perf: switch from @sentry/bun to @sentry/node-core/light (~170ms startup savings)

Replace @sentry/bun (which pulls in the full OpenTelemetry stack and 29+
auto-instrumentation modules) with @sentry/node-core/light for ~150ms
import time savings.

Additionally, patch @sentry/core barrel to remove 32 unused export lines
(AI tracing, MCP server, Supabase, feature flags, etc.) for ~14ms more.

Changes:
- Upgrade Sentry SDK 10.39.0 → 10.44.0
- Replace all @sentry/bun imports → @sentry/node-core/light (15 src files)
- Change BunClient → LightNodeClient in telemetry.ts
- Export Span type from @sentry/core (canonical source)
- Remove esbuild @sentry/bun → @sentry/node alias in bundle.ts
- Add patches for @sentry/core and @sentry/node-core barrels
- Update test imports and mock targets (4 test files)
- Add upstream issue drafts for @sentry/core/light and @sentry/bun/light

Closes #472

Author: BYK

.github/upstream-issues/sentry-bun-light.md

@@ -0,0 +1,54 @@
+# feat(bun): Add `@sentry/bun/light` entry point without OpenTelemetry
+
+**Repo**: https://github.com/getsentry/sentry-javascript
+
+## Problem
+
+`@sentry/bun` imports `@sentry/node`, which eagerly loads the entire OpenTelemetry stack and **29+ auto-instrumentation modules** (Express, MongoDB, Redis, PostgreSQL, Kafka, Prisma, AI providers, etc.). For CLI tools and other non-server Bun applications, none of these instrumentations are relevant, yet they cost:
+
+- **~150ms** additional import time
+- **~24MB** in `node_modules` (36 `@opentelemetry/*` packages)
+
+## Measured Impact
+
+Benchmarks from our Bun CLI project ([getsentry/cli](https://github.com/getsentry/cli)):
+
+| Import | Time | What Loads |
+|--------|------|------------|
+| `@sentry/bun` | **~285ms** | Full OTel stack + 29 auto-instrumentations (36 OTel packages) |
+| `@sentry/node-core/light` | **~130ms** | Core SDK only, no OTel, AsyncLocalStorage for context |
+
+The **~155ms difference** is entirely from OpenTelemetry packages that a CLI tool never uses. `@sentry/bun` adds only ~2ms on top of `@sentry/node` (it's a thin wrapper: `BunClient`, `bunServerIntegration`, `makeFetchTransport`).
+
+## Proposal
+
+Add `@sentry/bun/light` that mirrors what `@sentry/node-core/light` does for Node:
+
+1. **Uses `@sentry/node-core/light` instead of `@sentry/node`** — no OpenTelemetry dependency
+2. **Keeps Bun-specific niceties**:
+   - `makeFetchTransport` as default transport (uses global `fetch()`)
+   - `runtime: { name: 'bun', version: Bun.version }` in SDK metadata
+   - SDK metadata tagged as `"bun-light"` (or similar)
+3. **No `bunServerIntegration` in defaults** — it's for `Bun.serve()` which light-mode users (CLIs, scripts) likely don't need
+4. **Uses `AsyncLocalStorage`** for context propagation (same as `@sentry/node-core/light`)
+
+### Usage
+
+```typescript
+// Before (285ms):
+import * as Sentry from "@sentry/bun";
+
+// After (130ms):
+import * as Sentry from "@sentry/bun/light";
+```
+
+All existing APIs (`captureException`, `startSpan`, `setTag`, `metrics`, `logger`, `createConsolaReporter`, etc.) would be available — just without the OTel auto-instrumentation overhead.
+
+## Current Workaround
+
+We switched from `@sentry/bun` to `@sentry/node-core/light` directly. This works but:
+- Loses Bun-specific SDK metadata (runtime name shows as "node" instead of "bun")
+- Doesn't use `makeFetchTransport` by default (falls back to Node's `http` module — works in Bun but isn't native)
+- Requires users to know about the internal package structure
+
+A first-party `@sentry/bun/light` would be more ergonomic and keep Bun users within the expected SDK.

