typenative 0.1.3 → 0.2.0

package/.gitattributes

@@ -0,0 +1 @@
+govendor/** linguist-vendored

package/.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: '1.26'
 
       - run: npm ci
 

package/.github/workflows/npm-publish-github-packages.yml

@@ -27,7 +27,7 @@ jobs:
           node-version: 24
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23'
+          go-version: '1.26'
       - run: npm ci
       - run: npm ci
         working-directory: conformance

package/CHANGELOG.md

@@ -5,6 +5,253 @@ All notable changes to TypeNative will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.2.0] - 2026-10-18
+
+The Go standard-library bridge (`go:*` imports) goes from 73 to 154 probed packages, with 16
+left typed-only and 6 excluded. Most of the new coverage came with bridge fixes found by the
+probes: callbacks, generics, tuples, struct fields and constants now behave the way the
+generated types say they do.
+
+### Added
+
+- **Go probes**: compress (flate, zlib, lzw, bzip2), archive/tar, encoding (json, base32,
+  ascii85, asn1), mime/quotedprintable, unicode/utf16, hash (adler32, crc64, maphash), crypto
+  (sha3, hkdf, pbkdf2, des, rc4, fips140, ecdh, ecdsa, elliptic, mlkem, mlkemtest, x509, pkix,
+  tls metadata, dsa, hpke), fmt, path, io/fs, io/ioutil, maps, iter, unique, weak, structs,
+  image (color, palette, draw, gif, jpeg), go/* (parser, ast, scanner, printer, constant,
+  build, build/constraint, doc, doc/comment, types, importer), html/template,
+  text/template/parse, regexp/syntax, reflect, net (loopback TCP, textproto, cookiejar,
+  httputil, httptrace, pprof, cgi), runtime (metrics, pprof, trace), time/tzdata, os/user,
+  debug/buildinfo, math/big, testing (testing, fstest, iotest, quick), database/sql (+driver),
+  syscall
+- **Go generics**: type args are inferred recursively from the arguments and through constraint
+  core types (`Map ~map[K]V`); callback params of generic functions and methods on generic
+  receivers (`unique.Handle[T].Value`) are concrete
+- **Go callbacks**: TS closures passed to Go (params or struct fields) get the exact Go
+  signature — int params read as numbers, block bodies work, returns convert to the result type
+- `for (const [k, v] of seq2)` over `iter.Seq2`; destructuring multi-value Go calls types each
+  element; printf-style calls pass numbers to `%d %x %o %b %c %U` as `int64`
+- `String.indexOf(search, fromIndex)`
+- `npm run check:go-types` type-checks the `go:*` probes against `types/typenative-go.d.ts`
+- **Node networking**: `node:net` (TCP / Unix servers and sockets as duplex streams, Node's
+  `ECONNREFUSED`-style errors, `isIP`), `node:dns` (+ `dns/promises`), `node:http` /
+  `node:https` (servers on `net/http`, `request` / `get`, `STATUS_CODES`, `METHODS`),
+  `node:tls` (Node's certificate checks and error codes, `getPeerCertificate`), `node:dgram`,
+  and the global `fetch` with `Headers` / `Request` / `Response`
+- **`node:async_hooks`**: `AsyncLocalStorage` and `AsyncResource`; the event loop carries an
+  async context through timers, `nextTick`, microtasks, promise callbacks, awaits, fs / dns
+  callbacks, streams and servers
+- **`node:test`**: `test` / `describe` / `it` with hooks, subtests, skip / todo, timeouts and
+  `mock.fn`; Node's TAP (or, on a terminal, spec) report and exit code
+- **`node:worker_threads`**: workers re-run the program as child processes linked over
+  loopback TCP (structured-clone messages, `workerData`, `terminate`, errors), plus
+  `MessageChannel` / `MessagePort` / `BroadcastChannel`; globals `__filename` / `__dirname`
+- `new Promise((resolve) => setTimeout(resolve, ms))`: `resolve` / `reject` can be passed as
