# Description Correct ownership, endpoint validation, policy propagation, subscription delivery, file handling and generated-model behavior across the stack, tools and samples. Add focused regression tests and update the corresponding guides and sample documentation. ### Previously included corrections - Require an active, matching session to generate or access transient ResultTransfer file handles. Cover both sessionless generation and reads against a handle owned by an active session, using live session owners in the Machinery tests. - Keep physical filesystem operations within their configured mount and apply the same confinement checks throughout file operations. - Validate LDS semaphore paths consistently during server registration and registration-store maintenance. ### Individual issues addressed | # | Component | Issue and correction | |---|---|---| | 1 | AI jobs and transfers | Jobs and transfers did not consistently retain their creator's identity and session. Apply ownership checks to descendants, file handles, subscriptions and execution, and recheck deployment permissions before dispatch. | | 2 | Password-management client | Password-bearing calls could use signing-only channels or follow a replacement connection. Capture an encrypted transport generation and keep dispatch bound to it; preserve ordinary non-password edits. | | 3 | GDS and certificate-push clients | Connections omitted hostname verification. Validate the original configured DNS name or IP address before session activation. | | 4 | Certificate push | Private-key uploads could use signing-only calls. Require an encrypted, generation-bound dispatch while preserving certificate-only updates and restoring the caller's identity afterward. | | 5 | MQTT client | The .NET Framework custom-trust callback could discard TLS hostname, certificate-availability and usage errors. Retain those checks while supporting configured issuer trust. | | 6 | DTLS handshake | Certificate trust was not tied to the configured peer address. Match the certificate's DNS or IP identity to the intended endpoint. | | 7 | Replicated address spaces | Serialized nodes lost per-node and descendant permission metadata. Preserve role permissions, user-role permissions and access restrictions, including updates to existing replica nodes. | | 8 | MCP PubSub imports | Imports without groups skipped checks on the effective broker destination. Check the actual endpoint before resolving credentials or activating the connection. | | 9 | Reference-server accounts | A disabled username account could authenticate again with its previous roles. Reject disabled accounts during fresh authentication. | | 10 | Console reference client | The sample disabled hostname checks when connecting to an otherwise trusted peer. Retain the original requested host and validate it before activation. | | 11 | Capture replay and export | Replay and raw export could accept non-capture files or include key material. Require complete PCAP/PCAPNG containers and exclude key sidecars and decryption-secret blocks. | | 12 | PubSub adapter fallback | The fallback client configuration automatically accepted peer certificates. Apply normal trust and hostname validation before activation or reads. | | 13 | Kafka transport | Explicit TLS enablement was checked but did not reach both final Confluent configurations. Use the same effective protocol for validation, producers and consumers. | | 14 | PubSub actions | Configuration rebuilds could widen a connection-local action handler's scope. Preserve its original connection association and reject mismatched dispatch. | | 15 | PubSub readers | Reader-level message-protection settings were accepted but ignored. Apply the effective group and reader settings before accepting and publishing received values. | | 16 | PubSub key groups | Different `SecurityGroupId` values could share one connection-wide key context. Reject mixed groups on a connection and require separate connections for distinct groups. | | 17 | MCP session registrations | Session-name replacement or reuse could retain another registration's credential bindings. Bind access to the registration, caller and authenticated endpoint, and preserve that identity when borrowing sessions. | | 18 | Viewer HTTP host | Requests reached the viewer's OPC UA session without consistent Host, Origin and port checks. Validate the request destination and browser origin before using the session, while retaining supported local MCP clients. | | 19 | Vision file operations | File operations did not consistently apply protected-file checks, and remote handles lacked caller and connection context. Apply the shared checks and use host-side opaque handles bound to caller, target and generation. | | 20 | DTLS record integrity | The integrity-only MAC used a truncated sequence