@tier0/opcua-client 0.5.0 → 0.6.2

package/README.md

@@ -178,19 +178,34 @@ finishes.
 
 Node editors show only the standard settings by default. Connection security/timeouts/cache, Browse limits/paging, Read/Write batching/output, and Subscribe queue/deadband tuning remain available under a closed **Advanced settings** section. Existing flows retain their stored advanced values.
 
+## Server compatibility profiles
+
+Connection nodes default to the standard OPC UA profile. Select **Siemens
+WinCC** for classic WinCC or Unified servers that do not advertise usable
+OperationLimits: Read, Write, and MonitoredItem service calls then use a
+conservative fallback of 200 items per request, while advertised non-zero
+server limits still take precedence. Subscribe nodes use at most 1000
+MonitoredItems per Subscription and remove Deadband filters because WinCC does
+not support `ModifyMonitoredItems`/Deadband behavior consistently. The selected
+profile and effective subscription behavior are included in status diagnostics.
+
 ## Secure connections
 
 Connection nodes support `None/None` and `Sign` or `SignAndEncrypt` with
-`Basic256Sha256`. Secure connections require a client certificate, its private
-key, and at least one trusted Server or CA certificate. Trust is strict: an
+`Basic256Sha256`, `Aes128_Sha256_RsaOaep`, or `Aes256_Sha256_RsaPss`. Secure
+connections require a client certificate, its private key, and at least one
+trusted Server or CA certificate. Trust is strict: an
 empty trust list is rejected instead of silently accepting every Server
 certificate. Optional CRL files can be supplied as a newline-separated list.
 Password-protected PEM private keys use the separate Node-RED credential field,
 so the password is not stored in the normal Flow configuration.
 
-The client Application URI can be configured when the URI embedded in the
-client certificate differs from the open62541 default. Username authentication
-uses the selected secure endpoint and its advertised UserTokenPolicy.
+Before opening the native client, the package checks certificate validity,
+certificate/private-key matching, RSA key type and minimum 2048-bit strength,
+trusted-certificate validity, and Application URI consistency. When the client
+certificate contains exactly one URI, leaving Application URI empty selects it
+automatically. Username authentication uses the selected secure endpoint and
+its advertised UserTokenPolicy.
 
 The Connection editor can call `GetEndpoints`, filters the response to the
 implemented policies, and selects an endpoint compatible with Anonymous or
@@ -212,7 +227,7 @@ Node-RED Alpine image, the pinned open62541 v1.4.16 source archive, and its
 not contact npm or GitHub and does not invoke a compiler:
 
 ```bash
-npm install ./tier0-opcua-client-0.5.0.tgz --offline
+npm install ./tier0-opcua-client-0.6.0.tgz --offline
 ```
 
 The loader uses the bundled native addon directly. Set
@@ -332,3 +347,56 @@ See [BENCHMARK.md](BENCHMARK.md) for the recorded 1,000, 5,000, 10,000, and sust
 - Native command queue: 256 pending commands per connection.
 
 Configured service batches are automatically clamped to the server's advertised OperationLimits.
+
+## Status and error output (0.6.1)
+
+Browse, Read, Write and Subscribe now have two outputs. Output 1 retains data;
+output 2 emits structured diagnostic messages. Connect output 2 to Debug, a
+JSON/file node or your logging service. The shared Connection configuration
+has no output ports: its state is reported by each referencing operation node,
+identified by nodeId and connectionId.
+
+诊断输出可独立接 Debug、JSON + File 或日志服务。payload.level 为 info / warn / error；
+连接断开、订阅无响应、恢复失败、点位 Bad 状态和队列丢数据都会输出对应事件。
+恢复成功也会输出 info，但连接恢复或订阅重建不代表已经收到新数据。
+
+Messages contain payload.level, event, message, time (ISO 8601), nodeId,
+connectionId, operation, retrying and optional statusCode/counts. Subscription
+recovery includes rebuilt and dataGapPossible. The envelope contains
+opcua.operation = "diagnostic". No input values, endpoint URLs, credentials,
+certificates or raw SDK error text are copied to this output. Existing runtime
+logs and Catch handling remain unchanged; output 2 is additional reporting.
+
+Identical event/status-code pairs are emitted at most once per 30 seconds per
+node. The next emitted matching event includes suppressed repeats; there is
+no delayed timer flush. Connection restoration resets this suppression window.
+This limit applies only to diagnostic output, not the existing runtime logs.
+
+For Subscribe, **Status messages → Both outputs (legacy compatible)** is the
+default: existing subscription-status messages remain on output 1 and the new
+structured events appear on output 2. Choose **Output 2 only** to keep output 1
+strictly for data. Existing Flow JSON without statusOutput keeps its old behavior;
+all existing wires on output 1 remain unchanged. New diagnostic events are not
+sent to output 1. Structured events contain summaries; existing detailed
+subscription-status payloads are preserved only in compatibility mode.
+
+This change adds reporting; it does not add a data-silence watchdog or change
+OPC UA reconnection/monitoring behavior.
+
+## Point failure details (0.6.2)
+
+Diagnostic output now includes payload.failures: an array of nodeId (OPC UA
+point identifier), optional alias, statusCode and a short explanation. The
+outer payload.nodeId still identifies the Node-RED flow node. Read/Write
+partial failures display yellow status with success/total and failure counts.
+The detail list is available even when data output is set to Value only.
+
+Each event includes at most 100 failed points; failed reports the full failure
+count, failuresTruncated indicates truncation, and omittedFailures reports the
+remaining count. Use Full metadata on output 1 for complete Read/Write results.
+Subscription compatibility output also retains its existing bounded failures.
+Duplicate event suppression compares the failing point identities and status
+codes so a different batch of failing points is not hidden by the first batch.
+No point values or raw input messages are copied. A whole-service exception
+without per-point results is still an operation failure: it cannot identify
+which individual points failed.

package/lib/client.js

@@ -3,7 +3,8 @@
 const { EventEmitter } = require('events');
 const { chunks } = require('./points');
 const { loadAddon } = require('./native');
-const { normalizeConnectionOptions } = require('./security');
+const { preflightConnectionSecurity } = require('./security');
+const { SIEMENS_WINCC_DEFAULTS, isSiemensWinCC } = require('./compatibility');
 
 function normalizeNotificationBatch(notification) {
   if (notification && Array.isArray(notification.changes)) {
@@ -16,13 +17,17 @@ function normalizeNotificationBatch(notification) {
   };
 }
 
-function effectiveBatchSize(requested, serverLimit) {
+function effectiveBatchSize(requested, serverLimit, fallbackLimit) {
   const configured = Number.isFinite(Number(requested)) && Number(requested) > 0
     ? Math.floor(Number(requested))
     : 500;
   const limit = Number(serverLimit);
-  return Number.isFinite(limit) && limit > 0
-    ? Math.min(configured, Math.floor(limit))
+  if (Number.isFinite(limit) && limit > 0) {
+    return Math.min(configured, Math.floor(limit));
+  }
+  const fallback = Number(fallbackLimit);
+  return Number.isFinite(fallback) && fallback > 0
+    ? Math.min(configured, Math.floor(fallback))
     : configured;
 }
 
@@ -55,6 +60,7 @@ class OpcUaClient extends EventEmitter {
       operationLimits: {},
       nodeIdCache: {},
       connection: {},
+      compatibility: this.#compatibilityDiagnostics(),
     };
   }
 
