@dangahagan/weather-mcp 1.27.0 → 1.28.0

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://badge.fury.io/js/@dangahagan%2Fweather-mcp.svg)](https://www.npmjs.com/package/@dangahagan/weather-mcp)
 [![MCP Registry](https://img.shields.io/badge/MCP-Registry-blue)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.dgahagan/weather-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Tests](https://img.shields.io/badge/tests-3%2C130%20passing-brightgreen)](./docs/testing/TEST_SUITE_README.md)
+[![Tests](https://img.shields.io/badge/tests-3%2C250%20passing-brightgreen)](./docs/testing/TEST_SUITE_README.md)
 [![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js&logoColor=white)](https://nodejs.org)
 
 **Give your AI assistant real weather data — 17 tools, zero API keys, zero signup, zero cost.**
@@ -58,7 +58,7 @@ Choose this one if you want:
 
 - **Genuinely free** — every data source is a free public API. No trial that expires, no credit card, no rate-limited "free tier" bait.
 - **No API keys** — install to first forecast in under a minute. Nothing to configure, nothing to leak into a repo. ([Three optional keys](#optional-api-keys) add extras if you want them; the default configuration needs none.)
-- **Fully open source** — MIT licensed, readable TypeScript, 3,130 tests. Audit it, fork it, fix it.
+- **Fully open source** — MIT licensed, readable TypeScript, 3,250 tests. Audit it, fork it, fix it.
 - **Privacy-respecting** — your queries go directly from your machine to public weather APIs. No middleman server, no telemetry.
 - **Breadth** — 17 tools covering weather, safety hazards (lightning, floods, wildfires), marine conditions, air quality, and historical data back to 1940. Most weather MCPs stop at forecasts.
 
@@ -70,11 +70,11 @@ All 17 tools, documented in detail in **[docs/TOOLS.md](./docs/TOOLS.md)**:
 
 | Tool | What it does | Coverage |
 |------|-------------|----------|
-| `get_forecast` | Daily/hourly forecasts up to 16 days by coordinates, saved location, or city name (NOAA publishes 7 days daily and ~6.5 days hourly in the US, and says so when you ask for more; `source="openmeteo"` reaches the full range); sunrise/sunset, UV, precipitation probability, optional climate-normals comparison, optional moon phase & twilight almanac, optional five-model agreement comparison | 🌍 Global |
-| `get_current_conditions` | Current weather: temperature, wind, humidity, pressure; NOAA station observations in the US (plus heat index/wind chill, snow depth, optional NOAA fire-weather indices), Open-Meteo model data elsewhere (with an optional computed Fosberg fire-weather index), or real airport station observations worldwide with `source="metar"`. Always states the observation's age, and automatically falls back to a fresher nearby station when the nearest one has gone dark. In extreme conditions automatically adds frostbite time-to-onset (computed wind chill) or heat-stress context (estimated WBGT) | 🌍 Global |
+| `get_forecast` | Daily/hourly forecasts up to 16 days by coordinates, saved location, or city name (NOAA publishes 7 days daily and ~6.5 days hourly in the US, and says so when you ask for more; `source="openmeteo"` reaches the full range); sunrise/sunset, UV, precipitation probability, optional climate-normals comparison, optional moon phase & twilight almanac, optional five-model agreement comparison When the National Weather Service has a life-threatening alert active for a US point, its warning is surfaced at the top of the response before the report — absence of the banner is not an all-clear, so call `get_alerts` for the authoritative answer | 🌍 Global |
+| `get_current_conditions` | Current weather: temperature, wind, humidity, pressure; NOAA station observations in the US (plus heat index/wind chill, snow depth, optional NOAA fire-weather indices), Open-Meteo model data elsewhere (with an optional computed Fosberg fire-weather index), or real airport station observations worldwide with `source="metar"`. Always states the observation's age, and automatically falls back to a fresher nearby station when the nearest one has gone dark. In extreme conditions automatically adds frostbite time-to-onset (computed wind chill) or heat-stress context (estimated WBGT) When the National Weather Service has a life-threatening alert active for a US point, its warning is surfaced at the top of the response before the report — absence of the banner is not an all-clear, so call `get_alerts` for the authoritative answer | 🌍 Global |
 | `get_alerts` | Active watches, warnings, and advisories sorted by severity; official national warnings for the US (NOAA), Canada (ECCC), 38 European countries (MeteoAlarm), India (NDMA SACHET), the Philippines (PAGASA), Indonesia (BMKG), and Japan (JMA) | 🇺🇸 🇨🇦 🇪🇺 🇮🇳 🇵🇭 🇮🇩 🇯🇵 |
 | `get_historical_weather` | Hourly/daily observations from 1940 to present | 🌍 Global |
-| `get_weather_summary` | One-call overview combining current conditions, forecast, and alerts (optionally air quality and lightning) | 🌍 Global |
+| `get_weather_summary` | One-call overview combining current conditions, forecast, and alerts (optionally air quality and lightning); a life-threatening US alert is surfaced once above the whole summary, not once per section | 🌍 Global |
 | `search_location` | Geocode place names to coordinates ("Paris" → 48.85, 2.35) | 🌍 Global |
 | `get_air_quality` | AQI (US/European scales), pollutants, UV index, health guidance; current pollen levels for European locations (or worldwide with an optional key); optional day-grouped forecast up to 7 days with per-day peak AQI and UV | 🌍 Global |
 | `get_marine_conditions` | Wave height, swell, ocean currents, sea state on WMO Code Table 3700 (Douglas sea scale) with a severity marker and legend — includes Great Lakes and major US bays; forecast up to 16 days | 🌍 Global |
@@ -380,7 +380,7 @@ Being honest about what free public data can and can't do:
 ```bash
 npm run build          # Compile TypeScript
 npm run dev            # Run in development mode
-npm test               # Run all 3,130 tests
+npm test               # Run all 3,250 tests
 npm run test:coverage  # Coverage report
 npm run audit          # Dependency vulnerability scan
 ```

