a bit like in the old days of php when you'd have the serverside code and html rendered in their, but this time nearly everything is running on the client unless the client can't be trusted.
you could have some kind of ring system, where something can never run on the client right up to always run on client, but all in one file.
but maybe that's nasty.