bump version 3.21.0

fix(cli): --validate must not crash on a missing required env var

Also for the 3.20.0 release:
- docs: update README.md (Dart client, React Query hooks, MCP tool
  schemas/llms.txt, HTTP QUERY, OpenAPI 3.0/3.1, test count 2,484)
- docs: update .claude/skills/npgsqlrest (SKILL.md, annotations-reference.md,
  regenerated configuration-reference.jsonc)
- docs: add QUERY to the http/proxy/proxy_out --annotations syntax strings
- test: fix WireMock port collision (SqlFileHttpClientTypeFixture 50954 -> 50956)
  that intermittently failed the parallel Proxy fixtures

bump 3.19.0 and update skill files

bump version 3.18.2

feat(proxy): forward all automatic parameters to proxy upstream consi…

…stently (v3.18.1)

When an endpoint is a proxy, all server-filled parameters now forward to
the upstream through one unified path: user claims, IP address, HTTP
Custom Type fields, and resolved-parameter expressions.

Placement mirrors the endpoint's own signature, NOT the HTTP verb:
- a @body_parameter_name param carries the raw request body;
- otherwise RequestParamType decides — QueryString appends to the proxy
  query string, BodyJson merges into the proxy JSON body (typed:
  numbers / booleans / embedded json / strings) when the method carries
  a body.

Additive: the verbatim incoming request is still forwarded; the
automatic params are added on top so the upstream receives the same
parameter set the routine would.

The previous claim/IP-only query append in BuildTargetUrl is removed and
folded into the unified mechanism. Behavior change: claims/IP now follow
RequestParamType (unchanged for GET/QueryString — still query; for
BodyJson endpoints they now go to the body).

Notes: body merge only for JSON content types (multipart/non-JSON
forwarded verbatim); only expanded per-field HTTP-type params forwarded.

Tests cover GET-query, POST-body (typed), param_type-query on POST, and
resolved-param forwarding; existing claim/IP proxy tests pass unchanged.
Full suite green (2288). See changelog/v3.18.1.md.

upgrade references

feat(mcp): add a JSON body to 401/403 tool-authorization challenges

The MCP server signalled an unauthorized/forbidden tools/call with the
spec-required 401/403 + WWW-Authenticate challenge but an empty body. That is
valid (the challenge lives in the header), but clients that surface the
response body — MCP Inspector, curl — showed only a blank/truncated transport
error with no hint of what failed.

WriteUnauthorized/WriteForbidden now also write a small RFC 6750-shaped JSON
body (error + error_description) via a shared WriteChallengeBodyAsync. Status
code and the WWW-Authenticate header are unchanged, so OAuth clients behave
identically; only the human/diagnostic detail improves.

  401 -> {"error":"invalid_token","error_description":"This tool requires authentication. …"}
  403 -> {"error":"insufficient_scope","error_description":"This tool requires a role …"}

Extended the existing 401 gate and 403 role tests to assert the content type
and exact body. Full suite green (2262); AOT publish clean.

bump 3.16.3

bump 3.16.2

feat: v3.16.1 — cache stampede protection for cached routine responses

Make stampede protection actually fire for cached endpoints. The previous
IRoutineCache probe model (Get/AddOrUpdate) could not carry SQL execution as
the cache factory, so a burst of identical cold-cache requests executed the
query N times and could exhaust the Postgres connection pool.

- IRoutineCache.GetOrCreateAsync added as an additive default interface
  method, so existing custom backends keep working unchanged.
- Memory and Redis backends coalesce concurrent factory invocations via an
  in-flight Lazy<Task>; HybridCache delegates to its built-in GetOrCreateAsync.
- Scalar and passthrough proxy paths route through the factory, with the
  connection opened inside it so coalesced waiters never touch the DB.
- Records/sets streaming path uses a per-key execution gate, since it streams
  rows and disables caching above MaxCacheableRows; the gate serializes the
  over-limit case instead of coalescing.
- Tests assert execution counts on the memory backend (50->1, warm->+0,
  distinct keys, set within/over limit) against a live Postgres.

See changelog/v3.16.1.md for honest test-coverage notes and known limitations.