winlog 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a6df367ea2d0404effb7f44cb924e4f6fe67dbd5371b6038e056423054d3507
-  data.tar.gz: 74481ee0141c167adebff54a3e9ceaf2b17122f89899aa681b06214fc486596f
+  metadata.gz: 38f927d278f17a348344c5c3f1770549da3312b6c77f6a29bacccbd0d9f9d87d
+  data.tar.gz: 043653febe12b66d749c4d51515ee6635a539f42c403469803b177b2da24dc16
 SHA512:
-  metadata.gz: 3f48d2c5ae916db9f2fcdf76072464b069d5cc25983c534515fb4455b14f9de3a777dd6de61afe425ee77fb9095d7c8bec8289010d8a9dbbb8b645bef7b15e7d
-  data.tar.gz: b31ae1e789399d0781e44160c8638b469ad4674e598229fa2823993e68acc6b8390cdb0434fd7656fd5b906cc63deb38677c3c9b1c27cbce4de60d6e17ec87b9
+  metadata.gz: 0430a1d51e5832e248a8627485fdd1990d8c3e42149cb7f037c7e6c15d162250fdfbfacbe22c012f3d955c8ac80af01cc446babb3035347402e4c3f48d6db6df
+  data.tar.gz: 46eef6776b01377cdb5d451e74a42267037b5bda130d73a2522b307df5e14844473a6786b46f38a4958d30d0cb5bc898bbf8bfb72e54efb8b1a83b37c298fd4a

data/README.md

@@ -1,243 +1,11 @@
-# winlog
-
-**Structured, registration-free ETW telemetry for Ruby — TraceLogging events that cost nothing when nobody is listening.**
-
-`winlog` registers a [TraceLogging](https://learn.microsoft.com/windows/win32/tracelogging/trace-logging-portal)
-provider by name (auto name-hashed GUID — **no manifest, no message DLL, no
-registry write, no elevation**) and emits runtime-dynamic, self-describing
-events: an event name and typed fields decided at call time, decodable by WPA,
-PerfView, and the inbox `logman`/`tracerpt` with zero setup.
-
-The pain it removes: you cannot leave `puts` debugging or verbose file logging on
-in production, and a log file is an unstructured island disconnected from the
-rest of the system's diagnostics. ETW is the structured, OS-native tracing
-pipeline that Windows itself and the .NET runtime emit into — but reaching it
-from a scripting language has historically meant authoring a manifest, compiling
-a message DLL, and registering it with admin rights. TraceLogging is the
-manifest-free encoding that fixes this: every event carries its own schema, so it
-decodes **without any registration**. `winlog` is the thin Ruby binding to it.
-
-- **No setup, anywhere.** `gem install winlog`, `Winlog.open`, `log`. There is no
-  registration step the gem performs on the system, and no other Ruby gem emits
-  native ETW. `Logger` writes files; this feeds WPA/PerfView timelines right next
-  to kernel and .NET events.
-- **A disabled `log` costs about one Ruby method call.** When no ETW session has
-  enabled the provider, the call is gated in native code *before the fields are
-  even looked at* — no allocation, no transcoding, no iteration. Leave it in
-  production; that is the entire point of ETW.
-- **Hard to misuse.** Reserved keyword bits, level 0, malformed activity GUIDs,
-  NUL bytes in names, and unknown level symbols all raise loudly. Delivery
-  problems never raise — ETW is lossy by design, so `log` returns a boolean.
-
-| What | API |
-|---|---|
-| Register a provider | `Winlog.open("MyCompany.MyApp")` (block form auto-closes) |
-| Emit an event | `provider.log(:info, "Event", field: value, ...)` |
-| Cheap "is anyone listening?" | `provider.enabled?(level: :debug, keyword: 0x1)` |
-| Name-hashed GUID (no register) | `Winlog.guid_for("MyCompany.MyApp")` |
-| Fresh correlation id | `Winlog.new_activity_id` |
-| Stop / free | `provider.close` |
-
-## Requirements
-
-- **Windows 10 or later** with a native **MSVC (mswin)** Ruby. Not supported on
-  MinGW/UCRT Ruby (the extension is built with `cl.exe`).
