@openeudi/openid4vp 0.5.0 → 0.6.0

package/README.md

@@ -116,12 +116,14 @@ if (result.valid) {
 } else {
   console.warn("mismatch reasons:", result.match.unmatched);
   // each entry: { queryId, reason, detail? }
-  // reason ∈ { format_mismatch, vct_mismatch, doctype_mismatch, missing_claims, trusted_authority_mismatch, no_credential_found }
+  // reason ∈ { format_mismatch, vct_mismatch, doctype_mismatch, missing_claims, value_mismatch, trusted_authority_mismatch, no_credential_found /* only when the candidate list is empty */ }
 }
 ```
 
 Mismatches return `valid: false` — they do not throw. Only crypto/structural failures (malformed VP tokens, invalid signatures, expired credentials) and malformed DCQL queries throw exceptions.
 
+> **Privacy — diagnostics are verifier-internal.** `match.unmatched[].reason` and `detail` (including `value_mismatch`) are intended for verifier-side logging, debugging, and admin UIs. OpenID4VP §11 warns that per-claim verification outcomes can reveal wallet contents to observers. Do NOT echo these diagnostics into the OpenID4VP wire response sent back to the wallet, into end-user-visible error messages that another party could correlate, or into public analytics/third-party logs. The protocol's own error codes are the public interface; these fields are your internal instrumentation.
+
 ### ParseOptions / VerifyOptions
 
 Both `parsePresentation` and `verifyPresentation` accept:

package/dist/index.cjs

@@ -631,6 +631,9 @@ __export(index_es_exports, {
   Choice: () => Choice,
   Constructed: () => Constructed,
   DATE: () => DATE,
+  DEFAULT_MAX_CONTENT_LENGTH: () => DEFAULT_MAX_CONTENT_LENGTH,
+  DEFAULT_MAX_DEPTH: () => DEFAULT_MAX_DEPTH,
+  DEFAULT_MAX_NODES: () => DEFAULT_MAX_NODES,
   DateTime: () => DateTime,
   Duration: () => Duration,
   EndOfContent: () => EndOfContent,
@@ -725,7 +728,7 @@ function HexBlock(BaseClass) {
       this.isHexOnly = (_b = params.isHexOnly) !== null && _b !== void 0 ? _b : false;
       this.valueHexView = params.valueHex ? BufferSourceConverter.toUint8Array(params.valueHex) : EMPTY_VIEW;
     }
-    fromBER(inputBuffer, inputOffset, inputLength) {
+    fromBER(inputBuffer, inputOffset, inputLength, _context) {
       const view = inputBuffer instanceof ArrayBuffer ? new Uint8Array(inputBuffer) : inputBuffer;
       if (!checkBufferParams(this, view, inputOffset, inputLength)) {
         return -1;
@@ -769,6 +772,49 @@ function prepareIndefiniteForm(baseBlock) {
   }
   return !!((_a2 = baseBlock.lenBlock) === null || _a2 === void 0 ? void 0 : _a2.isIndefiniteForm);
 }
+function createFromBerContext(options = {}) {
+  var _a2, _b, _c;
+  return {
+    depth: 0,
+    maxDepth: (_a2 = options.maxDepth) !== null && _a2 !== void 0 ? _a2 : DEFAULT_MAX_DEPTH,
+    nodesCount: 0,
+    maxNodes: (_b = options.maxNodes) !== null && _b !== void 0 ? _b : DEFAULT_MAX_NODES,
+    maxContentLength: (_c = options.maxContentLength) !== null && _c !== void 0 ? _c : DEFAULT_MAX_CONTENT_LENGTH
+  };
+}
+function createErrorResult(error) {
+  const result = new BaseBlock({}, ValueBlock);
+  result.error = error;
+  return {
+    offset: -1,
+    result
+  };
+}
+function checkNodesLimit(context) {
+  context.nodesCount += 1;
+  if (context.nodesCount > context.maxNodes) {
+    return MAX_NODES_EXCEEDED_ERROR;
+  }
+  return void 0;
+}
+function checkContentLengthLimit(inputLength, context) {
+  if (inputLength > context.maxContentLength) {
+    return MAX_CONTENT_LENGTH_EXCEEDED_ERROR;
+  }
+  return void 0;
+}
+function localFromBERWithChildContext(inputBuffer, inputOffset, inputLength, context) {
+  const childDepth = context.depth + 1;
+  if (childDepth > context.maxDepth) {
+    return createErrorResult(MAX_DEPTH_EXCEEDED_ERROR);
