ciphergate-cli 0.7.0__py3-none-any.whl

ciphergate/models/policy.py

@@ -0,0 +1,402 @@
+"""Typed, strict schema for human-authored YAML policies (``policy_version: 1``).
+
+Unknown keys are rejected everywhere except inside ``metadata``. Semantic checks that span
+several fields (conflicts, risky allowances, key references) live in
+``ciphergate.policy.validator``.
+"""
+
+from __future__ import annotations
+
+import datetime as dt
+import re
+from typing import Annotated, Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+
+from ciphergate.constants import (
+    DEFAULT_KEY_ENV,
+    Action,
+    Destination,
+    DomainProfile,
+    Environment,
+    InputFormat,
+    TargetEnvironment,
+    UseCase,
+)
+
+SLUG_RE = r"^[a-z0-9][a-z0-9_.-]{0,63}$"
+CATEGORY_RE = re.compile(r"^[a-z][a-z0-9_]*\.[a-z0-9_]+$")
+CATEGORY_SELECTOR_RE = re.compile(r"^(\*|[a-z][a-z0-9_]*\.\*|[a-z][a-z0-9_]*\.[a-z0-9_]+)$")
+ENV_VAR_RE = r"^[A-Z_][A-Z0-9_]{0,127}$"
+MARKER_RE = re.compile(r"^\[[A-Z][A-Z0-9_]{0,31}(?::(?:\{category\}|[a-z0-9_.]{1,48}))?\]$")
+PREFIX_RE = r"^([a-z][a-z0-9_]{0,31})?$"
+
+Slug = Annotated[str, Field(pattern=SLUG_RE)]
+EnvVarName = Annotated[str, Field(pattern=ENV_VAR_RE)]
+
+
+class StrictModel(BaseModel):
+    model_config = ConfigDict(extra="forbid", str_strip_whitespace=False)
+
+
+# --------------------------------------------------------------------------- action parameters
+
+
+class EmptyParams(StrictModel):
+    """Actions that take no parameters."""
+
+
+class RedactParams(StrictModel):
+    marker: str = "[REDACTED:{category}]"
+
+    @field_validator("marker")
+    @classmethod
+    def _marker_shape(cls, value: str) -> str:
+        if not MARKER_RE.match(value):
+            raise ValueError(
+                "marker must look like [WORD] or [WORD:{category}] / [WORD:label] "
+                "(uppercase word, ASCII only) so rescans can recognise it"
+            )
+        return value
+
+
+class ReplaceParams(StrictModel):
+    value: str | int | float | bool | None
+
+    @field_validator("value")
+    @classmethod
+    def _bounded(cls, value: str | int | float | bool | None) -> str | int | float | bool | None:
+        if isinstance(value, str) and (len(value) > 256 or any(c in value for c in "\r\n\x00")):
+            raise ValueError("replacement strings must be at most 256 characters without newlines")
+        return value
+
+
+class PseudonymizeParams(StrictModel):
+    key_env: EnvVarName = DEFAULT_KEY_ENV
+    scope: Literal["field", "category", "entity"]
+    entity: Slug | None = None
+    prefix: Annotated[str, Field(pattern=PREFIX_RE)] = ""
+    normalize: Literal["nfc", "casefold_nfc", "none"] = "nfc"
+    namespace: Slug | None = None
+
+    @model_validator(mode="after")
+    def _entity_scope(self) -> PseudonymizeParams:
+        if self.scope == "entity" and not self.entity:
+            raise ValueError("scope 'entity' requires an 'entity' name")
+        if self.scope != "entity" and self.entity:
+            raise ValueError("'entity' is only valid with scope 'entity'")
+        return self
+
+
+class GeneralizeParams(StrictModel):
+    strategy: Literal["year", "year_month", "age_band", "round_coordinates", "numeric_bin"]
+    band_size: Annotated[int, Field(ge=1, le=100)] = 10
+    max_age: Annotated[int, Field(ge=1, le=200)] = 120
+    decimals: Annotated[int, Field(ge=0, le=4)] = 1
+    bins: list[float] | None = None
+
+    @model_validator(mode="after")
