side-channel

Draft: expose as a storage-only entry backed by the same implementations as the default API. Dependencies: https://github.com/ljharb/side-channel-list/pull/4 https://github.com/ljharb/side-channel-map/pull/2 https://github.com/ljharb/side-channel-weakmap/pull/2 All three backend storage subpaths must be released before this can merge. The default entry still initializes the public backends and retains its original assertion behavior; the storage entry exclusively imports the backend storage subpaths. Before merge, raise the backend minimum versions to their first storage-entry releases. Current manifest ranges are retained rather than inventing unpublished versions, so registry-only CI for this draft is expected to remain blocked on those releases. This exposes a storage-only subpath while keeping the existing root API, assertion behavior, native-intrinsic captures, and collection fallbacks. Consumers that do not call assert can avoid loading its formatter without changing their storage algorithm. The get/has/set/delete implementation is shared by the new subpath and the existing root entry. The root still supplies assert, including its existing error messages and dynamic lookup of channel.has. Validation with the coordinated source branches: Existing and new test suites pass on Node 16.20.2 and 24.19.0. ESLint passes (existing warnings remain); declarations and checked JS pass TypeScript 5.9.3 with dependency paths pointing to the coordinated source branches. An additional local before/after differential passes with WeakMap+Map, Map-only, WeakMap-only, and neither, including primitive/NaN keys, aliases/cycles, filter-created objects, Proxy access order, and late collection-prototype mutation. A cold-load regression test rejects any attempt by the storage entry to load object-inspect. Package dry runs include storage.js and storage.d.ts. The root now wraps a storage object to preserve its existing own-property order and closed-over assertion semantics. That adds one wrapper object for root-entry users; no runtime-performance improvement is claimed. The Node <16 CI matrix remains to be run upstream. A coordinated esbuild 0.25.12 browser/ES5/minified bundle of the current qs API shrinks from 46,520 to 36,693 bytes (9.60 KiB less); gzip-9 shrinks from 14,467 to 11,312 bytes (3.08 KiB less). This is a standalone reproducible-library fixture, not a promise about any application's savings. Identical versions of transitive dependencies were deduplicated in both builds. Related discussion: https://github.com/ljharb/qs/issues/404 and https://github.com/ljharb/side-channel/pull/12. This keeps the robustness machinery and does not remove the public assertion API. Coordinated integration: https://github.com/ljharb/side-channel/pull/17; consumer: https://github.com/ljharb/qs/pull/632.

The published npm package includes which extends (a devDependency). This causes build failures in webpack 5.109.0+ when auto-enables, as it attempts to resolve the missing devDependency reference. Fix:** Add to This is a development-time file that shouldn't be distributed with the runtime package.

Removes get-intrinsic/call-bind as dependencies without changing the supported runtimes or the robustness of the package assuming side-channel is required before WeakMap/Map/Function are tampered with. I wasn't able to test in node@0.4 but I tested in node@0.8 (no Map or WeakMap) and everything worked fine there. Also I fixed the lint.