feat(profile): show product-referenced Seity profiles in a host drawer

README.md

@@ -658,6 +658,17 @@ private storage and attachment custody stay with the one page core.
 
 Picker rows show verified contact names, with a generic label for unnamed contacts; raw account IDs are not displayed.
 
+The multi-select picker opens with the current audience checked, preserves selections while searching, and applies them
+only with **Use selection**. Confirming no checked contacts removes everyone; **Cancel**, Escape, and the backdrop leave
+the audience unchanged. The original single-contact picker remains available.
+
+Contact names and account identities remain host-private. Products receive opaque contact handles and can reserve
+clipped label boxes on their surface; the host draws verified contact usernames, or account identifiers when no username
+is available, above the product frame. These labels do not require a shared profile or photo, and are independent of
+Profile avatar placement. Same-wallet contact-directory changes clear stale names and refresh the latest placement
+without waiting for the product to redraw. Product restart, navigation, wallet/session replacement, an empty placement,
+and frame teardown cancel pending refreshes and remove labels.
+
 Use the existing **List**, **Timeline**, and **Resolution** tabs for activity and diagnostics. Wallet does not duplicate
 their event viewer or capture controls.
 
@@ -700,6 +711,29 @@ funds or import a real wallet. Debug builds can still access real networks and s
 
 Keep `VITE_APP_DEBUG` unset or false in production builds.
 
+### Seity profiles
+
+Profile sharing uses the native core's separate **Profile Disclosure** consent. It does not authorize identity
+disclosure, transaction signing, spending, or statement submission. Dismissing a disclosure prompt leaves it undecided;
+an explicit denial is persisted by the core.
+
+The host resolves Seity contact references through the active network's registry and decrypts Bulletin content outside
+the product frame. Profile references are bearer capabilities: their storage follows the existing encrypted native
+wallet custody and wallet/network namespaces. A network without a configured registry has no contact profile to display.
+
+Profiles and contact-avatar layers are Solid host surfaces attached to the product's connection to the shared page core.
+Closing or retiring the connection aborts pending loads, removes its drawer and avatars, and releases decrypted image
+URLs. Profile content is self-described; verified Chat attribution confirms who shared a reference, not who an image
+depicts.
+
+Opening a contact without a received, live profile reference still opens the host drawer. It shows the host-verified
+contact name and **No information shared with you yet**, without an error style or an indefinite spinner. It does not
+claim the contact has never shared: information may not have reached this host yet. Availability stays private from the
+requesting product, whose completion reply is the same for shared and empty profiles. When a product-specific Chat name
+is unavailable, the drawer resolves it from the same wallet- and People-network-bound verified directory used by contact
+labels. This lookup never delays opening the drawer or returns the name to the requesting product. Missing or
+unavailable directory names retain generic attribution.
+
 ## Sandbox API Checker
 
 dApps rendered in dotli's sandboxed iframe should communicate exclusively through the container bridge (postMessage),

apps/protocol/src/engine.ts

@@ -11,6 +11,7 @@ import type {
   ManifestResult,
   RootManifest,
   ResolveOptions,
+  SeitySlot,
 } from '@dotli/resolver';
 import { isExecutableKind } from '@dotli/shared';
 import {
@@ -52,6 +53,7 @@ export interface EngineOptions {
    *  `@dotli/resolver` entry points so they can be wired by reference. */
   resolveDotName?: (label: string, opts?: ResolveOptions) => Promise<string | null>;
   resolveOwner?: (label: string, opts?: ResolveOptions) => Promise<string | null>;
+  resolveSeitySlot?: (lookupKey: `0x${string}`, opts?: ResolveOptions) => Promise<SeitySlot | null>;
   /**
    * Product-manifest readers.
    *
@@ -157,6 +159,23 @@ export function createEngine(options: EngineOptions): ProtocolEngine {
         return;
       }
 
+      case 'resolveSeitySlot': {
+        if (!options.resolveSeitySlot) {
+          throw new Error(PROTOCOL_APP_ERRORS.RESOLVE_SEITY_SLOT_UNSUPPORTED);
+        }
+        const payload = request.payload as ProtocolRequestMap['resolveSeitySlot'];
+        assertStr(payload.lookupKey, 'lookupKey');
+        const slot = await options.resolveSeitySlot(payload.lookupKey as `0x${string}`, syncOptions);
+        respond({
+          namespace: 'dotli:protocol',
+          kind: 'response',
+          id: request.id,
+          ok: true,
+          result: slot === null ? null : { ...slot, version: slot.version.toString() },
+        });
+        return;
+      }
+
       case 'resolveOwner': {
         if (!options.resolveOwner) {
           throw new Error(PROTOCOL_APP_ERRORS.RESOLVE_OWNER_UNSUPPORTED);

