- Skip workspace/first-party modules so private package names are not
  sent to the public npm advisories endpoint.
- Show installed version(s) affected by each advisory by joining via
  semver.satisfies against vulnerable_versions.
- Add a 30s timeout (AbortSignal.timeout) to the registry request and
  wrap non-2xx / network failures in a clear Error with status + body.
- Cover the audit() path with tests that stub globalThis.fetch
  (happy path body + report, and 503 error wrapping).

- parseFile: sniff the first byte to route lockfile vs bundle so a
  parse failure surfaces the correct diagnostic instead of swallowing
  the real error and reporting the wrong format.
- flattenAdvisories: drop rows where no installed version matches the
  advisory's vulnerable range (avoids false positives, including bogus
  non-zero exit codes from such rows).
- collectPackages: sort via localeCompare + semver.compare (matches the
  style already used in apis/npm/index.js).
- formatTable: collapse newlines in cells so titles containing \n don't
  break the box layout.
- Add 'none' to SEVERITY_ORDER (npm emits it occasionally).
- Drop redundant truthy check in apis/npm/index.js asserts.
- Tests: dedup doesn't collapse different packages at the same version;
  bundle and lockfile diagnostics route correctly; zero-match advisory
  drop; network/abort error wrapping.

- parseFile now sniffs the bundle shape after brotli decompression and
  routes to Bundle.parseCode or Bundle.parseResources accordingly.
  Resource bundles (stasis.resources.br) carry the same per-module
  name/version metadata as code bundles, so they're auditable too.
- Wrap readFileSync ENOENT in a clean 'File not found: <path>' error
  instead of letting Node's raw stack escape to the CLI.

- parseFile: the JSON.parse used to disambiguate code-vs-resource
  bundles was outside the try/catch — a brotli-valid but JSON-corrupt
  input leaked a raw SyntaxError. Move it inside the catch so all
  bundle parse failures surface 'Failed to parse stasis bundle'.
- ENOENT throw now preserves { cause }, matching the sibling read-
  error throw.
- cell() regex broadened to include bare CR and U+2028/U+2029 so
  Unicode line/paragraph separators in advisory titles can't break
  the box layout (written as escape sequences to survive editor
  whitespace-trim).
- printAuditReport now hints 'No node_modules entries found in the
  input files' when the caller passed files but they yielded zero
  audit-eligible packages — silent 0-scan is confusing.