Added value: +{
+  "description": "Narrow products to these IDs from vulnerability status, score, or remediation references. Alone selects products; combined with cves selects both sections. Explicit sections must include products.",
+  "items": {
+    "description": "Exact case-sensitive CSAF product ID; surrounding whitespace is trimmed.",
+    "minLength": 1,
+    "type": "string"
+  },
+  "type": "array"
+}

Previous value: -"Machine-readable failure mode. Declared by this tool: `mirror_not_ready`: The advisory index has never completed a full sync. `mirror_unavailable`: The advisory index store cannot be opened: its location is not writable, is read-only, runs through a missing directory or a file, or holds a file that is not a SQLite database. `unknown_section`: A requested section is one this advisory does not carry. `cves_need_vulnerabilities_section`: cves is set but sections does not include \"vulnerabilities\", so there is nothing for cves to narrow. `unknown_cve`: A cves entry names a CVE this advisory does not cover. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `product_ids_need_products_section`: productIds is nonempty but explicit sections omits products. `unknown_product_id`: productIds names an ID with no definition in this advisory. `mirror_busy`: A transient SQLite lock prevents the advisory index from opening. `mirror_not_ready`: The advisory index has never completed a full sync. `mirror_unavailable`: The advisory index store cannot be opened: its location is not writable, is read-only, runs through a missing directory or a file, or holds a file that is not a SQLite database. `unknown_section`: A requested section is one this advisory does not carry. `cves_need_vulnerabilities_section`: cves is set but sections does not include \"vulnerabilities\", so there is nothing for cves to narrow. `unknown_cve`: A cves entry names a CVE this advisory does not cover. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "mirror_not_ready",
-  "mirror_unavailable",
-  "unknown_section",
-  "cves_need_vulnerabilities_section",
-  "unknown_cve"
-]New value: +[
+  "product_ids_need_products_section",
+  "unknown_product_id",
+  "mirror_busy",
+  "mirror_not_ready",
+  "mirror_unavailable",
+  "unknown_section",
+  "cves_need_vulnerabilities_section",
+  "unknown_cve"
+]

Added value: +{
+  "description": "True when productIds selects only requested definitions; whole-document totals are retained.",
+  "type": "boolean"
+}

Previous value: -"Flattened version rows returned — equal to productCount except on a truncated copy."New value: +"Product definitions returned — equal to productCount except under productIds selection or on a legacy truncated copy."

Previous value: -"Version entries under this product."New value: +"Product definitions grouped under this product label."

Previous value: -"One affected version or version range."New value: +"One branch, standalone, or relationship product definition."

Added value: +{
+  "description": "Lossless JSON text of upstream CSAF product identification metadata, when supplied.",
+  "type": "string"
+}

Previous value: -"CSAF branch category this entry came from, e.g. product_version or product_version_range."New value: +"CSAF branch category, or full_product_name or relationship for definitions outside branches."

Added value: +{
+  "description": "Exact full product name supplied upstream.",
+  "type": "string"
+}

Previous value: -"The CSAFPID token vulnerability entries reference — how a CVE maps to exact affected versions."New value: +"Exact opaque CSAF product ID referenced by vulnerability entries; case-sensitive and not restricted to CSAFPID tokens."

Added value: +{
+  "description": "First relationship component ID; not automatically expanded.",
+  "type": "string"
+}

Added value: +{
+  "description": "Second relationship component ID; not automatically expanded.",
+  "type": "string"
+}

Added value: +{
+  "description": "CSAF relationship category supplied upstream.",
+  "type": "string"
+}

Previous value: -"The version or version-range expression."New value: +"Version/range expression for a branch row, or full name for a standalone or relationship definition."

Previous value: -"Machine-readable failure mode. Declared by this tool: `mirror_not_ready`: The advisory index has never completed a full sync. `unknown_section`: A requested section is one this advisory does not carry. `cves_need_vulnerabilities_section`: cves is set but sections does not include \"vulnerabilities\", so there is nothing for cves to narrow. `unknown_cve`: A cves entry names a CVE this advisory does not cover. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `mirror_not_ready`: The advisory index has never completed a full sync. `mirror_unavailable`: The advisory index store cannot be opened: its location is not writable, is read-only, runs through a missing directory or a file, or holds a file that is not a SQLite database. `unknown_section`: A requested section is one this advisory does not carry. `cves_need_vulnerabilities_section`: cves is set but sections does not include \"vulnerabilities\", so there is nothing for cves to narrow. `unknown_cve`: A cves entry names a CVE this advisory does not cover. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "mirror_not_ready",
-  "unknown_section",
-  "cves_need_vulnerabilities_section",
-  "unknown_cve"
-]New value: +[
+  "mirror_not_ready",
+  "mirror_unavailable",
+  "unknown_section",
+  "cves_need_vulnerabilities_section",
+  "unknown_cve"
+]

Previous value: -"What to do instead, present when found is false."New value: +"What to do instead, present when found is false: how current the index is, and whether the advisory may be newer than it."

Added value: +{
+  "description": "Present when found is false: the newest revision timestamp the index holds, or null if none.",
+  "type": [
+    "string",
+    "null"
+  ]
+}

Added value: +{
+  "description": "Present when found is false: when the index last completed a sync, ISO 8601, or null if never.",
+  "type": [
+    "string",
+    "null"
+  ]
+}

Previous value: -"Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02. Case-insensitive; an optional revision suffix is a single letter a-f or a numeric -N. A trailing .json is stripped."New value: +"Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized."

Previous value: -"^\\s*ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[a-z]|-\\d+)?(?:\\.json)?\\s*$"New value: +"^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$"

Previous value: -"^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[a-z]|-\\d+)?$"New value: +"^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$"

Added value: +{
+  "description": "Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include \"vulnerabilities\".",
+  "items": {
+    "description": "One CVE identifier the advisory covers, e.g. CVE-2023-3935. Case and surrounding whitespace are normalized.",
+    "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
+    "type": "string"
+  },
+  "type": "array"
+}

Previous value: -"Machine-readable failure mode. Declared by this tool: `mirror_not_ready`: The advisory index has never completed a full sync. `unknown_section`: A requested section is one this advisory does not carry. Other values are possible when a failure originates below the handler."New value: +"Machine-readable failure mode. Declared by this tool: `mirror_not_ready`: The advisory index has never completed a full sync. `unknown_section`: A requested section is one this advisory does not carry. `cves_need_vulnerabilities_section`: cves is set but sections does not include \"vulnerabilities\", so there is nothing for cves to narrow. `unknown_cve`: A cves entry names a CVE this advisory does not cover. Other values are possible when a failure originates below the handler."

Previous value: -[
-  "mirror_not_ready",
-  "unknown_section"
-]New value: +[
+  "mirror_not_ready",
+  "unknown_section",
+  "cves_need_vulnerabilities_section",
+  "unknown_cve"
+]

Previous value: -"Flattened version rows actually returned."New value: +"Flattened version rows returned — equal to productCount except on a truncated copy."

Previous value: -"True when the flattened version rows were capped."New value: +"True only on a copy stored by an older index build that capped product rows; the index re-ingests on its next start and then returns every row. Absent otherwise."

Previous value: -"Outline arm — the sections available, largest first, with their byte sizes."New value: +"Outline arm — the sections available, largest first, with their byte sizes and, for vulnerabilities, its CVE IDs."

Added value: +{
+  "description": "On the vulnerabilities section only: the CVE IDs it holds, in document order. Pass any of them in cves to cisa_get_advisory to read just those entries.",
+  "items": {
+    "description": "One CVE identifier.",
+    "type": "string"
+  },
+  "type": "array"
+}