Package manager
Mifa
Mifa is Astra's package manager — Cargo-shaped, agent-friendly, and built around one non-negotiable: the same inputs must always produce the same build.
WorkflowFrom zero to running project
$ mifa init myapp # scaffold astra.toml + src/main.astra
$ cd myapp
$ mifa add utils@1.0.0 # record a dependency in the manifest
$ mifa verify # typecheck the whole workspace, no codegen
$ mifa lock # write astra.lock (sha256-stable)
$ mifa run # compile + execute natively
$ mifa verify --json # same result as a machine-readable envelope
$ mifa login <token> # store a registry token (~/.mifa/credentials.toml)
$ mifa publish --dry-run # validate + archive + checksum, no upload
$ mifa clean --cache # drop target/ and ~/.mifa/cacheThe manifest is plain TOML:
[package]
name = "myapp"
version = "0.1.0"
[dependencies]
utils = "1.0.0"
local_lib = { path = "../local_lib" }DeterminismThe lockfile
mifa lock resolves the full dependency graph and writes
astra.lock — versioned, sorted, and content-hashed. Two
machines with the same manifest resolve identical graphs, byte for
byte. This was validated as differentiator D5: repeated locks of the
same workspace produce sha256-identical files.
Reproducibility matters twice over for Astra's mission. Humans get reliable CI; agents get a guarantee that a build that verified once will verify the same way again — no drifting dependencies invalidating an earlier repair loop.
StatusMifa milestones
| Milestone | Scope | Status |
|---|---|---|
| M1 — Honest local workflow | init / add / build / run / verify; 43-test integration suite |
shipped |
| M2 — Lockfile + cache | astra.lock, ~/.mifa/cache, path dependencies, lock / clean |
shipped |
| M5-basics — JSON output | --json on init/add/verify/test/lock/login/publish; stable envelope for agent consumption |
shipped |
| M3 — Registry protocol | /v1/packages v1 API, SHA-256 checksums, yanked-version handling, stable REG4xx error codes |
shipped |
| M4 — Publish + auth | mifa login (per-registry tokens), publish --dry-run (validation, deterministic archive, checksum) |
shipped |
| mifa.dev — Public registry | Hosted global registry with semantic versioning | v1.0 |
Honest note: the registry protocol is fully specified and tested against an in-memory implementation — checksums, yanked versions, auth, and publish validation all work — but there is no hosted registry yet; real uploads are blocked on deployment. Local workflows (init, add, verify, lock, run, path dependencies, JSON output, login, dry-run publish) are real and covered by 90+ tests.
DesignWhy not reuse an existing manager?
- Verification-first resolution.
mifa verifytypechecks the whole workspace — including dependencies — without generating code, so an agent can validate a project graph in milliseconds. - Lockfile as a contract. The lock isn't advisory; future registry fetches will refuse checksum mismatches outright.
- One tool, one mental model. Mifa wraps the same
compiler library the
astraCLI uses. Diagnostics, exit codes, and JSON shapes stay identical between both tools — every command supports--jsonand emits the samediagnostics[]envelope.