@tier0/opcua-client 0.4.1 → 0.6.0

package/BENCHMARK.md

@@ -132,3 +132,30 @@ The same deployed Flow was tested with a separate native client generating the f
 Write CSV parsing was then changed from multiple whole-payload arrays and object copies to a single line scan that constructs compact final write descriptors. Two mixed Node-RED runs, each producing CSV and executing all 100,000 writes inside the Flow, recorded stable peaks of 226.73 MB and 226.06 MB. The immediately preceding fresh-process repeat peaked at 362.29 MB, so the repeatable peak reduction was approximately 37.6%. The optimized repeat recorded Write P50/P95 of 1,410/1,769 ms, delivered 120,000/120,000 native notifications with zero drops, and converged 20,000/20,000 final values. These are process-RSS engineering measurements; allocator and garbage-collector behavior still require production baselines on the target Node-RED image.
 
 The 20,000-point outage acceptance stopped and restarted the real OPC UA fixture after the initial four Subscriptions were created. The Subscribe node rebuilt exactly four Subscriptions with 20,000/20,000 MonitoredItems and zero failures. Two subsequent complete write rounds plus the rebuilt initial values delivered 60,000/60,000 native notifications with zero drops and final convergence for all 20,000 points. Recovery-phase RSS peaked at 175.04 MB and the complete run at 184.5 MB. The recovery status explicitly reported `rebuilt=true` and `dataGapPossible=true` because a server-side subscription rebuild cannot guarantee changes that occurred during the outage.
+
+## 0.5.0 knee-point benchmark
+
+Recorded on 2026-08-24 with Node-RED 4.1.10, Node.js 22.22.2, open62541 1.4.16, and package 0.5.0. Every tier used a fresh Node-RED process constrained to 2 vCPU and 2 GB. The server and clients used security mode `None` over container loopback. Service batches contained 500 nodes, each server Subscription contained at most 5,000 MonitoredItems, publishing and sampling intervals were 100 ms, and an independent native client changed every monitored value so the Node-RED Subscribe path could be measured without CSV construction in the Write node.
+
+| Points | Read P50 / P95 | External write P50 / P95 | Subscribe setup | Native notifications | Max callback lag | Node-RED peak RSS |
+| ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| 5,000 | 195 / 206 ms | 195 / 196 ms | 232 ms | 30,000, 0 dropped | 0.21 ms | 132.4 MB |
+| 10,000 | 411 / 467 ms | 392 / 396 ms | 475 ms | 60,000, 0 dropped | 1.00 ms | 153.4 MB |
+| 20,000 | 817 / 852 ms | 788 / 792 ms | 915 ms | 120,000, 0 dropped | 2.42 ms | 182.1 MB |
+| 30,000 | 1,263 / 1,274 ms | 1,208 / 1,219 ms | 1,523 ms | 180,000, 0 dropped | 2.18 ms | 194.4 MB |
+| 40,000 | 1,673 / 1,701 ms | 1,753 / 1,795 ms | 1,889 ms | 240,000, 0 dropped | 2.27 ms | 218.8 MB |
+| 60,000 | 2,521 / 2,556 ms | 2,590 / 2,641 ms | 2,860 ms | 360,000, 0 dropped | 5.07 ms | 261.3 MB |
+| 100,000 | 4,215 / 4,263 ms | 4,758 / 4,884 ms | 5,174 ms | 600,000, 0 dropped | 1.64 ms | 391.4 MB |
+| 150,000 | 6,353 / 6,470 ms | 8,045 / 8,137 ms | 7,582 ms | 600,000, 0 dropped | 27.53 ms | 463.2 MB |
+| 175,000 | 7,488 ms | 11,864 ms | 9,290 ms | 525,000, 0 dropped | 1.91 ms | 526.7 MB |
+| 200,000 | 8,485 / 8,663 ms | 42,410 / 43,425 ms | 10,968 ms | 800,000, 0 dropped | 1.73 ms | 564.0 MB |
+
+The 5,000 through 100,000 Read results remain close to 23,000-25,000 values per second. A one-second full-poll target therefore crosses its practical boundary between 20,000 and 30,000 points even though larger batches remain correct. Subscription creation stays near 18,000-22,000 MonitoredItems per second through 200,000 points.
+
+The coupled server/client system begins a soft knee around 150,000 monitored points. At that tier callback lag repeatedly reached about 27 ms and the default 100,000-entry NodeId cache started heavy eviction. Increasing the cache to 200,000 removed all evictions and improved Read P50 from 6,524 ms to 6,353 ms, but raised peak RSS from 425 MB to 463 MB and did not remove the callback-lag spike. Cache size is therefore a secondary tuning control, not the main scale limit.
+
+The sharp knee occurred between 175,000 and 200,000 monitored points. Increasing the point set by 14% increased one full write from about 11.9 seconds to 42.4 seconds. Node-RED still delivered all 800,000 native notifications with zero drops at 200,000 points, so the collapse occurred first in the open62541 server's processing of value changes under a very large monitored set, rather than in the Node-RED callback queue. A Siemens WinCC server can reach its own knee much earlier or later depending on licensed limits, Session and Subscription quotas, security, hardware, and project load.
+
+The editor Browse API intentionally caps one tree request at 100,000 total nodes. A namespace containing approximately 100,000 variables plus their Area objects therefore cannot be rendered as one complete selectable tree. Browse a narrower Area/root or import the point list instead of raising this UI protection.
+
+For production, keep a one-second full Read at or below roughly 20,000 points per Connection on equivalent hardware. For Subscribe, 50,000-60,000 monitored points per Connection is a conservative local-loopback engineering envelope with substantial margin below the observed system knee. Do not automatically add Sessions to exceed it: first verify the target server's Session, Subscription, MonitoredItem, publish, and sampling limits. Above 100,000 points, raise `nodeIdCacheSize` only with a corresponding memory budget and test the real server under the expected change rate and security policy.

