From cffe0942229ca227d1021fddc347afd031a31596 Mon Sep 17 00:00:00 2001
From: Ricardo <rick@rmendes.net>
Date: Sun, 22 Feb 2026 20:13:38 +0100
Subject: [PATCH] fix(compose): use HTTPS Note ID and add to/cc on Create
 activity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mastodon silently discards activities with urn:uuid: IDs since they
can't be dereferenced. Use an HTTPS URL under our domain instead.

Also add to/cc (Public + followers) on the Create wrapper activity,
not just the Note object — Mastodon requires addressing on both.
---
 lib/controllers/compose.js | 11 +++++++++--
 package.json               |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/controllers/compose.js b/lib/controllers/compose.js
index 3c197b9..fbd3b93 100644
--- a/lib/controllers/compose.js
+++ b/lib/controllers/compose.js
@@ -195,9 +195,14 @@ export function submitComposeController(mountPath, plugin) {
           { handle, publicationUrl: plugin._publicationUrl },
         );
 
-        const noteId = `urn:uuid:${crypto.randomUUID()}`;
+        const uuid = crypto.randomUUID();
+        const baseUrl = plugin._publicationUrl.replace(/\/$/, "");
+        const noteId = `${baseUrl}/activitypub/quick-replies/${uuid}`;
         const actorUri = ctx.getActorUri(handle);
 
+        const publicAddress = new URL(
+          "https://www.w3.org/ns/activitystreams#Public",
+        );
         const followersUri = ctx.getFollowersUri(handle);
         const note = new Note({
           id: new URL(noteId),
@@ -205,7 +210,7 @@ export function submitComposeController(mountPath, plugin) {
           content: content.trim(),
           inReplyTo: inReplyTo ? new URL(inReplyTo) : undefined,
           published: Temporal.Now.instant(),
-          to: new URL("https://www.w3.org/ns/activitystreams#Public"),
+          to: publicAddress,
           cc: followersUri,
         });
 
@@ -213,6 +218,8 @@ export function submitComposeController(mountPath, plugin) {
           id: new URL(`${noteId}#activity`),
           actor: actorUri,
           object: note,
+          to: publicAddress,
+          cc: followersUri,
         });
 
         // Send to followers
diff --git a/package.json b/package.json
index ca222dc..826ba1a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",