nthlayer-generate 2.0.2__tar.gz → 2.0.4__tar.gz

{nthlayer_generate-2.0.2 → nthlayer_generate-2.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nthlayer-generate
-Version: 2.0.2
+Version: 2.0.4
 Summary: NthLayer - The Missing Layer of Reliability
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{nthlayer_generate-2.0.2 → nthlayer_generate-2.0.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "nthlayer-generate"
-version = "2.0.2"
+version = "2.0.4"
 description = "NthLayer - The Missing Layer of Reliability"
 readme = "README.md"
 requires-python = ">=3.11"

{nthlayer_generate-2.0.2 → nthlayer_generate-2.0.4}/src/nthlayer_generate/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "2.0.2"
+__version__ = "2.0.4"

{nthlayer_generate-2.0.2 → nthlayer_generate-2.0.4}/src/nthlayer_generate/cli/init.py

@@ -1,7 +1,9 @@
 """CLI command for initializing new NthLayer services."""
 
+import re
 from pathlib import Path
 
+import yaml
 from nthlayer_common.manifest.models import resolve_service_type
 
 from nthlayer_generate.cli.ux import (
@@ -17,6 +19,7 @@ from nthlayer_generate.cli.ux import (
 )
 from nthlayer_generate.core.tiers import TIER_CONFIGS
 from nthlayer_generate.specs.custom_templates import CustomTemplateLoader
+from nthlayer_generate.specs.manifest import is_valid_service_name
 
 # The service-type menu. INVARIANT: every key is a value a manifest can
 # store verbatim — nothing here is translated on the way out (opensrm-8qpd).
@@ -115,12 +118,22 @@ def init_command(
     if not team and interactive:
         team = text_input("Team name", placeholder="e.g., platform, payments")
 
-    if not team:
+    # `not team` first: team is `str | None` here, so `.strip()` alone would
+    # raise on None and also lose the narrowing the calls below rely on. The
+    # `.strip()` half is what catches a whitespace-only --team here, where the
+    # message fits it, rather than at the _is_valid_team branch below, whose
+    # message would be false for it.
+    if not team or not team.strip():
         error("Team name is required")
         if not interactive:
             console.print("   [muted]Pass it with --team <team>[/muted]")
         return 1
 
+    if not _is_valid_team(team):
+        error("Invalid team name")
+        console.print("   [muted]Team name must not contain line breaks, tabs or NUL[/muted]")
+        return 1
+
     # Select service tier using interactive menu
     tier = None
     if interactive:
@@ -196,10 +209,25 @@ def init_command(
         service_name, team, tier, service_type, dependencies, template_obj
     )
 
+    # encoding="utf-8" explicitly, and UnicodeError caught alongside OSError
+    # (opensrm-t4rd edge-case pass). Without the encoding, `write_text` uses the
+    # locale's, so on a non-UTF-8 system an ordinary accented team name raised
+    # UnicodeEncodeError -- which is a ValueError, NOT an OSError, so the handler
+    # below missed it and init died by traceback. Worse, `write_text` had already
+    # created the file, so a ZERO-BYTE manifest was left behind and every later
+    # run then hit the `exists()` guard above and refused, permanently, until
+    # someone deleted it by hand.
+    #
+    # The unlink is the rollback half of this bead's defect 3: a run that fails
+    # must not leave a partial artifact that blocks the next one.
     try:
-        service_file.write_text(service_content)
-    except OSError as e:
+        service_file.write_text(service_content, encoding="utf-8")
+    except (OSError, UnicodeError) as e:
         error(f"Error creating service file: {e}")
+        try:
+            service_file.unlink(missing_ok=True)
+        except OSError:
+            pass
         return 1
 
     # Create .nthlayer directory
@@ -209,20 +237,40 @@ def init_command(
     except OSError as e:
         warning(f"Could not create .nthlayer directory: {e}")
 
