@harperfast/harper 5.3.0-beta.3 → 5.3.0-beta.4

package/security/certificateVerification/crlVerification.ts

@@ -4,8 +4,8 @@
 
 import * as pkijs from 'pkijs';
 import { loggerWithTag } from '../../utility/logging/logger.ts';
-import { table } from '../../resources/databases.ts';
 import { Resource } from '../../resources/Resource.ts';
+import { transaction } from '../../resources/transaction.ts';
 import type { SourceContext } from '../../resources/ResourceInterface.ts';
 import {
 	extractCRLDistributionPoints,
@@ -17,6 +17,7 @@ import {
 	getCertificateCacheTable as getSharedCertificateCacheTable,
 	pemToBuffer,
 } from './verificationUtils.ts';
+import { declareCRLCacheTable, declareRevokedCertificatesTable } from './verificationTables.ts';
 import { ERROR_CACHE_TTL, CRL_DEFAULT_VALIDITY_PERIOD, CRL_USER_AGENT } from './verificationConfig.ts';
 import type {
 	CertificateVerificationResult,
@@ -68,17 +69,12 @@ class CertificateRevocationListSource extends Resource {
 		const { distributionPoint, issuerPem: issuerPemStr, config } = requestContext;
 
 		try {
-			const result = await downloadAndParseCRL(distributionPoint, issuerPemStr, config.timeout);
+			const { entry } = await downloadAndParseCRLOnce(distributionPoint, issuerPemStr, config);
 
 			// Set expiration - use the CRL's nextUpdate time or configured TTL, whichever is sooner
-			const crlExpiry = result.next_update;
-			const configExpiry = Date.now() + config.cacheTtl;
-			const expiresAt = Math.min(crlExpiry, configExpiry);
+			context.expiresAt = Math.min(entry.next_update, Date.now() + config.cacheTtl);
 
-			return {
-				...result,
-				expiresAt,
-			};
+			return entry;
 		} catch (error) {
 			logger.error?.(`CRL fetch error for: ${distributionPoint} - ${error}`);
 
@@ -89,7 +85,7 @@ class CertificateRevocationListSource extends Resource {
 			// Check failure mode
 			if (config.failureMode === 'fail-closed') {
 				// Cache the error for faster recovery
-				const expiresAt = Date.now() + ERROR_CACHE_TTL;
+				context.expiresAt = Date.now() + ERROR_CACHE_TTL;
 
 				return {
 					crl_id: id,
@@ -97,9 +93,8 @@ class CertificateRevocationListSource extends Resource {
 					issuer_dn: 'unknown',
 					crl_blob: Buffer.alloc(0),
 					this_update: Date.now(),
-					next_update: expiresAt,
+					next_update: context.expiresAt,
 					signature_valid: false,
-					expiresAt,
 				};
 			}
 
@@ -111,42 +106,12 @@ class CertificateRevocationListSource extends Resource {
 }
 
 // Lazy-load Harper tables
-let crlCacheTable: ReturnType<typeof table>;
-let revokedCertificateTable: ReturnType<typeof table>;
+let crlCacheTable: ReturnType<typeof declareCRLCacheTable>;
+let revokedCertificateTable: ReturnType<typeof declareRevokedCertificatesTable>;
 
 function getCRLCacheTable() {
 	if (!crlCacheTable) {
-		crlCacheTable = table({
-			table: 'hdb_crl_cache',
-			database: 'system',
-			attributes: [
-				{
-					name: 'distribution_point',
-					isPrimaryKey: true,
-				},
-				{
-					name: 'issuer_dn',
-				},
-				{
-					name: 'crl_blob',
-				},
-				{
-					name: 'this_update',
-				},
-				{
-					name: 'next_update',
-				},
-				{
-					name: 'signature_valid',
-				},
-				{
-					name: 'expiresAt',
-					expiresAt: true,
-					indexed: true,
-				},
-			],
-		});
-
+		crlCacheTable = declareCRLCacheTable();
 		// Configure the caching source
 		(crlCacheTable as any).sourcedFrom(CertificateRevocationListSource);
 	}
@@ -154,44 +119,7 @@ function getCRLCacheTable() {
 }
 
