Compile typed event providers without Windows SDK

[PrzemyslawKlys]

Summary

• compile manifest-based Windows event provider resources entirely in managed code
• keep the PowerShell cmdlet and C# package builder as simple surfaces over the same EventViewerX compiler
• preserve installation, package signing, compatibility baselines, typed payloads, localization, maps, custom metadata, and historical package reads
• document that Windows SDK, Visual Studio, MSVC, Roslyn, and runtime source compilation are not required
• tolerate the short Event Log service refresh window when removing a newly created classic log

User experience

A user can define a provider in a PowerShell hashtable, JSON, or the C# model and call New-EVXProviderPackage or EventProviderPackageBuilder.Build. The resulting .evxprovider remains a build-once/deploy-many artifact. Building is non-elevated; installing or removing the machine-wide provider remains elevated.

The package contains a deterministic x64 resource-only PE with Windows message tables and compiled event metadata. It has no entry point, imports, managed runtime header, or executable provider code.

Compatibility

• new packages use format 2 and record the managed compiler identity/version
• existing format-1 packages remain readable, installable, usable as baselines, and signature-verifiable
• SDK tool path/timeout options and toolchain discovery/result types are removed because no external tools are invoked

Validation

• 673 EventViewerX tests passed on .NET 8 and .NET 10
• PowerForge release build completed, including EventViewerX NuGet and PSEventViewer module artifacts for PowerShell Core and Windows PowerShell
• 5 Pester custom-provider workflow tests passed, including elevated package build, installation, typed write/read/render, repair, replacement, inventory, and uninstall
• packaged module lifecycle passed on Windows PowerShell 5.1
• clean Windows Server 2025 lifecycle passed with no mc.exe, rc.exe, link.exe, or standalone csc.exe present
• independent local review completed; both reported schema defects were fixed and the targeted confirmation found no remaining issues

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 979ef448d2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 14d58c9cc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".