package/README.md

@@ -39,6 +39,8 @@ Browse output can be wired directly into Read or Subscribe. In the Read and Writ
 
 Subscription commands are `replace`, `add`, `remove`, and `clear`. Read and Write split large arrays into configurable service batches; they do not loop over scalar OPC UA requests.
 
+Subscribe nodes can save or import their own point list and establish it automatically after deploy. Repeating an unchanged `replace` command preserves existing server Subscriptions and MonitoredItems. Only added, removed, or monitoring-parameter-changed points are reconciled. A rejected point is reported in `failures` without stopping valid points, and requested versus server-revised publishing, sampling, lifetime, keepalive, and queue settings are included in subscription status output.
+
 New Read nodes default to compact results: `nodeId`, optional `alias`, `value`,
 `statusCode`, and `sourceTimestamp`. Browse metadata and subscription-only point
 settings are not repeated on every Read. **Value only** emits an array in point-
@@ -107,6 +109,13 @@ Session is intentional. Read/Write diagnostics and subscription status outputs
 include `connectionGovernance`, with the equivalent and active configuration
 counts.
 
+`connectionUsage` reports the current Read/Write/Browse/Subscribe consumer count
+and types, each consumer's last use, aggregate operation counts, and connection
+idle time. It is diagnostic only: `automaticIdleDisconnect` is false. A deployed
+Connection therefore remains stable for subscriptions until its configuration
+node is closed; deleting the last referencing flow is visible as a zero consumer
+count but does not race an idle timer.
+
 ## Connection and subscription recovery
 
 The native client reports secure-channel, session, connectivity-check, and subscription-inactivity transitions to a JavaScript connection supervisor. Recoverable channel interruptions keep the native client alive. Terminal failures replace the native client and retry with exponential backoff, 20% jitter, and the configured maximum interval. Operations fail fast with `OPCUA_RECONNECTING` while the connection is unavailable instead of building an unbounded request queue.
@@ -137,6 +146,12 @@ message or Write node identifies one target NodeId. A configured single
 `useInput` point behaves the same way. Set `msg.opcua.pointList = true` only when
 an array payload must be forced to mean a dynamic list of point descriptors.
 
