Add initial bundler plugin

[timokoessler]

Todos

• Add an agent mode during bundling that e.g. does not report to API
• Fix SCA reporting of dependencies
• Zen can not be disabled completely at runtime in bundling mode (?)
• Write docs
• Supported bundlers
  • Esbuild
  • Rolldown
• Check on runtime if the same agent version is used
• Do not require output dir if copy Files is false

Future Todos

• Supported bundlers
  • Vite (e.g. Nuxt, Astro, Remix ...)
  • Webpack (e.g. old Next.js)
  • Rollup
  • ...
• Sourcemaps?

Summary by Aikido

⚠️ Security Issues: 2	🔍 Quality Issues: 10	Resolved Issues: 0

🚀 New Features

• Added initial bundler plugin with esbuild and rolldown support

⚡ Enhancements

• Modified instrumentation transformer to inject bundling-specific helper calls
• Added bundling mode flags to agent/hooks to skip runtime hooks during bundling
• Updated ESM test script and package.json to include bundler dev dependencies

^{More info}

[codecov]

Codecov Report

❌ Patch coverage is 92.99674% with 43 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
library/bundler/internal/bundlers/esbuild.ts	90.54%	14 Missing ⚠️
library/bundler/internal/base.ts	92.81%	13 Missing ⚠️
library/bundler/internal/bundlers/rolldown.ts	95.00%	5 Missing and 1 partial ⚠️
...y/agent/hooks/instrumentation/injectedFunctions.ts	90.47%	4 Missing ⚠️
...nt/hooks/instrumentation/transformCodeInsertSCA.ts	93.18%	3 Missing ⚠️
library/agent/hooks/wrapNewInstance.ts	0.00%	2 Missing ⚠️
library/agent/hooks/wrapExport.ts	85.71%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[aikido-pr-checks]

Reassigning function parameter 'moduleInfo' with 'moduleInfo ??= getModuleInfoFromPath(path)'. Use a new local variable or default parameter instead.

Details

✨ AI Reasoning
​The patch introduced nullish-coalescing assignments to function parameters inside the patched function. Reassigning incoming parameters can obscure the original argument values and confuse callers and maintainers. The changes specifically set defaults by mutating parameters rather than using local variables or default parameters. This harms clarity and maintainability and was introduced in this diff.

🔧 How do I fix it?
Create new local variables instead of reassigning parameters. Use different variable names to clearly distinguish between input and modified values.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}