Allowed TypeScript Dependencies in the AI-Engineering-From-Scratch Curriculum

The AI-Engineering-From-Scratch curriculum permits only five specific TypeScript dependencies: hono, zod, ws, @hono/node-server, and Node.js 20+ standard library modules, enforcing a strict stdlib-first policy to maintain pedagogical clarity.

The rohitg00/ai-engineering-from-scratch repository maintains a rigorous dependency allowlist to ensure every lesson focuses on core language fundamentals rather than third-party abstractions. When implementing TypeScript solutions in this curriculum, contributors must import exclusively from the sanctioned package set defined in the project's governance documentation.

The Complete TypeScript Dependency Allowlist

According to [AGENTS.md](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md#L57-L61) at lines 57-61, only the following TypeScript dependencies are permitted in lesson code:

• hono — A lightweight HTTP router for building API servers without framework bloat.
• zod — Type-safe schema validation for enforcing request and response contracts.
• ws — WebSocket client/server capabilities, authorized only when lessons specifically require real-time communication.
• @hono/node-server — The required adapter to run Hono applications in Node.js 20+ environments.
• Node.js 20+ standard library — All built-in modules including fs, path, http, and stream are explicitly allowed.

This restriction ensures lesson code remains reproducible, transparent, and free from "black-box" library complexity that might obscure learning objectives.

Why the Curriculum Limits TypeScript Dependencies

The repository enforces a stdlib-first approach to teaching AI engineering concepts. By restricting external dependencies, the curriculum compels learners to engage directly with TypeScript's type system and Node.js core APIs rather than hiding implementation details behind opaque third-party wrappers.

Each permitted package serves a specific pedagogical purpose. Hono demonstrates minimal HTTP routing without the indirection of larger frameworks, while Zod illustrates runtime type validation patterns that complement TypeScript's compile-time checks. The WebSocket library (ws) appears only in lessons explicitly covering persistent connection protocols.

Implementing Lessons with Allowed TypeScript Dependencies

The following patterns demonstrate compliant usage of each sanctioned package within the curriculum's constraints.

Building HTTP Servers with Hono

The hono package functions as the primary HTTP framework for API development, providing a minimal abstraction over Node.js server primitives.

import { Hono } from 'hono';

const app = new Hono();

app.get('/hello', c => c.text('Hello from the AI-Engineering curriculum!'));

// Run with @hono/node-server (Node 20+)
export default app;

When deploying to Node.js 20+, combine this with the @hono/node-server adapter to handle the underlying HTTP server instantiation.

Runtime Validation Using Zod

Type-safe validation ensures external data conforms to expected contracts without sacrificing TypeScript's static type guarantees.

import { Hono } from 'hono';
import { z } from 'zod';

const app = new Hono();
const BodySchema = z.object({ name: z.string() });

app.post('/greet', async c => {
  const result = BodySchema.safeParse(await c.req.json());
  if (!result.success) return c.json({ error: 'Invalid payload' }, 400);
  return c.json({ message: `Hi, ${result.data.name}!` });
});

This pattern integrates Hono's request handling with Zod's schema validation to create robust, type-safe endpoints.

Real-Time Communication with WebSockets

The ws package is reserved for lessons exploring persistent connections and event-driven architectures.

import { WebSocketServer } from 'ws';

const wss = new WebSocketServer({ port: 8080 });

wss.on('connection', ws => {
  ws.on('message', message => {
    console.log('received:', message);
    ws.send(`Echo: ${message}`);
  });
});

Employ this dependency only when the learning objective specifically requires bidirectional, real-time communication capabilities.

Source File References

The definitive dependency policy resides in AGENTS.md at lines 57-61, where maintainers explicitly enumerate the permitted packages. Individual lesson implementations reference these dependencies in their respective package.json files, while actual imports appear in lesson code files such as code/main.ts and code/tests/… directories.

Summary

• The curriculum allows only five TypeScript dependencies: hono, zod, ws, @hono/node-server, and Node.js 20+ built-in modules.
• AGENTS.md lines 57-61 contain the authoritative allowlist that all contributors must follow.
• Hono provides lightweight HTTP routing, Zod enables type-safe validation, and WebSockets support real-time features when required.
• The stdlib-first philosophy prioritizes native TypeScript and Node.js capabilities over third-party abstractions.
• All lesson submissions must import exclusively from this sanctioned set to maintain pedagogical consistency.

Frequently Asked Questions

What TypeScript dependencies are allowed in the AI-Engineering-From-Scratch curriculum?

The curriculum explicitly permits hono for HTTP routing, zod for schema validation, ws for WebSocket functionality (when specifically needed), @hono/node-server for Node.js deployment, and all Node.js 20+ standard library modules. This restricted list is defined in AGENTS.md at lines 57-61.

Why does the repository enforce a dependency allowlist?

The maintainers implement a stdlib-first approach to ensure learners understand core TypeScript and Node.js concepts without relying on "black-box" abstractions. Restricting dependencies forces direct engagement with native language features and reduces external failure points in educational code.

Can I use other npm packages in my lesson submissions?

The curriculum documentation does not outline a process for expanding the allowlist. Contributors should implement solutions using the existing permitted packages and Node.js built-in modules. If a lesson requires functionality not covered by hono, zod, or ws, the implementation likely falls outside the curriculum's intended pedagogical scope.

Which Node.js version is required for the allowed dependencies?

All lesson code must target Node.js 20 or higher. This version requirement ensures compatibility with modern standard library features and the @hono/node-server adapter infrastructure specified in the dependency policy.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}