Tollstile

Roadmap

What ships in v0.1, and what is out of scope.

Public Beta · early access

Tollstile is in early access. The core payment lifecycle is implemented, but some rails and runtime integrations still need production verification. The v0.1 release includes the implemented areas below.

v0.1

AreaContentsStatus
CoreQuotes, authorizations, charges on two axes, authorization and upfront flows, variable prices, dynamic prices, request commitment, execution plans and rail exclusion, payer-scoped idempotency and result references, structured denial codes/actions, redaction, reconciliation, eventsImplemented
ConformancerailConformance(), RailHarness, ConformanceCase from tollstile/testing; shared ledger testsImplemented; fake-provider coverage, with unsupported harness cases reported as skipped
Policies and requirementssubscriber, credits with reservations, payPerCall, limit, payers, whenImplemented
Test rail and memory ledgerFailure simulation, tollstile/testing contexts and fake clockImplemented
AdaptersHono, MCP, Express, create-tollstileImplemented; tested with the real frameworks. MCP tools can ask a person to approve a charge — rendered as an Accept / Decline dialog by Claude Code 2.1.186, measured — and send them somewhere to pay, which OpenAI's codex client opens
AdaptersNext.js, fetch (Workers, Deno, Bun)Implemented; fetch runs the live demo on Cloudflare Workers. Not yet run inside Next.js, or on Deno or Bun
Railsx402 (exact, upto), MPP (Stripe charge, Tempo charge), L402, KYAPayImplemented and tested against fakes, published vectors, and reference libraries. x402 exact also verified on Base Sepolia with a real USDC transfer, and MPP Stripe in Stripe test mode, each including retries, refunds, and reconciliation
RailsMPP Tempo sessionExperimental
RequirementsverifiedAgent() (Web Bot Auth)Implemented; tested against RFC vectors, not verified against a live agent
RequirementsuserMandate() (AP2)Experimental
CLInpx tollstile reconcile: resolve charges a crash left behind, from a config file or a cronImplemented
LedgersPostgres, SQLite (including D1)Implemented; tested on PGlite and node:sqlite, on a real PostgreSQL 16 server in CI under 100-way concurrency and crash recovery, and on D1 in the live demo

Still to verify

  • The remaining rails against their live providers: Tempo Moderato for MPP, LND on regtest for L402, the Skyfire sandbox for KYAPay.
  • x402's upto scheme, and any facilitator other than x402.org on a testnet.
  • Run the Next.js and fetch adapters inside Next.js and on Workers, Deno, and Bun, and the D1 and Neon ledger adapters against those services.

After v0.1

  • escrow flow (settle a deposit, then the final amount)
  • OpenTelemetry package built on onEvent

Experiments

Things being tried in the open. Not API, not a standard, and not covered by any compatibility promise — they live in examples until something outside this project uses them.

A published price list

An agent that must contract with a provider before it can call anything is not buying software at the moment it needs it. Paying needs a rail; knowing the price needs nothing at all, and there was no machine-readable way to ask.

The demo serves one at /.well-known/tollstile:

{
  "call": "POST /v1/summarize",
  "price": "up to $0.50, then $0.001 per word",
  "plan": {
    "pricing": "up_to",
    "commitment": "request",
    "access": ["credits", "payPerCall"],
    "rails": [{ "rail": "test", "flow": "authorization", "settles": "after_handler", "onHandlerFailure": "release" }]
  }
}

plan is not a description someone maintains beside the code: it is the route's ExecutionPlan, the same object the gate enforces, so a published price cannot drift from the charged one. The example agent reads it before spending anything.

What would move this out of Experiments: something other than this demo reading one. If that happens, most of it is already in core — ExecutionPlan carries all of plan — and the rest is a route that serves it.

Out of scope

Not plannedWhy
Commerce checkout protocols (ACP, UCP)Catalogs, carts, and orders are a different problem from per-call payment
Handling raw card dataCards go through a provider
Custody, swaps, or a tokenTollstile never takes custody of funds
Issuing agent identitiesTollstile verifies evidence; it does not issue it

On this page