fix: use HTTPS activity IDs and add addressing for boost/like

Boost (Announce) was missing to/cc addressing so Mastodon silently
discarded it. Both boost and like used urn:uuid: IDs which are not
dereferenceable. Changed to HTTPS URLs and added Public/followers
addressing on Announce.

lib/controllers/interactions-boost.js

@@ -41,13 +41,22 @@ export function boostController(mountPath, plugin) {
         { handle, publicationUrl: plugin._publicationUrl },
       );
 
-      const activityId = `urn:uuid:${crypto.randomUUID()}`;
+      const uuid = crypto.randomUUID();
+      const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+      const activityId = `${baseUrl}/activitypub/boosts/${uuid}`;
+
+      const publicAddress = new URL(
+        "https://www.w3.org/ns/activitystreams#Public",
+      );
+      const followersUri = ctx.getFollowersUri(handle);
 
       // Construct Announce activity
       const announce = new Announce({
         id: new URL(activityId),
         actor: ctx.getActorUri(handle),
         object: new URL(url),
+        to: publicAddress,
+        cc: followersUri,
       });
 
       // Send to followers via shared inbox

lib/controllers/interactions-like.js

@@ -97,7 +97,9 @@ export function likeController(mountPath, plugin) {
       }
 
       // Generate a unique activity ID
-      const activityId = `urn:uuid:${crypto.randomUUID()}`;
+      const uuid = crypto.randomUUID();
+      const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+      const activityId = `${baseUrl}/activitypub/likes/${uuid}`;
 
       // Construct and send Like activity
       const like = new Like({

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",