 function getRevokedCertificateTable() {
-	if (!revokedCertificateTable) {
-		revokedCertificateTable = table({
-			table: 'hdb_revoked_certificates',
-			database: 'system',
-			attributes: [
-				{
-					name: 'composite_id',
-					isPrimaryKey: true,
-				},
-				{
-					name: 'serial_number',
-					indexed: true,
-				},
-				{
-					name: 'issuer_key_id',
-					indexed: true,
-				},
-				{
-					name: 'revocation_date',
-				},
-				{
-					name: 'revocation_reason',
-				},
-				{
-					name: 'crl_source',
-					indexed: true, // Links to CRL cache
-				},
-				{
-					name: 'crl_next_update',
-				},
-				{
-					name: 'expiresAt',
-					expiresAt: true,
-					indexed: true,
-				},
-			],
-		});
-	}
+	revokedCertificateTable ??= declareRevokedCertificatesTable();
 	return revokedCertificateTable;
 }
 
@@ -345,9 +273,15 @@ export async function performCRLCheck(
 		const crlStatus = await checkCRLFreshness(distributionPoints, issuerPem, config);
 
 		if (crlStatus.upToDate) {
-			// CRL was just fetched/refreshed — re-check the revoked table since it may have
-			// been populated by processRevokedCertificates during the download above
-			const revokedEntryFresh = await (revokedTable as any).get(compositeId);
+			// A CRL this check downloaded decides it: by now another thread may have replaced the stored set with
+			// a different generation of that CRL
+			if (crlStatus.revokedIds) {
+				return crlStatus.revokedIds.has(compositeId)
+					? { status: 'revoked', reason: 'unspecified', source: crlStatus.source }
+					: { status: 'good', source: crlStatus.source };
+			}
+			// Outside the verdict fill's transaction: on LMDB its read snapshot predates rows committed since
+			const revokedEntryFresh = await (revokedTable as any).get(compositeId, {});
 			if (revokedEntryFresh) {
 				const entry = revokedEntryFresh as any;
 				const now = Date.now();
@@ -392,7 +326,7 @@ async function checkCRLFreshness(
 	distributionPoints: string[],
 	issuerPem: string,
 	config: CRLConfig
-): Promise<{ upToDate: boolean; reason?: string; source?: string }> {
+): Promise<{ upToDate: boolean; reason?: string; source?: string; revokedIds?: Set<string> }> {
 	const now = Date.now();
 
 	// Check each distribution point
@@ -416,8 +350,9 @@ async function checkCRLFreshness(
 			}
 
 			// If no valid cached CRL, download and parse fresh
+			let revokedIds: Set<string> | undefined;
 			if (!crlData) {
-				crlData = await downloadAndParseCRL(distributionPoint, issuerPem, config.timeout);
+				({ entry: crlData, revokedIds } = await downloadAndParseCRLOnce(distributionPoint, issuerPem, config));
 			}
 
 			// Check if CRL is current
@@ -426,15 +361,15 @@ async function checkCRLFreshness(
 				// Store in cache for future use (only if we downloaded it fresh)
 				if (!cachedCRL) {
 					try {
-						await (crlTable as any).put(distributionPoint, crlData);
+						await (crlTable as any).put(distributionPoint, crlData, { expiresAt: crlExpiry });
 					} catch {
 						// Failed to cache, but continue anyway
 					}
 				}
 
-				return { upToDate: true, source: distributionPoint };
+				return { upToDate: true, source: distributionPoint, revokedIds };
 			} else if (crlExpiry + config.gracePeriod > now) {
-				return { upToDate: true, source: distributionPoint };
+				return { upToDate: true, source: distributionPoint, revokedIds };
 			} else {
 				return { upToDate: false, reason: 'crl-expired' };
 			}
@@ -451,23 +386,43 @@ async function checkCRLFreshness(
 	return { upToDate: false, reason: 'no-current-crl-data' };
 }
 