package/dist/config/displayThresholds.d.ts

@@ -107,6 +107,37 @@ export declare const DisplayThresholds: {
         /** Compute/render WBGT only when air temp (°F) is at or above showHeatIndex and rounded WBGT (°F) is at or above this */
         readonly showWbgtF: 80;
     };
+    /**
+     * Life-threatening alert banner gate
+     */
+    readonly criticalAlert: {
+        /**
+         * Display gates only. The predicate that reads them lives in
+         * `src/utils/criticalAlert.ts`, which owns the *shape* of the rule — the
+         * three-axis leg is an `and`, the response leg stands alone, and the two
+         * are `or`ed. Widening a list here loosens the gate; it cannot change that
+         * shape.
+         *
+         * These are membership lists rather than a rank because CAP's severity,
+         * urgency and certainty are unordered enums as far as this repo is
+         * concerned: `CAP_SEVERITY_ORDER` in `alertsHandler.ts` is a sort rank for
+         * display, and reusing it here would tie a safety gate to a presentation
+         * decision.
+         *
+         * Calibrated against the live national feed — see the Verification section
+         * of the design plan for the histogram the current values were read from.
+         * Tuning is a config change here, deliberately, so re-calibration never
+         * needs a code review of the predicate.
+         */
+        /** CAP `severity` values that can reach the gate's three-axis leg */
+        readonly severities: readonly string[];
+        /** CAP `urgency` values that can reach the gate's three-axis leg */
+        readonly urgencies: readonly string[];
+        /** CAP `certainty` values that can reach the gate's three-axis leg */
+        readonly certainties: readonly string[];
+        /** CAP `response` values that fire the gate on their own, whatever the severity */
+        readonly responses: readonly string[];
+    };
 };
 /**
  * API-related constants

package/dist/config/displayThresholds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"displayThresholds.d.ts","sourceRoot":"","sources":["../../src/config/displayThresholds.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,iBAAiB;IAC5B;;OAEG;aACH,WAAW;QACT,2DAA2D;iBAC3D,aAAa,EAAE,EAAE;QACjB,2DAA2D;iBAC3D,aAAa,EAAE,EAAE;QACjB;;;;;;WAMG;iBACH,YAAY;qBACV,CAAC,EAAE,CAAC;qBACJ,CAAC,EAAE,CAAC;;;IAIR;;OAEG;aACH,IAAI;QACF,4FAA4F;iBAC5F,qBAAqB,EAAE,GAAG;;IAG5B;;OAEG;aACH,UAAU;QACR,gBAAgB;iBAChB,QAAQ,EAAE,IAAI;QACd,UAAU;iBACV,GAAG,EAAE,CAAG;QACR,mBAAmB;iBACnB,QAAQ,EAAE,CAAG;QACb,uBAAuB;iBACvB,KAAK,EAAE,EAAI;;IAGb;;OAEG;aACH,iBAAiB;QACf;;;;WAIG;iBACH,mBAAmB,EAAE,GAAG;QACxB;;;;WAIG;iBACH,sBAAsB,EAAE,GAAG;QAC3B;;;WAGG;iBACH,kBAAkB,EAAE,CAAC;;IAGvB;;OAEG;aACH,aAAa;QACX,4CAA4C;iBAC5C,KAAK,EAAE,GAAG;QACV,+CAA+C;iBAC/C,QAAQ,EAAE,GAAG;QACb,4CAA4C;iBAC5C,KAAK,EAAE,GAAG;QACV;;;;;;;;;WASG;iBACH,UAAU;qBACR,IAAI,EAAE,KAAK;qBACX,EAAE,EAAE,IAAI;;;IAIZ;;OAEG;aACH,aAAa;QACX;;;;;;WAMG;QACH,mFAAmF;iBACnF,yBAAyB,EAAE,CAAC,EAAE;QAC9B,yHAAyH;iBACzH,SAAS,EAAE,EAAE;;CAEP,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB;;;OAGG;aACH,2BAA2B,EAAE,CAAC;IAE9B;;OAEG;aACH,uBAAuB,EAAE,EAAE;CACnB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,eAAe;IAC1B;;OAEG;aACH,mBAAmB,EAAE,CAAC;IAEtB;;OAEG;aACH,eAAe,EAAE,EAAE;IAEnB;;OAEG;aACH,sBAAsB,EAAE,GAAG;IAE3B;;;;;OAKG;aACH,kBAAkB,EAAE,GAAG;CACf,CAAC"}
+{"version":3,"file":"displayThresholds.d.ts","sourceRoot":"","sources":["../../src/config/displayThresholds.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,iBAAiB;IAC5B;;OAEG;aACH,WAAW;QACT,2DAA2D;iBAC3D,aAAa,EAAE,EAAE;QACjB,2DAA2D;iBAC3D,aAAa,EAAE,EAAE;QACjB;;;;;;WAMG;iBACH,YAAY;qBACV,CAAC,EAAE,CAAC;qBACJ,CAAC,EAAE,CAAC;;;IAIR;;OAEG;aACH,IAAI;QACF,4FAA4F;iBAC5F,qBAAqB,EAAE,GAAG;;IAG5B;;OAEG;aACH,UAAU;QACR,gBAAgB;iBAChB,QAAQ,EAAE,IAAI;QACd,UAAU;iBACV,GAAG,EAAE,CAAG;QACR,mBAAmB;iBACnB,QAAQ,EAAE,CAAG;QACb,uBAAuB;iBACvB,KAAK,EAAE,EAAI;;IAGb;;OAEG;aACH,iBAAiB;QACf;;;;WAIG;iBACH,mBAAmB,EAAE,GAAG;QACxB;;;;WAIG;iBACH,sBAAsB,EAAE,GAAG;QAC3B;;;WAGG;iBACH,kBAAkB,EAAE,CAAC;;IAGvB;;OAEG;aACH,aAAa;QACX,4CAA4C;iBAC5C,KAAK,EAAE,GAAG;QACV,+CAA+C;iBAC/C,QAAQ,EAAE,GAAG;QACb,4CAA4C;iBAC5C,KAAK,EAAE,GAAG;QACV;;;;;;;;;WASG;iBACH,UAAU;qBACR,IAAI,EAAE,KAAK;qBACX,EAAE,EAAE,IAAI;;;IAIZ;;OAEG;aACH,aAAa;QACX;;;;;;WAMG;QACH,mFAAmF;iBACnF,yBAAyB,EAAE,CAAC,EAAE;QAC9B,yHAAyH;iBACzH,SAAS,EAAE,EAAE;;IAGf;;OAEG;aACH,aAAa;QACX;;;;;;;;;;;;;;;;;WAiBG;QACH,qEAAqE;iBACrE,UAAU,EAAiB,SAAS,MAAM,EAAE;QAC5C,oEAAoE;iBACpE,SAAS,EAAmB,SAAS,MAAM,EAAE;QAC7C,sEAAsE;iBACtE,WAAW,EAA4B,SAAS,MAAM,EAAE;QACxD,mFAAmF;iBACnF,SAAS,EAAkB,SAAS,MAAM,EAAE;;CAEtC,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB;;;OAGG;aACH,2BAA2B,EAAE,CAAC;IAE9B;;OAEG;aACH,uBAAuB,EAAE,EAAE;CACnB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,eAAe;IAC1B;;OAEG;aACH,mBAAmB,EAAE,CAAC;IAEtB;;OAEG;aACH,eAAe,EAAE,EAAE;IAEnB;;OAEG;aACH,sBAAsB,EAAE,GAAG;IAE3B;;;;;OAKG;aACH,kBAAkB,EAAE,GAAG;CACf,CAAC"}