+  }
+  context.depth = childDepth;
+  try {
+    return localFromBER(inputBuffer, inputOffset, inputLength, context);
+  } finally {
+    context.depth -= 1;
+  }
+}
 function localChangeType(inputObject, newType) {
   if (inputObject instanceof newType) {
     return inputObject;
@@ -780,7 +826,7 @@ function localChangeType(inputObject, newType) {
   newObject.valueBeforeDecodeView = inputObject.valueBeforeDecodeView;
   return newObject;
 }
-function localFromBER(inputBuffer, inputOffset = 0, inputLength = inputBuffer.length) {
+function localFromBER(inputBuffer, inputOffset = 0, inputLength = inputBuffer.length, context = createFromBerContext()) {
   const incomingOffset = inputOffset;
   let returnObject = new BaseBlock({}, ValueBlock);
   const baseBlock = new LocalBaseBlock();
@@ -799,6 +845,14 @@ function localFromBER(inputBuffer, inputOffset = 0, inputLength = inputBuffer.le
       result: returnObject
     };
   }
+  const nodesLimitError = checkNodesLimit(context);
+  if (nodesLimitError) {
+    returnObject.error = nodesLimitError;
+    return {
+      offset: -1,
+      result: returnObject
+    };
+  }
   let resultOffset = returnObject.idBlock.fromBER(inputBuffer, inputOffset, inputLength);
   if (returnObject.idBlock.warnings.length) {
     returnObject.warnings.concat(returnObject.idBlock.warnings);
@@ -825,6 +879,15 @@ function localFromBER(inputBuffer, inputOffset = 0, inputLength = inputBuffer.le
   }
   inputOffset = resultOffset;
   inputLength -= returnObject.lenBlock.blockLength;
+  const valueLength = returnObject.lenBlock.isIndefiniteForm ? inputLength : returnObject.lenBlock.length;
+  const contentLengthError = checkContentLengthLimit(valueLength, context);
+  if (contentLengthError) {
+    returnObject.error = contentLengthError;
+    return {
+      offset: -1,
+      result: returnObject
+    };
+  }
   if (!returnObject.idBlock.isConstructed && returnObject.lenBlock.isIndefiniteForm) {
     returnObject.error = "Indefinite length form used for primitive encoding form";
     return {
@@ -963,14 +1026,14 @@ function localFromBER(inputBuffer, inputOffset = 0, inputLength = inputBuffer.le
     }
   }
   returnObject = localChangeType(returnObject, newASN1Type);
-  resultOffset = returnObject.fromBER(inputBuffer, inputOffset, returnObject.lenBlock.isIndefiniteForm ? inputLength : returnObject.lenBlock.length);
+  resultOffset = returnObject.fromBER(inputBuffer, inputOffset, valueLength, context);
   returnObject.valueBeforeDecodeView = inputBuffer.subarray(incomingOffset, incomingOffset + returnObject.blockLength);
   return {
     offset: resultOffset,
     result: returnObject
   };
 }
-function fromBER(inputBuffer) {
+function fromBER(inputBuffer, options = {}) {
   if (!inputBuffer.byteLength) {
     const result = new BaseBlock({}, ValueBlock);
     result.error = "Input buffer has zero length";
@@ -979,7 +1042,7 @@ function fromBER(inputBuffer) {
       result
     };
   }
-  return localFromBER(BufferSourceConverter.toUint8Array(inputBuffer).slice(), 0, inputBuffer.byteLength);
+  return localFromBER(BufferSourceConverter.toUint8Array(inputBuffer).slice(), 0, inputBuffer.byteLength, createFromBerContext(options));
 }
 function checkLen(indefiniteLength, length) {
   if (indefiniteLength) {
@@ -1385,7 +1448,7 @@ function verifySchema(inputBuffer, inputSchema) {
   }
   return compareSchema(asn1.result, asn1.result, inputSchema);
 }
