• debian/copyright read in full: DEP-5 with the canonical Format: URL; stanzas Files: * (Microsoft, Expat), swift.ts (David Owens II, Expat), postiats.ts + postiats.test.ts (Artyom Shalkhakov, Expat), wgsl.ts + wgsl.test.ts (Microsoft + Google LLC, Expat), debian/* (2026 Emfox Zhou, Expat), and one stand-alone Expat paragraph with the full text.
• Inventory of the tree (336 files: src/, build/, test/, scripts/, docs/ and the root files), searched with gitignore:false. Every file carries the Microsoft MIT header (LICENSE.txt covers headerless configs/data such as package-lock.json, .prettierrc, src/basic-languages/mysql/keywords.mysql.txt); greps for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU/GPL/LGPL, Apache, Mozilla, BSD, public domain, All rights reserved found no other holder and no other licence anywhere.
• ThirdPartyNotices.txt (the file the scan listed) is upstream's third-party notice document, i.e. text like the rest of the repository, MIT, covered by Files: *; it grants no rights and is not a licence for any other file. The five holders the scan missed are named only in the licence texts it quotes: Unicode, Inc (line 115), WHATWG (170), The Khronos Group (236) and W3C (267) inside its TypeScript/DefinitelyTyped sections, and Einar Lielmanis, Liam Newman, and contributors (290) for js-beautify; W3C-HTML5.1 and Ionic/Drifty Co. are quoted in the same way. None of that material is in this source package: the Unicode/WHATWG/W3C/Khronos/WebGL notices are part of TypeScript's notices (TypeScript is not shipped - the five generated files are excluded from the orig and rebuilt from Debian's node-typescript), and js-beautify/W3C-HTML5.1/Ionic belong to vscode-html-languageservice, which src/language/html only imports from the node-vscode-html-languageservice package. Case-insensitive greps of the whole tree find no WHATWG/W3C/Unicode-data/Khronos/js-beautify/Ionic material and no bundled third-party code at all.
• The wording in ThirdPartyNotices.txt that looks restrictive ('Microsoft reserves all rights not expressly granted herein', the DefinitelyTyped paragraph mentioning 'the EULA for the Microsoft Product') is quoted notice text from Microsoft's Visual Studio/TypeScript distributions; it is not a licence grant or restriction for any file of this package, and no DefinitelyTyped files are shipped here.
• src/basic-languages/swift/swift.ts ('Copyright (C) David Owens II, owensd.io. All rights reserved.') and src/basic-languages/postiats/postiats.ts + postiats.test.ts ('Copyright (c) Artyom Shalkhakov. All rights reserved.', MIT) are the holders its stanzas name. postiats.ts also carries the acknowledgement 'Based on the ATS/Postiats lexer by Hongwei Xi' - provenance, not a copyright notice; its author licenses it MIT and upstream records no third-party notice for it.
• src/basic-languages/wgsl/wgsl.ts and wgsl.test.ts carry 'Copyright (c) Microsoft Corporation, Google LLC', as the stanza says.
• No file that lacks its preferred form for modification is shipped: no minified JS, .jar/.class/.so/.dll/.pyc, no PDF, no font (the installed codicon.ttf is a symlink into fonts-codicons created by debian/node-monaco-editor.links), and the only images are upstream's docs/ (code-structure.dio.svg and out-folders.dio.svg are draw.io sources, debugging-*.gif and launch config.png screenshots).
• TypeScript: the Apache-2.0 compiler is not in the source tree (src/language/typescript/lib/ holds only editor.worker.d.ts); debian/build.sh rebuilds it from Debian's node-typescript and ts.worker.js bundles it, which debian/copyright's Comment on Files: * states, pointing at /usr/share/common-licenses/Apache-2.0. Apache-2.0 requires no Built-Using (it does not require source availability), and the package ships ThirdPartyNotices.txt, satisfying its notice condition.
• debian/control: compat 14 via debhelper-compat, Standards-Version 4.7.4 against Policy 4.7.4.1 (current), two Architecture: all packages, node-monaco-editor Depends fonts-codicons + ${misc:Depends}, libjs-monaco-editor Depends node-monaco-editor (= ${binary:Version}). Neither package needs a node-monaco-editor-core dependency: build-monaco-editor.ts's ESM_releasePlugins rewrites every non-relative import to a path inside the installed tree, so nothing is imported from that package at run time.