+  values
+- **`node:stream/web`**: `ReadableStream` / `WritableStream` / `TransformStream` with readers,
+  writers, controllers, queuing strategies, `tee` / `pipeTo` / `pipeThrough` and `for await`;
+  `TextEncoderStream` / `TextDecoderStream`, `CompressionStream` / `DecompressionStream` (also
+  globals); `Readable.toWeb` / `fromWeb` & co. and `stream.compose`
+- `Blob` / `File` (`node:buffer` and globals) and `FormData`; fetch streams bodies
+  (`response.body`, `ReadableStream` uploads), sends Blob / FormData bodies and reads
+  `blob()` / `formData()`
+- `TextDecoder#decode(bytes, { stream: true })`
+- **`node:crypto`**: `scrypt` / `scryptSync`; callback forms of `pbkdf2`, `hkdf`,
+  `randomBytes`, `randomFill`; `KeyObject` with `createPrivateKey` / `createPublicKey` /
+  `createSecretKey` and PEM / DER / JWK import and export; `generateKeyPair(Sync)` (RSA, EC,
+  Ed25519, X25519) and `generateKey(Sync)`; `sign` / `verify`, `createSign` / `createVerify`
+  (PKCS#1 v1.5, PSS, ECDSA DER / P1363, Ed25519); `publicEncrypt` & co.; ECDH and classic
+  Diffie-Hellman (MODP groups); `generatePrime` / `checkPrime`; `X509Certificate`; and
+  `crypto.subtle` (digest, keys, sign / verify, AES-GCM / CBC / CTR, RSA-OAEP, PBKDF2 / HKDF /
+  ECDH / X25519 derivation, wrap / unwrap)
+- **`child_process.fork`** with an IPC channel (`send` / `'message'` / `disconnect`;
+  `process.send` / `process.on('message')` in the child) and **`node:cluster`**: workers share
+  listening ports through the primary, which relays connections round-robin; cluster and worker
+  events, `disconnect`, `setupPrimary`
+- **`node:http2`** on `net/http`'s HTTP/2: h2c and TLS servers with the `'stream'` API
+  (`respond`, `respondWithFile`) and the compatibility `(req, res)` API; `connect()` client
+  sessions whose `request()` streams emit `'response'` with `:status`
+- `path.matchesGlob`; Buffer `read/writeBig(U)Int64LE/BE`, `swap16/32/64`, `buffer.isUtf8` /
+  `isAscii` / `transcode`; `util.parseArgs`, `getSystemErrorName` / `Message` / `Map`,
+  `MIMEType`, `parseEnv`, `aborted`, `debuglog`, `toUSVString`; `process.loadEnvFile`
+- `process.on('uncaughtException' | 'uncaughtExceptionMonitor' | 'unhandledRejection' |
+  'beforeExit')`, `process.cpuUsage` / `resourceUsage` / `availableMemory`; `os.totalmem` /
+  `freemem` / `uptime` / `loadavg` / `release` / `version`; timer handles with `ref` / `unref` /
+  `hasRef` / `refresh` / `close`; `PerformanceObserver`, `performance.timerify` /
+  `eventLoopUtilization`, `createHistogram`, `monitorEventLoopDelay`; `events.errorMonitor`,
+  `captureRejections`, static `getMaxListeners` / `setMaxListeners`, `addAbortListener`
+- zlib callback forms (`gzip(buf, [options], cb)` & co.) and `util.promisify` of them;
+  `readline.cursorTo` / `moveCursor` / `clearLine` / `clearScreenDown`;
+  `diagnostics_channel.tracingChannel` (`traceSync` / `tracePromise` / `traceCallback`) and
+  `channel.bindStore` / `runStores`; `net.BlockList` / `SocketAddress`; `dns.Resolver` (own
+  servers, `timeout`, `cancel`), `setServers`, `lookupService`; `tls.checkServerIdentity` (and
+  the `connect` option); HTTP `'upgrade'` / `'connect'` on servers and clients; node:test
+  `t.assert` and `mock.timers`; `console.table`
+- `new Error(message, { cause })` / `err.cause`; fetch refuses the Fetch standard's bad ports;
+  `net.Stream` and the `autoSelectFamily` defaults
+- **`node:sqlite`**: `DatabaseSync` / `StatementSync` (`run` / `get` / `all` / `iterate`, named
+  and bare parameters, `readBigInts`, `returnArrays`, `columns()`, `expandedSQL`), `function()`,
+  `aggregate()` (window functions), `setAuthorizer`, `limits`, `createTagStore()`, `backup()`,