package/dist/config/displayThresholds.js

@@ -107,6 +107,37 @@ export const DisplayThresholds = {
         /** Compute/render WBGT only when air temp (°F) is at or above showHeatIndex and rounded WBGT (°F) is at or above this */
         showWbgtF: 80,
     },
+    /**
+     * Life-threatening alert banner gate
+     */
+    criticalAlert: {
+        /**
+         * Display gates only. The predicate that reads them lives in
+         * `src/utils/criticalAlert.ts`, which owns the *shape* of the rule — the
+         * three-axis leg is an `and`, the response leg stands alone, and the two
+         * are `or`ed. Widening a list here loosens the gate; it cannot change that
+         * shape.
+         *
+         * These are membership lists rather than a rank because CAP's severity,
+         * urgency and certainty are unordered enums as far as this repo is
+         * concerned: `CAP_SEVERITY_ORDER` in `alertsHandler.ts` is a sort rank for
+         * display, and reusing it here would tie a safety gate to a presentation
+         * decision.
+         *
+         * Calibrated against the live national feed — see the Verification section
+         * of the design plan for the histogram the current values were read from.
+         * Tuning is a config change here, deliberately, so re-calibration never
+         * needs a code review of the predicate.
+         */
+        /** CAP `severity` values that can reach the gate's three-axis leg */
+        severities: ['Extreme'],
+        /** CAP `urgency` values that can reach the gate's three-axis leg */
+        urgencies: ['Immediate'],
+        /** CAP `certainty` values that can reach the gate's three-axis leg */
+        certainties: ['Observed', 'Likely'],
+        /** CAP `response` values that fire the gate on their own, whatever the severity */
+        responses: ['Evacuate'],
+    },
 };
 /**
  * API-related constants

