Address lead developer feedback and automated review findings

- Remove isPointerTypeRef string-hack in favor of TypeData.Ptr property.
- Refactor OneOf DSL to remove hacky signature signature-counting.
- Refactor transformUnion to match by branch name instead of index.
- Share UniqueUnionFieldNames across service, validation and transport.
- Pre-seed used tags/names in Protobuf generation to prevent collisions.
- Fallback cookie auth to header in Swagger 2.0 for spec compliance.
- Omit anyOf from Swagger 2.0 schemas for spec compliance.
- Update tests and inventory.

Author: CaliLuke

CONSTRUCTOR_UNION_FAILURE_INVENTORY.md

@@ -24,6 +24,7 @@ Do not call the feature done until each item is:
 - [x] Constructor-form string variants support recursion.
 - [x] Constructor-form string variants report precise unresolved-name errors.
 - [x] Constructor-form discriminator key overrides propagate correctly from enclosing payload/result attributes.
+- [x] Removed hacky signature checks in `dsl/attribute.go` in favor of cleaner type assertions.
 
 ## Variant Naming and Wire Contract
 
@@ -34,6 +35,7 @@ Do not call the feature done until each item is:
 - [x] Reordering unrelated declarations does not change public discriminator values or rendered OpenAPI output in the covered end-to-end fixture.
 - [x] Constructor-form discriminator values remain stable under covered `TypeName`, aliasing, and generated rename paths.
 - [x] Distinct discriminator names remain distinct after Go/codegen name normalization in covered constructor-form duplicate-name cases.
+- [x] Shared `UniqueUnionFieldNames` logic moved to `codegen/types.go` to ensure consistency between service, validation, and transport layers.
 
 ## Service and Transform Codegen
 
@@ -43,13 +45,19 @@ Do not call the feature done until each item is:
 - [x] Collections of constructor-form unions (`ArrayOf(OneOf(...))`, `MapOf(..., OneOf(...))`) generate stable transform code without helper collisions in covered transform cases.
 - [x] Constructor-form result unions with method-level views fail with a precise validation error instead of attempting inconsistent projection.
 - [x] Repeated identical anonymous constructor unions used across methods in the same service reuse shared generated union types without duplicate top-level identifiers.
+- [x] Generated Go union kind constants remain collision-safe after Go identifier normalization, not just generated field names.
+- [x] Union field-name suffixing preserves already-reserved normalized names so cases like `Foo`, `Foo!`, and `Foo2` cannot still emit duplicate identifiers after normalization.
+- [x] Union transforms (`transformUnion`) are now name-aware instead of index-based, preventing semantic swaps when branch order differs.
 
 ## Validation and Defaults
 
 - [x] Validation code generation validates the active constructor-union branch in covered constructor-union smoke tests.
 - [x] Validation code generation correctly validates the active constructor-union branch, including nested branch validations, in covered constructor-union validation paths.
 - [x] Invalid constructor unions in validation paths fail precisely at the DSL boundary instead of skipping validation or generating uncompilable code.
 - [x] Default values for constructor unions fail with a precise DSL error instead of leaking into codegen.
+- [x] Default-value rejection is intentionally correct for all union forms, not an accidental broadening of behavior from constructor unions to declaration-form unions.
+- [x] Constructor-union default rejection does not regress long-standing declaration-form union behavior unless that contract change is explicit and intentionally accepted.
+- [x] Accessor de-duplication is correctly propagated into validation code via `UniqueUnionFieldNames`.
 
 ## HTTP Transport Codegen
 
@@ -62,6 +70,7 @@ Do not call the feature done until each item is:
 - [x] Multipart request generation rejects constructor unions with a precise endpoint-validation error.
 - [x] WebSocket streaming generation handles constructor-form unions for `StreamingPayload` / `StreamingResult` in covered server/client WebSocket smoke tests.
 - [x] Security-scheme extraction through constructor unions fails with a precise DSL validation error in covered method-validation paths.
+- [x] `isPointerTypeRef` string-hack in server templates replaced with robust `expr.DataType` inspection via `isNilable`.
 
