@fedify/vocab 2.4.0 → 2.4.1

package/dist-tests/vocab.test.mjs

@@ -1,10 +1,10 @@
 import { Temporal } from "temporal-polyfill";
 globalThis.addEventListener = () => {};
-import { A as Object$1, B as QuoteAuthorization, C as Intent, D as Measure, E as Link, F as Person, G as Tombstone, H as Reject, I as Place, L as PropertyValue, N as OrderedCollectionPage, O as Multikey, P as Organization, R as Proposal, S as Image, T as InteractionRule, U as Service, V as QuoteRequest, W as Source, X as vocab_exports, _ as FeaturedCollection, a as Application, b as Group, d as CryptographicKey, f as Delete, g as FeatureRequest, h as FeatureAuthorization, i as Announce, j as Offer, k as Note, l as Commitment, m as Endpoints, n as Activity, p as Document, r as Agreement, s as Collection, t as Accept, u as Create, v as FeaturedItem, w as InteractionPolicy, x as Hashtag, y as Follow, z as Question } from "./vocab-COZcxf00.mjs";
-import { t as esm_default } from "./esm-DP2Spt0u.mjs";
+import { A as Object$1, B as QuoteAuthorization, C as Intent, D as Measure, E as Link, F as Person, G as Tombstone, H as Reject, I as Place, L as PropertyValue, N as OrderedCollectionPage, O as Multikey, P as Organization, R as Proposal, S as Image, T as InteractionRule, U as Service, V as QuoteRequest, W as Source, X as vocab_exports, _ as FeaturedCollection, a as Application, b as Group, d as CryptographicKey, f as Delete, g as FeatureRequest, h as FeatureAuthorization, i as Announce, j as Offer, k as Note, l as Commitment, m as Endpoints, n as Activity, p as Document, r as Agreement, s as Collection, t as Accept, u as Create, v as FeaturedItem, w as InteractionPolicy, x as Hashtag, y as Follow, z as Question } from "./vocab-DaniQwU7.mjs";
+import { t as esm_default } from "./esm-YWo4aQQe.mjs";
 import { t as assertInstanceOf } from "./utils-Df2odC27.mjs";
 import { mockDocumentLoader, test } from "@fedify/fixture";
-import { deepStrictEqual, notDeepStrictEqual, ok, rejects, throws } from "node:assert/strict";
+import { deepStrictEqual, notDeepStrictEqual, ok, rejects, strictEqual, throws } from "node:assert/strict";
 import { FetchError, LanguageString, decodeMultibase, getDocumentLoader, parseDecimal, parseIri } from "@fedify/vocab-runtime";
 import { configure, reset } from "@logtape/logtape";
 import { pascalCase } from "es-toolkit";
@@ -281,6 +281,61 @@ test("Note.fromJsonLd() ignores malformed language tags in nested objects", asyn
 	const attachment = (await note.toJsonLd()).attachment;
 	deepStrictEqual(attachment.nameMap, { en: "Valid" });
 });
+test("Note.fromJsonLd() normalizes extlang language tags", async () => {
+	const json = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		type: "Note",
+		content: "<p>早晨</p>",
+		contentMap: {
+			"zh-YUE": "<p>早晨</p>",
+			"yue": "<p>早晨呀</p>"
+		}
+	};
+	const note = await Note.fromJsonLd(json);
+	deepStrictEqual(note.contents, [
+		"<p>早晨</p>",
+		new LanguageString("<p>早晨呀</p>", "yue"),
+		new LanguageString("<p>早晨</p>", "yue")
+	]);
+	deepStrictEqual(note.contents.map((c) => typeof c === "string" ? null : c.locale.baseName), [
+		null,
+		"yue",
+		"yue"
+	]);
+	deepStrictEqual(await note.toJsonLd(), json);
+	deepStrictEqual((await note.toJsonLd({ format: "compact" })).contentMap, { yue: ["<p>早晨呀</p>", "<p>早晨</p>"] });
+	deepStrictEqual((await note.toJsonLd({ format: "expand" }))[0]["https://www.w3.org/ns/activitystreams#content"], [
+		{ "@value": "<p>早晨</p>" },
+		{
+			"@value": "<p>早晨呀</p>",
+			"@language": "yue"
+		},
+		{
+			"@value": "<p>早晨</p>",
+			"@language": "yue"
+		}
+	]);
+	const expandedNote = await Note.fromJsonLd({
+		"@type": ["https://www.w3.org/ns/activitystreams#Note"],
+		"https://www.w3.org/ns/activitystreams#name": [{