+OPC UA Int64 and UInt64 values inside the JavaScript safe-integer range are
+returned as Numbers. Larger values are returned as exact decimal strings so
+totals and counters never silently lose precision. Use decimal strings for
+64-bit writes; unsafe Numbers, fractional integers, and values outside the OPC UA
+type range are rejected before a service request.
+
 ```json
 {
   "topic": "ns=2;s=Recipe.Steps",
@@ -154,21 +169,43 @@ The Browse editor loads the address space through the deployed Connection node.
 
 The selected Variable descriptors are saved with the Browse node. Each input message outputs the full saved selection so it can be wired directly into Read or Subscribe. Send `msg.opcua.liveBrowse = true` when a flow needs to ignore the saved selection and perform a new live Browse.
 
+Recursive Browse requests batch multiple parent nodes and honor the server's
+`MaxNodesPerBrowse` OperationLimit. `Browse batch` and `References / page` bound
+each request. If `Maximum depth` or `Maximum nodes` truncates a live Browse,
+`msg.opcua.browse.truncated` and `truncationReason` make the partial result
+explicit. Unused server ContinuationPoints are released before the operation
+finishes.
+
 Node editors show only the standard settings by default. Connection security/timeouts/cache, Browse limits/paging, Read/Write batching/output, and Subscribe queue/deadband tuning remain available under a closed **Advanced settings** section. Existing flows retain their stored advanced values.
 
+## Server compatibility profiles
+
+Connection nodes default to the standard OPC UA profile. Select **Siemens
+WinCC** for classic WinCC or Unified servers that do not advertise usable
+OperationLimits: Read, Write, and MonitoredItem service calls then use a
+conservative fallback of 200 items per request, while advertised non-zero
+server limits still take precedence. Subscribe nodes use at most 1000
+MonitoredItems per Subscription and remove Deadband filters because WinCC does
+not support `ModifyMonitoredItems`/Deadband behavior consistently. The selected
+profile and effective subscription behavior are included in status diagnostics.
+
 ## Secure connections
 
 Connection nodes support `None/None` and `Sign` or `SignAndEncrypt` with
-`Basic256Sha256`. Secure connections require a client certificate, its private
-key, and at least one trusted Server or CA certificate. Trust is strict: an
+`Basic256Sha256`, `Aes128_Sha256_RsaOaep`, or `Aes256_Sha256_RsaPss`. Secure
+connections require a client certificate, its private key, and at least one
+trusted Server or CA certificate. Trust is strict: an
 empty trust list is rejected instead of silently accepting every Server
 certificate. Optional CRL files can be supplied as a newline-separated list.
 Password-protected PEM private keys use the separate Node-RED credential field,
 so the password is not stored in the normal Flow configuration.
 
-The client Application URI can be configured when the URI embedded in the
-client certificate differs from the open62541 default. Username authentication
-uses the selected secure endpoint and its advertised UserTokenPolicy.
+Before opening the native client, the package checks certificate validity,
+certificate/private-key matching, RSA key type and minimum 2048-bit strength,
+trusted-certificate validity, and Application URI consistency. When the client
+certificate contains exactly one URI, leaving Application URI empty selects it
+automatically. Username authentication uses the selected secure endpoint and
+its advertised UserTokenPolicy.
 
 The Connection editor can call `GetEndpoints`, filters the response to the
 implemented policies, and selects an endpoint compatible with Anonymous or
@@ -190,7 +227,7 @@ Node-RED Alpine image, the pinned open62541 v1.4.16 source archive, and its
 not contact npm or GitHub and does not invoke a compiler:
 
 ```bash
-npm install ./tier0-opcua-client-0.4.1.tgz --offline
+npm install ./tier0-opcua-client-0.6.0.tgz --offline
 ```
 
 The loader uses the bundled native addon directly. Set
@@ -207,6 +244,11 @@ npm run build:offline-prebuild -- --nodedir=/usr/local
 npm pack
 ```
 
+Before publishing, `npm run test:release` runs the JavaScript, native, offline
+runtime, and deployed Node-RED suites when their test Server and Node-RED runtime
+are available. `npm pack` also reruns the JavaScript suite and rejects an
+incomplete offline package.
+
 See `THIRD_PARTY_NOTICES.md` for the bundled open62541 and node-addon-api
 licenses.
 

package/lib/client.js

@@ -3,7 +3,8 @@
 const { EventEmitter } = require('events');
 const { chunks } = require('./points');
 const { loadAddon } = require('./native');
-const { normalizeConnectionOptions } = require('./security');
+const { preflightConnectionSecurity } = require('./security');
+const { SIEMENS_WINCC_DEFAULTS, isSiemensWinCC } = require('./compatibility');
 
 function normalizeNotificationBatch(notification) {
   if (notification && Array.isArray(notification.changes)) {
@@ -16,13 +17,17 @@ function normalizeNotificationBatch(notification) {
   };
 }
 
