UA-.NETStandard

mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-18 14:43:08 +08:00

Author	SHA1	Message	Date
Wolfgang Colsman	2de64d7d93	Source generator: keep NodeSet2 references to nodes of referenced models (#4796 ) # Description A reference in a NodeSet2 input whose target is a node of another model was dropped without a diagnostic when that model is supplied by a referenced assembly rather than by an AdditionalFiles input. The dependency metadata of a referenced assembly carries types only, so the importer could not resolve an instance such as DI's DeviceSet and skipped every reference to it: a device organized by DeviceSet (inverse Organizes) lost that reference, and so did any non-hierarchical reference to such a node. When the target of a reference is in another, non-zero namespace and no loaded design defines it, the importer now creates a stand-in that carries only the NodeId the generated AddReference call needs. The stand-in is not generated. References whose reference type is unknown are still skipped. Tests generate a DI-style NodeSet2 whose device is organized by DeviceSet against DI supplied as a referenced assembly and as an AdditionalFile, and compile the result against the stack. ## Related Issues None. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [x] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-10-16 20:09:14 +02:00
Wolfgang Colsman	716858aa7d	Source generator: option to emit exactly the nodes of a NodeSet2 (#4797 ) # Description For a NodeSet2 input the generator built the predefined nodes from the merged instance hierarchy. A subtype therefore got a copy of every Mandatory InstanceDeclaration of its supertypes as a new child node, with a NodeId the NodeSet2 never assigned (the supertype's numeric identifier in the subtype's namespace, or a string identifier derived from the path when the supertype comes from a referenced assembly). A DeviceType subtype got eight such children from DI's DeviceType, so the address space a server loads from the generated code differs from the NodeSet2 it was generated from. ModelSourceGeneratorEmitNodeSetNodesOnly (GeneratorOptions .EmitNodeSetNodesOnly), off by default, makes the predefined nodes of a NodeSet2 input exactly the nodes the NodeSet2 declares: a child the generator derives from a supertype or type definition is not added to a predefined node. The typed state classes are unchanged and still reach inherited members through the state classes of their supertypes, and the CreateInstanceOf* factories still create every Mandatory child of the type. ModelDesign inputs are not affected. IModelDesign.IsSourceNodeSet tells the generator whether the target model was read from a NodeSet2. A test in Opc.Ua.Di.Tests generates a DI-style NodeSet2 with the option on, exports the generated predefined nodes as a NodeSet2 and compares it with the input, node for node and reference for reference. ## Related Issues None. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [x] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-10-16 12:38:19 +02:00
Marc Schier	0374e19121	Add MachineTool, WMTP, GMS and CranesHoists companions (#4765 ) # Description _Describe the changes here to communicate to the maintainers why they should accept this pull request. By default - this will become the Commit message after merging and thus define history._ Add provider-backed MachineTool, bundled WMTP, GMS and CranesHoists companions using the existing Machinery/MachineVision fluent, DI and typed-client approach. The PR is open/non-draft by user choice. Current head `ecc4a7d6ca3e8004cf28ab54da605da302d026bf` is mergeable and has 108 successful checks, six intentionally skipped checks, zero failures and zero pending checks. All five primary workflows completed successfully at that exact head. \| Family \| Released specification/model \| Packaging \| \| --- \| --- \| --- \| \| MachineTool \| OPC 40501-1, 1.02.0 \| Model, Server, Client and MCP; normal root versions \| \| WMTP \| OPC 40505, 1.0.0 \| Bundled in MachineTool; distinct CLR/wire namespace and independent WMTP-only hosting \| \| GMS \| OPC 40210 reference 1.0.1, normative model 1.0.0 \| Model, Server, Client and MCP; normal root versions \| \| CranesHoists \| OPC 40020-1, 1.00 \| Model, Server, Client and MCP; all four plus Debug variants forced preview \| There are 12 new packable projects. No separate WMTP package/profile/guide, root version bump, tag, release or package publication is included. Mandatory instance structure is the default; selected optional features require explicit providers. The implementation reuses Machinery results/jobs/files/ProcessValues and Robotics topology, including retained MachineTool Production, defined GMS jobs/parts, modern ISA95/Machinery jobs, shared-owner hosting and isolated instances alongside MachineVision. Runtime and integration fixes preserve raw quality/timestamps, coherent acquisition, namespace ownership, accepted-configuration state, borrowed-resource lifetime, session/node/file cleanup, terminal-value publication, event propagation and endpoint-aware capability publication. Firmware/licence transfer means provider acceptance, not installation/activation. Cancellation does not silently abort another caller's operation. The later upstream MCP expansion is integrated without losing either family set or its default-off privileged/live execution policy. ### Conformance and scope Canonical model inputs are pinned to UA-Nodeset revision `96a08945425d0295edb3607d2a38f6841ef44046`. GMS upstream exception: [Annex A.1](https://reference.opcfoundation.org/specs/OPC-40210/annex-a) makes the released NodeSet normative, but §12.3.2.7 requires undefined `GMS_ProductionStatisticsType`. Inherited statistics and defined jobs/parts are implemented without inventing a standard type/NodeId; the complete GMS Production facet is withheld. The requirement ledger records 102 positively evidenced CU rows, 96 directly negative-tested rows and six explicit negative-evidence limitations. All 648 test-class/name/TRX links were independently resolved to passing cases. The six limitations concern Stacklight, retained legacy PowerOnDuration, Machinery PowerOnDuration, WorkingUnit, Obligation and MaintenanceMode. They are not claims that every invalid-input or hardware-control behavior was tested. The undefined GMS requirement is outside the 102 defined CUs. No external certification claim is made. Retained baseline complete-assembly line coverage, with generated code retained and no source exclusions: \| Family \| Model \| Server \| Client \| \| --- \| ---: \| ---: \| ---: \| \| MachineTool/WMTP \| 83.80% \| 91.98% \| 84.74% \| \| GMS \| 95.51% \| 90.63% \| 88.38% \| \| CranesHoists \| 92.76% \| 94.45% \| 92.24% \| These nine measurements predate the later focused review fixes and merges; they are not relabelled as new `ecc4a7d6c` percentages. The current head's separate CI code-coverage check succeeded. No new exclusions or threshold relaxations were introduced. ## Related Issues - Fixes [#4764](https://github.com/OPCFoundation/UA-.NETStandard/issues/4764), the implementation/design and acceptance tracker. ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received.	2026-10-15 15:15:46 +02:00
Marc Schier	d764161a53	Extract core/types fixes for schemas, replay, and source generation (#4801 ) # Description Extract the reusable core/types layer from #4462 without including UaLens or the other planned extraction layers. - Preserve null versus empty in `ByteString.Copy`, and provide older-framework path, random-byte, and SHA-256 convenience APIs. - Encode abstract numeric structure fields (`Number`, `Integer`, and `UInteger`) as Variants in JSON, XSD, and BSD schemas, with regression coverage and schema documentation. - Add opt-in complete-file validation for finalized PCAP replay while retaining the existing tolerant reader default. - Keep placeholder references on generated type templates, not runtime instances, while preserving ordinary external references. Initial extraction: commit `8881e096fb5e4eaa36f3c13f8caa57733373bd19` preserves the assigned changes from source `390c4a7a51b71da40caec2d22ef74518bbe670ce`, based on pinned `master` commit `5b03e9afa492cdb36049ee52ae844f630f89d8db`: 20 exact full-file extractions and only the generic replay paragraph in `docs/Diagnostics.md`. The UaLens capture-window paragraph remains with the source PR. No UaLens projects, UI, native-rendering paths, dependencies, or workflows are included. Review follow-up: `814c0f2dc6056ea5eb898611565b3e96cfa65104` fixes direct-placeholder references that bypassed filtering through `TargetPath` and emitted an undefined `forInstance` guard in instance-only factories. Filtering now follows target resolution. Compilation/reference-shape regressions cover ObjectType/VariableType, both placeholder rules, and direct-child/external targets; `docs/NodeManagers.md` documents the behavior. The review thread was resolved after publication and verification. CI follow-up: `93ec3928bd5a9cb2ea86110085e79131db17d443` addresses both causes found in [CI run 38700770996](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/38700770996): - `MODELGEN012` treated an identical payload-less transitive dependency declaration as a competing model producer after the SDK Programs model appeared in newer `master`. Matching closure rows no longer emit that diagnostic. Producer ordering is unchanged; actual producers, differing declarations, and malformed payload handling retain their existing diagnostics. New regression cases exercise both reference orders, and `docs/ModelDependencies.md` records the distinction. - The queue-fairness test sampled OS scheduling and failed on macOS. This reuses the exact one-file correction from `84d2c34d3902bfe700a87f6c30708b435500878f` in #4765: hold the existing heavy-owner publication hook, prove concurrent work-conserving progress, then assert exact recovered 1:3 service, all 960 unique requests, and complete queue/token/owner/lease cleanup. No production scheduler or fairness bound was changed. The PR now changes 26 paths. Its pinned extraction ancestry is preserved: no rebase, force push, or merge of newer `master` was performed. This remains the bottom of native stack 4807, ordered 4801 -> 4802 -> 4803 -> 4804 -> 4806. ### Current CI-repair validation Windows, existing .NET SDK 10.0.401, Release, with analyzers enabled. CI tested merge `9a2d252793da12aeb99ed379dfc9b03e89c912b7` (master `d40843c23a5fe8116ffe380cf937d88759f5218b` plus PR head `814c0f2dc6056ea5eb898611565b3e96cfa65104`), which includes newer tests absent from the pinned extraction branch. That exact merge was reproduced in a disposable detached worktree, then the proposed patch was applied. Git patch-id verified that the tested patch and committed branch patch were identical (`b7ed3ba2b61d1862825dd33d93c50c64d3a759ea`). Before the fix, all four failing client-accessor cases reproduced `MODELGEN012`, and both new matching-reexport cases failed. After the fix: \| Context / scope \| Framework \| Passed \| Failed \| Skipped \| \| --- \| --- \| ---: \| ---: \| ---: \| \| Exact CI merge + patch: client-accessor and dependency fixtures \| net10.0 \| 32 \| 0 \| 0 \| \| Same fixtures with CI coverage instrumentation \| net10.0 \| 32 \| 0 \| 0 \| \| Exact CI merge + patch: entire SourceGeneration.Tests project \| net10.0 \| 295 \| 0 \| 0 \| \| Exact CI merge + patch: entire SourceGeneration.Tests project \| net48 \| 295 \| 0 \| 0 \| \| Preserved PR branch: dependency and placeholder fixtures \| net10.0 \| 30 \| 0 \| 0 \| \| Preserved PR branch: dependency and placeholder fixtures \| net48 \| 30 \| 0 \| 0 \| \| Preserved PR branch: entire FairRequestQueueTests fixture, with coverage \| net10.0 \| 93 \| 0 \| 0 \| \| Preserved PR branch: entire FairRequestQueueTests fixture \| net48 \| 93 \| 0 \| 0 \| \| Exact CI merge + patch: entire FairRequestQueueTests fixture, with coverage \| net10.0 \| 93 \| 0 \| 0 \| All nine commands exited 0. The repository TRX verdict helpers verified 993 passing test executions, 0 failures, and 0 fixture setup/teardown failures across these overlapping runs. No build/analyzer warnings were reported. Normal restore resolved missing assets/target entries in the new checkout and when switching TFMs; no dependency declaration or SDK pin was changed. Exact successful test argument sets follow. Variables abbreviate the executable, project paths, and results directory only; output was also captured to separate local logs. ```powershell $env:DOTNET_ROOT = 'D:\git\UA-.NETStandard_master\TestResults\ualens-528-deep-repro\sdk' $env:PATH = "$env:DOTNET_ROOT;$env:PATH" $dotnet = "$env:DOTNET_ROOT\dotnet.exe" $generator = 'tests\Opc.Ua.SourceGeneration.Tests\Opc.Ua.SourceGeneration.Tests.csproj' $coreTests = 'tests\Opc.Ua.Core.Tests\Opc.Ua.Core.Tests.csproj' $results = 'C:\Users\mschier\.copilot\session-state\8f497e89-7fc2-4f48-880b-4803d97c1c12\files\ci-validation' # In the disposable exact-CI-merge checkout, with the identical proposed patch applied: Set-Location 'D:\Temp\ua-ci4801-8f497e89' # Passed: 32, Failed: 0, Skipped: 0 & $dotnet test $generator --no-restore --configuration Release --framework net10.0 -p:CustomTestTarget=net10.0 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true --filter 'FullyQualifiedName~ClientAccessorGeneratorTests\|FullyQualifiedName~ModelDependencyScannerTests' --logger 'trx;LogFileName=ci-metadata-green-net10.trx' --results-directory $results --verbosity minimal # Passed: 295, Failed: 0, Skipped: 0; reuses the analyzer-enabled build above & $dotnet test $generator --no-build --no-restore --configuration Release --framework net10.0 -p:CustomTestTarget=net10.0 --logger 'trx;LogFileName=ci-sourcegeneration-merge-net10.trx' --results-directory $results --verbosity quiet # Passed: 295, Failed: 0, Skipped: 0 & $dotnet test $generator --configuration Release --framework net48 -p:CustomTestTarget=net48 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true --logger 'trx;LogFileName=ci-sourcegeneration-merge-net48.trx' --results-directory $results --verbosity minimal # Passed: 93, Failed: 0, Skipped: 0 & $dotnet test $coreTests --configuration Release --framework net10.0 -p:CustomTestTarget=net10.0 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true -p:CollectCoverage=true --collect 'XPlat Code Coverage' --settings 'tests\coverlet.runsettings.xml' --filter 'FullyQualifiedName~FairRequestQueueTests' --logger 'trx;LogFileName=ci-fairqueue-merge-net10.trx' --results-directory $results --verbosity minimal # Passed: 32, Failed: 0, Skipped: 0 & $dotnet test $generator --configuration Release --framework net10.0 -p:CustomTestTarget=net10.0 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true -p:CollectCoverage=true --collect 'XPlat Code Coverage' --settings 'tests\coverlet.runsettings.xml' --filter 'FullyQualifiedName~ClientAccessorGeneratorTests\|FullyQualifiedName~ModelDependencyScannerTests' --logger 'trx;LogFileName=ci-metadata-coverage-net10.trx' --results-directory $results --verbosity minimal # In the preserved PR branch worktree: Set-Location 'D:\git\copilot-worktrees\UA-wot-d3-final\marcschier-congenial-umbrella' # Passed: 30, Failed: 0, Skipped: 0 & $dotnet test $generator --configuration Release --framework net10.0 -p:CustomTestTarget=net10.0 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true --filter 'FullyQualifiedName~ModelDependencyScannerTests\|FullyQualifiedName~PlaceholderReferenceGeneratorTests' --logger 'trx;LogFileName=ci-sourcegeneration-branch-net10.trx' --results-directory $results --verbosity minimal # Passed: 93, Failed: 0, Skipped: 0 & $dotnet test $coreTests --no-restore --configuration Release --framework net10.0 -p:CustomTestTarget=net10.0 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true -p:CollectCoverage=true --collect 'XPlat Code Coverage' --settings 'tests\coverlet.runsettings.xml' --filter 'FullyQualifiedName~FairRequestQueueTests' --logger 'trx;LogFileName=ci-fairqueue-branch-net10.trx' --results-directory $results --verbosity minimal # Passed: 93, Failed: 0, Skipped: 0 & $dotnet test $coreTests --configuration Release --framework net48 -p:CustomTestTarget=net48 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true --filter 'FullyQualifiedName~FairRequestQueueTests' --logger 'trx;LogFileName=ci-fairqueue-branch-net48.trx' --results-directory $results --verbosity minimal # Passed: 30, Failed: 0, Skipped: 0 & $dotnet test $generator --configuration Release --framework net48 -p:CustomTestTarget=net48 -p:RunAnalyzers=true -p:RunAnalyzersDuringBuild=true --filter 'FullyQualifiedName~ModelDependencyScannerTests\|FullyQualifiedName~PlaceholderReferenceGeneratorTests' --logger 'trx;LogFileName=ci-sourcegeneration-branch-net48.trx' --results-directory $results --verbosity minimal ``` `git diff --cached --check` passed. The queue-test blob was verified byte-for-byte against the existing published correction. The upstream branch was verified as `93ec3928bd5a9cb2ea86110085e79131db17d443` after push. Remote CI is pending, not claimed green: [new CI run 38712127138](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/38712127138). Cross-platform confirmation, CodeQL, coverage gates, and the complete `UA.slnx` suites on this new head are not established by these local checks. The source PR's checks are not claimed as evidence for this branch. ### Earlier validation The original extraction had 1,407 passing scoped test executions across net10.0/net48. The placeholder-review follow-up had six passing focused cases and 269 passing tests in the full source-generator project on each framework, with analyzer-enabled builds. Those are historical results for their respective commits, not fresh full-suite evidence for the CI-repair head. Earlier command details remain in this PR's edit history. ## Related Issues - Related to #4461 (existing tracking issue; not auto-closing). - Extracted from #4462 (source PR; remains open and is not auto-closing). - Reuses the bounded queue-test correction from #4765; does not incorporate that PR's other changes. _If this is a relatively large or complex change, a design must have been discussed in the related tracking issue and signed off (which becomes the Architectural Decision Record (ADR))._ This began as an exact extraction of existing behavior. The subsequent commits address the reported placeholder-generation defect and observed CI failures; they are not a new design or a claim of design sign-off. ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received.	2026-10-15 12:21:46 +02:00