+    def _bins(self) -> GeneralizeParams:
+        if self.strategy == "numeric_bin":
+            if not self.bins or len(self.bins) < 2:
+                raise ValueError("numeric_bin requires 'bins' with at least two increasing edges")
+            if any(b >= a for a, b in zip(self.bins[1:], self.bins, strict=False)):
+                raise ValueError("'bins' edges must be strictly increasing")
+        elif self.bins is not None:
+            raise ValueError("'bins' is only valid with strategy numeric_bin")
+        return self
+
+
+class DateShiftParams(StrictModel):
+    key_env: EnvVarName = DEFAULT_KEY_ENV
+    max_days: Annotated[int, Field(ge=1, le=3650)]
+    scope: Literal["dataset", "entity"] = "dataset"
+    entity_field: str | None = None
+    formats: list[str] = Field(default_factory=lambda: ["iso"])
+    namespace: Slug | None = None
+
+    @model_validator(mode="after")
+    def _entity(self) -> DateShiftParams:
+        if self.scope == "entity" and not self.entity_field:
+            raise ValueError("scope 'entity' requires 'entity_field'")
+        if self.scope != "entity" and self.entity_field:
+            raise ValueError("'entity_field' is only valid with scope 'entity'")
+        if not self.formats:
+            raise ValueError("'formats' must not be empty")
+        for fmt in self.formats:
+            if fmt != "iso" and ("%" not in fmt or len(fmt) > 64):
+                raise ValueError("formats must be 'iso' or an explicit strptime pattern")
+        return self
+
+
+ActionParams = (
+    EmptyParams
+    | RedactParams
+    | ReplaceParams
+    | PseudonymizeParams
+    | GeneralizeParams
+    | DateShiftParams
+)
+
+PARAM_MODELS: dict[Action, type[StrictModel]] = {
+    Action.ALLOW: EmptyParams,
+    Action.REDACT: RedactParams,
+    Action.REPLACE: ReplaceParams,
+    Action.PSEUDONYMIZE: PseudonymizeParams,
+    Action.GENERALIZE: GeneralizeParams,
+    Action.DATE_SHIFT: DateShiftParams,
+    Action.DROP_FIELD: EmptyParams,
+    Action.DROP_RECORD: EmptyParams,
+    Action.BLOCK: EmptyParams,
+    Action.REVIEW: EmptyParams,
+}
+
+_REJECTED_ACTIONS = {
+    "tokenize": "reversible tokenization is not supported in this release (no token vault); "
+    "use 'pseudonymize' for one-way keyed pseudonyms",
+    "detokenize": "reversible tokenization is not supported in this release",
+    "mask": "partial masking is not supported; use 'redact' or 'replace'",
+    "encrypt": "encryption is not supported in this release",
+}
+
+
+def _check_action(value: Any) -> Any:
+    if isinstance(value, str) and value in _REJECTED_ACTIONS:
+        raise ValueError(_REJECTED_ACTIONS[value])
+    return value
+
+
+# --------------------------------------------------------------------------- policy sections
+
+
+ContextOverrideField = Literal[
+    "environment", "target_environment", "destination", "domain_profile", "use_case"
+]
+
+
+class PolicyContext(StrictModel):
+    environment: Environment | None = None
+    target_environment: TargetEnvironment | None = None
+    destination: Destination | None = None
+    domain_profile: DomainProfile | None = None
+    use_case: UseCase | None = None
+    allow_cli_override: list[ContextOverrideField] = Field(default_factory=list)
+
+
+class Requirements(StrictModel):
+    environment: bool = True
+    target_environment: bool = False
+    destination: bool = True
+
+
+class RescanSettings(StrictModel):
+    enabled: bool = True