 ## OpenAPI v3 Schemas
 
@@ -77,13 +86,16 @@ Do not call the feature done until each item is:
 - [x] Constructor-form unions do not panic or crash OpenAPI v2 generation in covered smoke tests.
 - [x] Constructor-form unions do not panic or crash OpenAPI v2 generation in covered top-level, custom-key, nested, and recursive cases.
 - [x] OpenAPI v2 degrades gracefully for constructor-form unions with a covered object-schema fallback.
+- [x] Cookie-backed API key security schemes fallback to `in: header` for Swagger 2.0 documents to ensure spec compliance.
+- [x] Swagger 2.0 schemas do not contain `anyOf` fields (not supported by v2 spec); fallback to generic `object` behavior.
 
 ## OpenAPI Examples
 
 - [x] Schema examples, payload examples, and media-type examples use the canonical wire shape in covered cases.
 - [x] User-provided examples select the intended union branch, including later object branches, in covered cases.
 - [x] Ambiguous raw user examples for overlapping object branches do not silently canonicalize to the wrong branch in covered schema/payload example paths.
 - [x] Ambiguous user-provided union examples fail explicitly by omission instead of silently falling back to the first branch in covered OpenAPI example paths.
+- [x] Ambiguous user-provided union examples are an intentional upstream behavior with documented rationale, not just an implementation detail that drops examples silently. Inspected `http/codegen/openapi/v3/example.go`: ambiguous matches intentionally fail closed by omitting the example so the generator does not silently canonicalize to an arbitrary branch.
 - [x] Generated examples remain canonical through nested unions in covered cases.
 - [x] Schema-level property examples agree with enclosing payload and request/response examples in covered cases.
 - [x] Custom discriminator/value keys are reflected in examples as well as schemas in covered explicit and generated example paths.
@@ -103,9 +115,13 @@ Do not call the feature done until each item is:
 - [x] Unary gRPC code generation supports top-level constructor-form union payloads/results in covered smoke tests without invalid `.proto` output or generator panics.
 - [x] HTTP and gRPC CLI generation support top-level constructor-form union payloads in covered smoke tests without generation failures.
 - [x] gRPC code generation supports constructor-form unions in covered unary and bidirectional streaming smoke tests without invalid `.proto` output or generator panics.
+- [x] gRPC validation rejects explicit `rpc:tag` collisions between constructor-union branches and sibling protobuf fields before `.proto` generation.
+- [x] gRPC validation rejects explicit duplicate `rpc:tag` values across constructor-union branches before `.proto` generation.
+- [x] gRPC/protobuf generation rejects or dedupes constructor-union branch names that collide after protobuf field-name normalization.
 - [x] CLI generation handles constructor-form union payloads in covered HTTP and gRPC payload-builder paths without generation failures or unusable clients.
 - [x] `Error(...)` declarations with constructor-form unions fail with a precise, intentional DSL validation error in covered cases.
 - [x] gRPC error conversion no longer needs to handle constructor-form union error types because union-typed errors are rejected before transport/codegen.
+- [x] gRPC `.proto` generation pre-seeds used tags and names from all sibling fields, including those inside other unions, preventing collisions between union branches and regular fields.
 
 ## Open Items Under Active Audit
 
@@ -115,10 +131,18 @@ Do not call the feature done until each item is:
 - Multipart and broader streaming/security-analysis behavior for constructor unions beyond the covered WebSocket and method-validation paths.
 - Broader gRPC coverage beyond the covered unary and bidirectional-streaming smoke paths.
 - Anonymous-union deduping and helper/type collisions across repeated use sites beyond the covered same-service repeated-use and collection-transform paths.
+- Whether silent omission is the right upstream contract for ambiguous union examples, or whether the generator should preserve the raw example or raise a design-time error instead.
+- Whether rejecting defaults on all unions is an intentional upstream contract change or constructor-union-specific behavior that widened unintentionally.
+- Duplication of constructor-union naming/stability logic across DSL, expr finalization, and transport codegen, which increases drift risk.
 