romanett	9b034f8291	Enable nullable reference types centrally; migrate all unset and annotations-only projects (#4700 ) # Description Nullable reference types are now enabled once, in `common.props`, and every project in the repository builds warning-clean with them. Configuration - `<Nullable>enable</Nullable>` lives in `common.props`. All per-project `<Nullable>` settings are removed: 178 project files (enable, annotations, and the `disable` in the three Aot test projects). - 419 per-file `#nullable enable`/`restore` directives and the 4 `#nullable disable` directives are removed. - Kept on purpose: - The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`, `PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the project setting in generated code, so the directive is required there. - `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against the 1.5.378 packages and does not import the repository props. - `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now describe the central setting. Migration (the 43 unset and 13 annotations-only projects, roughly 10k diagnostics) - Production code: annotated at the declarations. Covers `tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the LDS sample. - Members, parameters and returns are nullable where null actually flows. - Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`, `IsMethodTypeDesign`). - `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take `params object?[]`. `Template.AddReplacement` takes `string?` (rendering already skips null replacements). - `IRegisteredServerStore.RegisterAsync` returns `Task<RegistrationEntry?>`: it returns null when a registration is removed. - Dereferences backed by an invariant (for example, the validated model) use `!`, so runtime behaviour is unchanged. - Behavioural changes in production code (small, deliberate): - `NodeSetToModelDesign` throws `InvalidOperationException` when the file is not a NodeSet. Before, it threw a NullReferenceException on the next line. - `ModelDesignValidator` starts its lookup tables empty instead of null. A redundant `if (m_nodes == null) return;` guard is gone. - Test code: minimal annotations. - `?` on values that can be null, `!` where the test asserts non-null. - `= null!` for fixture members assigned in SetUp. - `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the `IEncodeable` constraint. - A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`) folded into the adjacent `IsNull`/`Count` checks. Notes for reviewers - The diff is large (~1,500 files) but almost entirely mechanical: `?`, `!` and directive removal. The non-annotation changes are listed above. - Known follow-up, not done here: `IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay non-nullable even though the validator returns null before it loads a dictionary. Making them nullable would ripple through every generator call site. ## Related Issues - Fixes #4439 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. The "no new warnings" box covers net10.0 and net48: full non-incremental builds of `UA.slnx`, `tools/SourceGeneration.slnx`, `tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0 warnings and 0 errors under the repository's warnings-as-errors settings. net9.0 and net8.0 also had no nullable diagnostics, but they were not rebuilt after the final fixes. Tests have not been run locally yet. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:48:13 +02:00
romanett	cce2004fdd	CTT: keep GeneratesEvent off Object instances and Views off non-hierarchical references; classify Deadband Err-006 as CTT defect (#4667 ) # Description Three findings from the 2026-10-03 CTT run with the patched 1.05.513 scripts. Two are server/model defects and are fixed here. The third is a CTT script defect, recorded as C56 in `plans/ctt-issues.md`. ## 1. Monitored Items Deadband Filter `Err-006.js`: CTT defect (C56, no server change) The script modifies a MonitoredItem on the first static numeric scalar (a plain BaseDataVariable with no EURange) to use a PercentDeadband. It accepts only `Good` or `Bad_MonitoredItemFilterUnsupported`. Since #4629 the server returns `Bad_DeadbandFilterInvalid`, and that is the code the spec defines for this case: - OPC 10000-8 §7.2: PercentDeadband "applies only to AnalogItems with an EURange Property". - OPC 10000-8 §7.3.2 Table 61: `Bad_DeadbandFilterInvalid` is returned when "a PercentDeadband is not supported, since an EURange is not configured". CreateMonitoredItems and ModifyMonitoredItems both go through `ValidateMonitoringFilterAsync` and return the same code. Monitor Basic `Err-022.js` already accepts `Bad_FilterNotAllowed` for non-analog items, so the scripts disagree with each other here. Draft Mantis note (not filed yet): > Monitored Items Deadband Filter Err-006.js rejects Bad_DeadbandFilterInvalid for a PercentDeadband on a node without EURange > Err-006.js picks the first node of `/Server Test/NodeIds/Static/All Profiles/Scalar/NumericSettings`, which is normally a BaseDataVariable without an EURange. It then calls ModifyMonitoredItems with a PercentDeadband (10 %) and accepts only Good or Bad_MonitoredItemFilterUnsupported. OPC 10000-8 §7.2 limits PercentDeadband to AnalogItems with an EURange. §7.3.2 Table 61 defines Bad_DeadbandFilterInvalid for "a PercentDeadband is not supported, since an EURange is not configured", so a compliant server fails this test. Monitor Basic Err-022.js already accepts Bad_FilterNotAllowed for the non-analog fallback. > Proposed fix: add StatusCode.BadDeadbandFilterInvalid (and, consistent with Err-022.js, StatusCode.BadFilterNotAllowed) to the ExpectedAndAcceptedResults of the ModifyMonitoredItems call. ## 2. GeneratesEvent on Objects (Base Info Core Structure 2 `001.js`): source generator defect The CTT reported `ns=9;i=234` (the `<ServiceName>` placeholder of AuthorizationServicesFolderType) and `ns=9;s=AuthorizationServices/Default` as Objects that are the source of GeneratesEvent references. OPC 10000-3 §7.15 says: "The SourceNode of References of this type shall be an ObjectType, a VariableType or a Method". `OpcUaGdsModel.xml` declares both references (AccessTokenRequested/Issued audit events) correctly, on `AuthorizationServiceType`. The source generator copied the type's own non-hierarchical references onto every Object or Variable built from the type: onto instance declarations (the placeholder) and into `CreateInstanceOf<Type>`, which `AuthorizationServiceState` initialises from, and that is how the `Default` service gets them. UA-ModelCompiler does the same thing, so the official `Opc.Ua.Gds.NodeSet2.xml` in UA-Nodeset has the same two references on `ns=1;i=234`. Fix: - `TranslateReferences` now marks references declared on a type (`HierarchyReference.DefinedOnType`, which already existed but was never set). - `NodeStateGenerator.GetReferences` drops forward GeneratesEvent references (including subtypes such as AlwaysGeneratesEvent) for Object and Variable nodes when the reference came from the type. - ObjectTypes, VariableTypes and Methods keep these references. For example, the RegisterApplication methods and the Acknowledge/AddComment methods of the alarm types are unchanged. - References that a model declares explicitly on an instance are emitted as before. ## 3. View targeted by HasCause/HasEffect (Base Info Core Structure 2 `001.js`): sample model defect #4485 added `Views_Operations HasCause/HasEffect Views_Engineering` so that View Minimum Continuation Point 01 `012.js` and View Basic 2 `018.js` have at least two references to View nodes on the configured View (`/Server Test/NodeIds/NodeClasses/View` = `Views_Operations`). OPC 10000-3 §5.4 says Views "can be the SourceNode of any hierarchical Reference. They shall not be the SourceNode of any NonHierarchical Reference." `Views_Operations` now Organizes `Views_Engineering` and a new View, `Views_Maintenance`, which organizes `DataAccess`. This keeps two View-class references and adds no loops (ContainsNoLoops stays true). ## Tests - `NodeStateGeneratorTests.TypeGeneratesEventReferencesAreNotCopiedToObjectInstances`: covers the type, the placeholder, the instance, `CreateInstanceOf`, Methods and an explicit instance reference. It fails without the fix. - `ReferenceServerTest.SampleViewsHaveNoNonHierarchicalReferencesAsync`. The existing `NodeClassSampleNodesReferenceTheirOwnNodeClassAsync` still passes. - Results with net10.0: - SourceGeneration.Core.Tests: 4267 passed, 0 failed - InformationModel.Tests: 1078 passed, 0 failed - Di.Tests, including RobotOpenUsdE2e: 438 passed, 0 failed - OpenUsd.Tests: 921 passed, 0 failed - Server.Tests `ReferenceServerTest`: 56 passed, 0 failed - `UA.slnx` builds with net10.0. The changed test projects build with net48. ## CTT (patched 1.05.513 scripts, compared with the 2026-10-03 patched baseline) \| Part \| Change \| \| --- \| --- \| \| p02-base-info \| Base Info Core Structure 2 `001.js`: Error → Skipped. The GeneratesEvent and View errors are gone; the remaining skips are the CTT's own "type not defined within the test-script" notes. No other change. \| \| p03-base-view-method \| No change. View Basic 2 `018.js` and View Minimum Continuation Point 01 `012.js` still pass. \| \| p13-monitored-items \| Deadband `Err-006.js` still Error (C56). With the script fix it passes. Monitor Basic `007.js` gave a response-timestamp delay warning (>200 ms) caused by machine load; it also appears in the 2026-09-29 base run. \| 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 05:50:30 +00:00
Klaus Landsdorf	ac8dc531ee	Source generator, ISA-95 Job Control and DI changes for companion SDKs built on referenced models (#4577 ) ## Summary First of four stacked PRs that contribute complete implementations of the Machinery (OPC 40001-1 with Job Management, Result Transfer, Process Values and Energy), Pumps (OPC 40223) and Scales (OPC 40200, with PackML OPC 30050) companion specifications — tracked in #4576. It follows the split used for Robotics (#4123–#4127): this PR carries only the changes to existing shared code those SDKs need, and adds no project. Each change stands on its own and is covered by tests in this PR; the companion models are what surfaced them. Rebased onto master after #4569. The one conflict was in `NodeSetToModelDesign.cs`: #4569's shared `AssignSymbolicIds` already makes `Import` and `GetImportedSymbols` derive the same ids, and `NormalizeParentNodeId` moves into its pre-pass. The Copilot review is addressed in the last six commits (see "Review follow-up"). ## Changes ### Source generator (`tools/Opc.Ua.SourceGeneration.Core`) - VariableType data type across assemblies. A model that consumes a dependency through a referenced assembly's `[ModelDependency]` payload lost a VariableType's `DataType`/`ValueRank`, so `GetNodeStateClassName` dereferenced null and reported `MODELGEN003`. First hit: DI's `LifetimeVariableType` as used by Machinery. - Method declaration ↔ method state identity. A consumer re-declaring an inherited method referenced an `OwnerType_MethodMethodState` class the producer never generated. First hit: OPC 34100 ECM re-declaring the DI `LockingServices` methods. - Browse names and reference types of inherited children. An inherited child was emitted with `ReferenceTypeId = NodeId.Null` (invisible to a filtered Browse over the wire) and, where it lives in another namespace, with the declaring model's namespace. When the carried namespace is one the consuming model does not declare, the generated code names it by URI instead of emitting an empty `GetIndexOrAppend()`. - Payload compatibility. The three additions above travel in a length-prefixed, versioned declaration trailer after the existing trailers, so the node and child records keep their layout: an older reader ignores the capability bit and stops after the trailers it knows, and a payload without declarations is byte-identical to before. - Symbolic ids of children listed before their parent. Every `ParentNodeId` is normalized before any symbolic id is derived. No NodeSet in the repository has such an ordering today, so no generated symbol changes; OPC 30050 PackML (later in the stack) declares seven method `InputArguments` before their methods and failed with `MODELGEN025`. - Methods overridden with another method-state class. The subtype declares its own field and property for such a method, but `GetChildren` and `RemoveExplicitlyDefinedChild` skipped every overridden child and the supertype's field stays empty, so the method was missing from every instance (not browsed, no per-instance NodeId, not callable). The existing `MethodTypeOverride` test model has the gap; since #4555 generates a method with inline arguments as `MethodState`, OPC 40001-101 `ResultTransferType.GenerateFileForRead` hits it. It also affects models already in the repository: DI `SoftwareFolderType.Delete`, ISA-95 V2 `JobOrderReceiver.Update`, WoTCon `WoTDocument.Validate` and XRegistry `Group.Delete` / `Resource.Delete` now appear on their instances; the DI, ISA-95, WoTCon and XRegistry tests pass. ### ISA-95 Job Control (`src/Opc.Ua.ISA95.Server`) - `Isa95JobControlV2Binder` — the V2 receiver/response-provider binding moves out of `Isa95NodeManager` so OPC 40001-3 JobManagement can bind the same eleven verbs on its own instances instead of copying them. `Isa95NodeManager` behaviour is unchanged. - `Isa95AddressSpaceOwnership` — a second registration that would load the ISA-95 models fails immediately and names the current owner, as `DiAddressSpaceOwnership` already does for DI. - `IIsa95JobResponseCatalog` — a source for `JobOrderResponseList`, which the two state-filtered request methods cannot express. - `IIsa95JobResponseChangeSource` — a change stream of received responses, and of responses the provider drops after `ResponseRetention`; a response changes neither the order's state nor the order catalog, so the existing streams cannot report it. Both interfaces are implemented by `InMemoryIsa95JobControlProvider`, registered by `AddInMemoryIsa95JobControlProvider`, and count in `AddIsa95Server`'s provider detection and mixed-provider rejection. ### Device Integration (`src/Opc.Ua.Di.Server`, `src/Opc.Ua.Di.Client`) - `IDiPostSetupContext.GetService<T>()` — an optional lookup next to `GetRequiredService<T>()`, so a companion SDK can probe for a seam the server may not have filled without catching `InvalidOperationException`. The context still exposes no raw `IServiceProvider`. - `DiNodeManager.ConformanceUnits` / `ServerProfiles` are virtual, so a companion subclass appends the units its own model satisfies. - DI client browse enumerators follow `BrowseNext`. `DiTopologyClient.BrowseChildrenAsync` and `DiDeviceClient.BrowseFunctionalGroupsAsync` discarded the continuation point and returned an incomplete list from a paginating server. A