By the contracts, for your contracts

1 · Solidity

The interface is the whole dependency. Both gate generations answer this exact selector, so a consumer written against the interface works unchanged when its gate is upgraded from the v1 registry to the v2 — which is why it imports the interface rather than a concrete gate type.

contracts/ITouchstoneGate.sol

// SPDX-License-Identifier: Apache-2.0
pragma solidity ^0.8.24;

interface ITouchstoneGate {
    function check(
        bytes32 assetKey
    ) external view returns (bool allowed, string memory reason);
}

And the consumer — the pattern the deployed GuardedAction contracts use, unchanged: ask the gate, revert with the gate's own reason string when it refuses, proceed when it permits. The gate address and the asset key are immutable constructor arguments, so a consumer cannot be quietly repointed after deployment.

your contract

ITouchstoneGate public immutable gate;
bytes32 public immutable assetKey;

function execute() external {
    (bool allowed, string memory reason) = gate.check(assetKey);
    if (!allowed) revert ActionRefused(assetKey, reason);
    // ... the action the policy guards
}

2 · TypeScript — the SDK

The SDK is published as touchstone-sdk on the public npm registry, built from this repository's sdk/ workspace. Building from a checkout stays supported and is what CI runs.

install

npm install touchstone-sdk ethers

# or from a checkout of this repository
git clone https://github.com/Ridwannurudeen/touchstone
cd touchstone/sdk
npm ci && npm run build && npm test

check, then act

import { JsonRpcProvider, Wallet } from "ethers";
import {
  AssetGateClient,
  DEPLOYMENTS,
  GuardedActionClient,
  POLICIES,
} from "touchstone-sdk";

const deployment = DEPLOYMENTS.xlayerMainnet;   // .xlayerTestnet for chain 1952
const provider = new JsonRpcProvider(rpcUrl, deployment.chainId);
const wallet = new Wallet(privateKey, provider);

// gate address: the AssetGate row for your chain in the table below
const gate = new AssetGateClient(
  gateAddress,
  POLICIES.disclosureFreshness.registryKey,
  wallet
);
const action = new GuardedActionClient(guardedActionAddress, wallet);

const decision = await gate.check();   // { allowed, reason }
if (decision.allowed) await action.execute();

AssetGateClient.demand() exercises the gate's state-changing path and rejects a known refusal before it submits anything. GuardedActionClient.execute(builderCodes) appends the canonical ERC-8021 attribution suffix when you pass a registered Builder Code. Touchstone's live Terminal uses f0axgs7smtk2nfa7; its first attributed mainnet execution is public. Integrators should register and pass their own code.

read the registry directly

import { RegistryV2Client, indexPublished, policyRegistryKey } from "touchstone-sdk";

const registry = new RegistryV2Client(registryAddress, provider);
const report = await registry.latestReport(POLICIES.navSettlement.registryKey);
// null until that key has a publication; otherwise reportDigest, policyId,
// policyRoot, controlSetRoot, evidenceRoot, approvalDigest, epochKey, status,
// observedAt, validUntil, publisher, sequence, parentDigest and reportURI.

const events = await indexPublished(provider, registryAddress, fromBlock, "latest");
// Published and Corrected, in canonical log order. Handle both kinds: a
// correction must not leave cached permissive state behind.

// Derive a key rather than hand-hashing one.
policyRegistryKey(POLICIES.navSettlement.assetKey, "nav-settlement", 1);

3 · Raw JSON-RPC — no dependencies at all

The selector is the first four bytes of keccak256("check(bytes32)"). Compute it rather than trusting it printed here — cast sig 'check(bytes32)', or keccak256(toUtf8Bytes("check(bytes32)")).slice(0, 10) in ethers. The calldata is that selector followed by the 32-byte registry key.

eth_call · X Layer mainnet

SELECTOR=399e0792                 # keccak256("check(bytes32)")[0:4]
KEY=a40f966944356ce543320f59f22ba003e3f0be28532bae029d4f9f9d05efc589
GATE=0xAac48DC261B04737FDCB101D5049395121034a83

curl -s https://rpc.xlayer.tech -H 'content-type: application/json' -d "{
  \"jsonrpc\":\"2.0\", \"id\":1, \"method\":\"eth_call\",
  \"params\":[{\"to\":\"$GATE\",\"data\":\"0x$SELECTOR$KEY\"},\"latest\"]
}"

The result is the ABI encoding of (bool allowed, string reason): the boolean in the first word, then the offset, length and bytes of the reason string. Against the disclosure-freshness key this gate answers (true, "allowed") as of the most recent publication window — the Policy Terminal reads it live rather than reprinting it. When a gate refuses, the reason is one of its own constants: unknown asset, status not allowed, observation too old, wrong publisher, control-set mismatch.