@zincapp/mcp-server 1.5.0 → 1.8.0

package/dist/madrid-nima.d.ts

@@ -0,0 +1,89 @@
+export interface NimaCenterRef {
+    nima: number;
+    idCentro: number;
+    tipoCentro: string;
+    direccion: string;
+}
+/**
+ * Parse the ConsultaNimaAccion.icm search response into center refs.
+ *
+ * Each result row in the CM search table follows this fixed document order
+ * (verified against test/fixtures/cm-search-consenur.html):
+ *   1. NIMA cell: a `<script>` literal `var nima='2800006779';` followed by a
+ *      UI-only filter `nima.substring(2,5) != '913'` that gates a `document.write`
+ *      call — we read the JS literal directly and ignore that filter entirely.
+ *   2. Province/municipality cell (`<p>…</p>`) — not needed here.
+ *   3. Address cell (`<p>…</p>`) — captured as `direccion`.
+ *   4. A "Consultar" button `onclick="consultar('form',<idCentro>,'<tipoCentro>')"`.
+ *
+ * NIMA and idCentro are different identifiers for the same center (e.g. nima
+ * 2800082834 has idCentro 82834; nima 2800006779 has idCentro 90181) — they are
+ * NOT derivable from one another, so each row's nima/address must be aligned
+ * with that same row's idCentro/tipoCentro by document order, not by value.
+ *
+ * We match one row at a time with a single regex spanning nima → address →
+ * consultar(), rather than two separate passes, since the fixture shows rows
+ * never interleave (each row's four fields appear back-to-back before the next
+ * row's nima literal starts).
+ */
+export declare function parseCenterList(html: string): {
+    razonSocial: string | null;
+    centros: NimaCenterRef[];
+};
+export interface NimaAuthorization {
+    authId: string;
+    autorizacion: string;
+    estado: boolean;
+}
+/**
+ * Parse the FichaNimaAccion.icm detail into the razón social, the center NIMA, and its
+ * authorizations (verified against test/fixtures/cm-ficha-consenur-90181.html).
+ *
+ * Razón Social and NIMA come from the "Sede"/"Centro" fieldsets:
+ *   - `<b>Razón Social:</b> CONSENUR SANITARIOS, S.L.</td>` — plain text between the label and the cell close.
+ *   - `var nima = '2800006779';` — a JS literal inside the NIMA cell (the surrounding
+ *     `document.write(nima)` is a UI-only rendering detail we ignore, same as parseCenterList).
+ *
+ * The "Autorizaciones" table rows are `Tipo | Nº | Estado | …4 date cells… | Consultar button`,
+ * one row per authorization type held by the center. The real markup has malformed nested
+ * `<tr>`s (`<tr>\n<tr bgcolor="...">`) which we don't need to care about since we match on
+ * `<td>`/`<p>` boundaries rather than row boundaries. We map:
+ *   authId = code before ' - ' in the Tipo cell, uppercased ('G01 - Centro Gestor…' -> 'G01')
+ *   autorizacion = the Nº Autorización cell's text
+ *   estado = true iff the Estado cell's text is exactly 'Autorizado/Registrado' (else e.g. 'Baja' -> false)
+ * We scope the match to the text after the "Autorizaciones" heading so unrelated <p>s
+ * elsewhere in the page can't be mistaken for a row.
+ */
+export declare function parseAuthorizations(html: string): {
+    razonSocial: string | null;
+    nima: number | null;
+    autorizaciones: NimaAuthorization[];
+};
+export interface NimaCenter {
+    nima: number;
+    direccion: string;
+    autorizaciones: NimaAuthorization[];
+}
+export interface NimaEntity {
+    cif: string;
+    nombre: string | null;
+    centros: NimaCenter[];
+}
+export interface NimaLookupResult {
+    entidad: NimaEntity;
+}
+/**
+ * Orchestrate a NIMA registry lookup: search the CM by NIF (paginating through the result
+ * pages), then fetch the ficha for each target center and assemble the nested
+ * `Entidad -> centros -> autorizaciones` graph.
+ *
+ * When `args.nima` is given, we page only until that NIMA is found among the search results
+ * (or we run out of pages), then fetch just that one center's ficha. Without `args.nima`, every
+ * center found across all pages is fetched.
+ *
+ * `fetchImpl` is injectable so tests never hit the network; it defaults to the global `fetch`.
+ */
+export declare function lookupNimaAuthorizations(args: {
+    nif: string;
+    nima?: number;
+}, fetchImpl?: typeof fetch): Promise<NimaLookupResult>;

