Highlights

Runtime-configured CORS

• RuntimeCORS() lets HTTP and JSON-RPC designs declare that browser-origin policy comes from deployment configuration rather than generated literals.
• loomhttp.NewRuntimeCORSPolicy validates exact and regular-expression origins, credentials, methods, headers, exposed headers, and max age, then snapshots the policy into an immutable value supplied to generated server constructors.
• Generated actual-request and preflight handling now applies that runtime policy consistently across ordinary HTTP, HTTP SSE, JSON-RPC POST, and mixed HTTP/SSE servers.
• OpenAPI publishes x-loom-cors: {runtime: true} without leaking deployment-specific origins.

Leaner mixed JSON-RPC SSE servers

• Mixed HTTP/SSE JSON-RPC services now emit only the active unified ServeHTTP negotiation path and endpoint stream implementation.
• The unreachable SSE-only handleSSE path and service-level sse.go artifact are no longer generated for mixed services.
• Eager GET stream opening is emitted only for the real events/stream listener, removing impossible branches from other SSE methods.

Safer and more observable SSE delivery

• Generated HTTP SSE responses default X-Accel-Buffering to no so reverse proxies do not buffer incremental events. Caller-supplied header values remain authoritative.
• JSON-RPC SendAndClose on ID-less streams keeps its protocol-correct response suppression, but now emits the low-cardinality stream_final_response_suppressed transport event so discarded final values are observable.
• Generated GoDoc and DSL guidance now make the ID-scoped final-response contract explicit: raw GET events/stream implementations must use Send for every value that should reach the client.

Upgrade notes

• Regenerate HTTP and JSON-RPC transports with loom gen to receive the SSE header, observability, and mixed-server cleanup changes.
• Mixed JSON-RPC regeneration intentionally deletes the obsolete generated server/sse.go; do not retain that file manually.
• Designs that opt into RuntimeCORS() gain a loomhttp.RuntimeCORSPolicy parameter on the generated server constructor. Load deployment configuration in application startup, call loomhttp.NewRuntimeCORSPolicy, handle its validation error, and pass the resulting value to the constructor.
• Existing static CORS designs and designs without CORS retain their existing constructor signatures and behavior.
• WebSocket origin authorization remains separate from CORS; continue configuring the upgrader's CheckOrigin policy explicitly.

Verification

• Release preflight: lint, test-release, integration-test, openapi-contract, and generated-code-quality.
• Focused generated-module compile tests cover runtime CORS for HTTP, SSE, JSON-RPC, and mixed transports.
• Checked-in HTTP and JSON-RPC SSE fixtures were regenerated and exercised by the transport integration suites.

Full changelog: v1.4.1...v1.5.0