fix: address all seven final-gate findings for typed api blocks

B1: qualify each generated __wrn_api_check_* assertion name with a short
hash of the page's path (relative to app/, for reproducibility across
checkouts) so two pages declaring a same-named block no longer collide
with an identical type alias (TS2300).

B2: skip assertion emission for any block that is not client-mode, or
that has zero declared request fields. ssr sectioned blocks can never
declare a request and always fell back to Record<string, never>, whose
keyof is `string` -- making the key-exactness arm of AssertAssignable
evaluate to false unconditionally (TS2344) on every ssr sectioned block
regardless of correctness. Chose to skip both non-client blocks and
zero-field client blocks, since neither has anything meaningful to
assert type-safety about.

B3: only resolve the endpoint's input (query params / ctx.req.json())
when the endpoint declares an input schema. Previously the router-set
fix accidentally read the request body unconditionally, so a handler
with no input schema that parses the request itself hit
ERR_BODY_ALREADY_USED.

B4: run response/error bodies in client-mode api blocks through
eraseFunctionTypes, matching every other browser-bound body in
client-codegen.ts, so a TypeScript-only construct inside one (e.g. an
annotated locally-declared function) doesn't reach the .mjs artifact.

B5: only exclude "api" from state/prop destructuring in the generated
browser module when the page actually has client-mode api blocks (i.e.
there is a real `api` binding to shadow). Previously "api" was always
excluded, so a page with `state api` and no api blocks got an
undeclared `api` reference (ReferenceError) in client code.

B6: prefix each emitted assertion with `export`, so it isn't flagged as
an unused local under a downstream project's noUnusedLocals (TS6196).

B7: wrnexusCallApi now resolves with undefined for an ok 204/205
response, or an ok response with an empty/unparseable body, instead of
rejecting with "Response was not valid JSON" -- matching the spec's
failure table (error path only for non-2xx, network failure, or an
actually unparseable body on a non-empty response).

Regenerated examples/basic-app's generated types and editor bundles to
match. Confirmed the example's type gate still fails when an
unaccepted field is added to a request body, and passes cleanly
otherwise.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/compiler/src/client-codegen.ts

@@ -321,8 +321,8 @@ function apiBindings(ast: PageAst): string {
     .filter((block) => block.mode === "client" && block.sections)
     .map((block) => {
       const sections = block.sections!;
-      const response = sections.response.trim() || "return data;";
-      const error = sections.error.trim();
+      const response = eraseFunctionTypes(sections.response).trim() || "return data;";
+      const error = eraseFunctionTypes(sections.error).trim();
       const failure = error
         ? `(error) => { const status = error.status; const message = error.message; const data = error.data; ${error} }`
         : `(error) => { throw error; }`;
@@ -344,11 +344,23 @@ export function generateBrowserModule(ast: PageAst): string {
   const selectedImports = selectedBrowserImports(ast, functions);
   const imports = selectedImports.map((entry) => entry.code).join("\n");
   const importedBindings = [...new Set(selectedImports.flatMap((entry) => entry.bindings))];
-  const sharedState = state.filter((name) => safeIdentifier(name) && !RUNTIME_BINDINGS.has(name));
+  // `api` is only defined as a client-scope binding when the page actually has
+  // client-mode api blocks (see apiBindings below). A page that declares
+  // `state api` without any client api blocks must keep reading/writing that
+  // state as before, so only exclude the "api" name from destructuring when
+  // there is a real `api` binding to shadow it.
+  const hasClientApi = ast.dataApis.some((block) => block.mode === "client" && block.sections);
+  const localRuntimeBindings = hasClientApi
+    ? RUNTIME_BINDINGS
+    : new Set([...RUNTIME_BINDINGS].filter((name) => name !== "api"));
+  const sharedState = state.filter(
+    (name) => safeIdentifier(name) && !localRuntimeBindings.has(name),
+  );
   const sharedProps = ast.props
     .map((entry) => entry.name)
     .filter(
-      (name) => safeIdentifier(name) && !RUNTIME_BINDINGS.has(name) && !sharedState.includes(name),
+      (name) =>
+        safeIdentifier(name) && !localRuntimeBindings.has(name) && !sharedState.includes(name),
     );
   const callableAliases = functionNames.filter(
     (name) =>