package/dist/madrid-nima.js

@@ -0,0 +1,185 @@
+/**
+ * Parse the ConsultaNimaAccion.icm search response into center refs.
+ *
+ * Each result row in the CM search table follows this fixed document order
+ * (verified against test/fixtures/cm-search-consenur.html):
+ *   1. NIMA cell: a `<script>` literal `var nima='2800006779';` followed by a
+ *      UI-only filter `nima.substring(2,5) != '913'` that gates a `document.write`
+ *      call — we read the JS literal directly and ignore that filter entirely.
+ *   2. Province/municipality cell (`<p>…</p>`) — not needed here.
+ *   3. Address cell (`<p>…</p>`) — captured as `direccion`.
+ *   4. A "Consultar" button `onclick="consultar('form',<idCentro>,'<tipoCentro>')"`.
+ *
+ * NIMA and idCentro are different identifiers for the same center (e.g. nima
+ * 2800082834 has idCentro 82834; nima 2800006779 has idCentro 90181) — they are
+ * NOT derivable from one another, so each row's nima/address must be aligned
+ * with that same row's idCentro/tipoCentro by document order, not by value.
+ *
+ * We match one row at a time with a single regex spanning nima → address →
+ * consultar(), rather than two separate passes, since the fixture shows rows
+ * never interleave (each row's four fields appear back-to-back before the next
+ * row's nima literal starts).
+ */
+export function parseCenterList(html) {
+    const centros = [];
+    const rowRe = /var nima\s*=\s*'(\d+)'[\s\S]*?<\/script>[\s\S]*?<p>([^<]*)<\/p>\s*<\/td>\s*<td[^>]*>\s*<p>([^<]*)<\/p>[\s\S]*?consultar\('form',\s*(\d+)\s*,\s*'([^']+)'\)/g;
+    let m;
+    while ((m = rowRe.exec(html)) !== null) {
+        const nima = Number(m[1]);
+        // m[2] is the province/municipality cell (unused); m[3] is the address cell.
+        const direccion = m[3].trim();
+        const idCentro = Number(m[4]);
+        const tipoCentro = m[5].trim();
+        centros.push({ nima, idCentro, tipoCentro, direccion });
+    }
+    return { razonSocial: null, centros };
+}
+/** Collapse an HTML fragment to plain text (strip tags, decode &nbsp;, squash whitespace). */
+function pText(s) {
+    return s.replace(/<[^>]+>/g, ' ').replace(/&nbsp;/g, ' ').replace(/\s+/g, ' ').trim();
+}
+/**
+ * Parse the FichaNimaAccion.icm detail into the razón social, the center NIMA, and its
+ * authorizations (verified against test/fixtures/cm-ficha-consenur-90181.html).
+ *
+ * Razón Social and NIMA come from the "Sede"/"Centro" fieldsets:
+ *   - `<b>Razón Social:</b> CONSENUR SANITARIOS, S.L.</td>` — plain text between the label and the cell close.
+ *   - `var nima = '2800006779';` — a JS literal inside the NIMA cell (the surrounding
+ *     `document.write(nima)` is a UI-only rendering detail we ignore, same as parseCenterList).
+ *
+ * The "Autorizaciones" table rows are `Tipo | Nº | Estado | …4 date cells… | Consultar button`,
+ * one row per authorization type held by the center. The real markup has malformed nested
+ * `<tr>`s (`<tr>\n<tr bgcolor="...">`) which we don't need to care about since we match on
+ * `<td>`/`<p>` boundaries rather than row boundaries. We map:
+ *   authId = code before ' - ' in the Tipo cell, uppercased ('G01 - Centro Gestor…' -> 'G01')
+ *   autorizacion = the Nº Autorización cell's text
+ *   estado = true iff the Estado cell's text is exactly 'Autorizado/Registrado' (else e.g. 'Baja' -> false)