@@ -85,7 +91,8 @@ class OpcUaClient extends EventEmitter {
   }
 
   async #connect() {
-    const options = normalizeConnectionOptions(this.options);
+    const options = preflightConnectionSecurity(this.options);
+    this.diagnostics.securityPreflight = options.securityPreflight;
     const addon = loadAddon();
     const token = ++this.connectionToken;
     this.connectionState = 'connecting';
@@ -192,7 +199,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxNodesPerRead
+      batchSize, this.diagnostics.operationLimits?.maxNodesPerRead,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke('readManyAsync', batch));
@@ -204,7 +212,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxNodesPerWrite
+      batchSize, this.diagnostics.operationLimits?.maxNodesPerWrite,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke('writeManyAsync', batch));
@@ -222,7 +231,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall
+      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(points, effective)) {
       results.push(...await this.#invoke(
@@ -236,7 +246,8 @@ class OpcUaClient extends EventEmitter {
     const results = [];
     await this.connect();
     const effective = effectiveBatchSize(
-      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall
+      batchSize, this.diagnostics.operationLimits?.maxMonitoredItemsPerCall,
+      this.#compatibilityBatchFallback()
     );
     for (const batch of chunks(monitoredItemIds, effective)) {
       results.push(...await this.#invoke('removeMonitoredItemsAsync', subscriptionId, batch));
@@ -261,6 +272,22 @@ class OpcUaClient extends EventEmitter {
     return this.diagnostics;
   }
 
+  #compatibilityBatchFallback() {
+    return isSiemensWinCC(this.options.compatibilityProfile)
+      ? SIEMENS_WINCC_DEFAULTS.requestBatchSize
+      : 0;
+  }
+
+  #compatibilityDiagnostics() {
+    const siemensWincc = isSiemensWinCC(this.options.compatibilityProfile);
+    return {
+      profile: siemensWincc ? 'siemens-wincc' : 'standard',
+      requestBatchFallback: siemensWincc
+        ? SIEMENS_WINCC_DEFAULTS.requestBatchSize
+        : null,
+    };
+  }
+
   #refreshDiagnostics() {
     if (this.handle == null) return;
     const addon = loadAddon();
@@ -270,6 +297,8 @@ class OpcUaClient extends EventEmitter {
       this.diagnostics = {
         ...nativeDiagnostics,
         browse: this.diagnostics.browse,
+        securityPreflight: this.diagnostics.securityPreflight,
+        compatibility: this.#compatibilityDiagnostics(),
         connection: {
           ...(nativeDiagnostics.connection || {}),
           supervisor: { ...this.supervisorDiagnostics },

package/lib/compatibility.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const COMPATIBILITY_PROFILES = Object.freeze({
+  Standard: 'standard',
+  SiemensWinCC: 'siemens-wincc',
+});
+
+const SIEMENS_WINCC_DEFAULTS = Object.freeze({
+  requestBatchSize: 200,
+  monitoredItemsPerSubscription: 1000,
+});
+
+function normalizeCompatibilityProfile(value) {
+  return value === COMPATIBILITY_PROFILES.SiemensWinCC
+    ? COMPATIBILITY_PROFILES.SiemensWinCC
+    : COMPATIBILITY_PROFILES.Standard;
+}
+
+function isSiemensWinCC(value) {
+  return normalizeCompatibilityProfile(value) === COMPATIBILITY_PROFILES.SiemensWinCC;
+}
+
+module.exports = {
+  COMPATIBILITY_PROFILES,
+  SIEMENS_WINCC_DEFAULTS,
+  isSiemensWinCC,
+  normalizeCompatibilityProfile,
+};

package/lib/diagnostics.js

@@ -0,0 +1,123 @@
+'use strict';
+
+const { createHash } = require('node:crypto');
+const FAILURE_LIMIT = 100;
+const POINT_MESSAGES = {
+  BadNotReadable: '访问级别不允许读取或订阅该点位',
+  BadUserAccessDenied: '当前用户无权执行该操作',
+  BadNodeIdUnknown: '服务端找不到该 NodeId',
+  BadNodeIdInvalid: 'NodeId 格式无效',
+  BadNoCommunication: '服务端无法与该点位的数据源通信',
+  BadWaitingForInitialData: '等待该点位的首次数据',
+  BadTimeout: '该点位操作超时',
+  BadNotWritable: '该点位不允许写入',
+  BadTypeMismatch: '写入值类型与点位类型不匹配',
+  BadTooManyMonitoredItems: '服务端监控点数量超限',
+};
+
+// Output only allowlisted metadata: never forward SDK messages, credentials,
+// endpoint URLs, input payloads or raw state/diagnostic objects.
+function statusCode(error) {
+  const text = String(error?.code || error?.statusCode || error?.message || error || '');
+  return /\b(?:Bad[A-Za-z0-9]+|Uncertain[A-Za-z0-9]*|OPCUA_[A-Z_]+)\b/.exec(text)?.[0] || 'OperationFailed';
+}
+
+function createDiagnostics(node, config, operation) {
+  const recent = new Map();
+  let closed = false;
+  let interrupted = false;
+  const client = node.connection?.client;
+  function emit(level, event, message, details = {}, send) {
+    if (closed) return;
+    const now = Date.now();
+    const failures = details.failures;
+    // Different failing points must not be hidden by another batch's throttle.
+    const fingerprint = createHash('sha256');
+    if (failures) for (const item of failures) {
+      fingerprint.update(JSON.stringify([item.nodeId, item.alias, item.statusCode]));
+    }
+    const key = `${event}:${details.statusCode || ''}:${failures ? fingerprint.digest('hex') : ''}`;
+    const previous = recent.get(key);
+    if (previous && now - previous.time < 30000) {
+      previous.suppressed += 1;
+      return;
+    }
+    const payload = {
+      level, event, message, time: new Date(now).toISOString(),
+      nodeId: node.id || config.id, connectionId: config.connection, operation,
+      retrying: details.retrying === true,
+    };
+    if (details.statusCode) payload.statusCode = statusCode(details.statusCode);
+    if (failures) {
+      payload.failures = failures.slice(0, FAILURE_LIMIT).map((item) => {
+        const code = statusCode(item.statusCode);
+        return {
+          ...(typeof item.nodeId === 'string' ? { nodeId: item.nodeId } : {}),
+          ...(typeof item.alias === 'string' && item.alias ? { alias: item.alias } : {}),
+          statusCode: code,
+          message: POINT_MESSAGES[code] || '点位返回非 Good 状态，请根据 statusCode 排查',
+        };
+      });
+      payload.failuresTruncated = failures.length > FAILURE_LIMIT;
+      payload.omittedFailures = Math.max(0, failures.length - FAILURE_LIMIT);
+    }
+    for (const field of ['failed', 'total', 'monitored', 'desired', 'dropped', 'subscriptionId']) {
+      if (Number.isFinite(details[field])) payload[field] = details[field];
+    }
+    for (const field of ['rebuilt', 'dataGapPossible']) {
+      if (typeof details[field] === 'boolean') payload[field] = details[field];
+    }
+    if (previous?.suppressed) payload.suppressed = previous.suppressed;
+    if (recent.size >= 128) recent.delete(recent.keys().next().value);
+    recent.set(key, { time: now, suppressed: 0 });
+    const output = send || (node.send && node.send.bind(node));
+    output?.([null, { payload, opcua: { operation: 'diagnostic' } }]);
+  }
+  function failure(error, send, event = `${operation}_failed`, retrying = false) {
+    emit('error', event, `OPC UA ${operation} failed`, { statusCode: statusCode(error), retrying }, send);
+  }
+  function results(items, send, descriptors) {
+    const failed = items.filter((item) => item.statusCode && item.statusCode !== 'Good');
+    const failures = failed.map((item) => ({
+      nodeId: item.nodeId,
+      alias: item.alias ?? descriptors?.get(item.nodeId)?.alias,
+      statusCode: item.statusCode,
+    }));
+    if (failed.length) emit('warn', 'points_failed', 'Some OPC UA points returned a non-Good status', {
+      failed: failed.length, total: items.length, statusCode: statusCode(failed[0].statusCode),
+      failures,
+    }, send);
+    return failed.length;
+  }
+  const onFault = (error) => {
+    interrupted = true;
+    emit('warn', 'connection_fault', 'OPC UA connection fault', { statusCode: statusCode(error), retrying: true });
+  };
+  const onState = (state) => {
+    if (!state) return;
+    if (state.state === 'connected') {
+      if (interrupted) {
+        recent.clear();
+        emit('info', 'connection_restored', 'OPC UA connection restored; subscription recovery may still be pending');
+      }
+      interrupted = false;
+    } else if (['reconnecting', 'backoff', 'failed'].includes(state.state)) {
+      interrupted = true;
+      emit(state.state === 'failed' ? 'error' : 'warn', `connection_${state.state}`,
+        'OPC UA connection unavailable; recovery pending', {
+          retrying: true, ...(state.statusCode && state.statusCode !== 'Good' ? { statusCode: statusCode(state.statusCode) } : {}),
+        });
+    }
+  };
+  client?.on?.('fault', onFault);
+  client?.on?.('state', onState);
+  node.on('close', () => {
+    closed = true;
+    recent.clear();
+    client?.removeListener?.('fault', onFault);
+    client?.removeListener?.('state', onState);
+  });
+  return { emit, failure, results };
+}
+
+module.exports = { createDiagnostics, statusCode };

package/lib/security.js

@@ -1,18 +1,111 @@
 'use strict';
 