+    fail_on_categories: list[str] | None = None
+
+
+class PolicySettings(StrictModel):
+    strict: bool = True
+    unknown_sensitive_behavior: Literal["review", "block"] = "review"
+    fail_on_parse_error: bool = True
+    malformed_record_action: Literal["drop_record"] | None = None
+    report_raw_values: Literal[False] = False
+    scan_json_keys: bool = False
+    csv_duplicate_headers: Literal["reject", "disambiguate"] = "reject"
+    preserve_blank_lines: bool = False
+    rescan: RescanSettings = Field(default_factory=RescanSettings)
+
+    @field_validator("report_raw_values", mode="before")
+    @classmethod
+    def _no_raw(cls, value: Any) -> Any:
+        if value is True:
+            raise ValueError("reporting raw values is not supported; reports never contain values")
+        return value
+
+    @model_validator(mode="after")
+    def _parse_errors(self) -> PolicySettings:
+        if not self.fail_on_parse_error and self.malformed_record_action is None:
+            raise ValueError(
+                "fail_on_parse_error: false requires an explicit malformed_record_action "
+                "(currently only 'drop_record')"
+            )
+        if self.fail_on_parse_error and self.malformed_record_action is not None:
+            raise ValueError(
+                "malformed_record_action is only valid when fail_on_parse_error is false"
+            )
+        return self
+
+
+class CustomDetector(StrictModel):
+    id: Slug
+    category: str
+    pattern: Annotated[str, Field(min_length=1, max_length=512)]
+    confidence: Annotated[float, Field(ge=0.0, le=1.0)] = 0.8
+    ignore_case: bool = False
+
+
+PRESIDIO_ENTITY_RE = r"^[A-Z][A-Z0-9_]{1,63}$"
+SPACY_MODEL_RE = r"^[a-z][a-z0-9_]{1,63}$"
+
+
+def _default_presidio_entities() -> dict[str, str]:
+    return {"PERSON": "pii.person_name", "LOCATION": "location.coarse"}
+
+
+class PresidioSettings(StrictModel):
+    """Optional local NER (Presidio + an already-installed spaCy model). Off by default."""
+
+    enabled: bool = False
+    language: Annotated[str, Field(pattern=r"^[a-z]{2}$")] = "en"
+    model: Annotated[str, Field(pattern=SPACY_MODEL_RE)] = "en_core_web_lg"
+    min_score: Annotated[float, Field(ge=0.0, le=1.0)] = 0.6
+    entities: dict[Annotated[str, Field(pattern=PRESIDIO_ENTITY_RE)], str] = Field(
+        default_factory=_default_presidio_entities, min_length=1
+    )
+
+
+class DetectorSettings(StrictModel):
+    disabled: list[str] = Field(default_factory=list)
+    dates_emit_generic: bool = False
+    internal_host_suffixes: list[str] = Field(
+        default_factory=lambda: [
+            ".internal",
+            ".local",
+            ".corp",
+            ".lan",
+            ".intranet",
+            ".localdomain",
+        ]
+    )
+    custom: list[CustomDetector] = Field(default_factory=list)
+    reject_risky_regex: bool = True
+    presidio: PresidioSettings = Field(default_factory=PresidioSettings)
+
+    @field_validator("internal_host_suffixes")
+    @classmethod
+    def _suffixes(cls, value: list[str]) -> list[str]:
+        for item in value:
+            if not re.fullmatch(r"\.[a-z0-9-]{1,63}(\.[a-z0-9-]{1,63}){0,3}", item):
+                raise ValueError("internal_host_suffixes entries must look like '.internal'")
+        return value
+
+
+class Classification(StrictModel):
+    """Policy-declared field classification: tells the field detector what a field contains."""