package/dist/config/displayThresholds.js.map

@@ -1 +1 @@
-{"version":3,"file":"displayThresholds.js","sourceRoot":"","sources":["../../src/config/displayThresholds.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B;;OAEG;IACH,WAAW,EAAE;QACX,2DAA2D;QAC3D,aAAa,EAAE,EAAE;QACjB,2DAA2D;QAC3D,aAAa,EAAE,EAAE;QACjB;;;;;;WAMG;QACH,YAAY,EAAE;YACZ,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;SACL;KACF;IAED;;OAEG;IACH,IAAI,EAAE;QACJ,4FAA4F;QAC5F,qBAAqB,EAAE,GAAG;KAC3B;IAED;;OAEG;IACH,UAAU,EAAE;QACV,gBAAgB;QAChB,QAAQ,EAAE,IAAI;QACd,UAAU;QACV,GAAG,EAAE,GAAG;QACR,mBAAmB;QACnB,QAAQ,EAAE,GAAG;QACb,uBAAuB;QACvB,KAAK,EAAE,IAAI;KACZ;IAED;;OAEG;IACH,iBAAiB,EAAE;QACjB;;;;WAIG;QACH,mBAAmB,EAAE,GAAG;QACxB;;;;WAIG;QACH,sBAAsB,EAAE,GAAG;QAC3B;;;WAGG;QACH,kBAAkB,EAAE,CAAC;KACtB;IAED;;OAEG;IACH,aAAa,EAAE;QACb,4CAA4C;QAC5C,KAAK,EAAE,GAAG;QACV,+CAA+C;QAC/C,QAAQ,EAAE,GAAG;QACb,4CAA4C;QAC5C,KAAK,EAAE,GAAG;QACV;;;;;;;;;WASG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,KAAK;YACX,EAAE,EAAE,IAAI;SACT;KACF;IAED;;OAEG;IACH,aAAa,EAAE;QACb;;;;;;WAMG;QACH,mFAAmF;QACnF,yBAAyB,EAAE,CAAC,EAAE;QAC9B,yHAAyH;QACzH,SAAS,EAAE,EAAE;KACd;CACO,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B;;;OAGG;IACH,2BAA2B,EAAE,CAAC;IAE9B;;OAEG;IACH,uBAAuB,EAAE,EAAE;CACnB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;;OAEG;IACH,mBAAmB,EAAE,CAAC;IAEtB;;OAEG;IACH,eAAe,EAAE,EAAE;IAEnB;;OAEG;IACH,sBAAsB,EAAE,GAAG,EAAE,0BAA0B;IAEvD;;;;;OAKG;IACH,kBAAkB,EAAE,GAAG;CACf,CAAC"}
+{"version":3,"file":"displayThresholds.js","sourceRoot":"","sources":["../../src/config/displayThresholds.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B;;OAEG;IACH,WAAW,EAAE;QACX,2DAA2D;QAC3D,aAAa,EAAE,EAAE;QACjB,2DAA2D;QAC3D,aAAa,EAAE,EAAE;QACjB;;;;;;WAMG;QACH,YAAY,EAAE;YACZ,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;SACL;KACF;IAED;;OAEG;IACH,IAAI,EAAE;QACJ,4FAA4F;QAC5F,qBAAqB,EAAE,GAAG;KAC3B;IAED;;OAEG;IACH,UAAU,EAAE;QACV,gBAAgB;QAChB,QAAQ,EAAE,IAAI;QACd,UAAU;QACV,GAAG,EAAE,GAAG;QACR,mBAAmB;QACnB,QAAQ,EAAE,GAAG;QACb,uBAAuB;QACvB,KAAK,EAAE,IAAI;KACZ;IAED;;OAEG;IACH,iBAAiB,EAAE;QACjB;;;;WAIG;QACH,mBAAmB,EAAE,GAAG;QACxB;;;;WAIG;QACH,sBAAsB,EAAE,GAAG;QAC3B;;;WAGG;QACH,kBAAkB,EAAE,CAAC;KACtB;IAED;;OAEG;IACH,aAAa,EAAE;QACb,4CAA4C;QAC5C,KAAK,EAAE,GAAG;QACV,+CAA+C;QAC/C,QAAQ,EAAE,GAAG;QACb,4CAA4C;QAC5C,KAAK,EAAE,GAAG;QACV;;;;;;;;;WASG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,KAAK;YACX,EAAE,EAAE,IAAI;SACT;KACF;IAED;;OAEG;IACH,aAAa,EAAE;QACb;;;;;;WAMG;QACH,mFAAmF;QACnF,yBAAyB,EAAE,CAAC,EAAE;QAC9B,yHAAyH;QACzH,SAAS,EAAE,EAAE;KACd;IAED;;OAEG;IACH,aAAa,EAAE;QACb;;;;;;;;;;;;;;;;;WAiBG;QACH,qEAAqE;QACrE,UAAU,EAAE,CAAC,SAAS,CAAsB;QAC5C,oEAAoE;QACpE,SAAS,EAAE,CAAC,WAAW,CAAsB;QAC7C,sEAAsE;QACtE,WAAW,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAsB;QACxD,mFAAmF;QACnF,SAAS,EAAE,CAAC,UAAU,CAAsB;KAC7C;CACO,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B;;;OAGG;IACH,2BAA2B,EAAE,CAAC;IAE9B;;OAEG;IACH,uBAAuB,EAAE,EAAE;CACnB,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;;OAEG;IACH,mBAAmB,EAAE,CAAC;IAEtB;;OAEG;IACH,eAAe,EAAE,EAAE;IAEnB;;OAEG;IACH,sBAAsB,EAAE,GAAG,EAAE,0BAA0B;IAEvD;;;;;OAKG;IACH,kBAAkB,EAAE,GAAG;CACf,CAAC"}