+// Concurrent checks of certificates from one CA share one download and replacement per distribution point on
+// this thread; each replacing the same rows would make their commits conflict, and past the retry limit that
+// fails the check. The key holds every input the download uses, so no check inherits another's deadline.
+const crlDownloads = new Map<string, Promise<DownloadedCRL>>();
+
+function downloadAndParseCRLOnce(distributionPoint: string, issuerPemStr: string, config: CRLConfig) {
+	const key = `${distributionPoint}\n${config.gracePeriod}\n${config.timeout}\n${issuerPemStr}`;
+	let download = crlDownloads.get(key);
+	if (!download) {
+		download = downloadAndParseCRL(distributionPoint, issuerPemStr, config).finally(() => crlDownloads.delete(key));
+		crlDownloads.set(key, download);
+	}
+	return download;
+}
+
+interface DownloadedCRL {
+	entry: CRLCacheEntry;
+	revokedIds: Set<string>;
+}
+
 /**
  * Download and parse a CRL from a distribution point
  * @param distributionPoint - CRL URL
  * @param issuerPemStr - Issuer certificate for signature verification
- * @param timeout - Download timeout in milliseconds
- * @returns Parsed CRL entry for caching
+ * @param config - CRL configuration (download timeout, grace period)
+ * @returns Parsed CRL entry for caching, and the certificates it revokes
  */
 async function downloadAndParseCRL(
 	distributionPoint: string,
 	issuerPemStr: string,
-	timeout: number
-): Promise<CRLCacheEntry> {
+	config: CRLConfig
+): Promise<DownloadedCRL> {
 	// Download the CRL
 	// Note: Using fetch here since CRL downloads are cached and infrequent
 	// (typically one per CA), so this is not a hot path
 	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort(), timeout);
+	const timeoutId = setTimeout(() => controller.abort(), config.timeout);
 
 	try {
 		const response = await fetch(distributionPoint, {
@@ -477,8 +432,6 @@ async function downloadAndParseCRL(
 			},
 		});
 
-		clearTimeout(timeoutId);
-
 		if (!response.ok) {
 			throw new Error(`CRL download failed: ${response.status}`);
 		}
@@ -523,93 +476,80 @@ async function downloadAndParseCRL(
 			this_update: thisUpdate,
 			next_update: nextUpdate,
 			signature_valid: signatureValid,
-			expiresAt: nextUpdate,
 		};
 
 		// Process revoked certificates before returning so the revoked table is populated
 		// before any subsequent lookup in performCRLCheck
-		await processRevokedCertificates(crl, issuerPemStr, distributionPoint, nextUpdate);
-
-		return cacheEntry;
+		const revokedIds = await processRevokedCertificates(
+			crl,
+			issuerPemStr,
+			distributionPoint,
+			nextUpdate,
+			config.gracePeriod ?? 0
+		);
+
+		return { entry: cacheEntry, revokedIds };
 	} finally {
 		clearTimeout(timeoutId);
 	}
 }
 
 /**
- * Process revoked certificates from CRL and store them in the revoked certificates table
+ * Replace this CRL's rows in the revoked certificates table with its current revocations
  * @param crl - Parsed CRL object
  * @param issuerPemStr - Issuer certificate PEM
  * @param distributionPoint - CRL distribution point URL
  * @param nextUpdate - When this CRL expires
+ * @param gracePeriod - How long past nextUpdate performCRLCheck still honors a revocation
+ * @returns The composite ids of the revoked certificates
  */
 async function processRevokedCertificates(
 	crl: pkijs.CertificateRevocationList,
 	issuerPemStr: string,
 	distributionPoint: string,
-	nextUpdate: number
-): Promise<void> {
+	nextUpdate: number,
+	gracePeriod: number
+): Promise<Set<string>> {
 	const revokedTable = getRevokedCertificateTable();
 	const issuerKeyId = extractIssuerKeyId(issuerPemStr);
 	const cacheKey = distributionPoint;
+	const revokedIds = new Set<string>();
 
