feat(v1.1): Async API, Typed Events, and Filtering

[m96-chan]

Summary

This PR implements all v1.1 Enhanced Core features:

Async Streaming API (#54)

• AsyncEtwSession - Modern async/await ETW session
• Async context manager and iterator support
• Event callbacks with on_event()
• EventBatcher for efficient batch processing
• gather_events() for concurrent monitoring
• stream_to_queue() for producer/consumer patterns

Typed Events (#55)

• TypedEvent base class with common properties
• Pre-defined typed events:
  • ProcessStartEvent, ProcessStopEvent
  • ThreadStartEvent, ThreadStopEvent
  • ImageLoadEvent
  • DnsQueryEvent, DnsResponseEvent
  • TcpConnectEvent, TcpDisconnectEvent
• to_typed_event() auto-conversion
• register_event_type() for custom events

Event Filtering (#56)

• EventFilterBuilder with fluent API
• Filter by: event_id, process_id, level, opcode, properties
• Property filters: equals, contains, startswith, regex
• Combine filters with & (AND) and | (OR)
• Custom predicate support

Example Usage

Async API

async with AsyncEtwSession() as session:
    session.add_provider("Microsoft-Windows-DNS-Client")
    async for event in session.typed_events(timeout=30.0):
        if isinstance(event, DnsQueryEvent):
            print(f"DNS: {event.query_name}")

Typed Events

for event in session.events():
    typed = to_typed_event(event)
    if isinstance(typed, ProcessStartEvent):
        print(f"Process: {typed.image_file_name}")

Filtering

filter = (EventFilterBuilder()
    .event_ids([1, 2])
    .level_max(4)
    .property_contains("ImageFileName", "chrome")
    .build())

Demo Scripts

• examples/demo_async_api.py
• examples/demo_typed_events.py
• examples/demo_filtering.py

Closes

• feat: Async streaming API #54 Async streaming API
• feat: Manifest-based typed events #55 Manifest-based typed events
• feat: Real-time event filtering callbacks #56 Real-time event filtering callbacks

Test plan

• Run demo_async_api.py as admin
• Run demo_typed_events.py as admin
• Run demo_filtering.py as admin
• Verify typed event conversion
• Verify filter builder works correctly

🤖 Generated with Claude Code