@tier0/opcua-client 0.2.0 → 0.4.1

package/README.md

@@ -12,6 +12,10 @@ High-scale OPC UA client nodes for Node-RED, backed by open62541 and designed fo
 
 The OPC UA server remains a separate service. This package contains client and collection nodes only.
 
+Every node includes bilingual Chinese and English guidance in the Node-RED Help
+sidebar, covering its purpose, message contract, key settings, and operational
+notes for industrial deployments.
+
 ## Point contract
 
 Browse output can be wired directly into Read or Subscribe. In the Read and Write editors, manually added and imported points appear in one editable list. Import accepts JSON/CSV, merges by NodeId, and immediately shows the parsed rows. Both nodes also accept arrays, JSON strings/buffers, or CSV strings/buffers dynamically:
@@ -35,6 +39,14 @@ Browse output can be wired directly into Read or Subscribe. In the Read and Writ
 
 Subscription commands are `replace`, `add`, `remove`, and `clear`. Read and Write split large arrays into configurable service batches; they do not loop over scalar OPC UA requests.
 
+New Read nodes default to compact results: `nodeId`, optional `alias`, `value`,
+`statusCode`, and `sourceTimestamp`. Browse metadata and subscription-only point
+settings are not repeated on every Read. **Value only** emits an array in point-
+list order for batch output and a scalar for single/split output. **Full
+metadata** preserves the original descriptor-rich output and includes client
+diagnostics. Flow JSON created before this option existed continues to use Full
+metadata until the node is edited and a result detail is selected.
+
 Subscription notifications use a bounded native C++ queue and cross into JavaScript in batches. In Node-RED batch mode, changes from every server Subscription are merged and emitted when 500 values are ready or the default 50 ms flush window expires. Queue options are:
 
 - `callbackBatchSize`: maximum changes per native callback and Node-RED output message.
@@ -46,6 +58,21 @@ Subscription notifications use a bounded native C++ queue and cross into JavaScr
 
 `timestampMode` defaults to `source`, avoiding an unnecessary server timestamp on every high-rate notification. Advanced settings can request `both`, `server`, or `neither`. Notification outputs contain the changing value/status/timestamp plus useful custom point metadata such as `alias`; monitoring configuration that is constant for the lifetime of the item is not repeated on every change.
 
+New Subscribe nodes default to compact notifications: `nodeId`, optional
+`alias`, `value`, `statusCode`, and `sourceTimestamp`. Browse metadata, native
+MonitoredItem handles, and sharding details are omitted. In batch **Value only**
+mode, `msg.payload` is a value array and `msg.opcua.identifiers` is the matching
+NodeId/alias array. Parallel arrays preserve order and repeated changes from the
+same point. **Full metadata** preserves the original output for diagnostics and
+Flow JSON created before this option existed continues to use it.
+
+New Subscribe nodes also default to server queue size `1`, `discardOldest=true`,
+and native queue mode `latest`. This keeps real-time state current during
+backpressure instead of replaying stale values. Set queue mode to `all` and
+increase the server queue size for pulses, alarms, counters, or history capture
+where every intermediate transition must be retained. Existing Flow JSON keeps
+its saved queue settings; runtime fallbacks remain compatible with older nodes.
+
 Large point sets are automatically split across server Subscriptions. `maxItemsPerSubscription` defaults to 5,000 and acts as the fallback safety limit. When the server advertises `MaxMonitoredItemsPerSubscription`, the node uses the smaller limit. Status messages expose `subscriptionCount`, `subscriptionIds`, `desired`, `monitored`, and `failed`.
 
 Every batch includes queue diagnostics in `msg.opcua.queue`, including depth, capacity, maximum depth, enqueued, delivered, dropped, coalesced, batch sequence, and maximum queue lag. Queue overflow is also reported through the node status and warning log; it is never silent.
@@ -64,6 +91,22 @@ The native command queue defaults to 256 pending commands and is configurable as
 
 `client.getDiagnostics().commandQueue` reports `depth`, `capacity`, `maxDepth`, `active`, `enqueued`, `completed`, `rejected`, and `timedOut`.
 
+## Session ownership and duplicate-connection governance
+
+One `tier0-opcua-connection` configuration node owns one native client and one
+OPC UA Session. Read, Write, Browse, and Subscribe nodes that reference that
+same configuration reuse the Session, including when the configuration is
+shared across Node-RED flow tabs. Different Connection configuration nodes are
+never merged implicitly because separate Sessions may be required for isolation.
+
+When equivalent Connection configurations target the same endpoint, security
+mode/policy, and user identity, the runtime emits a warning that an additional
+Session will be created. Reuse the existing Connection configuration to avoid
+duplicate Server load. Enable **Allow parallel Session** only when the extra
+Session is intentional. Read/Write diagnostics and subscription status outputs
+include `connectionGovernance`, with the equivalent and active configuration
+counts.
+
 ## Connection and subscription recovery
 
 The native client reports secure-channel, session, connectivity-check, and subscription-inactivity transitions to a JavaScript connection supervisor. Recoverable channel interruptions keep the native client alive. Terminal failures replace the native client and retry with exponential backoff, 20% jitter, and the configured maximum interval. Operations fail fast with `OPCUA_RECONNECTING` while the connection is unavailable instead of building an unbounded request queue.
@@ -129,8 +172,14 @@ uses the selected secure endpoint and its advertised UserTokenPolicy.
 
 The Connection editor can call `GetEndpoints`, filters the response to the
 implemented policies, and selects an endpoint compatible with Anonymous or
-Username authentication. Certificate, private-key, trust-list, and CRL entries
-are filesystem paths visible to the Node-RED runtime.
+Username authentication. Client certificates, private keys, trusted Server/CA
+certificates, and CRLs can be uploaded from the editor. Uploaded files are kept
+under `<Node-RED userDir>/opcua-pki/<connection>/` with owner-only file
+permissions and the managed runtime path is stored in the Connection
+configuration. Existing and advanced deployments can still enter filesystem
+paths visible to the Node-RED runtime directly. Uploaded private-key bytes are
+never stored in the Flow JSON, and removing the Connection node removes its
+managed security-file directory.
 