-- Visual Studio 2017+ / Build Tools with the **Desktop development with C++**
-  workload to build from source. The [`vcvars`](https://github.com/main-path/vcvars)
-  dev dependency loads the MSVC environment for `rake compile` automatically — no
-  Developer Command Prompt needed; point build failures at `vcvars doctor`.
-- **x64.** arm64-mswin is expected to work but is untested and unsupported until
-  an arm64-mswin Ruby distribution exists (the code is arch-neutral).
-
-## Install
-
-```sh
-gem install winlog
-```
-
-## Quick start
-
-```ruby
-require "winlog"
-
-# EXE-lifetime provider: open once at startup, never close (the kernel cleans
-# up registration at process exit; the GC free hook is a safety net).
-PROV = Winlog.open("MyCompany.MyApp")
-PROV.guid                                  # => "ce5fa4ea-..."; hand to logman as "{...}"
-
-PROV.log(:info, "Startup", version: "1.4.2", pid: Process.pid)   # => false (no session)
-
-# Skip building expensive arguments when nobody is listening:
-if PROV.enabled?(level: :debug)
-  PROV.log(:debug, "CacheDump", entries: cache.size, hot: cache.hot_keys.join(","))
-end
-
-# Activity correlation (fiber-safe: explicit IDs, never the thread-ambient one):
-aid = Winlog.new_activity_id
-PROV.log(:info, "JobStart", opcode: :start, activity: aid, job: "reindex")
-PROV.log(:info, "JobStop",  opcode: :stop,  activity: aid, ok: true)
-
-# Misuse raises loudly:
-PROV.log(:fatal, "X")                       # ArgumentError: unknown level :fatal
-PROV.log(:info, "X", keyword: 1 << 50)      # ArgumentError: reserved keyword bits
-Winlog.open("päivä")                        # ArgumentError: name must be printable ASCII
-
-# Scoped provider for a short-lived tool:
-Winlog.open("MyCompany.Tool") { |p| p.log(:info, "Ran", args: ARGV.join(" ")) }
-```
-
-`log` returns `true` only when a session had the provider enabled at that
-level+keyword **and** the write succeeded; otherwise `false` (no listener, the
-provider never registered, or ETW dropped the event). It never raises on
-delivery.
-
-## Seeing your events
-
-Collecting a trace requires an **elevated prompt** (or membership in the
-*Performance Log Users* group). This is inherent to ETW for *every* provider on
-Windows, including Microsoft's own — it is not a `winlog` property and concerns
-*collection*, never *emit*. Ranked, copy-pasteable:
-
-**1. Inbox only — `logman` + `tracerpt` (nothing to install).** `logman` does
-not name-hash, so give it `provider.guid`:
-
-```sh
-logman start rb -p "{ce5fa4ea-ab00-5402-8b76-9f76ac858fb5}" 0xffffffffffffffff 5 -o rb.etl -ets
-ruby app.rb
-logman stop rb -ets
-tracerpt rb.etl -o rb.xml          # TDH auto-decodes TraceLogging on Win10+
-```
-
-**2. WPR (inbox) + WPA (free).** A `.wprp` profile can name the provider with the
-star (`*`) syntax, which name-hashes for you:
-
-```xml
-<EventProvider Id="MyApp" Name="*MyCompany.MyApp" />
-```
-
-`wpr -start profile.wprp -filemode` → `wpr -stop out.etl` → open in WPA → **System
-Activity ▸ Generic Events**.
-
-**3. PerfView** (single-exe download): `PerfView /onlyProviders=*MyCompany.MyApp collect`.
-The `*` converts the name to its GUID the EventSource way.
-
-> **Events do NOT appear in Event Viewer / `wevtutil`.** That requires registering
-> the provider with an Event Log channel (a manifest + `wevtutil im`, i.e.
-> registration and admin) — exactly what `winlog` deliberately does not do.
-> TraceLogging events go to **ETW sessions**, decoded by the tools above.
-
-## Levels, keywords, opcodes
-
-```ruby
-Winlog::LEVELS   # critical:1 error:2 warn:3 info:4 debug:5 (verbose: alias of debug)
-Winlog::OPCODES  # info:0 start:1 stop:2
-```
-
-- **Level** is a Symbol from `LEVELS` or an Integer `1..255` (1..5 are the
-  standard winmeta levels). Level **0 is rejected** — always assign a meaningful
-  non-zero level.
-- **Keyword** is a 64-bit bitmask; bits **0..47 are yours**, bits **48..63 are
-  reserved by Microsoft** (`Winlog::KEYWORD_RESERVED_MASK`) and setting any of
-  them raises `ArgumentError`. The default is `0`, which **bypasses keyword
-  filtering** (ETW semantics) — fine for getting started, but assign meaningful
-  keywords so sessions can filter.
-- **Opcode** `:start`/`:stop` bracket an activity for decoders.
-
-## Activities and fibers
-
-Correlate related events by passing the *same* explicit activity id, generated
-with `Winlog.new_activity_id`:
-
-```ruby
-aid = Winlog.new_activity_id
-prov.log(:info, "RequestStart", opcode: :start, activity: aid, related: parent_aid)
-# ... work ...
-prov.log(:info, "RequestStop",  opcode: :stop,  activity: aid, status: 200)
-```
-
-`winlog` **never uses or mutates ETW's thread-ambient activity id.** Under a
-fiber scheduler such as [`winloop`](https://github.com/main-path/winloop), one
-thread hosts many fibers, and the thread-local id would smear one fiber's
-activity across all of them. Correlation is therefore always per-call and
-explicit, which is fiber-correct by construction. If you want an ambient pattern,
-store the id in `Thread.current[:winlog_activity]` (fiber-local in Ruby) and pass
-it yourself.
-
-`winlog` never blocks, so it never offloads to a worker thread and integrates
-with a scheduler trivially: `log`/`enabled?`/`open`/`close` run inline, occupying
-the loop thread for at most one ~1–3 µs `EventWriteTransfer` per enabled event.
-
-## Costs and validation
-
-| Operation | Cost (spike-measured, x64) |
-|---|---|
-| `enabled?` native check (`IsEnabled`) | ~0.4 ns |
-| Disabled `log` (gated, fields untouched) | ~one Ruby method call (~0.1 µs) |
-| Enabled `EventWriteTransfer` | ~1–3 µs/event (expected; measure under a live session) |
-
-**The deliberate validation asymmetry (E2).** To keep the disabled path free, a
-`log` call validates its *control* arguments on every call — level, event-name
-type/content/NUL, `keyword:`/`opcode:`/`activity:`/`related:` — but does **not**
-look at field *values* until the event is actually enabled. Consequently a bad
-field value (e.g. `nil`, an `Array`) raises `TypeError` **only when a session is
-attached**. Use the `enabled?` guard idiom above if you need expensive arguments
-built only when watched, and rely on the control-arg checks to keep the common
-bugs deterministic regardless.
-
-Field-value → ETW type mapping:
-
-| Ruby value | ETW type | notes |
-|---|---|---|
-| `String` (text encoding) | UTF-8 string | transcoded; embedded NUL or invalid bytes → `ArgumentError` |
-| `String` (`Encoding::BINARY`) | binary | UINT16-counted; > 65535 bytes → `ArgumentError` |
-| `Integer` | int64 | outside INT64 → `RangeError` |
-| `Float` | double | |
-| `true` / `false` | bool32 | |
-| anything else (incl. `nil`) | — | `TypeError` |
-
-## Errors
-
-```
-Winlog::Error           < StandardError   # base for what winlog raises itself
-└── Winlog::Closed                        # any op (except close/closed?/inspect) on a closed provider
-```
-
-Plain argument misuse raises Ruby's own `ArgumentError` / `TypeError` /
-`RangeError`. There is deliberately **no `OSError`**: registration failure is a
-queryable status (`registered?` is `false`, `registration_result` is the
-HRESULT), and write failure is a `false` return — ETW is lossy by design and
-Microsoft's guidance is to ignore both. The single OS call with no status channel,
-`EventActivityIdControl` inside `Winlog.new_activity_id`, raises `Winlog::Error`
-with the Win32 code (it cannot fail in practice).
-
-## How it works
-
-`winlog` is built on Microsoft's **`TraceLoggingDynamic.h`** (vendored into
-`ext/winlog/`, © Microsoft, MIT). `TraceLoggingProvider.h` — the usual header —
-requires compile-time-constant provider/event/field names, which a runtime Ruby
-`log(level, event, **fields)` API cannot supply; `TraceLoggingDynamic.h` is
-Microsoft's supported answer for runtime-dynamic events, and (being C++:
-templates + `std::vector`) makes `winlog` the suite's first C++ extension.
-
-Under the hood: `EventRegister` opens a `REGHANDLE` and `EventSetInformation`
-attaches the provider traits; the provider GUID is the standard ETW name-hash of
-the name (SHA-1 over a fixed signature + the UTF-16BE upper-invariant name, .NET
-byte order — the same GUID EventSource, WPR `*name`, PerfView, and
-`Winlog.guid_for` compute). Each `log` builds one self-describing event (metadata
-+ packed field data) and writes it with `EventWriteTransfer`. `enabled?` reads
-in-process state maintained by ETW's enable callback — no system call.
-
-Honest limitations:
-
-- **Lossy transport.** Even a `true` return does not guarantee a session retained
-  the event (buffers can be full); a `false` may mean disabled, unregistered, or
-  dropped.
-- **64 KB event ceiling** (ETW), **65535-byte** binary fields (UINT16-counted),
-  and a ~32 KB metadata cap. Oversized events return `false`, never raise.
-- **Emit-only.** No session control, no consumption/decoding, no Event Log
-  delivery. The five field types above are the whole v1 surface.
-
-## License
-
-[MIT](LICENSE.txt). The vendored `ext/winlog/TraceLoggingDynamic.h` is
-© Microsoft Corporation, also MIT.
+# winlog (discontinued)
+
+**winlog is no longer maintained.** This final release (0.1.1) contains no
+code: installing it compiles nothing, and `require "winlog"` raises a
+`LoadError` explaining the discontinuation.
+
+Use opentelemetry-ruby, or win32-eventlog for the Windows Event Log instead.
+
+Earlier releases remain on RubyGems only because RubyGems does not allow
+versions older than 30 days to be yanked. They are unmaintained and not
+recommended.

data/lib/winlog.rb

@@ -1,216 +1,4 @@
-# frozen_string_literal: true
-
-require "winlog/version"
-require "winlog/winlog" # native extension: Winlog::Provider + Error/Closed + new_activity_id
-require "digest"
-
-# winlog — structured, registration-free ETW TraceLogging telemetry for Ruby:
-# events that cost nothing when nobody is listening.
-#
-# Register a provider by name (auto name-hashed GUID — no manifest, no message
-# DLL, no registry write, no elevation) and emit runtime-dynamic, self-describing
-# events decodable by WPA, PerfView, and the inbox logman/tracerpt with zero
-# setup. When no ETW session has enabled the provider, a `log` call is gated in
-# C before the fields are even looked at (~one Ruby method call). Emit-only:
-# events go to ETW sessions, NOT to Event Viewer.
-#
-#   PROV = Winlog.open("MyCompany.MyApp")
-#   PROV.log(:info, "Startup", version: "1.4.2", pid: Process.pid)  # => false (no session)
-#   Winlog.open("Tool") { |p| p.log(:info, "Ran", args: ARGV.join(" ")) }
-module Winlog
-  # Symbolic levels -> winmeta values (tracelogging.md §5, verified table).
-  LEVELS = {
-    critical: 1,   # WINEVENT_LEVEL_CRITICAL
-    error:    2,   # WINEVENT_LEVEL_ERROR
-    warn:     3,   # WINEVENT_LEVEL_WARNING
-    info:     4,   # WINEVENT_LEVEL_INFO
-    debug:    5,   # WINEVENT_LEVEL_VERBOSE
-    verbose:  5    # alias of :debug
-  }.freeze
-
-  # Symbolic opcodes -> winmeta values. START/STOP bracket activities.
-  OPCODES = { info: 0, start: 1, stop: 2 }.freeze
-
-  # Keyword bits 48..63 are reserved by Microsoft; winlog REJECTS them.
-  KEYWORD_RESERVED_MASK = 0xFFFF_0000_0000_0000
-
-  # 16 signature bytes prepended to the name before SHA-1, per the documented
-  # ETW name-hash algorithm (tracelogging.md §4).
