perf: switch from @sentry/bun to @sentry/node-core/light (~170ms startup savings) (#474)

## Summary

Switch from `@sentry/bun` to `@sentry/node-core/light` to eliminate the
OpenTelemetry dependency tree that a CLI tool never uses. Additionally,
patch `@sentry/core` barrel to remove unused modules (AI tracing, MCP
server, Supabase, feature flags).

## Changes

### Phase 1: SDK upgrade
- Upgrade Sentry SDK `10.39.0` → `10.44.0`

### Phase 2: Import migration (~150ms savings)
- Replace `@sentry/bun` + `@sentry/node` dependencies with
`@sentry/node-core`
- Replace all `import * as Sentry from "@sentry/bun"` →
`"@sentry/node-core/light"` (15 source files, 4 test files)
- Change `BunClient` → `LightNodeClient` in telemetry.ts
- Export `Span` type from `@sentry/core` (canonical source)
- Remove esbuild `@sentry/bun` → `@sentry/node` alias in bundle.ts (no
longer needed)

### Phase 3: Barrel patching (~14ms savings)
- Patch `@sentry/core` barrel to remove 32 export lines pulling in ~59
unused transitive modules (AI tracing integrations, MCP server,
Supabase, feature flags, etc.)
- Patch `@sentry/node-core/light` barrel to remove 11 matching
re-exports

### Phase 4: Upstream issue drafts
- Added `.github/upstream-issues/` with drafts for:
  - `@sentry/core/light` sub-path export request
  - `@sentry/bun/light` entry point request

## What we lose (nothing meaningful)

| Feature | Why irrelevant |
|---------|---------------|
| 29 OpenTelemetry auto-instrumentations | CLI is not a web server |
| `bunServerIntegration` | CLI does not call `Bun.serve()` |
| `BunClient` class | Deprecated since v9; replaced by `LightNodeClient`
|
| Bun-native fetch transport | `makeNodeTransport` works fine in Bun |
| OTEL context propagation | Light mode uses `AsyncLocalStorage` — same
behavior |
| SDK envelope metadata `"bun"` | Changes to `"node-light"` — cosmetic
only. `cli.runtime` tag still distinguishes Bun vs Node |

## API compatibility verified

Every API the CLI uses (`captureException`, `startSpan`, `setTag`,
`metrics`, `logger`, `createConsolaReporter`, `getTraceData`,
`isEnabled`, `flush`, `endSession`, etc.) is available in
`@sentry/node-core/light`.

## Risk

Light mode is labeled experimental, but we pin SDK versions exactly
(`10.44.0`, not `^10.44.0`), so we control when SDK updates happen.

## Verification

- ✅ `bun run typecheck` — clean
- ✅ `bun run test:unit` — 3883/3885 pass (2 pre-existing flaky failures
in upgrade tests)
- ✅ `bun run test:isolated` — 126/126 pass
- ✅ `bun run check:skill` — up to date
- ✅ `bun run check:errors` — no anti-patterns
- ✅ Patched SDK exports all needed symbols, removed symbols are
`undefined`
- 📊 SDK import time: ~114ms (down from ~285ms)

Closes #472

Author: BYK

.github/upstream-issues/sentry-bun-light.md

@@ -0,0 +1,54 @@
+# feat(bun): Add `@sentry/bun/light` entry point without OpenTelemetry
+
+**Repo**: https://github.com/getsentry/sentry-javascript
+
+## Problem
+
+`@sentry/bun` imports `@sentry/node`, which eagerly loads the entire OpenTelemetry stack and **29+ auto-instrumentation modules** (Express, MongoDB, Redis, PostgreSQL, Kafka, Prisma, AI providers, etc.). For CLI tools and other non-server Bun applications, none of these instrumentations are relevant, yet they cost:
+
+- **~150ms** additional import time
+- **~24MB** in `node_modules` (36 `@opentelemetry/*` packages)
+
+## Measured Impact
+
+Benchmarks from our Bun CLI project ([getsentry/cli](https://github.com/getsentry/cli)):
+
+| Import | Time | What Loads |
+|--------|------|------------|
+| `@sentry/bun` | **~285ms** | Full OTel stack + 29 auto-instrumentations (36 OTel packages) |
+| `@sentry/node-core/light` | **~130ms** | Core SDK only, no OTel, AsyncLocalStorage for context |
+
+The **~155ms difference** is entirely from OpenTelemetry packages that a CLI tool never uses. `@sentry/bun` adds only ~2ms on top of `@sentry/node` (it's a thin wrapper: `BunClient`, `bunServerIntegration`, `makeFetchTransport`).
+
+## Proposal
+
+Add `@sentry/bun/light` that mirrors what `@sentry/node-core/light` does for Node:
+
+1. **Uses `@sentry/node-core/light` instead of `@sentry/node`** — no OpenTelemetry dependency
+2. **Keeps Bun-specific niceties**:
+   - `makeFetchTransport` as default transport (uses global `fetch()`)
+   - `runtime: { name: 'bun', version: Bun.version }` in SDK metadata
+   - SDK metadata tagged as `"bun-light"` (or similar)
+3. **No `bunServerIntegration` in defaults** — it's for `Bun.serve()` which light-mode users (CLIs, scripts) likely don't need
+4. **Uses `AsyncLocalStorage`** for context propagation (same as `@sentry/node-core/light`)
+
+### Usage
+
+```typescript
+// Before (285ms):
+import * as Sentry from "@sentry/bun";
+
+// After (130ms):
+import * as Sentry from "@sentry/bun/light";
+```
+
+All existing APIs (`captureException`, `startSpan`, `setTag`, `metrics`, `logger`, `createConsolaReporter`, etc.) would be available — just without the OTel auto-instrumentation overhead.
+
+## Current Workaround
+
+We switched from `@sentry/bun` to `@sentry/node-core/light` directly. This works but:
+- Loses Bun-specific SDK metadata (runtime name shows as "node" instead of "bun")
+- Doesn't use `makeFetchTransport` by default (falls back to Node's `http` module — works in Bun but isn't native)
+- Requires users to know about the internal package structure
+
+A first-party `@sentry/bun/light` would be more ergonomic and keep Bun users within the expected SDK.