number. Authenticate the full reconstructed sequence number and epoch so records remain distinct across rollover. | | 21 | AMB client sample | Connection setup omitted hostname validation. Preserve the originally requested host and verify the peer identity before activation. | | 22 | Robot sample writes | The R2 `SpeedOverride` callback could target R1 state. Bind each callback to its own robot and apply that robot's write policy. | | 23 | AI result properties | Optional result children inherited remotely writable defaults. Preserve their declaration restrictions and keep server-produced results read-only. | | 24 | WSS peer-trust updates | Existing channels did not consistently respond to peer-trust changes. Revalidate complete chains for forward and reverse WSS channels and close only those that no longer validate. | | 25 | GDS revocation checks | Caller-provided certificates could cause issuer retrieval from embedded URLs. Resolve validation from configured local trust, issuers and CRLs without fetching caller-provided locations. | | 26 | GMS observations | Published correction observations retained writable model defaults. Reject remote writes while preserving publisher-side updates. | | 27 | Production-dataset monitoring | Subscription admission and delivery could use the reporter's context instead of each subscriber's permissions. Evaluate the subscriber at admission and on every delivery, including cancellation and disposal paths. | | 28 | WoT MQTT destinations | Hostless MQTT forms could imply a localhost destination before loopback checks. Reject them before credential lookup or connection attempts and validate the effective endpoint. | | 29 | XRegistry opaque reads | Content-ID reads and notifications did not consistently honor encrypted-read requirements or the currently accepted transport. Recheck the bound endpoint and reject transport downgrades before rebinding, including when protected values are already queued. | | 30 | PubSub capture dissection | Key loading did not consistently check the configured capture-root boundary. Check each actual key path immediately before opening it. | | 31 | PubSub publication queues | Imported WriterGroup queues were not fully checked against publish-topic grants. Check the destination actually used by each group. | | 32 | MCP PubSub mutations | A caller-supplied mode could select subscribe grants for an operation that publishes. Derive the required direction and parent context from the actual mutation. | | 33 | Generated write masks | Model import and generation could widen an explicit `UserWriteMask`. Preserve it through import, copy, merge, inheritance and dependency metadata. | | 34 | Generated method flags | An explicit `UserExecutable=false` could be lost. Preserve its specified state and resulting method behavior through the same model paths. | | 35 | Generated role identifiers | Unresolved role identifiers could cause permission entries to be omitted. Preserve namespace-qualified role IDs and report a diagnostic when a policy cannot be represented. | | 36 | Aggregation-server defaults | The `localhost` default did not reliably constrain listener binding. Use numeric loopback for the default endpoint and command-line fallback. | | 37 | Certificate-validation cache | Cached results could skip current leaf or issuer validity checks. Recheck validity windows on cache hits and keep hostname validation independent of cached chain trust. | | 38 | Software-update folders | Revision names and marker contents containing dot segments could select paths outside the software root. Normalize and check every derived path against that root. | | 39 | USDA arrays | Array elements were not encoded for their string or asset context. Escape them as data and preserve valid composition and round-trip behavior. | | 40 | Adapter hot reload | A changed dataset definition with the same name could keep old fields, subscriptions or cached values active. Compare complete immutable definitions and retire old state before replacement. | | 41 | Adapter index ranges | Subscription publication could ignore `IndexRange` and return the complete value. Preserve the requested projection and its status and timestamps; reject unsupported range providers. | | 42 | PubSub metadata and targets | Metadata from one connection could change another connection's target mapping. Scope metadata to its connection and provenance, and resolve targets using actual typed field IDs rather than field names or unintended positional fallback. | | 43 | Scales product locks | Product locks were not applied across every remote mutation path. Apply them consistently to value writes, filling calculations and related recipe/controller operations while retaining permitted updates. | | 44 | Event permission caching | Cached event decisions could outlive identity, role or node-policy