• mapbox-vector-tile/test/fixtures/12-1143-1497.vector.pbf: Mapbox Vector Tile protobuf test fixture read by mapbox-vector-tile/test/parse.test.js; hand-checked-in test data, not build output; covered by the BSD-3-Clause mapbox-vector-tile/* stanza.
• mapbox-vector-tile/test/fixtures/14-8801-5371.vector.pbf: same kind; also the tile read by mapbox-vector-tile/bench.js and the first fixture used in parse.test.js; test data, covered by the BSD-3-Clause stanza.
• mapbox-vector-tile/test/fixtures/lots-of-tags.vector.pbf: same kind; vector-tile test fixture, covered by the BSD-3-Clause stanza.
• mapbox-vector-tile/test/fixtures/multi-polygon.pbf: same kind; vector-tile test fixture, covered by the BSD-3-Clause stanza.
• mapbox-vector-tile/test/fixtures/multipolygon-with-closepath.pbf: same kind; vector-tile test fixture, covered by the BSD-3-Clause stanza.
• mapbox-vector-tile/test/fixtures/multipolygon.pbf: same kind; vector-tile test fixture, covered by the BSD-3-Clause stanza.
• mapbox-vector-tile/test/fixtures/polygon-with-inner.pbf: same kind; vector-tile test fixture, covered by the BSD-3-Clause stanza.
• mapbox-vector-tile/test/fixtures/singleton-multi-polygon.pbf: same kind; vector-tile test fixture, covered by the BSD-3-Clause stanza.
• mapbox-vector-tile/test/fixtures/stacked-multipolygon.pbf: same kind; vector-tile test fixture, covered by the BSD-3-Clause stanza.
• The seven further .pbf files the scan did not list -- mapbox-vector-tile/test/fixtures/{multi-line,multi-point,singleton-multi-line,singleton-multi-point,zero-line,zero-point,zero-polygon}.pbf -- are the same kind of vector-tile test fixture and are equally covered by the BSD-3-Clause stanza.
• mapbox-tiny-sdf/test/fixtures/{1-raw.png,1-sdf.png,1-metrics.json,1-out.json} are test expectations: test/test.js regenerates them itself (if (process.env.UPDATE) writeFileSync(...)) and compares against them; covered by the BSD-2-Clause mapbox-tiny-sdf/* stanza.
• Full text of the three LICENSE files read and compared with the License paragraphs: mapbox-vector-tile/LICENSE.txt = BSD-3-Clause naming Mapbox, mapbox-point-geometry/LICENSE = ISC, mapbox-tiny-sdf/LICENSE.txt = BSD-2-Clause Copyright (c) 2016-2024 Mapbox, Inc.; the copyright years and entities in debian/copyright match them.
• No SPDX headers, copyright notices or other licence statements exist in any .js, .json, .html, .proto, .yml or .md file outside the LICENSE files and package.json license fields (grep for Copyright/(C)/©/SPDX/Licensed under/GNU/Apache/Mozilla/public domain/All rights reserved over the whole tree). package-lock.json license entries describe npm dev-dependencies that are not shipped.
• mapbox-tiny-sdf/index.html contains import {mat4} from 'https://cdn.skypack.dev/pin/gl-matrix@v3.3.0-.../gl-matrix.js'; no third-party code is embedded (so no missing licence text), it is an upstream browser demo page, and it is not installed in the binary package (package.json files is only index.d.ts, plus index.js as main).
• mapbox-vector-tile/proto/vector_tile.proto (the protocol version 1 schema) has no notice of its own and is distributed by upstream under the repository's BSD-3-Clause LICENSE.txt, which is what the mapbox-vector-tile/* stanza says.
• Runtime imports are only @mapbox/point-geometry from vector-tile, which the same binary provides; pbf and geojson appear only as JSDoc @import type references (mapbox-vector-tile/index.js:4-5). The Depends on node-geojson and node-pbf therefore mirror upstream's package.json dependencies and are needed at build/test time (tsc type resolution, pbf in parse.test.js); not reported as a fault.
• The only file at the top level of the tree besides the three component directories and debian/ is .gitignore, added by debian/patches/dgit-changes.
• debhelper behaviour checked against the installed tools: /usr/share/perl5/Debian/Debhelper/Buildsystem/nodejs.pm sub test runs debian/tests/pkg-js/test at build time, sub build runs debian/nodejs//build (tsc --project tsconfig.json), install forces package.json#main and populates ${nodejs:Provides} for every root component (node-mapbox-vector-tile (= 3.0.0), node-mapbox-point-geometry (= 1.1.0), node-mapbox-tiny-sdf (= 2.3.0)).
• apt-cache checks: node-geojson 0.5.0+~7946.0.16-1 provides node-types-geojson (= 7946.0.16); node-canvas 3.2.3+dfsg-3; node-pngjs 3.0.0-1; node-typescript 6.0.3-2 (>= 5.5 satisfied); fonts-noto-cjk 1:20240730+repack1-1; dh-sequence-single-binary provided by debhelper 14.5; dh-sequence-nodejs-no-lerna provided by dh-nodejs 0.17.14; node-pbf is not in the archive yet but is built by source node-pbf 5.1.2-1 in NEW.
• Standards-Version 4.7.4 against Policy 4.7.4.1 (policy tool): first two components match, so not an issue.
• uscan found the packaged version as the newest upstream release (upstream 3.0.0, packaged 3.0.0).

• I did not inspect Debian's node-pngjs 3.0.0 to see whether the PNG.sync.read API that mapbox-tiny-sdf/test/test.js uses exists there; upstream's devDependency is pngjs ^7.0.0 and the version constraints are not checked by anything in the package (debian/nodejs/extlinks names it only as pngjs test). A build would show it.

None.