-function effectiveBatchSize(requested, serverLimit) {
+function effectiveBatchSize(requested, serverLimit, fallbackLimit) {
   const configured = Number.isFinite(Number(requested)) && Number(requested) > 0
     ? Math.floor(Number(requested))
     : 500;
   const limit = Number(serverLimit);
-  return Number.isFinite(limit) && limit > 0
-    ? Math.min(configured, Math.floor(limit))
+  if (Number.isFinite(limit) && limit > 0) {
+    return Math.min(configured, Math.floor(limit));
+  }
+  const fallback = Number(fallbackLimit);
+  return Number.isFinite(fallback) && fallback > 0
+    ? Math.min(configured, Math.floor(fallback))
     : configured;
 }
 
@@ -55,6 +60,7 @@ class OpcUaClient extends EventEmitter {
       operationLimits: {},
       nodeIdCache: {},
       connection: {},
+      compatibility: this.#compatibilityDiagnostics(),
     };
   }
 
@@ -85,7 +91,8 @@ class OpcUaClient extends EventEmitter {
   }
 
   async #connect() {
-    const options = normalizeConnectionOptions(this.options);
+    const options = preflightConnectionSecurity(this.options);
+    this.diagnostics.securityPreflight = options.securityPreflight;
     const addon = loadAddon();
     const token = ++this.connectionToken;
     this.connectionState = 'connecting';
@@ -164,14 +171,36 @@ class OpcUaClient extends EventEmitter {
   }
 
   async browse(options) {
-    return this.#invoke('browseAsync', options);
+    const items = await this.#invoke('browseAsync', options);
+    const browse = {
+      truncated: Boolean(items?.truncated),
+      truncationReason: items?.truncationReason || null,
+      serviceCalls: Number(items?.serviceCalls) || 0,
+      browseBatchSize: Number(items?.browseBatchSize) || 1,
+      releasedContinuationPoints: Number(items?.releasedContinuationPoints) || 0,
+      failures: Array.isArray(items?.browseFailures) ? items.browseFailures : [],
+    };
+    this.diagnostics.browse = browse;
+    if (Array.isArray(items)) {
+      for (const field of [
+        'truncated', 'truncationReason', 'serviceCalls', 'browseBatchSize',
+        'releasedContinuationPoints', 'browseFailures',
+      ]) delete items[field];
+      Object.defineProperty(items, 'diagnostics', {
+        configurable: true,
+        enumerable: false,
+        value: browse,
+      });
+    }
+    return items;
   }
 
   async readMany(points, batchSize = 500) {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxNodesPerRead
+      batchSize, this.diagnostics.operationLimits?.maxNodesPerRead,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke('readManyAsync', batch));
@@ -183,7 +212,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxNodesPerWrite
+      batchSize, this.diagnostics.operationLimits?.maxNodesPerWrite,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke('writeManyAsync', batch));
@@ -201,7 +231,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall
+      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke(
@@ -215,7 +246,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall
+      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(monitoredItemIds, effective)) {
       results.push(...await this.#invoke('removeMonitoredItemsAsync', subscriptionId, batch));
@@ -240,6 +272,22 @@ class OpcUaClient extends EventEmitter {
     return this.diagnostics;
   }
 
+  #compatibilityBatchFallback() {
+    return isSiemensWinCC(this.options.compatibilityProfile)
+      ? SIEMENS_WINCC_DEFAULTS.requestBatchSize
+      : 0;
+  }
+
+  #compatibilityDiagnostics() {
+    const siemensWincc = isSiemensWinCC(this.options.compatibilityProfile);
+    return {
+      profile: siemensWincc ? 'siemens-wincc' : 'standard',
+      requestBatchFallback: siemensWincc
+        ? SIEMENS_WINCC_DEFAULTS.requestBatchSize
+        : null,
+    };
+  }
+
   #refreshDiagnostics() {
     if (this.handle == null) return;
     const addon = loadAddon();
@@ -248,6 +296,9 @@ class OpcUaClient extends EventEmitter {
       const nativeDiagnostics = addon.getClientDiagnostics(this.handle) || {};
       this.diagnostics = {
         ...nativeDiagnostics,
+        browse: this.diagnostics.browse,
+        securityPreflight: this.diagnostics.securityPreflight,
+        compatibility: this.#compatibilityDiagnostics(),
         connection: {
           ...(nativeDiagnostics.connection || {}),
           supervisor: { ...this.supervisorDiagnostics },