changes. Revalidate the current subscriber, event type and source permissions instead of reusing a stale decision. | | 45 | WoT Modbus destinations | Hostless Modbus forms could imply localhost before loopback checks. Reject them before connecting and validate the effective endpoint. | | 46 | MCP local PKI tools | Peer-trust mutations did not consistently require the caller's `CertificateAdministration` grant. Check the capability before trust and untrust operations. | | 47 | Robot-control HTTP bridge | The bridge lacked consistent Host, Origin and port validation and caller-specific session grants. Apply those checks before borrowing the OPC UA session and retain supported local clients. | | 48 | Subscription transfers | Transferred subscriptions could retain cached notifications after the destination's permissions changed. Require authorization continuity between source and destination identities and roles, invalidate stale retransmission data when continuity fails, and preserve retransmission behavior for compatible transfers. | ### Compatibility notes - Replication uses the versioned NSRP v1 policy envelope. Upgrade peers together and re-encode or reseed legacy topology from the authoritative model; missing permission metadata is not inferred from old records. - Integrity-only DTLS peers must be upgraded together for the full sequence/epoch MAC. AEAD behavior is unchanged. - Distinct PubSub key groups require separate connections. - Custom sessions that cannot capture the actual encrypted transport, and subscription providers that cannot honor a requested range, are rejected rather than silently changing the requested behavior. - Subscription transfers retain retransmission data only when the destination authorization remains compatible with the source snapshot; otherwise the old sequence numbers and cached data are invalidated. ## Related Issues No separate tracking issue is linked. The individual corrections are listed above. ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received.
Source generation for OPC UA .NET Standard Library
This project uses C# source generators to create parts of the OPC UA .NET Standard Library at compile time. Source generators are a powerful feature in C# that allow developers to generate additional source code during the compilation process, enabling more efficient and maintainable codebases.
The OPC UA source generator is designed to automate working with the OPC UA core library in that it supports several ways to generate code at design time.
-
Generate all required classes for servers and clients from a given OPC UA information model. The model can be provided in various formats, such as NodeSet2 XML files or Model design xml file.
-
DataType Generators: These generators create classes and structures that represent OPC UA data types, ensuring that the generated code adheres to the OPC UA specifications.
Generate code from OPC UA Information Models
To generate code from OPC UA information models, you need to include the source generator in your project. This can be done by adding the appropriate NuGet package to your project file.
<PackageReference Include="Opc.Ua.SourceGeneration" Version="x.y.z" />
Once the package is added, you can configure the source generator to process your OPC UA information models.
You can do this by adding an ItemGroup to your project file that specifies the model files to be processed.
<ItemGroup>
<AdditionalFiles Include="Path\To\Your\ModelFile.xml" />
</ItemGroup>
The file to include must be part of your project and have its Build Action set to AdditionalFiles.
When you build your project, the source generator will process the specified model files and generate
the corresponding C# classes and structures.
Both ModelDesign and NodeSet2 XML files are supported, and they can be combined in one project —
a node in one input may reference a type defined in another (for example, instances authored as a
ModelDesign whose TypeDefinition points at object types authored as a NodeSet2). Every input is
supplied to the others as a resolution dependency, so such cross-model references resolve automatically.
All four NodeId identifier types defined in OPC 10000-3 5.2.2 are supported: Numeric, String, Guid
and Opaque. A ModelDesign carries them in the NumericId, StringId, GuidId and OpaqueId
attributes of a node. Because System.Guid and Opc.Ua.ByteString values cannot be C# constants,
the generated identifier fields for Guid and Opaque nodes are emitted as static readonly instead
of const.
An .xml AdditionalFiles item whose root element is neither a ModelDesign
(http://opcfoundation.org/UA/ModelDesign.xsd) nor a UANodeSet
(http://opcfoundation.org/UA/2011/03/UANodeSet.xsd) is not a model input and is skipped,
so XML files meant for other analyzers or tools can share the AdditionalFiles item group.
