v0.1.6 — Security & correctness hardening

First tagged release of the open-source Lexware Office MCP server — a self-hostable Model Context Protocol server exposing the Lexware Office (lexoffice) API to AI agents, with read / drafts / finalize capability tiers and OAuth or static-token auth.

This release folds in a review-driven security & correctness hardening pass (0.1.4 → 0.1.6), verified live against a real Lexware account and running in production. See CHANGELOG.md for the full per-version breakdown.

Highlights

Correctness

• create-draft-* rejects a stale finalize=true loudly instead of silently returning a draft; issuing lives only in the dedicated create-finalized-* tools.
• Error-body read failures are classified as LexwareApiError (a 404 stays a 404).
• update-voucher one-off contactName handling; get-document dispatches recurringtemplate; base64 uploads validated (no silent corruption); idempotent deletes; empty-list pagination text.
• Removed the read-only, silently-ignored archived param from the contact tools.

Security

• The 12 MB upload body limit is parsed on /mcp after auth, so unauthenticated requests can't force a multi-MB parse.
• Webhook event-subscription create + delete moved to the finalize tier (off by default); create-event-subscription requires an https:// callback.
• OAuth-domain denial returns 403 (not a 401 re-auth loop); static 401s carry a WWW-Authenticate challenge; OAuth endpoints overridable for non-WorkOS IdPs.
• Patched a transitive hono high-severity advisory (→ 4.12.27).

Robustness

• additionalFields escape hatch on every create tool (reserved control keys stripped) so valid unmodeled fields (e.g. xRechnung) aren't dropped; shared helpers; the tools layer no longer imports Skybridge at runtime.

Typecheck clean; 134 tests passing.