package/lib/compatibility.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const COMPATIBILITY_PROFILES = Object.freeze({
+  Standard: 'standard',
+  SiemensWinCC: 'siemens-wincc',
+});
+
+const SIEMENS_WINCC_DEFAULTS = Object.freeze({
+  requestBatchSize: 200,
+  monitoredItemsPerSubscription: 1000,
+});
+
+function normalizeCompatibilityProfile(value) {
+  return value === COMPATIBILITY_PROFILES.SiemensWinCC
+    ? COMPATIBILITY_PROFILES.SiemensWinCC
+    : COMPATIBILITY_PROFILES.Standard;
+}
+
+function isSiemensWinCC(value) {
+  return normalizeCompatibilityProfile(value) === COMPATIBILITY_PROFILES.SiemensWinCC;
+}
+
+module.exports = {
+  COMPATIBILITY_PROFILES,
+  SIEMENS_WINCC_DEFAULTS,
+  isSiemensWinCC,
+  normalizeCompatibilityProfile,
+};

package/lib/points.js

@@ -6,6 +6,17 @@ const DEFAULTS = Object.freeze({
   discardOldest: true,
 });
 
+const INTEGER_RANGES = Object.freeze({
+  SByte: [-128n, 127n],
+  Byte: [0n, 255n],
+  Int16: [-32768n, 32767n],
+  UInt16: [0n, 65535n],
+  Int32: [-2147483648n, 2147483647n],
+  UInt32: [0n, 4294967295n],
+  Int64: [-9223372036854775808n, 9223372036854775807n],
+  UInt64: [0n, 18446744073709551615n],
+});
+
 function positiveNumber(value, fallback) {
   const number = Number(value);
   return Number.isFinite(number) && number > 0 ? number : fallback;
@@ -245,15 +256,39 @@ function messagePoints(msg, staticNodeId, defaults = {}, options = {}) {
 }
 
 function coerceWriteValue(value, dataType) {
-  if (value == null || typeof value !== 'string') return value;
   const type = String(dataType || 'String');
+  if (Array.isArray(value)) {
+    return value.map((item) => coerceWriteValue(item, type));
+  }
+  if (value == null) return value;
   if (type === 'Boolean') {
-    if (/^(true|1)$/i.test(value)) return true;
-    if (/^(false|0)$/i.test(value)) return false;
+    if (typeof value === 'boolean') return value;
+    if (/^(true|1)$/i.test(String(value))) return true;
+    if (/^(false|0)$/i.test(String(value))) return false;
     throw new Error(`Invalid Boolean value: ${value}`);
   }
-  if (/^(S?Byte|U?Int(16|32|64)|Float|Double)$/.test(type)) {
-    const number = Number(value);
+  if (Object.prototype.hasOwnProperty.call(INTEGER_RANGES, type)) {
+    let integer;
+    if (typeof value === 'bigint') integer = value;
+    else if (typeof value === 'number') {
+      if (!Number.isSafeInteger(value)) {
+        throw new Error(`Invalid ${type} value: ${value}; use a decimal string for 64-bit integers`);
+      }
+      integer = BigInt(value);
+    } else if (typeof value === 'string' && /^-?\d+$/.test(value.trim())) {
+      integer = BigInt(value.trim());
+    } else throw new Error(`Invalid ${type} value: ${value}`);
+    const [minimum, maximum] = INTEGER_RANGES[type];
+    if (integer < minimum || integer > maximum) {
+      throw new Error(`Invalid ${type} value: ${value}; outside OPC UA range`);
+    }
+    if (type === 'Int64' || type === 'UInt64') {
+      return typeof value === 'number' ? value : integer.toString();
+    }
+    return Number(integer);
+  }
+  if (type === 'Float' || type === 'Double') {
+    const number = typeof value === 'number' ? value : Number(value);
     if (!Number.isFinite(number)) throw new Error(`Invalid ${type} value: ${value}`);
     return number;
   }

package/lib/security.js

@@ -1,18 +1,111 @@
 'use strict';
 