+const fs = require('node:fs');
+const crypto = require('node:crypto');
+
 const SECURITY_POLICY_URIS = Object.freeze({
   None: 'http://opcfoundation.org/UA/SecurityPolicy#None',
   Basic256Sha256: 'http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256',
+  Aes128_Sha256_RsaOaep: 'http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep',
+  Aes256_Sha256_RsaPss: 'http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss',
 });
 
 const SECURITY_MODES = new Set(['None', 'Sign', 'SignAndEncrypt']);
 
-function configurationError(message) {
+function configurationError(message, code = 'OPCUA_INVALID_SECURITY_CONFIGURATION', cause) {
   const error = new Error(message);
-  error.code = 'OPCUA_INVALID_SECURITY_CONFIGURATION';
+  error.code = code;
+  if (cause) error.cause = cause;
   return error;
 }
 
+function readSecurityFile(filePath, label, readFileSync = fs.readFileSync) {
+  try {
+    return readFileSync(filePath);
+  } catch (error) {
+    throw configurationError(
+      `Cannot read OPC UA ${label}: ${filePath}`,
+      'OPCUA_SECURITY_FILE_UNREADABLE',
+      error
+    );
+  }
+}
+
+function parseCertificate(buffer, label, X509Certificate = crypto.X509Certificate) {
+  try {
+    return new X509Certificate(buffer);
+  } catch (error) {
+    throw configurationError(
+      `Invalid OPC UA ${label}`,
+      'OPCUA_CERTIFICATE_INVALID',
+      error
+    );
+  }
+}
+
+function applicationUris(certificate) {
+  const output = [];
+  const expression = /(?:^|,\s*)URI:((?:"[^"]+")|[^,]+)/g;
+  for (const match of String(certificate.subjectAltName || '').matchAll(expression)) {
+    const value = match[1].replace(/^"|"$/g, '').trim();
+    if (value && !output.includes(value)) output.push(value);
+  }
+  return output;
+}
+
+function validateCertificateTime(certificate, label, now = Date.now()) {
+  const validFrom = Date.parse(certificate.validFrom);
+  const validTo = Date.parse(certificate.validTo);
+  if (Number.isFinite(validFrom) && now < validFrom) {
+    throw configurationError(
+      `OPC UA ${label} is not valid before ${certificate.validFrom}`,
+      'OPCUA_CERTIFICATE_NOT_YET_VALID'
+    );
+  }
+  if (Number.isFinite(validTo) && now > validTo) {
+    throw configurationError(
+      `OPC UA ${label} expired at ${certificate.validTo}`,
+      'OPCUA_CERTIFICATE_EXPIRED'
+    );
+  }
+}
+
+function loadPrivateKey(buffer, passphrase, createPrivateKey = crypto.createPrivateKey) {
+  const password = passphrase ? String(passphrase) : undefined;
+  const attempts = [
+    { key: buffer, passphrase: password },
+    { key: buffer, format: 'der', type: 'pkcs8', passphrase: password },
+    { key: buffer, format: 'der', type: 'pkcs1', passphrase: password },
+  ];
+  let lastError;
+  for (const options of attempts) {
+    try {
+      return createPrivateKey(options);
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw configurationError(
+    'Invalid OPC UA client private key or key password',
+    'OPCUA_PRIVATE_KEY_INVALID',
+    lastError
+  );
+}
+
+function certificateSummary(certificate, uri) {
+  const publicKey = certificate.publicKey;
+  return {
+    subject: certificate.subject,
+    issuer: certificate.issuer,
+    validFrom: certificate.validFrom,
+    validTo: certificate.validTo,
+    fingerprint256: certificate.fingerprint256,
+    applicationUri: uri || null,
+    publicKeyType: publicKey?.asymmetricKeyType || null,
+    modulusLength: publicKey?.asymmetricKeyDetails?.modulusLength || null,
+  };
+}
+
 function normalizePathList(value) {
   const source = Array.isArray(value)
     ? value
@@ -72,6 +165,92 @@ function normalizeConnectionOptions(options = {}) {
   return normalized;
 }
 
+function preflightConnectionSecurity(options = {}, dependencies = {}) {
+  const normalized = normalizeConnectionOptions(options);
+  const runtime = {
+    readFileSync: dependencies.readFileSync || fs.readFileSync,
+    X509Certificate: dependencies.X509Certificate || crypto.X509Certificate,
+    createPrivateKey: dependencies.createPrivateKey || crypto.createPrivateKey,
+    now: dependencies.now == null ? Date.now() : Number(dependencies.now),
+  };
+  if (normalized.securityMode === 'None') {
+    return {
+      ...normalized,
+      securityPreflight: { enabled: false, policy: normalized.securityPolicy },
+    };
+  }
+
+  const certificate = parseCertificate(
+    readSecurityFile(normalized.certificate, 'client certificate', runtime.readFileSync),
+    'client certificate',
+    runtime.X509Certificate
+  );
+  validateCertificateTime(certificate, 'client certificate', runtime.now);
+
+  const uris = applicationUris(certificate);
+  const applicationUri = normalized.applicationUri || (uris.length === 1 ? uris[0] : '');
+  if (!applicationUri) {
+    throw configurationError(
+      'The OPC UA client certificate must contain one Application URI or Application URI must be configured',
+      'OPCUA_CERTIFICATE_URI_MISSING'
+    );
+  }
+  if (!uris.includes(applicationUri)) {
+    throw configurationError(
+      `Configured Application URI does not match the client certificate: ${applicationUri}`,
+      'OPCUA_CERTIFICATE_URI_MISMATCH'
+    );
+  }
+
+  const privateKey = loadPrivateKey(
+    readSecurityFile(normalized.privateKey, 'client private key', runtime.readFileSync),
+    normalized.privateKeyPassword,
+    runtime.createPrivateKey
+  );
+  if (!certificate.checkPrivateKey(privateKey)) {
+    throw configurationError(
+      'The OPC UA client private key does not match the client certificate',
+      'OPCUA_PRIVATE_KEY_MISMATCH'
+    );
+  }
+
+  const keyType = certificate.publicKey?.asymmetricKeyType || '';
+  const modulusLength = Number(certificate.publicKey?.asymmetricKeyDetails?.modulusLength) || 0;
+  if (!keyType.startsWith('rsa')) {
+    throw configurationError(
+      `OPC UA ${normalized.securityPolicy} requires an RSA client certificate`,
+      'OPCUA_CERTIFICATE_KEY_TYPE_UNSUPPORTED'
+    );
+  }
+  if (modulusLength > 0 && modulusLength < 2048) {
+    throw configurationError(
+      `OPC UA client certificate RSA key is too short: ${modulusLength} bits; at least 2048 bits required`,
+      'OPCUA_CERTIFICATE_KEY_TOO_SHORT'
+    );
+  }
+
+  const trust = normalized.trustedCertificates.map((filePath) => {
+    const trusted = parseCertificate(
+      readSecurityFile(filePath, 'trusted certificate', runtime.readFileSync),
+      `trusted certificate: ${filePath}`,
+      runtime.X509Certificate
+    );
+    validateCertificateTime(trusted, `trusted certificate: ${filePath}`, runtime.now);
+    return certificateSummary(trusted);
+  });
+
+  return {
+    ...normalized,
+    applicationUri,
+    securityPreflight: {
+      enabled: true,
+      policy: normalized.securityPolicy,
+      clientCertificate: certificateSummary(certificate, applicationUri),
+      trustedCertificates: trust,
+    },
+  };
+}
+
 function endpointIdentityTypes(endpoint) {
   return [...new Set((endpoint?.userIdentityTokens || []).map((token) => token.tokenType))];
 }
@@ -92,5 +271,6 @@ module.exports = {
   matchingEndpoints,
   normalizeConnectionOptions,
   normalizePathList,
+  preflightConnectionSecurity,
   securityPolicyName,
 };

