node-opcua-address-space 2.186.17 → 2.187.1

package/api/address_space_public.ts

@@ -2,11 +2,19 @@
  * @module node-opcua-address-space
  */
 import type { IAddressSpace } from "node-opcua-address-space-base";
+import { type StoreAddressSpace, type StoreAddressSpaceOptions, StoreServices } from "node-opcua-address-space-store";
 import { AddressSpaceImpl } from "../impl/address_space.js";
 import type { IHistorizerFactory } from "./address_space_ts.js";
 import type { Namespace } from "./namespace.js";
 import type { UARootFolder } from "./ua_root_folder.js";
 
+/** the published names of the compact address space and its options */
+export type CompactAddressSpace = StoreAddressSpace;
+export type CompactAddressSpaceOptions = StoreAddressSpaceOptions;
+/** the Read, Write, Browse and TranslateBrowsePaths services on a compact address space */
+export const CompactAddressSpaceServices = StoreServices;
+export type CompactAddressSpaceServices = StoreServices;
+
 /**
  * The address space: the set of nodes a server exposes, and the namespaces they live in.
  *
@@ -40,6 +48,14 @@ export interface AddressSpaceConstructor {
     /** build an empty address space */
     create(): AddressSpace;
 
+    /**
+     * build an empty compact address space: the nodes in typed columns, node objects built
+     * on demand. Cheaper by far for a large model, and not yet an {@link AddressSpace}: it
+     * answers finds, browses, attribute and value reads, bindings and writes, and a server
+     * cannot be built on it yet.
+     */
+    createCompact(options?: CompactAddressSpaceOptions): CompactAddressSpace;
+
     /**
      * How historized variables get their historian. Assigning here replaces the default that
      * the historical-access code installs on first use.

package/api/helpers/resolve_opaque_on_address_space.ts

@@ -1,9 +1,18 @@
 import type { IAddressSpace } from "node-opcua-address-space-base";
 import { resolveDynamicExtensionObject } from "node-opcua-client-dynamic-extension-object";
-import { Variant } from "node-opcua-variant";
+import { DataType, Variant } from "node-opcua-variant";
 import { ensureDatatypeExtracted } from "../loader/ensure_datatype_extracted.js";
 import { PseudoSession } from "../pseudo_session.js";
 
+/**
+ * true when the variant may hold an opaque structure to resolve: only an ExtensionObject, or a
+ * Variant nested in one, can. Any other value is left as it is by resolveDynamicExtensionObject,
+ * so a Write of a number or a string needs neither a PseudoSession nor the DataType extraction.
+ */
+export function mayHoldOpaqueStructure(variant: Variant | null | undefined): boolean {
+    return !!variant && (variant.dataType === DataType.ExtensionObject || variant.dataType === DataType.Variant);
+}
+
 export async function resolveOpaqueOnAddressSpace(
     addressSpace: IAddressSpace,
     variants: (Variant | null) | (Variant | null)[]
@@ -11,6 +20,9 @@ export async function resolveOpaqueOnAddressSpace(
     if (!variants) {
         return;
     }
+    if (variants instanceof Variant ? !mayHoldOpaqueStructure(variants) : !variants.some(mayHoldOpaqueStructure)) {
+        return;
+    }
     const session = new PseudoSession(addressSpace);
     const extraDataTypeManager = await ensureDatatypeExtracted(addressSpace);
     if (variants instanceof Variant) {