bad status for the browsed node still means "no children" and a failed service call propagates; an outstanding continuation point is released whenever the enumeration stops early. ## Review follow-up \| Copilot finding \| Commit \| \|---\|---\| \| Payload additions break older readers (both High) \| `fix(sourcegen): move the dependency declarations into a trailer` \| \| Browse failures reported as empty, broad exception filter (Medium ×2); missing pagination tests (Low ×2) \| `fix(di-client): let a failed browse call propagate` \| \| New provider facets missing from detection (Medium) \| `fix(isa95): count the response facets as Job Control providers` \| \| Second review: continuation point kept after a failed BrowseNext \| `fix(di-client): release the continuation point after a failed BrowseNext` \| \| Second review: purged responses not reported \| `fix(isa95): report dropped job responses on the response change stream` \| \| Second review: missing V2 namespace cast to 65535 \| `fix(isa95): reject a missing Job Control V2 namespace in the binder` \| ## Points for the reviewer - `GetService<T>()` adds a member to a public 2.0 interface. The only implementation is the internal `DiPostSetupContext`; an external implementer would have to add it. - `DiDeviceClient.BrowseFunctionalGroupsAsync` used to throw for a bad status of the device node; like `DiTopologyClient` it now yields nothing. - The commits are self-contained and ordered; reviewing commit by commit is the easiest route. ## Testing - New and extended tests: `ModelDependencyV1Tests`, `NodeStateGeneratorTests`, `NodesetIdentifierSidecarTests`, `InMemoryIsa95JobControlProviderV2Tests`, `Isa95ServerBuilderTests`, `Isa95JobControlV2BinderTests`, `DiDeviceClientTests`, `DiTopologyClientTests`, `OpcUaServerDiBuilderExtensionsTests`. - `UA.slnx` builds for net472, net48, netstandard2.0/2.1 and net8/9/10 with SDK 10.0.401 and no warnings. - Tests on net10: SourceGeneration.Core 4266 (8 skipped), SourceGeneration 263, ISA95 144, DI 433; the first three also on net8. The changed projects build for net48 and netstandard2.0 without warnings. - Changed-line coverage (`check-coverage.ps1`): 91.1 % (594 of 652 lines). - The companion stack on top (#4578, #4579, #4580) is rebased onto this head. - Fork CI, full PR matrix incl. macOS, for this head (running): https://github.com/biancode/UA-.NETStandard/actions/runs/36558506011. CodeQL: https://github.com/biancode/UA-.NETStandard/actions/runs/36558509242. The previous head (before the second review round) passed every Windows and Linux job: https://github.com/biancode/UA-.NETStandard/actions/runs/36542929585.	2026-09-29 14:50:00 +02:00
romanett	442889cba5	Fix source generator audit findings; conform structure-field matrices and type metadata to OPC UA 1.05 (#4569 ) # Description This PR fixes a bug audit of the source generation projects (`tools/Opc.Ua.SourceGeneration`: model loading, NodeSet import, all emitters, the Roslyn hosts and packaging). It also fixes a max-effort code review of those fixes, and a check of every spec-relevant change against the OPC UA 1.05 text. - Scope:* about 85 audit findings, 48 review findings and 32 spec-grounding items were addressed. Each fix has a regression test that fails without it. - Wire change: it includes one deliberate, stack-wide wire change: structure-field matrices now follow OPC 10000-6 5.2.5 Table 28. Most changes are internal correctness fixes. The sections below list every change a user can observe: wire formats, generated code and API, generated address-space content, diagnostics and runtime behaviour. ## Behaviour / user-facing changes ### Wire format (encoders) - Binary inline matrices (OPC 10000-6 5.2.5 Table 28). - Layout: a multi-dimensional structure field is encoded as `Int32[] Dimensions`, then the values without a length prefix, with at least 2 dimensions. - Empty and null: any dimension <= 0 means no values follow, and a null matrix is `-1`. An empty matrix is written as `[0,0]`. - Compatibility: this is not compatible with earlier builds of this SDK for matrix fields. It applies to generated types, `[DataType]` types, `Structure`, client ComplexTypes and `WriteEncodeableMatrix`. - Unchanged: Variant matrices (5.2.2.16) keep their old encoding. - Declared rank decides matrix vs array. A 1-D `MatrixOf<T>` in an array field or a Variable value is written as an array again. Matrix-declared fields go through the new public `EncoderExtensions.WriteInlineMatrixValue`, which generated code also uses. A non-empty 1-D value in a matrix field throws `BadEncodingError`. - Decoder hardening: - Before allocating, the decoder bounds all matrix dimensions against overflow, `MaxArrayLength` and the remaining message length. - The decoder rejects: - a matrix with fewer than 2 dimensions; - a populated matrix whose rank differs from the field's declared rank; - a union SwitchField greater than the number of fields; - an EncodingMask with unassigned bits set. - Encoder `MaxArrayLength`: the encoder enforces `MaxArrayLength` for inline matrices, as it already did for arrays. - XML structure fields (5.3.1, 5.3.4, 5.3.5). - Fields: `Structure` and client ComplexTypes write fields like typed fields (`<A>1</A>`, array elements directly) instead of a Variant body. - Matrix fields: `Dimensions` and `Elements` go directly inside the field element, with no `<Matrix>` wrapper. - Empty matrices: written as nil, because XML dimensions must be greater than 0. - Compatibility: decoders still accept the old shapes. - Enum fixes: enum array elements with value 0 are no longer dropped, and enum array element names are fixed. - Other encoding fixes: - A null `DiagnosticInfo` structure field writes `0x00` instead of nothing. - A null scalar field in a runtime `Structure` is written as its default instead of zero bytes, which used to shift every following field. - A Variant holding an empty matrix encodes as an empty array instead of throwing. - `Variant.Copy` keeps the matrix identity of null and empty matrices. - NodeSet export and the DataContract surrogate write Variable values with the Variant rules again. A null or empty `MatrixOf` variable no longer produces invalid XML or unreadable NodeSets. - `JsonEncoder.CanOmitFields` is `true` only for Compact encoding. Verbose and RawData JSON include default-valued fields. ### `[DataType]` source-generated types - Default-value handling (OPC 10000-6 5.4.1, Table 1). - Encode: a field is omitted only when its value and its declared default are the type's default (0, false, null). Fields with a non-default initializer or constructor default, and empty strings, are always written, so configuration files get slightly larger. - JSON decode: a field missing from JSON decodes to the type default. - XML decode: a field missing from XML keeps its declared default, which older configuration files rely on. - Why: this fixes silent round-trip loss, for example `SamplingInterval = 0` read back as `-1`. - Nested `[DataType]` types: they are now generated inside their containing types. Without an explicit id, their default TypeId and XmlName are qualified (e.g. `s=Outer.Foo`); wire identity change for nested types. Colliding activator names get a `_2` suffix. - Activators: they are `internal` when the type, or any containing type, is not public (was CS0060). - Matrix properties: - `MatrixOf<T>` properties use the inline matrix encoding. - Matrices of non-sealed structures, or with `StructureHandling.ExtensionObject`, are written as ExtensionObjects. - Their published ValueRank is 2, because the rank can't be known from `MatrixOf<T>`. - Published StructureDefinitions: - They include base-class fields. - Nullable properties are no longer marked optional. - Inline structure fields name their concrete type. - `[Flags]` enums: they are published as plain enumerations with their member values, which matches how they are encoded. - Other generated code: - `Clone` deep-copies arrays and matrices of structures, Variants, ExtensionObjects and DataValues. - `IsEqual` and `GetHashCode` are consistent: EncodingMask, active union member and NaN handling agree. - Pooled `Reuse()` restores the freshly constructed state through the new `protected virtual ResetForReuse()`, and returns an instance to its runtime type's pool. - Enum capture: enum member values are captured culture-invariantly. Negative values were lost on cultures that use U+2212 as the minus sign. ### Model-driven generator: generated code, API and file names - Removed API: generated `_Placeholder` proxy accessors (e.g. `PowerTrainTypeClient.GetMotorIdentifier_PlaceholderAsync`) and fluent `X_Placeholder()` accessors are removed; they could never resolve anything. - Proxy accessors now look children up by BrowseName with the right namespace. - `RoboticsClient` finds motors and gears by type and drives via `IsDrivenBy`. Its topology snapshots used to be empty. - Renamed files:* generated files for a bound `[NodeManager]` are now named `{Namespace}.{Class}.NodeManager.g.cs` (also `.Factory` and `.FluentBuilders`). - Generated NodeState code: - Attributes are set through `baseState`/`nodeState` locals, so children named like base attributes (e.g. `DataType`, `EventNotifier`) compile. - Children that hide base members are declared `public new`, using names reflected from the runtime. - `global::` qualification is used throughout. - Proxies and fluent builders: a proxy whose supertype is excluded (e.g. Draft) derives from the nearest emitted ancestor. Fluent wrappers and NodeState factories fall back the same way; they used to fail with CS0246. - Derived structures: - The optional-field `EncodingMask` continues across inheritance. - A derived structure over a base type from another model no longer relies on `base.ResetForReuse`. - Default values: - NodeId, QualifiedName and ExpandedNodeId defaults resolve by namespace URI (`context.NamespaceUris.GetIndexOrAppend`) and server URI. - StatusCode, negative enum, `double`/`float` (shortest round-trip literal) and escaped string defaults now compile. - Event records: - Vendor event records have `Decoder.GetStandardFields(NamespaceTable)`, and their browse paths use the model's namespace. - A field whose namespace is unknown to the session no longer matches a namespace-0 field. - Companion `StandardFields` is `[Obsolete]`. - Vendor simple subtypes such as `Percent : Double` map to their built-in type. - Other fixes: - `MethodState.CallAsync` passes the real `objectId` to synchronous `OnCallMethod2` handlers; it used to pass `NodeId.Null`. - Enumeration fields with an explicit `Identifier` keep it, instead of taking a trailing `_<digits>`. - Explicit NumericIds are no longer reused by automatic numbering. - Dependencies are loaded in topological order. ### Generated address-space content - Arguments: - Methods without arguments no longer get empty `InputArguments`/`OutputArguments` properties (OPC 10000-3 5.7). - About 2,660 automatically assigned namespace-0 NodeIds of 15000 and above shift. Every NodeId in `StandardTypes.csv` is unchanged. - Permissions: type nodes and method declarations on types now carry the model's `RolePermissions`/`AccessRestrictions`. - Restored nodes: NodeSet import keeps nodes that were silently dropped before: - `NamespaceMetadata` objects and the NodeSet's own TypeDictionary variables; - ISA95 placeholders linked only non-hierarchically; - instances whose parent is in another namespace. - Import details: - ValueRank > 1 without ArrayDimensions keeps its rank. - `svr=` indexes map correctly. - Invalid MinimumSamplingInterval values import as -1, not 0. - Localized texts prefer the invariant or English translation. - StructureDefinitions: - They include inherited fields, including for subtypes without their own fields (e.g. `AnonymousIdentityToken` now publishes PolicyId). - The StructureType kind covers inherited AllowSubTypes fields. - Unions ignore IsOptional. - StructureFields never publish ValueRank 0; a OneOrMoreDimensions field without dimensions becomes rank 2. - Fields with ValueRank -2/-3 are published as scalar BaseDataType, which is what is on the wire. - OptionSets: - Implicit fields get the next free bit. - `OptionSetValues` uses null for undefined bits instead of "Reserved", and structure OptionSets publish all their bits (no 32/96-bit cap). - Numeric OptionSets are limited to their base type's width, and UInt64 bit 63 works. - Schemas: - Structures with inline-matrix fields are left out of the `.bsd` (5.2.5). - In the BSD, Variant-encoded and non-structure subtyped fields are described as `ua:Variant`. - In the `.xsd`, matrix fields are typed `ua:Matrix` with `Dimensions`/`Elements`, and `EncodingMask` is required. ### NodeSet / model input handling - Model selection: - The newest NodeSet of a model is chosen by `ModelVersion` (SemVer 2.0 precedence), then PublicationDate. The `Version` attribute, which Annex F says is not for comparison, is only a tie-break. - The order is total and does not depend on input order; referenced assemblies use the same rule. - Default names: - Invalid default Name/Prefix values are repaired (`201301ISA95` becomes `_201301ISA95`, `class` becomes `class_`). - Valid names are unchanged. - Sanitising no longer depends on the OS. - `ModelUri` metadata that doesn't match the NodeSet raises a warning instead of silently losing the model. - Input detection: - Only XML files whose root is `ModelDesign` or `UANodeSet` are treated as models. - A malformed NodeSet stays a NodeSet input, so it no longer breaks the ModelDesign pass. - `IdentifierFile` paths: they are normalized (`./`, `../`), and the suffix match requires a folder boundary. - Dependency payloads (`ModelDependencyV1`) carry field IsOptional, AllowSubTypes, ArrayDimensions and the producer's namespace tables in skippable trailers, so old and new readers stay compatible. ### Roslyn host, diagnostics, packaging - New diagnostics: - MODELGEN036: `[NodeManager]` target not supported (nested, generic, file-local or global namespace). - MODELGEN037: `[DataType]` target not supported (struct, generic, abstract, file-local or global namespace). - MODELGEN038: the definition of an encodeable base type can't be found. - New validator errors: - a structure with both optional and subtyped fields (OPC 10000-6 F.13); - multi-bit or duplicate OptionSet masks. - Diagnostic locations: `[DataType]`/`[NodeManager]` diagnostics point at real source locations again, so `#pragma` and `.editorconfig` apply. MODELGEN010 is the exception. - Incremental caching: pipeline values compare by value, so unrelated edits no longer regenerate the whole model or all `[DataType]`s. - `ModelSourceGeneratorIgnore` on a ModelDesign input is honoured; the design still resolves as a dependency. - Cancellation: a cancelled generation run propagates `OperationCanceledException` instead of reporting a MODELGEN003 error. - Stack package: the `Stack` NuGet package now ships `build/OPCFoundation.NetStandard.Opc.Ua.SourceGeneration.Stack.props`, so `StackSourceGeneratorMode` and `StackSourceGeneratorExclude` reach the compiler. ## Related Issues - No tracking issue. The audit, review and spec-grounding reports are available on request. Contains the matrix wire-format change discussed for D-5 (OPC 10000-6 5.2.5 Table 28). ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. (`docs/SourceGeneratedDataTypes.md`, `docs/NodeManagers.md`, generator readme) - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. (`UA.slnx` 0 warnings / 0 errors on net48 and net10.0) - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. The affected suites were run on net10.0: SourceGeneration Core/Roslyn/Stack, Types, Core.Encoders, Encoders.Fuzz, Client, Client.ComplexTypes, PubSub, Core, Server, GDS, Configuration, Di, Robotics, ISA95, Positioning, OpenUsd, XRegistry. net48 was built; its test legs, and the post-rebase verification, run in CI. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 00:47:40 +02:00
Copilot	02fb72e2d3	Support guid/opaque nodeids in NodeSet import (#4507 ) # Description `NodeSetToModelDesign.ImportNode` only stored Numeric and String NodeId identifiers. Guid and Opaque identifiers (both valid per OPC 10000-3 5.2.2) fell through to an `Information` log line, so the node was registered in `NodesByQName`/`NodesById` with no identifier at all and code generation continued against a node whose identity had been discarded. The `ModelDesign` schema has no representation for Guid/Opaque identifiers (`NodeDesign` exposes only `NumericId`/`StringId`), so the import now fails loudly instead of emitting output that looks correct. - Importer: the fall-through branches in `ImportNode` are replaced with an `InvalidDataException` naming the NodeId, browse name and identifier type. This matches the existing unsupported-input handling in the file and surfaces through `ModelCompilation` as a generator diagnostic. - Logger removal: `m_logger` had no remaining use in `NodeSetToModelDesign` and was removed along with its `Microsoft.Extensions.Logging` import. - Tests: `ImportUnsupportedNodeIdTypeThrowsInvalidDataException` covers Guid, empty Guid and Opaque identifiers via an in-memory NodeSet. - Docs: the source generator readme states the NodeSet2 identifier restriction. ```csharp else { // The model design can only carry numeric and string identifiers. // Guid and Opaque identifiers (OPC 10000-3 5.2.2) would be dropped // and code would be generated for a node without any identity, so // the import fails instead of silently producing wrong output. throw new InvalidDataException( $"NodeId ({input.NodeId}) of node '{input.BrowseName}' uses the " + $"{nodeId.IdType} identifier type which is not supported by the model " + "design. Only Numeric and String identifiers can be imported."); } ``` Note on behaviour: a null/unspecified NodeId parses as a Numeric identifier (`i=0`) and is still handled by the numeric branch, so the removed `IsNull` branch was only ever reachable for an empty Guid or Opaque identifier, which is now reported as unsupported. ## Related Issues ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #4504 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-21 14:52:55 +02:00
Marc Schier	9f14ddf5de	Preserve non-child hierarchical references during NodeSet import (#4491 ) # Description Preserve forward and inverse same-namespace hierarchical references that are not already represented by the NodeSet importer's parent/child relationship. A reference is implicit only when both its endpoints and its exact reference type match the selected ownership relationship; additional links do not reparent their targets. Also fix the generated-reference duplication that blocked the previous attempt in #4473. Inherited and declared `NodeDesign` objects can differ structurally while resolving to the same runtime reference. Deduplicating by the emitted reference-type ID, direction, and target ID prevents identical `AddReference` calls from throwing during Robotics/OpenUSD startup. - Add 21 importer/generator regression cases, including a minimized recursive-placeholder reproduction of the startup failure. - Strengthen the reference-server test to check the original missing forward links, inverse counterparts, subtype filtering, and unchanged ownership. - Document ownership versus graph references in `docs/NodeManagers.md`. ## Validation Confirmed the missing-reference cases fail before the importer fix, and the minimized duplicate-reference case fails before the generator fix. The original Robotics/OpenUSD fixture passed before the changes, failed with the importer-only candidate, and passes with both fixes. \| Suite \| net10.0 \| net48 \| \| --- \| --- \| --- \| \| SourceGeneration.Core.Tests \| 3,961 passed; 8 existing skips \| 3,961 passed; 8 existing skips \| \| SourceGeneration.Stack.Tests \| 94 passed \| 91 passed \| \| SourceGeneration.Tests \| 185 passed \| 185 passed \| \| Di.Tests, including all 17 RobotOpenUsdE2eTests \| 425 passed \| 425 passed \| \| ReferenceServerTests \| 45 passed \| 45 passed \| Executed using `CustomTestTarget` with `dotnet test tools/SourceGeneration.slnx`, the Di test project, and the `ReferenceServerTests` filter in the Server test project. Scoped whitespace/style checks and `git diff --check` also passed for the changed code. Pre-existing analyzer diagnostics outside the changes were left untouched. The full `UA.slnx` test suite has not been run locally. CI and CodeQL results remain pending. ## Related Issues - Fixes #4484. - Addresses the hierarchical-reference limitation deliberately deferred in #4473. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-09-15 13:06:47 +00:00
romanett	e639932b95	Fix source generator defects from the Client/Types/SourceGeneration audit (#4473 ) # Description Fixes the SourceGeneration findings of a read-only bug audit of `a05a36055` — sections 15 (host generators, Roslyn side), 16 (SourceGeneration.Core schema / ModelDesign loader) and 17 (SourceGeneration.Core generators). 36 of the 39 findings are fixed; each has a regression test. ### Generated-code correctness - State machine NodeId constants were emitted as `const uint` even when the aliased `Objects` constant is a `string`, so every model using string NodeIds with a `FiniteStateMachineType` subtype failed with CS0029. The constant type now follows the aliased node, looked up from the same source `NodeIdGenerator` emits from — top-level nodes plus each node's instance hierarchy, since a state or transition only ever exists as a hierarchy entry. - `NodeIdGenerator` emitted string identifiers into C# string literals without escaping them. - Structure field names are authored data, so they can be C# keywords or collide with the members every generated data type carries. Properties and `{Type}Fields` members now go through a sanitizing, collision-breaking mapping (including two siblings that sanitize to the same identifier). Wire names are untouched — OPC 10000-3 §8.51 requires the StructureField name to match the BrowseName, and the `DataMember`/encode/decode names still come from `Parameter.Name`. - `NodeStateGenerator`'s copy-on-write cast now uses the fully qualified data type name, which a cross-model structure needs. - `GetScalarValueAsCode` emitted `(double)NaN` and the infinities, which do not compile. - `TemplateWriter` formatted with the current culture, so a machine with a comma decimal separator emitted invalid generated source. ### Served schema documents - The binary schema described a different wire layout than the generated `Encode`/`Decode`: unions carried no `SwitchField`/`SwitchValue`, and structures with optional fields carried no encoding-mask presence bits. Both are now emitted per OPC 10000-6 §5.2.7, matching the layout the runtime `BsdSchemaGenerator` produces. A structure with more than 32 optional fields now fails generation instead of silently wrapping `1 << 32` back onto the first field's bit. - Documentation text and attribute values are XML-escaped. ### ModelDesign loading and validation - Identifiers pinned in a CSV were dropped whenever any other loaded namespace declared the same symbolic name. Removal is now scoped to the file's target namespace, and explicit `NumericId`s are keyed by `(namespace, id)` so the same number in two namespaces is legal. - Declaration order inside a design file no longer matters — base types are imported and validated ahead of their subtypes. - OptionSet `OptionSetValues` were truncated at bit 31 (signed shift) and bits 32–63 of a 64-bit option set were never emitted. - An authored `ValueRank` is no longer overwritten by the shape of the default value (OPC 10000-3 §6.2.8: a ValueRank may only be further restricted), and a VariableType data type may be narrowed any number of levels deep rather than exactly one. - NodeSet import: `AccessRestrictions="0"` means "no restrictions", not `EncryptionRequired` (OPC 10000-3 §8.56) — an unrecognised mask stays fail-closed; a NodeSet without `<Models>` reports what is wrong; an optional `<References>` no longer throws; the parent/child reference scan looks at the parent's references; and `IsTypeOf` terminates on the self-referential root reference types NodeSets routinely declare. - Version comparison is numeric per component (ordinally `"1.05.9"` sorts above `"1.05.10"`) and now lives on `SemVer`, so the NodeSet collection and the dependency tie-break cannot pick different winners; a publication-date version no longer outranks a real one. ### Host generator - `[DataType]` on an `enum` is matched again (an enum is not a `TypeDeclarationSyntax`), MODELGEN003 renders its arguments instead of the raw template, and the Types hint name keeps the namespace's dots so `A.BC` and `AB.C` cannot claim the same one. - Compilation-derived pipeline stages carry value comparers, so editing a file no longer re-runs the entire model generation on every keystroke. - A NodeSet that fails to load skips that file rather than every remaining one; a file listed twice as an `AdditionalFile` is deduped; superseded NodeSet versions are still recognised as NodeSet inputs and not generated a second time by the ModelDesign pass. - `LogLevel.Critical` maps to a diagnostic instead of being silently dropped. ### Client - `EventRecordFieldReaders` gained the readers the event record generator needs (including `Variant`, enumerations and the array forms). Fields whose type had no reader were declared on the record but never populated, so they read as `null`/`default` for every event. ## Not fixed (deliberately) - Forward same-namespace hierarchical references in `NodeSetToModelDesign.ImportReferences` — the audit flags the inverse-only handling as asymmetric. Making it symmetric compiles and passes every generator unit test, but regresses the address space: all 17 `RobotOpenUsdE2eTests` fail in `OneTimeSetUpAsync` because the hosted server never finishes starting. Reverted, with a comment at the site recording why. - §17.10 and §15.10 (both low + PLAUSIBLE) — each needs a wider refactor than this PR: a consistent NodeId-constant rename across ~6 cross-reference sites, and replacing `Location` with a serializable equivalent for incremental cache equality. ## Spec cross-check The encoding/schema changes were checked against the specification: OPC 10000-6 §5.2.7 (32-bit EncodingMask, one bit per optional field in order, padded), the union `SwitchField` encoding, OPC 10000-3 §8.56 (AccessRestrictionType bit mask), §6.2.8 and §5.6.2/§5.6.5 (ValueRank), §8.51 (StructureField name == BrowseName). `GenerateStackTests.OptionalFieldBitsAgreeBetweenBsdAndGeneratedEncoder` pins the BSD presence-bit order against the generated encoder's `LogRecordFields` so the two cannot drift apart again. ## Related Issues _No tracking issue — this PR implements the SourceGeneration sections of a bug audit. Happy to open one if maintainers prefer._ ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. > Note on the test checkbox: verified on net10.0 only — `UA.slnx` builds clean (0 warnings, 0 errors) and `Opc.Ua.SourceGeneration.Core.Tests` (3915), `Opc.Ua.SourceGeneration.Tests` (184), `Opc.Ua.Di.Tests` (425, including the `RobotOpenUsdE2eTests` end-to-end fixture that catches address-space content changes) and the `EventRecordFieldReaders` tests (16) all pass. .NET Framework has not been run locally; CI needs to confirm it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-13 19:07:55 +02:00
romanett	ececea15c8	Reimplement the GDS ApplicationsNodeManager as a generated fluent node manager (#4434 ) # Description Builds on #4428, which is now merged; this branch is rebased onto master. The GDS `ApplicationsNodeManager` becomes a source-generated `[NodeManager]`: the companion model, its loader and the fluent plumbing are emitted, and what stays hand-written is the behaviour. Getting there needed three things from the shared surface, which are the first two commits. ## Commits 1. Add the fluent hooks a hand-written manager needs at startup - `OnReadRolePermissions` / `OnReadUserRolePermissions` on the node builder. Every other `NodeState` `On` hook was already fluent; these were not, and a server that grants access on something the static model cannot express has to compute the permission set per request. - `Node<TState>(TState)` returns a builder over a node the caller already holds, for nodes materialised after `Configure` resolved its graph. - `OnAddressSpaceReadyAsync` on `FluentNodeManagerBase` — the one seam between the address space existing and the wiring being applied, for managers whose wiring depends on asynchronous setup. `Configure` is a `partial void` and cannot await. `DiNodeManager` had already invented the hook privately, so its declaration becomes an `override`. 2. Let a `[NodeManager]` bind to a model a referenced assembly supplies* A model belongs to the assembly that emits its types, which leaves a node manager for it homeless whenever that assembly cannot reference `Opc.Ua.Server` — a model-only package shared with clients, for instance. Binding was rejected twice over: the design was skipped before the binding was matched (`MODELGEN010`), and fluent-accessors-only mode refused to run alongside manager generation (`MODELGEN014`). The binding is now matched before the skip decision, and a matched binding puts that design into accessors-only mode. A design nothing binds to is still skipped, so this cannot start duplicating types by accident. The emitted manager also gains what a real manager needs: `DefaultNamespaceUris()` plus a protected constructor taking a replacement set; `GenerateDefaultConstructor=false` to suppress the two-argument form; its own logger category; and the call to `OnAddressSpaceReadyAsync`. Generated fluent accessors also stop re-enabling nullable warnings — a bare `#nullable enable` undid the shared header's `disable warnings`, so any model with a structure-typed method argument reported CS8600 on every generated `out T` in a project that builds warnings as errors. 3. Reimplement the GDS `ApplicationsNodeManager` as a generated node manager The design stays owned by `Opc.Ua.Gds.Common`; the server assembly only binds a manager to it. NodeIds do not move. `NamespaceIndexes[0]` must stay the application record namespace — it is the one the application database, the certificate request store and the base allocator mint ids in — so the constructor passes the namespace order explicitly rather than adopting the generated model-first default. A test pins both ends against a live server. Four overrides go, leaving `OnAddressSpaceReadyAsync` and `Dispose(bool)` — no address-space overrides at all: \| Removed \| Why it was unnecessary \| \| --- \| --- \| \| `New` \| The base allocator already mints into `NamespaceIndexes[0]`, with a thread-safe counter. The override existed only because `Create(assignNodeIds: true)` asks the factory with the declaration id still set; `AssignInstanceNodeId` nulls it and re-asks, documented as being there for exactly this allocator. \| \| `AddBehaviourToPredefinedNodeAsync` \| Its `AuthorizationServiceType` branch re-wired a node that was already wired, and its `KeyCredentialServiceType` branch had nothing to wire — the model ships that folder empty. \| \| `GetManagerHandleAsync`, `ValidateNodeAsync` \| Verbatim reimplementations of the base that also blocked the fluent base's virtual-node support. \| \| `DeleteAddressSpaceAsync` \| A `// TBD` passthrough. \| Everything else — all sixteen directory methods with their self-administration permissions, the certificate groups' concrete types and trust-list flags, and the authorization service (created through this PR's `Add` surface and wired in the same place) — is one `Configure` pass. 4. Bind the certificate groups from the `Configure` pass Acquiring a certificate group and binding it to its nodes are different kinds of work: the first is I/O (`InitAsync` opens certificate stores and creates CA certificates), the second only touches the address space. Each now runs in the phase it belongs to, which puts the whole of the wiring in one place. Ownership no longer rides on the binding. A group joins `m_ownedCertificateGroups` the moment it is constructed, before `InitAsync` can throw, so a group that fails half way through is still disposed — which the previous code could not manage, keying ownership off a dictionary it filled only after initialization succeeded. > Commit 3's message says this move is impossible and blames `PushTest`. That was a wrong diagnosis, and this commit supersedes it. Two real defects were hiding behind those failures: - `Create(..., NodeId.Null, ..., assignNodeIds: false)` does not null the NodeId. `NodeState.Create` overrides it only when handed a non-null one, so a custom group node kept the namespace-0 id of its type declaration. `AssignInstanceNodeId` hid this by re-asking the factory with the id nulled; the builder validates instead, and rejected it. The node is now created with an id in the manager's own namespace, as the `Default` authorization service already was. - The custom certificate group node was not browseable. It answered `GetCertificateGroups` and `ReadNode`, but a type-filtered recursive browse from the Objects folder never returned it — which OPC 10000-12 §7.8.2 requires of a certificate group. Staging the node through the builder gives it the reference it was missing. ### Two `PushTest` methods change — please review these closely The second defect had been masking what those tests actually did. Selecting the group positionally, `groups[3]` resolved to the server's own `ServerConfiguration` group while the custom one stayed invisible, so `UpdateTrustListOfCustomGroupAsync` and `AddRemoveCertOfCustomGroupAsync` were exercising a transactional trust list under a custom-group name. Browse results, before and after: \| # \| Before (baseline) \| After \| \| --- \| --- \| --- \| \| 0-2 \| GDS Directory groups (`ns=3`) \| GDS Directory groups (`ns=3`) \| \| 3 \| `DefaultApplicationGroup` `i=14156` — the server's own \| `MyCustomGroup` `ns=2` \| \| 4 \| — \| `DefaultApplicationGroup` `i=14156` \| They now resolve the group by browse name — which asserts it is browseable at all — and expect the immediate-apply semantics the GDS actually gives the groups of its own `Directory`: `CloseAndUpdate` writes the stores at once and reports `applyChangesRequired == false`, so the `ApplyChanges` calls go away (they would return `Bad_NothingToDo`). The read-back assertions are what prove the writes landed, and they are unchanged. This is a genuine loss of the transactional trust-list coverage those two methods were accidentally providing — the server's own group is still covered by the other `PushTest` methods, which target it deliberately. 