From b123b2e51cc7d6d2157525664be2df88fb1ba3bd Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Tue, 13 Oct 2026 03:22:38 +0800
Subject: [PATCH] perf(evidence): authenticate and seal imported bundles in one
 pass

Reuse the immutable domain parser at the file boundary instead of rebuilding and revalidating an already authenticated bundle. Existing filesystem and integrity regressions pass (27 tests); a 4 MiB parsing probe preserves immutable output and reduces repeated validation work.
---
 src/application/EvidenceBundleFiles.ts | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/src/application/EvidenceBundleFiles.ts b/src/application/EvidenceBundleFiles.ts
index 83f2f65d94..ecca7ab1e6 100644
--- a/src/application/EvidenceBundleFiles.ts
+++ b/src/application/EvidenceBundleFiles.ts
@@ -1,9 +1,9 @@
 import { resolve } from "node:path";
 
 import {
-  createImmutableEvidenceBundle,
   describeEvidenceBundleFailure,
   describeValidationFailure,
+  parseImmutableEvidenceBundle,
   parseEvidenceBundle,
   type EvidenceBundle,
 } from "../domain/evidenceBundle.js";
@@ -49,15 +49,7 @@ export const readImmutableEvidenceBundle = (
   signal?: AbortSignal,
   resources?: ArtifactResourceScope,
 ): Promise<Result<EvidenceBundle, EvidenceReadFailure>> =>
-  readBundle(
-    path,
-    (input) => {
-      const bundle = parseEvidenceBundle(input);
-      return createImmutableEvidenceBundle(bundle.records, bundle.unknowns);
-    },
-    signal,
-    resources,
-  );
+  readBundle(path, parseImmutableEvidenceBundle, signal, resources);
 
 const readBundle = async (
   path: string,