.github/upstream-issues/sentry-core-light-export.md

@@ -0,0 +1,82 @@
+# feat(core): Add `@sentry/core/light` sub-path export to reduce import time for lightweight consumers
+
+**Repo**: https://github.com/getsentry/sentry-javascript
+
+## Problem
+
+`@sentry/core` has a single barrel entry point (`index.js`) that eagerly loads **179 ESM modules** (~776 KB). This includes:
+
+- AI tracing integrations: OpenAI, Anthropic, Google GenAI, LangChain, LangGraph, Vercel AI SDK (21 files, ~170 KB)
+- MCP server integration (14 files, ~160 KB)
+- Supabase integration (1 file, ~14 KB)
+- Feature flags integrations (3 files, ~8 KB)
+- Other unused server-framework-specific code: tRPC, fetch instrumentation, idle spans, etc.
+
+Even `@sentry/node-core/light`, which was designed to be lightweight, re-exports from the full `@sentry/core` barrel, forcing consumers to pay the entire import cost.
+
+## Measured Impact
+
+On our Bun CLI project ([getsentry/cli](https://github.com/getsentry/cli)):
+
+| Configuration | `@sentry/core` Import Time |
+|---|---|
+| Full barrel (current) | **~40ms** |
+| Barrel with 29 unused export lines removed (59 transitive modules, 310 KB) | **~27ms** |
+
+That's a **33% improvement** just by removing modules that lightweight consumers never use.
+
+## Proposal
+
+Add a `@sentry/core/light` sub-path export (similar to `@sentry/node-core/light`) that excludes:
+
+- AI tracing integrations (OpenAI, Anthropic, Google GenAI, LangChain, LangGraph, Vercel AI SDK)
+- MCP server integration
+- Supabase integration
+- Feature flags integrations (featureFlagsIntegration, growthbookIntegration)
+- Server-framework-specific code (tRPC middleware, fetch instrumentation, idle spans)
+- Other heavy modules not needed for basic error/tracing/session/logs usage
+
+Then `@sentry/node-core/light` could import from `@sentry/core/light` instead of `@sentry/core`, further reducing the startup cost of lightweight mode.
+
+## Our Patch (for reference)
+
+We're currently removing these 32 export lines from the barrel via `bun patch`:
+
+```
+export { TRACING_DEFAULTS, startIdleSpan } from './tracing/idleSpan.js';
+export { _INTERNAL_clearAiProviderSkips, ... } from './utils/ai/providerSkip.js';
+export { moduleMetadataIntegration } from './integrations/moduleMetadata.js';
+export { captureConsoleIntegration } from './integrations/captureconsole.js';
+export { dedupeIntegration } from './integrations/dedupe.js';
+export { extraErrorDataIntegration } from './integrations/extraerrordata.js';
+export { rewriteFramesIntegration } from './integrations/rewriteframes.js';
+export { instrumentSupabaseClient, supabaseIntegration } from './integrations/supabase.js';
+export { instrumentPostgresJsSql } from './integrations/postgresjs.js';
+export { zodErrorsIntegration } from './integrations/zoderrors.js';
+export { thirdPartyErrorFilterIntegration } from './integrations/third-party-errors-filter.js';
+export { featureFlagsIntegration } from './integrations/featureFlags/featureFlagsIntegration.js';
+export { growthbookIntegration } from './integrations/featureFlags/growthbook.js';
+export { conversationIdIntegration } from './integrations/conversationId.js';
+export { profiler } from './profiling.js';
+export { instrumentFetchRequest } from './fetch.js';
+export { trpcMiddleware } from './trpc.js';
+export { wrapMcpServerWithSentry } from './integrations/mcp-server/index.js';
+export { addVercelAiProcessors } from './tracing/vercel-ai/index.js';
+export { _INTERNAL_cleanupToolCallSpanContext, ... } from './tracing/vercel-ai/utils.js';
+export { toolCallSpanContextMap as ... } from './tracing/vercel-ai/constants.js';
+export { instrumentOpenAiClient } from './tracing/openai/index.js';
+export { OPENAI_INTEGRATION_NAME } from './tracing/openai/constants.js';
+export { instrumentAnthropicAiClient } from './tracing/anthropic-ai/index.js';
+export { ANTHROPIC_AI_INTEGRATION_NAME } from './tracing/anthropic-ai/constants.js';
+export { instrumentGoogleGenAIClient } from './tracing/google-genai/index.js';
+export { GOOGLE_GENAI_INTEGRATION_NAME } from './tracing/google-genai/constants.js';
+export { createLangChainCallbackHandler } from './tracing/langchain/index.js';
+export { LANGCHAIN_INTEGRATION_NAME } from './tracing/langchain/constants.js';
+export { instrumentLangGraph, instrumentStateGraphCompile } from './tracing/langgraph/index.js';
+export { LANGGRAPH_INTEGRATION_NAME } from './tracing/langgraph/constants.js';
+export { _INTERNAL_FLAG_BUFFER_SIZE, ... } from './utils/featureFlags.js';
+```
+
+We also remove the corresponding re-exports from `@sentry/node-core/light/index.js`.
+
+Happy to contribute a PR if the approach is accepted.