Avoid duplicate response headers on Elysia 1.4.18 and earlier

[dktsudgg]

Fixes #970.

@fedify/elysia's fedify() plugin copies the federation response headers into set.headers and then returns the same Response object.

When the response has a body, that Response already carries its own headers,
so on Elysia 1.4.18 and earlier(where Elysia merges set.headers into the returned response by appending unconditionally) every response header ends up duplicated.
(for example : Content-Type: application/activity+json, application/activity+json)

Elysia 1.4.19 changed the merge to skip headers the response already has, which masks the bug, but the package still supports Elysia ^1.3.6, so users on 1.4.18 and earlier receive malformed federation responses that a strict ActivityPub peer can reject.

This change moves the early return response (the case where the response has a body) above the header copy,
so the copy only runs on the bodyless path where a fresh new Response(null, …) needs the headers.
When there is a body the Response is returned untouched, so there is nothing for Elysia to merge back in, and the headers are no longer duplicated on any Elysia version.

See #970 for the details.

Assisted-by: Claude Code:claude-fable-5

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b49efb35-c920-4b8e-b8cb-c0bc2f59652a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dahlia]

Could you add a changelog entry to CHANGES.md? Thanks!

[dktsudgg]

@dahlia I added a changelog entry!

[dahlia]

@dktsudgg Could you change the target of this pull request to 2.0-maintenance? 1.8.x is now end-of-life.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dktsudgg]

@dahlia I changed target branch to 2.0-maintenance

[dahlia]

Could you rebase your commits on the latest 2.0-maintenance?

[dahlia]

Sorry, the fix I made on 2.0-maintenance was half-baked. Could you make a rebase once again?

[dktsudgg]

Sorry, and I found that I mistyped like https://github.com/fedify-dev/fedify/issues/972,
I fixed it to https://github.com/fedify-dev/fedify/pull/972
(Addressed in 655f2dc)

[dktsudgg]

I added two commits with AI assistance to make mise run check pass.
please check e233750 and 9cc1d9e.
I confirmed it works locally, but the commit messages are AI-generated, so please give them a read.

It looks like there is a real incompatibility between sacho and hongdown rather than a one-off formatting issue.
hongdown 0.5.3 requires a blank line after the front matter's closing ---, while sacho's normal form forbids one,
so a changelog fragment with a links block cannot satisfy both checkers at once.
main branch works around this by excluding changes.d/ from Hongdown in .hongdown.toml, which is what 9cc1d9e backports.