-    # Create config file if it doesn't exist
+    # Create config file if it doesn't exist.
+    #
+    # `is_file()`, NOT `exists()` -- the same confusion this bead fixed for
+    # `nthlayer_dir` below. With `.nthlayer/config.yaml` present as a DIRECTORY,
+    # `exists()` is True because it is a directory, so the write was skipped and
+    # init reported success for a config it had never written, with no warning.
     config_file = nthlayer_dir / "config.yaml"
-    if not config_file.exists():
+    if not config_file.is_file():
         config_content = _generate_config_yaml()
         try:
-            config_file.write_text(config_content)
-        except OSError as e:
+            config_file.write_text(config_content, encoding="utf-8")
+        except (OSError, UnicodeError) as e:
             warning(f"Could not create config file: {e}")
 
     # Success message
     console.print()
     success(f"Created {service_file}")
-    if nthlayer_dir.exists():
+    # is_dir(), NOT exists() (opensrm-t4rd): with .nthlayer a regular FILE,
+    # exists() is True *because it is a file*, so init claimed to have created
+    # a directory it had not.
+    if nthlayer_dir.is_dir():
         success(f"Created {nthlayer_dir}/")
+    else:
+        # NOT fatal, including under --no-interactive. Decided deliberately
+        # (opensrm-t4rd acceptance): the manifest is the primary artifact and it
+        # was written correctly, so a CI gate keying on the exit code is right to
+        # pass. What was wrong before was claiming the directory had been created;
+        # the warning below states plainly that it was not, and names the fix.
+        # Making it fatal would fail runs whose manifest is perfectly good merely
+        # because .nthlayer could not be created (read-only parent, a stray file).
+        warning(
+            f"{nthlayer_dir}/ was not created — config was not written. "
+            f"It already exists as a file, or the parent is not writable."
+        )
 
     console.print()
     console.print("[bold]Next steps:[/bold]")
@@ -241,28 +289,147 @@ def init_command(
     return 0
 
 
-def _is_valid_service_name(name: str) -> bool:
-    """Check if service name is valid (lowercase with hyphens).
+# WHY THE SCALAR HELPERS BELOW EXIST (opensrm-t4rd).
+#
+# generate's hard rule 5 — no raw string construction for generated output —
+# applied at the one input that is scriptable and unvalidated. `--team` was
+# interpolated raw with only a truthiness check. Measured before the fix, all
+# exiting 0:
+#
+#   --team 'Platform: Core'            -> the manifest failed to parse
+#   --team $'ops\nname: hijacked'      -> injected a second service.name
+#   --team $'ops\ntier: critical'      -> manifest VALIDATED CLEAN carrying a
+#                                         bogus tier shadowed by the real one
+#
+# A colon in a team name is ordinary, so quoting has to be available. It is
+# applied conditionally, for the reason in `_yaml_scalar`, and done with
+# pyyaml rather than `json.dumps`, for the reason in `_quoted_yaml_scalar`.
+#
+# The allowlist is deliberately narrow: anything outside it is quoted rather
+# than reasoned about. It excludes every YAML indicator character (`:` `#`
+# `-` at the start, `{` `[` `&` `*` `!` `|` `>` `%` `@` and a backtick),
+# leading whitespace, and anything non-ASCII. Matching it is necessary but NOT
+# sufficient — see `_emits_as_same_string`.
+_PLAIN_SCALAR_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9 ._-]*")
 
