W Commons

Reusable Rust libraries for HTTP clients, model-provider protocols, notifications, storage, web services, IP intelligence, host metrics, utilities and cryptographic helpers. This public dependency set retains the original crate names and feature flags.

Crate	Purpose
w-util	Clocks, formatting, backoff, TTL caches and atomic counters
w-crypto	Hashing, HMAC, hex/base64 and constant-time helpers
w-task	Supervised periodic tasks
w-http	Async/blocking HTTP clients and bounded retry helpers
w-maas-protocol	Model-provider request, response and streaming types
w-maas-providers	Provider request/response adapters
w-maas-sdk	Outbound model-provider client
w-notify	Webhook/message delivery and project-mail transport
w-storage	Local filesystem and optional S3-compatible object storage
w-ipintel	IP/CIDR classification and optional GeoIP readers
w-web-kit	Feature-selected axum service helpers
w-hostmetrics	Host metrics parsers and optional live collection

w-notify = { git = "https://github.com/W-World-Labs/w-commons", tag = "v0.1.0", features = ["ssrf-guard"] }
w-hostmetrics = { git = "https://github.com/W-World-Labs/w-commons", tag = "v0.1.2", version = "=0.2.1" }

Build with Rust 1.98.1. Dependencies resolve through crates.io or sibling paths; no private registry or platform account is needed. API documentation is generated by cargo doc --workspace --all-features --no-deps.

cargo check --locked --workspace --all-features
cargo test --locked --workspace --all-features -- --test-threads=1

Storage defaults to local files; s3 enables S3, R2 or MinIO. Consumer-supplied credentials, GeoIP databases, model weights and production configuration are not bundled. Mail/model/network features need separately configured external services.

w-hostmetrics provides typed parsers without network access. Its optional sysinfo, sysinfo-disks, sampling and gpu-props features enable local collection helpers; callers choose when and what to collect.

For user-provided webhooks enable ssrf-guard and guard_ssrf(true). Guarded sends validate and pin public DNS addresses, disable proxies and redirects, and use five-second DNS/ten-second request deadlines. The guard owns its transport, taking precedence over with_client connection settings. Unguarded sends retain the supplied client. Payload construction and optional features remain unchanged.

License and releases

Each Cargo.toml declares its license. Original MIT crates use LICENSE-MIT; dual MIT OR Apache-2.0 crates may use either root license. Dependencies retain their own licenses. The distribution omits real traffic/documents, model weights, private credentials and private source history.

CI checks the full feature set, existing local checks, lockfile sources and the S3/ring dependency contract. Tags publish a source archive and SHA256SUMS after checks pass. Releases do not deploy services or publish crates.io packages.

Third-party dependencies

Each crate's Cargo.toml specifies the license for that crate's own code; the repository includes LICENSE-MIT and LICENSE-APACHE. Cargo.lock pins dependency versions, registry sources and checksums; it does not contain their license terms. THIRD-PARTY-DEPENDENCIES.json indexes the resolved external crates and their upstream-declared license expressions and source repositories for the locked all-features workspace, including platform-specific dependencies. This index is metadata, not a copy of upstream license texts or a statement that every dependency is linked by every feature set. Regenerate it with python3 scripts/license-index.py; CI verifies it with --check. Preserve the selected dependencies' original license texts and required notices when redistributing. External crates and separately configured services retain their own licenses; the root licenses do not relicense them.

Code, data and compatibility references

The reviewed public export contains first-party Rust implementations, the explicit factual metadata and fixtures below, and dependency manifests. No third-party source tree is vendored into these crates. Cargo dependencies are identified separately in the index above.

Location	Origin and scope
w-hostmetrics	First-party code extracted from W-Monitor's host collectors and pressure reader. Its inline parser samples and CPU/DMI matching strings accompany the implementation; no host inventory, collected fleet telemetry or external database is bundled. Reading /proc, sysfs, or caller-supplied nvidia-smi CSV does not bundle Linux, systemd or NVIDIA source/binaries. Those optional local tools retain their own licenses.
model_info.rs	A first-party schema with model identifiers, context/output limits and price defaults manually transcribed from public OpenAI, Anthropic, Google and DeepSeek documentation. The source records a 2026-06 snapshot; per-row archived pages and retrieval checksums were not recorded. Values are overridable defaults and are not a current-price guarantee. The LiteLLM model-price data file is not included or reused.
provider fixtures	Synthetic protocol request/response, stream and error examples. Each case.toml records the wire-contract or documentation source. The Gemini streaming fixture also records LiteLLM compatibility reference commit 7020e1e5f75fe6f98480753825589345d027b3c7; this is a behavior reference, not vendored LiteLLM implementation or dataset. No customer conversations, credentials or provider traffic captures are bundled.
SPA fixtures	Small first-party HTML/CSS examples for existing route checks.
GeoIP reader and storage adapters	Optional interfaces to consumer-supplied databases/services. GeoIP databases, model weights and service datasets are not included; consumers obtain and license them separately.

The model table's documented source families are the official OpenAI pricing/model documentation, Anthropic pricing documentation, Google Gemini documentation and DeepSeek documentation. These live pages can change and are not archival evidence for every bundled 2026-06 value. Provider names, protocol field names and public endpoints identify interoperability; they do not imply endorsement or relicense provider content.