A Variable or VariableType that a NodeSet2 declares without a <Value> element has a null
Value (OPC 10000-6 F.5): the generated node, its CreateInstanceOf* factory and every instance
that inherits it start with Variant.Null, also when the model is consumed from a referenced
assembly. A ModelDesign declaration without a DefaultValue keeps the default value of its
DataType. A server that wants such a variable to hold a value before it has one to publish sets
it when it creates the node, for example an empty structure for a structured DataType.
Generated node factories preserve UserWriteMask independently of WriteMask
and explicit UserExecutable=false independently of Executable, including
inherited, optional and standalone declarations. Valid RolePermissions RoleIds
retain their namespace URI and identifier even when the role node is supplied
only at runtime. Unrepresentable policy identities report MODELGEN003 rather
than silently removing an ACL entry.
Referenced-model security metadata uses the versioned SEC1 extension. Legacy
dependency payloads remain readable, but malformed security extensions fail
generation. Upgrade producer and consumer generators together and regenerate
affected model assemblies; older generators cannot preserve this policy metadata.
Per-file behaviour is controlled with AdditionalFiles metadata:
| Metadata | Description |
|---|---|
ModelSourceGeneratorIgnore |
true generates no code for the input. A NodeSet2 or ModelDesign input stays available to resolve references of the other inputs (use it for a model a referenced assembly already provides); an ignored WoT input is dropped entirely (see below). |
ModelSourceGeneratorModelUri |
NodeSet2/WoT inputs only. The model (namespace) URI of the input. Required when it cannot be inferred, and used to match the input to a namespace. |
ModelSourceGeneratorName |
NodeSet2/WoT inputs only. Overrides the generated Namespaces class identifier for the model. |
ModelSourceGeneratorPrefix |
NodeSet2/WoT inputs only. Overrides the C# namespace / prefix under which the model's types are generated. For a NodeSet2 input this defaults to a value derived from the model URI — set it explicitly to choose the generated C# namespace. A Prefix declared inside a referencing ModelDesign's <opc:Namespaces> does not rename the referenced model's generated types. |
A ModelDesign input declares its model URI, prefix and version itself (TargetNamespace and
<opc:Namespaces>), so the URI/name/prefix/version metadata has no effect on it.
The generated namespace also exposes ModelVersions.Target, which is the target
model's declared version. Use it when a host needs to publish the companion
specification version without maintaining a second literal.
<ItemGroup>
<AdditionalFiles Include="Model\EquipmentTypes.NodeSet2.xml">
<ModelSourceGeneratorModelUri>http://example.org/EquipmentTypes</ModelSourceGeneratorModelUri>
<ModelSourceGeneratorPrefix>Example.EquipmentTypes</ModelSourceGeneratorPrefix>
</AdditionalFiles>
<!-- A ModelDesign declares its own model URI (TargetNamespace). -->
<AdditionalFiles Include="Model\Instances.ModelDesign.xml" />
</ItemGroup>
See Source-Generated NodeManagers for the end-to-end pattern.
Generate code from WoT Thing Models / Thing Descriptions
An AdditionalFiles input can also be a W3C Web of Things (WoT) Thing Model or Thing Description. It is converted in memory to a NodeSet2 document (using the Opc.Ua.Wot converter) before the normal NodeSet2/ModelDesign pipeline above runs — the rest of the generator cannot tell the difference. No file or network I/O beyond the supplied AdditionalFiles content is performed, and externally referenced TD/TM documents are not resolved.