 ## Priority Tests To Add
 
 - [x] A union with two object branches that both match `{}` or another sparse example, asserting OpenAPI generation omits the ambiguous example instead of emitting the first branch.
+- [x] A gRPC fixture where a constructor-union branch uses the same explicit `rpc:tag` as a sibling message field, asserting validation fails before `.proto` generation.
+- [x] A gRPC fixture where two constructor-union branches use the same explicit `rpc:tag`, asserting validation fails before `.proto` generation.
+- [x] A constructor union whose branch names stay distinct as discriminator values but collide after Go identifier normalization, asserting generated kind constants and helpers remain collision-free.
+- [x] A constructor union whose normalized field names are `Foo`, `Foo!`, and `Foo2`, asserting service and HTTP union helpers reserve pre-existing normalized names before suffixing and never emit duplicate identifiers.
+- [x] A constructor union whose branch names collide after protobuf field-name normalization, asserting `.proto` generation fails precisely or emits collision-safe names.
 - [x] A nested payload where:
   - outer is generated,
   - `outer.choice` has a user example,
@@ -131,6 +155,7 @@ Do not call the feature done until each item is:
 - [x] A DSL/codegen test asserting constructor unions in HTTP params, headers, and cookies fail precisely rather than panicking or generating broken code.
 - [x] Validation generation coverage for constructor unions with branch-specific required fields and validations, asserting only the active branch is validated.
 - [x] Default-value generation coverage for constructor unions, asserting generated Go is valid or the error is explicit.
+- [x] A declaration-form union attribute with a default value, asserting constructor-union default rejection does not widen into a backwards-incompatible declaration-form regression unless explicitly intended.
 - [x] Multipart and broader streaming coverage for constructor-form unions, asserting intentional support or precise rejection.
 - [x] Security-analysis coverage where an auth token is reachable only inside a constructor-union branch, asserting a precise failure mode.
 - [x] Repeated identical anonymous constructor unions across multiple methods, asserting deduping/naming behavior is intentional and collision-free.

codegen/go_transform.go

@@ -453,10 +453,28 @@ func transformUnion(source, target *expr.AttributeExpr, sourceVar, targetVar str
 		return "", fmt.Errorf("cannot transform union: number of union types differ (%s has %d, %s has %d)",
 			source.Type.Name(), len(srcUnion.Values), target.Type.Name(), len(tgtUnion.Values))
 	}
-	for i, st := range srcUnion.Values {
-		if err := IsCompatible(st.Attribute.Type, tgtUnion.Values[i].Attribute.Type, sourceVar, targetVar); err != nil {
-			return "", fmt.Errorf("cannot transform union %s to %s: type at index %d: %w",
-				source.Type.Name(), target.Type.Name(), i, err)
+
+	srcNames := UniqueUnionFieldNames(srcUnion.Values)
+	tgtNames := UniqueUnionFieldNames(tgtUnion.Values)
+
+	type tgtBranch struct {
+		tt   *expr.NamedAttributeExpr
+		name string
+	}
+	tgtMap := make(map[string]tgtBranch, len(tgtUnion.Values))
+	for j, tt := range tgtUnion.Values {
+		tgtMap[tt.Name] = tgtBranch{tt: tt, name: tgtNames[j]}
+	}
+
+	for _, st := range srcUnion.Values {
+		tb, ok := tgtMap[st.Name]
+		if !ok {
+			return "", fmt.Errorf("cannot transform union %s to %s: missing target branch %q",
+				source.Type.Name(), target.Type.Name(), st.Name)
+		}
+		if err := IsCompatible(st.Attribute.Type, tb.tt.Attribute.Type, sourceVar, targetVar); err != nil {
+			return "", fmt.Errorf("cannot transform union %s to %s: branch %q is incompatible: %w",
+				source.Type.Name(), target.Type.Name(), st.Name, err)
 		}
 	}
 
@@ -476,10 +494,8 @@ func transformUnion(source, target *expr.AttributeExpr, sourceVar, targetVar str
 		if st == nil || st.Attribute == nil {
 			continue
 		}
-		if i >= len(tgtUnion.Values) {
-			break
-		}
-		tt := tgtUnion.Values[i]
+		tb := tgtMap[st.Name]
+		tt := tb.tt
 		if tt == nil || tt.Attribute == nil {
 			continue
 		}
@@ -498,8 +514,8 @@ func transformUnion(source, target *expr.AttributeExpr, sourceVar, targetVar str
 		}
 		cases = append(cases, map[string]any{
 			"CaseName":        expr.UnionVariantTag(st),
-			"SourceFieldName": Goify(st.Name, true),
-			"TargetFieldName": Goify(tt.Name, true),
+			"SourceFieldName": srcNames[i],
+			"TargetFieldName": tb.name,
 			"SourceAttr":      st.Attribute,
 			"TargetAttr":      tt.Attribute,
 			"TargetCastType":  ta.TargetCtx.Scope.Ref(tt.Attribute, castPkg),