5. Select `GetCertificates` results by type instead of by position `GetCertificatesAsync` checked entry zero of a parallel-array result. Which entry that is depends on the order the server reports its certificate types in, an empty result throws `IndexOutOfRange` rather than failing an assertion, and a second type going missing or unparseable would not be noticed. Every returned pair is now checked, and a failure names the certificate type. 6. Drop the `.Common` suffix from the three GDS projects Every other companion specification ships as `<Family>` / `<Family>.Client` / `<Family>.Server` — Di, ISA95, Positioning, Robotics, Vision, WotCon, XRegistry. GDS was the exception, with a `.Common` suffix that named nothing. \| Before \| After \| \| --- \| --- \| \| `src/Opc.Ua.Gds.Common` \| `src/Opc.Ua.Gds` \| \| `src/Opc.Ua.Gds.Client.Common` \| `src/Opc.Ua.Gds.Client` \| \| `src/Opc.Ua.Gds.Server.Common` \| `src/Opc.Ua.Gds.Server` \| No source changes were needed. `RootNamespace` was already the final name in all three projects — the namespaces have always been `Opc.Ua.Gds`, `Opc.Ua.Gds.Client` and `Opc.Ua.Gds.Server`, and only the assembly and package ids disagreed. Nothing compiling against these assemblies changes a `using`. The package ids do change, which is consumer-visible, so `docs/migrate/2.0.x/packages.md` gains a renamed-packages section — it is the document that undertakes to cover NuGet renames — and the migration skill's package table gains the two rows a 1.5.378 consumer needs. Build infrastructure that names the projects or their output moves with them: both solution files, `expected-packages.txt` (re-sorted — it is maintained alphabetically), both signing manifests, the reference-server Dockerfile, the metapackage nuspecs, and the analyzer's package dependencies. `preview-pack.slnx` is derived from `UA.slnx` and needs no edit. The migration analyzer's shim tree mirrors the source layout by its own documented convention, so `Gds.Client.Common/` becomes `Gds.Client/`. Prose naming past work is left alone — plan 23 still records that its deferral happened during the "GDS Client.Common modernization", which is the name that effort had. ## Validation `net10.0`, on master + these four commits, from a clean GDS PKI: - `UA.slnx`: 0 errors, 0 warnings in changed files (the solution's 30 pre-existing warning lines are CA1861/CA1850/CA1307 in `XRegistry`, `Types.Tests` and `WotCon.Tests` — same rules and projects as the base). - `Opc.Ua.Gds.Tests`: 1,117 passed, 0 failed, 54 skipped — identical to the base branch. - `Opc.Ua.Server.Tests`: 4,961 passed, 0 failed, 5 skipped (measured before commit 4, which touches only the GDS assembly and its tests). - `Opc.Ua.SourceGeneration.Tests`: 169 passed. - `Opc.Ua.SourceGeneration.Core.Tests`, NodeManager/Generators/Fluent: 84 passed; `GenerateCode`: 21 passed, 4 skipped. - `Opc.Ua.MigrationAnalyzer.Core.Tests`: 10 passed, 3 skipped. - After the rename: assemblies build as `Opc.Ua.Gds.dll` / `.Client.dll` / `.Server.dll`, with no `*.Common.dll` produced anywhere. - Commits 1-3 build standalone. - `Opc.Ua.Gds.Server.Common` also builds for `net48` and `netstandard2.1` (checked before the rebase onto #4428). Not yet run: the full `Opc.Ua.SourceGeneration.Core.Tests` suite (~3,800), and the older target frameworks since the rebase. ## Checklist - [x] Existing tests pass - [x] New tests cover the new surface (role permissions, resolved-node builder, referenced-model binding, constructor/namespace control, GDS namespace invariant, custom-group node namespace) - [ ] Full Core.Tests sweep and net48/netstandard2.1 re-run after the rebase 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-09 10:41:06 +02:00
romanett	30ed2390a8	Import NodeSet2 documents into a fluent node manager (#4432 ) ## What `INodeManagerBuilder.Import(UANodeSet, INodeSetImportFactoryProvider?)` lets a source-generated (or hand-written fluent) node manager overlay a NodeSet2 document that is only known at runtime onto the model it was generated from. Every document imported during one `Configure` pass forms a single batch that is linked exactly once after the pass. A node may therefore declare a `ParentNodeId` that lives in another document of the batch, or a node the manager already owns — which is what makes an overlay possible. Imported nodes resolve through `Node(...)`/`NodeFromTypeId(...)` immediately, so they can be wired in the same pass; they are registered with the manager when `CompleteConfigureAsync` runs. ### Public surface - +1 method: `INodeManagerBuilder.Import(UANodeSet nodeSet, INodeSetImportFactoryProvider? factoryProvider = null)`. - +3 contracts in `Opc.Ua.Server.Nodes`: `INodeSetImportFactoryProvider`, `INodeSetImportFactory`, `NodeSetImportDiscriminator` (TypeDefinition / MethodDeclaration / NodeId). - In `Opc.Ua.Export`: a public `UANodeSet.Import` overload taking a `NodeSetImportStateFactory`, and a public batch `LinkParentChildRelationships(context, nodes, NodeSetImportLinkOptions)`. These replace what would otherwise have been an `InternalsVisibleTo("Opc.Ua.Server")` on `Opc.Ua.Types`. - `NodeState.IsExplicitlyDefinedChild(context, child)` and `protected DetachExplicitlyDefinedChild(child)`, used to tell a generated slot apart from an ordinary child. ### Typed states, no reflection The generator emits `{Model}NodeSetImportFactoryProvider` — one factory per model type/declaration, each calling a concrete constructor for an empty state — and makes the generated node manager implement `INodeSetImportFactoryProvider` by delegating to it. So the builder resolves the provider from the manager (`NodeManager as INodeSetImportFactoryProvider`); `Import` also accepts one directly, and the generated manager exposes `partial void AddNodeSetImportFactories(List<INodeSetImportFactory>)` for dependency models. An imported node of a generated type materializes as its generated `*State` subclass with no type lookup, which keeps the path NativeAOT-safe. Because the factories create empty states, an imported instance carries exactly the children its document declares. ### Reconciliation When an imported child lands in a slot the generated parent declares (same BrowseName), it replaces the generated placeholder: the displaced node and every descendant the document does not carry over are removed from the manager, and references to them are retargeted at the replacement. Replacing a node the same `Configure` pass already wired is rejected with `BadInvalidState` rather than silently dropping the wiring, and sealing a builder with an unregistered import batch is rejected too. ### Also - `RuntimeNodeSetNodeManager` now uses the same importer: its documents are one batch, so a node may declare a parent in another document of the group regardless of parse order, and duplicate NodeIds across documents are detected while parsing. - Linking resolves an imported child's reference type from its own inverse reference (previously always `HasComponent`/`HasProperty`). - Method import keeps the document's `UserExecutable`; it previously copied `Executable` into it. View import keeps `EventNotifier`. ## Tests - `NodeSetImporterTests` (15) — discriminator selection, generic fallbacks, field/value/reference fidelity against a generic import, cross-document linking, typed replacement of inherited and argument slots, deferred linking preserving an application `Handle`, duplicate NodeIds, factory misuse. - `NodeSetImportBuilderTests` (15) — staging and lookup before registration, batch linking, attaching to an existing node, provider resolution, placeholder replacement with reference retargeting, configured-placeholder rejection, seal/completion guards. - `NodeSetImportIntegrationTests` (5) — a generated `[NodeManager]` overlaying its own model on a running server: typed states through the generated provider, cross-document linking, placeholder replacement, and browse through a session. - `NodeManagerGeneratorTests` (+4) — the emitted provider and the manager's delegation, including that no factory uses `Activator.CreateInstance`/reflection. - `NodeSetAotTests` (+1) — the public state-factory import under NativeAOT. Full `Opc.Ua.Server.Tests` (4946), `Opc.Ua.SourceGeneration.Core.Tests` (3821), `Opc.Ua.SourceGeneration.Tests` (165) and `Opc.Ua.Types.Tests` pass locally on net10.0. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-07 23:12:43 +00:00
romanett	e61ad4b306	Fully support sub-state machines in the fluent state-machine builder (#4322 ) # Description Part 16 §B.3 places `HasSubStateMachine` on the parent state node, but the fluent builder attached it to the state-machine root because `FluentFiniteStateMachineState` never materialized state nodes at all. Investigating #3821 showed the gap was wider than the reference placement: 1. No state nodes existed. The NodeId written into `CurrentState/Id` — `new NodeId(stateId, ElementNamespaceIndex)` — was dangling: no node with that id was in the address space. 2. `AvailableStates` was never populated, so `GetAvailableStatesAsync` returned empty against a fluent-built server. 3. The whole client discovery chain was therefore dead. `ObserveEffectiveStateAsync` enumerates `AvailableStates` and browses `HasSubStateMachine` from each state node — it found nothing. The client side was already spec-correct; only the server deviated. 4. `HasSubStateMachine` is non-hierarchical (a subtype of `NonHierarchicalReferences`, `i=32`). Using it as the sub-SM's `BaseInstanceState.ReferenceTypeId` left the sub-SM unreachable from a hierarchical browse of the machine. ## What changed Element nodes are materialized. Definition-mode machines now create one `StateType` node per declared state and one `TransitionType` node per declared transition — each a `HasComponent` child carrying `StateNumber` / `TransitionNumber`, with the §B.4 `FromState` / `ToState` / `HasEffect` references and `HasCause` added by `WithCause`. `AvailableStates`, `AvailableTransitions` and `LastTransition` are populated, so `CurrentState/Id` and `LastTransition/Id` resolve to real, browsable nodes. NodeIds are per-instance, so several machines built from one definition coexist. `HasSubStateMachine` moved to the state node, with the inverse `SubStateMachineOf`, and the sub-SM is attached as a `HasComponent` child (fixing 4). Core gains element-id mapping hooks. `GetCurrentStateId` / `UpdateStateVariable` / `UpdateTransitionVariable` hard-coded the numeric form and were non-virtual, so a subclass could not redirect them. They now route through `public virtual` `GetStateNodeId` / `GetStateId` / `GetTransitionNodeId` / `GetTransitionId`, whose defaults reproduce the previous `(elementId, ElementNamespaceIndex)` convention exactly — every stack-shipped and generator-emitted machine is unaffected, and there is a regression test asserting that. Generated machines report their model namespace. The generator now emits an `ElementNamespaceUri` override on `FiniteStateMachineType` subtypes, taken from the nearest type that actually declares state children — a subtype that only adds behaviour inherits its elements, and their namespace, from its base. Ordering and validation fixes. `WithSubStateMachine` and `WithInitialState` are now order-independent (previously, attaching a sub-SM before setting the initial state left the child suspended until the parent left and re-entered the state — silently). `WithSubStateMachine` validates `parentStateId`, and the builder rejects duplicate element browse names, since element NodeIds are now derived from them. ## A defect this surfaced Code that assembles nodes with the generated `CreateInstanceOf<Type>` factories never calls `NodeState.CreateAsPredefinedNode`, so `OnBeforeCreate` / `OnAfterCreate` are skipped for the entire subtree — and `OnAfterCreate` is the only place a state machine resolves its element namespace. It is also where `ConditionState` binds its `Enable` / `Disable` / `AddComment` handlers and `AlarmConditionState` binds the shelving methods, so the impact is broader than state machines. This PR fixes only the two call sites it depends on — DI's `SoftwareUpdateFacetWiring` and Robotics' `RoboticsOperationBuilder`. The repository-wide audit is deliberately left out of scope and tracked in #4320 (24 files call these factories; none completed the lifecycle). The Robotics regression had no test coverage at all, so an assertion on `CurrentState/Id` was added and verified to fail without the fix. ## Breaking changes - Sub-state machines are no longer browsable from the state-machine root. Callers passing a machine's `ObjectId` to `GetSubStateMachineAsync` must pass a state NodeId instead — from `GetAvailableStatesAsync` or a snapshot's `CurrentStateId`. - `CurrentState/Id` for fluent machines changes from the numeric form to the materialized node's id. Code reading a numeric id out of it should call `FiniteStateMachineState.GetStateId` rather than parsing the identifier. - Generated machines qualify `CurrentState/Id` / `LastTransition/Id` with their companion-spec namespace instead of the OPC UA one. Documented in `docs/WhatsNewIn2.0.md` and `docs/StateMachines.md`. ## Notes for reviewers - Adding `virtual` to the `FiniteStateMachineState` members is a binary (not source) breaking change — assumed acceptable on the 2.0 line, but worth confirming against the compatibility policy. - Address-space cost is one node plus one property per declared state and transition, per machine instance; called out in the docs for servers instantiating many machines. - `AvailableTransitions` is modelled as a `HasComponent` `BaseDataVariable` (matching the standard NodeSet and what the client's browse path expects), not a Property. ## Related Issues - Fixes #3821 - Surfaced #4320 (node create lifecycle audit — not addressed here) ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. ### Test runs (net10.0) \| Suite \| Result \| \|---\|---\| \| `Opc.Ua.Server.Tests` (full) \| 4734 passed, 5 skipped \| \| `Opc.Ua.SourceGeneration.Core.Tests` \| 3780 passed \| \| `Opc.Ua.SourceGeneration.Tests` \| 132 passed \| \| `Opc.Ua.SourceGeneration.Stack.Tests` \| 94 passed \| \| `Opc.Ua.Types.Tests` \| 8763 passed \| \| `Opc.Ua.Robotics.Tests` \| 540 passed \| \| `Opc.Ua.Robotics.Intent.Tests` \| 22 passed \| \| `Opc.Ua.Di.Tests` \| 424 passed \| \| `Opc.Ua.ISA95.Tests` \| 136 passed \| \| `Opc.Ua.Aas.Tests` \| 670 passed \| \| `Opc.Ua.Positioning.Tests` \| 69 passed \| \| `Opc.Ua.Client.Tests` (StateMachines) \| 36 passed \| Only net10.0 was run locally; the .NET Framework leg is left to CI, hence the unchecked box above. --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-08-29 13:33:16 +00:00
