fix: address all seven final-gate findings for typed api blocks

B1: qualify each generated __wrn_api_check_* assertion name with a short
hash of the page's path (relative to app/, for reproducibility across
checkouts) so two pages declaring a same-named block no longer collide
with an identical type alias (TS2300).

B2: skip assertion emission for any block that is not client-mode, or
that has zero declared request fields. ssr sectioned blocks can never
declare a request and always fell back to Record<string, never>, whose
keyof is `string` -- making the key-exactness arm of AssertAssignable
evaluate to false unconditionally (TS2344) on every ssr sectioned block
regardless of correctness. Chose to skip both non-client blocks and
zero-field client blocks, since neither has anything meaningful to
assert type-safety about.

B3: only resolve the endpoint's input (query params / ctx.req.json())
when the endpoint declares an input schema. Previously the router-set
fix accidentally read the request body unconditionally, so a handler
with no input schema that parses the request itself hit
ERR_BODY_ALREADY_USED.

B4: run response/error bodies in client-mode api blocks through
eraseFunctionTypes, matching every other browser-bound body in
client-codegen.ts, so a TypeScript-only construct inside one (e.g. an
annotated locally-declared function) doesn't reach the .mjs artifact.

B5: only exclude "api" from state/prop destructuring in the generated
browser module when the page actually has client-mode api blocks (i.e.
there is a real `api` binding to shadow). Previously "api" was always
excluded, so a page with `state api` and no api blocks got an
undeclared `api` reference (ReferenceError) in client code.

B6: prefix each emitted assertion with `export`, so it isn't flagged as
an unused local under a downstream project's noUnusedLocals (TS6196).

B7: wrnexusCallApi now resolves with undefined for an ok 204/205
response, or an ok response with an empty/unparseable body, instead of
rejecting with "Response was not valid JSON" -- matching the spec's
failure table (error path only for non-2xx, network failure, or an
actually unparseable body on a non-empty response).

Regenerated examples/basic-app's generated types and editor bundles to
match. Confirmed the example's type gate still fails when an
unaccepted field is added to a request body, and passes cleanly
otherwise.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/compiler/test/api-block-codegen.test.ts

@@ -81,6 +81,68 @@ test("a block without an error section still emits its response body", () => {
   expect(generated).toContain("data.users");
 });
 
+test("type annotations in response/error bodies are erased before emission (B4)", () => {
+  // Every other browser-bound body in the repo passes through eraseFunctionTypes
+  // (see the fn.body call sites in client-codegen.ts ~line 288 and ~371, and
+  // store-codegen.ts); response/error bodies must too, for the same reason:
+  // eraseFunctionTypes strips function-signature annotations (params, return
+  // type, typed catch clauses) so a locally-declared helper function inside a
+  // response/error body no longer ships raw TypeScript into the .mjs artifact.
+  const generated = browserModule(`    api searchUsers POST /api/users {
+      request {
+        body {
+          name?: string
+        }
+      }
+
+      response {
+        function pick(list: string[]): string[] { return list }
+        return pick(data.users)
+      }
+
+      error {
+        function describe(e: unknown): string { return String(e) }
+        return describe(error)
+      }
+    }`);
+
+  expect(generated).not.toContain("list: string[]");
+  expect(generated).not.toContain("): string[] {");
+  expect(generated).not.toContain("e: unknown");
+  expect(generated).not.toContain("): string {");
+  expect(() => {
+    new Function(generated.replace(/^\s*import[^\n]*$/gm, "").replace(/\bexport\s+/g, ""));
+  }).not.toThrow();
+});
+
+test("a page with state api and no client api blocks still reads that state (B5)", () => {
+  // "api" is normally excluded from state/prop destructuring because the
+  // emitted `const api = {...}` binding would shadow it -- but that binding
+  // only exists when the page has client-mode api blocks. Without one, the
+  // exclusion left `api` completely undeclared: a ReferenceError.
+  const generated = generateTargets(
+    parse(`page Repro {
+  state {
+    api = "hello"
+  }
+
+  functions {
+    client function run(): void {
+      console.log(api)
+    }
+  }
+
+  view { <main><button @click="run()">go</button></main> }
+}
+`),
+  ).browser;
+
+  expect(generated).toContain("context.state");
+  expect(() => {
+    new Function(generated.replace(/^\s*import[^\n]*$/gm, "").replace(/\bexport\s+/g, ""));
+  }).not.toThrow();
+});
+
 test("a state field named api does not collide with the emitted api object", () => {
   const generated = generateTargets(
     parse(`page Repro {