fix: Read event fields from a mapping as well as an object

[m96-chan]

Summary

event_to_span, event_to_log and SpanMapper read events with getattr only, so a dict got the default for every field — a span named unknown.0 with no provider and no PID. No error, no warning, just wrong.

event_to_span({"provider_name": "Microsoft-Windows-Kernel-Process",
               "event_id": 1, "process_id": 4104})
# name='unknown.0', etw.provider='unknown', etw.event_id=0, process.pid=0

pyetwkit.export has accepted both shapes all along via _event_to_dict, so the same dict exported to JSON perfectly well while OTLP silently emptied it.

Changes

• One _event_field() helper handling a Mapping or an object, used by event_to_span, event_to_log, SpanMapper.get_span_name and SpanMapper.extract_attributes
• _require_event() raises TypeError for something that is not an event at all, rather than returning a span of defaults
• A partial event still falls back per-field — not being complete is different from not being an event

Related Issue

Closes #92

Test Plan

Added/Modified Tests

Six tests: dict and object agree for event_to_span and event_to_log, SpanMapper matches a dict, a dict survives the whole exporter through OtlpFileExporter, junk raises TypeError, and a partial event still gets defaults.

Test Results

The reproduction from #92, before and after:

# before
dict   name='unknown.0'          pid=[{'intValue': 0}]
object name='Microsoft-Windows-Kernel-Process.1'  pid=[{'intValue': 4104}]

# after
dict   name='Microsoft-Windows-Kernel-Process.1'  pid=[{'intValue': 4104}]
object name='Microsoft-Windows-Kernel-Process.1'  pid=[{'intValue': 4104}]
junk -> TypeError expected an ETW event or a mapping of event fields, got str

355 passed
ruff / black  clean

Checklist

• Tests have been added/updated
• All tests pass
• Ready for code review
• Documentation updated (if applicable)
• CHANGELOG.md updated (if applicable)

Additional Notes

How this surfaced is worth recording: while implementing #91 I noticed the OTLP tests in this repo were passing dicts, which meant they had been asserting against spans of default values. I switched those tests to SimpleNamespace at the time so they exercised the real event shape; this fixes the library so the dict shape works too, rather than only avoiding it in tests.

Goes with #95 (#93). Both are independent of each other.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HhPcm483PrDmuQEUSALBFn