For developers and platforms
A provable ledger for credits, plans and bookings.
tfd replays Stripe events into double-entry books, signs Ed25519 receipts and seals months. Its source is public on GitHub and free to self-host, with a free CLI, open receipt and seal formats, and test vectors.
- Deterministic: the same events in give the same books and the same signatures out.
- Export to Parquet and hledger; verify receipts and seals with the CLI or your own code.
- Hosted service, a hash chain per event and the witness are on the roadmap.Next
$ tfd keys new --out keys --id juniper-2026-10
$ tfd receipt --root . --school sch_juniper --key keys/juniper-2026-10.private.pem --key-id juniper-2026-10 --event 01M41M0YW0JH3ARC874HFM8291 > receipt.json
$ tfd verify receipt receipt.json --keys keys/keys.json
{"ok":true}
$ sed -i '' 's/80000/120000/' receipt.json && tfd verify receipt receipt.json --keys keys/keys.json
{"ok":false,"reason":"bad_signature"}
Same numbers, three ways
Run the simulator.
A seeded school year through the engine, hledger and DuckDB, one KPI hash each. It needs bun. bun install sets up the whole monorepo workspace, not just the engine. hledger and DuckDB are optional: a channel that isn't installed is skipped, which is why the last line says “every channel that ran”. See the proof for the output and the end-to-end check.
$ git clone https://github.com/justbry/tfd && cd atm && bun install
$ cd packages/atm && bun ./src/bin.ts simulate --profile growth-12mo --seed 7
What would you simulate?
Turn the knobs.
Members, churn, refunds, yearly prepay, disputes, seat changes, upgrades, currency and Stripe's fees are all knobs. Presets cover a school, a studio, a church, a SaaS product and a course creator.
$ bun ./src/bin.ts simulate --profile monthly-members --set members=120 --set churnRate=0.05 --set refundRate=0.08 --set yearlyShare=0.3 --seed 42
scenario monthly-members (seed 42): 6186 events, 2026-01..2026-12
fixture hash 28e5497abeb025bb690f5a153178b9a09a81c4a13b2f2c2782224a52f03805b8
kpis hash by channel:
atm 0c3e6401efac297c624eaec4f108addfcd0a2b8eae031a3fee626284c605c41f
hledger 0c3e6401efac297c624eaec4f108addfcd0a2b8eae031a3fee626284c605c41f
duckdb 0c3e6401efac297c624eaec4f108addfcd0a2b8eae031a3fee626284c605c41f
parity: every channel that ran has the same hash
Any org, ad hoc
Simulate your own org.
Give an org and some knobs on stdin. The simulated SaaS product and course creator have their own pages: SaaS and digital products and creators and online courses. See where the simulations simplify.
$ echo '{"org":"creator","params":{"members":40,"refundRate":0.1}}' | bun ./src/bin.ts simulate --scenario - --json
What’s in the repository
- The engine (tfd): Stripe events in, double-entry books out, deterministic and replayable. Its source is public on GitHub and free to self-host, under FSL-1.1-ALv2 (source-available). Each release becomes Apache-2.0 two years after it ships.
- Signed receipts and sealed months: Ed25519 over a fixed canonical form (JSON with sorted keys). Receipts carry a sha256 of the event they came from; seals chain month to month.
- Open formats: JSON schemas for receipts and seals (Apache-2.0), golden test vectors (CC0-1.0), hledger journals and Parquet exports.
- A free CLI: make keys, print signed receipts, seal a month, verify receipts and seal chains, reconcile against Stripe.
The verifier on this site is a line-for-line port of the engine’s check to the browser, tested against the engine on the same samples. The verifier and receipt format are Apache-2.0.
Licenses
| Part | License |
|---|---|
| tfd engine and CLI | FSL-1.1-ALv2. Source-available and free to self-host. Each release becomes Apache-2.0 two years after it ships |
| Receipt and seal format, spec and verifier | Apache-2.0 |
| Test vectors | CC0-1.0 (public domain) |
| Hosted Trifold service, Rifo and the witness | Proprietary |
On the roadmap
The hosted service, a hash chain per event and Trifold as an independent witness are marked Next. The CLI is tfd (the atm command until the rename lands).
Read the source. Run the check.
Books ✓Receipt ✓Stripe ✓
The engine is source-available (FSL-1.1-ALv2); each release becomes Apache-2.0 after two years. The verifier and receipt format are Apache-2.0.