package/nodes/browse.html

@@ -46,6 +46,7 @@
 </script>
 <script type="text/html" data-help-name="tier0-opcua-browse">
   <section lang="zh-CN">
+    <p>输出 2 为独立状态／异常消息：payload.level 为 info、warn 或 error。可连接 Debug、文件或日志服务；原有 Catch 和日志仍然有效。同类事件每 30 秒最多输出一次，下一次包含 suppressed 计数。输出不含原始值、凭据或完整错误文本。</p>
     <h3>浏览（Browse）</h3>
     <p>浏览 OPC UA 地址空间并选择变量点位。Browse 返回节点描述信息，不读取实时值。</p>
     <h4>配置与输入</h4>
@@ -60,6 +61,7 @@
   </section>
   <hr>
   <section lang="en">
+    <p>Output 2 emits status/error events with payload.level (info, warn, error). Connect it to Debug, file or logging nodes. Catch and existing logs remain supported. Repeats are limited to one per 30 seconds; the next matching event includes suppressed counts. Raw values, credentials and SDK error text are omitted.</p>
     <h3>Browse</h3>
     <p>Browses the OPC UA address space and selects Variable nodes. Browse returns node descriptors; it does not read live values.</p>
     <h4>Configuration and input</h4>
@@ -75,7 +77,7 @@
 </script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-browse', {
-    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 1, icon: 'search.png',
+    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 2, outputLabels: ['Data', 'Status / errors'], icon: 'search.png',
     defaults: {
       connection: { value: '', type: 'tier0-opcua-connection', required: true }, rootNodeId: { value: 'ns=0;i=85' },
       selectedNodes: { value: [] }, recursive: { value: true }, variablesOnly: { value: true },

package/nodes/browse.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { createDiagnostics } = require('../lib/diagnostics');
+
 const { chunks } = require('../lib/points');
 const { buildBrowseTree, selectedVariables } = require('../lib/browse-tree');
 
@@ -65,12 +67,17 @@ module.exports = function registerBrowseNode(RED) {
     RED.nodes.createNode(this, config);
     const node = this;
     node.connection = RED.nodes.getNode(config.connection);
+    const diagnostics = createDiagnostics(node, config, 'browse');
     const consumer = node.connection?.registerConsumer?.('browse', {
       nodeId: config.id, name: config.name,
     });
 
     node.on('input', async (msg, send, done) => {
-      if (!node.connection) return done(new Error('OPC UA connection not configured'));
+      if (!node.connection) {
+        const error = new Error('OPCUA_CONNECTION_NOT_CONFIGURED');
+        diagnostics.failure(error, send);
+        return done(error);
+      }
 
       try {
         consumer?.markUsed('browse');
@@ -124,6 +131,10 @@ module.exports = function registerBrowseNode(RED) {
         }
 
         const partial = browseDiagnostics?.truncated || browseDiagnostics?.failures?.length;
+        if (partial) diagnostics.emit('warn', 'browse_partial', 'OPC UA Browse returned partial results', {
+          failed: browseDiagnostics?.failures?.length || 0, total: points.length,
+          failures: browseDiagnostics?.failures || [],
+        }, send);
         node.status({
           fill: partial ? 'yellow' : 'green', shape: partial ? 'ring' : 'dot',
           text: `${points.length} points` +
@@ -133,6 +144,7 @@ module.exports = function registerBrowseNode(RED) {
         done();
       } catch (error) {
         node.status({ fill: 'red', shape: 'ring', text: error.message });
+        diagnostics.failure(error, send);
         done(error);
       }
     });