-    Args:
-        name: Service name to validate
 
-    Returns:
-        True if valid
+def _yaml_scalar(value: object) -> str:
+    """Render *value* as a YAML scalar that cannot alter the document.
+
+    Plain when it provably round-trips, quoted otherwise. Quoting is
+    conditional so the documented example output stays byte-identical to what
+    init writes (``test_block_is_byte_identical_to_real_output``, the
+    docs-vs-reality guard from opensrm-noc6).
+
+    A non-str is quoted rather than rejected: values arrive straight from a
+    YAML loader, so a template declaring ``name: on`` makes this a bool and
+    ``re.fullmatch`` would raise on it.
     """
-    if not name:
+    if not isinstance(value, str):
+        return _quoted_yaml_scalar(str(value))
+    if _PLAIN_SCALAR_RE.fullmatch(value) and _emits_as_same_string(value):
+        return value
+    return _quoted_yaml_scalar(value)
+
+
+# pyyaml wraps long scalars by default, which would emit a second line into a
+# document built by string interpolation. Large enough to never wrap.
+_NO_WRAP = 10**9
+
+
+def _quoted_yaml_scalar(value: str) -> str:
+    """Render *value* as a double-quoted YAML scalar on exactly one line.
+
+    ``default_style='"'`` forces the quoted form for every input, so the result
+    is always a single line and never a block scalar.
+
+    ``json.dumps`` was used here first, on the reasoning that a JSON string is
+    also a valid YAML double-quoted scalar. True for the BMP, false above it:
+    with ``ensure_ascii=True`` json escapes a non-BMP character as a UTF-16
+    surrogate PAIR, and pyyaml resolves each 16-bit escape separately without
+    recombining them, so an emoji team name read back as two lone surrogates,
+    validated clean, and could not be re-encoded to UTF-8 at all.
+    ``ensure_ascii=False`` is no better: it mismatches on U+0085 and makes
+    pyyaml raise on U+007F.
+
+    ``allow_unicode=True`` is readability only, not correctness: it emits BMP
+    non-ASCII literally (``cafe`` with its accent, rather than an escape).
+    Above the BMP pyyaml escapes regardless of the flag -- but as ONE 32-bit
+    escape, which its own reader resolves back to one character. That single
+    escape, not the flag, is what json's surrogate pair got wrong. Measured:
+    both settings round-trip every value in the corpus.
+
+    The trailing newline pyyaml adds is stripped. No document-end marker is
+    stripped, because ``default_style='"'`` means only pyyaml's
+    double-quoted writer ever runs, and that writer never emits one.
+    """
+    return yaml.safe_dump(value, default_style='"', allow_unicode=True, width=_NO_WRAP).rstrip("\n")
+
+
+def _emits_as_same_string(value: str) -> bool:
+    """True if *value* written as a plain YAML scalar reads back identically.
+
+    The allowlist excludes every YAML *indicator*, but says nothing about
+    implicit *type resolution*, which is the half that was missing. Measured,
+    every one of these matched the allowlist, was emitted unquoted, and loaded
+    back as something other than the string written -- all at exit 0:
+
+      --team null         -> None       -> validate FAILS, "team is required"
+      --team yes/on/true  -> True       -> validates CLEAN, bool in a str field
+      --team no/off/false -> False      -> validate FAILS
+      --team 123          -> 123        -> int
+      --team 1_000        -> 1000       -> int
+      --team 1.5          -> 1.5        -> float
+      --team 0x1f         -> 31         -> int
+      --team 2026-01-01   -> date(...)  -> datetime.date, validates CLEAN
+      --team 'ops '       -> 'ops'      -> trailing space silently stripped
+
+    Case variants resolve too (``NULL``, ``Yes``), which is why this asks the
+    loader instead of carrying a deny list that would have to track the YAML 1.1
+    type schema -- and stay correct as pyyaml changes. Both shapes above are the
+    bead's own defects one field over: the first writes a manifest generate's
+    validator rejects, the second a clean manifest carrying a wrong value.
+
+    Checking the bare scalar is faithful to the mapping-value position it is
+    emitted into, because the allowlist already excludes every character whose
+    resolution differs between those two contexts.
+
+    ``ValueError`` is caught alongside ``YAMLError`` because pyyaml's integer
+    constructor raises it rather than a YAML error on an allowlist-matching
+    input: ``0b_`` reaches ``int("", 2)``. Uncaught, that crashed ``nthlayer
+    init`` with a traceback and wrote nothing. Fuzzing every
+    allowlist-matching string up to length 4 (10248 of them) reaches exactly
+    these two types, ``ValueError`` on 3 inputs -- ``0b_``, ``0x_``, ``0b__``.
+
+    Either way the answer is the same: a value that will not load is not
+    provably a plain string, so it gets quoted.
+    """
+    try:
+        loaded = yaml.safe_load(value)
+    except (yaml.YAMLError, ValueError):
         return False
+    return isinstance(loaded, str) and loaded == value
 
