# Allowed TypeScript Dependencies in the AI-Engineering-From-Scratch Curriculum

> Discover the five allowed TypeScript dependencies for the AI-Engineering-From-Scratch curriculum. Learn the stdlib-first policy for clear AI engineering education.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: best-practices
- Published: 2026-09-11

---

**The AI-Engineering-From-Scratch curriculum permits only five specific TypeScript dependencies: `hono`, `zod`, `ws`, `@hono/node-server`, and Node.js 20+ standard library modules, enforcing a strict stdlib-first policy to maintain pedagogical clarity.**

The `rohitg00/ai-engineering-from-scratch` repository maintains a rigorous **dependency allowlist** to ensure every lesson focuses on core language fundamentals rather than third-party abstractions. When implementing TypeScript solutions in this curriculum, contributors must import exclusively from the sanctioned package set defined in the project's governance documentation.

## The Complete TypeScript Dependency Allowlist

According to [[`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md)](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L57-L61) at lines 57-61, only the following TypeScript dependencies are permitted in lesson code:

- **`hono`** — A lightweight HTTP router for building API servers without framework bloat.
- **`zod`** — Type-safe schema validation for enforcing request and response contracts.
- **`ws`** — WebSocket client/server capabilities, authorized only when lessons specifically require real-time communication.
- **`@hono/node-server`** — The required adapter to run Hono applications in Node.js 20+ environments.
- **Node.js 20+ standard library** — All built-in modules including `fs`, `path`, `http`, and `stream` are explicitly allowed.

This restriction ensures lesson code remains reproducible, transparent, and free from "black-box" library complexity that might obscure learning objectives.

## Why the Curriculum Limits TypeScript Dependencies

The repository enforces a **stdlib-first approach** to teaching AI engineering concepts. By restricting external dependencies, the curriculum compels learners to engage directly with TypeScript's type system and Node.js core APIs rather than hiding implementation details behind opaque third-party wrappers.

Each permitted package serves a specific pedagogical purpose. Hono demonstrates minimal HTTP routing without the indirection of larger frameworks, while Zod illustrates runtime type validation patterns that complement TypeScript's compile-time checks. The WebSocket library (`ws`) appears only in lessons explicitly covering persistent connection protocols.

## Implementing Lessons with Allowed TypeScript Dependencies

The following patterns demonstrate compliant usage of each sanctioned package within the curriculum's constraints.

### Building HTTP Servers with Hono

The `hono` package functions as the primary HTTP framework for API development, providing a minimal abstraction over Node.js server primitives.

```typescript
import { Hono } from 'hono';

const app = new Hono();

app.get('/hello', c => c.text('Hello from the AI-Engineering curriculum!'));

// Run with @hono/node-server (Node 20+)
export default app;

```

When deploying to Node.js 20+, combine this with the `@hono/node-server` adapter to handle the underlying HTTP server instantiation.

### Runtime Validation Using Zod

Type-safe validation ensures external data conforms to expected contracts without sacrificing TypeScript's static type guarantees.

```typescript
import { Hono } from 'hono';
import { z } from 'zod';

const app = new Hono();
const BodySchema = z.object({ name: z.string() });

app.post('/greet', async c => {
  const result = BodySchema.safeParse(await c.req.json());
  if (!result.success) return c.json({ error: 'Invalid payload' }, 400);
  return c.json({ message: `Hi, ${result.data.name}!` });
});

```

This pattern integrates Hono's request handling with Zod's schema validation to create robust, type-safe endpoints.

### Real-Time Communication with WebSockets

The `ws` package is reserved for lessons exploring persistent connections and event-driven architectures.

```typescript
import { WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 8080 });

wss.on('connection', ws => {
  ws.on('message', message => {
    console.log('received:', message);
    ws.send(`Echo: ${message}`);
  });
});

```

Employ this dependency only when the learning objective specifically requires bidirectional, real-time communication capabilities.

## Source File References

The definitive dependency policy resides in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) at lines 57-61, where maintainers explicitly enumerate the permitted packages. Individual lesson implementations reference these dependencies in their respective [`package.json`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/package.json) files, while actual imports appear in lesson code files such as [`code/main.ts`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/code/main.ts) and `code/tests/…` directories.

## Summary

- The curriculum allows only five TypeScript dependencies: `hono`, `zod`, `ws`, `@hono/node-server`, and Node.js 20+ built-in modules.
- [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) lines 57-61 contain the authoritative allowlist that all contributors must follow.
- Hono provides lightweight HTTP routing, Zod enables type-safe validation, and WebSockets support real-time features when required.
- The stdlib-first philosophy prioritizes native TypeScript and Node.js capabilities over third-party abstractions.
- All lesson submissions must import exclusively from this sanctioned set to maintain pedagogical consistency.

## Frequently Asked Questions

### What TypeScript dependencies are allowed in the AI-Engineering-From-Scratch curriculum?

The curriculum explicitly permits `hono` for HTTP routing, `zod` for schema validation, `ws` for WebSocket functionality (when specifically needed), `@hono/node-server` for Node.js deployment, and all Node.js 20+ standard library modules. This restricted list is defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) at lines 57-61.

### Why does the repository enforce a dependency allowlist?

The maintainers implement a stdlib-first approach to ensure learners understand core TypeScript and Node.js concepts without relying on "black-box" abstractions. Restricting dependencies forces direct engagement with native language features and reduces external failure points in educational code.

### Can I use other npm packages in my lesson submissions?

The curriculum documentation does not outline a process for expanding the allowlist. Contributors should implement solutions using the existing permitted packages and Node.js built-in modules. If a lesson requires functionality not covered by `hono`, `zod`, or `ws`, the implementation likely falls outside the curriculum's intended pedagogical scope.

### Which Node.js version is required for the allowed dependencies?

All lesson code must target **Node.js 20** or higher. This version requirement ensures compatibility with modern standard library features and the `@hono/node-server` adapter infrastructure specified in the dependency policy.