-	// Clear existing entries for this CRL to ensure data consistency
-	// This prevents stale revocation data when certificates are removed from updated CRLs
-	try {
+	// All or nothing, so a failure leaves the previous revocations rather than a partial set that would read
+	// as good. Its own transaction, not the verdict fill's, so the rows are committed before performCRLCheck
+	// reads them back; the context's expiresAt is what each row stores as its expiry.
+	await transaction({ expiresAt: nextUpdate + gracePeriod }, async () => {
 		await clearExistingCRLEntries(revokedTable, cacheKey);
-	} catch (error) {
-		logger.warn?.(`Failed to clear existing CRL entries: ${error}`);
-		// Continue with processing - partial cleanup is better than no update
-	}
 
-	// Add new revoked certificates
-	if (crl.revokedCertificates) {
-		for (const revokedCert of crl.revokedCertificates) {
-			try {
-				// Extract serial number using PKI.js - same method as extractSerialNumber() function
-				// This gives us the clean serial number without ASN.1 encoding
-				const serialHex = revokedCert.userCertificate.valueBlock.valueHexView;
-
-				if (!serialHex) {
-					logger.warn?.('Could not extract serial number from revoked certificate');
-					continue;
-				}
+		for (const revokedCert of crl.revokedCertificates ?? []) {
+			// Extract serial number using PKI.js - same method as extractSerialNumber() function
+			// This gives us the clean serial number without ASN.1 encoding
+			const serialHex = revokedCert.userCertificate.valueBlock.valueHexView;
+			if (!serialHex)
+				throw new Error(`A revoked certificate in the CRL from ${distributionPoint} has no serial number`);
 
-				const serialNumber = Array.from(serialHex)
-					.map((b) => b.toString(16).padStart(2, '0'))
-					.join('');
-
-				const compositeId = createRevokedCertificateId(issuerKeyId, serialNumber);
-
-				// Extract revocation date
-				const revocationDate = revokedCert.revocationDate.value.getTime();
+			const serialNumber = Buffer.from(serialHex).toString('hex');
 
+			const entry: RevokedCertificateEntry = {
+				composite_id: createRevokedCertificateId(issuerKeyId, serialNumber),
+				serial_number: serialNumber,
+				issuer_key_id: issuerKeyId,
+				revocation_date: revokedCert.revocationDate.value.getTime(),
 				// For now, skip complex extension parsing and just use default reason
-				const revocationReason = 'unspecified';
-
-				const entry: RevokedCertificateEntry = {
-					composite_id: compositeId,
-					serial_number: serialNumber,
-					issuer_key_id: issuerKeyId,
-					revocation_date: revocationDate,
-					revocation_reason: revocationReason,
-					crl_source: cacheKey,
-					crl_next_update: nextUpdate,
-					expiresAt: nextUpdate,
-				};
+				revocation_reason: 'unspecified',
+				crl_source: cacheKey,
+				crl_next_update: nextUpdate,
+			};
 
-				await (revokedTable as any).put(entry.composite_id, entry);
-			} catch (error) {
-				logger.warn?.(`Failed to process revoked certificate: ${error}`);
-				// Continue with other certificates
-			}
+			revokedIds.add(entry.composite_id);
+			await (revokedTable as any).put(entry.composite_id, entry);
 		}
-	}
+	});
+	return revokedIds;
 }
 