apps/protocol/src/errors.ts

@@ -14,6 +14,7 @@ export const PROTOCOL_APP_ERRORS = {
   INVALID_SHARED_AUTH_VALUE: 'Invalid shared auth value',
   RESOLVE_DOT_NAME_UNSUPPORTED: 'resolveDotName is not served by this protocol mode',
   RESOLVE_OWNER_UNSUPPORTED: 'resolveOwner is not served by this protocol mode',
+  RESOLVE_SEITY_SLOT_UNSUPPORTED: 'resolveSeitySlot is not served by this protocol mode',
   RESOLVE_EXECUTABLE_MANIFEST_UNSUPPORTED: 'resolveExecutableManifest is not served by this protocol mode',
   RESOLVE_ROOT_MANIFEST_UNSUPPORTED: 'resolveRootManifest is not served by this protocol mode',
   CHAIN_BROKER_FAILED: 'Failed to create chain broker',

apps/protocol/src/main.ts

@@ -858,6 +858,7 @@ async function initDirectMode(): Promise<void> {
     resolveExecutableManifest,
     resolveOwner,
     resolveRootManifest,
+    resolveSeitySlot,
     setResolverAssetHubProvider,
     setResolverPeopleProvider,
     waitForPeopleFinalized,
@@ -1014,6 +1015,7 @@ async function initDirectMode(): Promise<void> {
     },
     resolveDotName,
     resolveOwner,
+    resolveSeitySlot,
     resolveExecutableManifest,
     resolveRootManifest,
   });

apps/protocol/src/protocol-shared-worker.ts

@@ -25,6 +25,7 @@ import {
   resolveExecutableManifest,
   resolveOwner,
   resolveRootManifest,
+  resolveSeitySlot,
   setResolverAssetHubProvider,
   setResolverPeopleProvider,
   waitForAssetHubFinalized,
@@ -368,6 +369,20 @@ async function handleRequest(port: MessagePort, request: ProtocolRequestEnvelope
       return;
     }
 
+    case 'resolveSeitySlot': {
+      const payload = request.payload as ProtocolRequestMap['resolveSeitySlot'];
+      assertString(payload.lookupKey, 'lookupKey');
+      const slot = await resolveSeitySlot(payload.lookupKey as `0x${string}`, syncOptions);
+      sendToPort(port, {
+        namespace: 'dotli:protocol',
+        kind: 'response',
+        id: request.id,
+        ok: true,
+        result: slot === null ? null : { ...slot, version: slot.version.toString() },
+      });
+      return;
+    }
+
     case 'resolveOwner': {
       const payload = request.payload as ProtocolRequestMap['resolveOwner'];
       assertString(payload.label, 'label');

docs/resolution-design.md

@@ -10,6 +10,16 @@
 
 ![Shared Smoldot](assets/smoldot-shared.svg)
 
+### Seity profile resolution
+
+Seity profile reads use `resolveSeitySlot` through the canonical iframe engine
+(`apps/protocol/src/engine.ts`) or the SharedWorker request handler. Both preserve
+the resolver sync deadline and serialize the slot's bigint version as a decimal
+string. Gateway mode instead calls `resolveSeitySlotViaRpc` directly. All three
+paths use the same pinned `withContract` registry reader; an unconfigured registry
+returns `null`. Profile resolution shares the canonical chain-pool lifecycle and
+stopped-chain recovery rather than maintaining a separate engine or RPC retry loop.
+
 ## Appendix
 
 Table I - Cold-start latency distribution. End-to-end domain resolution across 20 runs (2026-04-24). The *actor* column matches the components in the Architecture Overview above.

packages/config/src/network.ts

@@ -63,6 +63,8 @@ export interface ServicesConfig {
     readonly decimals: number;
   };
   readonly dotns: DotnsContracts;
+  /** Seity's slot registry on Asset Hub; absent where Seity is not deployed. */
+  readonly seity?: { readonly REGISTRY: string };
 }
 
 const BUILTIN_NETWORK_SERVICES: Record<NetworkName, ServicesConfig> = {
@@ -105,6 +107,8 @@ const BUILTIN_NETWORK_SERVICES: Record<NetworkName, ServicesConfig> = {
       STORAGE_SLOTS: { REGISTRY_RECORDS: 0, CONTENTHASH: 0, TEXT_RECORDS: 1 },
       TLD: 'paseo',
     },
+    // paritytech/seity registry/deployments/paseo-next-v2/deployment.json
+    seity: { REGISTRY: '0x90ddece099d26f66d13bb46b9db49dbb2083cb15' },
   },
   [NetworkName.PREVIEWNET]: {
     label: 'Previewnet',

