npmCLI & Toolingupdated 06 Nov 2026

@deepseek-ai/cosmokit review

Two configuration references can compare equal while holding different settings. @deepseek-ai/cosmokit 1.9.0 is a JavaScript utility library with array, object, string, time and binary helpers, plus immutable configuration snapshots. Even strict deepEqual treats two volatile references as equal regardless of their snapshots. If you're maintaining a plugin runtime or reviewing a dependency that uses this package, that equality rule matters when deciding whether settings changed.

@deepseek-ai/cosmokit · v1.9.0 · deepseek-ai/deepseek-harness · docs · reviewed by Keyoor

Verdict

Use @deepseek-ai/cosmokit 1.9.0 when its existing reference protocol fits your runtime and you can separate reference equality from snapshot changes. Before adopting it for new reload logic, check your real settings fixtures against both comparisons.

Answers from our run

@deepseek-ai/cosmokit or lodash-es: which should you use?

lodash-es: Consider lodash-es when you want Lodash exported as ES modules. Its registry description establishes that packaging choice; this guide does not claim that its equality behavior matches the volatile-reference protocol. Use @deepseek-ai/cosmokit 1.9.0 when its existing reference protocol fits your runtime and you can separate reference equality from snapshot changes.

When should you not use @deepseek-ai/cosmokit?

You want deepEqual to detect changed settings inside references. It ignores those snapshots even when strict is true; compare the values returned by get() instead.

API stability3/5The 1.9.0 manifest identifies ESM entry points and declarations, and the published implementation makes the reference protocol inspectable. That earns 3 on the stated evidence scale. Exported helpers marked internal and equality rules specific to these references require care; a single release cannot demonstrate compatibility across upgrades.

Docs2/5The published README explains snapshot reading and the unusual equality rule, while implementation comments identify runtime-owned operations. Its install command and default import still name the unscoped package, so a reader must reconcile those examples with the scoped manifest and exports. That concrete setup mismatch limits the documentation score to 2.

Maintenance2/5The bounded 1.9.0 registry record and matching published implementation establish an available, inspectable package. The linked parent-project release notes concern the host, not a package-specific support promise. A 2 reflects missing evidence of package-level response times and upgrade reliability, rather than a claim of abandonment.

Ecosystem2/5The shared-symbol implementation explains how cooperating copies can recognize references, and the package includes declarations for typed consumers. That is an integration mechanism, not proof that independent hosts work with this release. A 2 reflects the absence of executed integration evidence here; parent-repository popularity would not close that gap.

Use it if

You maintain software that already imports this scoped package and need to understand its configuration-reference behavior before changing reload logic.
You need a stable reference to copied, frozen configuration data and can keep validation and reference ownership in your application.
Your runtime deliberately compares configuration structure separately from the contents of volatile references.
You can pin the package and check its equality rules against your application's own fixtures before adoption.

Skip it if

You want deepEqual to detect changed settings inside references. It ignores those snapshots even when strict is true; compare the values returned by get() instead.
You need snapshots containing functions, class instances or cycles. Snapshot creation rejects these inputs rather than freezing arbitrary JavaScript object graphs.
You need a validator, subscription system or automatic reload scheduler. The inspected reference helpers copy, read and transfer values; your runtime must supply those policies.
You only need one ordinary array helper. Native JavaScript may already cover the task without adding another utility dependency.
You require demonstrated CommonJS, browser or host-plugin compatibility. Source inspection and these unexecuted examples do not establish those integrations.

Setup reality

Install the scope and version you mean: npm install --save-exact @deepseek-ai/cosmokit@1.9.0. The published README still shows installation of the unscoped cosmokit package and a default import. Follow this package's manifest and named exports instead. The package declares its module type as ESM. Use named imports from the package root, as the examples below do; do not assume the README's default-import example describes this scoped build. The manifest also points to TypeScript declarations.

This guide inspected the published package files and registry metadata. We did not install the dependency, compile the snippets, run its test suite or exercise a live plugin host. Every example is a documentation-based, unexecuted illustration of 1.9.0. Neither runtime compatibility nor concurrency safety was measured.

createVolatile copies and freezes plain configuration data. It does not validate your settings. Pass already checked values, keep the returned reference, and call get() when an operation needs a snapshot. Reading once at startup leaves you holding that old snapshot if an owning runtime later transfers another one. Capturing once at the start of an operation is useful when that operation should keep the same settings throughout.

The accepted data model is narrower than a general object clone. Arrays are copied recursively. Ordinary objects are copied through Object.entries, so symbol-keyed and non-enumerable fields are not part of the snapshot. Functions, non-plain objects and cycles throw. Getters can run while entries are read. Don't pass an arbitrary object and treat snapshot creation as sanitization.

Equality needs a separate decision. Passing true as deepEqual's third argument distinguishes null from undefined and changes treatment of opaque objects, but it still ignores the values inside two volatile references. Read the snapshots and compare those when content changes matter. Distinct cyclic structures also compare unequal; this is not a universal replacement for another library's equality function.