-var ViewWriter, powers2, digitsString, NAME, VALUE_HEX_VIEW, IS_HEX_ONLY, ID_BLOCK, TAG_CLASS, TAG_NUMBER, IS_CONSTRUCTED, FROM_BER, TO_BER, LOCAL, EMPTY_STRING, EMPTY_BUFFER, EMPTY_VIEW, END_OF_CONTENT_NAME, OCTET_STRING_NAME, BIT_STRING_NAME, LocalBaseBlock, ValueBlock, LocalIdentificationBlock, LocalLengthBlock, typeStore, BaseBlock, BaseStringBlock, LocalPrimitiveValueBlock, _a$w, Primitive, LocalConstructedValueBlock, _a$v, Constructed, LocalEndOfContentValueBlock, _a$u, EndOfContent, _a$t, Null, LocalBooleanValueBlock, _a$s, Boolean2, LocalOctetStringValueBlock, _a$r, OctetString, LocalBitStringValueBlock, _a$q, BitString, _a$p, LocalIntegerValueBlock, _a$o, Integer, _a$n, Enumerated, LocalSidValueBlock, LocalObjectIdentifierValueBlock, _a$m, ObjectIdentifier, LocalRelativeSidValueBlock, LocalRelativeObjectIdentifierValueBlock, _a$l, RelativeObjectIdentifier, _a$k, Sequence, _a$j, Set2, LocalStringValueBlock, LocalSimpleStringValueBlock, LocalSimpleStringBlock, LocalUtf8StringValueBlock, _a$i, Utf8String, LocalBmpStringValueBlock, _a$h, BmpString, LocalUniversalStringValueBlock, _a$g, UniversalString, _a$f, NumericString, _a$e, PrintableString, _a$d, TeletexString, _a$c, VideotexString, _a$b, IA5String, _a$a, GraphicString, _a$9, VisibleString, _a$8, GeneralString, _a$7, CharacterString, _a$6, UTCTime, _a$5, GeneralizedTime, _a$4, DATE, _a$3, TimeOfDay, _a$2, DateTime, _a$1, Duration, _a, TIME, Any, Choice, Repeated, RawData;
+var ViewWriter, powers2, digitsString, NAME, VALUE_HEX_VIEW, IS_HEX_ONLY, ID_BLOCK, TAG_CLASS, TAG_NUMBER, IS_CONSTRUCTED, FROM_BER, TO_BER, LOCAL, EMPTY_STRING, EMPTY_BUFFER, EMPTY_VIEW, END_OF_CONTENT_NAME, OCTET_STRING_NAME, BIT_STRING_NAME, LocalBaseBlock, ValueBlock, LocalIdentificationBlock, LocalLengthBlock, typeStore, BaseBlock, BaseStringBlock, LocalPrimitiveValueBlock, _a$w, Primitive, DEFAULT_MAX_DEPTH, DEFAULT_MAX_NODES, DEFAULT_MAX_CONTENT_LENGTH, MAX_DEPTH_EXCEEDED_ERROR, MAX_NODES_EXCEEDED_ERROR, MAX_CONTENT_LENGTH_EXCEEDED_ERROR, LocalConstructedValueBlock, _a$v, Constructed, LocalEndOfContentValueBlock, _a$u, EndOfContent, _a$t, Null, LocalBooleanValueBlock, _a$s, Boolean2, LocalOctetStringValueBlock, _a$r, OctetString, LocalBitStringValueBlock, _a$q, BitString, _a$p, LocalIntegerValueBlock, _a$o, Integer, _a$n, Enumerated, LocalSidValueBlock, LocalObjectIdentifierValueBlock, _a$m, ObjectIdentifier, LocalRelativeSidValueBlock, LocalRelativeObjectIdentifierValueBlock, _a$l, RelativeObjectIdentifier, _a$k, Sequence, _a$j, Set2, LocalStringValueBlock, LocalSimpleStringValueBlock, LocalSimpleStringBlock, LocalUtf8StringValueBlock, _a$i, Utf8String, LocalBmpStringValueBlock, _a$h, BmpString, LocalUniversalStringValueBlock, _a$g, UniversalString, _a$f, NumericString, _a$e, PrintableString, _a$d, TeletexString, _a$c, VideotexString, _a$b, IA5String, _a$a, GraphicString, _a$9, VisibleString, _a$8, GeneralString, _a$7, CharacterString, _a$6, UTCTime, _a$5, GeneralizedTime, _a$4, DATE, _a$3, TimeOfDay, _a$2, DateTime, _a$1, Duration, _a, TIME, Any, Choice, Repeated, RawData;
 var init_index_es2 = __esm({
   "node_modules/asn1js/build/index.es.js"() {
     init_index_es();
@@ -1447,7 +1510,7 @@ var init_index_es2 = __esm({
     };
     LocalBaseBlock.NAME = "baseBlock";
     ValueBlock = class extends LocalBaseBlock {
-      fromBER(_inputBuffer, _inputOffset, _inputLength) {
+      fromBER(_inputBuffer, _inputOffset, _inputLength, _context) {
         throw TypeError("User need to make a specific function in a class which extends 'ValueBlock'");
       }
       toBER(_sizeOnly, _writer) {
@@ -1560,31 +1623,21 @@ var init_index_es2 = __esm({
           this.tagNumber = tagNumberMask;
           this.blockLength = 1;
         } else {
-          let count = 1;
-          let intTagNumberBuffer = this.valueHexView = new Uint8Array(255);
-          let tagNumberBufferMaxLength = 255;
-          while (intBuffer[count] & 128) {
-            intTagNumberBuffer[count - 1] = intBuffer[count] & 127;
-            count++;