+
+    id: Slug
+    field_names: list[str] = Field(default_factory=list)
+    field_paths: list[str] = Field(default_factory=list)
+    category: str
+    confidence: Annotated[float, Field(ge=0.0, le=1.0)] = 0.9
+
+    @model_validator(mode="after")
+    def _has_selector(self) -> Classification:
+        if not self.field_names and not self.field_paths:
+            raise ValueError("a classification needs field_names or field_paths")
+        return self
+
+
+class RuleMatch(StrictModel):
+    categories: list[str] | None = None
+    detectors: list[str] | None = None
+    field_names: list[str] | None = None
+    field_paths: list[str] | None = None
+    field_regex: Annotated[str, Field(min_length=1, max_length=256)] | None = None
+    environments: list[Environment] | None = None
+    target_environments: list[TargetEnvironment] | None = None
+    destinations: list[Destination] | None = None
+    domain_profiles: list[DomainProfile] | None = None
+    use_cases: list[UseCase] | None = None
+    formats: list[InputFormat] | None = None
+    min_confidence: Annotated[float, Field(ge=0.0, le=1.0)] | None = None
+    max_confidence: Annotated[float, Field(ge=0.0, le=1.0)] | None = None
+
+    @model_validator(mode="after")
+    def _non_empty(self) -> RuleMatch:
+        for name, value in self:
+            if isinstance(value, list) and not value:
+                raise ValueError(f"selector '{name}' must not be an empty list (omit it instead)")
+        if all(value is None for _, value in self):
+            raise ValueError(
+                "a rule must declare at least one selector; match-everything is unsafe"
+            )
+        if (
+            self.min_confidence is not None
+            and self.max_confidence is not None
+            and self.min_confidence > self.max_confidence
+        ):
+            raise ValueError("min_confidence must not exceed max_confidence")
+        return self
+
+
+class Rule(StrictModel):
+    id: Slug
+    description: Annotated[str, Field(max_length=500)] | None = None
+    priority: Annotated[int, Field(ge=0, le=10_000)] = 100
+    hard: bool = False
+    guardrail: bool = False
+    match: RuleMatch
+    action: Action
+    params: dict[str, Any] = Field(default_factory=dict)
+    reason: Slug | None = None
+    acknowledge_risk: bool = False
+
+    @field_validator("action", mode="before")
+    @classmethod
+    def _rejected_actions(cls, value: Any) -> Any:
+        return _check_action(value)
+
+
+class DefaultAction(StrictModel):
+    action: Action
+    params: dict[str, Any] = Field(default_factory=dict)
+    reason: Slug | None = None
+
+    @field_validator("action", mode="before")
+    @classmethod
+    def _rejected_actions(cls, value: Any) -> Any:
+        return _check_action(value)
+
+
+class TransferApproval(StrictModel):
+    reviewed_by: Annotated[str, Field(min_length=1, max_length=200)]
+    reference: Annotated[str, Field(min_length=1, max_length=200)]
+    approved_on: dt.date
+
+
+class Transfer(StrictModel):
+    """Explicit, reviewed approval lifting the built-in PRD -> non-production transfer block."""
+
+    id: Slug
+    from_environments: Annotated[list[Environment], Field(min_length=1)]
+    to_target_environments: list[TargetEnvironment] = Field(default_factory=list)
+    to_destinations: list[Destination] = Field(default_factory=list)
+    approval: TransferApproval
+
+    @model_validator(mode="after")
+    def _has_target(self) -> Transfer:
+        if not self.to_target_environments and not self.to_destinations:
+            raise ValueError("a transfer needs to_target_environments or to_destinations")
+        return self
+
+
+class PolicyDocument(StrictModel):
+    policy_version: Literal[1]
+    name: Slug
+    metadata: dict[str, Any] = Field(default_factory=dict)
+    context: PolicyContext = Field(default_factory=PolicyContext)
+    requirements: Requirements = Field(default_factory=Requirements)
+    settings: PolicySettings = Field(default_factory=PolicySettings)
+    detectors: DetectorSettings = Field(default_factory=DetectorSettings)
+    custom_categories: list[str] = Field(default_factory=list)
+    classifications: list[Classification] = Field(default_factory=list)
+    rules: list[Rule] = Field(default_factory=list)
+    defaults: dict[str, DefaultAction] = Field(default_factory=dict)
+    transfers: list[Transfer] = Field(default_factory=list)
+
+    @field_validator("policy_version", mode="before")
+    @classmethod
+    def _version(cls, value: Any) -> Any:
+        if value != 1:
+            raise ValueError("unsupported policy_version; this release supports policy_version: 1")
+        return value

ciphergate/models/report.py

@@ -0,0 +1,115 @@
+"""Privacy-safe run report (schema ``ciphergate.report/v1``).