-    # Must be lowercase, numbers, and hyphens only
-    # Must not start or end with hyphen
-    if name[0] == "-" or name[-1] == "-":
-        return False
 
-    for char in name:
-        if not (char.islower() or char.isdigit() or char == "-"):
-            return False
+def _is_valid_team(team: str) -> bool:
+    r"""True if *team* contains no line break, tab or NUL.
+
+    Those four only, not every control character: the rest are quoted correctly
+    by ``_yaml_scalar`` and are merely odd, not dangerous. Blankness is not
+    checked here either — the caller rejects it first, with a message that
+    actually fits it.
+
+    Quoting alone already makes the document safe, so this is not what prevents
+    injection. It is what turns a newline in --team into a clear error rather
+    than a silently escaped ``\n`` in the output, because a team name spanning
+    lines is a mistake every time.
+    """
+    return not any(ch in team for ch in "\n\r\t\x00")
+
 
-    return True
+def _is_valid_service_name(name: str) -> bool:
+    """Delegates to the one service-name rule; see specs/manifest for why."""
+    return is_valid_service_name(name)
 
 
 def _generate_service_yaml_v2(
@@ -293,14 +460,14 @@ def _generate_service_yaml_v2(
     resources_yaml = _build_resources_yaml(service_name, tier, service_type, dependencies)
 
     # Template line if using a template
-    template_line = f"  template: {template.name}\n" if template else ""
+    template_line = f"  template: {_yaml_scalar(template.name)}\n" if template else ""
 
     return f"""# {service_name} Service Definition
 # Generated by NthLayer
 
 service:
-  name: {service_name}
-  team: {team}
+  name: {_yaml_scalar(service_name)}
+  team: {_yaml_scalar(team)}
   tier: {tier}
   type: {service_type}
 {template_line}
@@ -457,11 +624,11 @@ def _generate_service_yaml(service_name: str, team: str, template) -> str:
 # Generated by NthLayer
 
 service:
-  name: {service_name}
-  team: {team}
+  name: {_yaml_scalar(service_name)}
+  team: {_yaml_scalar(team)}
   tier: {template.tier}     # critical | standard | low
   type: {template.type}     # api | worker | stream | batch | database | ai-gate | x-web
-  template: {template.name}
+  template: {_yaml_scalar(template.name)}
 
 # Template provides:
 {_format_template_resources(template)}
@@ -493,7 +660,12 @@ def _format_template_resources(template) -> str:
     """
     lines = []
     for resource in template.resources:
-        lines.append(f"#   - {resource.kind}: {resource.name}")
+        # A comment, but still a line in the document: `resource.kind` and
+        # `resource.name` come from a template file on disk with no
+        # validation, so a newline in either would escape the `#` and land
+        # at top level. `_yaml_scalar` escapes it instead, and leaves the
+        # ordinary values (`SLO`, `availability`) unquoted.
+        lines.append(f"#   - {_yaml_scalar(resource.kind)}: {_yaml_scalar(resource.name)}")
     return "\n".join(lines) if lines else "#   (no resources)"
 
 

{nthlayer_generate-2.0.2 → nthlayer_generate-2.0.4}/src/nthlayer_generate/cli/setup.py