 /**
- * Clear existing revoked certificate entries for a specific CRL source
- * This ensures data consistency when CRLs are updated and certificates are removed
+ * Delete the revoked certificate entries stored for a specific CRL source
  * @param revokedTable - Harper table for revoked certificates
  * @param crlSource - CRL cache key to identify entries to remove
  */
@@ -617,27 +557,9 @@ async function clearExistingCRLEntries(
 	revokedTable: ReturnType<typeof getRevokedCertificateTable>,
 	crlSource: string
 ): Promise<void> {
-	// We need to find all entries with the matching crl_source and delete them individually
-	try {
-		// Use Harper's search capabilities to find entries by crl_source
-		// Note: This assumes the crl_source field is indexed (which it is)
-		const existingEntries = (revokedTable as any).search([
-			{
-				attribute: 'crl_source',
-				value: crlSource,
-			},
-		]);
-
-		for await (const entry of existingEntries) {
-			try {
-				await (revokedTable as any).delete((entry as any).composite_id);
-			} catch (deleteError) {
-				logger.warn?.(`Failed to delete revoked certificate entry: ${deleteError}`);
-				// Continue with other entries
-			}
-		}
-	} catch (searchError) {
-		logger.error?.(`Failed to search for existing CRL entries: ${searchError}`);
-		throw searchError;
+	const compositeIds: string[] = [];
+	for await (const entry of (revokedTable as any).search([{ attribute: 'crl_source', value: crlSource }])) {
+		compositeIds.push((entry as any).composite_id);
 	}
+	for (const compositeId of compositeIds) await (revokedTable as any).delete(compositeId);
 }

package/security/certificateVerification/types.ts

@@ -34,7 +34,6 @@ export interface CertificateCacheEntry {
 	status: CertificateStatus;
 	reason?: string;
 	checked_at: number;
-	expiresAt: number;
 	method: VerificationMethod;
 }
 
@@ -45,7 +44,6 @@ export interface CRLCacheEntry {
 	this_update: number;
 	next_update: number;
 	signature_valid: boolean;
-	expiresAt: number;
 }
 
 export interface RevokedCertificateEntry {
@@ -56,7 +54,6 @@ export interface RevokedCertificateEntry {
 	revocation_reason?: string;
 	crl_source: string; // Links to CRLCacheEntry.crl_id
 	crl_next_update: number;
-	expiresAt: number;
 }
 
