fix(imports): resolve workspace subpath exports (#1308)

[guyoron1]

Summary

• Workspace imports with subpath exports (e.g. import { value } from "@example/pkg-a/browser") now resolve through the package.json exports map instead of falling back to a bare path string
• Supports string values, condition objects (source > import > module > default > require > svelte > types), nested conditions, and wildcard patterns ("./*": "./src/*.ts")
• Normalizes import node IDs to use _file_stem instead of full paths across JS/Svelte/Astro/Vue extractors

Closes #1308

Test plan

• 4 new tests: string subpath, condition object, wildcard, filesystem fallback
• All 10 workspace tests pass
• All 38 import extension resolution tests pass
• Full 34-test JS import resolution suite passes — 0 regressions

[safishamsi]

Thanks for this — the exports-map subpath resolver is a genuinely useful addition and it shipped on v8 (e8dabad) with your authorship. It resolves @scope/pkg/subpath imports through the package's exports map (string values, condition objects, nested conditions, ./* wildcards), which graphify couldn't do before.

I landed the resolver portion only, with two changes:

• Dropped the import-node-ID normalization (_make_id(str(...)) → _make_id(_file_stem(...))) that the PR also included. Current v8 already fixes the node-ID mismatch a different, more complete way — commit 2133539 (import edges silently dropped on Next.js codebase — short IDs vs full-path node IDs (regression of #256) #1529), whose id-remap post-pass registers the absolute-resolved forms and handles the relative-input alias case. Keeping the _file_stem change on top regressed test_alias_import_edge_resolves_with_relative_input_paths (it changed the key the post-pass matches on, silently disabling the remap), so it was left out.
• Two hardening tweaks: default is now consulted LAST in the condition priority (Node's catch-all), and export targets that escape the package dir are rejected (a "./x": "../../../etc/..." value can no longer resolve to a file outside the package).

Brought your 4 subpath tests plus two more (path-escape, default-last). Full suite green (2551), and the #1529 test still passes. Closing as shipped — credit for #1308 is yours. Thank you.