feat(server-runtime-injection): Split runtime orchestrion injection into a dedicated package

The runtime diagnostics-channel injection (`register`/`hook`/`import-hook` + the
vendored transformer chain meriyah/esquery/astring/source-map/tracing-hooks) must
stay EXTERNAL when apps bundle their server, while the rest of `@sentry/server-utils`
(barrel + config + bundler plugins) is meant to be bundled. Sharing one package made
externalization fiddly. This moves the runtime injection into a new package,
`@sentry/server-runtime-injection`, so "keep this external" is a clean package boundary.

- New package holds `register`/`hook`/`import-hook` (subpaths `/register`, `/hook`,
  `/import-hook`) and vendors the transformer chain; it depends on `@sentry/server-utils`
  and imports `SENTRY_INSTRUMENTATIONS` from `./orchestrion/config` (config stays put).
- `@sentry/server-utils` drops the runtime dir/exports and the runtime-only vendored deps;
  the lone `config/index.ts` bundler re-export moves to a new `./orchestrion/bundler-transforms`
  subpath so importing config stays transformer-free (bun updated).
- References updated: node SDK + test mock, deno import, the shared `--import` template +
  `makeOrchestrionLoader` guard, Next.js externalization (`ORCHESTRION_RUNTIME_EXTERNAL_PACKAGES`,
  nextjs-anchored require-ability check, forwarder generation) + tests, `.size-limit.js`.
- Dep added to runtime-injection consumers (node, nextjs, deno, aws/gcp-serverless, astro,
  tanstackstart-react); package registered in workspaces, `.craft.yml`, CODEOWNERS, aws e2e.

Stacked on the detect/warn PR (#23675).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mydea

.craft.yml

@@ -12,6 +12,10 @@ targets:
   - name: npm
     id: '@sentry/server-utils'
     includeNames: /^sentry-server-utils-\d.*\.tgz$/
+  # Depends on @sentry/server-utils (for the shared instrumentation config); publish after it.
+  - name: npm
+    id: '@sentry/server-runtime-injection'
+    includeNames: /^sentry-server-runtime-injection-\d.*\.tgz$/
   ## 1.3 Browser Utils package
   - name: npm
     id: '@sentry/browser-utils'

.github/CODEOWNERS

@@ -10,6 +10,7 @@
 # Node/server runtimes and related packages
 # TEMP: whole JS SDK team reviews orchestrion work; revert to team-javascript-sdks-server after
 /packages/node/                     @getsentry/team-javascript-sdks
+/packages/server-runtime-injection/ @getsentry/team-javascript-sdks
 /packages/server-utils/             @getsentry/team-javascript-sdks
 /packages/node-native/              @getsentry/team-javascript-sdks-server
 /packages/profiling-node/           @getsentry/team-javascript-sdks-server

.size-limit.js

@@ -411,7 +411,7 @@ module.exports = [
   },
   {
     name: '@sentry/node/import (ESM hook with diagnostics-channel injection)',
-    path: ['packages/server-utils/build/esm/orchestrion/runtime/hook.js', 'packages/node/build/import-hook.mjs'],
+    path: ['packages/server-runtime-injection/build/esm/hook.js', 'packages/node/build/import-hook.mjs'],
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: true,
     limit: '91 KB',

dev-packages/e2e-tests/test-applications/aws-serverless/src/stack.ts

@@ -55,14 +55,14 @@ export class LocalLambdaStack extends Stack {
       const packageLockPath = path.join(lambdaPath, 'package-lock.json');
       const nodeModulesPath = path.join(lambdaPath, 'node_modules');
 
-      // `dir` is the package directory under `packages/`; `name` is the published
-      // npm name (most are `@sentry/<dir>`, but `server-utils` is `@sentry-internal`).
+      // `dir` is the package directory under `packages/`; `name` is the published npm name.
       const packagesToLink: Array<{ dir: string; name: string }> = [
         { dir: 'aws-serverless', name: '@sentry/aws-serverless' },
         { dir: 'node', name: '@sentry/node' },
         { dir: 'core', name: '@sentry/core' },
         { dir: 'opentelemetry', name: '@sentry/opentelemetry' },
         { dir: 'server-utils', name: '@sentry/server-utils' },
+        { dir: 'server-runtime-injection', name: '@sentry/server-runtime-injection' },
         { dir: 'bundler-plugins', name: '@sentry/bundler-plugins' },
       ];
       const dependencies: Record<string, string> = {};

dev-packages/rollup-utils/code/importHookTemplate.js

@@ -1 +1 @@
-import '@sentry/server-utils/orchestrion/import-hook';
+import '@sentry/server-runtime-injection/import-hook';

dev-packages/rollup-utils/npmHelpers.mjs

@@ -192,9 +192,9 @@ export function makeNPMConfigVariants(baseConfig, options = {}) {
 /**
  * Emits the `@sentry/<framework>/import` entry (`build/import-hook.mjs`) as part of the rollup build,
  * used as `node --import @sentry/<framework>/import app.js`. The generated hook imports
- * `@sentry/server-utils/orchestrion/import-hook`, which registers the orchestrion
- * diagnostics-channel injection, so the consuming package must declare `@sentry/server-utils` as a
- * dependency.
+ * `@sentry/server-runtime-injection/import-hook`, which registers the orchestrion
+ * diagnostics-channel injection, so the consuming package must declare
+ * `@sentry/server-runtime-injection` as a dependency.
  *
  * @param {string} outputFolder Build output folder.
  */
@@ -209,7 +209,7 @@ export function makeOrchestrionLoader(outputFolder) {
     );
   }
 
-  const requiredDep = '@sentry/server-utils';
+  const requiredDep = '@sentry/server-runtime-injection';
   const foundRequiredDep =
     Object.keys(packageDotJSON.dependencies ?? {}).some(key => {
       return key === requiredDep;

package.json

@@ -88,6 +88,7 @@
     "packages/replay-internal",
     "packages/replay-canvas",
     "packages/replay-worker",
+    "packages/server-runtime-injection",
     "packages/server-utils",
     "packages/solid",
     "packages/solidstart",

packages/astro/package.json

@@ -55,6 +55,7 @@
     "@sentry/core": "10.67.0",
     "@sentry/conventions": "^0.20.0",
     "@sentry/node": "10.67.0",
+    "@sentry/server-runtime-injection": "10.67.0",
     "@sentry/server-utils": "10.67.0",
     "@sentry/bundler-plugins": "10.67.0"
   },

packages/aws-serverless/package.json

@@ -59,6 +59,7 @@
     "@sentry/conventions": "^0.20.0",
     "@sentry/core": "10.67.0",
     "@sentry/node": "10.67.0",
+    "@sentry/server-runtime-injection": "10.67.0",
     "@sentry/server-utils": "10.67.0",
     "@types/aws-lambda": "^8.10.161"
   },

packages/bun/src/plugin.ts

@@ -38,9 +38,11 @@ type UnknownPlugin = any;
 // module system.
 import codeTransformer from '@apm-js-collab/code-transformer-bundler-plugins/bun';
 import {
-  INSTRUMENTED_MODULE_NAMES,
   moduleInjectedTransforms,
   ORCHESTRION_BUNDLER_MARKER_BANNER,
+} from '@sentry/server-utils/orchestrion/bundler-transforms';
+import {
+  INSTRUMENTED_MODULE_NAMES,
   SENTRY_INSTRUMENTATIONS,
   withoutInstrumentedExternals,
 } from '@sentry/server-utils/orchestrion/config';