package/dist/handlers/criticalAlertBanner.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The one place that fetches for the life-threatening alert banner.
+ *
+ * `get_forecast`, `get_current_conditions` and `get_weather_summary` all call
+ * `resolveCriticalAlertBanner` rather than each doing their own fetch-gate-format
+ * sequence, so the **failure posture exists once**. Three copies of a safety
+ * failure posture is how one copy drifts, and the copy that drifts is the one
+ * that renders a fabricated all-clear.
+ *
+ * The posture itself is D1 of the design plan: **silent omit**, one
+ * `logger.warn`, and no retries. That is only safe because the banner is a
+ * positive assertion — its absence claims nothing. `get_alerts` still serves
+ * the same data under full contract rules, where a failure propagates. Nothing
+ * in a tool description, schema or doc may ever say these three tools "check
+ * for alerts", or absence silently becomes an implied all-clear.
+ *
+ * The gate, the selection and the copy all live in `src/utils/criticalAlert.ts`,
+ * which is pure and zero-I/O. This module is the glue between that and the
+ * service, and holds no display logic of its own.
+ */
+import { NOAAService } from '../services/noaa.js';
+import type { ResolvedLocation } from '../utils/locationResolver.js';
+/**
+ * The banner for this point, or `''` — which is every path but one.
+ *
+ * In order:
+ *
+ * 1. **US pre-filter.** `country_code` when the resolution path knew one,
+ *    `isInUS` otherwise. NOAA is the only upstream in v1 (D2), so a non-US
+ *    point returns without making any request at all.
+ * 2. **One fetch, no retries.** `getAlerts` caches on its own point-keyed
+ *    alerts entry with the five-minute alerts TTL (`src/services/noaa.ts`), so a
+ *    banner fetch and a real `get_alerts` call within five minutes share one
+ *    request. This module deliberately builds no key and declares no TTL of its
+ *    own — that is what keeps risk floor F5 untripped, and the acceptance check
+ *    for it is a grep of this file for either construct.
+ * 3. **Any failure is silent.** One `logger.warn` and `''`. Never a
+ *    "could not check alerts" note: repeated benign warnings during an upstream
+ *    outage train readers to ignore the banner slot, which is worse than
+ *    nothing at all.
+ * 4. **All-or-nothing.** With no critical alert this emits nothing — no header,
+ *    no rule, no "no critical alerts" line.
+ *
+ * **G2 is not tripped by the pre-filter.** `isInUS` is a bounding box, but
+ * nothing about the box is rendered: a false negative omits a
+ * positive-assertion-only element and claims nothing, and a false positive (a
+ * point just over the Canadian border) costs one request that returns no alerts
+ * and therefore no banner.
+ *
+ * @param noaaService The NOAA client; its `getAlerts` is the only method called
+ * @param resolved The already-resolved location, carrying `country_code` when known
+ * @param timezone IANA zone the banner's expiry is rendered in
+ * @returns The formatted banner, or `''`
+ */
+export declare function resolveCriticalAlertBanner(noaaService: NOAAService, resolved: ResolvedLocation, timezone?: string): Promise<string>;
+/**
+ * Carry an already-resolved banner on an error about to be thrown.
+ *
+ * `get_forecast` and `get_current_conditions` resolve the banner concurrently
+ * with the weather body. When the body fails, the warning is the half the
+ * caller most needs, so it travels with the error to the one place that renders
+ * errors (`src/index.ts`) instead of being dropped. This keeps error formatting
+ * and error logging at that single site rather than duplicating either here.
+ *
+ * An empty banner attaches nothing at all, so a failure with no critical alert
+ * — every non-US point, and every US point with nothing life-threatening
+ * active — is byte-identical to what it was before.
+ *
+ * @param error The error being thrown; returned unchanged for `throw` chaining
+ * @param banner The resolved banner, or `''`
+ * @returns The same error
+ */
+export declare function carryCriticalAlertBannerOnError(error: unknown, banner: string): unknown;
+/**
+ * The banner carried by an error, or `''`.
+ *
+ * Read once, by the dispatch's error path. Returning `''` for every error that
+ * carries nothing is what keeps the existing error output unchanged.
+ *
+ * @param error The caught error
+ * @returns The carried banner, or `''`
+ */
+export declare function criticalAlertBannerFromError(error: unknown): string;
+//# sourceMappingURL=criticalAlertBanner.d.ts.map

package/dist/handlers/criticalAlertBanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"criticalAlertBanner.d.ts","sourceRoot":"","sources":["../../src/handlers/criticalAlertBanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AA4BrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAKvF;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQnE"}