+  and Node 24's error codes and messages. SQLite comes from github.com/ncruces/go-sqlite3 (Wasm
+  translated to Go: no cgo), vendored in `govendor/` by `npm run vendor:go` so builds need no
+  network. `loadExtension`, sessions and `serialize` are not available
+- conformance.md gives each unsupported Node module (`vm`, `repl`, `inspector`, …) its own section
+
+### Fixed
+
+- **Go types**: void functions were typed as returning `GoError`; params now accept what the
+  bridge converts (`number[]` for `[]byte`, one-char strings for `byte`/`rune`, `null` for
+  nil-able types, an array for variadics, an optional trailing `error`); pointers to basics are
+  `GoRef<T>`; typed constants keep their named type; aliases resolve (`os.FileMode`); named
+  slice/map types keep their methods (`net.IP`); `iter.Seq` is iterable; unimportable
+  `*/internal` packages are dropped and `runtime/cgo` is excluded
+- **Go bridge**: path-qualified types (`net/http.Cookie`) are localized and imported; unused
+  type-only imports are dropped and `import 'go:pkg'` emits `import _`; field reads/writes
+  convert numbers on any receiver; `null` comparisons on nil-able Go values are real nil checks;
+  `===` with typed constants coerces; `ref<T>().value` dereferences; `json.Unmarshal` fills a
+  `Record` ref
+- `npm run gen:go` runs from the repo root again
+- The self-hosted compiler (`npm run build:native`) builds again; the `src/go/*` modules are
+  transpilable by TypeNative
+- Object literals whose keys aren't identifiers (`{ 'Content-Type': … }`) compile (as records)
+- `const { a, b } = f()` evaluates `f()` once
+- `await` inside async arrow callbacks no longer blocks the event loop (every `await` goes
+  through `TnAwait`)
+- `JSON.parse` assigned to an interface type converts into its struct (it was `nil`); typed
+  callback parameters accept decoded JSON-like values
+- `for await` over a stream that errors throws the error (it ended the loop silently)
+- `const { value, done } = obj` on Node class instances types the bindings (and reads
+  accessors); `x as File` asserts dynamic values to Node classes
+- `Response#clone()` of a network body no longer blocks the event loop (both copies stream it)
+- The self-hosted compiler no longer crashes on `const [a, b] = call()`
+- A detached top-level async call with arguments (`run(a, b);`) passes them (they were dropped)
+- A function that only returns `undefined` compiles (its result type was `nil`)
+- `gunzip` of data without a gzip header fails with `incorrect header check`, as in Node
+- Error properties declared by both `NodeJS.ErrnoException` and `AssertionError` no longer hide
+  each other (`(e.cause as Error).message` typed the cause as unknown)
+- Negative bigint literals and `-x` on bigints; hex / octal / binary bigint literals;
+  `p.then(() => …)` on a `Promise<void>`; `JSON.stringify` of records keeps their keys (it
+  printed the map's internals); `String(x)` / template literals use a Node class's `toString()`
+- Top-level variables named like an imported Go package (`rsa`, `pem`, `encoding`, `http`, …) are
+  renamed instead of clashing with it; `bigint.toString(radix)`; `ArrayBuffer` annotations and
+  `byteLength` on Buffers
+- Object literals with `$` in a key (`{ $id: 1 }`) compile (as records); `rows as Row[]` on an
+  array of dynamic values converts each element; records held in dynamic values read their keys
+  (`row.name`, `row['name']`, `Object.keys(row)`, `row as Row`); `bytes[i]` on a dynamic
+  `Uint8Array`; `x === 1n` when `x` is `number | bigint`
+- `arr.reduce(…)` has a result type (functions returning it compiled without a return value); a