 ## Offline installation
 
@@ -141,7 +190,7 @@ Node-RED Alpine image, the pinned open62541 v1.4.16 source archive, and its
 not contact npm or GitHub and does not invoke a compiler:
 
 ```bash
-npm install ./tier0-opcua-client-0.1.0.tgz --offline
+npm install ./tier0-opcua-client-0.4.1.tgz --offline
 ```
 
 The loader uses the bundled native addon directly. Set

package/lib/connection-registry.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const crypto = require('node:crypto');
+
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [key, canonicalize(value[key])])
+    );
+  }
+  return value;
+}
+
+function connectionSignature(options) {
+  const source = options || {};
+  const identity = {
+    endpoint: String(source.endpoint || '').trim(),
+    securityMode: String(source.securityMode || 'None'),
+    securityPolicy: String(source.securityPolicy || 'None'),
+    user: String(source.user || '').trim(),
+  };
+  const serialized = JSON.stringify(canonicalize(identity));
+  return crypto.createHash('sha256').update(serialized).digest('hex');
+}
+
+class ConnectionRegistry {
+  constructor() {
+    this.entries = new Map();
+    this.configurationCount = 0;
+  }
+
+  register(options) {
+    const signature = connectionSignature(options);
+    let records = this.entries.get(signature);
+    if (!records) {
+      records = new Set();
+      this.entries.set(signature, records);
+    }
+    const record = {};
+    records.add(record);
+    this.configurationCount += 1;
+    let unregistered = false;
+
+    return {
+      duplicate: records.size > 1,
+      diagnostics: () => ({
+        equivalentConfigurations: records.size,
+        duplicateConfiguration: records.size > 1,
+        activeConfigurations: this.configurationCount,
+      }),
+      unregister: () => {
+        if (unregistered) return false;
+        unregistered = true;
+        records.delete(record);
+        this.configurationCount = Math.max(0, this.configurationCount - 1);
+        if (records.size === 0) this.entries.delete(signature);
+        return true;
+      },
+    };
+  }
+
+  get size() {
+    return this.configurationCount;
+  }
+}
+
+module.exports = { ConnectionRegistry, connectionSignature };

package/lib/security-file-store.js

@@ -0,0 +1,119 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs/promises');
+const path = require('node:path');
+
+const MAX_SECURITY_FILE_SIZE = 2 * 1024 * 1024;
+
+const FILE_KINDS = Object.freeze({
+  clientCertificate: {
+    prefix: 'client-certificate',
+    extensions: new Set(['.der', '.pem', '.crt', '.cer']),
+  },
+  privateKey: {
+    prefix: 'client-private-key',
+    extensions: new Set(['.der', '.pem', '.key']),
+  },
+  trustedCertificate: {
+    prefix: 'trusted-certificate',
+    extensions: new Set(['.der', '.pem', '.crt', '.cer']),
+  },
+  revocationList: {
+    prefix: 'revocation-list',
+    extensions: new Set(['.der', '.pem', '.crl']),
+  },
+});
+
+function storageError(message, code = 'OPCUA_SECURITY_FILE_INVALID') {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function decodeBase64(value) {
+  const encoded = String(value || '').trim();
+  if (!encoded || encoded.length % 4 !== 0 ||
+      !/^[A-Za-z0-9+/]*={0,2}$/.test(encoded)) {
+    throw storageError('Security file content must be valid base64');
+  }
+  const decoded = Buffer.from(encoded, 'base64');
+  if (!decoded.length || decoded.toString('base64') !== encoded) {
+    throw storageError('Security file content must be valid base64');
+  }
+  return decoded;
+}
+
+function connectionDirectoryName(connectionId) {
+  const value = String(connectionId || '').trim();
+  if (!value || value.length > 256) {
+    throw storageError('A valid Connection node id is required');
+  }
+  return crypto.createHash('sha256').update(value).digest('hex').slice(0, 32);
+}
+
+class SecurityFileStore {
+  constructor(options = {}) {
+    const userDir = path.resolve(String(options.userDir || process.cwd()));
+    this.root = path.join(userDir, 'opcua-pki');
+    this.maxFileSize = Number(options.maxFileSize) || MAX_SECURITY_FILE_SIZE;
+  }
+
+  connectionDirectory(connectionId) {
+    return path.join(this.root, connectionDirectoryName(connectionId));
+  }
+
+  async save({ connectionId, kind, fileName, contentBase64 }) {
+    const definition = FILE_KINDS[kind];
+    if (!definition) throw storageError(`Unsupported OPC UA security file kind: ${kind}`);
+
+    const extension = path.extname(String(fileName || '')).toLowerCase();
+    if (!definition.extensions.has(extension)) {
+      throw storageError(
+        `Unsupported ${kind} file extension; allowed: ${[...definition.extensions].join(', ')}`
+      );
+    }
+
+    const content = decodeBase64(contentBase64);
+    if (content.length > this.maxFileSize) {
+      throw storageError(
+        `Security file exceeds the ${this.maxFileSize} byte limit`,
+        'OPCUA_SECURITY_FILE_TOO_LARGE'
+      );
+    }
+
+    const directory = this.connectionDirectory(connectionId);
+    const sha256 = crypto.createHash('sha256').update(content).digest('hex');
+    const managedName = `${definition.prefix}-${sha256.slice(0, 24)}${extension}`;
+    const managedPath = path.join(directory, managedName);
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    try {
+      await fs.writeFile(managedPath, content, { flag: 'wx', mode: 0o600 });
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+    }
+    await fs.chmod(managedPath, 0o600);
+
+    return {
+      kind,
+      name: path.basename(String(fileName || '')),
+      path: managedPath,
+      size: content.length,
+      sha256,
+      managed: true,
+    };
+  }
+
+  async removeConnection(connectionId) {
+    const directory = this.connectionDirectory(connectionId);
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+}
+
+module.exports = {
+  FILE_KINDS,
+  MAX_SECURITY_FILE_SIZE,
+  SecurityFileStore,
+  connectionDirectoryName,
+  decodeBase64,
+};

package/nodes/browse.html

@@ -43,8 +43,33 @@
   <div class="form-row"><label for="node-input-name">Name</label><input type="text" id="node-input-name"></div>
 </script>
 <script type="text/html" data-help-name="tier0-opcua-browse">
-  <p>Loads the deployed OPC UA connection as a checkbox tree. Checking a parent selects every variable below it. Clearing a child makes its ancestors partially selected.</p>
-  <p>On input the node outputs every saved checked variable, ready for Read or Subscribe. Send <code>msg.opcua.liveBrowse=true</code> to bypass the saved selection and browse live.</p>
+  <section lang="zh-CN">
+    <h3>浏览（Browse）</h3>
+    <p>浏览 OPC UA 地址空间并选择变量点位。Browse 返回节点描述信息，不读取实时值。</p>
+    <h4>配置与输入</h4>
+    <ul>
+      <li>在编辑器中加载树并勾选变量；勾选父节点会选择其下所有变量。</li>
+      <li>收到任意输入消息后，默认输出已经保存的选择。</li>
+      <li>设置 <code>msg.opcua.liveBrowse=true</code> 可忽略保存的选择并实时浏览。</li>
+      <li><code>msg.nodeId</code> 或 <code>msg.topic</code> 可覆盖根 NodeId；默认根节点为 ObjectsFolder。</li>
+    </ul>
+    <h4>输出</h4>
+    <p><code>msg.payload</code> 是点位描述数组，包含 NodeId、名称、Browse 路径、数据类型和访问属性，可直接连接 Read 或 Subscribe。Paged 模式会分批输出，并通过 <code>msg.opcua.command</code> 标记 replace/add。</p>
+  </section>
+  <hr>
+  <section lang="en">
+    <h3>Browse</h3>
+    <p>Browses the OPC UA address space and selects Variable nodes. Browse returns node descriptors; it does not read live values.</p>
+    <h4>Configuration and input</h4>
+    <ul>
+      <li>Load the tree in the editor and check Variables. Checking a parent selects all Variables below it.</li>
+      <li>Any input message outputs the saved selection by default.</li>
+      <li>Set <code>msg.opcua.liveBrowse=true</code> to ignore the saved selection and perform a live Browse.</li>
+      <li><code>msg.nodeId</code> or <code>msg.topic</code> can override the root NodeId; the default root is ObjectsFolder.</li>
+    </ul>
+    <h4>Output</h4>
+    <p><code>msg.payload</code> is an array of point descriptors containing NodeId, names, Browse path, data type, and access attributes. It can feed Read or Subscribe directly. Paged mode emits multiple messages with replace/add in <code>msg.opcua.command</code>.</p>
+  </section>
 </script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-browse', {