 export interface CertificateChainEntry {

package/security/certificateVerification/verificationTables.ts

@@ -0,0 +1,124 @@
+/**
+ * The tables certificate verification caches into. Every node declares them in this shape at every writable
+ * start, whether or not it ever verifies a certificate: they replicate, and only an `expiration` stored in the
+ * node's own catalog arms the cleanup scan that removes the rows replicated to it. See dataLayer/DESIGN.md,
+ * "System table bootstrap".
+ */
+
+import { databases, table, type Table } from '../../resources/databases.ts';
+import { ServerError } from '../../utility/errors/hdbError.ts';
+import { SYSTEM_SCHEMA_NAME } from '../../utility/hdbTerms.ts';
+import { CRL_DEFAULTS, OCSP_DEFAULTS } from './configValidation.ts';
+import { CRL_DEFAULT_VALIDITY_PERIOD } from './verificationConfig.ts';
+
+export const CERTIFICATE_CACHE_TABLE = 'hdb_certificate_cache';
+export const CRL_CACHE_TABLE = 'hdb_crl_cache';
+export const REVOKED_CERTIFICATES_TABLE = 'hdb_revoked_certificates';
+
+// A table's expiration bounds only a row written without an expiry of its own; every writer here sets one.
+// For a verdict, the shorter of the two methods' default lifetimes.
+const CERTIFICATE_CACHE_EXPIRATION_SECONDS = Math.min(OCSP_DEFAULTS.cacheTtl, CRL_DEFAULTS.cacheTtl) / 1000;
+const CRL_CACHE_EXPIRATION_SECONDS = CRL_DEFAULTS.cacheTtl / 1000;
+// Never shorter than a revocation's own window, which would admit a revoked certificate early.
+const REVOKED_CERTIFICATES_EXPIRATION_SECONDS = (CRL_DEFAULT_VALIDITY_PERIOD + CRL_DEFAULTS.gracePeriod) / 1000;
+
+const MAX_OUTSTANDING_EVICTIONS = 100;
+
+export function declareCertificateCacheTable(): Table {
+	return table<Table>({
+		table: CERTIFICATE_CACHE_TABLE,
+		database: SYSTEM_SCHEMA_NAME,
+		schemaDefined: true,
+		expiration: CERTIFICATE_CACHE_EXPIRATION_SECONDS,
+		attributes: [
+			{ name: 'certificate_id', isPrimaryKey: true },
+			{ name: 'status' },
+			{ name: 'reason' },
+			{ name: 'checked_at' },
+			{ name: 'method' },
+		],
+	});
+}
+
+export function declareCRLCacheTable(): Table {
+	return table<Table>({
+		table: CRL_CACHE_TABLE,
+		database: SYSTEM_SCHEMA_NAME,
+		schemaDefined: true,
+		expiration: CRL_CACHE_EXPIRATION_SECONDS,
+		attributes: [
+			{ name: 'distribution_point', isPrimaryKey: true },
+			{ name: 'issuer_dn' },
+			{ name: 'crl_blob' },
+			{ name: 'this_update' },
+			{ name: 'next_update' },
+			{ name: 'signature_valid' },
+		],
+	});
+}
+
+export function declareRevokedCertificatesTable(): Table {
+	return table<Table>({
+		table: REVOKED_CERTIFICATES_TABLE,
+		database: SYSTEM_SCHEMA_NAME,
+		schemaDefined: true,
+		expiration: REVOKED_CERTIFICATES_EXPIRATION_SECONDS,
+		attributes: [
+			{ name: 'composite_id', isPrimaryKey: true },
+			{ name: 'serial_number', indexed: true },
+			{ name: 'issuer_key_id', indexed: true },
+			{ name: 'revocation_date' },
+			{ name: 'revocation_reason' },
+			{ name: 'crl_source', indexed: true },
+			{ name: 'crl_next_update' },
+		],
+	});
+}
+
+/**
+ * Declares the three tables and waits for any index backfill that starts, reading its outcome back from the
+ * catalog because a failed backfill still settles. After the first declaration on a node, it reclaims the
+ * verdicts cached before a verdict carried its own expiry.
+ */
+export async function ensureCertificateVerificationTables(): Promise<void> {
+	const reclaimLegacyVerdicts = databases.system?.[CERTIFICATE_CACHE_TABLE]?.expirationMS === undefined;
+	const declared = [declareCertificateCacheTable(), declareCRLCacheTable(), declareRevokedCertificatesTable()];
+	if (reclaimLegacyVerdicts) await evictVerdictsWithoutExpiry(declared[0]);
+	const incomplete: string[] = [];
+	for (const Table of declared) {
+		await Table.indexingOperation;
+		for (const { name, indexed } of Table.attributes) {
+			if (!indexed) continue;
+			const descriptor = Table.dbisDB.getSync(`${Table.tableName}/${name}`);
+			if (descriptor?.indexingFailed || descriptor?.indexingPID) incomplete.push(`${Table.tableName}.${name}`);
+		}
+	}
+	if (incomplete.length > 0) {
+		throw new ServerError(
+			`The index backfill of system.${incomplete.join(', system.')} did not complete; the next start retries it`
+		);
+	}
+}
+
+/**
+ * Those verdicts were stored with no expiry, so they would never be removed. Their keys are never read again
+ * (createCacheKey hashes a key version), so this only reclaims their space, with local evictions.
+ */
+async function evictVerdictsWithoutExpiry(CertificateCache: any): Promise<void> {
+	const outstanding: unknown[] = new Array(MAX_OUTSTANDING_EVICTIONS);
+	let evictions = 0;
+	for (const { key, value, version, expiresAt } of CertificateCache.primaryStore.getRange({
+		start: false,
+		versions: true,
+		snapshot: false,
+		lazy: true,
+	})) {
+		if (value == null || expiresAt != undefined) continue;
+		const slot = evictions++ % MAX_OUTSTANDING_EVICTIONS;
+		await outstanding[slot];
+		outstanding[slot] = CertificateCache.evict(key, value, version);
+		// yields between evictions, as the table's own cleanup scan does, so LMDB can renew its read transaction
+		await new Promise(setImmediate);
+	}
+	await Promise.all(outstanding);
+}

package/security/certificateVerification/verificationUtils.ts

@@ -6,7 +6,7 @@ import { createHash } from 'node:crypto';
 import * as pkijs from 'pkijs';
 import * as asn1js from 'asn1js';
 import { loggerWithTag } from '../../utility/logging/logger.ts';
-import { table } from '../../resources/databases.ts';
+import { declareCertificateCacheTable } from './verificationTables.ts';
 import type { PeerCertificate, CertificateChainEntry } from './types.ts';
 
 const logger = loggerWithTag('cert-verification-utils');
@@ -297,6 +297,10 @@ export function pemToBuffer(pem: string): ArrayBuffer {
 	return buffer;
 }
 
+// A verdict cached before verdicts carried their own expiry has none and would read as fresh forever, so the
+// keys it was stored under are never read again.
+const VERDICT_KEY_VERSION = 2;
+
 /**
  * Create a cache key for certificate verification
  * @param certPem - Certificate in PEM format
@@ -316,6 +320,7 @@ export function createCacheKey(
 		issuerPem,
 		method,
 		...additionalData,
+		keyVersion: VERDICT_KEY_VERSION,
 	};
 	const cacheKeyHash = createHash('sha256').update(JSON.stringify(cacheData)).digest('hex');
 	return `${method}:${cacheKeyHash}`;
@@ -410,38 +415,9 @@ export function extractIssuerKeyId(certPem: string): string {
  * Get shared certificate verification cache table
  * @returns Harper table instance for certificate verification cache
  */
-// Cache the certificate cache table instance to avoid recreating it
-let certificateCacheTable: ReturnType<typeof table> | null = null;
+let certificateCacheTable: ReturnType<typeof declareCertificateCacheTable> | null = null;
 
 export function getCertificateCacheTable() {
-	if (!certificateCacheTable) {
-		certificateCacheTable = table({
-			table: 'hdb_certificate_cache',
-			database: 'system',
-			attributes: [
-				{
-					name: 'certificate_id',
-					isPrimaryKey: true,
-				},
-				{
-					name: 'status', // 'good', 'revoked', 'unknown'
-				},
-				{
-					name: 'reason',
-				},
-				{
-					name: 'checked_at',
-				},
-				{
-					name: 'expiresAt',
-					expiresAt: true,
-					indexed: true,
-				},
-				{
-					name: 'method', // 'ocsp' or 'crl'
-				},
-			],
-		});
-	}
+	certificateCacheTable ??= declareCertificateCacheTable();
 	return certificateCacheTable;
 }

package/security/jsLoader.ts

@@ -32,7 +32,7 @@ import {
 	realpathSync,
 } from 'node:fs';
 import { EventEmitter } from 'node:events';
-import { whenComponentsLoaded } from '../server/threads/threadServer.js';
+import { whenComponentsLoaded, bootLoadsComponents } from '../server/threads/threadServer.js';
 import { thisThreadOwnsApplication } from '../server/threads/isolatedApplications.ts';
 
 type Lockdown = 'none' | 'freeze' | 'ses' | 'freeze-after-load';
@@ -88,6 +88,14 @@ export async function scopedImport(filePath: string | URL, scope?: ApplicationSc
 	return runWithComponentBinding(scope?.name, () => importScoped(moduleUrl, scope));
 }
 
+/**
+ * True where `freeze-after-load` freezes this thread's intrinsics once its boot load finishes, so no later
+ * load here matches a boot load.
+ */
+export function laterLoadsMeetFrozenIntrinsics(): boolean {
+	return APPLICATIONS_LOCKDOWN === 'freeze-after-load' && bootLoadsComponents();
+}
+
 async function importScoped(moduleUrl: string, scope?: ApplicationScope) {
 	try {
 		const loaderMode = scope?.mode;