+ * We scope the match to the text after the "Autorizaciones" heading so unrelated <p>s
+ * elsewhere in the page can't be mistaken for a row.
+ */
+export function parseAuthorizations(html) {
+    const rs = html.match(/Razón Social:<\/b>\s*([^<]+?)\s*<\/td>/);
+    const razonSocial = rs ? rs[1].trim() : null;
+    const nm = html.match(/var nima\s*=\s*'(\d+)'/);
+    const nima = nm ? Number(nm[1]) : null;
+    const fsStart = html.indexOf('Autorizaciones');
+    const scope = fsStart >= 0 ? html.slice(fsStart) : html;
+    const autorizaciones = [];
+    // Tipo cell's "<code> - <desc>" <p>, then the next two <td> cells (Nº, Estado) in document order.
+    const rowRe = /<p>\s*([A-Z]\d{2})\s*-[^<]*<\/p>[\s\S]*?<td[^>]*>\s*([\s\S]*?)<\/td>\s*<td[^>]*>\s*([\s\S]*?)<\/td>/g;
+    let m;
+    while ((m = rowRe.exec(scope)) !== null) {
+        const authId = m[1].toUpperCase();
+        const numero = pText(m[2]);
+        const estadoText = pText(m[3]);
+        if (!numero)
+            continue;
+        autorizaciones.push({
+            authId,
+            autorizacion: numero,
+            estado: estadoText === 'Autorizado/Registrado',
+        });
+    }
+    return { razonSocial, nima, autorizaciones };
+}
+const CM_BASE = 'https://gestiona.comunidad.madrid/pcea_nima_web/html/web';
+function form(fields) {
+    return new URLSearchParams({
+        posicionActual: '0', idCentro: '', tipoCentro: '', nif: '', nima: '', denominacion: '',
+        autorizacion: '', cdProvincia: '', dsProvincia: '', cdMunicipio: '', dsMunicipio: '',
+        ...fields,
+    }).toString();
+}
+/**
+ * The CM serves `Content-Type: text/html; charset=ISO-8859-1` (Latin-1) — the `<meta>` tag
+ * inside the HTML claims UTF-8, but the HTTP header is authoritative and the actual bytes are
+ * Latin-1 (e.g. `Razón` is `52 61 7a f3 6e`, where `0xf3` is `ó` in Latin-1, not UTF-8). Decoding
+ * with `res.text()` (UTF-8) mangles accented characters (`RÍO` -> `R�O`) and breaks the
+ * razonSocial regex entirely (`Razón Social` -> `Raz�n Social`, never matches -> null nombre).
+ * We always decode as Latin-1 regardless of what the response claims.
+ */
+async function cmPost(fetchImpl, action, fields) {
+    const res = await fetchImpl(`${CM_BASE}/${action}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: form(fields),
+    });
+    if (!res.ok)
+        throw new Error(`CM service error ${res.status} on ${action}`);
+    const buf = await res.arrayBuffer();
+    return new TextDecoder('iso-8859-1').decode(buf);
+}
+/**
+ * Orchestrate a NIMA registry lookup: search the CM by NIF (paginating through the result
+ * pages), then fetch the ficha for each target center and assemble the nested
+ * `Entidad -> centros -> autorizaciones` graph.
+ *
+ * When `args.nima` is given, we page only until that NIMA is found among the search results
+ * (or we run out of pages), then fetch just that one center's ficha. Without `args.nima`, every
+ * center found across all pages is fetched.
+ *
+ * `fetchImpl` is injectable so tests never hit the network; it defaults to the global `fetch`.
+ */
+export async function lookupNimaAuthorizations(args, fetchImpl = fetch) {
+    const nif = args.nif.trim().toUpperCase();
+    if (!nif)