• Build-Depends covers every module debian/build.sh copies from /usr/share/nodejs (esbuild, node-glob, node-jsonc-parser, node-typescript, node-vscode-css/html/json-languageservice, node-vscode-l10n, node-vscode-languageserver-textdocument/types, node-vscode-uri) plus fonts-codicons; the @types/node it compiles against comes with nodejs, which node-typescript Depends on. All names except node-monaco-editor-core exist in the archive lists.
• debian/rules: dh $@ with overrides for build (sh debian/build.sh) and install. debian/clean lists every path generated outside out/ and node_modules/: following the tsc command's import graph (build-languages.ts, build-monaco-editor.ts, importTypescript.ts -> utils.ts, fs.ts, releaseMetadata.ts) and importTypescript's output (lib.ts, lib.index.ts, typescriptServices.js/.d.ts, typescriptServicesMetadata.ts), nothing is left unremoved, so a build produces no unrepresentable change. The other generated files are under out/ and node_modules/, both in debian/clean.
• Check of debhelper at this level: dh_missing exits early when debian/tmp does not exist and no --sourcedir was given (so the --fail-missing default from compat 13 is harmless here); dh_compress only touches usr/share/{doc,man,info}, so the ES tree under /usr/share/nodejs is not compressed; dh_link accepts the package-root-relative paths used in the two .links files (leading slash optional) and writes the policy-conforming symlink.
• debian/patches: six patches, all with DEP-3 Description/Origin/Forwarded headers, each one explained in debian/README.source and matching a documented build adaptation (sources under TypeScript 6; commit from the environment; no AMD tree; TypeScript from the packaged compiler; no prettier; bigger stack for tsc). None is obsolete or half-applied.
• debian/tests/pkg-js/test: autopkgtest-pkg-nodejs with a hand-written script; its assertions agree with the build - 80 src/basic-languages//.contribution.ts plus json from the four advanced languages give 81 languages, and releaseMetadata.ts's merge by label puts the four worker languages in the order css, html, json, typescript the test expects, with pkg.module/pkg.typings created by build-monaco-editor.ts.
• debian/README.source and debian/README.Debian document the repack (debian/get-orig-source), the Debian build, the two build-modules shims, the six patches, and every difference from the upstream npm package (no dev//min/ AMD tree, ES tree assembled by Debian, TypeScript version). The debian/rules get-orig-source target is no longer required (Policy 4.1.4, A10.18) but keeping it is not a fault.
• debian/changelog: 0.47.0+ds-1, unstable, initial release closing an ITP; debian/source/format 3.0 (quilt); Vcs-Git/Vcs-Browser/Homepage point at the right places; Maintainer/Uploaders use the team's address as the rest of the archive does.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 0.57.0, packaged 0.47.0+ds), which is not a fault of the package.
• Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

• Nothing was built and no test was run (read-only review); the reasoning about the build, debian/clean and the autopkgtest is from reading debian/build.sh, the drivers and Debhelper sources on this system.
• node-monaco-editor-core (Build-Depends >= 0.47.0, << 0.48) is in neither the archive lists nor ftp-master's NEW queue as seen from this system, presumably the sibling upload; its version constraint could not be resolved.
• esbuild is not installed on this system, so it could not be checked that its binary package ships the node module at /usr/share/nodejs/esbuild that debian/build.sh copies and the drivers import.
• fonts-codicons is not installed here, so that it installs its font at /usr/share/fonts/truetype/codicons/codicon.ttf (the target of debian/node-monaco-editor.links, per README.Debian) could not be confirmed.
• The default MONACO_COMMIT in debian/build.sh (69991d66135e4a1fc1cf0b1ac4ad25d429866a0d) could not be compared with upstream's v0.47.0 tag without network access; it is what ends up as monacoCommitId in the installed package.json.
• pkg-js-autopkgtest is not installed here, so the effect of debian/tests/pkg-js/SKIP (contents: 'require') could only be inferred: autodep8 generates a test literally named 'require' (pkg-js-autopkgtest-require) besides the default one, so the file appears to list generated tests to skip, not to disable debian/tests/pkg-js/test.

None.