+			"@value": "早晨",
+			"@language": "zh-yue-HK"
+		}]
+	});
+	deepStrictEqual(expandedNote.names, [new LanguageString("早晨", "yue-HK")]);
+	deepStrictEqual(expandedNote.names[0].locale.baseName, "yue-HK");
+});
+test("Note.fromJsonLd() caches original language tags", async () => {
+	const json = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		type: "Note",
+		contentMap: { "EN-us": "Hello" }
+	};
+	const note = await Note.fromJsonLd(json);
+	deepStrictEqual(note.contents, [new LanguageString("Hello", "en-US")]);
+	deepStrictEqual(note.contents[0].locale.baseName, "en-US");
+	deepStrictEqual(await note.toJsonLd(), json);
+});
 test("Note.toJsonLd()", async () => {
 	const note = new Note({ tags: [new Hashtag({
 		name: "#Fedify",
@@ -2557,6 +2612,22 @@ test("Link.fromJsonLd()", async () => {
 		"href": "at://did:plc:ia76kvnndjutgedggx2ibrem"
 	})).href, new URL("at://did%3Aplc%3Aia76kvnndjutgedggx2ibrem"));
 });
+test("Link.fromJsonLd() normalizes extlang hreflang", async () => {
+	const link = await Link.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		type: "Link",
+		href: "https://example.com/yue",
+		hreflang: "zh-YUE"
+	});
+	deepStrictEqual(link.language?.baseName, "yue");
+	deepStrictEqual((await link.toJsonLd({ format: "compact" })).hreflang, "yue");
+	await rejects(() => Link.fromJsonLd({
+		"@context": "https://www.w3.org/ns/activitystreams",
+		type: "Link",
+		href: "https://example.com/en",
+		hreflang: "en-USA"
+	}), RangeError);
+});
 test("Person.fromJsonLd() with relative URLs", async () => {
 	deepStrictEqual((await (await Person.fromJsonLd({
 		"@context": ["https://www.w3.org/ns/activitystreams", "https://w3id.org/security/v1"],
@@ -2970,6 +3041,158 @@ test("FEP-fe34: Trust tracking in object cloning", () => {
 	});
 	deepStrictEqual(create.clone({ object: newNote }).objectId, new URL("https://example.com/new-note"));
 });
+for (const property of ["object", "attachment"]) for (const fetchOriginal of [false, true]) test(`clone() isolates ${property} dereferencing (${fetchOriginal ? "original" : "clone"} first)`, async () => {
+	const embedded = {
+		id: "https://b.example/notes/1",
+		type: "Note",
+		content: "embedded"
+	};
+	const json = {
+		"@context": "https://www.w3.org/ns/activitystreams",
+		id: "https://a.example/activities/1",
+		type: "Create",
+		[property]: embedded
+	};
+	const original = await Create.fromJsonLd(json, { contextLoader: mockDocumentLoader });
+	const copy = original.clone();
+	const fetching = fetchOriginal ? original : copy;
+	const untouched = fetchOriginal ? copy : original;
+	let fetches = 0;
+	const documentLoader = async (url) => {
+		fetches++;
+		return {
+			contextUrl: null,
+			documentUrl: url,
+			document: {
+				"@context": "https://www.w3.org/ns/activitystreams",
+				...embedded,
+				content: "fetched"
+			}
+		};
+	};
+	const options = {
+		documentLoader,
+		contextLoader: mockDocumentLoader
+	};
+	const fetched = property === "object" ? await fetching.getObject(options) : (await Array.fromAsync(fetching.getAttachments(options)))[0];
+	assertInstanceOf(fetched, Note);
+	deepStrictEqual(fetched.content, "fetched");
+	const trusted = { crossOrigin: "trust" };
+	const preserved = property === "object" ? await untouched.getObject(trusted) : (await Array.fromAsync(untouched.getAttachments(trusted)))[0];
+	assertInstanceOf(preserved, Note);
+	deepStrictEqual(preserved.content, "embedded");
+	deepStrictEqual((await original.toJsonLd())[property], fetchOriginal ? {
+		...embedded,
+		content: "fetched"
+	} : embedded);
+	const nested = (await new Accept({ object: untouched }).toJsonLd()).object;
+	deepStrictEqual(nested[property], embedded);