package/dist/handlers/criticalAlertBanner.js

@@ -0,0 +1,172 @@
+/**
+ * The one place that fetches for the life-threatening alert banner.
+ *
+ * `get_forecast`, `get_current_conditions` and `get_weather_summary` all call
+ * `resolveCriticalAlertBanner` rather than each doing their own fetch-gate-format
+ * sequence, so the **failure posture exists once**. Three copies of a safety
+ * failure posture is how one copy drifts, and the copy that drifts is the one
+ * that renders a fabricated all-clear.
+ *
+ * The posture itself is D1 of the design plan: **silent omit**, one
+ * `logger.warn`, and no retries. That is only safe because the banner is a
+ * positive assertion — its absence claims nothing. `get_alerts` still serves
+ * the same data under full contract rules, where a failure propagates. Nothing
+ * in a tool description, schema or doc may ever say these three tools "check
+ * for alerts", or absence silently becomes an implied all-clear.
+ *
+ * The gate, the selection and the copy all live in `src/utils/criticalAlert.ts`,
+ * which is pure and zero-I/O. This module is the glue between that and the
+ * service, and holds no display logic of its own.
+ */
+import { isInUS } from '../utils/geography.js';
+import { logger } from '../utils/logger.js';
+import { formatCriticalAlertBanner, selectCriticalAlert, } from '../utils/criticalAlert.js';
+/**
+ * The HTTP status an error carries, or `undefined`.
+ *
+ * Reads the two shapes this path can see — an `ApiError` subclass's
+ * `statusCode`, and an axios error's `response.status` — and nothing else. A
+ * bare number is the whole of what is logged: no message, no config, no URL.
+ */
+function httpStatusOf(error) {
+    if (typeof error !== 'object' || error === null) {
+        return undefined;
+    }
+    const record = error;
+    if (typeof record.statusCode === 'number') {
+        return record.statusCode;
+    }
+    if (typeof record.response?.status === 'number') {
+        return record.response.status;
+    }
+    return undefined;
+}
+/**
+ * The banner for this point, or `''` — which is every path but one.
+ *
+ * In order:
+ *
+ * 1. **US pre-filter.** `country_code` when the resolution path knew one,
+ *    `isInUS` otherwise. NOAA is the only upstream in v1 (D2), so a non-US
+ *    point returns without making any request at all.
+ * 2. **One fetch, no retries.** `getAlerts` caches on its own point-keyed
+ *    alerts entry with the five-minute alerts TTL (`src/services/noaa.ts`), so a
+ *    banner fetch and a real `get_alerts` call within five minutes share one
+ *    request. This module deliberately builds no key and declares no TTL of its
+ *    own — that is what keeps risk floor F5 untripped, and the acceptance check
+ *    for it is a grep of this file for either construct.
+ * 3. **Any failure is silent.** One `logger.warn` and `''`. Never a
+ *    "could not check alerts" note: repeated benign warnings during an upstream
+ *    outage train readers to ignore the banner slot, which is worse than
+ *    nothing at all.
+ * 4. **All-or-nothing.** With no critical alert this emits nothing — no header,
+ *    no rule, no "no critical alerts" line.
+ *
+ * **G2 is not tripped by the pre-filter.** `isInUS` is a bounding box, but
+ * nothing about the box is rendered: a false negative omits a
+ * positive-assertion-only element and claims nothing, and a false positive (a
+ * point just over the Canadian border) costs one request that returns no alerts
+ * and therefore no banner.
+ *
+ * @param noaaService The NOAA client; its `getAlerts` is the only method called
+ * @param resolved The already-resolved location, carrying `country_code` when known
+ * @param timezone IANA zone the banner's expiry is rendered in
+ * @returns The formatted banner, or `''`
+ */
+export async function resolveCriticalAlertBanner(noaaService, resolved, timezone) {
+    const { latitude, longitude } = resolved;
+    // country_code first, isInUS second. A saved or geocoded location already
+    // knows its country, so the common case costs no geography at all. Casing
+    // follows the upstream source (saved locations store "US", geocoders vary),
+    // hence the case-insensitive compare.
+    const countryCode = resolved.country_code;
+    const isUS = typeof countryCode === 'string' && countryCode.length > 0
+        ? countryCode.toLowerCase() === 'us'
+        : isInUS(latitude, longitude);
+    if (!isUS) {
+        return '';
+    }
+    try {
+        const alerts = await noaaService.getAlerts(latitude, longitude, true);
+        const features = Array.isArray(alerts?.features) ? alerts.features : [];
+        if (features.length === 0) {
+            return '';
+        }
+        // `properties` is required on the documented shape but a third-party
+        // response may omit it, so the map tolerates a feature without one rather
+        // than throwing inside a garnish path.
+        const candidates = features.map((feature) => (feature?.properties ?? {}));
+        return formatCriticalAlertBanner(selectCriticalAlert(candidates), features.length, timezone);
+    }
+    catch (error) {
+        // Exactly one warn, carrying no URL and no raw axios error. The banner is
+        // garnish (D1): this must add no latency and must never rethrow, because
+        // the forecast the caller actually asked for still has to render.
+        //
+        // The impl plan's contract is "no URL and no raw axios error", and
+        // `error.message` was carrying exactly that — "Request failed with status
+        // code 503" is the axios message, and an axios message is one upstream
+        // change away from carrying the request URL with it. What is logged is
+        // therefore the error's *type* and its status, the shape this project
+        // already uses for key-bearing services, which is what a reader of these
+        // logs actually needs to tell a 404 from an outage.
+        logger.warn('Critical-alert banner lookup failed; omitting the banner', {
+            service: 'NOAA',
+            securityEvent: true,
+            errorType: error instanceof Error ? error.constructor.name : 'Unknown',
+            status: httpStatusOf(error),
+        });
+        return '';
+    }
+}
+/**
+ * The banner a failed weather request is carrying, if any.
+ *
+ * A `Symbol.for` key rather than a named property: it cannot collide with any
+ * field on an `ApiError` subclass, it does not appear in `JSON.stringify`, and
+ * it survives being rethrown unchanged through the handlers' existing
+ * fallback `catch` blocks.
+ */
+const CRITICAL_ALERT_BANNER = Symbol.for('weather-mcp.critical-alert-banner');
+/**
+ * Carry an already-resolved banner on an error about to be thrown.
+ *
+ * `get_forecast` and `get_current_conditions` resolve the banner concurrently
+ * with the weather body. When the body fails, the warning is the half the
+ * caller most needs, so it travels with the error to the one place that renders
+ * errors (`src/index.ts`) instead of being dropped. This keeps error formatting
+ * and error logging at that single site rather than duplicating either here.
+ *
+ * An empty banner attaches nothing at all, so a failure with no critical alert
+ * — every non-US point, and every US point with nothing life-threatening
+ * active — is byte-identical to what it was before.
+ *
+ * @param error The error being thrown; returned unchanged for `throw` chaining
+ * @param banner The resolved banner, or `''`
+ * @returns The same error
+ */
+export function carryCriticalAlertBannerOnError(error, banner) {
+    if (banner && typeof error === 'object' && error !== null) {
+        error[CRITICAL_ALERT_BANNER] = banner;
+    }
+    return error;
+}
+/**
+ * The banner carried by an error, or `''`.
+ *
+ * Read once, by the dispatch's error path. Returning `''` for every error that
+ * carries nothing is what keeps the existing error output unchanged.
+ *
+ * @param error The caught error
+ * @returns The carried banner, or `''`
+ */
+export function criticalAlertBannerFromError(error) {
+    if (typeof error === 'object' && error !== null) {
+        const banner = error[CRITICAL_ALERT_BANNER];
+        if (typeof banner === 'string') {
+            return banner;
+        }
+    }
+    return '';
+}
+//# sourceMappingURL=criticalAlertBanner.js.map

package/dist/handlers/criticalAlertBanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"criticalAlertBanner.js","sourceRoot":"","sources":["../../src/handlers/criticalAlertBanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,2BAA2B,CAAC;AAEnC;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAkE,CAAC;IAClF,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAwB,EACxB,QAA0B,EAC1B,QAAiB;IAEjB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IAEzC,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,sCAAsC;IACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC1C,MAAM,IAAI,GACR,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,IAAI;QACpC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAElC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,uCAAuC;QACvC,MAAM,UAAU,GAA6B,QAAQ,CAAC,GAAG,CACvD,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAA2B,CACnE,CAAC;QAEF,OAAO,yBAAyB,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,EAAE;QACF,mEAAmE;QACnE,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE;YACtE,OAAO,EAAE,MAAM;YACf,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACtE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAAc,EAAE,MAAc;IAC5E,IAAI,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACzD,KAAiC,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAI,KAAiC,CAAC,qBAAqB,CAAC,CAAC;QACzE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/handlers/currentConditionsHandler.d.ts

@@ -8,7 +8,7 @@ import { AcisService } from '../services/acis.js';
 import { AviationWeatherService } from '../services/aviationWeather.js';
 import { LocationStore } from '../services/locationStore.js';
 import { GeocodingService } from '../services/geocoding.js';
-export declare function handleGetCurrentConditions(args: unknown, noaaService: NOAAService, openMeteoService: OpenMeteoService, nceiService: NCEIService, locationStore: LocationStore, geocodingService: GeocodingService, acisService?: AcisService, aviationWeatherService?: AviationWeatherService): Promise<{
+export declare function handleGetCurrentConditions(args: unknown, noaaService: NOAAService, openMeteoService: OpenMeteoService, nceiService: NCEIService, locationStore: LocationStore, geocodingService: GeocodingService, acisService?: AcisService, aviationWeatherService?: AviationWeatherService, criticalAlertBanner?: boolean): Promise<{
     content: Array<{
         type: string;
         text: string;

package/dist/handlers/currentConditionsHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"currentConditionsHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/currentConditionsHandler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA6G5D,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,OAAO,EACb,WAAW,EAAE,WAAW,EACxB,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,CAAC,EAAE,WAAW,EACzB,sBAAsB,CAAC,EAAE,sBAAsB,GAC9C,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAkH7D"}
+{"version":3,"file":"currentConditionsHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/currentConditionsHandler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA8G5D,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,OAAO,EACb,WAAW,EAAE,WAAW,EACxB,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,CAAC,EAAE,WAAW,EACzB,sBAAsB,CAAC,EAAE,sBAAsB,EAC/C,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAiJ7D"}