+  typed arrow parameter is no longer mistaken for an earlier variable of the same name
+- `(c) => (body += c)` arrow bodies; `console.log(x?.y)` prints optional strings / numbers
+  without quotes; the self-hosted compiler no longer crashes on `console.log` arguments of
+  unknown type
+
+## [0.1.3] - 2026-10-15
+
+Decorators and JSX arrive alongside a broad language-surface expansion (`using`, `new.target`,
+`for await`, namespaces, dynamic `import()`), and `types/typenative.d.ts` grows into a complete
+lib replacement. The conformance suite grows to 241 probes — including its first `.tsx` probe —
+and passes fully through the dev CLI.
+
+### Added
+
+- **Language**: `using` declarations — `[Symbol.dispose]()` runs when the enclosing block or
+  function exits, in reverse declaration order; `new.target` (constructors pass the target class
+  name through `super()` chains); `for await...of`; the `arguments` object; namespaces; computed
+  and heterogeneous enums; callable/construct signatures (`type F = { (): void }` — a class passed
+  as a value is its constructor); ambient declarations (`declare const` / `declare function` /
+  `declare module`); string, numeric and boolean literal types (single literals, unions,
+  literal-union `Record` keys)
+- **Decorators**: standard method and class decorators — decorator factories (`@tag('x')`),
+  stacked decorators, static methods — applied where the class is defined; `this` in the wrapper
+  is the decorated method's receiver; `f.call` / `f.apply`
+- **JSX**: `.tsx` files render JSX to HTML strings — text is escaped, void tags self-close
+  (`<br/>`), components are called with their props, `className` maps to `class`, boolean
+  attribute shorthand (`disabled`) and fragments flatten; both parsers take a tsx flag and
+  `.tsx` imports resolve
+- **Modules**: re-exports (`export { x } from './y'`), side-effect imports (`import './x'`),
+  dynamic `import()` (async), `import x = require('y')`; top-level statements of imported
+  modules execute through a generated `init()`
+- **Typing**: rest-parameter function types `(...args: T[]) => R` become variadic Go func types
+- **Library**: `String.normalize` — backed by `golang.org/x/text/unicode/norm`, vendored from
+  GOROOT's vendor tree via a `replace` in `dist/go.mod`, so builds need no network; object
+  literals of method-bearing interfaces; `new Set([...spread])`
+- **Type definitions**: `types/typenative.d.ts` expands by ~500 lines — `Generator`/`AsyncGenerator`
+  and the `Iterable`/`AsyncIterable` families, `Disposable`, `Awaited`, `TemplateStringsArray`,
+  `ArrayLike`, real mapped types for `Partial`/`Required`/`Readonly`/`Pick`/`Omit`/`Record`,
+  `RegExpExecArray`, constructor interfaces (`Array`/`String`/`Number`) and the `JSX` namespace
+- **Project config**: `types/tsconfig.json` — a standalone `lib: []` project for the
+  lib-replacement d.ts, so editors don't load es5 libs alongside it (TS6200, duplicate identifiers)
+
+### Changed
+
+- The conformance runner picks up `.tsx` probes; scaffolds pin `typenative ^0.1.3`; `dist/`
+  cleanup also removes stale `go.mod`/`go.sum`
+- Both parsers emit `declarationKind` (`var`/`let`/`const`/`using`/`await using`) on variable
+  declaration lists; tsparser takes `--tsx` and emits `JsxText`
+- README rewritten: requirements, quick start, CLI reference, and expanded language/stdlib tables
+
+## [0.1.2] - 2026-10-13
+
+The type system and standard library catch up with the conformance matrix: generics gain
+constraints, defaults and generic interfaces; utility types, `keyof`/`typeof`, intersections,
