# Allowed Dependencies for AI Engineering From Scratch: The Complete Allow-List

> Discover the allowed dependencies for AI Engineering From Scratch. Learn which Python, TypeScript, Rust, and Julia packages are permitted to build AI projects from scratch. Understand the stdlib-first policy.

- Repository: [Rohit Ghumare/ai-engineering-from-scratch](https://github.com/rohitg00/ai-engineering-from-scratch)
- Tags: allow-list
- Published: 2026-06-22

---

**AI Engineering From Scratch permits only specific third-party packages—`numpy`, `torch`, `h5py`, `zstandard`, and `safetensors` for Python; `hono`, `zod`, `ws`, and `@hono/node-server` for TypeScript—while restricting Rust and Julia to their standard libraries to enforce a strict "stdlib-first" educational policy.**

The rohitg00/ai-engineering-from-scratch repository maintains a curated dependency allow-list to keep the curriculum focused on fundamentals rather than framework abstractions. This policy is documented in the [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) file and enforced through automated auditing scripts. Understanding these constraints ensures your contributions align with the repository’s educational philosophy.

## The Stdlib-First Policy

The repository follows a strict **"stdlib-first"** mandate designed to maximize learning by minimizing hidden complexity. This approach requires learners to implement algorithms from scratch rather than relying on high-level abstractions. Any deviation from the approved dependency list must be justified with the explicit reason: *"stays stdlib-first for educational clarity."*

## Allowed Dependencies by Language

The definitive allow-list is located in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) at lines 52-57. Each language tier has specific permitted packages that complement—but do not replace—standard library capabilities.

### Python Dependencies

Python code may use the standard library plus five specific third-party packages:

- **`numpy`** – for numerical computing foundations
- **`torch`** – for tensor operations and deep learning primitives
- **`h5py`** – for HDF5 file format interaction
- **`zstandard`** – for compression algorithms
- **`safetensors`** – for secure tensor serialization

This constraint ensures that while learners can leverage performance-optimized primitives, they still write the high-level algorithmic logic themselves.

### TypeScript Dependencies

TypeScript implementations targeting Node 20+ may use:

- **`hono`** – lightweight web framework
- **`zod`** – schema validation library
- **`ws`** – WebSocket library (only when WebSocket functionality is explicitly required)
- **`@hono/node-server`** – Node.js adapter for Hono

All other functionality must rely on the Node.js 20+ standard library.

### Rust Dependencies

Rust code is restricted to **the standard library only**. All examples must compile as single-file programs using `rustc --edition 2021` without external crates. This constraint forces manual memory management and algorithm implementation without cargo dependency resolution.

### Julia Dependencies

Julia code may use select standard library modules:

- **`Random`** – for reproducible random number generation
- **`Statistics`** – for statistical operations
- **`LinearAlgebra`** – for matrix operations
- **`Printf`** – for formatted output

No external Julia packages are permitted.

## Enforcement and Verification

The repository enforces these constraints through automated tooling. The [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) file contains validation logic that scans lesson submissions for unauthorized imports or package references. 

The canonical reference resides in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md), which contributors must consult before submitting code. The [`README.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/README.md) provides the public entry point linking to each lesson and cross-referencing the dependency policy.

## Practical Examples

Here are minimal examples demonstrating compliant dependency usage for each supported language:

**Python** using permitted `numpy`:

```python
import numpy as np

def normalize(v):
    """Simple L2-norm using NumPy."""
    return v / np.linalg.norm(v)

print(normalize(np.array([1, 2, 3])))

```

**TypeScript** using the allowed `hono` framework:

```typescript
import { Hono } from "hono";

const app = new Hono();

app.get("/", c => c.text("Hello from AI Engineering!"));

export default {
  fetch: app.fetch,
};

```

**Rust** using only the standard library:

```rust
fn main() {
    println!("Hello from AI Engineering (Rust)");
}

```

**Julia** using the allowed `Random` module:

```julia
using Random

function sample_vector(n)
    rand(Random.GLOBAL_RNG, n)
end

println(sample_vector(5))

```

## Summary

- **AI Engineering From Scratch** maintains a strict allow-list to preserve educational value.
- **Python** permits `numpy`, `torch`, `h5py`, `zstandard`, and `safetensors` plus the standard library.
- **TypeScript** permits `hono`, `zod`, `ws` (conditional), and `@hono/node-server` plus Node 20+ stdlib.
- **Rust** allows only the standard library (`rustc --edition 2021`).
- **Julia**allows only `Random`, `Statistics`, `LinearAlgebra`, and `Printf` from the standard library.
- Violations are caught by [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) as defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md).

## Frequently Asked Questions

### Why does AI Engineering From Scratch restrict dependencies?

The restriction ensures learners understand foundational algorithms by implementing them manually rather than calling high-level APIs. This "stdlib-first" approach prevents *"dependency magic"* from obscuring the mechanics of AI engineering.

### Can I use PyTorch Lightning or Keras in this repository?

No. While `torch` is permitted for tensor operations, high-level frameworks like PyTorch Lightning, Keras, or FastAI are explicitly prohibited. The policy requires writing training loops, optimizers, and layers from scratch using only base `torch` primitives.

### How do I verify my code meets the dependency requirements?

Run the [`scripts/audit_lessons.py`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/scripts/audit_lessons.py) script locally before submitting. This tool parses your imports and flags any packages outside the allow-list defined in [`AGENTS.md`](https://github.com/rohitg00/ai-engineering-from-scratch/blob/main/AGENTS.md) lines 52-57. The script enforces the same checks used in continuous integration.

### Are there exceptions to the stdlib-first rule?

Exceptions are granted only when a package is essential for I/O or performance reasons and cannot be reasonably implemented from scratch. Any exception request must include the justification: *"stays stdlib-first for educational clarity"* and receive maintainer approval via the repository's contribution checklist.