The following extensions are always recognized as WoT model input:
| Extension | Content |
|---|---|
.tm.json |
Thing Model, plain JSON |
.td.json |
Thing Description, plain JSON |
.tm.jsonld |
Thing Model, JSON-LD |
.td.jsonld |
Thing Description, JSON-LD |
A plain .jsonld file is not treated as a WoT input by default — arbitrary JSON-LD is not consumed as a model. Opt a specific file in with the ModelSourceGeneratorWot metadata:
<ItemGroup>
<AdditionalFiles Include="Model\Sensor.jsonld">
<ModelSourceGeneratorWot>true</ModelSourceGeneratorWot>
</AdditionalFiles>
</ItemGroup>
The same per-file model metadata described above (ModelSourceGeneratorModelUri, ModelSourceGeneratorName, ModelSourceGeneratorPrefix, and ModelSourceGeneratorVersion) is preserved after a WoT document is wrapped as an in-memory NodeSet2 file. ModelSourceGeneratorIgnore=true is applied earlier: the WoT file is excluded before its contents are read or converted, so it emits no WoT diagnostics or sources and does not participate in dependency or synthesized-path collision resolution.
A malformed or unsupported WoT document never crashes the generator. Instead it is reported through one of these diagnostics, and the affected input is excluded from generation while every other input continues to be processed:
| Diagnostic | Meaning |
|---|---|
MODELGEN030 |
The document could not even be parsed as JSON, or exceeded a configured resource bound. |
MODELGEN031 |
The converter reported an error (a resource bound, a missing preservation envelope/native mapping, a dependency/resolver failure, or another conversion error). The Opc.Ua.Wot.WotDiagnosticCode is embedded in the message. |
MODELGEN032 |
The converter reported a warning (for example an unresolved dependency reference); generation continues with the best-effort result. |
MODELGEN033 |
The converter reported an informational note (for example a deterministically generated NodeId). |
MODELGEN034 |
The in-memory NodeSet2 path synthesized for a WoT input (for example Foo.tm.json → Foo.NodeSet2.xml) collides with an explicitly supplied .NodeSet2.xml or with another WoT input's synthesized path. Rename one of the inputs, or set distinct ModelSourceGeneratorName/ModelSourceGeneratorPrefix metadata. |
Using DataType Generators
The OPC UA source generator includes several data type generators that can be used to create classes by annotating your existing code with specific attributes. Here are some of the available data type generators:
DataTypeAttribute
Generates IEncodeable implementation for your class. Simply annotate your class with the [DataType] attribute
to generate the necessary serialization and deserialization code and other required implementation.
The [DataContract} and [DataMember] attributes from System.Runtime.Serialization can be used to
control the serialization behavior.
[DataType(TypeId = "nsu=http://your-namespace-uri/;i=1000")]
public partial class MyCustomDataType
{
[DataMember(Order = 1)]
public int Id { get; set; }
[DataMember(Order = 2)]
public string Name { get; set; }
}
IMPORTANT: your class must be a partial class with a default constructor for the source generator to work. Do not implement the
IEncodeableinterface yourself, as this will conflict with the generated code.
The source generator generates the necessary implementation for the IEncodeable interface, including
methods for encoding and decoding the data type. If the type extends another type this type also must
be annotated with the [DataType] attribute to be included in the source generation. Only the properties
of the annotated type will be part of the generated implementation.
If the structure is abstract the type will be generated as abstract as well.
The following functionality will be implemented over time
- Record types and structs
- Support for generating structures with optional fields, option set and union types
- Support to understand nullable annotation for optional fields
- Support for generating collection types (arrays, lists, etc.)
- Support for generating complex types with nested data types. If the type references other data types, these must be built in or implement IEncodeable to be included.
ObjectType client proxies
In addition to data type generation, the source generator emits a strongly
typed asynchronous client proxy for every ObjectType defined in the
processed model. Each emitted class is named {TypeName}Client and exposes
the OPC UA methods declared by that ObjectType as await-able C# methods
that internally translate to a CallRequest over an ISessionClient.
Inheritance and shadowing
Generated proxies form an inheritance chain that mirrors the OPC UA type hierarchy:
- If an ObjectType derives from another ObjectType, its proxy derives
from that parent's proxy — even when the parent lives in a different
assembly (e.g.
