AI Engineering from Scratch TypeScript Dependencies: The Complete Allow-List

The AI Engineering from Scratch curriculum permits only five TypeScript dependency categories: the hono HTTP framework, zod for schema validation, the ws library for WebSocket communication (when explicitly required), the @hono/node-server adapter, and Node.js 20+ built-in standard library modules.

The repository maintains a strict dependency policy defined in AGENTS.md to ensure learners focus on fundamental AI engineering concepts rather than framework abstractions. According to the rohitg00/ai-engineering-from-scratch source code, this curated list appears at line 60 of the agents configuration file and enforces a "stdlib-first" philosophy throughout the curriculum.

The Complete TypeScript Allow-List

The curriculum explicitly whitelights the following packages in AGENTS.md (lines 50-62):

• hono – A small, composable HTTP framework used for building lightweight servers in lesson examples without the overhead of larger frameworks like Express or NestJS.
• zod – A pure TypeScript schema validation library that enables type-safe input checking with zero dependencies, aligning with the curriculum's type-driven development approach.
• ws – A minimal WebSocket client/server implementation permitted only when lessons specifically require real-time communication (e.g., streaming token generation).
• @hono/node-server – An adapter that allows hono to run on Node.js 20+, maintaining consistency with the curriculum's runtime requirements.
• Node 20+ stdlib – All built-in Node.js modules (e.g., fs, path, crypto, http) are permanently available without additional installation.

These packages were selected because they are lightweight, well-maintained, and provide excellent TypeScript typings while avoiding the "hidden magic" of larger ecosystems.

Why the Curriculum Enforces a Strict Dependency Policy

The allow-list serves three educational objectives defined in the repository's guidelines:

Educational Clarity – Students see full implementations of core algorithms (attention mechanisms, back-propagation) without abstraction layers hiding the underlying logic. By prohibiting frameworks like Express or frontend libraries, the curriculum ensures learners understand every line of code.

Reproducibility – Small, well-scoped packages reduce version-conflict risks across different lessons. The locked dependency tree guarantees that code written for phase one will still execute identically in phase six.

Portability – Lessons run on any standard Node.js 20+ environment without additional setup scripts or containerization. The reliance on stdlib-first architecture means examples work consistently across macOS, Linux, and Windows environments.

Practical Implementation Examples

The following patterns demonstrate how to use each allowed dependency within the curriculum constraints.

Setting Up HTTP Servers with Hono

In phases/*/code/main.ts files, learners implement REST endpoints using the hono framework paired with the Node.js adapter:

import { Hono } from 'hono';
import { serve } from '@hono/node-server';

const app = new Hono();

app.get('/', (c) => c.text('Hello from AI Engineering!'));

serve(app, { port: 3000 });

The @hono/node-server import is required because the curriculum targets Node.js 20+ runtimes rather than edge environments. This combination provides a minimal router API (app.get, app.post, etc.) without pulling in unnecessary middleware stacks.

Type-Safe Validation with Zod

For input validation in API endpoints, the curriculum requires zod schemas to ensure compile-time and runtime type safety:

import { z } from 'zod';
import { Hono } from 'hono';
import { serve } from '@hono/node-server';

const MessageSchema = z.object({
  text: z.string().min(1),
  sender: z.string(),
});

const app = new Hono();

app.post('/message', async (c) => {
  const body = await c.req.json();
  const result = MessageSchema.safeParse(body);
  if (!result.success) {
    return c.json({ error: result.error.errors }, 400);
  }
  return c.json({ status: 'ok' });
});

serve(app, { port: 3000 });

This pattern validates request payloads against TypeScript interfaces, ensuring that lessons involving data preprocessing or model inputs receive correctly typed parameters.

Real-Time Communication with ws

When lessons explore streaming inference or real-time model interactions, the ws package is conditionally imported as specified in AGENTS.md line 60:

import { WebSocketServer } from 'ws';
import { serve } from '@hono/node-server';
import { Hono } from 'hono';

const app = new Hono();
const server = serve(app, { port: 3000 });

const wss = new WebSocketServer({ server });

wss.on('connection', (ws) => {
  ws.send('Welcome to the AI-engineered chat!');
  ws.on('message', (msg) => {
    console.log('Received:', msg);
    ws.send(`Echo: ${msg}`);
  });
});

The curriculum permits ws only when WebSocket functionality is explicitly required for the lesson, maintaining the lightweight dependency footprint otherwise.

Leveraging Node.js Standard Library

All lessons may freely utilize Node.js built-in modules without restriction. This example from the foundational phases demonstrates stdlib usage for configuration loading:

import { readFile } from 'node:fs/promises';
import { join } from 'node:path';

async function loadConfig() {
  const path = join(process.cwd(), 'config.json');
  const data = await readFile(path, 'utf-8');
  return JSON.parse(data);
}

The node: prefix syntax is encouraged for clarity, though not strictly required in Node.js 20+.

Summary

• The only permitted external TypeScript packages are hono, zod, ws (conditional), and @hono/node-server as documented in AGENTS.md lines 50-62.
• The curriculum follows a stdlib-first philosophy, requiring Node.js 20+ and allowing unrestricted use of built-in modules like fs, crypto, and path.
• This strict allow-list ensures educational transparency, allowing students to see complete implementations of AI algorithms without framework abstraction layers.
• All code examples must adhere to these constraints to remain compatible with the repository's testing infrastructure in phases/*/code/tests/.

Frequently Asked Questions

Can I use Express.js or NestJS in AI Engineering from Scratch projects?

No. The curriculum explicitly prohibits larger frameworks like Express, NestJS, or Fastify. The AGENTS.md file mandates hono as the sole HTTP framework because it is lightweight, composable, and does not obscure the underlying Node.js HTTP mechanics that learners must understand.

Why is Zod the only validation library allowed?

zod is the only permitted validation library because it is written in pure TypeScript with zero runtime dependencies, providing both compile-time type inference and runtime validation. This aligns with the curriculum's goal of teaching type-safe engineering practices without introducing external complexity or heavy package trees.

Is TypeScript itself required, or can I write plain JavaScript?

While the repository is designed for TypeScript (as evidenced by .ts file extensions in lesson paths like phases/*/code/main.ts), the dependency rules focus on runtime packages. Node.js 20+ is required, and TypeScript compilation is assumed, though the specific compiler configuration follows standard Node.js TypeScript patterns without additional tooling restrictions.

Can I install additional npm packages for visualization or data processing?

No. The allow-list is strictly enforced. For data manipulation, lessons utilize Node.js built-in modules (fs, crypto, stream) and native TypeScript data structures. Visualization requirements are typically handled via HTML output from hono servers or stdlib-based file generation, not specialized charting libraries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}