@@ -17,6 +17,12 @@ import argparse
 import os
 from pathlib import Path
 
+# Reused from init rather than copied, which is this bead's whole point
+# (opensrm-h9fq). It is the only private cross-module import in src/, and
+# relocating these helpers to a shared home is tracked in opensrm-d5ce --
+# deferred because opensrm-t4rd's AST guards match them by name in cli/init.py
+# and that move needs its own verification.
+from nthlayer_generate.cli.init import _is_valid_team, _yaml_scalar
 from nthlayer_generate.cli.ux import (
     confirm,
     console,
@@ -42,6 +48,7 @@ from nthlayer_generate.config.loader import (
     save_config,
 )
 from nthlayer_generate.config.secrets import get_secret_resolver
+from nthlayer_generate.specs.manifest import is_valid_service_name
 
 
 def setup_command(
@@ -88,11 +95,23 @@ def setup_command(
     print()
     _test_connections()
 
-    # Offer to create first service
+    # Offer to create first service.
+    #
+    # The return value is PROPAGATED (opensrm-h9fq). It used to be discarded,
+    # so every failure inside printed `error(...)` and then this function
+    # printed "Setup Complete!" and returned 0. The configuration above IS
+    # saved by this point, so the message says what actually happened rather
+    # than claiming either total success or total failure.
+    service_rc = 0
     if not skip_service:
         print()
         if _confirm("Create your first service?", default=True):
-            _create_first_service()
+            service_rc = _create_first_service()
+
+    if service_rc != 0:
+        console.print()
+        warning("Configuration was saved, but the first service was not created.")
+        return service_rc
 
     _print_next_steps()
     return 0
@@ -375,8 +394,36 @@ def _test_pagerduty(config: IntegrationConfig) -> tuple[bool, str]:
         return False, str(e)
 
 
-def _create_first_service() -> None:
-    """Guide user through creating their first service."""
+# The wizard's three tier tables, lifted to module level so a test can assert
+# they AGREE (opensrm-h9fq). While they were function-locals, adding a value to
+# `tier_map` with no matching config was an undetectable drift -- the provenance
+# pass mutated exactly that and the suite stayed green.
+TIER_CHOICES = [
+    "critical - 99.95% availability, 5min escalation",
+    "standard - 99.9% availability, 15min escalation",
+    "low - 99.5% availability, 30min escalation",
+]
+TIER_MAP = {"critical": 1, "standard": 2, "low": 3}
+TIER_CONFIGS_BY_INDEX = {
+    1: {"availability": 99.95, "latency_ms": 200, "tier_name": "critical"},
+    2: {"availability": 99.9, "latency_ms": 500, "tier_name": "standard"},
+    3: {"availability": 99.5, "latency_ms": 1000, "tier_name": "low"},
+}
+
+
+def _create_first_service() -> int:
+    """Guide user through creating their first service.
+
+    Returns 0 on success OR on a deliberate skip, and 1 on failure, so the
+    caller can key an exit code on it (opensrm-h9fq). It returned None while
+    every failure path printed `error(...)` and the command then printed
+    "Setup Complete!" and exited 0 -- which is this bead's own defect in its
+    exit-code half, and `specs/manifest.py` says plainly that an exit code is
+    what a CI gate keys on.
+
+    A user declining is NOT a failure: choosing not to create a service, or
+    declining an overwrite, returns 0.
+    """
     console.print()
     console.print("[bold]Create Your First Service[/bold]")
     console.print("[muted]─[/muted]" * 40)
@@ -385,16 +432,29 @@ def _create_first_service() -> None:
     service_name = _prompt("Service name (e.g., payment-api)")
     if not service_name:
         info("Skipping service creation.")
-        return
+        return 0
 
     # Validate name
     if not _is_valid_service_name(service_name):
         error(f"Invalid service name: {service_name}")
-        console.print("Use lowercase letters, numbers, and hyphens only.")
-        return
+        console.print("   [muted]Use lowercase letters, numbers and hyphens only[/muted]")
+        return 1
 
     team = _prompt("Team name", default="platform")
 