packages/content/src/index.ts

@@ -9,6 +9,6 @@ export { bitswapGet, listenForSandboxBitswap, onContentProgress } from './bitswa
 export { decryptContent, isEncrypted } from './decrypt.js';
 export { type FetchResult } from './fetch.js';
 export { fetchFromIpfs } from './ipfs.js';
-export { computePreimageKey, hashToCid } from './preimage.js';
+export { cidToPreimageKey, computePreimageKey, hashToCid } from './preimage.js';
 export { assertBlockMatchesCid } from './verify.js';
 export { loadFetch, type FetchModule } from './lazy.js';

packages/content/src/preimage.ts

@@ -30,3 +30,21 @@ export function hashToCid(hashHex: string): CID {
   const digest = create(BLAKE2B_256_MULTIHASH_CODE, fromHex(hashHex));
   return CID.createV1(RAW_CID_CODEC, digest);
 }
+
+/**
+ * Inverse of `hashToCid`: the Blake2b-256 preimage key a Bulletin CID names.
+ * Throws for any CID that is not CIDv1 raw with a Blake2b-256 multihash, the
+ * only shape the preimage API content-addresses.
+ */
+export function cidToPreimageKey(cid: string): `0x${string}` {
+  const parsed = CID.parse(cid);
+  if (
+    parsed.version !== 1 ||
+    parsed.code !== RAW_CID_CODEC ||
+    parsed.multihash.code !== BLAKE2B_256_MULTIHASH_CODE ||
+    parsed.multihash.digest.length !== 32
+  ) {
+    throw new Error(`${cid} is not a raw Blake2b-256 CIDv1`);
+  }
+  return toHex(parsed.multihash.digest);
+}

packages/protocol/src/client.ts

@@ -656,7 +656,8 @@ async function postRequest<M extends ProtocolRequestMethod>(
     frameWindow.postMessage(envelope, getProtocolOrigin());
   });
 }
-type ResolverRequestMethod = 'resolveDotName' | 'resolveOwner' | 'resolveExecutableManifest' | 'resolveRootManifest';
+type ResolverRequestMethod =
+  'resolveDotName' | 'resolveOwner' | 'resolveSeitySlot' | 'resolveExecutableManifest' | 'resolveRootManifest';
 
 function isStoppedResolverResponse(error: unknown): error is Error {
   return (
@@ -700,6 +701,20 @@ export async function resolveOwnerRemote(label: string): Promise<string | null>
   return (await postResolverRequest('resolveOwner', { label })) as string | null;
 }
 
+/** A Seity registry slot as the protocol returns it; `version` is a decimal string. */
+export interface RemoteSeitySlot {
+  readonly owner: `0x${string}`;
+  readonly cidDigest: `0x${string}`;
+  readonly version: string;
+}
+
+/** Remote proxy for the Seity registry reader (null when the registry is absent). */
+export async function resolveSeitySlotRemote(lookupKey: `0x${string}`): Promise<RemoteSeitySlot | null> {
+  return (await postResolverRequest('resolveSeitySlot', {
+    lookupKey,
+  })) as RemoteSeitySlot | null;
+}
+
 /**
  * Remote proxy for the executable-manifest reader.
  *

packages/protocol/src/index.ts

@@ -49,6 +49,7 @@ export {
   resolveExecutableManifestRemote,
   resolveOwnerRemote,
   resolveRootManifestRemote,
+  resolveSeitySlotRemote,
   setProtocolSubMode,
   subscribeSharedAuthStorage,
   subscribeSharedWallet,
@@ -57,6 +58,7 @@ export {
   warmupProtocol,
   writeSharedAuthStorage,
   writeSharedModeStorage,
+  type RemoteSeitySlot,
 } from './client.js';
 export { CORE_CUSTODY_BUSY_ERROR, isCoreCustodyOperation, type CoreCustodyOperation } from './core-custody.js';
 export { ProtocolFatalError, ProtocolInitFailedError } from './errors.js';

packages/protocol/src/messages.ts

@@ -11,6 +11,7 @@ export interface ProtocolRequestMap {
   warmup: Record<string, never>;
   resolveDotName: { label: string };
   resolveOwner: { label: string };
+  resolveSeitySlot: { lookupKey: string };
   resolveExecutableManifest: {
     label: string;
     kind: 'app' | 'widget' | 'worker';

packages/protocol/src/method-timeouts.ts

@@ -34,6 +34,7 @@ export const METHOD_TIMEOUTS: Partial<Record<ProtocolRequestMethod, number>> = {
   chainConnect: 30_000,
   resolveDotName: 90_000,
   resolveOwner: 90_000,
+  resolveSeitySlot: 90_000,
   resolveExecutableManifest: 30_000,
   resolveRootManifest: 30_000,
 };

packages/resolver/src/abi.ts

@@ -63,6 +63,21 @@ export function computeMappingSlot(key: `0x${string}`, slotNumber: number): `0x$
   return toHex(new Uint8Array(keccak_256(concatBytes(hexToBytes(key), slotBytes))));
 }
 