-  GUID_SIGNATURE = [0x48, 0x2C, 0x2D, 0xB2, 0xC3, 0x90, 0x47, 0xC8,
-                    0x87, 0xF8, 0x1A, 0x15, 0xBF, 0xC1, 0x30, 0xFB].freeze
-  private_constant :GUID_SIGNATURE
-
-  # Printable ASCII (bytes 0x21..0x7E): no spaces, no control chars, no NUL.
-  NAME_PATTERN = /\A[\x21-\x7E]{1,255}\z/
-  private_constant :NAME_PATTERN
-
-  # Base class for everything winlog raises itself. (Error and Closed are
-  # actually defined in C so they exist before this file's reopen; documented
-  # here for the reader.)
-  #
-  #   class Winlog::Error  < StandardError; end
-  #   class Winlog::Closed < Winlog::Error; end
-
-  module_function
-
-  # Register a TraceLogging provider under +name+ and return a Winlog::Provider.
-  # Block form yields the provider and ensure-closes it, returning the block
-  # value. Registration is system-wide registration-FREE (no manifest, registry,
-  # or elevation). On a rare EventRegister failure NO exception is raised — the
-  # provider is a benign no-op; check #registered? (MS guidance).
-  #
-  #   Winlog.open("X")                     # => #<Winlog::Provider X {guid}>
-  #   Winlog.open("X") { |p| p.log(...) }  # => block value; provider closed after
-  def open(name)
-    prov = Provider.new(name)
-    return prov unless block_given?
-
-    begin
-      yield prov
-    ensure
-      prov.close
-    end
-  end
-
-  # The ETW name-hashed GUID for +name+ WITHOUT registering anything. Pure Ruby
-  # (SHA-1 over the documented signature + UTF-16BE upcased name, .NET byte
-  # order). Same +name+ rules as Winlog.open. Case-insensitive.
-  #
-  #   Winlog.guid_for("MyCompany.MyComponent")
-  #   # => "ce5fa4ea-ab00-5402-8b76-9f76ac858fb5"
-  def guid_for(name)
-    name = validate_name!(name)
-    bytes = Digest::SHA1.digest(
-      GUID_SIGNATURE.pack("C*") + name.upcase.encode("UTF-16BE").b
-    ).bytes[0, 16]
-    bytes[7] = (bytes[7] & 0x0F) | 0x50
-    [bytes[0, 4].reverse, bytes[4, 2].reverse, bytes[6, 2].reverse,
-     bytes[8, 2], bytes[10, 6]]
-      .map { |part| part.map { |b| format("%02x", b) }.join }
-      .join("-")
-  end
-
-  # Map a level (Symbol in LEVELS or Integer 1..255) to its winmeta Integer.
-  # Raises ArgumentError on an unknown Symbol or out-of-range Integer.
-  def level_for(level)
-    case level
-    when Symbol
-      LEVELS.fetch(level) do
-        raise ArgumentError, "unknown level #{level.inspect} " \
-                             "(known: #{LEVELS.keys.inspect})"
-      end
-    when Integer
-      unless level.between?(1, 255)
-        raise ArgumentError, "level must be 1..255, got #{level.inspect}"
-      end
-      level
-    else
-      raise ArgumentError,
-            "level must be a Symbol or Integer, got #{level.inspect}"
-    end
-  end
-
-  # Map an opcode (Symbol in OPCODES or Integer 0..255) to its Integer value.
-  def opcode_for(opcode)
-    case opcode
-    when Symbol
-      OPCODES.fetch(opcode) do
-        raise ArgumentError, "unknown opcode #{opcode.inspect} " \
-                             "(known: #{OPCODES.keys.inspect})"
-      end
-    when Integer
-      unless opcode.between?(0, 255)
-        raise ArgumentError, "opcode must be 0..255, got #{opcode.inspect}"
-      end
-      opcode
-    else
-      raise ArgumentError,
-            "opcode must be a Symbol or Integer, got #{opcode.inspect}"
-    end
-  end
-
-  # Validate a provider name: printable ASCII (0x21..0x7E), 1..255 bytes.
-  # Returns the name as a String. Raises ArgumentError on anything else.