package/nodes/connection.html

@@ -4,6 +4,11 @@
   .opcua-standard-note { margin: 0 0 10px 105px; color: var(--red-ui-form-text-color, #666); font-size: 0.9em; }
   .opcua-discovery-result { margin: 6px 0 8px 105px; max-width: 70%; }
   .opcua-discovery-result select { width: 100%; }
+  .opcua-security-path { width: calc(70% - 88px) !important; }
+  .opcua-security-list { display: inline-block; width: 70%; vertical-align: top; }
+  .opcua-security-list textarea { width: 100%; box-sizing: border-box; }
+  .opcua-security-upload { margin-top: 4px; }
+  .opcua-hidden-file { display: none !important; }
 </style>
 <script type="text/html" data-template-name="tier0-opcua-connection">
   <div class="form-row"><label for="node-config-input-endpoint">Endpoint</label><input type="text" id="node-config-input-endpoint" placeholder="opc.tcp://127.0.0.1:4840"></div>
@@ -17,12 +22,13 @@
     <div class="form-row"><label for="node-config-input-securityPolicy">Policy</label><select id="node-config-input-securityPolicy"><option value="None">None</option><option value="Basic256Sha256">Basic256Sha256</option></select></div>
     <div class="form-row"><label for="node-config-input-user">User</label><input type="text" id="node-config-input-user"></div>
     <div class="form-row"><label for="node-config-input-password">Password</label><input type="password" id="node-config-input-password"></div>
-    <div class="form-row opcua-secure-field"><label for="node-config-input-certificate">Client certificate</label><input type="text" id="node-config-input-certificate" placeholder="/path/to/client.der"></div>
-    <div class="form-row opcua-secure-field"><label for="node-config-input-privateKey">Client private key</label><input type="text" id="node-config-input-privateKey" placeholder="/path/to/client-key.pem"></div>
+    <div class="form-row opcua-secure-field"><label for="node-config-input-certificate">Client certificate</label><input type="text" class="opcua-security-path" id="node-config-input-certificate" placeholder="Upload or enter /path/to/client.der"> <button type="button" class="red-ui-button" id="node-config-upload-certificate"><i class="fa fa-upload"></i> Upload</button><input type="file" class="opcua-hidden-file" id="node-config-file-certificate" accept=".der,.pem,.crt,.cer"></div>
+    <div class="form-row opcua-secure-field"><label for="node-config-input-privateKey">Client private key</label><input type="text" class="opcua-security-path" id="node-config-input-privateKey" placeholder="Upload or enter /path/to/client-key.pem"> <button type="button" class="red-ui-button" id="node-config-upload-privateKey"><i class="fa fa-upload"></i> Upload</button><input type="file" class="opcua-hidden-file" id="node-config-file-privateKey" accept=".der,.pem,.key"></div>
     <div class="form-row opcua-secure-field"><label for="node-config-input-privateKeyPassword">Key password</label><input type="password" id="node-config-input-privateKeyPassword"></div>
     <div class="form-row opcua-secure-field"><label for="node-config-input-applicationUri">Application URI</label><input type="text" id="node-config-input-applicationUri" placeholder="Must match the client certificate"></div>
-    <div class="form-row opcua-secure-field"><label for="node-config-input-trustedCertificates">Trusted certificates</label><textarea id="node-config-input-trustedCertificates" rows="3" placeholder="One Server or CA certificate path per line"></textarea></div>
-    <div class="form-row opcua-secure-field"><label for="node-config-input-revocationList">Revocation list</label><textarea id="node-config-input-revocationList" rows="2" placeholder="Optional CRL path, one per line"></textarea></div>
+    <div class="form-row opcua-secure-field"><label for="node-config-input-trustedCertificates">Trusted certificates</label><div class="opcua-security-list"><textarea id="node-config-input-trustedCertificates" rows="3" placeholder="Upload files or enter one Server/CA path per line"></textarea><button type="button" class="red-ui-button opcua-security-upload" id="node-config-upload-trustedCertificates"><i class="fa fa-upload"></i> Upload files</button><input type="file" multiple class="opcua-hidden-file" id="node-config-file-trustedCertificates" accept=".der,.pem,.crt,.cer"></div></div>
+    <div class="form-row opcua-secure-field"><label for="node-config-input-revocationList">Revocation list</label><div class="opcua-security-list"><textarea id="node-config-input-revocationList" rows="2" placeholder="Upload files or enter one optional CRL path per line"></textarea><button type="button" class="red-ui-button opcua-security-upload" id="node-config-upload-revocationList"><i class="fa fa-upload"></i> Upload files</button><input type="file" multiple class="opcua-hidden-file" id="node-config-file-revocationList" accept=".der,.pem,.crl"></div></div>
+    <div class="opcua-standard-note opcua-secure-field">Uploaded files are stored under the Node-RED user directory. Runtime-visible paths may still be entered directly.</div>
     <div class="form-row"><label for="node-config-input-requestedSessionTimeout">Session timeout</label><input type="number" id="node-config-input-requestedSessionTimeout"></div>
     <div class="form-row"><label for="node-config-input-requestTimeout">Request timeout</label><input type="number" id="node-config-input-requestTimeout"></div>
     <div class="form-row"><label for="node-config-input-connectivityCheckInterval">Connectivity check</label><input type="number" id="node-config-input-connectivityCheckInterval"></div>
@@ -30,9 +36,42 @@
     <div class="form-row"><label for="node-config-input-maxReconnectInterval">Max reconnect</label><input type="number" id="node-config-input-maxReconnectInterval"></div>
     <div class="form-row"><label for="node-config-input-nodeIdCacheSize">NodeId cache</label><input type="number" id="node-config-input-nodeIdCacheSize"></div>
     <div class="form-row"><label for="node-config-input-commandQueueSize">Command queue</label><input type="number" id="node-config-input-commandQueueSize"></div>
+    <div class="form-row"><label for="node-config-input-allowParallelSession">Parallel Session</label><input type="checkbox" id="node-config-input-allowParallelSession" style="width:auto"></div>
+    <div class="opcua-standard-note">Leave disabled and reuse one Connection configuration for one Session. Enable only when a separate Session with equivalent settings is intentional.</div>
   </details>
   <div class="form-row"><label for="node-config-input-name">Name</label><input type="text" id="node-config-input-name"></div>
 </script>
+<script type="text/html" data-help-name="tier0-opcua-connection">
+  <section lang="zh-CN">
+    <h3>连接（Connection）</h3>
+    <p>创建并维护共享的 OPC UA SecureChannel 和 Session，供 Browse、Read、Write、Subscribe 节点复用。配置节点本身没有消息输入或输出。</p>
+    <h4>主要配置</h4>
+    <ul>
+      <li><b>Endpoint</b>：服务器地址，例如 <code>opc.tcp://192.168.1.10:4840</code>。</li>
+      <li><b>Discover endpoints</b>：读取服务器公开的安全模式、安全策略和用户认证方式。</li>
+      <li><b>Test connection</b>：使用当前配置建立临时连接并验证认证。</li>
+      <li><b>Security</b>：支持 None、Sign、SignAndEncrypt；安全模式、策略和认证方式必须与服务器 Endpoint 匹配。</li>
+      <li><b>证书</b>：安全连接可上传或指定客户端证书、私钥、信任证书和 CRL。Application URI 应与客户端证书一致。</li>
+    </ul>
+    <h4>建议</h4>
+    <p>一个 Connection 配置对应一条客户端 Session。多个业务节点应复用同一个 Connection，避免为相同 Endpoint 重复创建 Session。节点内置自动重连、连通性检查以及有界命令队列。</p>
+  </section>
+  <hr>
+  <section lang="en">
+    <h3>Connection</h3>
+    <p>Creates and maintains a shared OPC UA SecureChannel and Session for Browse, Read, Write, and Subscribe nodes. The configuration node itself has no message input or output.</p>
+    <h4>Main settings</h4>
+    <ul>
+      <li><b>Endpoint</b>: Server URL, for example <code>opc.tcp://192.168.1.10:4840</code>.</li>
+      <li><b>Discover endpoints</b>: Reads advertised security modes, policies, and user token types.</li>
+      <li><b>Test connection</b>: Opens a temporary connection with the current settings and validates authentication.</li>
+      <li><b>Security</b>: Supports None, Sign, and SignAndEncrypt. Mode, policy, and identity must match an advertised endpoint.</li>
+      <li><b>Certificates</b>: Secure connections can upload or reference a client certificate, private key, trust list, and CRLs. The Application URI should match the client certificate.</li>
+    </ul>
+    <h4>Recommendation</h4>
+    <p>One Connection configuration owns one client Session. Reuse it across nodes targeting the same server instead of creating duplicate Sessions. Automatic reconnect, connectivity checks, and a bounded command queue are enabled.</p>
+  </section>
+</script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-connection', {
     category: 'config',
@@ -48,6 +87,7 @@
       maxReconnectInterval: { value: 30000, validate: RED.validators.number() },
       nodeIdCacheSize: { value: 100000, validate: RED.validators.number() },
       commandQueueSize: { value: 256, validate: RED.validators.number() },
+      allowParallelSession: { value: false },
       name: { value: '' }
     },
     credentials: {
@@ -73,6 +113,94 @@
       mode.on('change', updateSecurityFields);
       updateSecurityFields();
 
