fix(server): resolve esbuild from app dir, not server dir

When `@webjskit/cli` is installed globally (the typical case for
end-users), `import('esbuild')` from `packages/server/src/dev.js`
walks up from the global install tree — never reaching the user app's
`node_modules`. The dev server then served `.ts` files as
`/* esbuild missing */` even after `npm i` succeeded in the scaffold.

Adds a `loadEsbuild(appDir)` helper that:
1. Resolves `esbuild` from the user's `appDir/package.json`
   (where the scaffold ships it as a devDep), then
2. Falls back to bare `import('esbuild')` for workspace-linked
   installs.

Bumps `@webjskit/server` 0.1.0 → 0.1.1 and `@webjskit/cli` 0.1.3 →
0.1.4 (cli pin updated to server@0.1.1).

Author: vivek7405

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjskit/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "description": "webjs CLI — dev, start, create, db",
   "bin": {
@@ -13,7 +13,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@webjskit/server": "0.1.0"
+    "@webjskit/server": "0.1.1"
   },
   "publishConfig": {
     "access": "public"

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjskit/server",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "webjs dev/prod server: SSR, router, API, server actions, live reload",
   "main": "index.js",

packages/server/package.json

@@ -449,7 +449,7 @@ async function handleCore(req, ctx) {
       }
       // TypeScript source: esbuild-strip types, cache by mtime.
       if (/\.m?ts$/.test(abs)) {
-        return tsResponse(abs, dev);
+        return tsResponse(abs, dev, appDir);
       }
       return fileResponse(abs, { dev, immutable: false });
     }
@@ -795,14 +795,14 @@ let _superjsonBundle = null;
  */
 async function serveBundledSuperjson(appDir, dev) {
   if (!_superjsonBundle) {
-    let build;
-    try { ({ build } = await import('esbuild')); }
-    catch {
+    const esbuildMod = await loadEsbuild(appDir);
+    if (!esbuildMod) {
       return new Response('/* esbuild missing */', {
         status: 500,
         headers: { 'content-type': 'application/javascript; charset=utf-8' },
       });
     }
+    const { build } = esbuildMod;
     const entryPoint = locatePackageDir(appDir, 'superjson');
     if (!entryPoint) return new Response('superjson not found', { status: 404 });
     const result = await build({
@@ -824,15 +824,15 @@ async function serveBundledSuperjson(appDir, dev) {
   });
 }
 
-async function tsResponse(abs, dev) {
-  let esbuild;
-  try { ({ transform: esbuild } = await import('esbuild')); }
-  catch {
+async function tsResponse(abs, dev, appDir) {
+  const esbuildMod = await loadEsbuild(appDir);
+  if (!esbuildMod) {
     return new Response(
       '/* esbuild missing — run `npm i -D esbuild` to enable TypeScript sources */',
       { status: 500, headers: { 'content-type': 'application/javascript; charset=utf-8' } }
     );
   }
+  const esbuild = esbuildMod.transform;
   const st = await stat(abs);
   const cached = TS_CACHE.get(abs);
   if (cached && cached.mtimeMs === st.mtimeMs) {
@@ -911,6 +911,30 @@ function locatePackageDir(appDir, pkgName) {
   return null;
 }
 
+/**
+ * Load esbuild — preferring the user app's `node_modules` (where the scaffold
+ * lists it as a devDep). Falls back to the server module's resolution path
+ * (works for workspace-linked installs). Returns `null` if not found.
+ *
+ * Without this two-step lookup, a globally-installed `@webjskit/cli` can't see
+ * esbuild from the user's app and serves `.ts` files as an "esbuild missing"
+ * stub even though `npm i` succeeded.
+ *
+ * @param {string} appDir
+ * @returns {Promise<typeof import('esbuild') | null>}
+ */
+let _esbuild = null;
+async function loadEsbuild(appDir) {
+  if (_esbuild) return _esbuild;
+  try {
+    const req = createRequire(join(appDir, 'package.json'));
+    _esbuild = await import(pathToFileURL(req.resolve('esbuild')).href);
+    return _esbuild;
+  } catch {}
+  try { _esbuild = await import('esbuild'); return _esbuild; } catch {}
+  return null;
+}
+
 const RELOAD_CLIENT_JS = `// webjs dev reload client
 const es = new EventSource('/__webjs/events');
 es.addEventListener('reload', () => location.reload());