+/**
+ * Compute the slot for `mapping(bytes32 => mapping(bytes32 => T))` at slot N,
+ * which is also how a pvm-contract-sdk `Mapping<([u8; 32], [u8; 32]), T>`
+ * lays out (pvm-storage chains tuple keys like Solidity nested mappings):
+ *   keccak256(inner ++ keccak256(outer ++ uint256(N)))
+ */
+export function computeNestedBytes32MappingSlot(
+  outerKey: `0x${string}`,
+  innerKey: `0x${string}`,
+  slotNumber: number,
+): `0x${string}` {
+  const midSlot = computeMappingSlot(outerKey, slotNumber);
+  return toHex(new Uint8Array(keccak_256(concatBytes(hexToBytes(innerKey), hexToBytes(midSlot)))));
+}
+
 /**
  * Compute the data slot for long Solidity `bytes` storage.
  *

packages/resolver/src/index.ts

@@ -39,12 +39,14 @@ export {
   resolveExecutableManifest,
   resolveOwner,
   resolveRootManifest,
+  resolveSeitySlot,
   setResolverAssetHubProvider,
   setResolverPeopleProvider,
   waitForAssetHubFinalized,
   waitForPeopleFinalized,
   type ResolveOptions,
 } from './resolve.js';
+export { type SeitySlot } from './seity-registry.js';
 export { createCoreRpcChainProvider, getConnectedRpcEndpoint, isCoreRpcChainSupported } from './rpc-chain.js';
 export { type ChainTransportHooks, type ConnectionStatus } from './transport-hooks.js';
 export {

packages/resolver/src/resolve.ts

@@ -20,6 +20,7 @@ import type { PhaseCallback, StatusCallback } from './access-raw-storage.js';
 import { createRawApi, type Api } from './api.js';
 import { readExecutableManifest, readRootManifest } from './manifest.js';
 import type { ExecutableKind, ExecutableManifest, ManifestResult, RootManifest } from './manifest.js';
+import { readSeitySlot, type SeitySlot } from './seity-registry.js';
 
 export type { StatusCallback, PhaseCallback, ResolvePhase } from './access-raw-storage.js';
 export { statusToPhase } from './access-raw-storage.js';
@@ -359,3 +360,16 @@ async function readOwner(label: string, opts: ResolveOptions): Promise<string |
   const dotns = getActiveServicesConfig().dotns;
   return readMappingAddress(api, dotns.DOTNS_REGISTRY, node, dotns.STORAGE_SLOTS.REGISTRY_RECORDS);
 }
+
+/**
+ * Read one Seity registry slot on the active network's Asset Hub. Returns
+ * null when the network has no Seity registry configured.
+ */
+export async function resolveSeitySlot(lookupKey: `0x${string}`, opts: ResolveOptions = {}): Promise<SeitySlot | null> {
+  const registry = getActiveServicesConfig().seity?.REGISTRY;
+  if (registry === undefined) {
+    return null;
+  }
+  const api = await ensureClient(opts);
+  return readSeitySlot(api, registry, lookupKey);
+}

packages/resolver/src/rpc-resolve.ts

@@ -31,6 +31,7 @@ import { createRawApi, type Api } from './api.js';
 import { getConnectedRpcEndpoint } from './rpc-chain.js';
 import { readExecutableManifest, readRootManifest } from './manifest.js';
 import type { ExecutableKind, ExecutableManifest, ManifestResult, RootManifest } from './manifest.js';
+import { readSeitySlot, type SeitySlot } from './seity-registry.js';
 
 export type { StatusCallback } from './access-raw-storage.js';
 
@@ -225,6 +226,19 @@ export function resolveOwnerViaRpc(label: string): Promise<string | null> {
   });
 }
 
+/**
+ * Read one Seity registry slot over JSON-RPC: the gateway-mode counterpart of
+ * `resolveSeitySlot`. Null when the network has no Seity registry, matching
+ * the protocol-worker path.
+ */
+export async function resolveSeitySlotViaRpc(lookupKey: `0x${string}`): Promise<SeitySlot | null> {
+  const registry = getActiveServicesConfig().seity?.REGISTRY;
+  if (registry === undefined) {
+    return null;
+  }
+  return withRpcClient(api => readSeitySlot(api, registry, lookupKey));
+}
+
 /**
  * Return the Asset Hub RPC endpoint URI the shared chain connection is
  * currently on, or `null` while none is open. The URI may not be the first