+const fs = require('node:fs');
+const crypto = require('node:crypto');
+
 const SECURITY_POLICY_URIS = Object.freeze({
   None: 'http://opcfoundation.org/UA/SecurityPolicy#None',
   Basic256Sha256: 'http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256',
+  Aes128_Sha256_RsaOaep: 'http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep',
+  Aes256_Sha256_RsaPss: 'http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss',
 });
 
 const SECURITY_MODES = new Set(['None', 'Sign', 'SignAndEncrypt']);
 
-function configurationError(message) {
+function configurationError(message, code = 'OPCUA_INVALID_SECURITY_CONFIGURATION', cause) {
   const error = new Error(message);
-  error.code = 'OPCUA_INVALID_SECURITY_CONFIGURATION';
+  error.code = code;
+  if (cause) error.cause = cause;
   return error;
 }
 
+function readSecurityFile(filePath, label, readFileSync = fs.readFileSync) {
+  try {
+    return readFileSync(filePath);
+  } catch (error) {
+    throw configurationError(
+      `Cannot read OPC UA ${label}: ${filePath}`,
+      'OPCUA_SECURITY_FILE_UNREADABLE',
+      error
+    );
+  }
+}
+
+function parseCertificate(buffer, label, X509Certificate = crypto.X509Certificate) {
+  try {
+    return new X509Certificate(buffer);
+  } catch (error) {
+    throw configurationError(
+      `Invalid OPC UA ${label}`,
+      'OPCUA_CERTIFICATE_INVALID',
+      error
+    );
+  }
+}
+
+function applicationUris(certificate) {
+  const output = [];
+  const expression = /(?:^|,\s*)URI:((?:"[^"]+")|[^,]+)/g;
+  for (const match of String(certificate.subjectAltName || '').matchAll(expression)) {
+    const value = match[1].replace(/^"|"$/g, '').trim();
+    if (value && !output.includes(value)) output.push(value);
+  }
+  return output;
+}
+
+function validateCertificateTime(certificate, label, now = Date.now()) {
+  const validFrom = Date.parse(certificate.validFrom);
+  const validTo = Date.parse(certificate.validTo);
+  if (Number.isFinite(validFrom) && now < validFrom) {
+    throw configurationError(
+      `OPC UA ${label} is not valid before ${certificate.validFrom}`,
+      'OPCUA_CERTIFICATE_NOT_YET_VALID'
+    );
+  }
+  if (Number.isFinite(validTo) && now > validTo) {
+    throw configurationError(
+      `OPC UA ${label} expired at ${certificate.validTo}`,
+      'OPCUA_CERTIFICATE_EXPIRED'
+    );
+  }
+}
+
+function loadPrivateKey(buffer, passphrase, createPrivateKey = crypto.createPrivateKey) {
+  const password = passphrase ? String(passphrase) : undefined;
+  const attempts = [
+    { key: buffer, passphrase: password },
+    { key: buffer, format: 'der', type: 'pkcs8', passphrase: password },
+    { key: buffer, format: 'der', type: 'pkcs1', passphrase: password },
+  ];
+  let lastError;
+  for (const options of attempts) {
+    try {
+      return createPrivateKey(options);
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw configurationError(
+    'Invalid OPC UA client private key or key password',
+    'OPCUA_PRIVATE_KEY_INVALID',
+    lastError
+  );
+}
+
+function certificateSummary(certificate, uri) {
+  const publicKey = certificate.publicKey;
+  return {
+    subject: certificate.subject,
+    issuer: certificate.issuer,
+    validFrom: certificate.validFrom,
+    validTo: certificate.validTo,
+    fingerprint256: certificate.fingerprint256,
+    applicationUri: uri || null,
+    publicKeyType: publicKey?.asymmetricKeyType || null,
+    modulusLength: publicKey?.asymmetricKeyDetails?.modulusLength || null,
+  };
+}
+
 function normalizePathList(value) {
   const source = Array.isArray(value)
     ? value
@@ -72,6 +165,92 @@ function normalizeConnectionOptions(options = {}) {
   return normalized;
 }
 
