Release v22.148.0

Added

• [AllowCallerValidationSeverity] lets a command explicitly permit callers to relax validation severities above the host default.
• A new Command property on ArcOptions (CommandOptions, bound from Cratis:Arc:Command) configures the default maximum caller severity and lets hosts ignore the header globally, including on opted-in commands.
• Commands can declare [assembly: BlockOnValidationSeverity(...)] as a fallback blocking policy. Command and inherited declarations take precedence, and generated TypeScript proxies carry the resolved policy.

Changed

• Model-bound command HTTP endpoints now cap caller-allowed validation severity at Warning by default. If your application intentionally allows callers to relax errors, opt in with [AllowCallerValidationSeverity(ValidationResultSeverity.Error)] or set Cratis:Arc:Command:MaximumCallerAllowedSeverity to Error. Set IgnoreCallerAllowedSeverity to ignore the header even on opted-in commands. See validation severity filtering.

Fixed

• Controller command and query results and observable query errors now honor ExposeExceptionDetails, returning a generic error when detail is disabled while keeping full detail in server logs.
• HttpListener-hosted endpoints now reject non-empty non-JSON request bodies when reading JSON, matching ASP.NET Core behavior for payloads. Send application/json or an application/*+json content type.