+      const maxSecurityFileSize = 2 * 1024 * 1024;
+      const uploadSecurityFile = function (file, kind) {
+        return new Promise(function (resolve, reject) {
+          if (!connectionId) {
+            reject(new Error('Save the Connection node once before uploading security files'));
+            return;
+          }
+          if (file.size > maxSecurityFileSize) {
+            reject(new Error(`${file.name} exceeds the 2 MiB security file limit`));
+            return;
+          }
+          const reader = new FileReader();
+          reader.onerror = function () {
+            reject(new Error(`Cannot read ${file.name}`));
+          };
+          reader.onload = function () {
+            const encoded = String(reader.result || '');
+            const separator = encoded.indexOf(',');
+            if (separator < 0) {
+              reject(new Error(`Cannot encode ${file.name}`));
+              return;
+            }
+            $.ajax({
+              url: 'opcua-client/security-files',
+              method: 'POST',
+              contentType: 'application/json',
+              data: JSON.stringify({
+                connectionId,
+                kind,
+                fileName: file.name,
+                contentBase64: encoded.slice(separator + 1)
+              })
+            }).done(function (response) {
+              resolve(response.file);
+            }).fail(function (xhr) {
+              reject(new Error(xhr.responseJSON?.error || `Cannot upload ${file.name}`));
+            });
+          };
+          reader.readAsDataURL(file);
+        });
+      };
+
+      const bindSecurityUpload = function (buttonSelector, fileSelector, targetSelector, kind, append) {
+        const button = $(buttonSelector);
+        const fileInput = $(fileSelector);
+        const target = $(targetSelector);
+        button.on('click', function () { fileInput.trigger('click'); });
+        fileInput.on('change', function () {
+          const input = this;
+          const files = Array.from(input.files || []);
+          if (!files.length) return;
+          button.prop('disabled', true);
+          files.reduce(function (chain, file) {
+            return chain.then(function () {
+              return uploadSecurityFile(file, kind);
+            }).then(function (uploaded) {
+              if (!append) {
+                target.val(uploaded.path);
+                return;
+              }
+              const paths = String(target.val() || '').split(/\r?\n|;/)
+                .map(function (entry) { return entry.trim(); })
+                .filter(Boolean);
+              if (paths.indexOf(uploaded.path) < 0) paths.push(uploaded.path);
+              target.val(paths.join('\n'));
+            });
+          }, Promise.resolve()).then(function () {
+            RED.notify(`${files.length} OPC UA security file(s) uploaded`, 'success');
+          }).catch(function (error) {
+            RED.notify(error.message || String(error), 'error');
+          }).then(function () {
+            input.value = '';
+            button.prop('disabled', false);
+          });
+        });
+      };
+
+      bindSecurityUpload('#node-config-upload-certificate', '#node-config-file-certificate',
+        '#node-config-input-certificate', 'clientCertificate', false);
+      bindSecurityUpload('#node-config-upload-privateKey', '#node-config-file-privateKey',
+        '#node-config-input-privateKey', 'privateKey', false);
+      bindSecurityUpload('#node-config-upload-trustedCertificates',
+        '#node-config-file-trustedCertificates', '#node-config-input-trustedCertificates',
+        'trustedCertificate', true);
+      bindSecurityUpload('#node-config-upload-revocationList',
+        '#node-config-file-revocationList', '#node-config-input-revocationList',
+        'revocationList', true);
+
       const connectionSettings = function () {
         return {
           connectionId,

package/nodes/connection.js

@@ -1,6 +1,8 @@
 'use strict';
 
 const { OpcUaClient, discoverEndpoints } = require('../lib/client');
+const { ConnectionRegistry } = require('../lib/connection-registry');
+const { SecurityFileStore } = require('../lib/security-file-store');
 
 function pathList(value) {
   const source = Array.isArray(value) ? value : String(value || '').split(/\r?\n|;/);
@@ -37,6 +39,28 @@ function clientOptions(config, credentials = {}) {
 }
 
 module.exports = function registerConnectionNode(RED) {
+  const connectionRegistry = new ConnectionRegistry();
+  const securityFileStore = new SecurityFileStore({ userDir: RED.settings?.userDir });
+
+  RED.httpAdmin.post(
+    '/opcua-client/security-files',
+    RED.auth.needsPermission('opcua-client.security-files.write'),
+    async (req, res) => {
+      try {
+        const file = await securityFileStore.save(req.body || {});
+        res.send({ file });
+      } catch (error) {
+        const status = error?.code === 'OPCUA_SECURITY_FILE_TOO_LARGE'
+          ? 413
+          : String(error?.code || '').startsWith('OPCUA_SECURITY_FILE_') ? 400 : 500;
+        res.status(status).send({
+          error: error.message || String(error),
+          code: error.code || 'OPCUA_SECURITY_FILE_UPLOAD_FAILED',
+        });
+      }
+    }
+  );
+
   RED.httpAdmin.post(
     '/opcua-client/endpoints',
     RED.auth.needsPermission('opcua-client.discovery'),
@@ -102,19 +126,79 @@ module.exports = function registerConnectionNode(RED) {
   function OpcUaConnectionNode(config) {
     RED.nodes.createNode(this, config);
     const node = this;
+    const dependentCleanups = new Set();
 