Marc Schier	397db603db	Add OPC UA for Asset Administration Shell: the published OPC 30270 and v3 draft (#4244 ) # Description Implements the Asset Administration Shell companion specifications on top of `marcschier/wot-type-binding`, in two halves that a Server chooses between: * AAS V3 — the [draft](https://github.com/marcschier/opcua-drafts/tree/main/companion-specs/AAS) (`http://opcfoundation.org/UA/I4AAS/v3/`), all sixteen conformance units: the metamodel, the registry built on the abstract xRegistry base, generational materialization, federation, packages with digest-bound integrity, the Digital Product Passport vocabulary, and the Annex F bridge to WoT Thing Descriptions. * AAS V2 — the published [OPC 30270](https://reference.opcfoundation.org/specs/OPC-30270/full) (`http://opcfoundation.org/UA/I4AAS/`), which maps the AAS V2.0.1 metamodel: object model, ingestion of XML, JSON and AASX, materialization, server and client. The two are different metamodel generations rather than two revisions of one model — V2 keeps `Asset` as a first-class Identifiable, `identification.idType`, Views and ordered collections, none of which survive into V3 — so they are alternatives. A Server hosts one or the other; this is documented rather than enforced at startup. Each is named for the generation it maps (`Opc.Ua.Aas.V2`, `Opc.Ua.Aas.V3`, `AddAasV2Server`, `AddAasV3Server`), and what genuinely serves both carries no marker and sits at the root of `Opc.Ua.Aas`: the deterministic NodeId encoding and idShortPath conventions, `AasOptional<T>`, the digest rule, the materialization diagnostics, the AASX container walk, and the value and operation providers, which are keyed on `NodeId` and `Variant` and so carry no version at all. ## What is in here New libraries: `Opc.Ua.Aas`, `Opc.Ua.Aas.Server`, `Opc.Ua.Aas.Client`, `Opc.Ua.Aas.WoT`, plus `samples/Aas` and `docs/Aas.md`. Enabling changes to existing code, each needed by the above: * The OPC UA `Decimal` DataType added to `Opc.Ua.Types`, with its Part 6 §5.1.10 wire encoding. `BinaryDecoder` gained one internal member, `TryReadRemainingBodyBytes`, because a trailing field with no self-describing length cannot otherwise be read; `Decimal.Decode` is its only caller. Part 6 Table 3 types the unscaled `Value` as an OctetString whose byte count is `Length` − 2, not a length-prefixed `ByteString`, so it carries no length of its own — `DecimalEncodingTests` pins the body byte-for-byte against that mistake, and against the `Length ≤ 2` values the same table calls invalid. * The xRegistry projection engine extracted into `Opc.Ua.XRegistry.Server` and `Opc.Ua.WotCon.Server` migrated onto it (−848/+387 lines), with the WoT Connectivity tests passing unedited. * Two source-generator fixes, both of which made a model impossible to build (see below). ## Defects found and fixed along the way Running the stack end to end, rather than trusting per-area test suites, surfaced defects that no unit test caught. The ones worth a maintainer's attention: * The generator emitted non-terminating constructors. A structure field with no declared default was initialized with `new T()`, so a self-referential DataType (`AASReferenceDataType.referredSemanticId`) recursed until the stack overflowed and `AddOpcUaAas` could not load the model at all. The test host died rather than failing. Only the field that closes a cycle is now left null. * The generator omitted `new` on a redeclared placeholder. `AASOrderedSubmodelElementCollectionType` redeclares the `SubmodelElement` slot of its base type, and the generated `Add` method hid the base one without saying so, so the V2 model would not compile. No existing model could have hit either defect — both are build failures, so anything that builds today is unaffected. * The metamodel half had never worked outside its unit tests: the emitted NodeSet declared no reference-type aliases and was rejected by the loader; the Mandatory `Invoke` Method was never emitted, because a NodeSet is imported as written rather than instantiated from its type; the runtime bound at the authored namespace index instead of the one the Server assigns; and `MethodDeclarationId` was addressed in the wrong namespace. Every materializer test inspected the in-memory object graph, which cannot see whether the graph is loadable — two tests now import it exactly as `RuntimeNodeSetNodeManager` does. * The client could not see any Property member. It browsed `HasComponent` with subtypes, but `HasProperty` is a sibling under `Aggregates`, so reading a value failed and invoking failed argument validation. * Every repeated registry write forked a duplicate group and resource instead of adding a version, because the identifier was re-derived against a sibling set that already contained the entity itself. This also made the persistence bounds unreachable. * `.gitignore`'s `*/packages/` silently swallowed the whole package-integrity implementation and its tests, which would have vanished on a fresh clone. ## Specification findings Nine findings against the V3 draft are fixed in [marcschier/opcua-drafts#75](https://github.com/marcschier/opcua-drafts/pull/75). The substantive one: clause 6.1.5's absent-versus-empty rule was unsatisfiable for five container fields that materialize as parent components with no node of their own, which made `AAS-LosslessRoundTrip` unachievable. OPC 30270 contradicts itself twice. Both are recorded in `AasV2ConformanceUnits.cs` and the documentation rather than smoothed over: Table 83 spells the unit `I4AAS MultiLangaugeProperty` where Table 85 spells it correctly, and Table 85 lists an `I4AAS Security` unit that Table 83 never defines. Table 84, which would assign profile URIs, is empty, so `ServerProfileArray` gains no I4AAS entry. ## Known limitation Calling an `Operation` with arguments answers `BadTooManyArguments`. Method resolution works from both the instance NodeId and the `MethodDeclarationId`, and the argument definitions are published, but `NodeState.AddChild` does not route through `MethodState.FindChild`, so a Method imported from a NodeSet leaves its typed `InputArguments` null. Closing this means changing how the shared NodeSet import claims typed children, which affects every consumer of runtime NodeSets and is out of scope here. It is documented in `docs/Aas.md` §11, the conformance matrix marks `AAS-OperationInvoke` partial rather than claiming it, and `samples/Aas` exercises the path and reports the status rather than working around it. V2 is unaffected — its `Operation` is an OptionalPlaceholder with no declared arguments. ## Related Issues - No tracking issue yet. Opening as a draft for design discussion first, per the ADR guidance below; happy to open one and link it once the shape is agreed. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. ### Verification \| Check \| Result \| \|---\|---\| \| AAS tests \| 670 passed, 0 failed on net472, net48, net8.0, net9.0, net10.0 \| \| Coverage \| Client 80.8 %, Server 81.2 %, `Opc.Ua.Aas` 82.0 %, WoT 82.4 % — all above the 80 % gate \| \| Libraries \| `Opc.Ua.Aas`, `.Server`, `.Client`, `.WoT` build clean on every target framework, zero warnings \| \| Regression \| `Opc.Ua.Types` 8677, `Opc.Ua.WotCon` 1094, `Opc.Ua.XRegistry` 198, `Opc.Ua.Server` 4050 — all green \| \| Sample \| `samples/Aas` builds warning-free and runs end to end \| \| Merge validation \| Solution builds clean on net10.0 and net48; WoT Types 504, WotCon 1111, AAS 670, XRegistry 198 tests passed \| \| CI \| All 99 checks green on `ff9298e44`; only the CLA signature status is outstanding \| ### Review pass A full review against both specifications, and for API consistency and correctness, produced twelve fixes. Each one has a test that fails without it. \| Defect \| Where \| Why it mattered \| \|---\|---\|---\| \| V2 projection aborted on every `File` read from a document \| `AasV2EnvironmentRuntime` \| The runtime bound `File/Value` unconditionally, the materializer emitted it only with content, and the builder throws `BadNotFound` for an unknown NodeId — aborting the whole registration. No reader ever populates `AasFile.File`, so no AAS V2 document could be hosted at all. \| \| `aas-suppl` anchored on the wrong part \| `AasxPackageReaderCore`, `AasxPackageWriter` \| IDTA and the Package Explorer anchor it on the environment part; we used the origin part. Every real `.aasx` returned zero supplementary files, silently. Affects both halves. \| \| Federation failed closed on pooled connections \| `AasFederation` \| `ConnectCallback` fires only for new connections, so the second fetch to an origin — and all of net472/net48/netstandard2.1 — failed with a security-flavoured error. The peer is now validated inside the callback, which makes reuse safe by construction. \| \| Malformed `Decimal` escaped as `ArgumentOutOfRangeException` \| `BinaryDecoder` \| A declared body shorter than `Scale` produced a negative read length. Two of the three test cases had been passing for the wrong reason. \| \| V2 and V3 cross-wired their value providers \| `OpcUaAasServerBuilderExtensions` \| Both registered `IAasValueProvider`; whichever was added first served both AddressSpaces. V2 now has its own contract, so co-hosting is harmless rather than silently wrong. `EnvironmentFolder` was also bound and ignored on the V2 path. \| \| Export filter skipped three nesting kinds \| `AasEnvironmentExporter` \| Content under `Entity`, `AnnotatedRelationshipElement` and `Operation` was exported unevaluated and stamped with a Digest presenting it as complete (clause 6.5.10). List authorization paths also shifted after a denial. \| \| Concealment held at the Method but not in the projection \| `AasRegistryModel` \| `GetSubmodel` answered `BadNotFound` while an anonymous Browse revealed the node, its identifier, semanticId and digest (clause 6.5.7). \| \| File handles were unsynchronized and unowned \| `AasElementFileManager` \| The async node manager holds no lock, so concurrent Calls raced a bare `Dictionary`; sequential handles let any Session read, seek or commit another's. Writes were also unbounded. \| \| Projection host was unimplementable outside the stack \| `AasEnvironmentProjection` \| The handle demanded a type with an internal constructor — our own tests used `FormatterServices.GetUninitializedObject` to get round it. Now mirrors WotCon's interface-typed registration. \| \| Embedded `FileType` omitted 7 of 10 Mandatory members \| `AasEnvironmentMaterializer` (V2) \| OPC 10000-3 6.4.4 requires them all; without `Size` and `OpenCount` a Client cannot size a read or detect an abandoned handle. \| \| Round-trip oracle ignored most of the model \| `AasRoundTripComparer` \| `Blob`, `File`, `ReferenceElement` and `BasicEventElement` had no case arm, so their fields compared equal by falling off the switch; `valueType`, `semanticId`, `entityType` and `Key.type` were never read. The clause 6.4 losslessness claim rested on it. \| Known, unchanged: calling an `Operation` with arguments answers `BadTooManyArguments`, because `NodeState.AddChild` does not route through `MethodState.FindChild`. Documented in `docs/Aas.md` §11. Not addressed in this pass, and worth a maintainer decision: OPC 30270 §9.2 says all NodeIds of Nodes not defined in the companion specification shall not use the standard namespaces, and Table 87 marks a vendor-specific instance namespace Mandatory. Both halves currently mint instances in the companion namespace. Separating them touches NodeId minting, the runtime and the client together, so it is better done deliberately than folded into a review pass. This is a large change and touches shared code (`Opc.Ua.Types`, the source generator, the xRegistry projection). It is deliberately a draft: the enabling changes are separable if maintainers would prefer them split into their own PRs. The latest `master` is merged into this branch in `0dd0ff0e1`. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9e6a5abf-3299-4cd1-9855-010fedbf0ad8 Copilot-Session: c3d88950-4a65-4ff6-87d2-1f545a875c9b Copilot-Session: b8ab3763-b9bd-46ae-b0ef-045db26e5782	2026-08-18 08:11:47 -07:00
romanett	34fe1a1567	Emit WriteMask from the model in the source generator (#4253 ) ## Summary Isolates a self-contained OPC UA source-generator bug fix, extracted from PR #4220 (which targets a different base branch) so it can merge independently against `master`. ## Fix: Emit node WriteMask from the model Bug: The `NodeState` source generator hardcoded `global::Opc.Ua.AttributeWriteMask.None` for both the `WriteMask` and `UserWriteMask` attribute replacements. As a result, attributes declared writable in a NodeSet2 model (for example `WriteMask=96`) were emitted as `None`, so writes to those attributes failed with `BadNotWritable`. Change: - `tools/Opc.Ua.SourceGeneration.Core/Generators/NodeStateGenerator.cs` - the common node replacements now emit `root.GetWriteMaskAsCode()` for the `WriteMask` and `UserWriteMask` tokens instead of the hardcoded `AttributeWriteMask.None`. - `tools/Opc.Ua.SourceGeneration.Core/Schema/ModelDesignExtensions.cs` - adds a `GetWriteMaskAsCode(this NodeDesign node)` helper that returns `global::Opc.Ua.AttributeWriteMask.None` when `WriteAccess == 0`, otherwise `(global::Opc.Ua.AttributeWriteMask){writeMask}`. ## Tests - `tests/Opc.Ua.SourceGeneration.Core.Tests/Schema/ModelDesignExtensionsTests.cs` - adds `[TestCase]`-driven coverage for `GetWriteMaskAsCode` across representative write-mask values plus a null-node test. ## Validation - `dotnet build tools\Opc.Ua.SourceGeneration.Core\Opc.Ua.SourceGeneration.Core.csproj -c Release` - 0 warnings, 0 errors. - `dotnet test tests\Opc.Ua.SourceGeneration.Core.Tests\Opc.Ua.SourceGeneration.Core.Tests.csproj -f net8.0 -c Release` - 3775 passed, 0 failed, 8 skipped. ## Note on the Views fix (excluded) A second generator fix (preserve forward same-namespace `Organizes` references to `ViewDesign` targets in `NodeSetToModelDesign`) was intended to ship here as well, but it was excluded. That fix compensates for behavior introduced by #4220 where imported Views are promoted to top-level `ViewDesign` nodes and their `ParentNodeId` is cleared. On `master` that promotion does not happen (Views remain children of their folder), so the fix and its test do not apply and cannot be cleanly isolated. It will land with #4220. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-14 07:57:44 -07:00
romanett	cc4791e2fd	Import NodeSet2 Views as standalone top-level nodes in the source generator (#4259 ) ## Problem The NodeState source generator mishandled `UAView` nodes imported from a NodeSet2 model. When an exporter set a View's `ParentNodeId` to an organizing folder, the importer/generator absorbed the View into that folder's `Children` and tried to emit an invalid `AddChild(...)` call. Because `ViewState` derives from `NodeState` (not `BaseInstanceState`), a View can never be an `AddChild` component, so the generated code was invalid. ## Fix Make Views standalone top-level predefined nodes linked purely via `Organizes` references — mirroring how `DataType`/`ReferenceType` type nodes and `DataTypeEncoding` are handled: - `tools/Opc.Ua.SourceGeneration.Core/Schema/NodeSetToModelDesign.cs` — clear the `UAView` `ParentNodeId` so the View stays a standalone top-level node, keep the organizing folder's forward `Organizes` references to those Views, and carry the View's `ContainsNoLoops` attribute through to the `ViewDesign`. - `tools/Opc.Ua.SourceGeneration.Core/Generators/NodeStateGenerator.cs` — return `null` for `ViewDesign` in the `AddChild` and `ReplaceChild` template paths so Views are never emitted as components. - `tests/Opc.Ua.SourceGeneration.Core.Tests/Schema/NodeSetToModelDesignTests.cs` — new `ViewImport` NodeSet constant and `ImportPreservesFolderOrganizesReferencesToViews` test verifying Views are imported as top-level nodes while the organizing folder retains its forward `Organizes` references to them. ## Validation - `dotnet build tools\Opc.Ua.SourceGeneration.Core` (Release): 0 warnings / 0 errors. - `dotnet test tests\Opc.Ua.SourceGeneration.Core.Tests` (net8.0, filtered to `NodeSetToModelDesign`): all 17 tests pass, including the new `ImportPreservesFolderOrganizesReferencesToViews`. Extracted from the larger PR #4220 work — this PR contains only the source-generator View fix (no WriteMask, UserAccessLevel, NodeSet2.xml, or ReferenceNodeManager changes). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-14 07:57:06 -07:00
Marc Schier	e73e71184d	[WotCon] Add OPC UA WoT Connectivity 1.1 with the Types, source generation, Server and xRegistry work it builds on (#4128 ) ## Summary Adds OPC UA WoT Connectivity 1.1 to the stack, together with the Types, source generation, Server and xRegistry work it is built on. This branch is the merge point for the fourteen-PR stack that replaced integration PR #4093; every constituent PR was reviewed and approved separately and is listed below. 414 files changed, +108,936 / -3,199. Roughly 46k added lines of product code, 57k of tests, plus samples, tools and documentation. ## Types - Complete `ExtensionObject` raw-body decoding for binary, XML and JSON bodies by resolving the concrete type through the message context's encodeable factory, and simplify the `Variant` structure helpers by delegating to it (#4128). - Add `IAtomicFileReplace` as an optional `IFileSystem` capability so existing external implementations keep working, with atomic publish for `LocalFileSystem` via `File.Replace`/`File.Move` and for `VirtualFileSystem` by re-keying the in-memory entry (#4128). - Add lossless conversion between WoT documents and NodeSet2 (`Opc.Ua.Wot.WotNodeSetConverter`). A byte-exact `uav:nodeSet` envelope is preserved when requested, the structured `uav:nodes` projection is used when the readable vocabulary is incomplete, and NodeSet2 is otherwise synthesized from readable WoT terms. Unmapped JSON members survive a round trip as pointer-addressed residue (#4131). ## Source generation - Improve the NodeSet to ModelDesign conversion and the generated node state (#4132). - Generate OPC UA models directly from WoT Thing Description files (#4134). ## Server - Add live NodeManager shadow and immediate reload. A reload materializes a new generation beside the active one and switches atomically; the superseded generation is retired gracefully so existing MonitoredItems keep being served until they drain, or immediately when the caller asks for it. Includes the request admission and drain machinery that lets an orderly shutdown wait for admitted requests instead of tearing down underneath them (#4147). - Make subscription transfer between sessions transactional, so a failed transfer leaves neither session holding a partially moved subscription (#4150). ## xRegistry - Allow clients to use explicit registry roots rather than assuming a well-known location (#4130). ## WoT Connectivity - Add the WoT Connectivity 1.1 information model: a registry-first revision layered on the abstract xRegistry base model, incorporating the complete published OPC 10100-1 v1.02 surface as deprecated nodes in the same namespace so existing 1.02 clients keep working (#4139). - Add the protocol binding abstractions and planners that compile WoT forms into executable plans (#4140). - Add the HTTP, Modbus, OPC UA and MQTT binding executors (#4144). - Add the registry and its stores, including document versioning, validation, dependency resolution and refresh (#4146). - Add the registry client (#4142). - Materialize WoT Thing Descriptions into the server address space, deriving types from Thing Models and instances from Thing Descriptions (#4154). - Restore the WoT asset registry bridge so the deprecated 1.02 asset surface is backed by the registry (#4171). - Add the WoT Connectivity samples and complete the documentation (#4156), and restore the remaining coverage and docs (#4172). ## New projects `src/Opc.Ua.WotCon.Bindings`, `src/Opc.Ua.WotCon.Bindings.Mqtt`, `tests/Opc.Ua.WotCon.Bindings.Tests`, `tests/Opc.Ua.WotCon.Samples.Tests`, and the `samples/WotCon` AggregationServer, AggregationClient and FlatTagServer samples. ## Constituent pull requests Merged into this branch top-down, each independently approved: \| PR \| Title \| \| --- \| --- \| \| #4128 \| [Types] Complete ExtensionObject decoding and add an atomic file replace capability \| \| #4131 \| [Types] Add lossless conversion between WoT documents and NodeSet2 \| \| #4132 \| [SourceGeneration] Improve NodeSet to ModelDesign conversion and generated node state \| \| #4134 \| [SourceGeneration] Generate OPC UA models from WoT Thing Description files \| \| #4147 \| [Server] Add live NodeManager shadow and immediate reload \| \| #4150 \| [Server] Make subscription transfer between sessions transactional \| \| #4130 \| [XRegistry] Allow clients to use explicit registry roots \| \| #4139 \| [WotCon] Add the WoT Connectivity 1.1 information model \| \| #4140 \| [WotCon] Add the WoT protocol binding abstractions and planners \| \| #4144 \| [WotCon] Add the HTTP, Modbus, OPC UA and MQTT binding executors \| \| #4146 \| [WotCon] Add the WoT Connectivity registry and its stores \| \| #4142 \| [WotCon] Add the WoT Connectivity registry client \| \| #4154 \| [WotCon] Materialize WoT Thing Descriptions into the server address space \| \| #4156 \| [WotCon] Add the WoT Connectivity samples and complete the documentation \| \| #4171 \| Restore WoT asset registry bridge \| \| #4172 \| Restore WoT coverage and docs \| Supersedes #4093. ## Follow-up The WoT Connectivity and WoT Binding drafts have moved to 1.1-draft2 since this work was authored. Aligning with that revision - the removed group vocabulary, the new projection/View construct, the remaining model vocabulary terms and the two new portable-identity validation rules - is tracked separately and will follow in its own pull request. ## Validation Built for every target framework with zero warnings and zero errors, and validated at the tip of the stack with `Opc.Ua.WotCon.Tests` at 999 passed / 0 failed and `Opc.Ua.Server.Tests` at 4024 passed / 0 failed. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9e6a5abf-3299-4cd1-9855-010fedbf0ad8	2026-08-05 10:14:15 +02:00
Marc Schier	0357380335	Source generator: typed NodeSet method signatures and referenced model accessors (#4124 ) Stack 2/5 — base #4123. Part of the #4096 split; see #4096 for the overall picture. > Review after #4123. The diff shown against `master` will include #4123 until that merges. ## What this is Source generator only; no runtime library changes. ## Contents - Typed NodeSet method signatures. A method imported from a NodeSet now gets a typed signature. Methods that share a declared signature are grouped onto one generated `MethodType`, named after its owner when the plain name would collide, so two unrelated `Execute` methods no longer share a class. - An override that keeps the signature it inherits keeps the declaration it overrides. Pointing `MethodDeclarationNode` at the override itself made `MethodDeclarationId` self-referential. OPC 10000-4 lets a caller invoke a method with the NodeId of its declaration in the ObjectType or any supertype, and `MethodState.MethodDeclarationId` is what the server matches on, so `Call` stopped resolving and returned `Bad_MethodInvalid` for every alarm subtype. An override that genuinely changes its signature still becomes its own declaration. - `StateNumbers` / `TransitionNumbers` were emitted empty for every NodeSet-sourced model, because such children arrive as `VariableDesign` rather than `PropertyDesign` and were filtered out. Any companion model built from a NodeSet was writing `StateNumber = 0` on the wire — a Part 16 defect well beyond the models in this stack. The ModelDesign path is unchanged. - Referenced models can contribute fluent accessors, carried by a model dependency payload so a downstream model can extend an upstream one. ## Notes for the reviewer - `tests/Opc.Ua.SourceGeneration.Tests` is left at its `master` content here. Its new vendor-subtype test uses the Robotics NodeSet as its fixture, so it can only land with the Robotics change at the top of the stack (5/5). - `PumpInstanceNodeIdRegressionTests` gains six `InputArguments`/`OutputArguments` entries for argument-less standard condition methods. Typed method signatures materialise those properties from the `ConditionType` declaration even where the method takes none. That is a real deviation, pinned rather than hidden so it stays visible; it is worth a follow-up. ## Validation `dotnet build UA.slnx` — 0 errors. \| Suite \| Result \| \| --- \| --- \| \| Opc.Ua.SourceGeneration.Core.Tests \| 3739 / 0 \| \| Opc.Ua.SourceGeneration.Tests \| 81 / 0 \| \| Opc.Ua.Di.Tests \| 304 / 0 \| \| Opc.Ua.History.Tests \| 506 / 0 \| \| Opc.Ua.Gds.Tests \| 1095 / 0 \| History and GDS are listed because they are what the method-declaration fix above is load-bearing for: without it they fail with 10 and 370 errors respectively. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8cbb8cd0-f0cb-4ab0-bea2-6202fbf69485	2026-08-01 07:55:57 +02:00
Marc Schier	8a10139b8c	Fix OPC UA address-space compliance in the device integration stack (#4117 ) # Description A live OPC UA compliance audit of `samples/PumpDeviceIntegrationServer` against the OPC 40223 Pumps and OPC 10000-100 (DI) companion specifications found 13 address-space violations plus a serialization bug in the MCP tool. Every fix lands at its root cause in the shared stack rather than as a workaround in the sample, so all servers benefit. The sample now exposes N fully simulated pumps (`--pumps N`) and advertises the DI conformance facets it actually satisfies. > This branch has been merged with `master` including #4116 ("Add simulation to PumpDeviceIntegrationServer and Event modelling"), which independently reworked the same pump simulation and the same fluent alarm builders. See [Relationship to #4116](#relationship-to-4116) below for how the two were reconciled. ## Findings and fixes \| # \| Finding \| Root cause \| Fix \| \|---\|---------\|-----------\|-----\| \| 1 \| `OverTempAlarm` created by the fluent API did not exist in the address space \| `AttachAlarm` attached the alarm with `AddChild` but never indexed it into the node manager \| Register the node; the same gap existed in `AddObject`, `CreateInstance` and the state-machine creators \| \| 2 \| Alarms were unsubscribable — `EventNotifier = 0` everywhere, no `HasNotifier` from `Server` \| No event-source wiring at all \| Set `HasCondition`, initialise `SourceNode`/`SourceName`/`ConditionName`/`InputNode`, promote `EventNotifier` up the ancestor chain, publish `HasNotifier` from the `Server` object \| \| 3 \| Every instance NodeId was minted in the DI standard namespace (`ns=4;s=5001_Pump #1`) \| `DiNodeManager.New` inherited the parent's namespace index \| New `DiNodeManager.InstanceNamespaceIndex`; instances move to the server's application namespace \| \| 4 \| `Server/Namespaces` described only 2 of 6 namespaces \| The NodeSet2 importer drops nodes parented to namespace 0, so companion-spec metadata objects never reached the address space — and no route covered the server's own namespace \| New `NamespaceMetadataPublisher` walks the `NamespaceArray` and fills version/publication date from `ModelDependencyAttribute` \| \| 5 \| Vendor BrowseNames (`Diagnostics`, `LastError`, …) sat in the DI namespace \| Builders defaulted to the parent's namespace \| Default to the server namespace; spec-defined BrowseNames are unchanged \| \| 6 \| `AccessLevel="5"` from the Pumps NodeSet was reported as `1` \| The ModelDesign `AccessLevel` enum is not `[Flags]` and cannot represent `CurrentRead \\| HistoryRead` \| Carry the verbatim NodeSet2 bitmask and emit named `AccessLevels` constants \| \| 7 \| `Historizing = true` while `HistoryRead` returned `BadHistoryOperationUnsupported` \| Nothing reconciled the declared history surface with the wired historians \| Startup clears the advertisement (including masking the attribute read callbacks) when no provider resolves; the sample wires a real historian \| \| 8 \| Mandatory `ProductInstanceUri` unset \| Sample omission \| Populated on every pump \| \| 9 \| Mandatory `TrueState`/`FalseState` empty on every supervision boolean \| Absent in the official NodeSet; a server must still populate them \| Populated on every pump \| \| 10 \| Machinery `Machines` folder empty (OPC 40001-1 §9.2 says shall) \| `TryAddToMachinesFolder` used `AddChild`, which re-parents the device away from `DeviceSet` \| Add the `Organizes` reference instead \| \| 11 \| BrowseName contained a space and `#` \| Sample naming \| `Pump_1` with the readable label in `DisplayName` \| \| 12 \| `Maintenance` group materialised but empty \| Sample omission \| Populated \| \| 13 \| Uninitialised values reported `Good` \| No initial-value status \| `BadWaitingForInitialData` until the first simulation tick \| \| — \| `ServerProfileArray` advertised only `StandardUA2017` \| `DiNodeManager` did not implement the existing `IConformanceContributor` \| Contribute DI 1.05 server facets computed at runtime from what is actually wired, merged with `StandardUA2017` \| \| — \| MCP tool serialised boolean `false` and numeric `0` as JSON `null` \| `Variant.Null` is `default`, so `Variant.Equals` adopts the non-null type and compares against the default value \| Dispatch on `BuiltInType` and use typed `TryGetValue` accessors instead of the prohibited `AsBoxedObject` \| ## Relationship to #4116 #4116 landed on `master` while this branch was in flight and targeted overlapping ground. The merge is a union of both intents, not a fast-forward: - `AlarmBuilderExtensions` — kept both sides. #4116 contributes the parent-must-be-an-Object guard, `SetEnableState`, and the `HasEventSource` references; this branch contributes the `HasCondition` reference, condition source initialisation, registration of the alarm with the node manager so it is browsable, notifier promotion up the whole ancestor chain, and root-notifier registration. - `SupervisionBuilderExtensions` — took #4116's `SetAlarmActive`. It is more spec-correct than this branch's version: it honours `EnabledState`, resets Acked/Confirmed on activation, and computes `Retain` per OPC 10000-9 so an unacknowledged Condition stays retained after going inactive. This branch's null guard was kept so a malformed alarm cannot dereference a missing `EnabledState`. - `PumpNodeManager.Configure.cs` — took #4116's push-based simulation (`RegisterPumpSimulation`, `CreatePumpSimulation`, `IValueUpdater<T>`, `Initialize`/`Advance`/`Publish`, deterministic per-pump phase offsets) as the structure, then folded in this branch's compliance work: configurable pump count, Maintenance group, `TrueState`/`FalseState`, historian wiring, per-pump mandatory Identification values, and `BadWaitingForInitialData` until the first tick. - README — union, keeping #4116's address-space validation workflow section. Two test adjustments were needed, both because the merge legitimately changed behaviour the tests pinned: - `PumpHostedReferenceTests` now resolves pump NodeIds from the browse result instead of hard-coding the DI namespace, and waits for the first published value. `PumpCreatedAfterStartupJoinsTheLiveSimulationAsync` was added to restore #4116's coverage that a pump created after startup through `ConfigureDevicesFor` joins the live simulation. - `FluentAlarmRegistrationIntegrationTests` no longer asserts that `Retain` clears when an alarm goes inactive — that pinned this branch's weaker semantics, and #4116's Part 9 behaviour is correct. ## Breaking change Runtime-created DI device instance NodeIds move from the companion-spec namespace to the server's application namespace, e.g. `ns=<DI>;s=5001_Pump #1` becomes `ns=<application>;s=5001_Pump #1`. This invalidates NodeIds cached by clients from earlier 2.0 previews. It is not a model change — standard DI/Machinery/Pumps type NodeIds and spec-defined BrowseNames are untouched. Device integration hosting is new in 2.0, so there is nothing to migrate from 1.5.378 and this is deliberately not in `docs/MigrationGuide.md`. Anyone tracking 2.0 previews should rediscover devices by browsing `DeviceSet` rather than persisting NodeIds, and resolve namespace indexes from `NamespaceArray` per connection. ## Verification Compliance is pinned by regression tests that assert through the server's service surface (`BrowseAsync` / `ReadAsync` / `HistoryReadAsync`), not by inspecting `NodeState` objects in memory. That distinction mattered: three defects survived in-memory assertions and were only caught through the read path — most subtly, `Historizing` was cleared while `AccessLevel` still advertised `HistoryRead`, because attribute read callbacks re-applied the NodeSet bits. Post-merge on net10.0: \| Suite \| Result \| \|---\|---\| \| `Opc.Ua.Di.Tests` \| 326 passed \| \| `Opc.Ua.Server.Tests` \| 3846 passed, 5 skipped \| \| `Opc.Ua.Tools.Tests` \| 288 passed \| \| `Opc.Ua.History.Tests` \| 506 passed, 27 skipped \| \| `Opc.Ua.SourceGeneration.Core.Tests` \| 3722 passed, 8 skipped \| The full solution was also built and tested on net48 before the merge. Review feedback from `copilot-pull-request-reviewer` has been addressed in commit `badad31dc`: the shared `ServerObjectState` lock was removed (the forward `HasNotifier` edge is published through the owning node manager instead), MCP array serialization now preserves element types, and the pump option guards report the specific rejected option. The only failure is `ConfigureApplicationBuildsSharedClientAndServerConfigurationAsync`, a pre-existing certificate-store issue that passes when run in isolation and is unrelated to this change. ## Documentation Updated `docs/DeviceIntegration.md`, `docs/MigrationGuide.md`, `docs/HistoricalAccess.md`, `docs/DeveloperGuide.md`, `docs/McpServer.md`, `docs/README.md`, `samples/PumpDeviceIntegrationServer/README.md` and `tools/Opc.Ua.Mcp/README.md`, and consolidated the four node-manager documents into a single [`docs/NodeManagers.md`](docs/NodeManagers.md) — overview, built-in managers (including `MasterNodeManager`), core vs custom, registration, server address-space metadata, and source generation — with a TOC and all inbound links repointed. ## Related Issues No tracking issue exists for this work yet — it originated from an ad-hoc compliance audit of the pump sample. Given the size of the change and the runtime-breaking NodeId move, please open (or link) a tracking issue so the design is recorded as an ADR before merging. - Fixes # ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0d50c3fc-58b1-4c99-85a4-1e32c88666d9	2026-07-30 16:04:18 +02:00