+        throw new Error('nif is required');
+    // 1. Search by NIF, paginating through result pages. The CM shows "Número total de
+    //    registros: N" in the response; we page while more rows remain and (if a target NIMA was
+    //    requested) we haven't found it yet. Capped defensively at 10 pages.
+    //
+    //    Pagination mechanism: live testing against the real CM proved `accion_paginacion` (page
+    //    number / 'Siguiente') does NOTHING — it returns page 1's same rows regardless of value.
+    //    The real mechanism is the `posicionActual` OFFSET: posicionActual=0 -> rows 1..10,
+    //    posicionActual=10 -> row 11, etc. So we advance posicionActual by the page size (10)
+    //    each iteration and drop accion_paginacion entirely.
+    const PAGE_SIZE = 10;
+    const centers = [];
+    const seenIdCentro = new Set();
+    let page = 0;
+    for (; page < 10; page++) {
+        const html = await cmPost(fetchImpl, 'ConsultaNimaAccion.icm', { nif, posicionActual: String(page * PAGE_SIZE) });
+        const parsed = parseCenterList(html);
+        // De-dup guard: a bad/repeated offset should never duplicate a center already collected.
+        const beforeCount = centers.length;
+        for (const c of parsed.centros) {
+            if (seenIdCentro.has(c.idCentro))
+                continue;
+            seenIdCentro.add(c.idCentro);
+            centers.push(c);
+        }
+        const total = Number(html.match(/Número total de registros:\s*(\d+)/)?.[1] ?? centers.length);
+        const nimaFound = args.nima ? centers.some(c => c.nima === args.nima) : false;
+        // Finding 2: a page that adds zero new centers means we're no longer making progress
+        // (e.g. the server ignores posicionActual and re-serves the same rows) — stop instead of
+        // burning the remaining page budget on repeats.
+        if (centers.length === beforeCount)
+            break;
+        if (args.nima && nimaFound)
+            break;
+        // Finding 1: a small/wrong `total` must never cut off a search that is still looking for
+        // an unfound target nima — only let `>= total` end the loop when we're gathering ALL
+        // centers (no nima filter) or the requested nima has already been found.
+        if (!args.nima && centers.length >= total)
+            break;
+    }
+    if (centers.length === 0)
+        throw new Error(`Sin centros en el registro NIMA para NIF ${nif}`);
+    const targets = args.nima
+        ? centers.filter(c => c.nima === args.nima)
+        : centers;
+    if (args.nima && targets.length === 0) {
+        throw new Error(`NIMA ${args.nima} no está entre los centros del NIF ${nif}`);
+    }
+    // 2. Fetch each target center's ficha and assemble the nested graph.
+    const out = [];
+    let razonSocial = null;
+    for (const c of targets) {
+        const ficha = await cmPost(fetchImpl, 'FichaNimaAccion.icm', { idCentro: String(c.idCentro), tipoCentro: c.tipoCentro, nif });
+        const parsed = parseAuthorizations(ficha);
+        if (parsed.razonSocial)
+            razonSocial = parsed.razonSocial;
+        out.push({ nima: c.nima, direccion: c.direccion, autorizaciones: parsed.autorizaciones });
+    }
+    return { entidad: { cif: nif, nombre: razonSocial, centros: out } };
+}

