Let quote authors fetch instruments

Private quote requests point the quoted author at the newly published
instrument, so the stored note has to authorize that actor to fetch it.
Add the quoted author to followers-only and direct quote audiences unless
that actor is already included by a mention.

#32 (comment)

Assisted-by: Codex:gpt-5.5

Author: dahlia

packages/botkit/src/session-impl.test.ts

@@ -554,6 +554,39 @@ test("SessionImpl.publish()", async (t) => {
     assert.deepStrictEqual(quote.quoteTarget?.id, originalMsg.id);
   });
 
+  await t.test("private quote includes quoted author in audience", async () => {
+    const originalAuthorId = new URL("https://remote.example/ap/actor/john");
+    const originalAuthor = new Person({
+      id: originalAuthorId,
+      preferredUsername: "john",
+    });
+    const originalPost = new Note({
+      id: new URL("https://remote.example/ap/note/private"),
+      content: "<p>Private post</p>",
+      attribution: originalAuthor,
+      to: new URL("https://remote.example/ap/actor/john/followers"),
+    });
+    const originalMsg = await createMessage<Note, void>(
+      originalPost,
+      session,
+      {},
+    );
+
+    for (const visibility of ["followers", "direct"] as const) {
+      ctx.sentActivities = [];
+      await session.publish(text`Private quote`, {
+        quoteTarget: originalMsg,
+        visibility,
+      });
+
+      const { activity } = ctx.sentActivities[0];
+      assert.ok(activity instanceof Create);
+      const object = await activity.getObject(ctx);
+      assert.ok(object instanceof Note);
+      assert.ok(object.toIds.includes(originalAuthorId));
+    }
+  });
+
   await t.test("poll single choice", async () => {
     ctx.sentActivities = [];
     const endTime = Temporal.Now.instant().add({ hours: 24 });

packages/botkit/src/session-impl.ts

@@ -288,6 +288,14 @@ export class SessionImpl<TContextData> implements Session<TContextData> {
         }),
       );
     }
+    const actorId = this.context.getActorUri(this.bot.identifier);
+    const quoteTargetActorId = options.quoteTarget?.actor.id;
+    const privateQuoteAudienceIds = quoteTargetActorId != null &&
+        quoteTargetActorId.href !== actorId.href &&
+        (visibility === "followers" || visibility === "direct") &&
+        !mentionedActorIds.some((id) => id.href === quoteTargetActorId.href)
+      ? [quoteTargetActorId]
+      : [];
     let inclusiveOptions: Note[] = [];
     let exclusiveOptions: Note[] = [];
     let voters: number | null = null;
@@ -327,10 +335,10 @@ export class SessionImpl<TContextData> implements Session<TContextData> {
       tags,
       interactionPolicy: serializeQuotePolicy(
         options.quotePolicy ?? this.bot.quotePolicy,
-        this.context.getActorUri(this.bot.identifier),
+        actorId,
         this.context.getFollowersUri(this.bot.identifier),
       ),
-      attribution: this.context.getActorUri(this.bot.identifier),
+      attribution: actorId,
       attachments: options.attachments ?? [],
       inclusiveOptions,
       exclusiveOptions,
@@ -342,8 +350,9 @@ export class SessionImpl<TContextData> implements Session<TContextData> {
         ? [
           this.context.getFollowersUri(this.bot.identifier),
           ...mentionedActorIds,
+          ...privateQuoteAudienceIds,
         ]
-        : mentionedActorIds,
+        : [...mentionedActorIds, ...privateQuoteAudienceIds],
       ccs: visibility === "public"
         ? [this.context.getFollowersUri(this.bot.identifier)]
         : visibility === "unlisted"