-            if (count >= intBuffer.length) {
+          let count = 0;
+          while (true) {
+            const tagByteIndex = count + 1;
+            if (tagByteIndex >= intBuffer.length) {
               this.error = "End of input reached before message was fully decoded";
               return -1;
             }
-            if (count === tagNumberBufferMaxLength) {
-              tagNumberBufferMaxLength += 255;
-              const tempBufferView2 = new Uint8Array(tagNumberBufferMaxLength);
-              for (let i = 0; i < intTagNumberBuffer.length; i++)
-                tempBufferView2[i] = intTagNumberBuffer[i];
-              intTagNumberBuffer = this.valueHexView = new Uint8Array(tagNumberBufferMaxLength);
-            }
+            count++;
+            if ((intBuffer[tagByteIndex] & 128) === 0)
+              break;
           }
           this.blockLength = count + 1;
-          intTagNumberBuffer[count - 1] = intBuffer[count] & 127;
-          const tempBufferView = new Uint8Array(count);
+          const intTagNumberBuffer = this.valueHexView = new Uint8Array(count);
           for (let i = 0; i < count; i++)
-            tempBufferView[i] = intTagNumberBuffer[i];
-          intTagNumberBuffer = this.valueHexView = new Uint8Array(count);
-          intTagNumberBuffer.set(tempBufferView);
+            intTagNumberBuffer[i] = intBuffer[i + 1] & 127;
           if (this.blockLength <= 9)
             this.tagNumber = utilFromBase(intTagNumberBuffer, 7);
           else {
@@ -1734,8 +1787,8 @@ var init_index_es2 = __esm({
         this.lenBlock = new LocalLengthBlock(parameters);
         this.valueBlock = valueBlockType ? new valueBlockType(parameters) : new ValueBlock(parameters);
       }
-      fromBER(inputBuffer, inputOffset, inputLength) {
-        const resultOffset = this.valueBlock.fromBER(inputBuffer, inputOffset, this.lenBlock.isIndefiniteForm ? inputLength : this.lenBlock.length);
+      fromBER(inputBuffer, inputOffset, inputLength, context) {
+        const resultOffset = this.valueBlock.fromBER(inputBuffer, inputOffset, this.lenBlock.isIndefiniteForm ? inputLength : this.lenBlock.length, context);
         if (resultOffset === -1) {
           this.error = this.valueBlock.error;
           return resultOffset;
@@ -1859,14 +1912,21 @@ var init_index_es2 = __esm({
       typeStore.Primitive = _a$w;
     })();
     Primitive.NAME = "PRIMITIVE";
+    DEFAULT_MAX_DEPTH = 100;
+    DEFAULT_MAX_NODES = 1e4;
+    DEFAULT_MAX_CONTENT_LENGTH = 16 * 1024 * 1024;
+    MAX_DEPTH_EXCEEDED_ERROR = "Maximum ASN.1 nesting depth exceeded";
+    MAX_NODES_EXCEEDED_ERROR = "Maximum ASN.1 node count exceeded";
+    MAX_CONTENT_LENGTH_EXCEEDED_ERROR = "Maximum ASN.1 content length exceeded";
     LocalConstructedValueBlock = class extends ValueBlock {
       constructor({ value = [], isIndefiniteForm = false, ...parameters } = {}) {
         super(parameters);
         this.value = value;
         this.isIndefiniteForm = isIndefiniteForm;
       }
-      fromBER(inputBuffer, inputOffset, inputLength) {
+      fromBER(inputBuffer, inputOffset, inputLength, context) {
         const view = BufferSourceConverter.toUint8Array(inputBuffer);
+        const parseContext = context !== null && context !== void 0 ? context : createFromBerContext();
         if (!checkBufferParams(this, view, inputOffset, inputLength)) {
           return -1;
         }
@@ -1877,7 +1937,7 @@ var init_index_es2 = __esm({
         }
         let currentOffset = inputOffset;
         while (checkLen(this.isIndefiniteForm, inputLength) > 0) {
-          const returnObject = localFromBER(view, currentOffset, inputLength);
+          const returnObject = localFromBERWithChildContext(view, currentOffset, inputLength, parseContext);