+    # Gated and quoted for the same reason as init (opensrm-t4rd, opensrm-h9fq):
+    # `team` is free text and was interpolated raw, so a colon broke the document
+    # and a newline injected a sibling field that validated clean. `_yaml_scalar`
+    # makes the document safe; this check turns a newline into a clear error
+    # rather than a silently escaped one.
+    if not team or not team.strip():
+        error("Team name is required")
+        return 1
+    if not _is_valid_team(team):
+        error("Invalid team name")
+        console.print("   [muted]Team name must not contain line breaks, tabs or NUL[/muted]")
+        return 1
+
     # Service type selection using interactive menu
     type_choices = [
         "api - HTTP/REST API service",
@@ -405,32 +465,98 @@ def _create_first_service() -> None:
     service_type = selected_type.split(" - ")[0]
 
     # Service tier selection using interactive menu
-    tier_choices = [
-        "critical - 99.95% availability, 5min escalation",
-        "standard - 99.9% availability, 15min escalation",
-        "low - 99.5% availability, 30min escalation",
-    ]
+    tier_choices = list(TIER_CHOICES)
     selected_tier = select("Service tier", tier_choices, default=tier_choices[1])
     tier_name = selected_tier.split(" - ")[0]
-    tier_map = {"critical": 1, "standard": 2, "low": 3}
+    tier_map = dict(TIER_MAP)
     tier = tier_map.get(tier_name, 2)
 
-    # Create services directory
+    # All three of the following mirror cli/init.py's hardening from
+    # opensrm-t4rd (opensrm-h9fq). This bead imported init's quoting HELPERS and
+    # left the file IO beside them unhardened, so t4rd's defects were still live
+    # here verbatim.
+    #
+    # `exist_ok=True` does not cover a non-directory last component, so a
+    # `services` FILE or dangling symlink raised FileExistsError, and a
+    # read-only cwd raised PermissionError -- a traceback where init gives a
+    # message. Not fatal, as in init: the wizard has nothing else to write.
     services_dir = Path("services")
-    services_dir.mkdir(exist_ok=True)
+    try:
+        services_dir.mkdir(exist_ok=True)
+    except OSError as e:
+        error(f"Could not create {services_dir}/: {e}")
+        console.print(
+            "   [muted]It may already exist as a file, or the parent may not be "
+            "writable. Remove or rename it and re-run.[/muted]"
+        )
+        return 1
 
     # Generate service YAML
     service_content = _generate_service_yaml(service_name, team, service_type, tier)
 
+    # `is_file()`, NOT `exists()`. With a DIRECTORY at the target, `exists()` was
+    # True, so the user was asked to confirm an overwrite and then got
+    # IsADirectoryError. The same confusion t4rd corrected in init.
     service_file = services_dir / f"{service_name}.yaml"
-    if service_file.exists():
+    if service_file.is_file():
         if not _confirm(f"{service_file} exists. Overwrite?", default=False):
             info("Skipping service creation.")
-            return
-
-    service_file.write_text(service_content)
+            return 0
+    elif service_file.exists():
+        error(f"{service_file} exists but is not a regular file")
+        console.print("   [muted]Remove it, or choose a different service name.[/muted]")
+        return 1
+
+    # ENCODE BEFORE OPENING ANYTHING. `write_text` opens with "w", which
+    # truncates immediately, so an encoding failure lands AFTER the file is
+    # already empty. Measured: a 38-byte manifest went to 0 bytes and the user
+    # was told it had been left unchanged. Encoding first moves the whole
+    # UnicodeError class in front of any file descriptor, so on that path
+    # nothing is touched and saying so is true.
+    #
+    # DEFENSIVE ONLY: no known wizard input reaches this handler, and the
+    # provenance pass confirmed it cannot be kill-checked. Kept because a field
+    # added later without `_yaml_scalar` would make it reachable (opensrm-h9fq).
+    try:
+        payload = service_content.encode("utf-8")
+    except UnicodeError as e:
+        error(f"Could not encode the manifest: {e}")
+        info(f"{service_file} was not touched.")
+        return 1
+
+    # `is_symlink()` as well as `is_file()`. A symlink whose victim is missing
+    # is neither a file nor `exists()`, so without this the rollback below
+    # deleted a symlink this run did not create -- the same mistake as deleting
+    # a pre-existing regular file, one shape over.
+    #
+    pre_existing = service_file.is_file() or service_file.is_symlink()
+    try:
+        service_file.write_bytes(payload)
+    except OSError as e:
+        error(f"Error creating {service_file}: {e}")
+        if pre_existing:
+            # Deliberately not "unchanged": an OSError at open leaves it intact,
+            # but one raised mid-write leaves it partial, and this cannot tell
+            # them apart. Atomic replacement is opensrm-may6's scope; until then
+            # the message must not promise more than it knows.
+            info(
+                f"{service_file} was not removed, but may be incomplete. "
+                f"Check it with `nthlayer validate {service_file}`, or re-run "
+                f"`nthlayer setup`."
+            )
+        else:
+            try:
+                service_file.unlink(missing_ok=True)
+            except OSError:
+                # intentionally ignored: the write already failed and the
+                # manifest is the only artifact, so a failed cleanup has
+                # nothing left to report and must not mask the real error
+                # (hard rule 4).
+                pass
+        return 1
     console.print()
     success(f"Created {service_file}")
+    return 0
 
