feat(v0.4.0): attribute types (Lookup/MultiSelect/AutoNumber/Image) + schema consistency + HTTP transport polish + audit corrections (P0-P3)

Sprints 2/3/4:
- New attribute types: Lookup (via RelationshipDefinitions), MultiSelectPicklist, AutoNumber, Image
- Fixed MultiSelect OptionSetType (MultiSelect, not Picklist)
- createRelationship reads OData-EntityId response header (204 No Content)
- buildLookupRelationshipBody: correct SchemaName formula, 100-char guard, CascadeConfiguration, AssociatedMenuConfiguration
- lbl() now emits @odata.type on each LocalizedLabel
- HTTP server: HMAC-SHA256 timing-safe token verify, WWW-Authenticate header, configurable CORS origin, GET/DELETE session guard
- Schema: confirm const:true on destructive tools, EntitySetName cache in detect_duplicates, hasSysAdmin preflight handler
- Split attribute.tools.ts => attribute.definitions.ts + attribute.tools.ts (both <400 lines)
- config.example.json -> config.example.jsonc; docs updated with BEARER_TOKEN + MCP_HTTP_CORS_ORIGIN

Author: Dev Agent Amelia

README.md

@@ -6,8 +6,6 @@
 
 **The most complete MCP server for Microsoft Dataverse.**
 
-Give your AI agents real-time access to Dataverse — query records with OData & FetchXML, manage metadata, inspect solutions, run batch operations, audit changes, and more. Zero-config auth via Microsoft device code flow.
-
 63 tools · 4 resources · 10 guided workflows · Zero config auth
 
 [![npm](https://img.shields.io/npm/v/mcp-dataverse)](https://www.npmjs.com/package/mcp-dataverse)
@@ -80,6 +78,31 @@ Re-authenticate after ~90 days of inactivity: `npx mcp-dataverse-auth`
 
 ---
 
+## HTTP Transport
+
+Run as an HTTP server for multi-client use:
+
+```bash
+MCP_TRANSPORT=http MCP_HTTP_PORT=3000 MCP_HTTP_SECRET=mysecret node dist/server.js
+```
+
+Connect using VS Code / Copilot with:
+```json
+{
+  "servers": {
+    "dataverse": {
+      "type": "http",
+      "url": "http://localhost:3000/mcp",
+      "headers": {
+        "Authorization": "Bearer mysecret"
+      }
+    }
+  }
+}
+```
+
+---
+
 ## Troubleshooting
 
 | Symptom                            | Fix                                                                |

config.example.json

@@ -0,0 +1,20 @@
+{
+  "environmentUrl": "https://yourorg.crm.dynamics.com",
+  "requestTimeoutMs": 30000,
+  "maxRetries": 3
+}
+
+// HTTP transport mode (optional — uncomment to use)
+// {
+//   "environmentUrl": "https://yourorg.crm.dynamics.com",
+//   "requestTimeoutMs": 30000,
+//   "maxRetries": 3,
+//   "transport": "http",
+//   "httpPort": 3000
+// }
+//
+// Matching environment variables:
+//   MCP_TRANSPORT=http
+//   MCP_HTTP_PORT=3000
+//   MCP_HTTP_SECRET=your-bearer-token   (optional: enables Authorization header check)
+//   MCP_HTTP_JSON_RESPONSE=true         (default: true; set to false for SSE streaming)

config.example.jsonc

@@ -0,0 +1 @@
+import{b as a}from"./chunk-75JPRQKI.js";export{a as DataverseAdvancedClient};

dist/chunk-Z4HSLXJQ.js dist/chunk-75JPRQKI.jsdist/chunk-Z4HSLXJQ.js renamed to dist/chunk-75JPRQKI.js

@@ -125,6 +125,54 @@ npx mcp-dataverse --transport http --port 3001
 
 The MCP endpoint is available at `http://localhost:3001/mcp`.
 
+## HTTP Transport
+
+The server can run in HTTP mode instead of stdio, which enables multi-client connections and browser-based access.
+
+### Starting the HTTP server
+
+Set the `MCP_TRANSPORT` environment variable to `http`:
+
+```bash
+MCP_TRANSPORT=http MCP_HTTP_PORT=3000 node dist/server.js
+```
+
+Or in `config.json`:
+```json
+{
+  "transport": "http",
+  "httpPort": 3000
+}
+```
+
+### Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `MCP_HTTP_PORT` | `3000` | Port to listen on |
+| `MCP_HTTP_JSON_RESPONSE` | `true` | Enable JSON response mode (vs SSE streaming) |
+| `MCP_HTTP_SECRET` | *(none)* | Bearer token for authentication. If set, all `/mcp` requests must include `Authorization: Bearer <token>` |
+| `BEARER_TOKEN` | *(none)* | Deprecated alias for `MCP_HTTP_SECRET`. Use `MCP_HTTP_SECRET` in new setups. |
+| `MCP_HTTP_CORS_ORIGIN` | `*` | Allowed CORS origin. Set to your app origin (e.g. `http://localhost:5173`) when auth is enabled to restrict browser access. |
+
+### Authentication
+
+When `MCP_HTTP_SECRET` is set, every request to `/mcp` must include:
+```
+Authorization: Bearer your-secret-token
+```
+
+### Health check
+
+```
+GET /health
+```
+Returns `{"status":"ok","version":"...","tools":<count>}`. No authentication required.
+
+### Multi-client support
+
+Each client gets a dedicated MCP session identified by `mcp-session-id`. Sessions are automatically cleaned up on disconnect.
+
 ## Diagnostics
 
 Run the built-in health check to verify your configuration and connectivity: