@tier0/opcua-client 0.5.0 → 0.6.0

package/README.md

@@ -178,19 +178,34 @@ finishes.
 
 Node editors show only the standard settings by default. Connection security/timeouts/cache, Browse limits/paging, Read/Write batching/output, and Subscribe queue/deadband tuning remain available under a closed **Advanced settings** section. Existing flows retain their stored advanced values.
 
+## Server compatibility profiles
+
+Connection nodes default to the standard OPC UA profile. Select **Siemens
+WinCC** for classic WinCC or Unified servers that do not advertise usable
+OperationLimits: Read, Write, and MonitoredItem service calls then use a
+conservative fallback of 200 items per request, while advertised non-zero
+server limits still take precedence. Subscribe nodes use at most 1000
+MonitoredItems per Subscription and remove Deadband filters because WinCC does
+not support `ModifyMonitoredItems`/Deadband behavior consistently. The selected
+profile and effective subscription behavior are included in status diagnostics.
+
 ## Secure connections
 
 Connection nodes support `None/None` and `Sign` or `SignAndEncrypt` with
-`Basic256Sha256`. Secure connections require a client certificate, its private
-key, and at least one trusted Server or CA certificate. Trust is strict: an
+`Basic256Sha256`, `Aes128_Sha256_RsaOaep`, or `Aes256_Sha256_RsaPss`. Secure
+connections require a client certificate, its private key, and at least one
+trusted Server or CA certificate. Trust is strict: an
 empty trust list is rejected instead of silently accepting every Server
 certificate. Optional CRL files can be supplied as a newline-separated list.
 Password-protected PEM private keys use the separate Node-RED credential field,
 so the password is not stored in the normal Flow configuration.
 
-The client Application URI can be configured when the URI embedded in the
-client certificate differs from the open62541 default. Username authentication
-uses the selected secure endpoint and its advertised UserTokenPolicy.
+Before opening the native client, the package checks certificate validity,
+certificate/private-key matching, RSA key type and minimum 2048-bit strength,
+trusted-certificate validity, and Application URI consistency. When the client
+certificate contains exactly one URI, leaving Application URI empty selects it
+automatically. Username authentication uses the selected secure endpoint and
+its advertised UserTokenPolicy.
 
 The Connection editor can call `GetEndpoints`, filters the response to the
 implemented policies, and selects an endpoint compatible with Anonymous or
@@ -212,7 +227,7 @@ Node-RED Alpine image, the pinned open62541 v1.4.16 source archive, and its
 not contact npm or GitHub and does not invoke a compiler:
 
 ```bash
-npm install ./tier0-opcua-client-0.5.0.tgz --offline
+npm install ./tier0-opcua-client-0.6.0.tgz --offline
 ```
 
 The loader uses the bundled native addon directly. Set

package/lib/client.js

@@ -3,7 +3,8 @@
 const { EventEmitter } = require('events');
 const { chunks } = require('./points');
 const { loadAddon } = require('./native');
-const { normalizeConnectionOptions } = require('./security');
+const { preflightConnectionSecurity } = require('./security');
+const { SIEMENS_WINCC_DEFAULTS, isSiemensWinCC } = require('./compatibility');
 
 function normalizeNotificationBatch(notification) {
   if (notification && Array.isArray(notification.changes)) {
@@ -16,13 +17,17 @@ function normalizeNotificationBatch(notification) {
   };
 }
 
-function effectiveBatchSize(requested, serverLimit) {
+function effectiveBatchSize(requested, serverLimit, fallbackLimit) {
   const configured = Number.isFinite(Number(requested)) && Number(requested) > 0
     ? Math.floor(Number(requested))
     : 500;
   const limit = Number(serverLimit);
-  return Number.isFinite(limit) && limit > 0
-    ? Math.min(configured, Math.floor(limit))
+  if (Number.isFinite(limit) && limit > 0) {
+    return Math.min(configured, Math.floor(limit));
+  }
+  const fallback = Number(fallbackLimit);
+  return Number.isFinite(fallback) && fallback > 0
+    ? Math.min(configured, Math.floor(fallback))
     : configured;
 }
 
@@ -55,6 +60,7 @@ class OpcUaClient extends EventEmitter {
       operationLimits: {},
       nodeIdCache: {},
       connection: {},
+      compatibility: this.#compatibilityDiagnostics(),
     };
   }
 
@@ -85,7 +91,8 @@ class OpcUaClient extends EventEmitter {
   }
 
   async #connect() {
-    const options = normalizeConnectionOptions(this.options);
+    const options = preflightConnectionSecurity(this.options);
+    this.diagnostics.securityPreflight = options.securityPreflight;
     const addon = loadAddon();
     const token = ++this.connectionToken;
     this.connectionState = 'connecting';
@@ -192,7 +199,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxNodesPerRead
+      batchSize, this.diagnostics.operationLimits?.maxNodesPerRead,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke('readManyAsync', batch));
@@ -204,7 +212,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxNodesPerWrite
+      batchSize, this.diagnostics.operationLimits?.maxNodesPerWrite,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke('writeManyAsync', batch));
@@ -222,7 +231,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall
+      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke(
@@ -236,7 +246,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall
+      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(monitoredItemIds, effective)) {
       results.push(...await this.#invoke('removeMonitoredItemsAsync', subscriptionId, batch));
@@ -261,6 +272,22 @@ class OpcUaClient extends EventEmitter {
     return this.diagnostics;
   }
 
+  #compatibilityBatchFallback() {
+    return isSiemensWinCC(this.options.compatibilityProfile)
+      ? SIEMENS_WINCC_DEFAULTS.requestBatchSize
+      : 0;
+  }
+
+  #compatibilityDiagnostics() {
+    const siemensWincc = isSiemensWinCC(this.options.compatibilityProfile);
+    return {
+      profile: siemensWincc ? 'siemens-wincc' : 'standard',
+      requestBatchFallback: siemensWincc
+        ? SIEMENS_WINCC_DEFAULTS.requestBatchSize
+        : null,
+    };
+  }
+
   #refreshDiagnostics() {
     if (this.handle == null) return;
     const addon = loadAddon();
@@ -270,6 +297,8 @@ class OpcUaClient extends EventEmitter {
       this.diagnostics = {
         ...nativeDiagnostics,
         browse: this.diagnostics.browse,
+        securityPreflight: this.diagnostics.securityPreflight,
+        compatibility: this.#compatibilityDiagnostics(),
         connection: {
           ...(nativeDiagnostics.connection || {}),
           supervisor: { ...this.supervisorDiagnostics },

package/lib/compatibility.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const COMPATIBILITY_PROFILES = Object.freeze({
+  Standard: 'standard',
+  SiemensWinCC: 'siemens-wincc',
+});
+
+const SIEMENS_WINCC_DEFAULTS = Object.freeze({
+  requestBatchSize: 200,
+  monitoredItemsPerSubscription: 1000,
+});
+
+function normalizeCompatibilityProfile(value) {
+  return value === COMPATIBILITY_PROFILES.SiemensWinCC
+    ? COMPATIBILITY_PROFILES.SiemensWinCC
+    : COMPATIBILITY_PROFILES.Standard;
+}
+
+function isSiemensWinCC(value) {
+  return normalizeCompatibilityProfile(value) === COMPATIBILITY_PROFILES.SiemensWinCC;
+}
+
+module.exports = {
+  COMPATIBILITY_PROFILES,
+  SIEMENS_WINCC_DEFAULTS,
+  isSiemensWinCC,
+  normalizeCompatibilityProfile,
+};

package/lib/security.js

@@ -1,18 +1,111 @@
 'use strict';
 
+const fs = require('node:fs');
+const crypto = require('node:crypto');
+
 const SECURITY_POLICY_URIS = Object.freeze({
   None: 'http://opcfoundation.org/UA/SecurityPolicy#None',
   Basic256Sha256: 'http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256',
+  Aes128_Sha256_RsaOaep: 'http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep',
+  Aes256_Sha256_RsaPss: 'http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss',
 });
 
 const SECURITY_MODES = new Set(['None', 'Sign', 'SignAndEncrypt']);
 
-function configurationError(message) {
+function configurationError(message, code = 'OPCUA_INVALID_SECURITY_CONFIGURATION', cause) {
   const error = new Error(message);
-  error.code = 'OPCUA_INVALID_SECURITY_CONFIGURATION';
+  error.code = code;
+  if (cause) error.cause = cause;
   return error;
 }
 
+function readSecurityFile(filePath, label, readFileSync = fs.readFileSync) {
+  try {
+    return readFileSync(filePath);
+  } catch (error) {
+    throw configurationError(
+      `Cannot read OPC UA ${label}: ${filePath}`,
+      'OPCUA_SECURITY_FILE_UNREADABLE',
+      error
+    );
+  }
+}
+
+function parseCertificate(buffer, label, X509Certificate = crypto.X509Certificate) {
+  try {
+    return new X509Certificate(buffer);
+  } catch (error) {
+    throw configurationError(
+      `Invalid OPC UA ${label}`,
+      'OPCUA_CERTIFICATE_INVALID',
+      error
+    );
+  }
+}
+
+function applicationUris(certificate) {
+  const output = [];
+  const expression = /(?:^|,\s*)URI:((?:"[^"]+")|[^,]+)/g;
+  for (const match of String(certificate.subjectAltName || '').matchAll(expression)) {
+    const value = match[1].replace(/^"|"$/g, '').trim();
+    if (value && !output.includes(value)) output.push(value);
+  }
+  return output;
+}
+
+function validateCertificateTime(certificate, label, now = Date.now()) {
+  const validFrom = Date.parse(certificate.validFrom);
+  const validTo = Date.parse(certificate.validTo);
+  if (Number.isFinite(validFrom) && now < validFrom) {
+    throw configurationError(
+      `OPC UA ${label} is not valid before ${certificate.validFrom}`,
+      'OPCUA_CERTIFICATE_NOT_YET_VALID'
+    );
+  }
+  if (Number.isFinite(validTo) && now > validTo) {
+    throw configurationError(
+      `OPC UA ${label} expired at ${certificate.validTo}`,
+      'OPCUA_CERTIFICATE_EXPIRED'
+    );
+  }
+}
+
+function loadPrivateKey(buffer, passphrase, createPrivateKey = crypto.createPrivateKey) {
+  const password = passphrase ? String(passphrase) : undefined;
+  const attempts = [
+    { key: buffer, passphrase: password },
+    { key: buffer, format: 'der', type: 'pkcs8', passphrase: password },
+    { key: buffer, format: 'der', type: 'pkcs1', passphrase: password },
+  ];
+  let lastError;
+  for (const options of attempts) {
+    try {
+      return createPrivateKey(options);
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw configurationError(
+    'Invalid OPC UA client private key or key password',
+    'OPCUA_PRIVATE_KEY_INVALID',
+    lastError
+  );
+}
+
+function certificateSummary(certificate, uri) {
+  const publicKey = certificate.publicKey;
+  return {
+    subject: certificate.subject,
+    issuer: certificate.issuer,
+    validFrom: certificate.validFrom,
+    validTo: certificate.validTo,
+    fingerprint256: certificate.fingerprint256,
+    applicationUri: uri || null,
+    publicKeyType: publicKey?.asymmetricKeyType || null,
+    modulusLength: publicKey?.asymmetricKeyDetails?.modulusLength || null,
+  };
+}
+
 function normalizePathList(value) {
   const source = Array.isArray(value)
     ? value
@@ -72,6 +165,92 @@ function normalizeConnectionOptions(options = {}) {
   return normalized;
 }
 