package/nodes/connection.html

@@ -15,11 +15,13 @@
   <div class="form-row"><label></label><button type="button" class="red-ui-button" id="node-config-input-discoverEndpoints">Discover endpoints</button> <button type="button" class="red-ui-button" id="node-config-input-testConnection">Test connection</button></div>
   <div class="opcua-discovery-result" id="node-config-input-discoveryResult" style="display:none"><select id="node-config-input-discoveredEndpoint"></select></div>
   <div class="opcua-standard-note" id="node-config-input-testResult"></div>
+  <div class="form-row"><label for="node-config-input-compatibilityProfile">Server profile</label><select id="node-config-input-compatibilityProfile"><option value="standard">Standard OPC UA</option><option value="siemens-wincc">Siemens WinCC</option></select></div>
+  <div class="opcua-standard-note">Siemens WinCC uses conservative 200-item service batches and disables unsupported Subscription Deadband filters when the Server does not advertise usable limits.</div>
   <div class="form-row"><label for="node-config-input-securityMode">Security</label><select id="node-config-input-securityMode"><option value="None">None</option><option value="Sign">Sign</option><option value="SignAndEncrypt">SignAndEncrypt</option></select></div>
   <div class="opcua-standard-note">Standard defaults include automatic reconnect, connectivity checks, and bounded command/NodeId queues.</div>
   <details class="opcua-advanced">
     <summary>Security and advanced connection settings</summary>
-    <div class="form-row"><label for="node-config-input-securityPolicy">Policy</label><select id="node-config-input-securityPolicy"><option value="None">None</option><option value="Basic256Sha256">Basic256Sha256</option></select></div>
+    <div class="form-row"><label for="node-config-input-securityPolicy">Policy</label><select id="node-config-input-securityPolicy"><option value="None">None</option><option value="Basic256Sha256">Basic256Sha256</option><option value="Aes128_Sha256_RsaOaep">Aes128_Sha256_RsaOaep</option><option value="Aes256_Sha256_RsaPss">Aes256_Sha256_RsaPss</option></select></div>
     <div class="form-row"><label for="node-config-input-user">User</label><input type="text" id="node-config-input-user"></div>
     <div class="form-row"><label for="node-config-input-password">Password</label><input type="password" id="node-config-input-password"></div>
     <div class="form-row opcua-secure-field"><label for="node-config-input-certificate">Client certificate</label><input type="text" class="opcua-security-path" id="node-config-input-certificate" placeholder="Upload or enter /path/to/client.der"> <button type="button" class="red-ui-button" id="node-config-upload-certificate"><i class="fa fa-upload"></i> Upload</button><input type="file" class="opcua-hidden-file" id="node-config-file-certificate" accept=".der,.pem,.crt,.cer"></div>
@@ -50,8 +52,9 @@
       <li><b>Endpoint</b>：服务器地址，例如 <code>opc.tcp://192.168.1.10:4840</code>。</li>
       <li><b>Discover endpoints</b>：读取服务器公开的安全模式、安全策略和用户认证方式。</li>
       <li><b>Test connection</b>：使用当前配置建立临时连接并验证认证。</li>
-      <li><b>Security</b>：支持 None、Sign、SignAndEncrypt；安全模式、策略和认证方式必须与服务器 Endpoint 匹配。</li>
-      <li><b>证书</b>：安全连接可上传或指定客户端证书、私钥、信任证书和 CRL。Application URI 应与客户端证书一致。</li>
+      <li><b>Server profile</b>：默认使用标准 OPC UA 行为；Siemens WinCC 模式在服务器未公布有效 OperationLimits 时按每批 200 点请求，并在订阅中禁用 WinCC 不支持的 Deadband。</li>
+      <li><b>Security</b>：支持 None、Sign、SignAndEncrypt，以及 Basic256Sha256、Aes128_Sha256_RsaOaep、Aes256_Sha256_RsaPss；安全模式、策略和认证方式必须与服务器 Endpoint 匹配。</li>
+      <li><b>证书</b>：安全连接可上传或指定客户端证书、私钥、信任证书和 CRL。连接前会检查有效期、证书和私钥是否匹配、RSA 密钥强度及 Application URI。若证书只包含一个 URI，可留空并自动采用。</li>
     </ul>
     <h4>建议</h4>
     <p>一个 Connection 配置对应一条客户端 Session。多个业务节点应复用同一个 Connection，避免为相同 Endpoint 重复创建 Session。节点内置自动重连、连通性检查以及有界命令队列。</p>
@@ -65,8 +68,9 @@
       <li><b>Endpoint</b>: Server URL, for example <code>opc.tcp://192.168.1.10:4840</code>.</li>
       <li><b>Discover endpoints</b>: Reads advertised security modes, policies, and user token types.</li>
       <li><b>Test connection</b>: Opens a temporary connection with the current settings and validates authentication.</li>
-      <li><b>Security</b>: Supports None, Sign, and SignAndEncrypt. Mode, policy, and identity must match an advertised endpoint.</li>
-      <li><b>Certificates</b>: Secure connections can upload or reference a client certificate, private key, trust list, and CRLs. The Application URI should match the client certificate.</li>
+      <li><b>Server profile</b>: Standard uses normal OPC UA behavior. Siemens WinCC falls back to 200-item service batches when usable OperationLimits are not advertised and removes unsupported Subscription Deadband filters.</li>
+      <li><b>Security</b>: Supports None, Sign, and SignAndEncrypt with Basic256Sha256, Aes128_Sha256_RsaOaep, or Aes256_Sha256_RsaPss. Mode, policy, and identity must match an advertised endpoint.</li>
+      <li><b>Certificates</b>: Secure connections can upload or reference a client certificate, private key, trust list, and CRLs. Validity, key matching, RSA strength, and Application URI are checked before connecting. An empty URI is filled automatically when the certificate contains exactly one URI.</li>
     </ul>
     <h4>Recommendation</h4>
     <p>One Connection configuration owns one client Session. Reuse it across nodes targeting the same server instead of creating duplicate Sessions. Automatic reconnect, connectivity checks, and a bounded command queue are enabled.</p>
@@ -78,6 +82,7 @@
     defaults: {
       endpoint: { value: '', required: true },
       securityMode: { value: 'None' }, securityPolicy: { value: 'None' },
+      compatibilityProfile: { value: 'standard' },
       user: { value: '' }, certificate: { value: '' }, privateKey: { value: '' },
       applicationUri: { value: '' }, trustedCertificates: { value: '' }, revocationList: { value: '' },
       requestedSessionTimeout: { value: 60000, validate: RED.validators.number() },
@@ -207,6 +212,7 @@
           endpoint: String($('#node-config-input-endpoint').val() || '').trim(),
           securityMode: mode.val(),
           securityPolicy: policy.val(),
+          compatibilityProfile: $('#node-config-input-compatibilityProfile').val(),
           user: $('#node-config-input-user').val(),
           password: $('#node-config-input-password').val(),
           certificate: $('#node-config-input-certificate').val(),
@@ -245,9 +251,12 @@
           const allEndpoints = Array.isArray(response.endpoints) ? response.endpoints : [];
           const identityType = String($('#node-config-input-user').val() || '').trim()
             ? 'Username' : 'Anonymous';
+          const supportedPolicies = new Set([
+            'None', 'Basic256Sha256',
+            'Aes128_Sha256_RsaOaep', 'Aes256_Sha256_RsaPss',
+          ]);
           const supported = allEndpoints.filter(function (item) {
-            const itemPolicy = policyName(item.securityPolicyUri);
-            return itemPolicy === 'None' || itemPolicy === 'Basic256Sha256';
+            return supportedPolicies.has(policyName(item.securityPolicyUri));
           });
           const matchingIdentity = supported.filter(function (item) {
             return (item.userIdentityTokens || []).some(function (token) {
@@ -271,7 +280,7 @@
               .appendTo(discovered);
           });
           if (!endpoints.length) {
-            RED.notify('The server returned no supported None or Basic256Sha256 endpoint', 'warning');
+            RED.notify('The server returned no endpoint supported by this client', 'warning');
             result.hide();
             return;
           }
@@ -293,7 +302,8 @@
         if (!selected) return;
         const selectedPolicy = policyName(selected.securityPolicyUri);
         mode.val(selected.securityMode);
-        if (selectedPolicy === 'None' || selectedPolicy === 'Basic256Sha256') {
+        if (['None', 'Basic256Sha256', 'Aes128_Sha256_RsaOaep',
+          'Aes256_Sha256_RsaPss'].includes(selectedPolicy)) {
           policy.val(selectedPolicy);
         }
         updateSecurityFields();

package/nodes/connection.js

@@ -3,6 +3,7 @@
 const { OpcUaClient, discoverEndpoints } = require('../lib/client');
 const { ConnectionRegistry } = require('../lib/connection-registry');
 const { SecurityFileStore } = require('../lib/security-file-store');
+const { normalizeCompatibilityProfile } = require('../lib/compatibility');
 
 function pathList(value) {
   const source = Array.isArray(value) ? value : String(value || '').split(/\r?\n|;/);
@@ -14,6 +15,7 @@ function clientOptions(config, credentials = {}) {
     endpoint: config.endpoint,
     securityMode: config.securityMode || 'None',
     securityPolicy: config.securityPolicy || 'None',
+    compatibilityProfile: normalizeCompatibilityProfile(config.compatibilityProfile),
     user: config.user || '',
     password: credentials.password || '',
     certificate: config.certificate || '',

package/nodes/read.html

@@ -45,6 +45,7 @@
 </script>
 <script type="text/html" data-help-name="tier0-opcua-read">
   <section lang="zh-CN">
+    <p>输出 2 为独立状态／异常消息：payload.level 为 info、warn 或 error。可连接 Debug、文件或日志服务；原有 Catch 和日志仍然有效。同类事件每 30 秒最多输出一次，下一次包含 suppressed 计数。输出不含原始值、凭据或完整错误文本。</p>
     <h3>读取（Read）</h3>
     <p>每收到一条输入消息执行一次 OPC UA Read。它不是定时器；读取频率由上游 Inject、Function 或其他节点的触发频率决定。</p>
     <h4>输入</h4>
@@ -65,6 +66,7 @@
   </section>
   <hr>
   <section lang="en">
+    <p>Output 2 emits status/error events with payload.level (info, warn, error). Connect it to Debug, file or logging nodes. Catch and existing logs remain supported. Repeats are limited to one per 30 seconds; the next matching event includes suppressed counts. Raw values, credentials and SDK error text are omitted.</p>
     <h3>Read</h3>
     <p>Executes one OPC UA Read for each input message. It is not a timer; the upstream Inject, Function, or other node controls the read frequency.</p>
     <h4>Input</h4>
@@ -86,7 +88,7 @@
 </script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-read', {
-    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 1, icon: 'bridge.png',
+    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 2, outputLabels: ['Data', 'Status / errors'], icon: 'bridge.png',
     defaults: {
       connection: { value: '', type: 'tier0-opcua-connection', required: true },
       nodeId: { value: '' }, pointList: { value: '' }, pointListFileName: { value: '' },

package/nodes/read.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { createDiagnostics } = require('../lib/diagnostics');
+
 const { looksLikePointList, messagePoints } = require('../lib/points');
 
 const COMPACT_RESULT_FIELDS = Object.freeze([
@@ -27,12 +29,17 @@ module.exports = function registerReadNode(RED) {
     RED.nodes.createNode(this, config);
     const node = this;
     node.connection = RED.nodes.getNode(config.connection);
+    const diagnostics = createDiagnostics(node, config, 'read');
     const consumer = node.connection?.registerConsumer?.('read', {
       nodeId: config.id, name: config.name,
     });
 
     node.on('input', async (msg, send, done) => {
-      if (!node.connection) return done(new Error('OPC UA connection not configured'));
+      if (!node.connection) {
+        const error = new Error('OPCUA_CONNECTION_NOT_CONFIGURED');
+        diagnostics.failure(error, send);
+        return done(error);
+      }
 
       try {
         consumer?.markUsed('read');
@@ -55,6 +62,7 @@ module.exports = function registerReadNode(RED) {
 