+
+A report contains counts, safe structural locations, rule IDs and reason codes. It never contains
+raw values, snippets, keys, key derivations or value fingerprints.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import StrEnum
+from typing import Any
+
+from ciphergate.constants import DISCLAIMER, REPORT_SCHEMA, ExitCode
+
+
+class RunStatus(StrEnum):
+    READY = "ready"
+    BLOCKED = "blocked"
+    REVIEW_REQUIRED = "review_required"
+    CONFIGURATION_REQUIRED = "configuration_required"
+    SANITIZED = "sanitized"
+    RESCAN_FAILED = "rescan_failed"
+    PASSED = "passed"
+
+
+STATUS_EXIT_CODES: dict[RunStatus, ExitCode] = {
+    RunStatus.READY: ExitCode.OK,
+    RunStatus.SANITIZED: ExitCode.OK,
+    RunStatus.PASSED: ExitCode.OK,
+    RunStatus.BLOCKED: ExitCode.BLOCKED,
+    RunStatus.REVIEW_REQUIRED: ExitCode.BLOCKED,
+    RunStatus.CONFIGURATION_REQUIRED: ExitCode.KEY_OR_TRANSFORM_CONFIG,
+    RunStatus.RESCAN_FAILED: ExitCode.RESCAN_FAILED,
+}
+
+
+@dataclass
+class RescanSummary:
+    strict: bool
+    failed: bool
+    fail_on_categories: list[str]
+    counts: dict[str, int]
+    unexpected_by_category: dict[str, int]
+    gating_by_category: dict[str, int]
+    items: list[dict[str, Any]]
+    items_truncated: bool = False
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "strict": self.strict,
+            "failed": self.failed,
+            "fail_on_categories": self.fail_on_categories,
+            "counts": self.counts,
+            "unexpected_by_category": self.unexpected_by_category,
+            "gating_by_category": self.gating_by_category,
+            "items": self.items,
+            "items_truncated": self.items_truncated,
+        }
+
+
+@dataclass
+class RunReport:
+    command: str
+    status: RunStatus
+    run_id: str
+    timestamp: str
+    version: str
+    input: dict[str, Any]
+    policy: dict[str, Any]
+    context: dict[str, Any]
+    gates: list[dict[str, Any]] = field(default_factory=list)
+    transfer_approvals: list[str] = field(default_factory=list)
+    summary: dict[str, Any] = field(default_factory=dict)
+    items: list[dict[str, Any]] = field(default_factory=list)
+    items_truncated: bool = False
+    keys: list[dict[str, str]] = field(default_factory=list)
+    changes: dict[str, Any] = field(default_factory=dict)
+    parse_errors: list[dict[str, Any]] = field(default_factory=list)
+    output: dict[str, Any] = field(default_factory=dict)
+    rescan: RescanSummary | None = None
+    warnings: list[str] = field(default_factory=list)
+
+    @property
+    def exit_code(self) -> int:
+        return int(STATUS_EXIT_CODES[self.status])
+
+    @property
+    def ok(self) -> bool:
+        return self.exit_code == 0
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema": REPORT_SCHEMA,
+            "command": self.command,
+            "status": str(self.status),
+            "exit_code": self.exit_code,
+            "run_id": self.run_id,
+            "timestamp": self.timestamp,
+            "ciphergate_version": self.version,
+            "input": self.input,
+            "policy": self.policy,
+            "context": self.context,
+            "gates": self.gates,
+            "transfer_approvals": self.transfer_approvals,
+            "summary": self.summary,
+            "items": self.items,
+            "items_truncated": self.items_truncated,
+            "keys": self.keys,
+            "changes": self.changes,
+            "parse_errors": self.parse_errors,
+            "output": self.output,
+            "rescan": self.rescan.to_dict() if self.rescan else None,
+            "warnings": self.warnings,
+            "disclaimer": DISCLAIMER,
+        }

ciphergate/pipeline/__init__.py

@@ -0,0 +1 @@
+"""Inspect -> plan -> sanitize -> rescan orchestration and safe output handling."""

ciphergate/pipeline/atomic_output.py

@@ -0,0 +1,143 @@
+"""Atomic, no-overwrite-by-default output publishing.
+
+Contract:
+
+1. A temp file is created with ``mkstemp`` in the destination directory (same filesystem; owner-only
+   ``0600`` permissions on POSIX; on Windows the file inherits the directory ACL).
+2. Content is written, flushed and ``fsync``-ed, then the temp file is closed.
+3. Only after every check passes, ``publish()`` moves it into place:
+   * without ``force``: ``os.link`` + unlink on POSIX (fails if the target appeared meanwhile),
+     ``os.rename`` on Windows (fails if the target exists) — never replaces an existing file;
+   * with ``force``: ``os.replace`` (atomic replacement; the previous file stays intact until then).
