# AI Engineering from Scratch TypeScript Dependencies: The Complete Allow-List

> Discover the five essential TypeScript dependencies for AI Engineering from Scratch including hono, zod, and ws. Understand the complete allow-list for your project.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: best-practices
- Published: 2026-08-28

---

**The AI Engineering from Scratch curriculum permits only five TypeScript dependency categories: the `hono` HTTP framework, `zod` for schema validation, the `ws` library for WebSocket communication (when explicitly required), the `@hono/node-server` adapter, and Node.js 20+ built-in standard library modules.**

The repository maintains a strict dependency policy defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) to ensure learners focus on fundamental AI engineering concepts rather than framework abstractions. According to the rohitg00/ai-engineering-from-scratch source code, this curated list appears at line 60 of the agents configuration file and enforces a "stdlib-first" philosophy throughout the curriculum.

## The Complete TypeScript Allow-List

The curriculum explicitly whitelights the following packages in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) (lines 50-62):

- **`hono`** – A small, composable HTTP framework used for building lightweight servers in lesson examples without the overhead of larger frameworks like Express or NestJS.
- **`zod`** – A pure TypeScript schema validation library that enables type-safe input checking with zero dependencies, aligning with the curriculum's type-driven development approach.
- **`ws`** – A minimal WebSocket client/server implementation permitted only when lessons specifically require real-time communication (e.g., streaming token generation).
- **`@hono/node-server`** – An adapter that allows `hono` to run on Node.js 20+, maintaining consistency with the curriculum's runtime requirements.
- **Node 20+ stdlib** – All built-in Node.js modules (e.g., `fs`, `path`, `crypto`, `http`) are permanently available without additional installation.

These packages were selected because they are lightweight, well-maintained, and provide excellent TypeScript typings while avoiding the "hidden magic" of larger ecosystems.

## Why the Curriculum Enforces a Strict Dependency Policy

The allow-list serves three educational objectives defined in the repository's guidelines:

**Educational Clarity** – Students see full implementations of core algorithms (attention mechanisms, back-propagation) without abstraction layers hiding the underlying logic. By prohibiting frameworks like Express or frontend libraries, the curriculum ensures learners understand every line of code.

**Reproducibility** – Small, well-scoped packages reduce version-conflict risks across different lessons. The locked dependency tree guarantees that code written for phase one will still execute identically in phase six.

**Portability** – Lessons run on any standard Node.js 20+ environment without additional setup scripts or containerization. The reliance on stdlib-first architecture means examples work consistently across macOS, Linux, and Windows environments.

## Practical Implementation Examples

The following patterns demonstrate how to use each allowed dependency within the curriculum constraints.

### Setting Up HTTP Servers with Hono

In `phases/*/code/main.ts` files, learners implement REST endpoints using the `hono` framework paired with the Node.js adapter:

```typescript
import { Hono } from 'hono';
import { serve } from '@hono/node-server';

const app = new Hono();

app.get('/', (c) => c.text('Hello from AI Engineering!'));

serve(app, { port: 3000 });

```

The `@hono/node-server` import is required because the curriculum targets Node.js 20+ runtimes rather than edge environments. This combination provides a minimal router API (`app.get`, `app.post`, etc.) without pulling in unnecessary middleware stacks.

### Type-Safe Validation with Zod

For input validation in API endpoints, the curriculum requires `zod` schemas to ensure compile-time and runtime type safety:

```typescript
import { z } from 'zod';
import { Hono } from 'hono';
import { serve } from '@hono/node-server';

const MessageSchema = z.object({
  text: z.string().min(1),
  sender: z.string(),
});

const app = new Hono();

app.post('/message', async (c) => {
  const body = await c.req.json();
  const result = MessageSchema.safeParse(body);
  if (!result.success) {
    return c.json({ error: result.error.errors }, 400);
  }
  return c.json({ status: 'ok' });
});

serve(app, { port: 3000 });

```

This pattern validates request payloads against TypeScript interfaces, ensuring that lessons involving data preprocessing or model inputs receive correctly typed parameters.

### Real-Time Communication with ws

When lessons explore streaming inference or real-time model interactions, the `ws` package is conditionally imported as specified in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) line 60:

```typescript
import { WebSocketServer } from 'ws';
import { serve } from '@hono/node-server';
import { Hono } from 'hono';

const app = new Hono();
const server = serve(app, { port: 3000 });

const wss = new WebSocketServer({ server });

wss.on('connection', (ws) => {
  ws.send('Welcome to the AI-engineered chat!');
  ws.on('message', (msg) => {
    console.log('Received:', msg);
    ws.send(`Echo: ${msg}`);
  });
});

```

The curriculum permits `ws` only when WebSocket functionality is explicitly required for the lesson, maintaining the lightweight dependency footprint otherwise.

### Leveraging Node.js Standard Library

All lessons may freely utilize Node.js built-in modules without restriction. This example from the foundational phases demonstrates stdlib usage for configuration loading:

```typescript
import { readFile } from 'node:fs/promises';
import { join } from 'node:path';

async function loadConfig() {
  const path = join(process.cwd(), 'config.json');
  const data = await readFile(path, 'utf-8');
  return JSON.parse(data);
}

```

The `node:` prefix syntax is encouraged for clarity, though not strictly required in Node.js 20+.

## Summary

- The **only permitted external TypeScript packages** are `hono`, `zod`, `ws` (conditional), and `@hono/node-server` as documented in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) lines 50-62.
- The curriculum follows a **stdlib-first philosophy**, requiring Node.js 20+ and allowing unrestricted use of built-in modules like `fs`, `crypto`, and `path`.
- This strict allow-list ensures **educational transparency**, allowing students to see complete implementations of AI algorithms without framework abstraction layers.
- All code examples must adhere to these constraints to remain compatible with the repository's testing infrastructure in `phases/*/code/tests/`.

## Frequently Asked Questions

### Can I use Express.js or NestJS in AI Engineering from Scratch projects?

No. The curriculum explicitly prohibits larger frameworks like Express, NestJS, or Fastify. The [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) file mandates `hono` as the sole HTTP framework because it is lightweight, composable, and does not obscure the underlying Node.js HTTP mechanics that learners must understand.

### Why is Zod the only validation library allowed?

`zod` is the only permitted validation library because it is written in pure TypeScript with zero runtime dependencies, providing both compile-time type inference and runtime validation. This aligns with the curriculum's goal of teaching type-safe engineering practices without introducing external complexity or heavy package trees.

### Is TypeScript itself required, or can I write plain JavaScript?

While the repository is designed for TypeScript (as evidenced by `.ts` file extensions in lesson paths like `phases/*/code/main.ts`), the dependency rules focus on runtime packages. Node.js 20+ is required, and TypeScript compilation is assumed, though the specific compiler configuration follows standard Node.js TypeScript patterns without additional tooling restrictions.

### Can I install additional npm packages for visualization or data processing?

No. The allow-list is strictly enforced. For data manipulation, lessons utilize Node.js built-in modules (`fs`, `crypto`, `stream`) and native TypeScript data structures. Visualization requirements are typically handled via HTML output from `hono` servers or stdlib-based file generation, not specialized charting libraries.