The exported updateVolatile and volatileEntries helpers carry internal annotations. The update helper transfers source.get() into the target without validating it or making another copy. Keep that work in the runtime that owns the reference. isVolatile checks a shared-symbol protocol, not the trustworthiness of an object. There is no basis here for using it as a security boundary.

For schema parsing choices, see the separate @deepseek-ai/schemastery guide. Parsing settings and deciding whether stored settings changed are different jobs.

Ratings use an editorial evidence scale: 1 means little inspected support for adoption, 3 means a usable documented surface with material gaps, and 5 requires strong operational and compatibility evidence. They are judgments about the available evidence, not benchmarks. Parent-project release notes describe host changes and do not establish this package's release history. No download, repository-star or bundle-size figure is used to infer independent adoption or compatibility.

Patterns

Detach settings from their input detach-settings

import { createVolatile } from '@deepseek-ai/cosmokit';

const input = { retries: 2, tags: ['build'] };
const settings = createVolatile(input);
input.tags.push('deploy');
const snapshot = settings.get();

Unexecuted 1.9.0 illustration. The snapshot keeps its copied tags array. Both the snapshot object and nested array are frozen. This copies supported data; it does not validate retry limits or labels.

Handle an unsupported configuration value unsupported-snapshot

import { createVolatile } from '@deepseek-ai/cosmokit';

try {
  createVolatile({ created: new Date() });
} catch (error) {
  if (!(error instanceof TypeError)) throw error;
  console.error(error.message);
}

Unexecuted 1.9.0 illustration. Date is a non-plain object and snapshot creation throws. Functions and cyclic structures are rejected too. Convert such application values into supported settings data deliberately.

See why references hide a settings change reference-equality

import { createVolatile, deepEqual } from '@deepseek-ai/cosmokit';

const before = createVolatile({ retries: 2 });
const after = createVolatile({ retries: 5 });
const same = deepEqual(before, after, true);

Unexecuted 1.9.0 illustration. The implementation returns true for two volatile references before applying the strict comparison rules. Strict mode does not make this a snapshot comparison.

Compare the stored settings instead snapshot-equality

import { createVolatile, deepEqual } from '@deepseek-ai/cosmokit';

const before = createVolatile({ retries: 2 });
const after = createVolatile({ retries: 5 });
const changed = !deepEqual(before.get(), after.get(), true);

Unexecuted 1.9.0 illustration. Comparing these ordinary snapshot objects reaches their retries values. The implementation therefore makes changed true for this input. This is source-derived behavior, not a recorded execution result.

Choose whether missing and null differ nullable-comparison

import { deepEqual } from '@deepseek-ai/cosmokit';

const previous = { label: null };
const candidate = { label: undefined };
const looseMatch = deepEqual(previous, candidate);
const strictMatch = deepEqual(previous, candidate, true);

Unexecuted 1.9.0 illustration. The default comparison equates null and undefined recursively. Strict mode distinguishes this pair. It still does not compare the contents of volatile references.

Capture one snapshot for an operation capture-operation

import { createVolatile } from '@deepseek-ai/cosmokit';

const settings = createVolatile({ retries: 2, label: 'worker' });
function describeOperation() {
  const current = settings.get();
  return `${current.label}: ${current.retries} retries`;
}
const description = describeOperation();

Unexecuted 1.9.0 illustration. Read inside the operation if later operations should see an owning runtime's updates. Keeping current within this call preserves that chosen snapshot; this is not a claim about transaction or concurrency safety.

Transfer a candidate in the owning runtime runtime-transfer

import { createVolatile, updateVolatile } from '@deepseek-ai/cosmokit';

const settings = createVolatile({ retries: 2 });
const captured = settings.get();
const candidate = createVolatile({ retries: 5 });
updateVolatile(settings, candidate);
const next = settings.get();

Unexecuted 1.9.0 illustration. updateVolatile is exported but annotated internal. It transfers candidate.get() without validating or copying again. captured retains the earlier snapshot while next reads the replacement. Use only where you own the runtime policy.

Keep shallow selection separate from copying shallow-selection

import { createVolatile, pick } from '@deepseek-ai/cosmokit';

const settings = createVolatile({ worker: { retries: 2 }, enabled: true });
const selected = pick(settings.get(), ['worker']);
const copied = createVolatile(selected);

Unexecuted 1.9.0 illustration. pick creates a shallow selection. selected.worker still refers to the frozen nested snapshot; the new outer selected object is not itself frozen. createVolatile performs a new recursive snapshot copy of that selection.

Alternatives

Package	Registry	Pick it when
lodash-es	npm	Consider lodash-es when you want Lodash exported as ES modules. Its registry description establishes that packaging choice; this guide does not claim that its equality behavior matches the volatile-reference protocol.
remeda	npm	Consider Remeda when you want a utility library for JavaScript and TypeScript. Its registry description establishes that scope; review the actual functions you need rather than assuming it can replace these configuration references.

More cli & tooling guides

commander · chalk · typescript · esbuild · yargs · click · the whole shelf →

How this guide is made: grounded in the library's documentation, release notes, changelog, and issue history, on a fixed rubric — not a hands-on install of every release. The 50 most-downloaded entries are additionally install-verified in clean containers. Corrections: contact the desk.