           if (returnObject.offset === -1) {
             this.error = returnObject.result.error;
             this.warnings.concat(returnObject.result.warnings);
@@ -1928,9 +1988,9 @@ var init_index_es2 = __esm({
         super(parameters, LocalConstructedValueBlock);
         this.idBlock.isConstructed = true;
       }
-      fromBER(inputBuffer, inputOffset, inputLength) {
+      fromBER(inputBuffer, inputOffset, inputLength, context) {
         this.valueBlock.isIndefiniteForm = this.lenBlock.isIndefiniteForm;
-        const resultOffset = this.valueBlock.fromBER(inputBuffer, inputOffset, this.lenBlock.isIndefiniteForm ? inputLength : this.lenBlock.length);
+        const resultOffset = this.valueBlock.fromBER(inputBuffer, inputOffset, this.lenBlock.isIndefiniteForm ? inputLength : this.lenBlock.length, context);
         if (resultOffset === -1) {
           this.error = this.valueBlock.error;
           return resultOffset;
@@ -2093,11 +2153,11 @@ ${values.join("\n")}` : `${blockName} :`;
         super(parameters);
         this.isConstructed = isConstructed;
       }
-      fromBER(inputBuffer, inputOffset, inputLength) {
+      fromBER(inputBuffer, inputOffset, inputLength, context) {
         let resultOffset = 0;
         if (this.isConstructed) {
           this.isHexOnly = false;
-          resultOffset = LocalConstructedValueBlock.prototype.fromBER.call(this, inputBuffer, inputOffset, inputLength);
+          resultOffset = LocalConstructedValueBlock.prototype.fromBER.call(this, inputBuffer, inputOffset, inputLength, context);
           if (resultOffset === -1)
             return resultOffset;
           for (let i = 0; i < this.value.length; i++) {
@@ -2153,7 +2213,7 @@ ${values.join("\n")}` : `${blockName} :`;
         this.idBlock.tagClass = 1;
         this.idBlock.tagNumber = 4;
       }
-      fromBER(inputBuffer, inputOffset, inputLength) {
+      fromBER(inputBuffer, inputOffset, inputLength, context) {
         this.valueBlock.isConstructed = this.idBlock.isConstructed;
         this.valueBlock.isIndefiniteForm = this.lenBlock.isIndefiniteForm;
         if (inputLength === 0) {
@@ -2168,7 +2228,8 @@ ${values.join("\n")}` : `${blockName} :`;
           const buf = view.subarray(inputOffset, inputOffset + inputLength);
           try {
             if (buf.byteLength) {
-              const asn = localFromBER(buf, 0, buf.byteLength);
+              const parseContext = context !== null && context !== void 0 ? context : createFromBerContext();
+              const asn = localFromBERWithChildContext(buf, 0, buf.byteLength, parseContext);
               if (asn.offset !== -1 && asn.offset === inputLength) {
                 this.valueBlock.value = [asn.result];
               }
@@ -2176,7 +2237,7 @@ ${values.join("\n")}` : `${blockName} :`;
           } catch {
           }
         }
-        return super.fromBER(inputBuffer, inputOffset, inputLength);
+        return super.fromBER(inputBuffer, inputOffset, inputLength, context);
       }
       onAsciiEncoding() {
         if (this.valueBlock.isConstructed || this.valueBlock.value && this.valueBlock.value.length) {
@@ -2211,13 +2272,13 @@ ${values.join("\n")}` : `${blockName} :`;
         this.isConstructed = isConstructed;
         this.blockLength = this.valueHexView.byteLength;
       }
-      fromBER(inputBuffer, inputOffset, inputLength) {
+      fromBER(inputBuffer, inputOffset, inputLength, context) {
         if (!inputLength) {
           return inputOffset;
         }
         let resultOffset = -1;
         if (this.isConstructed) {
-          resultOffset = LocalConstructedValueBlock.prototype.fromBER.call(this, inputBuffer, inputOffset, inputLength);