-  def validate_name!(name)
-    str = String(name)
-    # Compare raw bytes so a broken/foreign encoding can never make the regex
-    # match raise (it would on an invalid byte sequence); printable ASCII is a
-    # pure byte predicate. Reuse the same 0x21..0x7E, 1..255 contract as
-    # NAME_PATTERN, then return a clean UTF-8 String.
-    bytes = str.bytes
-    ok = bytes.length.between?(1, 255) && bytes.all? { |b| b >= 0x21 && b <= 0x7E }
-    unless ok
-      raise ArgumentError,
-            "name must be 1..255 printable-ASCII bytes (0x21..0x7E: no spaces, " \
-            "control chars, or NUL), got #{name.inspect}"
-    end
-    str.b.force_encoding(Encoding::UTF_8)
-  end
-  private_class_method :validate_name!
-
-  # Native (TypedData) provider class; the C side defines the bridges and the
-  # read-only methods. The Ruby layer here adds the validated, ergonomic API.
-  class Provider
-    # The provider name as given (frozen UTF-8 String). Stored at initialize and
-    # never read back from provider metadata (tld swaps in empty NullMetadata on
-    # a failed registration). Correct regardless of registration outcome.
-    def name
-      raise Winlog::Closed, "winlog: provider is closed" if closed?
-
-      @name
-    end
-
-    # Same contract as Winlog.open (no block form here; open delegates to new).
-    # Raises ArgumentError on a bad name; never raises on EventRegister failure
-    # (see #registered?).
-    def initialize(name)
-      @name = Winlog.send(:validate_name!, name).dup.freeze
-      _register(@name)
-    end
-
-    # Emit one TraceLogging event. THE call of the gem.
-    #
-    #   level  : Symbol in LEVELS, or Integer 1..255.
-    #   event  : event name (Symbol or String; valid UTF-8, non-empty, no NUL).
-    #   fields : keyword splat of field-name => value pairs, plus the reserved
-    #            control kwargs keyword:/opcode:/activity:/related: (extracted by
-    #            exact Symbol key; String keys with the same text stay fields).
-    #
-    # Returns true if enabled and written, false if skipped/dropped. Never
-    # raises on delivery problems (ETW is lossy by design). Raises Winlog::Closed
-    # after close. Field-value type errors raise only when the event is enabled
-    # (the deliberate E2 asymmetry; control args validate on every call).
-    def log(level, event, **fields)
-      # Map opcode symbol -> integer here (Ruby owns the OPCODES table) without
-      # disturbing the String-key escape hatch: only a :opcode Symbol key is a
-      # control arg, and only when its value is a Symbol does it need mapping.
-      if fields.key?(:opcode) && fields[:opcode].is_a?(Symbol)
-        fields = fields.dup
-        fields[:opcode] = Winlog.opcode_for(fields[:opcode])
-      end
-      _log(Winlog.level_for(level), event, fields)
-    end
-
-    # Is any ETW session listening (with the given level/keyword filter)?
-    # Reads in-process enable state — no system call. Raises Winlog::Closed
-    # after close.
-    #
-    #   level:   nil (default; "any level") | Symbol in LEVELS | Integer 1..255
-    #   keyword: Integer 0..0x0000_FFFF_FFFF_FFFF (reserved bits raise)
-    def enabled?(level: nil, keyword: 0)
-      lvl = level.nil? ? nil : Winlog.level_for(level)
-      _enabled(lvl, keyword)
-    end
-
-    # Never raises, even closed.
-    def inspect
-      if closed?
-        "#<Winlog::Provider (closed)>"
-      else
-        "#<Winlog::Provider #{@name} {#{guid}}>"
-      end
-    end
-
-    private :_register, :_log, :_write, :_enabled
-  end
-end
+# frozen_string_literal: true
+
+raise LoadError, "winlog is discontinued and this release contains no code. Use opentelemetry-ruby, or win32-eventlog for the Windows Event Log instead." \
+  " Earlier winlog releases are unmaintained and not recommended."