+function preflightConnectionSecurity(options = {}, dependencies = {}) {
+  const normalized = normalizeConnectionOptions(options);
+  const runtime = {
+    readFileSync: dependencies.readFileSync || fs.readFileSync,
+    X509Certificate: dependencies.X509Certificate || crypto.X509Certificate,
+    createPrivateKey: dependencies.createPrivateKey || crypto.createPrivateKey,
+    now: dependencies.now == null ? Date.now() : Number(dependencies.now),
+  };
+  if (normalized.securityMode === 'None') {
+    return {
+      ...normalized,
+      securityPreflight: { enabled: false, policy: normalized.securityPolicy },
+    };
+  }
+
+  const certificate = parseCertificate(
+    readSecurityFile(normalized.certificate, 'client certificate', runtime.readFileSync),
+    'client certificate',
+    runtime.X509Certificate
+  );
+  validateCertificateTime(certificate, 'client certificate', runtime.now);
+
+  const uris = applicationUris(certificate);
+  const applicationUri = normalized.applicationUri || (uris.length === 1 ? uris[0] : '');
+  if (!applicationUri) {
+    throw configurationError(
+      'The OPC UA client certificate must contain one Application URI or Application URI must be configured',
+      'OPCUA_CERTIFICATE_URI_MISSING'
+    );
+  }
+  if (!uris.includes(applicationUri)) {
+    throw configurationError(
+      `Configured Application URI does not match the client certificate: ${applicationUri}`,
+      'OPCUA_CERTIFICATE_URI_MISMATCH'
+    );
+  }
+
+  const privateKey = loadPrivateKey(
+    readSecurityFile(normalized.privateKey, 'client private key', runtime.readFileSync),
+    normalized.privateKeyPassword,
+    runtime.createPrivateKey
+  );
+  if (!certificate.checkPrivateKey(privateKey)) {
+    throw configurationError(
+      'The OPC UA client private key does not match the client certificate',
+      'OPCUA_PRIVATE_KEY_MISMATCH'
+    );
+  }
+
+  const keyType = certificate.publicKey?.asymmetricKeyType || '';
+  const modulusLength = Number(certificate.publicKey?.asymmetricKeyDetails?.modulusLength) || 0;
+  if (!keyType.startsWith('rsa')) {
+    throw configurationError(
+      `OPC UA ${normalized.securityPolicy} requires an RSA client certificate`,
+      'OPCUA_CERTIFICATE_KEY_TYPE_UNSUPPORTED'
+    );
+  }
+  if (modulusLength > 0 && modulusLength < 2048) {
+    throw configurationError(
+      `OPC UA client certificate RSA key is too short: ${modulusLength} bits; at least 2048 bits required`,
+      'OPCUA_CERTIFICATE_KEY_TOO_SHORT'
+    );
+  }
+
+  const trust = normalized.trustedCertificates.map((filePath) => {
+    const trusted = parseCertificate(
+      readSecurityFile(filePath, 'trusted certificate', runtime.readFileSync),
+      `trusted certificate: ${filePath}`,
+      runtime.X509Certificate
+    );
+    validateCertificateTime(trusted, `trusted certificate: ${filePath}`, runtime.now);
+    return certificateSummary(trusted);
+  });
+
+  return {
+    ...normalized,
+    applicationUri,
+    securityPreflight: {
+      enabled: true,
+      policy: normalized.securityPolicy,
+      clientCertificate: certificateSummary(certificate, applicationUri),
+      trustedCertificates: trust,
+    },
+  };
+}
+
 function endpointIdentityTypes(endpoint) {
   return [...new Set((endpoint?.userIdentityTokens || []).map((token) => token.tokenType))];
 }
@@ -92,5 +271,6 @@ module.exports = {
   matchingEndpoints,
   normalizeConnectionOptions,
   normalizePathList,
+  preflightConnectionSecurity,
   securityPolicyName,
 };

package/nodes/connection.html

@@ -15,11 +15,13 @@
   <div class="form-row"><label></label><button type="button" class="red-ui-button" id="node-config-input-discoverEndpoints">Discover endpoints</button> <button type="button" class="red-ui-button" id="node-config-input-testConnection">Test connection</button></div>
   <div class="opcua-discovery-result" id="node-config-input-discoveryResult" style="display:none"><select id="node-config-input-discoveredEndpoint"></select></div>
   <div class="opcua-standard-note" id="node-config-input-testResult"></div>
+  <div class="form-row"><label for="node-config-input-compatibilityProfile">Server profile</label><select id="node-config-input-compatibilityProfile"><option value="standard">Standard OPC UA</option><option value="siemens-wincc">Siemens WinCC</option></select></div>
+  <div class="opcua-standard-note">Siemens WinCC uses conservative 200-item service batches and disables unsupported Subscription Deadband filters when the Server does not advertise usable limits.</div>
   <div class="form-row"><label for="node-config-input-securityMode">Security</label><select id="node-config-input-securityMode"><option value="None">None</option><option value="Sign">Sign</option><option value="SignAndEncrypt">SignAndEncrypt</option></select></div>
   <div class="opcua-standard-note">Standard defaults include automatic reconnect, connectivity checks, and bounded command/NodeId queues.</div>
   <details class="opcua-advanced">
     <summary>Security and advanced connection settings</summary>
-    <div class="form-row"><label for="node-config-input-securityPolicy">Policy</label><select id="node-config-input-securityPolicy"><option value="None">None</option><option value="Basic256Sha256">Basic256Sha256</option></select></div>
+    <div class="form-row"><label for="node-config-input-securityPolicy">Policy</label><select id="node-config-input-securityPolicy"><option value="None">None</option><option value="Basic256Sha256">Basic256Sha256</option><option value="Aes128_Sha256_RsaOaep">Aes128_Sha256_RsaOaep</option><option value="Aes256_Sha256_RsaPss">Aes256_Sha256_RsaPss</option></select></div>
     <div class="form-row"><label for="node-config-input-user">User</label><input type="text" id="node-config-input-user"></div>
     <div class="form-row"><label for="node-config-input-password">Password</label><input type="password" id="node-config-input-password"></div>
     <div class="form-row opcua-secure-field"><label for="node-config-input-certificate">Client certificate</label><input type="text" class="opcua-security-path" id="node-config-input-certificate" placeholder="Upload or enter /path/to/client.der"> <button type="button" class="red-ui-button" id="node-config-upload-certificate"><i class="fa fa-upload"></i> Upload</button><input type="file" class="opcua-hidden-file" id="node-config-file-certificate" accept=".der,.pem,.crt,.cer"></div>
@@ -50,8 +52,9 @@
       <li><b>Endpoint</b>：服务器地址，例如 <code>opc.tcp://192.168.1.10:4840</code>。</li>
       <li><b>Discover endpoints</b>：读取服务器公开的安全模式、安全策略和用户认证方式。</li>
       <li><b>Test connection</b>：使用当前配置建立临时连接并验证认证。</li>
-      <li><b>Security</b>：支持 None、Sign、SignAndEncrypt；安全模式、策略和认证方式必须与服务器 Endpoint 匹配。</li>
-      <li><b>证书</b>：安全连接可上传或指定客户端证书、私钥、信任证书和 CRL。Application URI 应与客户端证书一致。</li>
+      <li><b>Server profile</b>：默认使用标准 OPC UA 行为；Siemens WinCC 模式在服务器未公布有效 OperationLimits 时按每批 200 点请求，并在订阅中禁用 WinCC 不支持的 Deadband。</li>
+      <li><b>Security</b>：支持 None、Sign、SignAndEncrypt，以及 Basic256Sha256、Aes128_Sha256_RsaOaep、Aes256_Sha256_RsaPss；安全模式、策略和认证方式必须与服务器 Endpoint 匹配。</li>
+      <li><b>证书</b>：安全连接可上传或指定客户端证书、私钥、信任证书和 CRL。连接前会检查有效期、证书和私钥是否匹配、RSA 密钥强度及 Application URI。若证书只包含一个 URI，可留空并自动采用。</li>
     </ul>
     <h4>建议</h4>
     <p>一个 Connection 配置对应一条客户端 Session。多个业务节点应复用同一个 Connection，避免为相同 Endpoint 重复创建 Session。节点内置自动重连、连通性检查以及有界命令队列。</p>
@@ -65,8 +68,9 @@
       <li><b>Endpoint</b>: Server URL, for example <code>opc.tcp://192.168.1.10:4840</code>.</li>
       <li><b>Discover endpoints</b>: Reads advertised security modes, policies, and user token types.</li>
       <li><b>Test connection</b>: Opens a temporary connection with the current settings and validates authentication.</li>
-      <li><b>Security</b>: Supports None, Sign, and SignAndEncrypt. Mode, policy, and identity must match an advertised endpoint.</li>
-      <li><b>Certificates</b>: Secure connections can upload or reference a client certificate, private key, trust list, and CRLs. The Application URI should match the client certificate.</li>
+      <li><b>Server profile</b>: Standard uses normal OPC UA behavior. Siemens WinCC falls back to 200-item service batches when usable OperationLimits are not advertised and removes unsupported Subscription Deadband filters.</li>
+      <li><b>Security</b>: Supports None, Sign, and SignAndEncrypt with Basic256Sha256, Aes128_Sha256_RsaOaep, or Aes256_Sha256_RsaPss. Mode, policy, and identity must match an advertised endpoint.</li>
+      <li><b>Certificates</b>: Secure connections can upload or reference a client certificate, private key, trust list, and CRLs. Validity, key matching, RSA strength, and Application URI are checked before connecting. An empty URI is filled automatically when the certificate contains exactly one URI.</li>
     </ul>
     <h4>Recommendation</h4>
     <p>One Connection configuration owns one client Session. Reuse it across nodes targeting the same server instead of creating duplicate Sessions. Automatic reconnect, connectivity checks, and a bounded command queue are enabled.</p>
@@ -78,6 +82,7 @@
     defaults: {
       endpoint: { value: '', required: true },
       securityMode: { value: 'None' }, securityPolicy: { value: 'None' },
+      compatibilityProfile: { value: 'standard' },
       user: { value: '' }, certificate: { value: '' }, privateKey: { value: '' },
       applicationUri: { value: '' }, trustedCertificates: { value: '' }, revocationList: { value: '' },
       requestedSessionTimeout: { value: 60000, validate: RED.validators.number() },
@@ -207,6 +212,7 @@
           endpoint: String($('#node-config-input-endpoint').val() || '').trim(),
           securityMode: mode.val(),
           securityPolicy: policy.val(),
+          compatibilityProfile: $('#node-config-input-compatibilityProfile').val(),
           user: $('#node-config-input-user').val(),
           password: $('#node-config-input-password').val(),
           certificate: $('#node-config-input-certificate').val(),
@@ -245,9 +251,12 @@
           const allEndpoints = Array.isArray(response.endpoints) ? response.endpoints : [];
           const identityType = String($('#node-config-input-user').val() || '').trim()
             ? 'Username' : 'Anonymous';
+          const supportedPolicies = new Set([
+            'None', 'Basic256Sha256',
+            'Aes128_Sha256_RsaOaep', 'Aes256_Sha256_RsaPss',
+          ]);
           const supported = allEndpoints.filter(function (item) {
-            const itemPolicy = policyName(item.securityPolicyUri);
-            return itemPolicy === 'None' || itemPolicy === 'Basic256Sha256';
+            return supportedPolicies.has(policyName(item.securityPolicyUri));
           });
           const matchingIdentity = supported.filter(function (item) {
             return (item.userIdentityTokens || []).some(function (token) {
@@ -271,7 +280,7 @@
               .appendTo(discovered);
           });
           if (!endpoints.length) {
-            RED.notify('The server returned no supported None or Basic256Sha256 endpoint', 'warning');
+            RED.notify('The server returned no endpoint supported by this client', 'warning');
             result.hide();
             return;
           }
@@ -293,7 +302,8 @@
         if (!selected) return;
         const selectedPolicy = policyName(selected.securityPolicyUri);
         mode.val(selected.securityMode);
-        if (selectedPolicy === 'None' || selectedPolicy === 'Basic256Sha256') {
+        if (['None', 'Basic256Sha256', 'Aes128_Sha256_RsaOaep',
+          'Aes256_Sha256_RsaPss'].includes(selectedPolicy)) {
           policy.val(selectedPolicy);
         }
         updateSecurityFields();

package/nodes/connection.js

@@ -3,6 +3,7 @@
 const { OpcUaClient, discoverEndpoints } = require('../lib/client');
 const { ConnectionRegistry } = require('../lib/connection-registry');
 const { SecurityFileStore } = require('../lib/security-file-store');
+const { normalizeCompatibilityProfile } = require('../lib/compatibility');
 
 function pathList(value) {
   const source = Array.isArray(value) ? value : String(value || '').split(/\r?\n|;/);
@@ -14,6 +15,7 @@ function clientOptions(config, credentials = {}) {
     endpoint: config.endpoint,
     securityMode: config.securityMode || 'None',
     securityPolicy: config.securityPolicy || 'None',
+    compatibilityProfile: normalizeCompatibilityProfile(config.compatibilityProfile),
     user: config.user || '',
     password: credentials.password || '',
     certificate: config.certificate || '',

package/nodes/subscribe.html

@@ -71,6 +71,7 @@
       <li>服务器可以把请求间隔修订为它支持的值。</li>
     </ul>
     <p>新节点默认 Server queue size=1、Discard oldest=true、Queue mode=latest，适合实时状态采集。脉冲、报警转换或完整历史不能丢失时，应改为 all 并增大服务器队列。</p>
+    <p>Connection 选择 Siemens WinCC 后，如果服务器没有公布有效限制，每个 Subscription 最多建立 1000 个 MonitoredItem，并自动移除 WinCC 不支持的 Deadband 配置；节点状态消息会报告实际兼容策略。</p>
     <h4>输出</h4>
     <ul>
       <li><b>Compact</b>：NodeId/alias、值、状态和源时间戳。</li>
@@ -93,6 +94,7 @@
       <li>The server may revise requested intervals to supported values.</li>
     </ul>
     <p>New nodes default to server queue size 1, discard-oldest, and local latest coalescing for real-time state. Select all and increase the server queue for pulses, alarm transitions, or history where every change must be retained.</p>
+    <p>With the Siemens WinCC Connection profile, each Subscription is conservatively capped at 1000 MonitoredItems when the server advertises no usable limit, and unsupported Deadband filters are removed automatically. Status output reports the active compatibility behavior.</p>
     <h4>Output</h4>
     <ul>
       <li><b>Compact</b>: NodeId/alias, value, status, and source timestamp.</li>

package/nodes/subscribe.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { looksLikePointList, messagePoints } = require('../lib/points');
+const { SIEMENS_WINCC_DEFAULTS, isSiemensWinCC } = require('../lib/compatibility');
 
 const NOTIFICATION_CONFIG_FIELDS = new Set([
   'nodeId',
@@ -55,19 +56,19 @@ function positiveInteger(value, fallback) {
   return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
 }
 
-function monitoringSettings(point, config) {
+function monitoringSettings(point, config, siemensWincc = false) {
   return {
     samplingInterval: Number(point.samplingInterval) || Number(config.samplingInterval) || 1000,
     queueSize: positiveInteger(point.queueSize, positiveInteger(config.queueSize, 1)),
     discardOldest: point.discardOldest !== false,
-    deadbandType: point.deadbandType || config.deadbandType || 'none',
-    deadbandValue: Number(point.deadbandValue ?? config.deadbandValue) || 0,
+    deadbandType: siemensWincc ? 'none' : point.deadbandType || config.deadbandType || 'none',
+    deadbandValue: siemensWincc ? 0 : Number(point.deadbandValue ?? config.deadbandValue) || 0,
   };
 }
 
-function sameMonitoringSettings(left, right, config) {
-  const leftSettings = monitoringSettings(left, config);
-  const rightSettings = monitoringSettings(right, config);
+function sameMonitoringSettings(left, right, config, siemensWincc = false) {
+  const leftSettings = monitoringSettings(left, config, siemensWincc);
+  const rightSettings = monitoringSettings(right, config, siemensWincc);
   return Object.keys(leftSettings).every(
     (key) => leftSettings[key] === rightSettings[key]
   );
@@ -111,6 +112,7 @@ module.exports = function registerSubscribeNode(RED) {
     node.closing = false;
     node.lastDropped = 0;
     node.lastStatusAt = 0;
+    node.compatibilityWarningIssued = false;
     const consumer = node.connection?.registerConsumer?.('subscribe', {
       nodeId: config.id, name: config.name,
     });
@@ -118,7 +120,16 @@ module.exports = function registerSubscribeNode(RED) {
     const batchSize = positiveInteger(config.batchSize, 500);
     const callbackBatchSize = positiveInteger(config.callbackBatchSize, 500);
     const callbackFlushIntervalMs = positiveInteger(config.callbackFlushIntervalMs, 50);
-    const configuredSubscriptionCapacity = positiveInteger(config.maxItemsPerSubscription, 5000);
+    const siemensWincc = isSiemensWinCC(
+      node.connection?.client?.options?.compatibilityProfile
+    );
+    const requestedSubscriptionCapacity = positiveInteger(config.maxItemsPerSubscription, 5000);
+    const configuredSubscriptionCapacity = siemensWincc
+      ? Math.min(
+          requestedSubscriptionCapacity,
+          SIEMENS_WINCC_DEFAULTS.monitoredItemsPerSubscription
+        )
+      : requestedSubscriptionCapacity;
     // Undefined preserves the descriptor-rich output used by Flow JSON created
     // before resultDetail existed. New editor nodes explicitly save compact.
     const resultDetail = ['compact', 'value', 'full'].includes(config.resultDetail)
@@ -129,6 +140,24 @@ module.exports = function registerSubscribeNode(RED) {
       return [...node.subscriptions.keys()];
     }
 
+    function applyCompatibility(points) {
+      if (!siemensWincc) return points;
+      let removedDeadband = false;
+      const compatible = points.map((point) => {
+        const configuredType = point.deadbandType || config.deadbandType || 'none';
+        if (configuredType === 'none') return point;
+        removedDeadband = true;
+        return { ...point, deadbandType: 'none', deadbandValue: 0 };
+      });
+      if (removedDeadband && !node.compatibilityWarningIssued) {
+        node.compatibilityWarningIssued = true;
+        node.warn(
+          'Siemens WinCC does not support OPC UA DataChange Deadband filters; Deadband was disabled.'
+        );
+      }
+      return compatible;
+    }
+
     function primarySubscriptionId() {
       return subscriptionIds()[0] ?? null;
     }
@@ -325,8 +354,8 @@ module.exports = function registerSubscribeNode(RED) {
           samplingInterval: Number(config.samplingInterval) || 1000,
           queueSize: Number(config.queueSize) || 10,
           discardOldest: config.discardOldest !== false,
-          deadbandType: config.deadbandType || 'none',
-          deadbandValue: Number(config.deadbandValue) || 0,
+          deadbandType: siemensWincc ? 'none' : config.deadbandType || 'none',
+          deadbandValue: siemensWincc ? 0 : Number(config.deadbandValue) || 0,
           timestampMode: config.timestampMode || 'source',
         },
         batchSize
@@ -497,6 +526,11 @@ module.exports = function registerSubscribeNode(RED) {
           queueSizeMin: revisedQueues.minimum,
           queueSizeMax: revisedQueues.maximum,
         },
+        compatibility: {
+          profile: siemensWincc ? 'siemens-wincc' : 'standard',
+          deadbandSupported: !siemensWincc,
+          monitoredItemsPerSubscription: configuredSubscriptionCapacity,
+        },
         connectionGovernance: node.connection?.getConnectionGovernance?.(),
         connectionUsage: node.connection?.getConnectionUsage?.(),
       };
@@ -563,7 +597,7 @@ module.exports = function registerSubscribeNode(RED) {
       for (const [nodeId, monitored] of node.monitored) {
         const previous = node.desired.get(nodeId);
         const next = nextDesired.get(nodeId);
-        if (!next || !previous || !sameMonitoringSettings(previous, next, config)) {
+        if (!next || !previous || !sameMonitoringSettings(previous, next, config, siemensWincc)) {
           changed.add(nodeId);
         }
       }
@@ -626,14 +660,14 @@ module.exports = function registerSubscribeNode(RED) {
         const configuredPayload = !looksLikePointList(msg.payload) && !Array.isArray(msg.items) &&
           !dynamicNodeId ? config.pointList : '';
         const staticNodeId = dynamicNodeId ? '' : config.nodeId;
-        const points = command === 'clear' ? [] : messagePoints(msg, staticNodeId, {
+        const points = command === 'clear' ? [] : applyCompatibility(messagePoints(msg, staticNodeId, {
           samplingInterval: Number(config.samplingInterval) || 1000,
           queueSize: Number(config.queueSize) || 10,
           discardOldest: config.discardOldest !== false,
         }, {
           configuredPayload,
           format: 'auto',
-        });
+        }));
 
         node.status({ fill: 'blue', shape: 'dot', text: `${command} ${points.length}` });
         await runSerialized(async () => {
@@ -642,7 +676,7 @@ module.exports = function registerSubscribeNode(RED) {
             const changed = new Set();
             points.forEach((point) => {
               const previous = node.desired.get(point.nodeId);
-              if (previous && !sameMonitoringSettings(previous, point, config)) {
+              if (previous && !sameMonitoringSettings(previous, point, config, siemensWincc)) {
                 changed.add(point.nodeId);
               }
               node.desired.set(point.nodeId, point);
@@ -710,14 +744,14 @@ module.exports = function registerSubscribeNode(RED) {
         if (node.closing) return;
         let points;
         try {
-          points = messagePoints({}, config.nodeId, {
+          points = applyCompatibility(messagePoints({}, config.nodeId, {
             samplingInterval: Number(config.samplingInterval) || 1000,
             queueSize: Number(config.queueSize) || 10,
             discardOldest: config.discardOldest !== false,
           }, {
             configuredPayload: config.pointList,
             format: 'auto',
-          });
+          }));
         } catch (error) {
           node.status({ fill: 'red', shape: 'ring', text: error.message });
           node.warn(`OPC UA saved subscription point list is invalid: ${error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tier0/opcua-client",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "High-scale OPC UA client nodes for Node-RED powered by open62541",
   "license": "Apache-2.0",
   "repository": {

package/src/addon.cc

@@ -49,6 +49,14 @@ std::string SecurityPolicyUri(const std::string& policy) {
       policy == "http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256") {
     return "http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256";
   }
+  if (policy == "Aes128_Sha256_RsaOaep" ||
+      policy == "http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep") {
+    return "http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep";
+  }
+  if (policy == "Aes256_Sha256_RsaPss" ||
+      policy == "http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss") {
+    return "http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss";
+  }
   return "";
 }