+conditional types and mapped types lower to Go; Promise, timer, Object, collection and math
+built-ins round out. The conformance suite grows to 219 probes (including 15 for rows that
+already worked — `console.error`/`warn`, `Map`/`Set.clear`, `node:url`, `process.cwd`, `split`
+with a RegExp, access modifiers, `const enum`, `import type`, indexed access types, literal
+types, hex/octal/binary literals, `override`, template literal types, `var`) and passes fully
+through the dev CLI; the stage-1/stage-2 bootstrap fixpoint holds.
+
+### Added
+
+- **Generics**: constraints (`T extends U`), defaults (`T = U`), generic interfaces, class
+  expressions, index signatures, `keyof` and mapped types
+- **Type operators**: `keyof T`, `typeof x`, `readonly T[]`, intersections `A & B` (merged into
+  one struct), conditional types (`T extends U ? X : Y`) with `infer`, `void`/`never`/`object`,
+  the `void` operator, `satisfies`
+- **Utility types**: `Partial`, `Required`, `Readonly`, `Pick`, `Omit`, `NonNullable` (lowered to
+  the base type)
+- **Language**: async generators (`async function*` driven by `for await`), labeled tuple
+  elements with optional and rest members (`[x: number, y?: string, ...rest: number[]]`),
+  overload signatures, `this: T` parameters, `asserts x is T`, optional call `f?.()` (checks the
+  function value; the result is nullable), comma-separated declarators/updates in `for` headers
+  (`for (let i = 0, j = 10; …; i++, j--)` via Go's parallel forms), import renaming
+  (`import { a as b }`), `static { … }` blocks → `func init()`, self-referencing arrow functions
+  (`const f = (…) => … f(…) …`)
+- **Promises & timers**: `Promise.prototype.reject`/`catch`/`finally`, combinators
+  `race`/`allSettled`/`any`, `Promise.resolve`; `setTimeout` returns a handle that `clearTimeout`
+  stops; `setInterval`; `queueMicrotask`
+- **Objects**: `Object.hasOwn`, `Object.defineProperty`, `Object.fromEntries`, integrity methods
+  (`freeze`/`seal`/`preventExtensions`)
+- **Collections**: `WeakMap`/`WeakSet`; ES2024 `Set` operations (`union`, `intersection`,
+  `difference`, `isSubsetOf`, …); array `concat` (flattens one level), `copyWithin`, `toSpliced`,
+  `toSorted`, `toReversed`, `with`, `reduceRight`; `any` receivers accept the newer array methods
+  through array-only method casts
+- **Strings, numbers, regex**: `String.raw`, `toPrecision`, `String()`/`Boolean()` with JS
+  formatting and truthiness; regex `y`/`u` flags and `.source`/`.flags`
+- **Globals**: `globalThis`, `structuredClone`, `isFinite`, `encodeURIComponent`/
+  `decodeURIComponent`; `Math` constants (`PI`, `E`, `SQRT2`, …) and `hypot`/`cbrt`/`expm1`/
+  `log1p`/hyperbolics/inverse trig/`atan2`
+- **Date**: `getUTC*` getters and `Date.UTC`
+- **Semantics**: functions stored in `Record`s are called as values — `rec.fn(args)` lowers to
+  `rec.Get("fn")(args)` (previously dispatched as a built-in method, so `handlers.sort(x)` ran an
+  array sort); names that are also JS `Map` methods stay Map methods unless the receiver is typed
+  as a `Record`; dynamic `obj[key] = v` writes; mixed array literals (`[['a', 1]]`) become
+  `[]interface{}`
+
+### Changed
+
+- tsparser emits the raw text of template literals
+
+### Fixed
+
+- `JSON.stringify` no longer HTML-escapes `<`, `>`, `&` in the reflection path (`json.Marshal`
+  produced `\u003c`); stage 1 and stage 2 of the bootstrap generate identical Go again
+- `Date.toISOString` printed the month twice (`2006-01-01` instead of `2006-01-02`)
+- `??` passed to a nullable parameter is boxed; object literals nested in dynamic objects stay
+  dynamic; shorthand properties (`{ x }`) read narrowed variables correctly
+
 ## [0.1.1] - 2026-10-10
 