+function preflightConnectionSecurity(options = {}, dependencies = {}) {
+  const normalized = normalizeConnectionOptions(options);
+  const runtime = {
+    readFileSync: dependencies.readFileSync || fs.readFileSync,
+    X509Certificate: dependencies.X509Certificate || crypto.X509Certificate,
+    createPrivateKey: dependencies.createPrivateKey || crypto.createPrivateKey,
+    now: dependencies.now == null ? Date.now() : Number(dependencies.now),
+  };
+  if (normalized.securityMode === 'None') {
+    return {
+      ...normalized,
+      securityPreflight: { enabled: false, policy: normalized.securityPolicy },
+    };
+  }
+
+  const certificate = parseCertificate(
+    readSecurityFile(normalized.certificate, 'client certificate', runtime.readFileSync),
+    'client certificate',
+    runtime.X509Certificate
+  );
+  validateCertificateTime(certificate, 'client certificate', runtime.now);
+
+  const uris = applicationUris(certificate);
+  const applicationUri = normalized.applicationUri || (uris.length === 1 ? uris[0] : '');
+  if (!applicationUri) {
+    throw configurationError(
+      'The OPC UA client certificate must contain one Application URI or Application URI must be configured',
+      'OPCUA_CERTIFICATE_URI_MISSING'
+    );
+  }
+  if (!uris.includes(applicationUri)) {
+    throw configurationError(
+      `Configured Application URI does not match the client certificate: ${applicationUri}`,
+      'OPCUA_CERTIFICATE_URI_MISMATCH'
+    );
+  }
+
+  const privateKey = loadPrivateKey(
+    readSecurityFile(normalized.privateKey, 'client private key', runtime.readFileSync),
+    normalized.privateKeyPassword,
+    runtime.createPrivateKey
+  );
+  if (!certificate.checkPrivateKey(privateKey)) {
+    throw configurationError(
+      'The OPC UA client private key does not match the client certificate',
+      'OPCUA_PRIVATE_KEY_MISMATCH'
+    );
+  }
+
+  const keyType = certificate.publicKey?.asymmetricKeyType || '';
+  const modulusLength = Number(certificate.publicKey?.asymmetricKeyDetails?.modulusLength) || 0;
+  if (!keyType.startsWith('rsa')) {
+    throw configurationError(
+      `OPC UA ${normalized.securityPolicy} requires an RSA client certificate`,
+      'OPCUA_CERTIFICATE_KEY_TYPE_UNSUPPORTED'
+    );
+  }
+  if (modulusLength > 0 && modulusLength < 2048) {
+    throw configurationError(
+      `OPC UA client certificate RSA key is too short: ${modulusLength} bits; at least 2048 bits required`,
+      'OPCUA_CERTIFICATE_KEY_TOO_SHORT'
+    );
+  }
+
+  const trust = normalized.trustedCertificates.map((filePath) => {
+    const trusted = parseCertificate(
+      readSecurityFile(filePath, 'trusted certificate', runtime.readFileSync),
+      `trusted certificate: ${filePath}`,
+      runtime.X509Certificate
+    );
+    validateCertificateTime(trusted, `trusted certificate: ${filePath}`, runtime.now);
+    return certificateSummary(trusted);
+  });
+
+  return {
+    ...normalized,
+    applicationUri,
+    securityPreflight: {
+      enabled: true,
+      policy: normalized.securityPolicy,
+      clientCertificate: certificateSummary(certificate, applicationUri),
+      trustedCertificates: trust,
+    },
+  };
+}
+
 function endpointIdentityTypes(endpoint) {
   return [...new Set((endpoint?.userIdentityTokens || []).map((token) => token.tokenType))];
 }
@@ -92,5 +271,6 @@ module.exports = {
   matchingEndpoints,
   normalizeConnectionOptions,
   normalizePathList,
+  preflightConnectionSecurity,
   securityPolicyName,
 };