package/dist/tools/apply-authorization.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ZincAppClient } from '../client.js';
+export declare function registerApplyAuthorization(server: McpServer, client: ZincAppClient): void;

package/dist/tools/apply-authorization.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { resolveElevation } from './elevation.js';
+// One authorization to upsert on an entity center. authId = static TYPE (T01/T02/G0x from the
+// catalogue); autorizacion = the official registry NUMBER the human supplies (the agent never invents it).
+const AuthSchema = z.object({
+    clientId: z.number().describe('The entity (client) id — from audit_entities / propose_authorizations'),
+    centerId: z.number().describe('The entity center id'),
+    authId: z.string().describe('The static authorization TYPE code, e.g. "T01" (hazardous transport), "G01" (gestor)'),
+    autorizacion: z.string().describe('The official registry NUMBER for this authorization — YOU (the human) provide it; the agent never invents it'),
+});
+export function registerApplyAuthorization(server, client) {
+    server.tool('apply_authorization', 'Write (upsert) entity-center authorizations — the master-data WRITE complement to ' +
+        'propose_authorizations. propose_authorizations tells you WHICH authorization TYPE a ' +
+        'transporter/gestor is missing (e.g. T01); this writes it, WITH the official registry number ' +
+        'THE HUMAN SUPPLIES in each item\'s `autorizacion`. The agent must NEVER invent that number — ' +
+        'it is administrative master data (the company\'s inscription code in the waste registry), not ' +
+        'something in the DIs. Each item: {clientId, centerId, authId (the type), autorizacion (the ' +
+        'number)}. Upsert: updates the number if the authorization already exists, else creates it. ' +
+        'Runs UNDER YOUR ACTIVE OPERATOR ELEVATION (company derived from it, no companyId); writes ' +
+        'through the framework (hooks + audit) as the elevated _sysadmin, recording you in the audit ' +
+        'trail. Only apply numbers you (the human) have verified.', {
+        authorizations: z.array(AuthSchema)
+            .describe('The authorizations to write, each with the registry number you provide'),
+    }, async ({ authorizations }) => {
+        const elev = await resolveElevation(client);
+        if ('content' in elev)
+            return elev;
+        const companyId = elev.companyId;
+        const result = await client.post('/mwm/retirada/apply-authorization', { confirm: true, authorizations });
+        const ok = result.applied;
+        const bad = result.failed.length;
+        const failLines = bad
+            ? '\n\n### Fallidas\n' + result.failed.map(f => `- entidad ${f.clientId}/${f.centerId} · ${f.authId}: ${f.error}`).join('\n')
+            : '';
+        const text = `# Autorizaciones aplicadas · company ${companyId}\n` +
+            `${ok} autorización(es) escrita(s)${bad ? `, ${bad} con error` : ''}, bajo tu elevación de operador.` +
+            failLines +
+            `\n\n_Recuerda des-elevarte desde el portal web con un motivo cuando termines._`;
+        return { content: [{ type: 'text', text }] };
+    });
+}

package/dist/tools/index.js

@@ -12,7 +12,10 @@ import { registerProposeCompletion } from './propose-completion.js';
 import { registerAuditEntities } from './audit-entities.js';
 import { registerApplyCompletion } from './apply-completion.js';
 import { registerProposeAuthorizations } from './propose-authorizations.js';
+import { registerApplyAuthorization } from './apply-authorization.js';
+import { registerLinkGestorAuthorizations } from './link-gestor-authorizations.js';
 import { registerProposeNt } from './propose-nt.js';
+import { registerLookupAuthorization } from './lookup-authorization.js';
 export function registerAllTools(server, client) {
     registerSearchDocs(server, client);
     registerReadDoc(server, client);
@@ -28,5 +31,8 @@ export function registerAllTools(server, client) {
     registerAuditEntities(server, client);
     registerApplyCompletion(server, client);
     registerProposeAuthorizations(server, client);
+    registerApplyAuthorization(server, client);
+    registerLinkGestorAuthorizations(server, client);
     registerProposeNt(server, client);
+    registerLookupAuthorization(server, client);
 }

package/dist/tools/link-gestor-authorizations.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ZincAppClient } from '../client.js';
+export declare function registerLinkGestorAuthorizations(server: McpServer, client: ZincAppClient): void;