 The conformance suite is fully green: all 147 probes pass (up from 95/147), through both the dev

package/CONTRIBUTION.md

@@ -66,7 +66,7 @@ The `.d.ts` files are the type-checking contract for user code. If your feature
 
 - `types/typenative.d.ts` — core JS subset (`Array`, `Map`, `Set`, `JSON`, `Math`, `RegExp`, …).
 - `types/typenative-npm.d.ts` — `node:*` shims (`fs`, `path`, `os`, `child_process`, …).
-- `types/typenative-go.d.ts` — `go:*` bridges (`fmt`, `strings`, `strconv`).
+- `types/typenative-go.d.ts` — `go:*` bridges. Generated from the Go standard library by `npm run gen:go` (`scripts/gostd`), which also rewrites the Go table in conformance.md; never edit it by hand. `npm run check:go-types` type-checks the `lib-go-*` probes against it.
 
 No signature → user code won't type-check → the feature doesn't exist.
 

package/README.md

@@ -154,7 +154,7 @@ TypeNative supports a growing subset of TypeScript, not the whole language. The
 | `JSON`          | `parse` / `stringify`                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `RegExp`        | Literals + `new RegExp()`, `test()`, `exec()` with named groups (`.groups`), flags `i`/`m`/`s`/`g`/`y`/`u`, stateful `lastIndex` for `/g` loops, `source`/`flags`/`global`/... properties. Backreferences, lookahead and lookbehind run on a small backtracking engine (RE2 does not support them)                                                                                                                              |
 | Globals         | `setTimeout`/`clearTimeout`, `setInterval`/`clearInterval`, `queueMicrotask`, `structuredClone`, `globalThis`, `encodeURIComponent`/`decodeURIComponent`, `isNaN`/`isFinite`, `NaN`/`Infinity`                                                                                                                                                                                                                                  |
-| `process`       | `argv` (→ `os.Args`), `platform` (→ Node-style names), `env`, `cwd`, `exit`                                                                                                                                                                                                                                                                                                                                                     |
+| `process`       | `argv`, `platform` (→ Node-style names), `env`, `cwd`, `exit`, `exitCode`, `hrtime`, `stdout`/`stderr`/`stdin`, `on('exit')`, … (see [node:process](conformance.md#nodeprocess))                                                                                                                                                                                                                                      |
 
 **Node built-ins (import with the `node:` prefix, mapped to Go helpers):**
 
@@ -169,7 +169,7 @@ fs.readFileSync('file.txt', 'utf-8');
 childProcess.spawnSync('go', ['version'], { encoding: 'utf-8' });
 ```
 
-Supported: `node:path` (`join`, `dirname`, `basename`, `extname`, `resolve`), `node:fs` (`read`/`write`/`append`/`exists`/`mkdir`/`readdir`/`copy`/`rm`/`unlink`), `node:url` (`fileURLToPath`, `pathToFileURL`), `node:os` (`platform`, `homedir`, `tmpdir`), `node:child_process` (sync `exec`, `execSync`, and `spawnSync` shaped like Node's `{ stdout, stderr, status }`; pass `{ stdio: 'inherit' }` to run with the parent's stdio or `{ input }` to pipe stdin). `node:readline.question()` exists as a TypeNative sync extension for self-hosted prompts.
+Supported: `path`, `fs` (sync, callbacks, `fs/promises`, streams), `os`, `process`, `buffer`, `url` (`URL`, `URLSearchParams`), `util`, `assert`, `crypto` (hashes, ciphers, keys, signatures, `X509Certificate`, `crypto.subtle`), `zlib`, `events`, `stream` (+ `stream/web`: `ReadableStream` & co.), `readline`, `child_process` (with `fork` / IPC), `cluster`, `timers`, `perf_hooks`, `querystring`, `string_decoder`, networking (`net`, `dns`, `http`, `https`, `http2`, `tls`, `dgram`, global `fetch` with `Blob` / `FormData`), `async_hooks` (`AsyncLocalStorage`), `diagnostics_channel` (with `tracingChannel`), `test` (the `node:test` runner, with `mock.timers`), `worker_threads` (workers as child processes) and `sqlite` (`DatabaseSync` on a bundled pure-Go SQLite: no cgo, no network at build time) and more, with Node's signatures (import as `node:x` or `x`). Callbacks, timers and I/O run on one event loop, as in Node. `node:readline.question()` exists as a TypeNative sync extension for self-hosted prompts. Per-API status: [conformance.md](conformance.md#node-builtins-node).
 
 **Direct Go access (import with the `go:` prefix):**
 
@@ -180,7 +180,7 @@ import { ToUpper } from 'go:strings';
 Println(Sprintf('hi %s', ToUpper('bob')));
 ```
 