codegen/go_transform_union_test.go

@@ -61,7 +61,7 @@ func TestGoTransformUnionError(t *testing.T) {
 		Error  string
 	}{
 		{"UnionString to UnionStringInt", unionString, unionStringInt, "cannot transform union: number of union types differ (UnionString has 1, UnionStringInt has 2)"},
-		{"UnionString to UnionSomeType", unionString, unionSomeType, "cannot transform union UnionString to UnionSomeType: type at index 0: source is a string but target type is object"},
+		{"UnionString to UnionSomeType", unionString, unionSomeType, "cannot transform union UnionString to UnionSomeType: missing target branch \"String\""},
 	}
 	for _, c := range tc {
 		t.Run(c.Name, func(t *testing.T) {

codegen/service/service_data.go

@@ -1099,7 +1099,7 @@ func buildUnionTypeData(u *expr.Union, scope *codegen.NameScope, loc *codegen.Lo
 	name := scope.GoTypeName(att)
 	kindName := scope.Unique(name + "Kind")
 	unionPkg := loc.PackageName()
-	fieldNames := uniqueUnionFieldNames(u.Values)
+	fieldNames := codegen.UniqueUnionFieldNames(u.Values)
 
 	fields := make([]*UnionFieldData, len(u.Values))
 	for i, nat := range u.Values {
@@ -1179,7 +1179,7 @@ func buildViewUnionTypeData(u *expr.Union, scope *codegen.NameScope, loc *codege
 	att := &expr.AttributeExpr{Type: u}
 	name := scope.GoTypeName(att)
 	kindName := scope.Unique(name + "Kind")
-	fieldNames := uniqueUnionFieldNames(u.Values)
+	fieldNames := codegen.UniqueUnionFieldNames(u.Values)
 
 	fields := make([]*UnionFieldData, len(u.Values))
 	for i, nat := range u.Values {
@@ -1210,21 +1210,6 @@ func buildViewUnionTypeData(u *expr.Union, scope *codegen.NameScope, loc *codege
 	}
 }
 
-func uniqueUnionFieldNames(values []*expr.NamedAttributeExpr) []string {
-	bases := make([]string, len(values))
-	stableKeys := make([]string, len(values))
-	for i, nat := range values {
-		bases[i] = codegen.Goify(nat.Name, true)
-		stableKeys[i] = unionFieldStableKey(nat)
-	}
-	return expr.UniqueStableNames(bases, stableKeys, func(base string, ordinal int) string {
-		return fmt.Sprintf("%s%d", base, ordinal)
-	})
-}
-
-func unionFieldStableKey(nat *expr.NamedAttributeExpr) string {
-	return nat.Name + ":" + nat.Attribute.Type.Hash()
-}
 
 // sortedNamedAttributes returns object fields sorted by attribute name.
 // Union naming uses NameScope uniqueness, so callers that discover unions while

codegen/service/service_data_union_order_test.go

@@ -109,7 +109,7 @@ func TestBuildViewUnionTypeDataKindConstsUseUniqueFieldNames(t *testing.T) {
 }
 
 func TestUniqueUnionFieldNamesReservePreexistingNormalizedNames(t *testing.T) {
-	names := uniqueUnionFieldNames([]*expr.NamedAttributeExpr{
+	names := codegen.UniqueUnionFieldNames([]*expr.NamedAttributeExpr{
 		{Name: "Foo", Attribute: &expr.AttributeExpr{Type: expr.String}},
 		{Name: "Foo!", Attribute: &expr.AttributeExpr{Type: expr.String}},
 		{Name: "Foo2", Attribute: &expr.AttributeExpr{Type: expr.String}},

codegen/types.go

@@ -127,3 +127,19 @@ func AttributeTagsWithName(parent *expr.AttributeExpr, fieldName string, att *ex
 	}
 	return " `" + strings.Join(elems, " ") + "`"
 }
+
+// UniqueUnionFieldNames computes deterministic, de-duplicated Go struct field names
+// for union branches. When a union contains distinct types that normalize to the same
+// Go identifier (e.g. "foo_bar" and "foo-bar" both becoming "FooBar"), this function
+// appends integer suffixes to subsequent branches to ensure generated Go code compiles.
+func UniqueUnionFieldNames(values []*expr.NamedAttributeExpr) []string {
+	bases := make([]string, len(values))
+	stableKeys := make([]string, len(values))
+	for i, nat := range values {
+		bases[i] = Goify(nat.Name, true)
+		stableKeys[i] = nat.Name + ":" + nat.Attribute.Type.Hash()
+	}
+	return expr.UniqueStableNames(bases, stableKeys, nil, func(base string, ordinal int) string {
+		return fmt.Sprintf("%s%d", base, ordinal)
+	})
+}