package/dist/tools/link-gestor-authorizations.js

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+import { resolveElevation } from './elevation.js';
+export function registerLinkGestorAuthorizations(server, client) {
+    server.tool('link_gestor_authorizations', 'Backfill the missing gestor authorization LINK on a year\'s waste removals — the fix for the ' +
+        'register\'s `autorizacion-gestor` gap. The importer created the gestor EntidadCentroLer rows ' +
+        'with an empty auth_id; this links each to the center\'s already-loaded gestor authorization ' +
+        '(G0x) using the SAME rule the register enforces (destino + hazard class). Without confirm it ' +
+        'is a DRY-RUN (shows what would be linked and what can\'t resolve); with confirm=true it writes ' +
+        'under your active operator elevation (company derived from it). Rows whose center has no ' +
+        'matching destino authorization are reported, never forced — load the G0x with ' +
+        'apply_authorization first. Read the dry-run before confirming.', {
+        year: z.number().describe('Calendar year, e.g. 2025'),
+        confirm: z.boolean().optional().describe('true to write; omit/false for a dry-run'),
+    }, async ({ year, confirm }) => {
+        const elev = await resolveElevation(client);
+        if ('content' in elev)
+            return elev;
+        const body = { year, confirm: confirm === true };
+        const res = confirm === true
+            ? await client.post('/mwm/retirada/link-gestor-authorizations', body)
+            : await client.post('/mwm/retirada/link-gestor-authorizations', body);
+        if (confirm !== true) {
+            const d = res;
+            const sampleR = d.resoluble.slice(0, 15).map(r => `  - ${r.clientId}/${r.centerId} · LER ${r.codigoLer} → \`${r.authId}\``).join('\n');
+            const sampleU = d.unresoluble.slice(0, 15).map(u => `  - ${u.clientId}/${u.centerId} · LER ${u.codigoLer}: ${u.reason}`).join('\n');
+            const text = `# Dry-run · vincular autorización de gestor · ${d.year}\n` +
+                `${d.total} fila(s) EntidadCentroLer sin auth_id · ${d.resoluble.length} resolubles · ${d.unresoluble.length} sin resolver.\n\n` +
+                (d.resoluble.length ? `## Se vincularían (authId)\n${sampleR}${d.resoluble.length > 15 ? `\n  … +${d.resoluble.length - 15} más` : ''}\n\n` : '') +
+                (d.unresoluble.length ? `## No resolubles (falta cargar la G0x)\n${sampleU}${d.unresoluble.length > 15 ? `\n  … +${d.unresoluble.length - 15} más` : ''}\n\n` : '') +
+                `_Ejecuta con confirm=true para aplicar las ${d.resoluble.length} resolubles._`;
+            return { content: [{ type: 'text', text }] };
+        }
+        const r = res;
+        const failLines = r.failed.length ? '\n\n### Fallidas\n' + r.failed.map(f => `- ${f.clientId}/${f.centerId} LER ${f.codigoLer}: ${f.error}`).join('\n') : '';
+        const text = `# Aplicado · vincular autorización de gestor · ${r.year}\n` +
+            `${r.applied} vinculada(s)${r.skipped ? `, ${r.skipped} ya poblada(s)` : ''}${r.failed.length ? `, ${r.failed.length} con error` : ''}, bajo tu elevación.` +
+            (r.unresoluble.length ? `\n${r.unresoluble.length} sin resolver (falta cargar su G0x — usa apply_authorization).` : '') +
+            failLines +
+            `\n\n_Recuerda des-elevarte desde el portal web con un motivo cuando termines._`;
+        return { content: [{ type: 'text', text }] };
+    });
+}

package/dist/tools/lookup-authorization.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ZincAppClient } from '../client.js';
+export declare function registerLookupAuthorization(server: McpServer, _client: ZincAppClient): void;

