• debian/copyright read in full: DEP-5 1.0, Files: * (Paco Coursey, Expat) and Files: debian/* (Andrew Lee, Expat), standalone Expat text reproduced verbatim; Upstream-Name cmdk.
• LICENSE.md is the MIT/Expat text, Copyright (c) 2022 Paco Coursey; Copyright|(C)|©|SPDX-License-Identifier|Licensed under|GNU (Lesser) General Public|Apache License|Mozilla Public|public domain|All rights reserved searched over the whole tree (all globs/greps with gitignore off, .pc/ skipped) matched only LICENSE.md, debian/copyright and one unrelated onClick={(c) ...} hit.
• Whole-tree inventory (44 files outside .pc/ and debian/): top-level config/docs, cmdk/{package.json,tsup.config.ts,src/}, test/{.test.ts,pages/*,style.css,next-env.d.ts,...}, .github/, .husky/. Only LICENSE.md is a licence file; no COPYING/NOTICE/AUTHORS; no images, fonts, PDFs, minified or built JS/bytecode in the tree. test/next-env.d.ts is the 4-line Next.js type-reference stub; cmdk/dist is absent (gitignored, generated by the build).
• Prescan listed no files and its author check found no holder missing from debian/copyright; nothing listed there is left unaccounted for.
• Files-Excluded: website is accurate: the orig tarball (root dip-cmdk-fb4ea04/) and the tree both lack website/; README.md:2 still references ./website/public/og.png, which is only a broken link and has no licensing consequence (pnpm-workspace.yaml also still lists 'website', harmless since no pnpm install is run).
• Build/install flow checked against /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm and Sequence/nodejs.pm: debian/nodejs/build is executed for the main dir (cd cmdk; tsc), the cmdk component's tsup src script is skipped because tsup is not a known build command, install_module installs package.json#files (dist), the forced main file dist/index.js and cmdk/package.json into /usr/share/nodejs/cmdk; debian/rules removes the unwanted /usr/share/nodejs/cmdk-root afterwards.
• Dependencies checked with apt-cache: node-react 18.3.1, node-react-dom 18.3.1~..., node-react-remove-scroll 2.7.2, node-typescript 6.0.3-2 all exist in unstable; Homepage, Vcs-Browser/Vcs-Git, Testsuite and Section fields are present and well formed.
• Packaging files: debhelper-compat 14, no debian/patches (nothing to be DEP-3 checked), changelog 1.1.1+ds-1 to unstable closing #1151619 with a valid date, source format 3.0 (quilt), autopkgtest via Testsuite: autopkgtest-pkg-nodejs with debian/tests/pkg-js/test; Standards-Version 4.7.4 against Policy 4.7.4.1.
• uscan found the packaged version as the newest upstream release (upstream 1.1.1, packaged 1.1.1+ds).

• node-radix-ui appears neither in the archive's package lists nor among the uploads waiting in NEW, and nothing provides it; if it is not a virtual package provided by a radix upload, both Build-Depends and Depends are unsatisfiable. The related @radix-ui/react-compose-refs, react-dialog, react-id and react-primitive modules in debian/nodejs/extlinks are only covered if that one package ships all of them.
• The provenance of cmdk/src/command-score.ts could not be checked offline: no command-score source exists under /usr/share/nodejs to compare against, and nothing in the package states it (reported as a recalled issue above).
• Whether the tsc 6.0.3 in unstable accepts the generated tsconfig (ignoreDeprecations: "6.0", module: "CommonJS", types: ["node",...] with @types/node only listed in extlinks) was not tested; the maintainer's own clean build is assumed to succeed.
• Whether this is a fault: cmdk/src/command-score.ts carries no copyright notice though it appears to be vendored from the command-score package. The model reported it as a blocker licensing issue from its own knowledge of something outside the package, which it did not check with a tool, so it is not counted among the issues. Files: cmdk/src/command-score.ts:1-5, debian/copyright:8-10.
  Evidence: The file has no header at all, and its comments refer to another codebase: in the original, we used to do the lower-casing on each recursive call and allow duplicate letters. Ref #7428; the scoring constants (SCORE_CONTINUE_MATCH, PENALTY_CASE_MISMATCH, ...) are the ones of the npm command-score package.
  Problem: If this is copied from command-score (MIT), its copyright notice and permission text must be retained and its holder named in debian/copyright; Files: * names only Paco Coursey. I could not check the file's origin offline (nothing named command-score exists in /usr/share/nodejs), so this is reported as unconfirmed.
  Fix: Check the file's history in the upstream repository; if it is derived from command-score, add a Files: cmdk/src/command-score.ts stanza with its holder and licence and keep the upstream notice in the file.
• debian/watch looks at github.com/dip/cmdk, but the Source field of debian/copyright names github.com/pacocoursey/cmdk. Whether these are the same upstream was not checked.

None.