-    node.client = new OpcUaClient(clientOptions(config, node.credentials));
+    function runDependentCleanup(record) {
+      if (!record.promise) {
+        record.promise = Promise.resolve()
+          .then(record.cleanup)
+          .finally(() => dependentCleanups.delete(record));
+      }
+      return record.promise;
+    }
 
-    node.client.on('fault', (error) => node.warn(`OPC UA connection fault: ${error.message}`));
-    node.client.on('state', (state) => {
-      if (state.state === 'failed') node.warn(`OPC UA connection failed: ${state.statusCode}`);
+    const options = clientOptions(config, node.credentials);
+    const registration = connectionRegistry.register(options);
+    node.client = new OpcUaClient(options);
+    node.getConnectionGovernance = () => ({
+      ...registration.diagnostics(),
+      allowParallelSession: config.allowParallelSession === true,
+    });
+    node.getDiagnostics = () => ({
+      ...node.client.getDiagnostics(),
+      connectionGovernance: node.getConnectionGovernance(),
     });
-    node.on('close', async (done) => {
+    node.registerDependentCleanup = (cleanup) => {
+      if (typeof cleanup !== 'function') {
+        throw new TypeError('OPC UA dependent cleanup must be a function');
+      }
+      const record = { cleanup, promise: null };
+      dependentCleanups.add(record);
+      return () => runDependentCleanup(record);
+    };
+
+    if (registration.duplicate && config.allowParallelSession !== true) {
+      node.warn(
+        `Equivalent OPC UA Connection configuration detected for ${options.endpoint}; ` +
+        'this creates an additional Session. Reuse the existing Connection configuration ' +
+        'or enable "Allow parallel Session" when isolation is intentional.'
+      );
+    }
+
+    const onFault = (error) => node.warn(`OPC UA connection fault: ${error.message}`);
+    const onState = (state) => {
+      if (state.state === 'failed') node.warn(`OPC UA connection failed: ${state.statusCode}`);
+    };
+    node.client.on('fault', onFault);
+    node.client.on('state', onState);
+    node.on('close', async (removed, done) => {
+      if (typeof removed === 'function') {
+        done = removed;
+        removed = false;
+      }
+      node.client.off('fault', onFault);
+      node.client.off('state', onState);
+      registration.unregister();
+      const cleanupResults = await Promise.allSettled(
+        [...dependentCleanups].map(runDependentCleanup)
+      );
+      for (const result of cleanupResults) {
+        if (result.status === 'rejected') {
+          node.warn(`OPC UA dependent cleanup failed: ${result.reason?.message || result.reason}`);
+        }
+      }
       try {
         await node.client.disconnect();
       } catch (error) {
         node.warn(`OPC UA disconnect failed: ${error.message}`);
       }
+      if (removed) {
+        try {
+          await securityFileStore.removeConnection(config.id);
+        } catch (error) {
+          node.warn(`OPC UA managed security file cleanup failed: ${error.message}`);
+        }
+      }
       done();
     });
   }

package/nodes/read.html

@@ -39,13 +39,48 @@
     <div class="form-row"><label for="node-input-indexRange">Index range</label><input type="text" id="node-input-indexRange" placeholder="For example 0:9 or 0:1,2:3"></div>
     <div class="form-row"><label for="node-input-batchSize">Batch size</label><input type="number" id="node-input-batchSize"></div>
     <div class="form-row"><label for="node-input-outputMode">Output</label><select id="node-input-outputMode"><option value="batch">Batch</option><option value="split">One message per point</option></select></div>
+    <div class="form-row"><label for="node-input-resultDetail">Result detail</label><select id="node-input-resultDetail"><option value="compact">Compact</option><option value="value">Value only</option><option value="full">Full metadata</option></select></div>
   </details>
   <div class="form-row"><label for="node-input-name">Name</label><input type="text" id="node-input-name"></div>
 </script>
 <script type="text/html" data-help-name="tier0-opcua-read">
-  <p>Add NodeIds to the point list or import JSON/CSV. Imported points are parsed and shown in the same list.</p>
-  <p>CSV requires a <code>nodeId</code> header. A JSON/CSV point list may also arrive dynamically in <code>msg.payload</code>.</p>
-  <p>Use <code>indexRange</code> (or legacy <code>range</code>) per point or in <code>msg.indexRange</code> to read part of an array or matrix.</p>
+  <section lang="zh-CN">
+    <h3>读取（Read）</h3>
+    <p>每收到一条输入消息执行一次 OPC UA Read。它不是定时器；读取频率由上游 Inject、Function 或其他节点的触发频率决定。</p>
+    <h4>输入</h4>
+    <ul>
+      <li>可在编辑器中添加 NodeId，或导入 JSON/CSV 点表；CSV 必须包含 <code>nodeId</code> 列。</li>
+      <li>也可通过 <code>msg.payload</code> 或 <code>msg.items</code> 动态传入点表。</li>
+      <li>单点读取可使用节点配置、<code>msg.nodeId</code> 或 <code>msg.topic</code>。</li>
+      <li><code>indexRange</code> 可读取数组或矩阵的指定范围。</li>
+    </ul>
+    <h4>输出</h4>
+    <ul>
+      <li><b>Compact</b>：NodeId/alias、值、状态码和源时间戳，推荐用于采集。</li>
+      <li><b>Value only</b>：批量时按点表顺序输出值数组，单点时输出标量。</li>
+      <li><b>Full metadata</b>：同时输出完整点表描述和客户端诊断，适合排障。</li>
+    </ul>
+    <p>大点表会按照 Batch size 和服务器 OperationLimits 自动拆分为批量服务请求，不会逐点建立连接。</p>
+  </section>
+  <hr>
+  <section lang="en">
+    <h3>Read</h3>
+    <p>Executes one OPC UA Read for each input message. It is not a timer; the upstream Inject, Function, or other node controls the read frequency.</p>
+    <h4>Input</h4>
+    <ul>
+      <li>Add NodeIds in the editor or import a JSON/CSV point list. CSV requires a <code>nodeId</code> column.</li>
+      <li>A dynamic point list may arrive in <code>msg.payload</code> or <code>msg.items</code>.</li>
+      <li>A single point may come from the node setting, <code>msg.nodeId</code>, or <code>msg.topic</code>.</li>
+      <li>Use <code>indexRange</code> to read part of an array or matrix.</li>
+    </ul>
+    <h4>Output</h4>
+    <ul>
+      <li><b>Compact</b>: NodeId/alias, value, status code, and source timestamp. Recommended for collection flows.</li>
+      <li><b>Value only</b>: A value array in point-list order for batch reads, or a scalar for one point.</li>
+      <li><b>Full metadata</b>: Full point descriptors and client diagnostics for troubleshooting.</li>
+    </ul>
+    <p>Large point lists are split according to Batch size and server OperationLimits. The node does not create one connection per point.</p>
+  </section>
 </script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-read', {
@@ -55,7 +90,8 @@
       nodeId: { value: '' }, pointList: { value: '' }, pointListFileName: { value: '' },
       indexRange: { value: '' },
       batchSize: { value: 500, validate: RED.validators.number() },
-      outputMode: { value: 'batch' }, name: { value: '' }
+      outputMode: { value: 'batch' }, resultDetail: { value: 'compact' },
+      name: { value: '' }
     },
     oneditprepare: function () {
       const points = new Map();