-Any Go package can be imported this way (`import { X } from 'go:pkg'` → `pkg.X`); the typed subset declared for typechecking is `go:fmt` (`Println`, `Sprintf`), `go:strings` (`ToUpper`, `ToLower`), `go:strconv` (`FormatBool`).
+Any Go package can be imported this way (`import { X } from 'go:pkg'` → `pkg.X` with numeric conversion and throw-on-error results). The full standard library is declared for typechecking (`npm run gen:go`), with 154 packages probed — see [conformance.md](conformance.md#go-bridges-gostar).
 
 **npm packages:**
 
@@ -240,7 +240,7 @@ main.ts --(parse)--> normalized JSON AST --(transpileToNative)--> dist/code.go -
 
 - **Parse:** Node CLI uses the `typescript` npm package (`src/parse-node.ts`); the self-hosted binary spawns the Go `tsparser` tool (`src/parse-native.ts`). Both emit the same `{ kind: "Xxx", ... }` JSON shape so one transpiler consumes either.
 - **Transpile:** `transpileToNative(code, { parse, readFile })` in `src/transpiler.ts` lowers the AST to Go, resolving relative and npm imports into additional Go files (`TranspileResult { main, files }`).
-- **Build:** `run()` in `src/index.ts` writes `dist/code.go` (+ one Go file per module), cleans stale `dist/*.go`, shells out to `go build -o dist/native(.exe)`, then either executes it (`--script`, stdio inherited) or copies it to `--output`.
+- **Build:** `run()` in `src/index.ts` writes `dist/code.go` (+ one Go file per module), cleans stale `dist/*.go`, shells out to `go build -o dist/native(.exe)`, then either executes it (`--script`, stdio inherited) or copies it to `--output`. Third-party Go modules a program needs (`node:sqlite`'s driver, shipped in `govendor/`; `golang.org/x/text`, copied from GOROOT) are copied under `dist/tnvendor` and wired in with `replace` directives in `dist/go.mod`, so builds stay offline.
 
 ## Testing and conformance
 

package/bin/cli.js

@@ -2,6 +2,7 @@
 // Node CLI entry point (npm `bin`). Interactive prompts use inquirer here;
 // the actual compiler logic lives in the transpilable src/index.ts.
 import inquirer from 'inquirer';
+import { fileURLToPath } from 'node:url';
 import { run, createProject } from './index.js';
 import { parseAstJson } from './parse-node.js';
 (async function main() {
@@ -57,6 +58,7 @@ import { parseAstJson } from './parse-node.js';
         output: output ?? answers.output ?? null,
         scriptMode,
         tsCode: answers.tsCode ?? null,
-        parse: parseAstJson
+        parse: parseAstJson,
+        vendorDir: fileURLToPath(new URL('../govendor', import.meta.url))
     });
 })();