metadata

@@ -1,109 +1,30 @@
 --- !ruby/object:Gem::Specification
 name: winlog
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - ned
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '13.0'
-- !ruby/object:Gem::Dependency
-  name: rake-compiler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '5.0'
-- !ruby/object:Gem::Dependency
-  name: vcvars
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.1
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.1'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.1.1
-description: |
-  winlog emits Windows ETW TraceLogging events from Ruby with no manifest, no
-  message DLL, no registry writes, and no elevation: register a provider by
-  name (standard ETW name-hashed GUID), then log runtime-dynamic events with
-  typed fields (UTF-8 text, binary, int64, double, boolean) plus levels,
-  keywords, opcodes, and explicit activity IDs for correlation. Events are
-  self-describing and decode in WPA, PerfView, and the inbox logman/tracerpt
-  with zero setup; when no session is listening, a log call is gated in native
-  code before field processing and costs about one Ruby method call. Built on
-  Microsoft's MIT-licensed TraceLoggingDynamic.h (vendored). Emit-only: events
-  go to ETW sessions, not the Windows Event Log. Windows MSVC (mswin) Ruby only.
+dependencies: []
+description: winlog is discontinued. This final release contains no code and exists
+  only so that installing winlog explains the discontinuation instead of building
+  an unmaintained native extension.
 executables: []
-extensions:
-- ext/winlog/extconf.rb
+extensions: []
 extra_rdoc_files: []
 files:
-- CHANGELOG.md
 - LICENSE.txt
 - README.md
-- ext/winlog/TraceLoggingDynamic.h
-- ext/winlog/extconf.rb
-- ext/winlog/winlog.cpp
 - lib/winlog.rb
-- lib/winlog/version.rb
-homepage: https://github.com/main-path/winlog
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/main-path/winlog
-  source_code_uri: https://github.com/main-path/winlog
-  changelog_uri: https://github.com/main-path/winlog/blob/main/CHANGELOG.md
-  bug_tracker_uri: https://github.com/main-path/winlog/issues
   rubygems_mfa_required: 'true'
+post_install_message: winlog is discontinued and this release contains no code. Use
+  opentelemetry-ruby, or win32-eventlog for the Windows Event Log instead.
 rdoc_options: []
 require_paths:
 - lib
@@ -111,7 +32,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '2.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -120,6 +41,6 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: Structured, registration-free ETW TraceLogging telemetry for Ruby — events
-  that cost nothing when nobody is listening.
+summary: Discontinued. Use opentelemetry-ruby, or win32-eventlog for the Windows Event
+  Log instead.
 test_files: []

data/CHANGELOG.md

@@ -1,31 +0,0 @@
-# Changelog
-
-## [0.1.0] - 2026-06-27
-
-Initial release.
-
-- `Winlog.open(name)` — register a TraceLogging provider by name (standard ETW
-  name-hashed GUID; no manifest, message DLL, registry write, or elevation),
-  returning a `Winlog::Provider`. Block form yields the provider and
-  ensure-closes it.
-- `Winlog::Provider#log(level, event, **fields)` — emit one runtime-dynamic,
-  self-describing event with typed fields (UTF-8 text, binary, int64, double,
-  boolean) plus `keyword:`, `opcode:`, and explicit `activity:`/`related:` GUIDs
-  for correlation. Gated in native code before any field is read when no session
-  is listening (~one Ruby method call); never raises on delivery problems.
-- `Winlog::Provider#enabled?(level:, keyword:)` — in-process check (no system
-  call) for skipping expensive argument building.
-- `Winlog::Provider#name` / `#guid` / `#registered?` / `#registration_result` /
-  `#close` / `#closed?` / `#inspect`.
-- `Winlog.guid_for(name)` — the pure-Ruby ETW name-hash, for handing the GUID to
-  logman (which does not name-hash).
-- `Winlog.new_activity_id` — a fresh 128-bit activity id
-  (`EventActivityIdControl(CREATE_ID)`), fiber-safe (never touches the
-  thread-ambient activity id).
-- Constants `Winlog::LEVELS`, `Winlog::OPCODES`, `Winlog::KEYWORD_RESERVED_MASK`.
-- Errors `Winlog::Error` and `Winlog::Closed`; plain argument misuse raises
-  Ruby's own `ArgumentError` / `TypeError` / `RangeError`.
-
-Built on Microsoft's MIT-licensed `TraceLoggingDynamic.h` (vendored into
-`ext/winlog/`); winlog implements no ETW encoding of its own. Emit-only: events
-go to ETW sessions, not the Windows Event Log. Windows MSVC (mswin) Ruby only.