+4. On any exception, ``KeyboardInterrupt`` or ``abort()``, the temp file is removed. If removal
+   fails, a warning naming the temp path is logged to stderr (the name is CipherGate-generated and
+   contains no data) and ``cleanup_failed_path`` is set.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import logging
+import os
+import tempfile
+from pathlib import Path
+from types import TracebackType
+from typing import IO
+
+from ciphergate.errors import OutputWriteError
+from ciphergate.reporting.safe_text import escape_control
+
+logger = logging.getLogger("ciphergate")
+
+
+class AtomicOutput:
+    def __init__(self, final_path: Path, *, force: bool, encoding: str = "utf-8") -> None:
+        self.final_path = final_path
+        self.force = force
+        self.encoding = encoding
+        self.temp_path: Path | None = None
+        self._stream: IO[str] | None = None
+        self.published = False
+        self.cleanup_failed_path: Path | None = None
+
+    def __enter__(self) -> AtomicOutput:
+        parent = self.final_path.parent if str(self.final_path.parent) else Path(".")
+        try:
+            parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+            fd, name = tempfile.mkstemp(prefix=".ciphergate-", suffix=".tmp", dir=parent)
+        except OSError:
+            raise OutputWriteError(
+                "cannot create a temporary output file in the destination directory",
+                code="output_temp_failed",
+            ) from None
+        self.temp_path = Path(name)
+        with contextlib.suppress(OSError):
+            os.chmod(name, 0o600)
+        self._stream = os.fdopen(fd, "w", encoding=self.encoding, newline="", errors="strict")
+        return self
+
+    @property
+    def stream(self) -> IO[str]:
+        if self._stream is None:
+            raise OutputWriteError("output stream is not open", code="output_closed")
+        return self._stream
+
+    def finish_writing(self) -> None:
+        """Flush, fsync and close the temp file (content complete, not yet published)."""
+        if self._stream is None:
+            return
+        try:
+            self._stream.flush()
+            os.fsync(self._stream.fileno())
+            self._stream.close()
+        except UnicodeEncodeError:
+            raise OutputWriteError(
+                "output contains characters not representable in the output encoding",
+                code="output_encoding",
+            ) from None
+        except OSError:
+            raise OutputWriteError(
+                "failed to flush output to disk", code="output_flush_failed"
+            ) from None
+        finally:
+            self._stream = None
+
+    def publish(self) -> None:
+        self.finish_writing()
+        if self.temp_path is None:
+            raise OutputWriteError("output was never opened", code="output_closed")
+        try:
+            if self.force:
+                os.replace(self.temp_path, self.final_path)
+            elif os.name == "nt":
+                os.rename(self.temp_path, self.final_path)
+            else:
+                os.link(self.temp_path, self.final_path)
+                os.unlink(self.temp_path)
+        except FileExistsError:
+            raise OutputWriteError(
+                "output file appeared while processing; not replaced (use --force)",
+                code="output_exists",
+            ) from None
+        except OSError:
+            raise OutputWriteError(
+                "failed to publish output atomically", code="output_publish_failed"
+            ) from None
+        self.published = True
+        if os.name != "nt":
+            with contextlib.suppress(OSError):
+                dir_fd = os.open(self.final_path.parent or Path("."), os.O_RDONLY)
+                try:
+                    os.fsync(dir_fd)
+                finally:
+                    os.close(dir_fd)
+
+    def abort(self) -> None:
+        if self._stream is not None:
+            with contextlib.suppress(OSError, ValueError, UnicodeEncodeError):
+                self._stream.close()
+            self._stream = None
+        if self.temp_path is not None and not self.published:
+            try:
+                if self.temp_path.exists():
+                    self.temp_path.unlink()
+            except OSError:
+                self.cleanup_failed_path = self.temp_path
+                logger.warning(
+                    "could not remove temporary output file %s; delete it manually",
+                    escape_control(str(self.temp_path)),
+                )
+
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        tb: TracebackType | None,
+    ) -> None:
+        if exc_type is not None or not self.published:
+            self.abort()
+        if exc_type is not None and issubclass(exc_type, UnicodeEncodeError):
+            raise OutputWriteError(
+                "output contains characters not representable in the output encoding",
+                code="output_encoding",
+            ) from None