+          resultOffset = LocalConstructedValueBlock.prototype.fromBER.call(this, inputBuffer, inputOffset, inputLength, context);
           if (resultOffset === -1)
             return resultOffset;
           for (const value of this.value) {
@@ -2257,7 +2318,8 @@ ${values.join("\n")}` : `${blockName} :`;
           const buf = intBuffer.subarray(1);
           try {
             if (buf.byteLength) {
-              const asn = localFromBER(buf, 0, buf.byteLength);
+              const parseContext = context !== null && context !== void 0 ? context : createFromBerContext();
+              const asn = localFromBERWithChildContext(buf, 0, buf.byteLength, parseContext);
               if (asn.offset !== -1 && asn.offset === inputLength - 1) {
                 this.value = [asn.result];
               }
@@ -2313,10 +2375,10 @@ ${values.join("\n")}` : `${blockName} :`;
         this.idBlock.tagClass = 1;
         this.idBlock.tagNumber = 3;
       }
-      fromBER(inputBuffer, inputOffset, inputLength) {
+      fromBER(inputBuffer, inputOffset, inputLength, context) {
         this.valueBlock.isConstructed = this.idBlock.isConstructed;
         this.valueBlock.isIndefiniteForm = this.lenBlock.isIndefiniteForm;
-        return super.fromBER(inputBuffer, inputOffset, inputLength);
+        return super.fromBER(inputBuffer, inputOffset, inputLength, context);
       }
       onAsciiEncoding() {
         if (this.valueBlock.isConstructed || this.valueBlock.value && this.valueBlock.value.length) {
@@ -8871,38 +8933,6 @@ var INTERNAL_TO_DCQL_FORMAT = {
   "sd-jwt-vc": "dc+sd-jwt",
   mdoc: "mso_mdoc"
 };
-function classifyMismatch(query, decoded, hasDetail) {
-  if (decoded.format !== query.format) return "format_mismatch";
-  if (query.format === "dc+sd-jwt") {
-    const allowed = query.meta?.vct_values;
-    if (allowed && allowed.length > 0 && !allowed.includes(decoded.vct ?? "")) {
-      return "vct_mismatch";
-    }
-  }
-  if (query.format === "mso_mdoc") {
-    const expected = query.meta?.doctype_value;
-    if (expected && expected !== decoded.doctype) return "doctype_mismatch";
-  }
-  if (query.trusted_authorities && query.trusted_authorities.length > 0) {
-    const decodedAuthIds = decoded.trusted_authority_ids ?? [];
-    const anyMatch = query.trusted_authorities.some(
-      (ta) => ta.values.some((v) => decodedAuthIds.includes(v))
-    );
-    if (!anyMatch) return "trusted_authority_mismatch";
-  }
-  if (hasDetail) return "missing_claims";
-  return "no_credential_found";
-}
-function refineUnmatched(query, decoded, match) {
-  if (match.unmatched.length === 0) return match;
-  const refined = match.unmatched.map((entry) => {
-    const credentialQuery = query.credentials.find((c) => c.id === entry.queryId);
-    if (!credentialQuery) return entry;
-    const specific = classifyMismatch(credentialQuery, decoded, entry.detail !== void 0);
-    return { ...entry, reason: specific };
-  });
-  return { ...match, unmatched: refined };
-}
 async function verifyPresentation(vpToken, query, options) {
   const parsed = await parsePresentation(vpToken, options);
   const dcqlFormat = INTERNAL_TO_DCQL_FORMAT[parsed.format] ?? parsed.format;
@@ -8921,8 +8951,7 @@ async function verifyPresentation(vpToken, query, options) {
   if (parsed.trust?.trustedAuthorityIds && parsed.trust.trustedAuthorityIds.length > 0) {
     decoded.trusted_authority_ids = [...parsed.trust.trustedAuthorityIds];
   }
-  const rawMatch = dcql.matchQuery(query, [decoded]);
-  const match = refineUnmatched(query, decoded, rawMatch);
+  const match = dcql.matchQuery(query, [decoded]);
   const submission = match.satisfied ? dcql.buildSubmission(query, match) : null;
   return {
     parsed,