package/nodes/read.js

@@ -2,6 +2,26 @@
 
 const { looksLikePointList, messagePoints } = require('../lib/points');
 
+const COMPACT_RESULT_FIELDS = Object.freeze([
+  'nodeId',
+  'alias',
+  'value',
+  'statusCode',
+  'sourceTimestamp',
+]);
+
+function compactResult(result) {
+  const output = {};
+  for (const field of COMPACT_RESULT_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(result, field)) output[field] = result[field];
+  }
+  return output;
+}
+
+function valueOnly(result) {
+  return Object.prototype.hasOwnProperty.call(result, 'value') ? result.value : null;
+}
+
 module.exports = function registerReadNode(RED) {
   function OpcUaReadNode(config) {
     RED.nodes.createNode(this, config);
@@ -29,29 +49,46 @@ module.exports = function registerReadNode(RED) {
           ...value,
         }));
 
+        // Undefined preserves the original output for Flow JSON created before
+        // resultDetail was introduced. New editor nodes explicitly save compact.
+        const resultDetail = config.resultDetail || 'full';
+        const outputResults = resultDetail === 'compact'
+          ? results.map(compactResult)
+          : resultDetail === 'value'
+            ? results.map(valueOnly)
+            : results;
+
         if ((config.outputMode || 'batch') === 'split') {
-          results.forEach((result) => send({
-            ...msg,
-            topic: result.nodeId,
-            payload: result.value,
-            opcua: result,
-          }));
+          results.forEach((result, index) => {
+            const output = {
+              ...msg,
+              topic: result.nodeId,
+              payload: valueOnly(result),
+            };
+            if (resultDetail === 'value') delete output.opcua;
+            else output.opcua = outputResults[index];
+            send(output);
+          });
         } else if (points.length === 1 && !looksLikePointList(msg.payload) &&
                    !Array.isArray(msg.items) && !config.pointList) {
           const result = results[0];
           msg.topic = result.nodeId;
-          msg.payload = result.value;
-          msg.opcua = result;
+          msg.payload = valueOnly(result);
+          if (resultDetail === 'value') delete msg.opcua;
+          else msg.opcua = outputResults[0];
           send(msg);
         } else {
-          msg.payload = results;
+          msg.payload = outputResults;
           msg.opcua = {
-            ...(msg.opcua || {}),
             operation: 'read',
             total: results.length,
             good: results.filter((item) => item.statusCode === 'Good').length,
-            clientDiagnostics: node.connection.client.getDiagnostics(),
+            resultDetail,
           };
+          if (resultDetail === 'full') {
+            msg.opcua.clientDiagnostics = node.connection.getDiagnostics?.() ||
+              node.connection.client.getDiagnostics();
+          }
           send(msg);
         }
 

