Release v22.25.0

Added

• A model-bound command can declare [BlockOnValidationSeverity(ValidationResultSeverity.Warning)], or Information, so that warning- or information-level validation failures reject it. The declared severity is the lowest severity that blocks. It applies to HTTP execution, validation, Provide() and in-process ICommandPipeline execution, and derived command records inherit it. (#2760)
• Generated TypeScript proxies carry the declared severity and apply the same threshold on the client. The server stays authoritative. An out-of-range declared severity fails proxy generation.

Changed

• For a command that declares a blocking severity, the caller's X-Allowed-Severity (or allowedSeverity) can make validation stricter, never looser. A failure with Unknown severity also rejects such a command. Commands without the attribute behave as before. This deliberately differs from the caller opt-out for controller actions in #21; decision 0005 records why.