package/api/index.ts

@@ -91,7 +91,12 @@ export * from "../impl/event_data.js";
 /** Building and maintaining a variable whose value is an array of extension objects. */
 export { addElement, bindExtObjArrayNode, createExtObjArrayNode, removeElement } from "../impl/extension_object_array_node.js";
 /** The default historian, installed through {@link AddressSpace.historizerFactory}. */
-export { VariableHistorian } from "../impl/historical_access/address_space_historical_data_node.js";
+export {
+    createDetachedHistorian,
+    historyReadThrough,
+    type IHistoryReadTarget,
+    VariableHistorian
+} from "../impl/historical_access/address_space_historical_data_node.js";
 export {
     installReadProcessedDetails,
     type ReadProcessedDetailsFunc
@@ -135,7 +140,7 @@ export * from "./helpers/call_helpers.js";
 export * from "./helpers/dump_tools.js";
 export * from "./helpers/ensure_secure_access.js";
 export * from "./helpers/make_optionals_map.js";
-export { resolveOpaqueOnAddressSpace } from "./helpers/resolve_opaque_on_address_space.js";
+export { mayHoldOpaqueStructure, resolveOpaqueOnAddressSpace } from "./helpers/resolve_opaque_on_address_space.js";
 export * from "./interfaces/alarms_and_conditions/condition_info_i.js";
 export * from "./interfaces/alarms_and_conditions/condition_snapshot.js";
 export * from "./interfaces/alarms_and_conditions/instantiate_alarm_condition_options.js";
@@ -236,12 +241,18 @@ export type {
     NodesetSource,
     NodesetSourceKind
 } from "./loader/nodeset_source.js";
-export { sha256Hex } from "./loader/nodeset_source.js";
+export { openNodesetSource, sha256Hex } from "./loader/nodeset_source.js";
 export * from "./loader/nodeset_source_helpers.js";
 export { type NodesetToImageOptions, nodesetToImage } from "./loader/nodeset_to_image.js";
 export { headerComplete, parseDependencies, sliceHeader } from "./loader/nodeset_xml_header.js";
 export { makeXmlNodesetRecordReader, type XmlNodesetRecordReader, xmlNodesetRecords } from "./loader/nodeset_xml_producer.js";
 export * from "./loader/register_node_promoter.js";
+export {
+    type CompactRecordConsumer,
+    compactRecordConsumer,
+    StoreRecordApplier,
+    type StoreRecordApplierOptions
+} from "./loader/store_record_applier.js";
 export * from "./namespace.js";
 export type { INamespaceAlarmAndCondition } from "./namespace_alarm_and_condition.js";
 export * from "./namespace_data_access.js";

package/api/loader/store_record_applier.ts

@@ -0,0 +1,267 @@
+/**
+ * @module node-opcua-address-space
+ *
+ * The nodeset records written straight into a compact store: no node object is created.
+ * Same producer as the object applier (NodesetRecordApplier), other sink.
+ */
+import { type CompactStore, NO_NODE, type RolePermissionEntry, type StoreAddressSpace } from "node-opcua-address-space-store";
+import { NodeClass } from "node-opcua-data-model";
+import { NodeId } from "node-opcua-nodeid";
+import { DataType, VariantArrayType, type VariantOptions } from "node-opcua-variant";
+import type { NodeSetPermissionsPolicy } from "../interfaces/nodeset_loader_options.js";
+import {
+    type NodesetHeaderRecord,
+    type NodesetNodeRecord,
+    type NodesetRecord,
+    type NodesetRecordConsumer,
+    XmlExtensionObjectFragment
+} from "./nodeset_record.js";
+
+const UA_NAMESPACE_URI = "http://opcfoundation.org/UA/";
+
+/** who hands out namespace indexes: the address space, or a plain table in a test */
+export interface NamespaceRegistry {
+    /** the index of a namespace, registering it when it is new */
+    indexOf(namespaceUri: string): number;
+}
+
+/** the same two policies as the object loader, with the same defaults */
+export interface StoreRecordApplierOptions {
+    /** the nodeset's RolePermissions: kept (the default) or dropped */
+    permissions?: NodeSetPermissionsPolicy;
+    /** the nodeset's AccessRestrictions: kept, or dropped (the default) */
+    accessRestrictions?: NodeSetPermissionsPolicy;
+}
+
+export class StoreRecordApplier implements NodesetRecordConsumer {
+    // per document: the file's namespace table to the store's
+    #table: number[] = [];
+    #headerSeen = false;
+    #nodeCount = 0;
+    #pendingValues = 0;
+    #deferredValues = 0;
+    // a type definition or data type declared before its node exists: set at finish()
+    #deferredTypeDefinitions: [number, NodeId][] = [];
+    #deferredDataTypes: [number, NodeId][] = [];
+    #deferredParents: [number, NodeId][] = [];
+    readonly #store: CompactStore;
+    readonly #namespaces: NamespaceRegistry;
+    readonly #loadTime = Date.now();
+    readonly #keepPermissions: boolean;
+    readonly #keepAccessRestrictions: boolean;
+
+    constructor(store: CompactStore, namespaces: NamespaceRegistry, options: StoreRecordApplierOptions = {}) {
+        this.#store = store;
+        this.#namespaces = namespaces;
+        this.#keepPermissions = (options.permissions ?? "apply") === "apply";
+        this.#keepAccessRestrictions = (options.accessRestrictions ?? "ignore") === "apply";
+    }
+
+    /** nodes applied by this applier */
+    public get nodeCount(): number {
+        return this.#nodeCount;
+    }
+
+    public apply(record: NodesetRecord): void {
+        if (record.kind === "header") {
+            this.#applyHeader(record);
+            return;
+        }
+        if (!this.#headerSeen) {
+            throw new Error("StoreRecordApplier: a node record came before the header record");
+        }
+        this.#applyNode(record);
+    }
+
+    /** at the end of a document, or of a set of documents: resolve the references that waited */
+    public finish(): { unresolved: number } {
+        const store = this.#store;
+        const unresolved = store.resolvePending();
+        for (const [i, nodeId] of this.#deferredTypeDefinitions) {
+            const t = store.find(nodeId);
+            if (t !== NO_NODE) store.nodes.setTypeDefinition(i, t);
+        }
+        for (const [i, nodeId] of this.#deferredDataTypes) {
+            const t = store.find(nodeId);
+            if (t !== NO_NODE) store.nodes.setDataType(i, t);
+        }
+        for (const [i, nodeId] of this.#deferredParents) {
+            const t = store.find(nodeId);
+            if (t !== NO_NODE) store.nodes.setParent(i, t);
+        }
+        this.#deferredTypeDefinitions = [];
+        this.#deferredDataTypes = [];
+        this.#deferredParents = [];
+        store.finish();
+        return { unresolved: unresolved.length };
+    }
+
+    #applyHeader(header: NodesetHeaderRecord): void {
+        this.#headerSeen = true;
+        this.#table = [];
+        for (const model of header.models) {
+            this.#namespaces.indexOf(model.modelUri);
+        }
+        if (header.models.length === 0) {
+            for (const uri of header.namespaceUris) {
+                this.#namespaces.indexOf(uri);
+            }
+        }
+        // the file's table: the UA namespace, then the declared URIs in order; a repeat takes no slot
+        const seen = new Set<string>();
+        for (const uri of [UA_NAMESPACE_URI, ...header.namespaceUris]) {
+            if (seen.has(uri)) continue;
+            seen.add(uri);
+            this.#table.push(this.#namespaces.indexOf(uri));
+        }
+    }
+
+    #translateNamespace(fileIndex: number): number {
+        const index = this.#table[fileIndex];
+        if (index === undefined) {
+            throw new Error(`StoreRecordApplier: no namespace for file index ${fileIndex}`);
+        }
+        return index;
+    }
+
+    #translate(fileLocal: NodeId): NodeId {
+        const namespace = this.#translateNamespace(fileLocal.namespace);
+        return namespace === fileLocal.namespace ? fileLocal : new NodeId(fileLocal.identifierType, fileLocal.value, namespace);
+    }
+
+    #applyNode(record: NodesetNodeRecord): void {
+        const store = this.#store;
+        const nodeId = this.#translate(record.nodeId);
+        const i = store.addNode({
+            nodeId,
+            nodeClass: record.nodeClass,
+            browseName: record.browseName.name ?? "",
+            browseNameNamespace: this.#translateNamespace(record.browseName.namespaceIndex),
+            displayName: record.displayName && record.displayName !== record.browseName.name ? record.displayName : null,
+            description: record.description ?? null,
+            valueRank: record.valueRank,
+            // the document gives the levels as numbers; CurrentRead when it says nothing, and the
+            // user level follows the node's unless declared (same reading as the object applier)
+            accessLevel: parseAccessLevel(record.accessLevel, 1),
+            userAccessLevel: record.userAccessLevel ? parseAccessLevel(record.userAccessLevel, 1) : undefined,
+            minimumSamplingInterval: record.minimumSamplingInterval,
+            historizing: record.historizing,
+            eventNotifier: record.eventNotifier,
+            isAbstract: record.isAbstract,
+            symmetric: record.symmetric,
+            inverseName: record.inverseName ?? null,
+            containsNoLoops: record.containsNoLoops,
+            accessRestrictions: this.#keepAccessRestrictions ? parseAccessRestrictions(record.accessRestrictions) : undefined,
+            rolePermissions: this.#keepPermissions ? this.#rolePermissions(record) : undefined
+        });
+        this.#nodeCount++;
+        for (const reference of record.references) {
+            const referenceType = this.#translate(reference.referenceType);
+            const target = this.#translate(reference.nodeId);
+            store.addReference(i, referenceType, reference.isForward, target);
+            // the type definition and the data type are also columns, kept resolved by index
+            if (reference.isForward && referenceType.namespace === 0 && referenceType.value === 40 /* HasTypeDefinition */) {
+                const t = store.find(target);
+                if (t !== NO_NODE) store.nodes.setTypeDefinition(i, t);
+                else this.#deferredTypeDefinitions.push([i, target]);
+            }
+        }
+        if (record.dataType) {
+            const dataTypeId = this.#translate(record.dataType);
+            const dataType = store.find(dataTypeId);
+            if (dataType !== NO_NODE) store.nodes.setDataType(i, dataType);
+            else this.#deferredDataTypes.push([i, dataTypeId]);
+        }
+        if (record.parentNodeId) {
+            const parentId = this.#translate(record.parentNodeId);
+            const parent = store.find(parentId);
+            if (parent !== NO_NODE) store.nodes.setParent(i, parent);
+            else this.#deferredParents.push([i, parentId]);
+        }
+        if (record.value && (record.nodeClass === NodeClass.Variable || record.nodeClass === NodeClass.VariableType)) {
+            this.#applyValue(i, record.value);
+        }
+    }
+
+    #rolePermissions(record: NodesetNodeRecord): RolePermissionEntry[] | undefined {
+        if (record.rolePermissions) {
+            return record.rolePermissions.map((r) => ({ roleId: this.#translate(r.roleId), permissions: r.permissions }));
+        }
+        // HasNoPermissions grants nothing; an absent RolePermissions inherits the namespace default
+        return record.hasNoPermissions ? [] : undefined;
+    }
+
+    #applyValue(i: number, value: VariantOptions): void {
+        if (holdsXmlFragment(value.value)) {
+            // an extension object the loader left as its XML: the node objects decode it once every
+            // document is in; the store has no decoder yet, so the Variable waits for a value rather
+            // than serve something a client cannot decode
+            this.#deferredValues++;
+            return;
+        }
+        const now = this.#loadTime;
+        const dataType =
+            (typeof value.dataType === "string" ? DataType[value.dataType as keyof typeof DataType] : value.dataType) ??
+            DataType.Null;
+        const isScalar = value.arrayType === undefined || value.arrayType === VariantArrayType.Scalar;
+        const v = value.value;
+        if (isScalar && (typeof v === "number" || typeof v === "boolean")) {
+            this.#store.values.setScalar(i, dataType, v, 0, now, now);
+        } else {
+            this.#store.values.setObject(i, dataType, value, 0, now, now);
+            this.#pendingValues++;
+        }
+    }
+
+    /** values kept as objects (strings, arrays, structures) */
+    public get objectValueCount(): number {
+        return this.#pendingValues;
+    }
+
+    /** extension object values the document gave as XML, left unset (BadWaitingForInitialData) */
+    public get deferredValueCount(): number {
+        return this.#deferredValues;
+    }
+}
+
+/** true when a value is, or holds, an extension object still in its XML form */
+function holdsXmlFragment(value: unknown): boolean {
+    if (value instanceof XmlExtensionObjectFragment) return true;
+    return Array.isArray(value) && value.some((element) => element instanceof XmlExtensionObjectFragment);
+}
+
+function parseAccessLevel(text: string | undefined, absent: number): number {
+    const value = parseInt(text || "", 10);
+    return Number.isNaN(value) ? absent : value;
+}
+
+/** the AccessRestrictions attribute of the document: a number; absent or invalid inherits */
+function parseAccessRestrictions(text: string | undefined): number | undefined {
+    if (text === undefined || text === "") {
+        return undefined;
+    }
+    const value = parseInt(text, 10);
+    return Number.isNaN(value) ? undefined : value & 0xf;
+}
+
+/** what a compact address space is loaded through: the records go in, finish() once they are all in */
+export interface CompactRecordConsumer extends NodesetRecordConsumer {
+    finish(): { unresolved: number };
+}
+
+/**
+ * the consumer a nodeset producer feeds to load a compact address space: the records written
+ * into its store, the namespaces registered on it, and what the space derives from its columns
+ * derived again at the end
+ */
+export function compactRecordConsumer(space: StoreAddressSpace, options: StoreRecordApplierOptions = {}): CompactRecordConsumer {
+    const applier = new StoreRecordApplier(space.store, { indexOf: (uri) => space.namespaceIndexOf(uri) }, options);
+    return {
+        apply: (record) => applier.apply(record),
+        finish: () => {
+            const result = applier.finish();
+            space.finishLoad();
+            return result;
+        }
+    };
+}

package/api/session_context.ts

@@ -219,27 +219,39 @@ function getPermissionForRole(
 function isDefaultContext(context: SessionContext) {
     return context === SessionContext.defaultContext;
 }
+const serverNamespacesNodeId = resolveNodeId(ObjectIds.Server_Namespaces);
+/**
+ * the Namespaces Object of the Server (RootFolder/Objects/Server/Namespaces), which holds the
+ * NamespaceMetadata of every namespace.
+ *
+ * It is consulted for each permission and each access-restriction check, that is several times
+ * per node read, so it is found by its NodeId: `rootFolder.objects.server.namespaces` resolves
+ * three children by name every time it is evaluated.
+ */
+function getServerNamespaces(namespace: NamespacePrivate): BaseNode | null {
+    return namespace.addressSpace.findNode(serverNamespacesNodeId);
+}
+
 function getAccessRestrictionsOnNamespace(namespace: NamespacePrivate, context: SessionContext): AccessRestrictionsFlag {
     // ignore permission when default context is provided (to avoid recursion)
     if (isDefaultContext(context)) {
         return AccessRestrictionsFlag.None;
     }
-    const namespaces = namespace.addressSpace.rootFolder?.objects?.server?.namespaces;
-    if (!namespaces) {
-        return AccessRestrictionsFlag.None;
-    }
-    const namespaceObject = namespaces.getChildByName(namespace.namespaceUri);
-    if (!namespaceObject) {
-        return AccessRestrictionsFlag.None;
-    }
-    const defaultAccessRestriction = namespaceObject.getChildByName("defaultAccessRestriction");
-    if (defaultAccessRestriction) {
-        const dataValue = defaultAccessRestriction.readAttribute(null, AttributeIds.Value);
-        if (dataValue?.statusCode.isGood()) {
-            return dataValue.value.value as AccessRestrictionsFlag;
-        }
-    }
-    return AccessRestrictionsFlag.None;
+    const namespaces = getServerNamespaces(namespace);
+    const namespaceObject = namespaces?.getChildByName(namespace.namespaceUri);
+    const defaultAccessRestrictions = namespaceObject?.getChildByName("DefaultAccessRestrictions");
+    if (defaultAccessRestrictions) {
+        const dataValue = defaultAccessRestrictions.readAttribute(null, AttributeIds.Value);
+        const value = dataValue?.value?.value as AccessRestrictionsFlag | null | undefined;
+        // the NamespaceMetadata nodes of the standard nodesets declare the property without a
+        // value: a null falls through to the namespace's own setting below
+        if (dataValue?.statusCode.isGood() && value !== null && value !== undefined) {
+            return value;
+        }
+    }
+    // same fallback as getDefaultUserRolePermissionsOnNamespace: the policy set with
+    // Namespace.setDefaultAccessRestrictions() applies even without setNamespaceMetaData()
+    return namespace.getDefaultAccessRestrictions();
 }
 
 function getDefaultUserRolePermissionsOnNamespace(
@@ -251,7 +263,7 @@ function getDefaultUserRolePermissionsOnNamespace(
         return null;
     }
 
-    const namespaces = namespace.addressSpace.rootFolder?.objects?.server?.namespaces;
+    const namespaces = getServerNamespaces(namespace);
     const uaNamespaceObject = namespaces?.getChildByName(namespace.namespaceUri);
     if (uaNamespaceObject) {
         // DefaultUserRolePermissions is the user-specific policy and wins when it carries a value.
@@ -437,6 +449,17 @@ export function makeRoles(roleIds: RoleIdLike[] | string | WellKnownRoles, addre
     return roleIds.map((role) => resolveRole(role, addressSpace));
 }
 
+/** what {@link SessionContext.withPermissionCache} remembers while its action runs */
+interface PermissionCache {
+    roles?: NodeId[];
+    evaluationRoles?: NodeId[];
+    /** keyed by the RolePermissions that apply, which most nodes share with their namespace */
+    permissions: Map<RolePermissionType[] | null, PermissionFlag>;
+    /** keyed by namespace index: a Read stays within one address space */
+    defaultRolePermissions: Map<number, RolePermissionType[] | null>;
+    defaultAccessRestrictions: Map<number, AccessRestrictionsFlag>;
+}
+
 export class SessionContext implements ISessionContext {
     public static defaultContext = new SessionContext({});
 
@@ -447,6 +470,8 @@ export class SessionContext implements ISessionContext {
     public readonly server?: IServerBase;
     public readonly requestHeader?: RequestHeader;
 
+    #permissionCache: PermissionCache | null = null;
+
     constructor(options?: SessionContextOptions) {
         options = options || {};
         this.session = options.session;
@@ -480,6 +505,26 @@ export class SessionContext implements ISessionContext {
         return this.requestHeader?.auditEntryId || undefined;
     }
 
+    /**
+     * see {@link ISessionContext.withPermissionCache}.
+     *
+     * A Session's sessionContext is shared by every request in flight on it, so the cache only
+     * lives while `action` runs, and `action` must not wait on anything: a request served in
+     * one synchronous run cannot be interleaved with another one. Nested calls share the
+     * outermost cache.
+     */
+    public withPermissionCache<T>(action: () => T): T {
+        if (this.#permissionCache) {
+            return action();
+        }
+        this.#permissionCache = { permissions: new Map(), defaultRolePermissions: new Map(), defaultAccessRestrictions: new Map() };
+        try {
+            return action();
+        } finally {
+            this.#permissionCache = null;
+        }
+    }
+
     /**
      * The client's application-instance certificate,
      * or `null` if no secure channel is available.
@@ -558,6 +603,15 @@ export class SessionContext implements ISessionContext {
      *
      */
     public getCurrentUserRoles(): NodeId[] {
+        const cache = this.#permissionCache;
+        if (!cache) {
+            return this.#resolveCurrentUserRoles();
+        }
+        cache.roles ??= this.#resolveCurrentUserRoles();
+        return cache.roles;
+    }
+
+    #resolveCurrentUserRoles(): NodeId[] {
         if (!this.session) {
             // no Session: an in-process caller. getPermissions grants it everything —
             // an empty list here does NOT mean "no rights", see unresolvedPermissions.
@@ -573,7 +627,8 @@ export class SessionContext implements ISessionContext {
             return [];
         }
 
-        const anonymous = makeRoles([WellKnownRoles.Anonymous]);
+        // a fresh array each time, a caller may change it; the NodeId is resolved once, at load
+        const anonymous = (): NodeId[] => [anonymousRoleNodeId];
 
         const username = getUserName(userIdentityToken);
 
@@ -587,16 +642,16 @@ export class SessionContext implements ISessionContext {
         }
 
         if (username === "anonymous") {
-            return anonymous;
+            return anonymous();
         }
         if (!this.server?.userManager) {
-            return anonymous;
+            return anonymous();
         }
 
         assert(this.server != null, "expecting a server");
 
         if (typeof this.server.userManager.getUserRoles !== "function") {
-            return anonymous;
+            return anonymous();
         }
 
         const rolesNodeId = this.server.userManager.getUserRoles(username) || [];
@@ -627,8 +682,16 @@ export class SessionContext implements ISessionContext {
 
     public getApplicableRolePermissions(node: BaseNode): RolePermissionType[] | null {
         if (!node.rolePermissions) {
-            const namespace = node.namespace as NamespacePrivate;
-            const defaultUserRolePermissions = getDefaultUserRolePermissionsOnNamespace(namespace, this);
+            const cache = this.#permissionCache;
+            if (!cache) {
+                return getDefaultUserRolePermissionsOnNamespace(node.namespace as NamespacePrivate, this);
+            }
+            const namespaceIndex = node.nodeId.namespace;
+            let defaultUserRolePermissions = cache.defaultRolePermissions.get(namespaceIndex);
+            if (defaultUserRolePermissions === undefined) {
+                defaultUserRolePermissions = getDefaultUserRolePermissionsOnNamespace(node.namespace as NamespacePrivate, this);
+                cache.defaultRolePermissions.set(namespaceIndex, defaultUserRolePermissions);
+            }
             return defaultUserRolePermissions;
         }
         return node.rolePermissions;
@@ -684,7 +747,11 @@ export class SessionContext implements ISessionContext {
     public getPermissions(node: BaseNode): PermissionFlag {
         const applicableRolePermissions = this.getApplicableRolePermissions(node);
 
-        const roles = this.getCurrentUserRoles();
+        const cache = this.#permissionCache;
+        if (cache) {
+            cache.roles ??= this.getCurrentUserRoles();
+        }
+        const roles = cache?.roles ?? this.getCurrentUserRoles();
         if (roles.length === 0) {
             // Two very different situations land here:
             //  - no Session at all: an in-process caller, always trusted (see isInProcessCaller)
@@ -694,17 +761,39 @@ export class SessionContext implements ISessionContext {
             //    can set unresolvedPermissionPolicy: "deny" to fail closed instead.
             return this.unresolvedPermissions;
         }
+        if (!cache) {
+            return this.#evaluatePermissions(applicableRolePermissions, this.getRolesForPermissionEvaluation(roles));
+        }
+        let permissions = cache.permissions.get(applicableRolePermissions);
+        if (permissions === undefined) {
+            cache.evaluationRoles ??= this.getRolesForPermissionEvaluation(roles);
+            permissions = this.#evaluatePermissions(applicableRolePermissions, cache.evaluationRoles);
+            cache.permissions.set(applicableRolePermissions, permissions);
+        }
+        return permissions;
+    }
+
+    #evaluatePermissions(applicableRolePermissions: RolePermissionType[] | null, roles: NodeId[]): PermissionFlag {
         const unresolved = this.unresolvedPermissions;
         let orFlags: PermissionFlag = 0;
-        for (const role of this.getRolesForPermissionEvaluation(roles)) {
+        for (const role of roles) {
             orFlags = orFlags | getPermissionForRole(applicableRolePermissions, role, unresolved);
         }
         return orFlags;
     }
+
     public getAccessRestrictions(node: BaseNode): AccessRestrictionsFlag {
         if (node.accessRestrictions === undefined) {
-            const namespace = node.namespace as NamespacePrivate;
-            const accessRestrictions = getAccessRestrictionsOnNamespace(namespace, this);
+            const cache = this.#permissionCache;
+            if (!cache) {
+                return getAccessRestrictionsOnNamespace(node.namespace as NamespacePrivate, this);
+            }
+            const namespaceIndex = node.nodeId.namespace;
+            let accessRestrictions = cache.defaultAccessRestrictions.get(namespaceIndex);
+            if (accessRestrictions === undefined) {
+                accessRestrictions = getAccessRestrictionsOnNamespace(node.namespace as NamespacePrivate, this);
+                cache.defaultAccessRestrictions.set(namespaceIndex, accessRestrictions);
+            }
             return accessRestrictions;
         }
         return node.accessRestrictions;

package/dist/api/address_space_public.d.ts

@@ -2,9 +2,16 @@
  * @module node-opcua-address-space
  */
 import type { IAddressSpace } from "node-opcua-address-space-base";
+import { type StoreAddressSpace, type StoreAddressSpaceOptions, StoreServices } from "node-opcua-address-space-store";
 import type { IHistorizerFactory } from "./address_space_ts.js";
 import type { Namespace } from "./namespace.js";
 import type { UARootFolder } from "./ua_root_folder.js";
+/** the published names of the compact address space and its options */
+export type CompactAddressSpace = StoreAddressSpace;
+export type CompactAddressSpaceOptions = StoreAddressSpaceOptions;
+/** the Read, Write, Browse and TranslateBrowsePaths services on a compact address space */
+export declare const CompactAddressSpaceServices: typeof StoreServices;
+export type CompactAddressSpaceServices = StoreServices;
 /**
  * The address space: the set of nodes a server exposes, and the namespaces they live in.
  *
@@ -35,6 +42,13 @@ export interface AddressSpace extends IAddressSpace {
 export interface AddressSpaceConstructor {
     /** build an empty address space */
     create(): AddressSpace;
+    /**
+     * build an empty compact address space: the nodes in typed columns, node objects built
+     * on demand. Cheaper by far for a large model, and not yet an {@link AddressSpace}: it
+     * answers finds, browses, attribute and value reads, bindings and writes, and a server
+     * cannot be built on it yet.
+     */
+    createCompact(options?: CompactAddressSpaceOptions): CompactAddressSpace;
     /**
      * How historized variables get their historian. Assigning here replaces the default that
      * the historical-access code installs on first use.

package/dist/api/address_space_public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"address_space_public.d.ts","sourceRoot":"","sources":["../../api/address_space_public.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,aAAa;IAC/C,eAAe,IAAI,SAAS,CAAC;IAC7B,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,UAAU,EAAE,YAAY,CAAC;IAEzB;;;;;;;OAOG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACpC,mCAAmC;IACnC,MAAM,IAAI,YAAY,CAAC;IAEvB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,EAAE,uBAA0C,CAAC"}
+{"version":3,"file":"address_space_public.d.ts","sourceRoot":"","sources":["../../api/address_space_public.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEtH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACpD,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAClE,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,sBAAgB,CAAC;AACzD,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,aAAa;IAC/C,eAAe,IAAI,SAAS,CAAC;IAC7B,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,UAAU,EAAE,YAAY,CAAC;IAEzB;;;;;;;OAOG;IACH,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACpC,mCAAmC;IACnC,MAAM,IAAI,YAAY,CAAC;IAEvB;;;;;OAKG;IACH,aAAa,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,mBAAmB,CAAC;IAEzE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,EAAE,uBAA0C,CAAC"}

package/dist/api/address_space_public.js

@@ -1,4 +1,7 @@
+import { StoreServices } from "node-opcua-address-space-store";
 import { AddressSpaceImpl } from "../impl/address_space.js";
+/** the Read, Write, Browse and TranslateBrowsePaths services on a compact address space */
+export const CompactAddressSpaceServices = StoreServices;
 /**
  * An interface and a variable may share a name, so `AddressSpace` is both the type you
  * annotate with and the value you call `create()` on, while the implementation class stays

package/dist/api/address_space_public.js.map

@@ -1 +1 @@
-{"version":3,"file":"address_space_public.js","sourceRoot":"","sources":["../../api/address_space_public.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA6C5D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAA4B,gBAAgB,CAAC"}
+{"version":3,"file":"address_space_public.js","sourceRoot":"","sources":["../../api/address_space_public.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyD,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQ5D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,aAAa,CAAC;AAmDzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAA4B,gBAAgB,CAAC"}