.github/upstream-issues/sentry-core-light-export.md

@@ -0,0 +1,82 @@
+# feat(core): Add `@sentry/core/light` sub-path export to reduce import time for lightweight consumers
+
+**Repo**: https://github.com/getsentry/sentry-javascript
+
+## Problem
+
+`@sentry/core` has a single barrel entry point (`index.js`) that eagerly loads **179 ESM modules** (~776 KB). This includes:
+
+- AI tracing integrations: OpenAI, Anthropic, Google GenAI, LangChain, LangGraph, Vercel AI SDK (21 files, ~170 KB)
+- MCP server integration (14 files, ~160 KB)
+- Supabase integration (1 file, ~14 KB)
+- Feature flags integrations (3 files, ~8 KB)
+- Other unused server-framework-specific code: tRPC, fetch instrumentation, idle spans, etc.
+
+Even `@sentry/node-core/light`, which was designed to be lightweight, re-exports from the full `@sentry/core` barrel, forcing consumers to pay the entire import cost.
+
+## Measured Impact
+
+On our Bun CLI project ([getsentry/cli](https://github.com/getsentry/cli)):
+
+| Configuration | `@sentry/core` Import Time |
+|---|---|
+| Full barrel (current) | **~40ms** |
+| Barrel with 29 unused export lines removed (59 transitive modules, 310 KB) | **~27ms** |
+
+That's a **33% improvement** just by removing modules that lightweight consumers never use.
+
+## Proposal
+
+Add a `@sentry/core/light` sub-path export (similar to `@sentry/node-core/light`) that excludes:
+
+- AI tracing integrations (OpenAI, Anthropic, Google GenAI, LangChain, LangGraph, Vercel AI SDK)
+- MCP server integration
+- Supabase integration
+- Feature flags integrations (featureFlagsIntegration, growthbookIntegration)
+- Server-framework-specific code (tRPC middleware, fetch instrumentation, idle spans)
+- Other heavy modules not needed for basic error/tracing/session/logs usage
+
+Then `@sentry/node-core/light` could import from `@sentry/core/light` instead of `@sentry/core`, further reducing the startup cost of lightweight mode.
+
+## Our Patch (for reference)
+
+We're currently removing these 32 export lines from the barrel via `bun patch`:
+
+```
+export { TRACING_DEFAULTS, startIdleSpan } from './tracing/idleSpan.js';
+export { _INTERNAL_clearAiProviderSkips, ... } from './utils/ai/providerSkip.js';
+export { moduleMetadataIntegration } from './integrations/moduleMetadata.js';
+export { captureConsoleIntegration } from './integrations/captureconsole.js';
+export { dedupeIntegration } from './integrations/dedupe.js';
+export { extraErrorDataIntegration } from './integrations/extraerrordata.js';
+export { rewriteFramesIntegration } from './integrations/rewriteframes.js';
+export { instrumentSupabaseClient, supabaseIntegration } from './integrations/supabase.js';
+export { instrumentPostgresJsSql } from './integrations/postgresjs.js';
+export { zodErrorsIntegration } from './integrations/zoderrors.js';
+export { thirdPartyErrorFilterIntegration } from './integrations/third-party-errors-filter.js';
+export { featureFlagsIntegration } from './integrations/featureFlags/featureFlagsIntegration.js';
+export { growthbookIntegration } from './integrations/featureFlags/growthbook.js';
+export { conversationIdIntegration } from './integrations/conversationId.js';
+export { profiler } from './profiling.js';
+export { instrumentFetchRequest } from './fetch.js';
+export { trpcMiddleware } from './trpc.js';
+export { wrapMcpServerWithSentry } from './integrations/mcp-server/index.js';
+export { addVercelAiProcessors } from './tracing/vercel-ai/index.js';
+export { _INTERNAL_cleanupToolCallSpanContext, ... } from './tracing/vercel-ai/utils.js';
+export { toolCallSpanContextMap as ... } from './tracing/vercel-ai/constants.js';
+export { instrumentOpenAiClient } from './tracing/openai/index.js';
+export { OPENAI_INTEGRATION_NAME } from './tracing/openai/constants.js';
+export { instrumentAnthropicAiClient } from './tracing/anthropic-ai/index.js';
+export { ANTHROPIC_AI_INTEGRATION_NAME } from './tracing/anthropic-ai/constants.js';
+export { instrumentGoogleGenAIClient } from './tracing/google-genai/index.js';
+export { GOOGLE_GENAI_INTEGRATION_NAME } from './tracing/google-genai/constants.js';
+export { createLangChainCallbackHandler } from './tracing/langchain/index.js';
+export { LANGCHAIN_INTEGRATION_NAME } from './tracing/langchain/constants.js';
+export { instrumentLangGraph, instrumentStateGraphCompile } from './tracing/langgraph/index.js';
+export { LANGGRAPH_INTEGRATION_NAME } from './tracing/langgraph/constants.js';
+export { _INTERNAL_FLAG_BUFFER_SIZE, ... } from './utils/featureFlags.js';
+```
+
+We also remove the corresponding re-exports from `@sentry/node-core/light/index.js`.
+
+Happy to contribute a PR if the approach is accepted.