fix: address all seven final-gate findings for typed api blocks

B1: qualify each generated __wrn_api_check_* assertion name with a short
hash of the page's path (relative to app/, for reproducibility across
checkouts) so two pages declaring a same-named block no longer collide
with an identical type alias (TS2300).

B2: skip assertion emission for any block that is not client-mode, or
that has zero declared request fields. ssr sectioned blocks can never
declare a request and always fell back to Record<string, never>, whose
keyof is `string` -- making the key-exactness arm of AssertAssignable
evaluate to false unconditionally (TS2344) on every ssr sectioned block
regardless of correctness. Chose to skip both non-client blocks and
zero-field client blocks, since neither has anything meaningful to
assert type-safety about.

B3: only resolve the endpoint's input (query params / ctx.req.json())
when the endpoint declares an input schema. Previously the router-set
fix accidentally read the request body unconditionally, so a handler
with no input schema that parses the request itself hit
ERR_BODY_ALREADY_USED.

B4: run response/error bodies in client-mode api blocks through
eraseFunctionTypes, matching every other browser-bound body in
client-codegen.ts, so a TypeScript-only construct inside one (e.g. an
annotated locally-declared function) doesn't reach the .mjs artifact.

B5: only exclude "api" from state/prop destructuring in the generated
browser module when the page actually has client-mode api blocks (i.e.
there is a real `api` binding to shadow). Previously "api" was always
excluded, so a page with `state api` and no api blocks got an
undeclared `api` reference (ReferenceError) in client code.

B6: prefix each emitted assertion with `export`, so it isn't flagged as
an unused local under a downstream project's noUnusedLocals (TS6196).

B7: wrnexusCallApi now resolves with undefined for an ok 204/205
response, or an ok response with an empty/unparseable body, instead of
rejecting with "Response was not valid JSON" -- matching the spec's
failure table (error path only for non-2xx, network failure, or an
actually unparseable body on a non-empty response).

Regenerated examples/basic-app's generated types and editor bundles to
match. Confirmed the example's type gate still fails when an
unaccepted field is added to a request body, and passes cleanly
otherwise.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/compiler/src/client-codegen.ts

@@ -321,8 +321,8 @@ function apiBindings(ast: PageAst): string {
     .filter((block) => block.mode === "client" && block.sections)
     .map((block) => {
       const sections = block.sections!;
-      const response = sections.response.trim() || "return data;";
-      const error = sections.error.trim();
+      const response = eraseFunctionTypes(sections.response).trim() || "return data;";
+      const error = eraseFunctionTypes(sections.error).trim();
       const failure = error
         ? `(error) => { const status = error.status; const message = error.message; const data = error.data; ${error} }`
         : `(error) => { throw error; }`;
@@ -344,11 +344,23 @@ export function generateBrowserModule(ast: PageAst): string {
   const selectedImports = selectedBrowserImports(ast, functions);
   const imports = selectedImports.map((entry) => entry.code).join("\n");
   const importedBindings = [...new Set(selectedImports.flatMap((entry) => entry.bindings))];
-  const sharedState = state.filter((name) => safeIdentifier(name) && !RUNTIME_BINDINGS.has(name));
+  // `api` is only defined as a client-scope binding when the page actually has
+  // client-mode api blocks (see apiBindings below). A page that declares
+  // `state api` without any client api blocks must keep reading/writing that
+  // state as before, so only exclude the "api" name from destructuring when
+  // there is a real `api` binding to shadow it.
+  const hasClientApi = ast.dataApis.some((block) => block.mode === "client" && block.sections);
+  const localRuntimeBindings = hasClientApi
+    ? RUNTIME_BINDINGS
+    : new Set([...RUNTIME_BINDINGS].filter((name) => name !== "api"));
+  const sharedState = state.filter(
+    (name) => safeIdentifier(name) && !localRuntimeBindings.has(name),
+  );
   const sharedProps = ast.props
     .map((entry) => entry.name)
     .filter(
-      (name) => safeIdentifier(name) && !RUNTIME_BINDINGS.has(name) && !sharedState.includes(name),
+      (name) =>
+        safeIdentifier(name) && !localRuntimeBindings.has(name) && !sharedState.includes(name),
     );
   const callableAliases = functionNames.filter(
     (name) =>

packages/compiler/test/api-block-codegen.test.ts

@@ -81,6 +81,68 @@ test("a block without an error section still emits its response body", () => {
   expect(generated).toContain("data.users");
 });
 
+test("type annotations in response/error bodies are erased before emission (B4)", () => {
+  // Every other browser-bound body in the repo passes through eraseFunctionTypes
+  // (see the fn.body call sites in client-codegen.ts ~line 288 and ~371, and
+  // store-codegen.ts); response/error bodies must too, for the same reason:
+  // eraseFunctionTypes strips function-signature annotations (params, return
+  // type, typed catch clauses) so a locally-declared helper function inside a
+  // response/error body no longer ships raw TypeScript into the .mjs artifact.
+  const generated = browserModule(`    api searchUsers POST /api/users {
+      request {
+        body {
+          name?: string
+        }
+      }
+
+      response {
+        function pick(list: string[]): string[] { return list }
+        return pick(data.users)
+      }
+
+      error {
+        function describe(e: unknown): string { return String(e) }
+        return describe(error)
+      }
+    }`);
+
+  expect(generated).not.toContain("list: string[]");
+  expect(generated).not.toContain("): string[] {");
+  expect(generated).not.toContain("e: unknown");
+  expect(generated).not.toContain("): string {");
+  expect(() => {
+    new Function(generated.replace(/^\s*import[^\n]*$/gm, "").replace(/\bexport\s+/g, ""));
+  }).not.toThrow();
+});
+
+test("a page with state api and no client api blocks still reads that state (B5)", () => {
+  // "api" is normally excluded from state/prop destructuring because the
+  // emitted `const api = {...}` binding would shadow it -- but that binding
+  // only exists when the page has client-mode api blocks. Without one, the
+  // exclusion left `api` completely undeclared: a ReferenceError.
+  const generated = generateTargets(
+    parse(`page Repro {
+  state {
+    api = "hello"
+  }
+
+  functions {
+    client function run(): void {
+      console.log(api)
+    }
+  }
+
+  view { <main><button @click="run()">go</button></main> }
+}
+`),
+  ).browser;
+
+  expect(generated).toContain("context.state");
+  expect(() => {
+    new Function(generated.replace(/^\s*import[^\n]*$/gm, "").replace(/\bexport\s+/g, ""));
+  }).not.toThrow();
+});
+
 test("a state field named api does not collide with the emitted api object", () => {
   const generated = generateTargets(
     parse(`page Repro {