 
 def _generate_service_yaml(
@@ -441,20 +567,24 @@ def _generate_service_yaml(
 ) -> str:
     """Generate service YAML content."""
     # Tier-based defaults
-    tier_configs = {
-        1: {"availability": 99.95, "latency_ms": 200, "tier_name": "critical"},
-        2: {"availability": 99.9, "latency_ms": 500, "tier_name": "standard"},
-        3: {"availability": 99.5, "latency_ms": 1000, "tier_name": "low"},
-    }
-    config = tier_configs.get(tier, tier_configs[2])
+    tier_configs = TIER_CONFIGS_BY_INDEX
+    # Raise rather than defaulting (opensrm-h9fq). The hazard is a STRING tier:
+    # init's sibling `_generate_service_yaml_v2` takes `tier: str`, so now that
+    # the emitted field is a name, a caller passing the name would otherwise get
+    # a wrong-but-valid manifest. Unreachable today, since `tier_map` clamps the
+    # menu to 1-3, so this is a loud guard on a latent silent-wrong rather than
+    # a live fix. The cases are enumerated in TestUnknownTierIsLoud.
+    if tier not in tier_configs:
+        raise ValueError(f"Unknown tier {tier!r}; expected one of {sorted(tier_configs)}")
+    config = tier_configs[tier]
 
     return f"""# {name} Service Definition
 # Generated by NthLayer setup wizard
 
 service:
-  name: {name}
-  team: {team}
-  tier: {tier}
+  name: {_yaml_scalar(name)}
+  team: {_yaml_scalar(team)}
+  tier: {config["tier_name"]}
   type: {service_type}
 
 resources:
@@ -462,7 +592,7 @@ resources:
   - kind: SLO
     name: availability
     spec:
-      objective: {config['availability']}
+      objective: {config["availability"]}
       window: 30d
       indicator:
         type: availability
@@ -476,7 +606,7 @@ resources:
     spec:
       objective: 99.0
       window: 30d
-      threshold_ms: {config['latency_ms']}
+      threshold_ms: {config["latency_ms"]}
       indicator:
         type: latency
         percentile: 99
@@ -503,15 +633,11 @@ resources:
 
 
 def _is_valid_service_name(name: str) -> bool:
-    """Validate service name format."""
-    if not name:
-        return False
-    if name[0] == "-" or name[-1] == "-":
-        return False
-    for char in name:
-        if not (char.islower() or char.isdigit() or char == "-"):
-            return False
-    return True
+    """Delegates to the one service-name rule; see specs/manifest for why.
+
+    This was the third private copy (opensrm-h9fq).
+    """
+    return is_valid_service_name(name)
 
 
 def _print_next_steps() -> None: