node-opcua-server 2.163.1 → 2.165.0

package/dist/server_end_point.d.ts

@@ -1,14 +1,14 @@
 /**
  * @module node-opcua-server
  */
-import { EventEmitter } from "events";
-import { OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { Certificate, PrivateKey } from "node-opcua-crypto/web";
-import { MessageSecurityMode, SecurityPolicy, ServerSecureChannelLayer, ServerSecureChannelParent } from "node-opcua-secure-channel";
-import { UserTokenType } from "node-opcua-service-endpoints";
-import { EndpointDescription } from "node-opcua-service-endpoints";
-import { ApplicationDescription } from "node-opcua-service-endpoints";
-import { IHelloAckLimits } from "node-opcua-transport";
+import { EventEmitter } from "node:events";
+import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
+import { type Certificate, type PrivateKey } from "node-opcua-crypto/web";
+import { MessageSecurityMode, SecurityPolicy, ServerSecureChannelLayer, type ServerSecureChannelParent } from "node-opcua-secure-channel";
+import { ApplicationDescription, EndpointDescription, UserTokenType } from "node-opcua-service-endpoints";
+import type { IHelloAckLimits } from "node-opcua-transport";
+import type { IChannelData } from "./i_channel_data";
+import type { ISocketData } from "./i_socket_data";
 export interface OPCUAServerEndPointOptions {
     /**
      * the tcp port
@@ -42,7 +42,7 @@ export interface OPCUAServerEndPointOptions {
      */
     timeout?: number;
     serverInfo: ApplicationDescription;
-    objectFactory?: any;
+    objectFactory?: unknown;
     transportSettings?: IServerTransportSettings;
 }
 export interface IServerTransportSettings {
@@ -54,9 +54,66 @@ export interface EndpointDescriptionParams {
     resourcePath?: string;
     alternateHostname?: string[];
     hostname: string;
+    /**
+     * Override the port used in the endpoint URL.
+     * When set, the endpoint URL uses this port instead of the
+     * server's listen port. The server does NOT listen on this port.
+     * Useful for Docker port-mapping, reverse proxies, and NAT.
+     */
+    advertisedPort?: number;
     securityPolicies: SecurityPolicy[];
     userTokenTypes: UserTokenType[];
 }
+/**
+ * Per-URL security overrides for advertised endpoints.
+ *
+ * When `advertisedEndpoints` contains a config object, the endpoint
+ * descriptions generated for that URL use the overridden security
+ * settings instead of inheriting from the main endpoint.
+ *
+ * Any field that is omitted falls back to the main endpoint's value.
+ *
+ * @example
+ * ```ts
+ * advertisedEndpoints: [
+ *     // Public: SignAndEncrypt only, no anonymous
+ *     {
+ *         url: "opc.tcp://public.example.com:4840",
+ *         securityModes: [MessageSecurityMode.SignAndEncrypt],
+ *         allowAnonymous: false
+ *     },
+ *     // Internal: inherits everything from main endpoint
+ *     "opc.tcp://internal:48480"
+ * ]
+ * ```
+ */
+export interface AdvertisedEndpointConfig {
+    /** The full endpoint URL, e.g. `"opc.tcp://public.example.com:4840"` */
+    url: string;
+    /** Override security modes (default: inherit from main endpoint) */
+    securityModes?: MessageSecurityMode[];
+    /** Override security policies (default: inherit from main endpoint) */
+    securityPolicies?: SecurityPolicy[];
+    /** Override anonymous access (default: inherit from main endpoint) */
+    allowAnonymous?: boolean;
+    /** Override user token types (default: inherit from main endpoint) */
+    userTokenTypes?: UserTokenType[];
+}
+/**
+ * An advertised endpoint entry — either a plain URL string (inherits
+ * all settings from the main endpoint) or a config object with
+ * per-URL security overrides.
+ */
+export type AdvertisedEndpoint = string | AdvertisedEndpointConfig;
+/**
+ * Normalize any `advertisedEndpoints` input into a uniform
+ * `AdvertisedEndpointConfig[]`.
+ *
+ * This coercion is done early so that all downstream code
+ * (endpoint generation, IP/hostname extraction) only deals
+ * with one type.
+ */
+export declare function normalizeAdvertisedEndpoints(raw?: AdvertisedEndpoint | AdvertisedEndpoint[]): AdvertisedEndpointConfig[];
 export interface AddStandardEndpointDescriptionsParam {
     allowAnonymous?: boolean;
     disableDiscovery?: boolean;
@@ -68,7 +125,46 @@ export interface AddStandardEndpointDescriptionsParam {
     hostname?: string;
     securityPolicies?: SecurityPolicy[];
     userTokenTypes?: UserTokenType[];
+    /**
+     * Additional endpoint URL(s) to advertise.
+     *
+     * Use when the server is behind Docker port-mapping,
+     * a reverse proxy, or a NAT gateway.
+     *
+     * Each entry can be a plain URL string (inherits all security
+     * settings from the main endpoint) or an
+     * `AdvertisedEndpointConfig` object with per-URL overrides.
+     *
+     * The server still listens on `port` — these are purely
+     * advertised aliases.
+     *
+     * @example Simple string (inherits main settings)
+     * ```ts
+     * advertisedEndpoints: "opc.tcp://localhost:48481"
+     * ```
+     *
+     * @example Mixed array with per-URL security overrides
+     * ```ts
+     * advertisedEndpoints: [
+     *     "opc.tcp://internal:48480",
+     *     {
+     *         url: "opc.tcp://public.example.com:4840",
+     *         securityModes: [MessageSecurityMode.SignAndEncrypt],
+     *         allowAnonymous: false
+     *     }
+     * ]
+     * ```
+     */
+    advertisedEndpoints?: AdvertisedEndpoint | AdvertisedEndpoint[];
 }
+/**
+ * Parse an `opc.tcp://hostname:port` URL and extract hostname and port.
+ * @internal
+ */
+export declare function parseOpcTcpUrl(url: string): {
+    hostname: string;
+    port: number;
+};
 /**
  * OPCUAServerEndPoint a Server EndPoint.
  * A sever end point is listening to one port
@@ -90,11 +186,11 @@ export declare class OPCUAServerEndPoint extends EventEmitter implements ServerS
     transactionsCountOldChannels: number;
     securityTokenCountOldChannels: number;
     serverInfo: ApplicationDescription;
-    objectFactory: any;
+    objectFactory: unknown;
     _on_new_channel?: (channel: ServerSecureChannelLayer) => void;
     _on_close_channel?: (channel: ServerSecureChannelLayer) => void;
-    _on_connectionRefused?: (socketData: any) => void;
-    _on_openSecureChannelFailure?: (socketData: any, channelData: any) => void;
+    _on_connectionRefused?: (socketData: ISocketData) => void;
+    _on_openSecureChannelFailure?: (socketData: ISocketData, channelData: IChannelData) => void;
     private _certificateChain;
     private _privateKey;
     private _channels;

package/dist/server_end_point.js

@@ -1,31 +1,30 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPCUAServerEndPoint = void 0;
 /* eslint-disable max-statements */
 /**
  * @module node-opcua-server
  */
 // tslint:disable:no-console
-const events_1 = require("events");
-const net_1 = __importDefault(require("net"));
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPCUAServerEndPoint = void 0;
+exports.normalizeAdvertisedEndpoints = normalizeAdvertisedEndpoints;
+exports.parseOpcTcpUrl = parseOpcTcpUrl;
+const node_events_1 = require("node:events");
+const node_net_1 = __importDefault(require("node:net"));
 const chalk_1 = __importDefault(require("chalk"));
-const async_1 = __importDefault(require("async"));
 const node_opcua_assert_1 = require("node-opcua-assert");
 const web_1 = require("node-opcua-crypto/web");
 const node_opcua_debug_1 = require("node-opcua-debug");
 const node_opcua_hostname_1 = require("node-opcua-hostname");
 const node_opcua_secure_channel_1 = require("node-opcua-secure-channel");
 const node_opcua_service_endpoints_1 = require("node-opcua-service-endpoints");
-const node_opcua_service_endpoints_2 = require("node-opcua-service-endpoints");
-const node_opcua_service_endpoints_3 = require("node-opcua-service-endpoints");
 const debugLog = (0, node_opcua_debug_1.make_debugLog)(__filename);
 const errorLog = (0, node_opcua_debug_1.make_errorLog)(__filename);
 const warningLog = (0, node_opcua_debug_1.make_warningLog)(__filename);
 const doDebug = (0, node_opcua_debug_1.checkDebugFlag)(__filename);
-const default_transportProfileUri = "http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary";
+const UATCP_UASC_UABINARY = "http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary";
 function extractSocketData(socket, reason) {
     const { bytesRead, bytesWritten, remoteAddress, remoteFamily, remotePort, localAddress, localPort } = socket;
     const data = {
@@ -68,6 +67,7 @@ function dumpChannelInfo(channels) {
         console.log("        bytesRead     = ", channel.bytesRead);
         console.log("        sessions      = ", Object.keys(channel.sessionTokens).length);
         console.log(Object.values(channel.sessionTokens).map(d).join("\n"));
+        // biome-ignore lint/suspicious/noExplicitAny: accessing internal transport for debug dump
         const socket = channel.transport?._socket;
         if (!socket) {
             console.log(" SOCKET IS CLOSED");
@@ -79,15 +79,43 @@ function dumpChannelInfo(channels) {
     console.log("------------------------------------------------------");
 }
 const emptyCertificate = Buffer.alloc(0);
+// biome-ignore lint/suspicious/noExplicitAny: deliberate null→PrivateKey sentinel
 const emptyPrivateKey = null;
 let OPCUAServerEndPointCounter = 0;
+/**
+ * Normalize any `advertisedEndpoints` input into a uniform
+ * `AdvertisedEndpointConfig[]`.
+ *
+ * This coercion is done early so that all downstream code
+ * (endpoint generation, IP/hostname extraction) only deals
+ * with one type.
+ */
+function normalizeAdvertisedEndpoints(raw) {
+    if (!raw)
+        return [];
+    const arr = Array.isArray(raw) ? raw : [raw];
+    return arr.map((entry) => (typeof entry === "string" ? { url: entry } : entry));
+}
+/**
+ * Parse an `opc.tcp://hostname:port` URL and extract hostname and port.
+ * @internal
+ */
+function parseOpcTcpUrl(url) {
+    // URL class doesn't understand opc.tcp://, so swap to http://
+    const httpUrl = url.replace(/^opc\.tcp:\/\//i, "http://");
+    const parsed = new URL(httpUrl);
+    return {
+        hostname: parsed.hostname,
+        port: parsed.port ? Number.parseInt(parsed.port, 10) : 4840
+    };
+}
 function getUniqueName(name, collection) {
     if (collection[name]) {
         let counter = 0;
-        while (collection[name + "_" + counter.toString()]) {
+        while (collection[`${name}_${counter.toString()}`]) {
             counter++;
         }
-        name = name + "_" + counter.toString();
+        name = `${name}_${counter.toString()}`;
         collection[name] = 1;
         return name;
     }
@@ -102,7 +130,7 @@ function getUniqueName(name, collection) {
  * note:
  *   see OPCUA Release 1.03 part 4 page 108 7.1 ApplicationDescription
  */
-class OPCUAServerEndPoint extends events_1.EventEmitter {
+class OPCUAServerEndPoint extends node_events_1.EventEmitter {
     /**
      * the tcp port
      */
@@ -165,7 +193,7 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         this._privateKey = emptyPrivateKey;
         (0, node_opcua_assert_1.assert)(Object.keys(this._channels).length === 0, "OPCUAServerEndPoint channels must have been deleted");
         this._channels = {};
-        this.serverInfo = new node_opcua_service_endpoints_3.ApplicationDescription({});
+        this.serverInfo = new node_opcua_service_endpoints_1.ApplicationDescription({});
         this._endpoints = [];
         (0, node_opcua_assert_1.assert)(this._endpoints.length === 0, "endpoints must have been deleted");
         this._endpoints = [];
@@ -225,11 +253,11 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         return arr.length === 0 ? null : arr[0];
     }
     addEndpointDescription(securityMode, securityPolicy, options) {
-        // istanbul ignore next
+        // c8 ignore next
         if (securityMode === node_opcua_secure_channel_1.MessageSecurityMode.None && securityPolicy !== node_opcua_secure_channel_1.SecurityPolicy.None) {
             throw new Error(" invalid security ");
         }
-        // istanbul ignore next
+        // c8 ignore next
         if (securityMode !== node_opcua_secure_channel_1.MessageSecurityMode.None && securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.None) {
             throw new Error(" invalid security ");
         }
@@ -238,9 +266,10 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         const resourcePath = (options.resourcePath || "").replace(/\\/g, "/");
         (0, node_opcua_assert_1.assert)(resourcePath.length === 0 || resourcePath.charAt(0) === "/", "resourcePath should start with /");
         const hostname = options.hostname || (0, node_opcua_hostname_1.getFullyQualifiedDomainName)();
-        const endpointUrl = `opc.tcp://${hostname}:${this.port}${resourcePath}`;
+        const effectivePort = options.advertisedPort ?? this.port;
+        const endpointUrl = `opc.tcp://${hostname}:${effectivePort}${resourcePath}`;
         const endpoint_desc = this.getEndpointDescription(securityMode, securityPolicy, endpointUrl);
-        // istanbul ignore next
+        // c8 ignore next
         if (endpoint_desc) {
             throw new Error(" endpoint already exist");
         }
@@ -257,13 +286,14 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
             resourcePath: options.resourcePath,
             restricted: !!options.restricted,
             securityPolicies: options.securityPolicies || [],
+            advertisedPort: options.advertisedPort,
             userTokenTypes
         }, this));
     }
     addRestrictedEndpointDescription(options) {
         options = { ...options };
         options.restricted = true;
-        return this.addEndpointDescription(node_opcua_secure_channel_1.MessageSecurityMode.None, node_opcua_secure_channel_1.SecurityPolicy.None, options);
+        this.addEndpointDescription(node_opcua_secure_channel_1.MessageSecurityMode.None, node_opcua_secure_channel_1.SecurityPolicy.None, options);
     }
     addStandardEndpointDescriptions(options) {
         options = options || {};
@@ -312,6 +342,59 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
                 }
             }
         }
+        // ── Advertised endpoints (virtual — no TCP listener) ──────
+        // Normalize to AdvertisedEndpointConfig[] so downstream code
+        // only deals with one type.
+        const advertisedList = normalizeAdvertisedEndpoints(options.advertisedEndpoints);
+        // Main endpoint defaults (guaranteed non-null — assigned above)
+        const mainSecurityModes = options.securityModes || defaultSecurityModes;
+        const mainSecurityPolicies = options.securityPolicies || defaultSecurityPolicies;
+        const mainUserTokenTypes = options.userTokenTypes || defaultUserTokenTypes;
+        for (const config of advertisedList) {
+            const { hostname: advHostname, port: advPort } = parseOpcTcpUrl(config.url);
+            // Skip if this hostname+port combo was already covered
+            // by the regular hostname loop (same hostname, same port)
+            if (hostnames.some((h) => h.toLowerCase() === advHostname.toLowerCase()) && advPort === this.port) {
+                continue;
+            }
+            // Per-URL security overrides — fall back to main settings
+            const entrySecurityModes = config.securityModes ?? mainSecurityModes;
+            const entrySecurityPolicies = config.securityPolicies ?? mainSecurityPolicies;
+            let entryUserTokenTypes = config.userTokenTypes ?? mainUserTokenTypes;
+            // Handle allowAnonymous override: if explicitly false,
+            // filter out Anonymous even if the main config allows it
+            if (config.allowAnonymous === false) {
+                entryUserTokenTypes = entryUserTokenTypes.filter((t) => t !== node_opcua_service_endpoints_1.UserTokenType.Anonymous);
+            }
+            const optionsE = {
+                hostname: advHostname,
+                advertisedPort: advPort,
+                securityPolicies: entrySecurityPolicies,
+                userTokenTypes: entryUserTokenTypes,
+                allowUnsecurePassword: options.allowUnsecurePassword,
+                alternateHostname: options.alternateHostname,
+                resourcePath: options.resourcePath
+            };
+            if (entrySecurityModes.indexOf(node_opcua_secure_channel_1.MessageSecurityMode.None) >= 0) {
+                this.addEndpointDescription(node_opcua_secure_channel_1.MessageSecurityMode.None, node_opcua_secure_channel_1.SecurityPolicy.None, optionsE);
+            }
+            else {
+                if (!options.disableDiscovery) {
+                    this.addRestrictedEndpointDescription(optionsE);
+                }
+            }
+            for (const securityMode of entrySecurityModes) {
+                if (securityMode === node_opcua_secure_channel_1.MessageSecurityMode.None) {
+                    continue;
+                }
+                for (const securityPolicy of entrySecurityPolicies) {
+                    if (securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.None) {
+                        continue;
+                    }
+                    this.addEndpointDescription(securityMode, securityPolicy, optionsE);
+                }
+            }
+        }
     }
     /**
      * returns the list of end point descriptions.
@@ -324,9 +407,13 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
     listen(callback) {
         (0, node_opcua_assert_1.assert)(typeof callback === "function");
         (0, node_opcua_assert_1.assert)(!this._started, "OPCUAServerEndPoint is already listening");
+        if (!this._server) {
+            callback(new Error("Server is not initialized"));
+            return;
+        }
         this._listen_callback = callback;
         this._server.on("error", (err) => {
-            debugLog(chalk_1.default.red.bold(" error") + " port = " + this.port, err);
+            debugLog(`${chalk_1.default.red.bold(" error")} port = ${this.port}`, err);
             this._started = false;
             this._end_listen(err);
         });
@@ -344,8 +431,8 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
             (0, node_opcua_assert_1.assert)(!err, " cannot listen to port ");
             this._started = true;
             if (!this.port) {
-                const add = this._server.address();
-                this.port = typeof add !== "string" ? add.port : this.port;
+                const add = this._server?.address();
+                this.port = typeof add !== "string" ? add?.port || 0 : this.port;
             }
             this._end_listen();
         });
@@ -353,7 +440,7 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
     killClientSockets(callback) {
         for (const channel of this.getChannels()) {
             const hacked_channel = channel;
-            if (hacked_channel.transport && hacked_channel.transport._socket) {
+            if (hacked_channel.transport?._socket) {
                 // hacked_channel.transport._socket.close();
                 hacked_channel.transport._socket.destroy();
                 hacked_channel.transport._socket.emit("error", new Error("EPIPE"));
@@ -362,8 +449,9 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         callback();
     }
     suspendConnection(callback) {
-        if (!this._started) {
-            return callback(new Error("Connection already suspended !!"));
+        if (!this._started || !this._server) {
+            callback(new Error("Connection already suspended !!"));
+            return;
         }
         // Stops the server from accepting new connections and keeps existing connections.
         // (note from nodejs doc: This function is asynchronous, the server is finally closed
@@ -373,7 +461,7 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         // if the server was not open when it was closed.
         this._server.close(() => {
             this._started = false;
-            debugLog("Connection has been closed !" + this.port);
+            debugLog(`Connection has been closed !${this.port}`);
         });
         this._started = false;
         callback();
@@ -395,15 +483,27 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
             this.suspendConnection(() => {
                 // shutdown all opened channels ...
                 const _channels = Object.values(this._channels);
-                async_1.default.each(_channels, (channel, callback1) => {
-                    this.shutdown_channel(channel, callback1);
-                }, (err) => {
-                    /* istanbul ignore next */
+                const promises = _channels.map((channel) => new Promise((resolve, reject) => {
+                    this.shutdown_channel(channel, (err) => {
+                        if (err) {
+                            reject(err);
+                        }
+                        else {
+                            resolve();
+                        }
+                    });
+                }));
+                Promise.all(promises)
+                    .then(() => {
+                    /* c8 ignore next */
                     if (!(Object.keys(this._channels).length === 0)) {
                         errorLog(" Bad !");
                     }
                     (0, node_opcua_assert_1.assert)(Object.keys(this._channels).length === 0, "channel must have unregistered themselves");
-                    callback(err || undefined);
+                    callback();
+                })
+                    .catch((err) => {
+                    callback(err);
                 });
             });
         }
@@ -449,23 +549,23 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         return Object.keys(this._channels).length;
     }
     _dump_statistics() {
-        this._server.getConnections((err, count) => {
+        this._server?.getConnections((_err, count) => {
             debugLog(chalk_1.default.cyan("CONCURRENT CONNECTION = "), count);
         });
-        debugLog(chalk_1.default.cyan("MAX CONNECTIONS = "), this._server.maxConnections);
+        debugLog(chalk_1.default.cyan("MAX CONNECTIONS = "), this._server?.maxConnections);
     }
     _setup_server() {
         (0, node_opcua_assert_1.assert)(!this._server);
-        this._server = net_1.default.createServer({ pauseOnConnect: true }, this._on_client_connection.bind(this));
+        this._server = node_net_1.default.createServer({ pauseOnConnect: true }, this._on_client_connection.bind(this));
         // xx console.log(" Server with max connections ", self.maxConnections);
         this._server.maxConnections = this.maxConnections + 1; // plus one extra
         this._listen_callback = undefined;
         this._server
             .on("connection", (socket) => {
-            // istanbul ignore next
+            // c8 ignore next
             if (doDebug) {
                 this._dump_statistics();
-                debugLog("server connected  with : " + socket.remoteAddress + ":" + socket.remotePort);
+                debugLog(`server connected  with : ${socket.remoteAddress}:${socket.remotePort}`);
             }
         })
             .on("close", () => {
@@ -489,7 +589,7 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         const deny_connection = () => {
             console.log(chalk_1.default.bgWhite.cyan("OPCUAServerEndPoint#_on_client_connection " +
                 "The maximum number of connection has been reached - Connection is refused"));
-            const reason = "maxConnections reached (" + this.maxConnections + ")";
+            const reason = `maxConnections reached (${this.maxConnections})`;
             const socketData = extractSocketData(socket, reason);
             this.emit("connectionRefused", socketData);
             socket.end();
@@ -498,7 +598,7 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         const establish_connection = () => {
             const nbConnections = Object.keys(this._channels).length;
             if (nbConnections >= this.maxConnections) {
-                warningLog(" nbConnections ", nbConnections, " self._server.maxConnections", this._server.maxConnections, this.maxConnections);
+                warningLog(" nbConnections ", nbConnections, " self._server.maxConnections", this._server?.maxConnections, this.maxConnections);
                 deny_connection();
                 return;
             }
@@ -517,7 +617,7 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
                 this._un_pre_registerChannel(channel);
                 debugLog(chalk_1.default.yellow.bold("Channel#init done"), err);
                 if (err) {
-                    const reason = "openSecureChannel has Failed " + err.message;
+                    const reason = `openSecureChannel has Failed ${err.message}`;
                     const socketData = extractSocketData(socket, reason);
                     const channelData = extractChannelData(channel);
                     this.emit("openSecureChannelFailure", socketData, channelData);
@@ -611,7 +711,7 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
         this.bytesReadInOldChannels += channel.bytesRead;
         this.transactionsCountOldChannels += channel.transactionsCount;
         delete this._channels[channel.hashKey];
-        // istanbul ignore next
+        // c8 ignore next
         if (doDebug) {
             this._dump_statistics();
             debugLog("un-registering channel  - Count = ", this.currentChannelCount);
@@ -621,7 +721,6 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
     _end_listen(err) {
         if (!this._listen_callback)
             return;
-        (0, node_opcua_assert_1.assert)(typeof this._listen_callback === "function");
         this._listen_callback(err);
         this._listen_callback = undefined;
     }
@@ -646,18 +745,19 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
     _prevent_DDOS_Attack(establish_connection, deny_connection) {
         const nbConnections = this.activeChannelCount;
         if (nbConnections >= this.maxConnections) {
-            // istanbul ignore next
-            errorLog(chalk_1.default.bgRed.white("PREVENTING DDOS ATTACK => maxConnection =" + this.maxConnections));
+            // c8 ignore next
+            errorLog(chalk_1.default.bgRed.white(`PREVENTING DDOS ATTACK => maxConnection =${this.maxConnections}`));
             const unused_channels = this.getChannels().filter((channel1) => {
                 return !channel1.hasSession;
             });
             if (unused_channels.length === 0) {
-                doDebug && console.log(this.getChannels()
-                    .map(({ status, isOpened, hasSession }) => `${status} ${isOpened} ${hasSession}\n`)
-                    .join(" "));
+                doDebug &&
+                    console.log(this.getChannels()
+                        .map(({ status, isOpened, hasSession }) => `${status} ${isOpened} ${hasSession}\n`)
+                        .join(" "));
                 // all channels are in used , we cannot get any
                 errorLog(`All channels are in used ! we cannot cancel any ${this.getChannels().length}`);
-                // istanbul ignore next
+                // c8 ignore next
                 if (doDebug) {
                     console.log("  - all channels are used !!!!");
                     false && dumpChannelInfo(this.getChannels());
@@ -665,14 +765,14 @@ class OPCUAServerEndPoint extends events_1.EventEmitter {
                 setTimeout(deny_connection, 1000);
                 return;
             }
-            // istanbul ignore next
+            // c8 ignore next
             if (doDebug) {
                 console.log("   - Unused channels that can be clobbered", unused_channels.map((channel1) => channel1.hashKey).join(" "));
             }
             const channel = unused_channels[0];
             errorLog(`${unused_channels.length} : Forcefully closing oldest channel that have no session: ${channel.hashKey}`);
             channel.close(() => {
-                // istanbul ignore next
+                // c8 ignore next
                 if (doDebug) {
                     console.log("   _ Unused channel has been closed ", channel.hashKey);
                 }
@@ -712,7 +812,6 @@ function estimateSecurityLevel(securityMode, securityPolicy) {
         case node_opcua_secure_channel_1.SecurityPolicy.Aes256_Sha256_RsaPss:
             return 7 + offset;
         default:
-        case node_opcua_secure_channel_1.SecurityPolicy.None:
             return 1;
     }
 }
@@ -732,7 +831,7 @@ function _makeEndpointDescription(options, parent) {
         options.securityLevel === undefined
             ? estimateSecurityLevel(options.securityMode, options.securityPolicy)
             : options.securityLevel;
-    (0, node_opcua_assert_1.assert)(isFinite(options.securityLevel), "expecting a valid securityLevel");
+    (0, node_opcua_assert_1.assert)(Number.isFinite(options.securityLevel), "expecting a valid securityLevel");
     const securityPolicyUri = (0, node_opcua_secure_channel_1.toURI)(options.securityPolicy);
     const userIdentityTokens = [];
     const registerIdentity2 = (tokenType, securityPolicy, name) => {
@@ -784,7 +883,7 @@ function _makeEndpointDescription(options, parent) {
             //  when channel session security is not "None",
             //  userIdentityTokens can be left to null.
             //  in this case this mean that secure policy will be the same as connection security policy
-            // istanbul ignore next
+            // c8 ignore next
             if (process.env.NODEOPCUA_SERVER_EMULATE_SIEMENS) {
                 // However, for some reason SIEMENS plc requires that password get encrypted even though
                 // the secure channel is also encrypted ....
@@ -829,7 +928,7 @@ function _makeEndpointDescription(options, parent) {
         });
     }
     // return the endpoint object
-    const endpoint = new node_opcua_service_endpoints_2.EndpointDescription({
+    const endpoint = new node_opcua_service_endpoints_1.EndpointDescription({
         endpointUrl: "<to be evaluated at run time>", // options.endpointUrl,
         server: undefined, // options.server,
         serverCertificate: options.serverCertificateChain,
@@ -837,13 +936,14 @@ function _makeEndpointDescription(options, parent) {
         securityPolicyUri,
         userIdentityTokens,
         securityLevel: options.securityLevel,
-        transportProfileUri: default_transportProfileUri
+        transportProfileUri: UATCP_UASC_UABINARY
     });
     endpoint._parent = parent;
     // endpointUrl is dynamic as port number may be adjusted
     // when the tcp socket start listening
+    // biome-ignore lint/suspicious/noExplicitAny: __defineGetter__ not in standard typings
     endpoint.__defineGetter__("endpointUrl", () => {
-        const port = endpoint._parent.port;
+        const port = options.advertisedPort ?? endpoint._parent.port;
         const resourcePath = options.resourcePath || "";
         const hostname = options.hostname;
         const endpointUrl = `opc.tcp://${hostname}:${port}${resourcePath}`;
@@ -862,7 +962,7 @@ function _makeEndpointDescription(options, parent) {
  *
  */
 function matching_endpoint(securityMode, securityPolicy, endpointUrl, endpoint) {
-    (0, node_opcua_assert_1.assert)(endpoint instanceof node_opcua_service_endpoints_2.EndpointDescription);
+    (0, node_opcua_assert_1.assert)(endpoint instanceof node_opcua_service_endpoints_1.EndpointDescription);
     const endpoint_securityPolicy = (0, node_opcua_secure_channel_1.fromURI)(endpoint.securityPolicyUri);
     if (endpointUrl && endpoint.endpointUrl !== endpointUrl) {
         return false;