package/nodes/subscribe.html

@@ -7,7 +7,7 @@
   <div class="form-row"><label for="node-input-connection">Connection</label><input type="text" id="node-input-connection"></div>
   <div class="form-row"><label for="node-input-nodeId">NodeId</label><input type="text" id="node-input-nodeId" placeholder="Optional when input supplies points"></div>
   <div class="form-row"><label for="node-input-samplingInterval">Sampling (ms)</label><input type="number" id="node-input-samplingInterval"></div>
-  <div class="opcua-standard-note">Standard mode shards large point sets across subscriptions, batches changes, and automatically restores them after reconnect.</div>
+  <div class="opcua-standard-note">Standard mode keeps the latest pending value per point, shards large point sets, batches changes, and automatically restores them after reconnect.</div>
   <details class="opcua-advanced">
     <summary>Advanced subscription and queue settings</summary>
     <div class="form-row"><label for="node-input-publishingInterval">Publishing interval</label><input type="number" id="node-input-publishingInterval"></div>
@@ -19,6 +19,7 @@
     <div class="form-row"><label for="node-input-batchSize">Create batch size</label><input type="number" id="node-input-batchSize"></div>
     <div class="form-row"><label for="node-input-maxItemsPerSubscription">Items / subscription</label><input type="number" id="node-input-maxItemsPerSubscription"></div>
     <div class="form-row"><label for="node-input-outputMode">Change output</label><select id="node-input-outputMode"><option value="batch">Native batch</option><option value="single">One message per change</option></select></div>
+    <div class="form-row"><label for="node-input-resultDetail">Result detail</label><select id="node-input-resultDetail"><option value="compact">Compact</option><option value="value">Value only</option><option value="full">Full metadata</option></select></div>
     <div class="form-row"><label for="node-input-callbackBatchSize">Output batch size</label><input type="number" id="node-input-callbackBatchSize"></div>
     <div class="form-row"><label for="node-input-callbackFlushIntervalMs">Batch flush (ms)</label><input type="number" id="node-input-callbackFlushIntervalMs"></div>
     <div class="form-row"><label for="node-input-callbackQueueSize">Native queue capacity</label><input type="number" id="node-input-callbackQueueSize"></div>
@@ -27,21 +28,66 @@
   </details>
   <div class="form-row"><label for="node-input-name">Name</label><input type="text" id="node-input-name"></div>
 </script>
-<script type="text/html" data-help-name="tier0-opcua-subscribe"><p>Creates one or more OPC UA subscriptions for many monitored items. Input may be an array, JSON, CSV, or Browse output. Commands are <code>replace</code>, <code>add</code>, <code>remove</code>, and <code>clear</code> in <code>msg.opcua.command</code>.</p><p>The node automatically honors the server subscription limit when available. Batch output flushes when its size threshold is reached or its time window expires. Queue diagnostics are reported in <code>msg.opcua.queue</code>.</p></script>
+<script type="text/html" data-help-name="tier0-opcua-subscribe">
+  <section lang="zh-CN">
+    <h3>订阅（Subscribe）</h3>
+    <p>创建 OPC UA Subscription 和 MonitoredItems，由服务器在值变化时推送通知；它不是客户端定时 Read。大量点位会按照服务器限制自动拆分到多个 Subscription。</p>
+    <h4>输入与命令</h4>
+    <p>点表可来自数组、JSON、CSV 或 Browse 输出。通过 <code>msg.opcua.command</code> 使用 <code>replace</code>、<code>add</code>、<code>remove</code>、<code>clear</code> 动态管理点位。</p>
+    <h4>时间与队列</h4>
+    <ul>
+      <li><b>Sampling</b>：服务器检查 MonitoredItem 的请求间隔。</li>
+      <li><b>Publishing interval</b>：服务器发布已排队通知的请求周期。</li>
+      <li><b>Batch flush</b>：Node-RED 合并通知的最大等待时间，不影响服务器采样。</li>
+      <li>服务器可以把请求间隔修订为它支持的值。</li>
+    </ul>
+    <p>新节点默认 Server queue size=1、Discard oldest=true、Queue mode=latest，适合实时状态采集。脉冲、报警转换或完整历史不能丢失时，应改为 all 并增大服务器队列。</p>
+    <h4>输出</h4>
+    <ul>
+      <li><b>Compact</b>：NodeId/alias、值、状态和源时间戳。</li>
+      <li><b>Value only</b>：值在 <code>msg.payload</code>，同位置标识在 <code>msg.opcua.identifiers</code>。</li>
+      <li><b>Full metadata</b>：保留完整诊断字段。</li>
+    </ul>
+    <p>队列深度、丢弃数和延迟位于 <code>msg.opcua.queue</code>；发生溢出时节点会显示警告。</p>
+  </section>
+  <hr>
+  <section lang="en">
+    <h3>Subscribe</h3>
+    <p>Creates one or more OPC UA subscriptions and MonitoredItems so the server sends data-change notifications. It is not a periodic client Read. Large point sets are automatically sharded across Subscriptions according to server limits.</p>
+    <h4>Input and commands</h4>
+    <p>Point lists may come from arrays, JSON, CSV, or Browse output. Use <code>replace</code>, <code>add</code>, <code>remove</code>, or <code>clear</code> in <code>msg.opcua.command</code> to manage points dynamically.</p>
+    <h4>Timing and queues</h4>
+    <ul>
+      <li><b>Sampling</b>: Requested interval at which the server checks a MonitoredItem.</li>
+      <li><b>Publishing interval</b>: Requested cycle at which the server publishes queued notifications.</li>
+      <li><b>Batch flush</b>: Maximum Node-RED aggregation delay; it does not control server sampling.</li>
+      <li>The server may revise requested intervals to supported values.</li>
+    </ul>
+    <p>New nodes default to server queue size 1, discard-oldest, and local latest coalescing for real-time state. Select all and increase the server queue for pulses, alarm transitions, or history where every change must be retained.</p>
+    <h4>Output</h4>
+    <ul>
+      <li><b>Compact</b>: NodeId/alias, value, status, and source timestamp.</li>
+      <li><b>Value only</b>: Values are in <code>msg.payload</code>; matching identities are in <code>msg.opcua.identifiers</code>.</li>
+      <li><b>Full metadata</b>: Preserves full diagnostic fields.</li>
+    </ul>
+    <p>Queue depth, drops, and lag are reported in <code>msg.opcua.queue</code>. Queue overflow also raises a node warning.</p>
+  </section>
+</script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-subscribe', {
     category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 1, icon: 'bridge.png',
     defaults: {
       connection: { value: '', type: 'tier0-opcua-connection', required: true }, nodeId: { value: '' },
       publishingInterval: { value: 1000, validate: RED.validators.number() }, samplingInterval: { value: 1000, validate: RED.validators.number() },
-      queueSize: { value: 10, validate: RED.validators.number() }, discardOldest: { value: true },
+      queueSize: { value: 1, validate: RED.validators.number() }, discardOldest: { value: true },
       deadbandType: { value: 'none' }, deadbandValue: { value: 0, validate: RED.validators.number() },
       timestampMode: { value: 'source' },
       batchSize: { value: 500, validate: RED.validators.number() }, outputMode: { value: 'batch' },
+      resultDetail: { value: 'compact' },
       maxItemsPerSubscription: { value: 5000, validate: RED.validators.number() },
       callbackBatchSize: { value: 500, validate: RED.validators.number() }, callbackQueueSize: { value: 10000, validate: RED.validators.number() },
       callbackFlushIntervalMs: { value: 50, validate: RED.validators.number() },
-      queueMode: { value: 'all' }, overflowPolicy: { value: 'drop-oldest' },
+      queueMode: { value: 'latest' }, overflowPolicy: { value: 'drop-oldest' },
       lifetimeCount: { value: 120 }, maxKeepAliveCount: { value: 10 }, maxNotificationsPerPublish: { value: 0 },
       reconnectInterval: { value: 5000 }, name: { value: '' }
     },

package/nodes/subscribe.js

@@ -12,6 +12,44 @@ const NOTIFICATION_CONFIG_FIELDS = new Set([
   'enabled',
 ]);
 
+const COMPACT_NOTIFICATION_FIELDS = Object.freeze([
+  'nodeId',
+  'value',
+  'statusCode',
+  'sourceTimestamp',
+]);
+
+function valueOnly(change) {
+  return Object.prototype.hasOwnProperty.call(change, 'value') ? change.value : null;
+}
+
+function compactChange(change, point) {
+  const output = {};
+  for (const field of COMPACT_NOTIFICATION_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(change, field)) output[field] = change[field];
+  }
+  if (point.alias != null && point.alias !== '') output.alias = point.alias;
+  return output;
+}
+
+function valueChange(change, point) {
+  return {
+    nodeId: change.nodeId,
+    ...(point.alias != null && point.alias !== '' ? { alias: point.alias } : {}),
+    ...(Object.prototype.hasOwnProperty.call(change, 'value') ? { value: change.value } : {}),
+  };
+}
+
+function fullChange(change, point, subscriptionId) {
+  change.subscriptionId = subscriptionId;
+  for (const key in point) {
+    if (!NOTIFICATION_CONFIG_FIELDS.has(key) && !Object.hasOwn(change, key)) {
+      change[key] = point[key];
+    }
+  }
+  return change;
+}
+
 function positiveInteger(value, fallback) {
   const number = Number(value);
   return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
@@ -40,6 +78,11 @@ module.exports = function registerSubscribeNode(RED) {
     const callbackBatchSize = positiveInteger(config.callbackBatchSize, 500);
     const callbackFlushIntervalMs = positiveInteger(config.callbackFlushIntervalMs, 50);
     const configuredSubscriptionCapacity = positiveInteger(config.maxItemsPerSubscription, 5000);
+    // Undefined preserves the descriptor-rich output used by Flow JSON created
+    // before resultDetail existed. New editor nodes explicitly save compact.
+    const resultDetail = ['compact', 'value', 'full'].includes(config.resultDetail)
+      ? config.resultDetail
+      : 'full';
 
     function subscriptionIds() {
       return [...node.subscriptions.keys()];
@@ -108,14 +151,23 @@ module.exports = function registerSubscribeNode(RED) {
       if (!changes.length || node.closing) return;
       const diagnostics = combinedDiagnostics();
       updateQueueWarning(diagnostics);
-      node.send({
-        payload: changes,
+      const output = {
+        payload: resultDetail === 'value' ? changes.map(valueOnly) : changes,
         opcua: {
           operation: 'change',
           total: changes.length,
           subscriptionCount: node.subscriptions.size,
+          resultDetail,
           queue: diagnostics,
         },
+      };
+      if (resultDetail === 'value') {
+        // Subscription batches are sparse and may repeat one NodeId. A parallel
+        // identifier array preserves every change without repeating objects.
+        output.opcua.identifiers = changes.map((change) => change.alias || change.nodeId);
+      }
+      node.send({
+        ...output,
       });
     }
 