package/dist/tools/lookup-authorization.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { lookupNimaAuthorizations } from '../madrid-nima.js';
+export function registerLookupAuthorization(server, _client) {
+    server.tool('lookup_authorization', 'Look up an entity\'s waste authorizations in the OFFICIAL Comunidad de Madrid NIMA registry ' +
+        '(gestiona.comunidad.madrid) by NIF — the authoritative source for the registry NUMBER that ' +
+        'the agent must never invent. Returns the entity with its centers (one per NIMA) and each ' +
+        'center\'s authorizations, mapped to the system\'s authId codes (T01/G01/…). IMPORTANT: in ' +
+        'the CM registry a company has DIFFERENT NIMAs per role — the transport authorization (T01/T02) ' +
+        'lives on a different NIMA/center than the gestor authorization (G0x) — so this reveals which ' +
+        'NIMA holds which. Read-only, proposes only: pass a found number to apply_authorization to write ' +
+        'it. If a `nima` is given, only that center is returned.', {
+        nif: z.string().describe('The entity NIF/CIF, e.g. "B86208824" (from audit_entities / propose_authorizations)'),
+        nima: z.number().optional().describe('Restrict to the center with this exact NIMA (else all centers are returned)'),
+    }, async ({ nif, nima }) => {
+        let result;
+        try {
+            result = await lookupNimaAuthorizations({ nif, nima });
+        }
+        catch (e) {
+            return { content: [{ type: 'text', text: `No se pudo consultar el registro NIMA: ${e?.message ?? e}` }] };
+        }
+        const e = result.entidad;
+        if (e.centros.length === 0) {
+            return { content: [{ type: 'text', text: `Sin centros en el registro NIMA para NIF ${e.cif}.` }] };
+        }
+        const blocks = e.centros.map(c => {
+            const auths = c.autorizaciones.length
+                ? c.autorizaciones.map(a => `  - \`${a.authId}\` · ${a.autorizacion} · ${a.estado ? 'ACTIVA' : 'baja'}`).join('\n')
+                : '  _(sin autorizaciones)_';
+            return `### NIMA ${c.nima}\n${c.direccion}\n${auths}`;
+        }).join('\n\n');
+        const text = `# Registro NIMA (Comunidad de Madrid) · ${e.nombre ?? e.cif}\n` +
+            `NIF ${e.cif} · ${e.centros.length} centro(s)\n\n` +
+            blocks +
+            `\n\n_Fuente oficial. Para escribir un número: apply_authorization con el authId y el número ACTIVO correcto._`;
+        return { content: [{ type: 'text', text }] };
+    });
+}

package/dist/tools/propose-authorizations.js

@@ -23,11 +23,14 @@ export function registerProposeAuthorizations(server, client) {
         }
         const blocks = r.proposals.map(p => {
             const name = p.nombre ?? p.cif ?? '(sin nombre)';
+            const coords = (p.clientId != null && p.centerId != null)
+                ? `  · entidad **${p.clientId}/${p.centerId}** (para apply_authorization)`
+                : '  · _(sin centro resoluble — no aplicable directamente)_';
             const cands = p.candidates.length
                 ? p.candidates.map(c => `  - \`${c.authId}\`${c.name ? ` — ${c.name}` : ''}`).join('\n')
                 : '  _(sin candidatos en el catálogo)_';
             const warns = p.warnings.map(w => `  ⚠️ ${w}`).join('\n');
-            return `### ${name} — ${p.usedByRemovals} retirada(s)${p.peligroso ? ' · peligroso' : ''}\nCandidatos (authId):\n${cands}\n${warns}`;
+            return `### ${name} — ${p.usedByRemovals} retirada(s)${p.peligroso ? ' · peligroso' : ''}${coords}\nCandidatos (authId):\n${cands}\n${warns}`;
         }).join('\n\n');
         const text = `# Propuesta de autorizaciones · ${r.role}s · company ${companyId}\n${r.proposals.length} sin autorización\n\n${blocks}`;
         return { content: [{ type: 'text', text }] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zincapp/mcp-server",
-  "version": "1.5.0",
+  "version": "1.8.0",
   "description": "MCP server for ZincApp — search docs, read API reference, execute sandbox calls, and audit/complete waste removals (retiradas)",
   "type": "module",
   "bin": {
@@ -10,7 +10,9 @@
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "build:test": "tsc -p tsconfig.test.json",
+    "test": "npm run build:test && node --test \"dist-test/test/**/*.test.js\""
   },
   "keywords": [
     "mcp",