ref(build): Relocate vendored deps out of node_modules in npm builds

[mydea]

Summary

Foundational build-infra change for the @sentry/conventions migration. The per-package @sentry/conventions PRs depend on this and it should merge first.

Root cause

With preserveModules: true, Rollup emits bundled dependencies that resolve from node_modules (e.g. the vendored @sentry/conventions devDependency) into an output directory literally named node_modules (build/esm/node_modules/@sentry/conventions/dist/attributes.js).

Node treats node_modules as a package-scope boundary: the {"type":"module"} marker we emit at the ESM build root does not apply inside it. Node then loads our ESM .js files there as CommonJS, so named imports fail:

Named export 'HTTP_TARGET' not found. The requested module '.../node_modules/@sentry/conventions/dist/attributes.js'
is a CommonJS module, which may not support all module.exports as named exports.

The same boundary also makes Vitest externalize the /node_modules/ path and require() it, which additionally fails on Node 18 (no require(esm) support).

Fix

A relocate-vendored-modules rollup-utils plugin moves bundled node_modules deps to a plain _external/ directory (kept under src so preserveModules roots it at the build root). Rollup rewrites every import specifier to the new location automatically, so the type:module scope marker applies and neither the Node ESM/CJS heuristic nor Vitest's externalization fire. Modules with internal relative imports (e.g. the multi-file @sentry/rrweb bundle in replay) are relocated as a unit.

Also maps the @sentry/conventions/attributes subpath in packages/typescript/tsconfig.json for the repo's node moduleResolution type builds.

Verified with a full yarn build:dev (all 45 projects) and by confirming a packed @sentry/react-router resolves the relocated file as ESM.

Ref: #20982

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 625467a. Configure here.}

[mydea]

this is actually related to follow up PRs but is foundational enough that we may as well also do it here I suppose... this is for the node bundler strategy to be able to resolve the subpath import properly for types.

[mydea]

Superseded: per discussion we're making @sentry/conventions a regular (externalized) dependency instead of vendoring it into the build, so the relocate-vendored-modules rollup plugin is no longer needed. The per-package PRs now carry the dependency move directly.