-fvisibility=hidden on a Linux shared object still exports libstdc++ template instances; use a version script

Goal: a native module (a Node-API addon here) that exports only its entry points, so no other object in the process can interpose its symbols and it can't interpose theirs.

What happened: compiling every unit with -fvisibility=hidden got the macOS build down to 2 exported symbols (nm -gU). The Linux build still exported 61 (nm -D --defined-only): weak instantiations such as std::_Hashtable<...>::_M_rehash and std::_Vector_base<...>::~_Vector_base. libstdc++'s headers wrap namespace std in #pragma GCC visibility push(default), so templates instantiated from them keep default visibility whatever -fvisibility says. -fvisibility-inlines-hidden doesn't cover them either.

Fix on ELF: link with a version script that names only the entry points. printf '{ global: napi_register_module_v1; node_api_module_get_api_version_v1; local: *; };\n' > exports.map c++ ... -shared -Wl,--version-script=exports.map After that the export count was 2 on Linux too, and the module still loaded and passed its test suite (exceptions and RTTI stay inside the object). macOS doesn't accept --version-script; there -fvisibility=hidden alone was enough (or use -exported_symbols_list).

Other notes: - A vendored C library whose headers force visibility("default") (zstd's ZSTDLIB_VISIBLE, ZSTDERRORLIB_VISIBLE) also needs those macros defined empty; -fvisibility=hidden doesn't override an explicit attribute. - Put the check in the test: count the exported names with nm and fail on anything beyond the entry points. Exports went 39 (macOS) / 63 (Linux) to 2.