+	strictEqual(property === "object" ? await fetching.getObject(options) : (await Array.fromAsync(fetching.getAttachments(options)))[0], fetched);
+	deepStrictEqual(fetches, 1);
+	const independentlyFetched = property === "object" ? await untouched.getObject(options) : (await Array.fromAsync(untouched.getAttachments(options)))[0];
+	assertInstanceOf(independentlyFetched, Note);
+	deepStrictEqual(independentlyFetched.content, "fetched");
+	deepStrictEqual(fetches, 2);
+	const warmedClone = fetching.clone();
+	strictEqual(property === "object" ? await warmedClone.getObject(options) : (await Array.fromAsync(warmedClone.getAttachments(options)))[0], fetched);
+	deepStrictEqual(fetches, 2);
+});
+for (const clone of [false, true]) for (const frozen of [false, true]) test(`${clone ? "clone()" : "constructor"} copies ${frozen ? "frozen" : "mutable"} plural arrays`, async () => {
+	const items = [new URL("https://example.com/object"), new URL("https://example.com/object")];
+	const before = items.slice();
+	if (frozen) globalThis.Object.freeze(items);
+	const base = new Collection({});
+	const collection = clone ? base.clone({ items }) : new Collection({ items });
+	const sibling = clone ? base.clone({ items }) : new Collection({ items });
+	const fetched = await Array.fromAsync(collection.getItems({
+		documentLoader: mockDocumentLoader,
+		contextLoader: mockDocumentLoader
+	}));
+	deepStrictEqual(fetched.length, 2);
+	deepStrictEqual(fetched.map((item) => item.name), ["Fetched object", "Fetched object"]);
+	deepStrictEqual(items, before);
+	strictEqual(items[0], before[0]);
+	strictEqual(items[1], before[1]);
+	deepStrictEqual((await sibling.toJsonLd()).items, before.map(String));
+	if (!frozen) {
+		items.push(new URL("https://example.com/extra"));
+		deepStrictEqual(collection.itemIds, before);
+		deepStrictEqual(sibling.itemIds, before);
+	}
+});
+test("clone() copies scalar arrays without changing sparse inputs", () => {
+	const names = ["original"];
+	const original = new Object$1({ names });
+	names.push("caller mutation");
+	deepStrictEqual(original.names, ["original"]);
+	const copy = original.clone();
+	copy.names.push("clone mutation");
+	deepStrictEqual(original.names, ["original"]);
+	deepStrictEqual(copy.names, ["original", "clone mutation"]);
+	const replacements = ["replacement"];
+	const replaced = original.clone({ names: replacements });
+	replacements.push("caller mutation");
+	deepStrictEqual(replaced.names, ["replacement"]);
+	const sparseNames = new Array(2);
+	sparseNames[1] = "kept";
+	const sparse = new Object$1({ names: sparseNames });
+	for (const instance of [
+		sparse,
+		sparse.clone(),
+		sparse.clone({ names: sparse.names })
+	]) {
+		deepStrictEqual(instance.names.length, 2);
+		deepStrictEqual(0 in instance.names, false);
+		deepStrictEqual(instance.names[1], "kept");
+	}
+});
+test("clone() preserves embedded object identity and trust", async () => {
+	const note = new Note({ id: new URL("https://b.example/note") });
+	const original = new Create({
+		id: new URL("https://a.example/create"),
+		object: note
+	});
+	const documentLoader = async () => {
+		throw new Error("Trusted embedded objects must not be fetched.");
+	};
+	for (const instance of [
+		original,
+		original.clone(),
+		original.clone({ objects: [note] })
+	]) {
+		strictEqual(await instance.getObject({ documentLoader }), note);
+		strictEqual(instance.objectId, note.id);
+	}
+});
+test("clone() isolates crossOrigin trust when fetching", async () => {
+	const original = new Create({
+		id: new URL("https://a.example/create"),
+		object: new URL("https://b.example/note")
+	});
+	const copy = original.clone();
+	const documentLoader = async (url) => ({
+		contextUrl: null,
+		documentUrl: url,
+		document: {