Marc Schier	cfd15f08e1	Assign instance NodeIds in generated CreateOrReplace<Child> helpers (#4104 ) # Description The model source generator emits two families of instance helpers with inconsistent NodeId behaviour: * `ISystemContext.CreateInstanceOf<Type>(parent, browseName)` rebases the whole materialised subtree onto per-instance NodeIds. * `<Owner>.CreateOrReplace<Child>(context, replacement)` — the plumbing behind `NodeState.CreateChild` / `ReplaceChild` — did not. The child it produced was either bare (null NodeId, no browse name) or kept the type-level NodeId of the replacement. Any node manager mixing the two had to hand-roll a recursive re-stamp before registration, or sibling instances collided on NodeIds — a failure that only surfaces at registration time. `samples/PumpDeviceIntegrationServer` did exactly this. ## What changed Generator (`tools/Opc.Ua.SourceGeneration.Core`) * `CreateOrReplace<Child>` gains `bool assignInstanceNodeIds = true`. When enabled and the context supplies an `ISystemContext.NodeIdFactory`, a child whose NodeId is null or still equal to its declaration NodeId — and its descendants — are rebased through `NodeInstanceExtensions.AssignInstanceNodeId` / `AssignInstanceChildNodeIds`, with the owner as reference root. A NodeId the caller already assigned is never overwritten. * The helper also stamps the new child's `SymbolicName` / `BrowseName` / `DisplayName`. Without an identity, a path-based `INodeIdFactory` derives `{parent}_` for every child of a parent, so the assignment would have introduced collisions rather than removed them. `BrowseName` stamping is guarded on `context.NamespaceUris != null` — event-reporting paths pass a context without a namespace table. * All generated `Create` factory call sites pass `assignInstanceNodeIds: false`: they build declaration subtrees whose NodeIds must stay at their type-level values, and the enclosing `CreateInstanceOf<Type>` factory rebases the finished subtree in a single pass. The `CreateInstanceOf<Type>` rebase guard drops the `parent != null` requirement — supplying a `browseName` is what marks a dynamically materialised instance. Calling it without one (as the generated `NodeStateActivator`s do, and when replacing a well-known singleton) still keeps the declaration NodeIds. * `replacement` is now emitted as `BaseInstanceState?` on `CreateOrReplace<Child>` and on the generated `FindChild` override, matching the documented contract and the base `NodeState.FindChild` signature. Hand-written twins — `MethodState.CreateOrReplace{Input,Output}Arguments` and `BaseDataVariableState.CreateOrReplaceEnumStrings` gain the same parameter and behaviour, sharing a new internal `NodeInstanceExtensions.AssignNewChildInstanceNodeIds`. This is also required so the generated `public new` overrides keep hiding a matching base signature (otherwise `CS0109` with `TreatWarningsAsErrors`). Sample — `PumpDeviceIntegrationServer` now passes the real `DeviceSet` parent to the factory and drops `AssignChildNodeIds` plus the manual root stamp. Docs — new "Materialising instances at runtime — NodeId assignment" section in `SourceGeneratedNodeManagers.md` and a refreshed `DeviceIntegration.md`. ## Design note: why not the guard proposed in the issue Gating on "the owner already has an instance NodeId" cannot be implemented as `owner.NodeId != <ownerTypeNodeId>`. The generated child factories call `<Owner>.CreateOrReplace<Child>` on declaration instances — `CreatePumpType_Operational` runs on a `FunctionalGroupState` whose NodeId is `ObjectIds.PumpType_Operational`, not `ObjectTypeIds.FunctionalGroupType` — so the comparison would be true while the type template is being materialised (`forInstance: false`) and would rewrite the address space's declaration NodeIds. The explicit opt-out separates the two callers unambiguously. ## Compatibility Adding an optional parameter is source-compatible. Behaviour changes for callers of `NodeState.CreateChild` / `ReplaceChild` when the context carries a `NodeIdFactory`: the new child now carries a browse name and a per-instance NodeId instead of nothing. ## Related Issues - Fixes #4099 > [!NOTE] > The issue asks to delete `AssignChildNodeIds` from `samples/MinimalRobotServer`. That sample does not exist on `master` — it only lives on the still-open #4096 branch and carries no such helper. The equivalent boilerplate on `master` is `PumpDeviceIntegrationServer/PumpNodeManager`, which this PR cleans up. Details in [this comment](https://github.com/OPCFoundation/UA-.NETStandard/issues/4099#issuecomment-5102275507). > [!NOTE] > One commit is an unrelated one-line-scope build-hygiene fix: two `CA2000` warnings in `ConsoleReferenceClient` where subscription ownership transfers to the session. Happy to split it out if preferred. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received. ### Tests added Generator emission (`NodeManagerGeneratorTests`) — `CreateOrReplaceChildAssignsInstanceNodeIdsByDefault`, `TypeFactoriesOptOutOfCreateOrReplaceNodeIdAssignment`, `CreateInstanceOfFactoriesRebaseWithoutAnExplicitParent`. Helper behaviour (`NodeInstanceExtensionsTests`) — `CreateOrReplaceArgumentsAssignsInstanceNodeIds`, `CreateOrReplaceArgumentsKeepsCallerAssignedNodeId`, `CreateOrReplaceArgumentsHonoursTheAssignmentOptOut`, `CreateOrReplaceEnumStringsAssignsInstanceNodeIds`. Pump DI server regression (`PumpInstanceNodeIdRegressionTests`, added on review feedback): \| Test \| Asserts \| \| --- \| --- \| \| `ConfiguredPumpExposesTheFullModelSurface` \| The exact set of 77 model identifiers a configured pump materialises. \| \| `EveryPumpInstanceExposesTheSameGeneratedModelSurface` \| A second pump exposes the identical generated surface, minus what the fluent `Configure` pass adds. \| \| `MaterialisedPumpNodeIdsComeFromTheNodeIdFactory` \| Every NodeId is `{parentIdentifier}_{symbolicName}` in the parent's namespace — minted by `PumpNodeManager.New`. \| \| `MaterialisedPumpNodeIdsAreUniqueAcrossInstances` \| No NodeId is null or shared between two instances of the type. \| \| `GeneratedFactoryAssignsInstanceNodeIdsBeforeRegistration` \| The factory output already carries per-instance NodeIds before `AddPredefinedNodeAsync` applies its defensive rebase. \| \| `AlarmSubtreeKeepsStandardDeclarationNodeIds` \| Pins the alarm subtree's standard-namespace ids — a pre-existing gap outside the generated helpers. \| The 77-identifier baseline was captured by running the same subtree walk against the pre-change commit and diffing it against the post-change run: identical — same node set, same NodeIds. ### Local test runs \| Suite \| net10.0 \| net48 \| net472 \| \| --- \| --- \| --- \| --- \| \| `Opc.Ua.SourceGeneration.Core.Tests` \| 3722 passed \| 3721 passed \| — \| \| `Opc.Ua.SourceGeneration.Tests` \| 81 passed \| 81 passed \| — \| \| `Opc.Ua.SourceGeneration.Stack.Tests` \| 90 passed \| — \| — \| \| `Opc.Ua.Types.Tests` \| 8083 passed \| 8076 passed \| — \| \| `Opc.Ua.Di.Tests` \| 303 passed \| 303 passed \| 277 passed \| \| `Opc.Ua.Core.Tests` \| 4134 passed \| — \| — \| \| `Opc.Ua.Gds.Tests` \| 1095 passed \| — \| — \| \| `Opc.Ua.History.Tests` \| 506 passed \| — \| — \| \| `Opc.Ua.Server.Tests` \| 3626 passed, 1 failed \| 3574 passed, 1 failed \| — \| The single `Opc.Ua.Server.Tests` failure — `ServerFluentApiHostingTests.ConfigureApplicationBuildsSharedClientAndServerConfigurationAsync` — is pre-existing and unrelated; it reproduces on a stashed clean `master` tree. > [!NOTE] > The source-generation test harness compiles generated model code against a hand-written `Opc.Ua` API stub (`tests/Opc.Ua.SourceGeneration.Core.Tests/CompilerUtils.cs`, shared by three test projects). Its 73 `CreateOrReplace<Child>` declarations were updated to the new signature — without that, every generated call site passing `assignInstanceNodeIds: false` failed to bind. `NodesetMethodArgumentTests` pinned the exact emitted call and was updated to the new one for the same reason as the `NodeStateGeneratorTests` expectations. > [!NOTE] > `master` has been merged into this branch. The only conflict was in `NodeStateGeneratorTests.cs`, where master rewrapped the expected call-site strings while this branch appended `assignInstanceNodeIds: false` to them — kept master's wrapping and re-applied the argument. Master's two new templates (`Create_MethodArguments`, `Assign_MethodArgumentValues`) call `CreateOrReplace{Input,Output}Arguments` while building a declaration subtree, so they now pass `assignInstanceNodeIds: false` to preserve their stated intent of leaving the property node's identity untouched. > [!TIP] > Changing a source generator leaves dependent projects' cached generated output stale. If a local build reports `CS1739: ... does not have a parameter named 'assignInstanceNodeIds'` or `CS0109` on a generated `CreateOrReplace*`, run `dotnet build <project> -t:Rebuild`. Clean CI builds are unaffected. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b019f3a2-f58d-4f7e-93db-c8a0dec656e2	2026-07-28 21:22:14 +02:00
Marc Schier	5b9bcedc62	Add OPC UA ISA-95 Common Model and Job Control support (#4089 ) # Description Adds first-class support for the OPC UA ISA-95 companion specifications: - OPC-10030 Common Model. - OPC-10031-4 Job Control V1. - OPC-10031-4 Job Control V2. The change introduces `Opc.Ua.ISA95`, `Opc.Ua.ISA95.Client`, and `Opc.Ua.ISA95.Server`, together with a NativeAOT-compatible minimal server sample and comprehensive tests. ## Highlights - Compiles the three canonical NodeSets and identifier mapping CSV files through the source generator. - Adds NodeSet identifier mapping validation, typed method arguments/results, companion event records, and generated method argument nodes. - Provides typed Common Model builders with normative relationships and an injectable `GeoSpatialLocationType` provider. - Implements lossless V1/V2 Job Control providers over a shared version-neutral store, including state paths, status events, comments, response queries, catalog changes, and cohesive DI registration. - Adds subtype-aware typed clients, standalone encodeable registration, `IIsa95ClientFactory`, and V2 status-event streaming. - Adds the `MinimalIsa95Server` sample, package documentation, and an ISA-95 guide with conformance and HA guidance. - Tracks typed RSL/GPOS integration as follow-up issue #4095. ## Validation - `Opc.Ua.ISA95.Tests`: 137/137 passed on `net10.0` and `net48`. - Source-generator suites: 81/81 model, 90/90 stack, 3718 passed / 8 skipped core. - `EventRecordFieldReaders` feedback tests: 6/6 on `net10.0` and `net48`. - `EventRecordFieldReaders` changed-method patch coverage: 100% line coverage (36/36) and 100% branch coverage (22/22). - `Opc.Ua.ISA95`, `.Client`, and `.Server` build across all configured target frameworks without new diagnostics. - Cobertura line coverage: 88.08% model, 90.04% client, 91.19% server. - NativeAOT sample publishes and passes a live typed V2 Store/status-event validation. - The ISA-95 NativeAOT smoke test passes in the source-generated native test executable. - OPC UA KB NodeSet validation reports zero errors for Common, V1, and V2. The broader NativeAOT executable still reports unrelated existing GDS and complex-type test failures; the ISA-95-specific native test passes. ## Node state generator fixes Generating method arguments inline for imported nodesets regressed every model that already emits `InputArguments` / `OutputArguments` child node factories: - The inline block ran before the child factories. `MethodState.CreateOrReplaceInputArguments` keeps the property that was assigned first, so the child carrying the well-known NodeId was dropped and a NodeId-less placeholder remained in the address space. This broke browsing (reference descriptions without a target) and made method arguments unreachable at their well-known NodeIds. - The `MethodDeclarationId` fallback keyed on an autogenerated display name redirected every declared method of the standard address space to its own NodeId, which made method calls fail. The inline block is now emitted after the child factories and reduced to a value assignment when a child factory exists. The value is only re-emitted when an argument references a namespace other than OPC UA, because the value of an imported property is the verbatim XML of the source nodeset whose namespace indices do not survive the import. The `MethodDeclarationId` fallback is restricted to declarations without a resolvable NodeId. The generated OPC UA address space is byte-identical to `master` again. ## Related Issues - Fixes #4088 - Follow-up: #4095	2026-07-28 12:01:57 +02:00
Marc Schier	66be6731f4	Source generator: support compiled companion models and safe NodeState writes (#4063 ) ## Summary Combines the compiled companion-model support from #4062 with the NodeState emission fixes already in this PR. The model source generator can now consume compiled companion `NodeSet2` models more reliably, while generated factories consistently target base `NodeState` members even when a generated subclass shadows them. ## Changes ### Compiled companion NodeSets - Add `OpcUaStateTypeIndex` and wire it through `ModelSourceGenerator` / `ModelCompilation` so standard (`ns=0`) node-state and method-state class names are resolved from referenced `Opc.Ua.Core(.Types)` metadata. - Add the model-generation-scoped `StandardMethodStateFallback`, which degrades an unresolved standard typed `MethodState` reference to `global::Opc.Ua.MethodState` only when the type is neither available in the compilation nor declared by the current generation pass. - Keep declaration names outside the reference-only fallback policy, propagate fallback state through the logical execution context, reuse the immutable availability index, and use named incremental-generator inputs instead of deep `Left` / `Right` chains. - Escape generated fluent-builder XML documentation where browse names can contain XML-sensitive characters. ### Safe NodeState factory emission - Declare one base-typed `global::Opc.Ua.NodeState nodeState = state;` local per generated factory. - Use `nodeState` for base-member reads and writes to `NodeId`, `SymbolicName`, `BrowseName`, `DisplayName`, `Description`, `WriteMask`, `UserWriteMask`, `AccessRestrictions`, `ReleaseStatus`, `Categories`, `Specification` and `IsPartOfTypeHierarchy`. - Base-qualify the optional-child `previousNodeId` read, NodeId comparison, and existing-child NodeId update. - `global::`-qualify emitted `NodeId` / `ExpandedNodeId` namespace prefixes to avoid namespace collisions. ### Supporting updates - Expose `Opc.Ua.Types` internals to `Opc.Ua.Core.Encoders.Tests`. - Update generator assertions and add focused fallback regression coverage. ## Why Compiled companion models can instantiate standard types whose curated Core implementation does not expose the conventionally named typed method-state class. The scoped fallback lets those models generate without weakening the Stack generator or masking classes emitted by the current model. Separately, generated subclasses can shadow base `NodeState` properties with strongly typed `new` properties. Routing base attributes through a `NodeState`-typed local guarantees initialization reaches the intended base member while keeping generated code smaller and clearer than repeated casts. ## Validation - Full `Opc.Ua.SourceGeneration.Core.Tests` on net10.0: 3718 passed / 8 skipped / 0 failed. - Combined focused generator coverage on net48: 21 passed / 0 failed. - Full `Opc.Ua.SourceGeneration.Tests`: 68 passed / 0 failed. - Full `Opc.Ua.SourceGeneration.Stack.Tests`: 90 passed / 0 failed*. ## Context This PR supersedes #4062 and contains both source-generator change sets. The companion-model fallback remains the scoped interim workaround tracked by #4060; a future upstream name-resolution step can remove it. These changes also feed the experimental data-encodings work in #4007. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-07-21 20:48:44 +02:00
Marc Schier	7cec2d614d	Move repository files to the consolidated layout	2026-07-16 06:25:54 +02:00

24 Commits