@@ -158,23 +210,26 @@ module.exports = function registerSubscribeNode(RED) {
         const change = sourceChanges[index];
         const point = node.desired.get(change.nodeId);
         if (!point) continue;
-        change.subscriptionId = record.id;
-        for (const key in point) {
-          if (!NOTIFICATION_CONFIG_FIELDS.has(key) && !Object.hasOwn(change, key)) {
-            change[key] = point[key];
-          }
-        }
-        changes.push(change);
+        changes.push(resultDetail === 'compact'
+          ? compactChange(change, point)
+          : resultDetail === 'value'
+            ? valueChange(change, point)
+            : fullChange(change, point, record.id));
       }
 
       if ((config.outputMode || 'batch') === 'single') {
         const queue = combinedDiagnostics();
         updateQueueWarning(queue);
-        changes.forEach((change, index) => node.send({
-          topic: change.nodeId,
-          payload: change.value,
-          opcua: index === 0 ? { ...change, queue } : change,
-        }));
+        changes.forEach((change, index) => {
+          const output = {
+            topic: change.nodeId,
+            payload: valueOnly(change),
+          };
+          if (resultDetail === 'value') {
+            if (index === 0) output.opcua = { operation: 'change', resultDetail, queue };
+          } else output.opcua = index === 0 ? { ...change, queue } : change;
+          node.send(output);
+        });
       } else if (changes.length) {
         node.pendingChanges.push(...changes);
         flushFullBatches();
@@ -358,6 +413,7 @@ module.exports = function registerSubscribeNode(RED) {
         subscriptionCount: ids.length,
         subscriptionId: ids[0] ?? null,
         subscriptionIds: ids,
+        connectionGovernance: node.connection?.getConnectionGovernance?.(),
       };
     }
 
@@ -496,15 +552,23 @@ module.exports = function registerSubscribeNode(RED) {
       }
     });
 
-    node.on('close', async (done) => {
+    async function cleanupSubscription() {
       node.closing = true;
       if (node.reconnectTimer) clearTimeout(node.reconnectTimer);
+      node.reconnectTimer = null;
       discardPendingChanges();
       node.connection?.client.off('fault', onFault);
       node.connection?.client.off('state', onState);
       node.desired.clear();
+      await runSerialized(() => clearSubscriptions());
+    }
+
+    const runCleanup = node.connection?.registerDependentCleanup?.(cleanupSubscription) ||
+      cleanupSubscription;
+
+    node.on('close', async (done) => {
       try {
-        await runSerialized(() => clearSubscriptions());
+        await runCleanup();
       } catch (error) {
         node.warn(`OPC UA subscription cleanup failed: ${error.message}`);
       }

package/nodes/write.html

@@ -46,9 +46,33 @@
   <div class="form-row"><label for="node-input-name">Name</label><input type="text" id="node-input-name"></div>
 </script>
 <script type="text/html" data-help-name="tier0-opcua-write">
-  <p>Add NodeId, value, and data type rows or import JSON/CSV. Imported points are parsed and shown in the same list.</p>
-  <p>CSV requires <code>nodeId</code> and <code>value</code>; <code>dataType</code> is optional. A JSON/CSV point list may also arrive dynamically in <code>msg.payload</code>.</p>
-  <p>Use <code>indexRange</code> (or legacy <code>range</code>) per point or in <code>msg.indexRange</code> for partial array writes.</p>
+  <section lang="zh-CN">
+    <h3>写入（Write）</h3>
+    <p>向一个或多个 OPC UA Variable 写值。服务器必须允许当前用户写入，值也必须能够转换为目标数据类型。</p>
+    <h4>输入</h4>
+    <ul>
+      <li>单点：NodeId 来自节点配置、<code>msg.nodeId</code> 或 <code>msg.topic</code>，写入值来自 <code>msg.payload</code>。</li>
+      <li>批量：通过编辑器、JSON 或 CSV 提供 <code>nodeId</code>、<code>value</code> 和可选 <code>dataType</code>。</li>
+      <li>CSV 必须包含 <code>nodeId</code> 和 <code>value</code>；未指定类型时使用节点默认类型。</li>
+      <li><code>indexRange</code> 可部分写入数组或矩阵。</li>
+    </ul>
+    <h4>输出</h4>
+    <p>Batch 模式在 <code>msg.payload</code> 中返回每个 NodeId 的 StatusCode；Split 模式每个写入结果发送一条消息。应检查是否为 <code>Good</code>，不要只依赖节点未报异常。</p>
+  </section>
+  <hr>
+  <section lang="en">
+    <h3>Write</h3>
+    <p>Writes values to one or more OPC UA Variables. The current user must have write access and each value must be convertible to the target data type.</p>
+    <h4>Input</h4>
+    <ul>
+      <li>Single point: NodeId comes from the node setting, <code>msg.nodeId</code>, or <code>msg.topic</code>; the value comes from <code>msg.payload</code>.</li>
+      <li>Batch: Supply <code>nodeId</code>, <code>value</code>, and optional <code>dataType</code> through the editor, JSON, or CSV.</li>
+      <li>CSV requires <code>nodeId</code> and <code>value</code>. The node default type is used when <code>dataType</code> is omitted.</li>
+      <li>Use <code>indexRange</code> for partial array or matrix writes.</li>
+    </ul>
+    <h4>Output</h4>
+    <p>Batch mode returns one StatusCode per NodeId in <code>msg.payload</code>. Split mode sends one message per write result. Check for <code>Good</code>; do not treat the absence of a node error as proof that every item succeeded.</p>
+  </section>
 </script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-write', {

package/nodes/write.js

@@ -28,7 +28,8 @@ module.exports = function registerWriteNode(RED) {
             operation: 'write',
             total: results.length,
             good: results.filter((item) => item.statusCode === 'Good').length,
-            clientDiagnostics: node.connection.client.getDiagnostics(),
+            clientDiagnostics: node.connection.getDiagnostics?.() ||
+              node.connection.client.getDiagnostics(),
           };
           send(msg);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tier0/opcua-client",
-  "version": "0.2.0",
+  "version": "0.4.1",
   "description": "High-scale OPC UA client nodes for Node-RED powered by open62541",
   "license": "Apache-2.0",
   "repository": {