Selling Elixir packages on Moatless

Not a software engineer? You don't really have to know this stuff! Your agent can figure out how to integrate the things you buy, and can help you with what makes sense for you to buy. This is for those who put code up for sale or for those who want to know how it works under the hood.

Elixir already has a well-worn way to sell a library: a private Hex repository. It's how Oban Pro is sold. You add the repository to Mix once, with a key, and then the package is a dependency like any other.

Moatless now has one of those for everyone. If your codebase is an Elixir package, you can sell it on Moatless, and buyers add it to their projects with mix deps.get. They can still clone it with git, like any other listing.

For sellers

You need a mix.exs with package config, a switch on your listing, and a release.

1. Package config in your mix.exs. That means a package entry in project/0, with your licenses, and your files if they aren't the usual ones (lib, priv, mix.exs, your README, license and changelog). Your version has to be a version like 1.2.0, and it has to go up with each release, since that's how Mix tells releases apart.

Moatless reads your mix.exs without running it. Almost every mix.exs is written in a way it understands: plain values, module attributes like @version, ~w and ~s sigils, and calls to the module's own functions without arguments, like deps(). If yours computes its config in a cleverer way, simplify project/0 and it'll work.

Your package can depend on any package from Hex.pm. Dependencies from a path or git can only be for development or tests (only: [:dev, :test]), since buyers couldn't get them.

2. Turn it on for your listing. On your listing's page under Sell, open Advanced and check Hex package. It's off by default.

3. Publish a release. Moatless reads your mix.exs, builds the package from the release, and your listing's page shows buyers how to add it. If it can't, the release isn't published, and you get an email (and a note on your listing's page) saying what to fix, down to the line in mix.exs it couldn't read.

A few things worth knowing:

• Package names are first come, first served. Every package on Moatless shares one repository, so like on Hex.pm, a name belongs to the first listing to release it. If yours is taken, give your package another name in mix.exs with package: [name: "..."].
• Which versions buyers get. Subscribers get every version you publish. Buyers who paid once get the versions up to the release they bought. As with every listing on Moatless, subscribers are only charged for the months in which you publish a release.
• Your agent can set it up. The Moatless skill knows about this setting, so your coding agent can turn it on when it creates the listing, and fix your mix.exs if a release fails.

For buyers

Once you've bought a package, you add Moatless's Hex repository once, and then depend on the package like any other.

1. Create an API key in your Moatless settings.

2. Add the repository. The listing's page on Moatless has the exact command, including the repository's key fingerprint, which Mix checks so you know you're talking to Moatless:

mix hex.repo add moatless https://moatless.store/hex \
  --fetch-public-key <fingerprint from the listing's page> \
  --auth-key $MOATLESS_API_KEY

You only do this once, and every package you buy on Moatless comes from the same repository.

3. Add the dependency to your mix.exs, with repo: "moatless", and fetch it:

{:acme_kit, "~> 1.0", repo: "moatless"}

mix deps.get

Its own dependencies from Hex.pm come from Hex.pm, as usual.

Updates. New versions you're entitled to show up like any other package update: run mix deps.update acme_kit. If you subscribe, that's every new version. If you bought it once, it's the versions up to the release you bought, and buying it again gets you the newest.

CI and deploys. Your build needs the repository too, so run the same mix hex.repo add command there, with an API key kept in your CI's secrets. You can revoke a key from your settings at any time.

Happy Hacking!

• Zach