package/nodes/browse.html

@@ -36,6 +36,8 @@
     <div class="form-row"><label for="node-input-variablesOnly">Variables only</label><input type="checkbox" id="node-input-variablesOnly" style="width:auto"></div>
     <div class="form-row"><label for="node-input-maxDepth">Maximum depth</label><input type="number" id="node-input-maxDepth"></div>
     <div class="form-row"><label for="node-input-maxNodes">Maximum nodes</label><input type="number" id="node-input-maxNodes"></div>
+    <div class="form-row"><label for="node-input-browseBatchSize">Browse batch</label><input type="number" id="node-input-browseBatchSize"></div>
+    <div class="form-row"><label for="node-input-referencesPerNode">References / page</label><input type="number" id="node-input-referencesPerNode"></div>
     <div class="form-row"><label for="node-input-attributeBatchSize">Attribute batch</label><input type="number" id="node-input-attributeBatchSize"></div>
     <div class="form-row"><label for="node-input-outputMode">Output</label><select id="node-input-outputMode"><option value="all">All selected points</option><option value="paged">Paged selected points</option></select></div>
     <div class="form-row"><label for="node-input-pageSize">Page size</label><input type="number" id="node-input-pageSize"></div>
@@ -54,7 +56,7 @@
       <li><code>msg.nodeId</code> 或 <code>msg.topic</code> 可覆盖根 NodeId；默认根节点为 ObjectsFolder。</li>
     </ul>
     <h4>输出</h4>
-    <p><code>msg.payload</code> 是点位描述数组，包含 NodeId、名称、Browse 路径、数据类型和访问属性，可直接连接 Read 或 Subscribe。Paged 模式会分批输出，并通过 <code>msg.opcua.command</code> 标记 replace/add。</p>
+    <p><code>msg.payload</code> 是点位描述数组，包含 NodeId、名称、Browse 路径、数据类型和访问属性，可直接连接 Read 或 Subscribe。Paged 模式会分批输出，并通过 <code>msg.opcua.command</code> 标记 replace/add。浏览被最大深度或节点数截断时，<code>msg.opcua.browse.truncated</code> 为 true；节点会释放未使用的 ContinuationPoint。</p>
   </section>
   <hr>
   <section lang="en">
@@ -68,7 +70,7 @@
       <li><code>msg.nodeId</code> or <code>msg.topic</code> can override the root NodeId; the default root is ObjectsFolder.</li>
     </ul>
     <h4>Output</h4>
-    <p><code>msg.payload</code> is an array of point descriptors containing NodeId, names, Browse path, data type, and access attributes. It can feed Read or Subscribe directly. Paged mode emits multiple messages with replace/add in <code>msg.opcua.command</code>.</p>
+    <p><code>msg.payload</code> is an array of point descriptors containing NodeId, names, Browse path, data type, and access attributes. It can feed Read or Subscribe directly. Paged mode emits multiple messages with replace/add in <code>msg.opcua.command</code>. When maximum depth or node count truncates a Browse, <code>msg.opcua.browse.truncated</code> is true; unused ContinuationPoints are released.</p>
   </section>
 </script>
 <script type="text/javascript">
@@ -78,6 +80,8 @@
       connection: { value: '', type: 'tier0-opcua-connection', required: true }, rootNodeId: { value: 'ns=0;i=85' },
       selectedNodes: { value: [] }, recursive: { value: true }, variablesOnly: { value: true },
       maxDepth: { value: 10, validate: RED.validators.number() }, maxNodes: { value: 10000, validate: RED.validators.number() },
+      browseBatchSize: { value: 100, validate: RED.validators.number() },
+      referencesPerNode: { value: 1000, validate: RED.validators.number() },
       attributeBatchSize: { value: 200, validate: RED.validators.number() }, outputMode: { value: 'all' },
       pageSize: { value: 500, validate: RED.validators.number() }, name: { value: '' }
     },
@@ -240,6 +244,8 @@
             rootNodeId: $('#node-input-rootNodeId').val() || 'ns=0;i=85',
             maxDepth: $('#node-input-maxDepth').val(),
             maxNodes: $('#node-input-maxNodes').val(),
+            browseBatchSize: $('#node-input-browseBatchSize').val(),
+            referencesPerNode: $('#node-input-referencesPerNode').val(),
             attributeBatchSize: $('#node-input-attributeBatchSize').val()
           })
         }).done((data) => {
@@ -248,6 +254,11 @@
             return;
           }
           renderTree(data.tree);
+          if (data.truncated) {
+            statusArea.text(`${data.total} node(s) loaded; truncated by ${data.truncationReason || 'server limit'}.`);
+          } else if (Array.isArray(data.failures) && data.failures.length) {
+            statusArea.text(`${data.total} node(s) loaded; ${data.failures.length} branch(es) failed.`);
+          }
         }).fail((request) => {
           const message = request.responseJSON && request.responseJSON.error || request.responseText || 'Browse failed';
           statusArea.text(message);