package/dist/handlers/currentConditionsHandler.js

@@ -1,7 +1,8 @@
 /**
  * Handler for get_current_conditions tool
  */
-import { resolveLocationAsync, prependLocationLine } from '../utils/locationResolver.js';
+import { resolveLocationAsync, prependLocationLine, prependCriticalAlertBanner } from '../utils/locationResolver.js';
+import { resolveCriticalAlertBanner, carryCriticalAlertBannerOnError } from './criticalAlertBanner.js';
 import { validateOptionalBoolean } from '../utils/validation.js';
 import { convertToFahrenheit } from '../utils/temperatureConversion.js';
 import { resolveUnitPreferences } from '../utils/unitPreferences.js';
@@ -36,7 +37,7 @@ function insertNoteAfterHeading(text, note) {
     // The remainder starts with the original newline(s), so no trailing \n here.
     return `${text.slice(0, newline)}\n\n${note}${text.slice(newline)}`;
 }
-export async function handleGetCurrentConditions(args, noaaService, openMeteoService, nceiService, locationStore, geocodingService, acisService, aviationWeatherService) {
+export async function handleGetCurrentConditions(args, noaaService, openMeteoService, nceiService, locationStore, geocodingService, acisService, aviationWeatherService, criticalAlertBanner) {
     // Resolve location from coordinates, a saved location name, or a geocoded city name
     const resolved = await resolveLocationAsync(args, locationStore, geocodingService);
     const { latitude, longitude } = resolved;
@@ -49,53 +50,79 @@ export async function handleGetCurrentConditions(args, noaaService, openMeteoSer
     const useNOAA = requestedSource === 'auto'
         ? isInUS(latitude, longitude)
         : requestedSource === 'noaa';
+    // BLOCKER-1 (diff review): a life-threatening warning must not be suppressed
+    // by a weather failure. Started here rather than awaited — every validation
+    // above has already run, and the alert fetch now overlaps the observation
+    // fetch instead of serialising ahead of it. `resolveCriticalAlertBanner`
+    // never rejects (it is silent-omit by construction), so this promise is safe
+    // to leave in flight across the observation's own error paths.
+    const bannerPromise = criticalAlertBanner
+        ? resolveCriticalAlertBanner(noaaService, resolved, guessTimezoneFromCoords(latitude, longitude))
+        : undefined;
     let output;
-    if (requestedSource === 'metar') {
-        // METAR is never auto-routed (D1): `auto` keeps its exact US-NOAA /
-        // elsewhere-Open-Meteo semantics, and this arm is reached only on an
-        // explicit request. A model estimate at the caller's coordinates and a
-        // measurement at an airport 40 km away answer different questions.
-        if (!aviationWeatherService) {
-            throw new ServiceUnavailableError('AviationWeather', 'METAR station observations are not available in this server configuration.');
-        }
-        output = await formatMetarCurrentConditions(aviationWeatherService, openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService);
-    }
-    else if (useNOAA) {
-        try {
-            output = await formatNOAACurrentConditions(noaaService, openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService);
+    try {
+        if (requestedSource === 'metar') {
+            // METAR is never auto-routed (D1): `auto` keeps its exact US-NOAA /
+            // elsewhere-Open-Meteo semantics, and this arm is reached only on an
+            // explicit request. A model estimate at the caller's coordinates and a
+            // measurement at an airport 40 km away answer different questions.
+            if (!aviationWeatherService) {
+                throw new ServiceUnavailableError('AviationWeather', 'METAR station observations are not available in this server configuration.');
+            }
+            output = await formatMetarCurrentConditions(aviationWeatherService, openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService);
         }
-        catch (error) {
-            // The US bounding boxes overrun the border (Toronto, Vancouver, Windsor
-            // all sit inside them), so auto-routed points NOAA rejects fall back to
-            // Open-Meteo instead of erroring. NOAA maps the coverage 404 ("Unable to
-            // provide data for requested point") to DataNotFoundError and other 4xx
-            // to InvalidLocationError — both are non-retryable "NOAA can't serve
-            // this request" failures, so both fall back. Transient failures
-            // (RateLimitError, ServiceUnavailableError, network) still propagate,
-            // and explicit source="noaa" keeps its error contract.
-            if (requestedSource !== 'auto' ||
-                !(error instanceof DataNotFoundError || error instanceof InvalidLocationError)) {
-                throw error;
+        else if (useNOAA) {
+            try {
+                output = await formatNOAACurrentConditions(noaaService, openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService);
+            }
+            catch (error) {
+                // The US bounding boxes overrun the border (Toronto, Vancouver, Windsor
+                // all sit inside them), so auto-routed points NOAA rejects fall back to
+                // Open-Meteo instead of erroring. NOAA maps the coverage 404 ("Unable to
+                // provide data for requested point") to DataNotFoundError and other 4xx
+                // to InvalidLocationError — both are non-retryable "NOAA can't serve
+                // this request" failures, so both fall back. Transient failures
+                // (RateLimitError, ServiceUnavailableError, network) still propagate,
+                // and explicit source="noaa" keeps its error contract.
+                if (requestedSource !== 'auto' ||
+                    !(error instanceof DataNotFoundError || error instanceof InvalidLocationError)) {
+                    throw error;
+                }
+                logger.warn('NOAA rejected auto-routed location; falling back to Open-Meteo', {
+                    latitude,
+                    longitude,
+                    fallback: true
+                });
+                output = insertNoteAfterHeading(await formatOpenMeteoCurrentConditions(openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService), NOAA_FALLBACK_NOTE);
             }
-            logger.warn('NOAA rejected auto-routed location; falling back to Open-Meteo', {
-                latitude,
-                longitude,
-                fallback: true
-            });
-            output = insertNoteAfterHeading(await formatOpenMeteoCurrentConditions(openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService), NOAA_FALLBACK_NOTE);
+        }
+        else {
+            output = await formatOpenMeteoCurrentConditions(openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService);
         }
     }
-    else {
-        output = await formatOpenMeteoCurrentConditions(openMeteoService, nceiService, latitude, longitude, includeFireWeather, includeNormals, prefs, acisService);
+    catch (error) {
+        // The observation failed, but the banner may still have resolved. Carry it
+        // on the error so the dispatch's single error-rendering site can show the
+        // warning above the failure message; with no banner this rethrows the
+        // original error untouched and the existing error contract is unchanged.
+        throw carryCriticalAlertBannerOnError(error, bannerPromise ? await bannerPromise : '');
     }
-    return prependLocationLine({
+    // The flag check gated the fetch at the start (before any await), so an
+    // absent flag adds no latency to the no-op path. The banner is prepended
+    // last — outermost, above the `**Location:**` line this wraps — because a
+    // life-threatening warning outranks knowing which place it is about. This
+    // single return is shared by every source arm (NOAA, Open-Meteo, and the
+    // METAR arm which falls through to it), so wrapping it here covers all three
+    // by construction.
+    const banner = bannerPromise ? await bannerPromise : '';
+    return prependCriticalAlertBanner(prependLocationLine({
         content: [
             {
                 type: 'text',
                 text: output
             }
         ]
-    }, resolved);
+    }, resolved), banner);
 }
 /**
  * Render a fixed-°F value in the caller's preferred temperature unit.