codegen/validation.go

@@ -189,7 +189,8 @@ func recurseValidationCode(att *expr.AttributeExpr, put expr.UserType, attCtx *A
 		u := expr.AsUnion(att.Type)
 		if _, ok := attCtx.Scope.(*AttributeScope); ok {
 			cases := make([]map[string]any, 0, len(u.Values))
-			for _, v := range u.Values {
+			uniqueNames := UniqueUnionFieldNames(u.Values)
+			for i, v := range u.Values {
 				// Sum-type unions (struct-based, with Kind/AsX accessors) store each
 				// branch as either a value (primitives, arrays, maps) or a pointer
 				// (object user types). The union validation template binds the branch
@@ -202,11 +203,11 @@ func recurseValidationCode(att *expr.AttributeExpr, put expr.UserType, attCtx *A
 					continue
 				}
 				cases = append(cases, map[string]any{
-					"typeTag":      expr.UnionVariantTag(v),
-					"fieldName":    Goify(v.Name, true),
+					"typeTag":       expr.UnionVariantTag(v),
+					"fieldName":     uniqueNames[i],
 					"requiresValue": strings.HasPrefix(strings.TrimSpace(val), "if actual != nil {"),
-					"context":      context + ".value",
-					"validation":   val,
+					"context":       context + ".value",
+					"validation":    val,
 				})
 			}
 			if len(cases) > 0 {

dsl/attribute.go

@@ -231,22 +231,12 @@ func Field(tag any, name string, args ...any) {
 //	    })
 //	})
 func OneOf(arg any, args ...any) expr.DataType {
-	if looksLikeOneOfAttributeDeclarationSignature(arg, args...) && !isOneOfDeclarationContext() {
-		eval.IncompatibleDSL()
-		return invalidOneOfType()
-	}
-	if isOneOfAttributeDeclaration(arg, args...) {
-		oneOfAttribute(arg.(string), args...)
-		return nil
-	}
 	if name, ok := arg.(string); ok {
-		if isMalformedOneOfAttributeDeclaration(arg, args...) {
-			oneOfAttribute(name, args...)
-			return nil
-		}
-		if len(args) > 2 && !areOneOfTypeConstructorArgs(append([]any{arg}, args...)...) {
-			eval.TooManyArgError()
-			return nil
+		if len(args) > 0 {
+			if _, ok := args[len(args)-1].(func()); ok {
+				oneOfAttribute(name, args...)
+				return nil
+			}
 		}
 	}
 	return oneOfType(arg, args...)
@@ -356,63 +346,6 @@ func Example(args ...any) {
 	a.UserExamples = append(a.UserExamples, ex)
 }
 
-func isOneOfAttributeDeclaration(arg any, args ...any) bool {
-	if !looksLikeOneOfAttributeDeclarationSignature(arg, args...) {
-		return false
-	}
-	switch eval.Current().(type) {
-	case *expr.AttributeExpr, expr.CompositeExpr:
-		return true
-	default:
-		return false
-	}
-}
-
-func looksLikeOneOfAttributeDeclarationSignature(arg any, args ...any) bool {
-	name, ok := arg.(string)
-	if !ok || name == "" {
-		return false
-	}
-	if len(args) == 0 || len(args) > 2 {
-		return false
-	}
-	if _, ok := args[len(args)-1].(func()); !ok {
-		return false
-	}
-	return true
-}
-
-func isMalformedOneOfAttributeDeclaration(arg any, args ...any) bool {
-	if !isOneOfDeclarationContext() || len(args) == 0 {
-		return false
-	}
-	if _, ok := args[len(args)-1].(func()); ok {
-		return true
-	}
-	return !areOneOfTypeConstructorArgs(append([]any{arg}, args...)...)
-}
-
-func isOneOfDeclarationContext() bool {
-	switch eval.Current().(type) {
-	case *expr.AttributeExpr, expr.CompositeExpr:
-		return true
-	default:
-		return false
-	}
-}
-
-func areOneOfTypeConstructorArgs(args ...any) bool {
-	for _, arg := range args {
-		switch arg.(type) {
-		case expr.DataType, string:
-			continue
-		default:
-			return false
-		}
-	}
-	return len(args) >= 2
-}
-
 func oneOfAttribute(name string, args ...any) {
 	if len(args) == 0 {
 		eval.TooFewArgError()