+			"@context": "https://www.w3.org/ns/activitystreams",
+			id: "https://other.example/note",
+			type: "Note",
+			content: "cross-origin"
+		}
+	});
+	const options = {
+		documentLoader,
+		contextLoader: mockDocumentLoader
+	};
+	const trusted = await copy.getObject({
+		...options,
+		crossOrigin: "trust"
+	});
+	assertInstanceOf(trusted, Note);
+	deepStrictEqual(trusted.content, "cross-origin");
+	deepStrictEqual(await original.getObject(options), null);
+	deepStrictEqual(original.objectId, new URL("https://b.example/note"));
+});
 test("FEP-fe34: crossOrigin ignore behavior (default)", async () => {
 	const crossOriginDocumentLoader = async (url) => {
 		if (url === "https://different-origin.com/note") return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",
@@ -43,9 +43,9 @@
     "jsonld": "^9.0.0",
     "pkijs": "^3.3.3",
     "temporal-polyfill": "^1.0.1",
-    "@fedify/vocab-tools": "2.4.0",
-    "@fedify/webfinger": "2.4.0",
-    "@fedify/vocab-runtime": "2.4.0"
+    "@fedify/vocab-tools": "2.4.1",
+    "@fedify/webfinger": "2.4.1",
+    "@fedify/vocab-runtime": "2.4.1"
   },
   "devDependencies": {
     "@types/node": "^24.12.2",

package/src/vocab.test.ts

@@ -23,6 +23,7 @@ import {
   notDeepStrictEqual,
   ok,
   rejects,
+  strictEqual,
   throws,
 } from "node:assert/strict";
 import { inspect } from "node:util";
@@ -438,6 +439,77 @@ test("Note.fromJsonLd() ignores malformed language tags in nested objects", asyn
   deepStrictEqual(attachment.nameMap, { en: "Valid" });
 });
 
+test("Note.fromJsonLd() normalizes extlang language tags", async () => {
+  const json = {
+    "@context": "https://www.w3.org/ns/activitystreams",
+    type: "Note",
+    content: "<p>早晨</p>",
+    contentMap: {
+      "zh-YUE": "<p>早晨</p>",
+      "yue": "<p>早晨呀</p>",
+    },
+  };
+  const note = await Note.fromJsonLd(json);
+  // JSON-LD expansion sorts language map keys, so yue comes before zh-yue:
+  deepStrictEqual(note.contents, [
+    "<p>早晨</p>",
+    new LanguageString("<p>早晨呀</p>", "yue"),
+    new LanguageString("<p>早晨</p>", "yue"),
+  ]);
+  deepStrictEqual(
+    note.contents.map((c) => typeof c === "string" ? null : c.locale.baseName),
+    [null, "yue", "yue"],
+  );
+
+  // The unmodified object is serialized from the cached original document:
+  deepStrictEqual(await note.toJsonLd(), json);
+  const compact = await note.toJsonLd({ format: "compact" }) as Record<
+    string,
+    unknown
+  >;
+  deepStrictEqual(compact.contentMap, {
+    yue: ["<p>早晨呀</p>", "<p>早晨</p>"],
+  });
+  const expanded = await note.toJsonLd({ format: "expand" });
+  deepStrictEqual(
+    (expanded as Record<string, unknown>[])[0][
+      "https://www.w3.org/ns/activitystreams#content"
+    ],
+    [
+      { "@value": "<p>早晨</p>" },
+      { "@value": "<p>早晨呀</p>", "@language": "yue" },
+      { "@value": "<p>早晨</p>", "@language": "yue" },
+    ],
+  );
+
+  const expandedNote = await Note.fromJsonLd({
+    "@type": ["https://www.w3.org/ns/activitystreams#Note"],
+    "https://www.w3.org/ns/activitystreams#name": [
+      { "@value": "早晨", "@language": "zh-yue-HK" },
+    ],
+  });
+  deepStrictEqual(expandedNote.names, [new LanguageString("早晨", "yue-HK")]);
+  deepStrictEqual(
+    (expandedNote.names[0] as LanguageString).locale.baseName,
+    "yue-HK",
+  );
+});
+
+test("Note.fromJsonLd() caches original language tags", async () => {
+  const json = {
+    "@context": "https://www.w3.org/ns/activitystreams",
+    type: "Note",
+    contentMap: { "EN-us": "Hello" },
+  };
+  const note = await Note.fromJsonLd(json);
+  deepStrictEqual(note.contents, [new LanguageString("Hello", "en-US")]);
+  deepStrictEqual(
+    (note.contents[0] as LanguageString).locale.baseName,
+    "en-US",
+  );
+  deepStrictEqual(await note.toJsonLd(), json);
+});
+
 test("Note.toJsonLd()", async () => {
   const note = new Note({
     tags: [
@@ -3852,6 +3924,29 @@ test("Link.fromJsonLd()", async () => {
   );
 });
 
+test("Link.fromJsonLd() normalizes extlang hreflang", async () => {
+  const link = await Link.fromJsonLd({
+    "@context": "https://www.w3.org/ns/activitystreams",
+    type: "Link",
+    href: "https://example.com/yue",
+    hreflang: "zh-YUE",
+  });
+  deepStrictEqual(link.language?.baseName, "yue");
+  const compact = await link.toJsonLd({ format: "compact" }) as Record<
+    string,
+    unknown
+  >;
+  deepStrictEqual(compact.hreflang, "yue");
+
+  await rejects(() =>
+    Link.fromJsonLd({
+      "@context": "https://www.w3.org/ns/activitystreams",
+      type: "Link",
+      href: "https://example.com/en",
+      hreflang: "en-USA",
+    }), RangeError);
+});
+
 test("Person.fromJsonLd() with relative URLs", async () => {
   const json = {
     "@context": [
@@ -4437,6 +4532,216 @@ test("FEP-fe34: Trust tracking in object cloning", () => {
   );
 });
 
+for (const property of ["object", "attachment"] as const) {
+  for (const fetchOriginal of [false, true]) {
+    test(
+      `clone() isolates ${property} dereferencing (${
+        fetchOriginal ? "original" : "clone"
+      } first)`,
+      async () => {
+        const embedded = {
+          id: "https://b.example/notes/1",
+          type: "Note",
+          content: "embedded",
+        };
+        const json = {
+          "@context": "https://www.w3.org/ns/activitystreams",
+          id: "https://a.example/activities/1",
+          type: "Create",
+          [property]: embedded,
+        };
+        const original = await Create.fromJsonLd(json, {
+          contextLoader: mockDocumentLoader,
+        });
+        const copy = original.clone();
+        const fetching = fetchOriginal ? original : copy;
+        const untouched = fetchOriginal ? copy : original;
+        let fetches = 0;
+        // deno-lint-ignore require-await
+        const documentLoader = async (url: string) => {
+          fetches++;
+          return {
+            contextUrl: null,
+            documentUrl: url,
+            document: {
+              "@context": "https://www.w3.org/ns/activitystreams",
+              ...embedded,
+              content: "fetched",
+            },
+          };
+        };
+        const options = { documentLoader, contextLoader: mockDocumentLoader };
+        const fetched = property === "object"
+          ? await fetching.getObject(options)
+          : (await Array.fromAsync(fetching.getAttachments(options)))[0];
+        assertInstanceOf(fetched, Note);
+        deepStrictEqual(fetched.content, "fetched");
+
+        // Inspect the other instance before it fetches anything itself.
+        const trusted = { crossOrigin: "trust" as const };
+        const preserved = property === "object"
+          ? await untouched.getObject(trusted)
+          : (await Array.fromAsync(untouched.getAttachments(trusted)))[0];
+        assertInstanceOf(preserved, Note);
+        deepStrictEqual(preserved.content, "embedded");
+        const serialized = await original.toJsonLd() as Record<string, unknown>;
+        deepStrictEqual(
+          serialized[property],
+          fetchOriginal ? { ...embedded, content: "fetched" } : embedded,
+        );
+        const accept = new Accept({ object: untouched });
+        const acceptJson = await accept.toJsonLd() as {
+          object: Record<string, unknown>;
+        };
+        const nested = acceptJson.object;
+        deepStrictEqual(nested[property], embedded);
+
+        // Successful lookups and their trust metadata belong to each instance.
+        const cached = property === "object"
+          ? await fetching.getObject(options)
+          : (await Array.fromAsync(fetching.getAttachments(options)))[0];
+        strictEqual(cached, fetched);
+        deepStrictEqual(fetches, 1);
+        const independentlyFetched = property === "object"
+          ? await untouched.getObject(options)
+          : (await Array.fromAsync(untouched.getAttachments(options)))[0];
+        assertInstanceOf(independentlyFetched, Note);
+        deepStrictEqual(independentlyFetched.content, "fetched");
+        deepStrictEqual(fetches, 2);
+        const warmedClone = fetching.clone();
+        strictEqual(
+          property === "object"
+            ? await warmedClone.getObject(options)
+            : (await Array.fromAsync(warmedClone.getAttachments(options)))[0],
+          fetched,
+        );
+        deepStrictEqual(fetches, 2);
+      },
+    );
+  }
+}
+
+for (const clone of [false, true]) {
+  for (const frozen of [false, true]) {
+    test(
+      `${clone ? "clone()" : "constructor"} copies ${
+        frozen ? "frozen" : "mutable"
+      } plural arrays`,
+      async () => {
+        const items = [
+          new URL("https://example.com/object"),
+          new URL("https://example.com/object"),
+        ];
+        const before = items.slice();
+        if (frozen) globalThis.Object.freeze(items);
+        const base = new Collection({});
+        const collection = clone
+          ? base.clone({ items })
+          : new Collection({ items });
+        const sibling = clone
+          ? base.clone({ items })
+          : new Collection({ items });
+        const fetched = await Array.fromAsync(collection.getItems({
+          documentLoader: mockDocumentLoader,
+          contextLoader: mockDocumentLoader,
+        }));
+        deepStrictEqual(fetched.length, 2);
+        deepStrictEqual(fetched.map((item) => item.name), [
+          "Fetched object",
+          "Fetched object",
+        ]);
+        deepStrictEqual(items, before);
+        strictEqual(items[0], before[0]);
+        strictEqual(items[1], before[1]);
+        const siblingJson = await sibling.toJsonLd() as { items: unknown };
+        deepStrictEqual(siblingJson.items, before.map(String));
+        if (!frozen) {
+          items.push(new URL("https://example.com/extra"));
+          deepStrictEqual(collection.itemIds, before);
+          deepStrictEqual(sibling.itemIds, before);
+        }
+      },
+    );
+  }
+}
+
+test("clone() copies scalar arrays without changing sparse inputs", () => {
+  const names = ["original"];
+  const original = new Object({ names });
+  names.push("caller mutation");
+  deepStrictEqual(original.names, ["original"]);
+  const copy = original.clone();
+  copy.names.push("clone mutation");
+  deepStrictEqual(original.names, ["original"]);
+  deepStrictEqual(copy.names, ["original", "clone mutation"]);
+  const replacements = ["replacement"];
+  const replaced = original.clone({ names: replacements });
+  replacements.push("caller mutation");
+  deepStrictEqual(replaced.names, ["replacement"]);
+
+  const sparseNames = new Array<string>(2);
+  sparseNames[1] = "kept";
+  const sparse = new Object({ names: sparseNames });
+  for (
+    const instance of [
+      sparse,
+      sparse.clone(),
+      sparse.clone({ names: sparse.names }),
+    ]
+  ) {
+    deepStrictEqual(instance.names.length, 2);
+    deepStrictEqual(0 in instance.names, false);
+    deepStrictEqual(instance.names[1], "kept");
+  }
+});
+
+test("clone() preserves embedded object identity and trust", async () => {
+  const note = new Note({ id: new URL("https://b.example/note") });
+  const original = new Create({
+    id: new URL("https://a.example/create"),
+    object: note,
+  });
+  // deno-lint-ignore require-await
+  const documentLoader = async () => {
+    throw new Error("Trusted embedded objects must not be fetched.");
+  };
+  for (
+    const instance of [
+      original,
+      original.clone(),
+      original.clone({ objects: [note] }),
+    ]
+  ) {
+    strictEqual(await instance.getObject({ documentLoader }), note);
+    strictEqual(instance.objectId, note.id);
+  }
+});
+
+test("clone() isolates crossOrigin trust when fetching", async () => {
+  const original = new Create({
+    id: new URL("https://a.example/create"),
+    object: new URL("https://b.example/note"),
+  });
+  const copy = original.clone();
+  // deno-lint-ignore require-await
+  const documentLoader = async (url: string) => ({
+    contextUrl: null,
+    documentUrl: url,
+    document: {
+      "@context": "https://www.w3.org/ns/activitystreams",
+      id: "https://other.example/note",
+      type: "Note",
+      content: "cross-origin",
+    },
+  });
+  const options = { documentLoader, contextLoader: mockDocumentLoader };
+  const trusted = await copy.getObject({ ...options, crossOrigin: "trust" });
+  assertInstanceOf(trusted, Note);
+  deepStrictEqual(trusted.content, "cross-origin");
+  deepStrictEqual(await original.getObject(options), null);
+  deepStrictEqual(original.objectId, new URL("https://b.example/note"));
+});
+
 test("FEP-fe34: crossOrigin ignore behavior (default)", async () => {
   // Create a mock document loader that returns objects with different origins
   // deno-lint-ignore require-await