         // Undefined preserves the original output for Flow JSON created before
         // resultDetail was introduced. New editor nodes explicitly save compact.
+        const failed = diagnostics.results(results, send);
         const resultDetail = config.resultDetail || 'full';
         const outputResults = resultDetail === 'compact'
           ? results.map(compactResult)
@@ -96,10 +104,12 @@ module.exports = function registerReadNode(RED) {
           send(msg);
         }
 
-        node.status({ fill: 'green', shape: 'dot', text: `${results.length} read` });
+        node.status({ fill: failed ? 'yellow' : 'green', shape: failed ? 'ring' : 'dot',
+          text: `${results.length - failed}/${results.length} read` + (failed ? ` / ${failed} failed` : '') });
         done();
       } catch (error) {
         node.status({ fill: 'red', shape: 'ring', text: error.message });
+        diagnostics.failure(error, send);
         done(error);
       }
     });

package/nodes/subscribe.html

@@ -47,6 +47,7 @@
     <div class="form-row"><label for="node-input-timestampMode">Timestamps</label><select id="node-input-timestampMode"><option value="source">Source</option><option value="both">Source and server</option><option value="server">Server</option><option value="neither">None</option></select></div>
     <div class="form-row"><label for="node-input-batchSize">Create batch size</label><input type="number" id="node-input-batchSize"></div>
     <div class="form-row"><label for="node-input-maxItemsPerSubscription">Items / subscription</label><input type="number" id="node-input-maxItemsPerSubscription"></div>
+    <div class="form-row"><label for="node-input-statusOutput">Status messages</label><select id="node-input-statusOutput"><option value="both">Both outputs (legacy compatible)</option><option value="separate">Output 2 only</option></select></div>
     <div class="form-row"><label for="node-input-outputMode">Change output</label><select id="node-input-outputMode"><option value="batch">Native batch</option><option value="single">One message per change</option></select></div>
     <div class="form-row"><label for="node-input-resultDetail">Result detail</label><select id="node-input-resultDetail"><option value="compact">Compact</option><option value="value">Value only</option><option value="full">Full metadata</option></select></div>
     <div class="form-row"><label for="node-input-callbackBatchSize">Output batch size</label><input type="number" id="node-input-callbackBatchSize"></div>
@@ -59,6 +60,7 @@
 </script>
 <script type="text/html" data-help-name="tier0-opcua-subscribe">
   <section lang="zh-CN">
+    <p>输出 2 为独立状态／异常消息：payload.level 为 info、warn 或 error。可连接 Debug、文件或日志服务；原有 Catch 和日志仍然有效。同类事件每 30 秒最多输出一次，下一次包含 suppressed 计数。输出不含原始值、凭据或完整错误文本。</p>
     <h3>订阅（Subscribe）</h3>
     <p>创建 OPC UA Subscription 和 MonitoredItems，由服务器在值变化时推送通知；它不是客户端定时 Read。大量点位会按照服务器限制自动拆分到多个 Subscription。</p>
     <h4>输入与命令</h4>
@@ -71,6 +73,7 @@
       <li>服务器可以把请求间隔修订为它支持的值。</li>
     </ul>
     <p>新节点默认 Server queue size=1、Discard oldest=true、Queue mode=latest，适合实时状态采集。脉冲、报警转换或完整历史不能丢失时，应改为 all 并增大服务器队列。</p>
+    <p>Connection 选择 Siemens WinCC 后，如果服务器没有公布有效限制，每个 Subscription 最多建立 1000 个 MonitoredItem，并自动移除 WinCC 不支持的 Deadband 配置；节点状态消息会报告实际兼容策略。</p>
     <h4>输出</h4>
     <ul>
       <li><b>Compact</b>：NodeId/alias、值、状态和源时间戳。</li>
@@ -81,6 +84,7 @@
   </section>
   <hr>
   <section lang="en">
+    <p>Output 2 emits status/error events with payload.level (info, warn, error). Connect it to Debug, file or logging nodes. Catch and existing logs remain supported. Repeats are limited to one per 30 seconds; the next matching event includes suppressed counts. Raw values, credentials and SDK error text are omitted.</p>
     <h3>Subscribe</h3>
     <p>Creates one or more OPC UA subscriptions and MonitoredItems so the server sends data-change notifications. It is not a periodic client Read. Large point sets are automatically sharded across Subscriptions according to server limits.</p>
     <h4>Input and commands</h4>
@@ -93,6 +97,7 @@
       <li>The server may revise requested intervals to supported values.</li>
     </ul>
     <p>New nodes default to server queue size 1, discard-oldest, and local latest coalescing for real-time state. Select all and increase the server queue for pulses, alarm transitions, or history where every change must be retained.</p>
+    <p>With the Siemens WinCC Connection profile, each Subscription is conservatively capped at 1000 MonitoredItems when the server advertises no usable limit, and unsupported Deadband filters are removed automatically. Status output reports the active compatibility behavior.</p>
     <h4>Output</h4>
     <ul>
       <li><b>Compact</b>: NodeId/alias, value, status, and source timestamp.</li>
@@ -104,8 +109,9 @@
 </script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-subscribe', {
-    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 1, icon: 'bridge.png',
+    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 2, outputLabels: ['Data', 'Status / errors'], icon: 'bridge.png',
     defaults: {
+      statusOutput: { value: 'both' },
       connection: { value: '', type: 'tier0-opcua-connection', required: true },
       nodeId: { value: '' }, pointList: { value: '' }, pointListFileName: { value: '' },
       publishingInterval: { value: 1000, validate: RED.validators.number() }, samplingInterval: { value: 1000, validate: RED.validators.number() },

package/nodes/subscribe.js

@@ -1,6 +1,9 @@
 'use strict';
 
+const { createDiagnostics } = require('../lib/diagnostics');
+
 const { looksLikePointList, messagePoints } = require('../lib/points');
+const { SIEMENS_WINCC_DEFAULTS, isSiemensWinCC } = require('../lib/compatibility');
 
 const NOTIFICATION_CONFIG_FIELDS = new Set([
   'nodeId',
@@ -55,19 +58,19 @@ function positiveInteger(value, fallback) {
   return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
 }
 
-function monitoringSettings(point, config) {
+function monitoringSettings(point, config, siemensWincc = false) {
   return {
     samplingInterval: Number(point.samplingInterval) || Number(config.samplingInterval) || 1000,
     queueSize: positiveInteger(point.queueSize, positiveInteger(config.queueSize, 1)),
     discardOldest: point.discardOldest !== false,
-    deadbandType: point.deadbandType || config.deadbandType || 'none',
-    deadbandValue: Number(point.deadbandValue ?? config.deadbandValue) || 0,
+    deadbandType: siemensWincc ? 'none' : point.deadbandType || config.deadbandType || 'none',
+    deadbandValue: siemensWincc ? 0 : Number(point.deadbandValue ?? config.deadbandValue) || 0,
   };
 }
 
-function sameMonitoringSettings(left, right, config) {
-  const leftSettings = monitoringSettings(left, config);
-  const rightSettings = monitoringSettings(right, config);
+function sameMonitoringSettings(left, right, config, siemensWincc = false) {
+  const leftSettings = monitoringSettings(left, config, siemensWincc);
+  const rightSettings = monitoringSettings(right, config, siemensWincc);
   return Object.keys(leftSettings).every(
     (key) => leftSettings[key] === rightSettings[key]
   );
@@ -97,6 +100,7 @@ module.exports = function registerSubscribeNode(RED) {
     RED.nodes.createNode(this, config);
     const node = this;
     node.connection = RED.nodes.getNode(config.connection);
+    const diagnostics = createDiagnostics(node, config, 'subscribe');
     node.subscriptions = new Map();
     node.desired = new Map();
     node.monitored = new Map();
@@ -111,6 +115,7 @@ module.exports = function registerSubscribeNode(RED) {
     node.closing = false;
     node.lastDropped = 0;
     node.lastStatusAt = 0;
+    node.compatibilityWarningIssued = false;
     const consumer = node.connection?.registerConsumer?.('subscribe', {
       nodeId: config.id, name: config.name,
     });
@@ -118,7 +123,16 @@ module.exports = function registerSubscribeNode(RED) {
     const batchSize = positiveInteger(config.batchSize, 500);
     const callbackBatchSize = positiveInteger(config.callbackBatchSize, 500);
     const callbackFlushIntervalMs = positiveInteger(config.callbackFlushIntervalMs, 50);
-    const configuredSubscriptionCapacity = positiveInteger(config.maxItemsPerSubscription, 5000);
+    const siemensWincc = isSiemensWinCC(
+      node.connection?.client?.options?.compatibilityProfile
+    );
+    const requestedSubscriptionCapacity = positiveInteger(config.maxItemsPerSubscription, 5000);
+    const configuredSubscriptionCapacity = siemensWincc
+      ? Math.min(
+          requestedSubscriptionCapacity,
+          SIEMENS_WINCC_DEFAULTS.monitoredItemsPerSubscription
+        )
+      : requestedSubscriptionCapacity;
     // Undefined preserves the descriptor-rich output used by Flow JSON created
     // before resultDetail existed. New editor nodes explicitly save compact.
     const resultDetail = ['compact', 'value', 'full'].includes(config.resultDetail)
@@ -129,6 +143,24 @@ module.exports = function registerSubscribeNode(RED) {
       return [...node.subscriptions.keys()];
     }
 
+    function applyCompatibility(points) {
+      if (!siemensWincc) return points;
+      let removedDeadband = false;
+      const compatible = points.map((point) => {
+        const configuredType = point.deadbandType || config.deadbandType || 'none';
+        if (configuredType === 'none') return point;
+        removedDeadband = true;
+        return { ...point, deadbandType: 'none', deadbandValue: 0 };
+      });
+      if (removedDeadband && !node.compatibilityWarningIssued) {
+        node.compatibilityWarningIssued = true;
+        node.warn(
+          'Siemens WinCC does not support OPC UA DataChange Deadband filters; Deadband was disabled.'
+        );
+      }
+      return compatible;
+    }
+
     function primarySubscriptionId() {
       return subscriptionIds()[0] ?? null;
     }
@@ -175,6 +207,7 @@ module.exports = function registerSubscribeNode(RED) {
     function updateQueueWarning(diagnostics) {
       const dropped = Number(diagnostics.dropped) || 0;
       if (dropped > node.lastDropped) {
+        diagnostics.emit('warn', 'queue_overflow', 'OPC UA notification queue dropped changes', { dropped });
         node.warn(`OPC UA notification queue dropped ${dropped - node.lastDropped} change(s); total ${dropped}`);
       }
       node.lastDropped = dropped;
@@ -243,9 +276,10 @@ module.exports = function registerSubscribeNode(RED) {
 
     function onNativeBatch(record, batch) {
       if (node.closing || !record.id || !node.subscriptions.has(record.id)) return;
-      const diagnostics = batch.diagnostics || {};
-      node.subscriptionDiagnostics.set(record.id, diagnostics);
+      const queueDiagnostics = batch.diagnostics || {};
+      node.subscriptionDiagnostics.set(record.id, queueDiagnostics);
       const sourceChanges = batch.changes || [];
+      diagnostics.results(sourceChanges.filter((change) => node.desired.has(change.nodeId)), undefined, node.desired);
       const changes = [];
       for (let index = 0; index < sourceChanges.length; index += 1) {
         const change = sourceChanges[index];
@@ -325,8 +359,8 @@ module.exports = function registerSubscribeNode(RED) {
           samplingInterval: Number(config.samplingInterval) || 1000,
           queueSize: Number(config.queueSize) || 10,
           discardOldest: config.discardOldest !== false,
-          deadbandType: config.deadbandType || 'none',
-          deadbandValue: Number(config.deadbandValue) || 0,
+          deadbandType: siemensWincc ? 'none' : config.deadbandType || 'none',
+          deadbandValue: siemensWincc ? 0 : Number(config.deadbandValue) || 0,
           timestampMode: config.timestampMode || 'source',
         },
         batchSize
@@ -497,6 +531,11 @@ module.exports = function registerSubscribeNode(RED) {
           queueSizeMin: revisedQueues.minimum,
           queueSizeMax: revisedQueues.maximum,
         },
+        compatibility: {
+          profile: siemensWincc ? 'siemens-wincc' : 'standard',
+          deadbandSupported: !siemensWincc,
+          monitoredItemsPerSubscription: configuredSubscriptionCapacity,
+        },
         connectionGovernance: node.connection?.getConnectionGovernance?.(),
         connectionUsage: node.connection?.getConnectionUsage?.(),
       };
@@ -513,7 +552,9 @@ module.exports = function registerSubscribeNode(RED) {
       let rebuilt = false;
       if (node.subscriptions.size) {
         let valid = false;
-        try { valid = await validateSubscriptions(); } catch {}
+        try { valid = await validateSubscriptions(); } catch (error) {
+          diagnostics.failure(error, undefined, 'subscription_validation_failed', true);
+        }
         if (!valid) {
           await clearSubscriptions(true, true);
           rebuilt = true;
@@ -534,6 +575,7 @@ module.exports = function registerSubscribeNode(RED) {
       }
       await pruneEmptySubscriptions();
 
+      diagnostics.results(failures, undefined, node.desired);
       node.reconcileAttempt = 0;
       node.status({
         fill: failures.length ? 'yellow' : 'green',
@@ -542,7 +584,12 @@ module.exports = function registerSubscribeNode(RED) {
           (failures.length ? ` / ${failures.length} failed` : ''),
       });
       if (reason !== 'command') {
-        node.send({
+        diagnostics.emit(failures.length ? 'warn' : 'info', failures.length ? 'subscription_recovery_partial' : 'subscription_restored',
+          'OPC UA subscription reconciliation completed; data receipt is not yet confirmed', {
+            failed: failures.length, monitored: node.monitored.size, desired: node.desired.size,
+            rebuilt, dataGapPossible: rebuilt,
+          });
+        if (config.statusOutput !== 'separate') node.send({
           payload: { ...statusPayload('recover'), rebuilt, reason },
           opcua: {
             operation: 'subscription-status',
@@ -563,7 +610,7 @@ module.exports = function registerSubscribeNode(RED) {
       for (const [nodeId, monitored] of node.monitored) {
         const previous = node.desired.get(nodeId);
         const next = nextDesired.get(nodeId);
-        if (!next || !previous || !sameMonitoringSettings(previous, next, config)) {
+        if (!next || !previous || !sameMonitoringSettings(previous, next, config, siemensWincc)) {
           changed.add(nodeId);
         }
       }
@@ -591,6 +638,7 @@ module.exports = function registerSubscribeNode(RED) {
         try {
           await runSerialized(() => reconcileSubscriptions(reason));
         } catch (error) {
+          diagnostics.failure(error, undefined, 'subscription_recovery_failed', true);
           node.warn(`OPC UA resubscribe failed: ${error.message}`);
           node.status({ fill: 'yellow', shape: 'ring', text: 'waiting to recover' });
           scheduleReconnect(reason);
@@ -609,6 +657,7 @@ module.exports = function registerSubscribeNode(RED) {
         scheduleReconnect(state.reason || 'connected', true);
       } else if (state.state === 'subscription-inactive' &&
                  (!state.subscriptionId || node.subscriptions.has(state.subscriptionId))) {
+        diagnostics.emit('warn', 'subscription_inactive', 'OPC UA subscription is inactive; recovery pending', { retrying: true, subscriptionId: state.subscriptionId });
         node.status({ fill: 'yellow', shape: 'ring', text: 'subscription inactive' });
         scheduleReconnect('subscription-inactive');
       } else if (['reconnecting', 'backoff', 'failed'].includes(state.state)) {
@@ -619,21 +668,25 @@ module.exports = function registerSubscribeNode(RED) {
     node.connection?.client.on('state', onState);
 
     node.on('input', async (msg, send, done) => {
-      if (!node.connection) return done(new Error('OPC UA connection not configured'));
+      if (!node.connection) {
+        const error = new Error('OPCUA_CONNECTION_NOT_CONFIGURED');
+        diagnostics.failure(error, send);
+        return done(error);
+      }
       try {
         const command = msg.opcua?.command || 'replace';
         const dynamicNodeId = msg.nodeId || msg.topic;
         const configuredPayload = !looksLikePointList(msg.payload) && !Array.isArray(msg.items) &&
           !dynamicNodeId ? config.pointList : '';
         const staticNodeId = dynamicNodeId ? '' : config.nodeId;
-        const points = command === 'clear' ? [] : messagePoints(msg, staticNodeId, {
+        const points = command === 'clear' ? [] : applyCompatibility(messagePoints(msg, staticNodeId, {
           samplingInterval: Number(config.samplingInterval) || 1000,
           queueSize: Number(config.queueSize) || 10,
           discardOldest: config.discardOldest !== false,
         }, {
           configuredPayload,
           format: 'auto',
-        });
+        }));
 
         node.status({ fill: 'blue', shape: 'dot', text: `${command} ${points.length}` });
         await runSerialized(async () => {
@@ -642,7 +695,7 @@ module.exports = function registerSubscribeNode(RED) {
             const changed = new Set();
             points.forEach((point) => {
               const previous = node.desired.get(point.nodeId);
-              if (previous && !sameMonitoringSettings(previous, point, config)) {
+              if (previous && !sameMonitoringSettings(previous, point, config, siemensWincc)) {
                 changed.add(point.nodeId);
               }
               node.desired.set(point.nodeId, point);
@@ -666,7 +719,10 @@ module.exports = function registerSubscribeNode(RED) {
           text: `${node.monitored.size} monitored / ${node.subscriptions.size} sub` +
             (failed ? ` / ${failed} failed` : ''),
         });
-        send({
+        diagnostics.emit(failed ? 'warn' : 'info', 'subscription_updated', 'OPC UA subscription configuration updated', {
+          failed, monitored: node.monitored.size, desired: node.desired.size,
+        }, send);
+        if (config.statusOutput !== 'separate') send({
           ...msg,
           payload: statusPayload(command),
           opcua: { operation: 'subscription-status' },
@@ -674,6 +730,7 @@ module.exports = function registerSubscribeNode(RED) {
         done();
       } catch (error) {
         node.status({ fill: 'red', shape: 'ring', text: error.message });
+        diagnostics.failure(error, send);
         done(error);
       }
     });
@@ -710,16 +767,17 @@ module.exports = function registerSubscribeNode(RED) {
         if (node.closing) return;
         let points;
         try {
-          points = messagePoints({}, config.nodeId, {
+          points = applyCompatibility(messagePoints({}, config.nodeId, {
             samplingInterval: Number(config.samplingInterval) || 1000,
             queueSize: Number(config.queueSize) || 10,
             discardOldest: config.discardOldest !== false,
           }, {
             configuredPayload: config.pointList,
             format: 'auto',
-          });
+          }));
         } catch (error) {
           node.status({ fill: 'red', shape: 'ring', text: error.message });
+          diagnostics.failure(error, undefined, 'subscription_configuration_failed');
           node.warn(`OPC UA saved subscription point list is invalid: ${error.message}`);
           return;
         }
@@ -730,6 +788,7 @@ module.exports = function registerSubscribeNode(RED) {
           });
         }).catch((error) => {
           node.status({ fill: 'yellow', shape: 'ring', text: 'waiting to subscribe' });
+          diagnostics.failure(error, undefined, 'subscription_startup_failed', true);
           node.warn(`OPC UA startup subscription failed: ${error.message}`);
           scheduleReconnect('startup');
         });

package/nodes/write.html

@@ -47,6 +47,7 @@
 </script>
 <script type="text/html" data-help-name="tier0-opcua-write">
   <section lang="zh-CN">
+    <p>输出 2 为独立状态／异常消息：payload.level 为 info、warn 或 error。可连接 Debug、文件或日志服务；原有 Catch 和日志仍然有效。同类事件每 30 秒最多输出一次，下一次包含 suppressed 计数。输出不含原始值、凭据或完整错误文本。</p>
     <h3>写入（Write）</h3>
     <p>向一个或多个 OPC UA Variable 写值。服务器必须允许当前用户写入，值也必须能够转换为目标数据类型。</p>
     <h4>输入</h4>
@@ -62,6 +63,7 @@
   </section>
   <hr>
   <section lang="en">
+    <p>Output 2 emits status/error events with payload.level (info, warn, error). Connect it to Debug, file or logging nodes. Catch and existing logs remain supported. Repeats are limited to one per 30 seconds; the next matching event includes suppressed counts. Raw values, credentials and SDK error text are omitted.</p>
     <h3>Write</h3>
     <p>Writes values to one or more OPC UA Variables. The current user must have write access and each value must be convertible to the target data type.</p>
     <h4>Input</h4>
@@ -78,7 +80,7 @@
 </script>
 <script type="text/javascript">
   RED.nodes.registerType('tier0-opcua-write', {
-    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 1, icon: 'bridge.png',
+    category: 'OPC UA', color: '#c7e9f1', inputs: 1, outputs: 2, outputLabels: ['Data', 'Status / errors'], icon: 'bridge.png',
     defaults: {
       connection: { value: '', type: 'tier0-opcua-connection', required: true },
       nodeId: { value: '' }, dataType: { value: 'String' },

package/nodes/write.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { createDiagnostics } = require('../lib/diagnostics');
+
 const { messageWritePoints } = require('../lib/points');
 
 module.exports = function registerWriteNode(RED) {
@@ -7,12 +9,17 @@ module.exports = function registerWriteNode(RED) {
     RED.nodes.createNode(this, config);
     const node = this;
     node.connection = RED.nodes.getNode(config.connection);
+    const diagnostics = createDiagnostics(node, config, 'write');
     const consumer = node.connection?.registerConsumer?.('write', {
       nodeId: config.id, name: config.name,
     });
 
     node.on('input', async (msg, send, done) => {
-      if (!node.connection) return done(new Error('OPC UA connection not configured'));
+      if (!node.connection) {
+        const error = new Error('OPCUA_CONNECTION_NOT_CONFIGURED');
+        diagnostics.failure(error, send);
+        return done(error);
+      }
 
       try {
         consumer?.markUsed('write');
@@ -23,6 +30,7 @@ module.exports = function registerWriteNode(RED) {
           Number(config.batchSize) || 500
         );
 
+        const failed = diagnostics.results(results, send, new Map(points.map((point) => [point.nodeId, point])));
         if ((config.outputMode || 'batch') === 'split') {
           results.forEach((result) => send({ ...msg, topic: result.nodeId, opcua: result }));
         } else {
@@ -38,10 +46,12 @@ module.exports = function registerWriteNode(RED) {
           send(msg);
         }
 
-        node.status({ fill: 'green', shape: 'dot', text: `${results.length} written` });
+        node.status({ fill: failed ? 'yellow' : 'green', shape: failed ? 'ring' : 'dot',
+          text: `${results.length - failed}/${results.length} written` + (failed ? ` / ${failed} failed` : '') });
         done();
       } catch (error) {
         node.status({ fill: 'red', shape: 'ring', text: error.message });
+        diagnostics.failure(error, send);
         done(error);
       }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tier0/opcua-client",
-  "version": "0.5.0",
+  "version": "0.6.2",
   "description": "High-scale OPC UA client nodes for Node-RED powered by open62541",
   "license": "Apache-2.0",
   "repository": {

package/src/addon.cc

@@ -49,6 +49,14 @@ std::string SecurityPolicyUri(const std::string& policy) {
       policy == "http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256") {
     return "http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256";
   }
+  if (policy == "Aes128_Sha256_RsaOaep" ||
+      policy == "http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep") {
+    return "http://opcfoundation.org/UA/SecurityPolicy#Aes128_Sha256_RsaOaep";
+  }
+  if (policy == "Aes256_Sha256_RsaPss" ||
+      policy == "http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss") {
+    return "http://opcfoundation.org/UA/SecurityPolicy#Aes256_Sha256_RsaPss";
+  }
   return "";
 }