DirectoryTypeClient : Opc.Ua.FolderTypeClient). - The roots of the chain (types that derive directly from
BaseObjectType) ultimately inherit from the hand-authored abstract baseOpc.Ua.ObjectTypeClient, which provides theSession,ObjectId,Telemetryproperties and theCallMethodAsynchelper used by every generated wrapper. - When an ObjectType declares a method with the same browse name as an
ancestor method but a different signature, the generated wrapper is
emitted with the C#
newmodifier so the derived signature shadows the inherited one.
The standard UA stack ships with proxies for every ObjectType in the
core NodeSet (e.g. FileTypeClient, TrustListTypeClient,
ServerConfigurationTypeClient, …) emitted into the Opc.Ua namespace,
so downstream models can simply derive from them.
For an ergonomic, System.IO-style async client built on top of the
generated FileTypeClient / FileDirectoryTypeClient /
TemporaryFileTransferTypeClient proxies, see
docs/FileSystemClient.md.
Output namespace
By default each model emits its proxies into its own namespace — the C# prefix of the model's target namespace. For example:
| Model | Proxy namespace |
|---|---|
| Standard UA | Opc.Ua |
| GDS | Opc.Ua.Gds |
| Custom NodeSet | matches the model's target namespace prefix |
To redirect proxy emission to a different namespace, set the
ModelSourceGeneratorObjectTypeProxyNamespace MSBuild property.
MSBuild properties
The proxy generator is controlled by the following MSBuild properties on the consuming project:
| Property | Description |
|---|---|
ModelSourceGeneratorOmitObjectTypeProxies |
Set to true to suppress emission of *TypeClient proxies. By default proxies are emitted for every ObjectType in the model alongside the standard model output (constants, NodeIds, NodeStates, DataTypes, schemas). |
ModelSourceGeneratorObjectTypeProxyNamespace |
Optional. Overrides the C# namespace used for the emitted proxy classes. Defaults to the model's own namespace. |
ModelSourceGeneratorUseTypeDefinitionModellingRules |
Set to true to make instance code generation use the modelling rules from the referenced type definition unconditionally, rather than the overridden rules on the instance. Off by default; enabled by default for stack generation. Note: regardless of this setting, the generator always enforces OPC UA modelling rule promotion semantics — instances may only promote the type definition's rule (Optional→Mandatory, OptionalPlaceholder→Mandatory|MandatoryPlaceholder, MandatoryPlaceholder→Mandatory); demotions are silently rejected. |
ModelSourceGeneratorEmitNodeSetNodesOnly |
Set to true to make the predefined nodes generated for a NodeSet2 input exactly the nodes of the NodeSet2. A subtype then does not get copies of the Mandatory InstanceDeclarations of its supertypes (with NodeIds the NodeSet2 never assigned), and an instance does not get children its NodeSet2 does not declare, or references to them. Typed state classes and the CreateInstanceOf* factories are not affected: an instance created at run time still gets every Mandatory descendant of its type. Off by default; ModelDesign inputs are not affected. |
Example (suppress proxy emission for a model that does not need them):
<PropertyGroup>
<ModelSourceGeneratorOmitObjectTypeProxies>true</ModelSourceGeneratorOmitObjectTypeProxies>
</PropertyGroup>
Optional client member accessors
Client variable accessors and placeholder enumerators are off by default. A client library can opt in over a referenced model assembly that already supplies the matching model URI, C# prefix and generated ObjectType proxies:
<PropertyGroup>
<ModelSourceGeneratorClientAccessorsOnly>true</ModelSourceGeneratorClientAccessorsOnly>
<ModelSourceGeneratorClientAccessorNamespace>Example.Client</ModelSourceGeneratorClientAccessorNamespace>
<ModelSourceGeneratorClientAccessorClassName>ExampleClientMembers</ModelSourceGeneratorClientAccessorClassName>
</PropertyGroup>
Reference Opc.Ua.Client, the model assembly and the source generator, and supply
the same NodeSet2 or ModelDesign input as an AdditionalFile, with its original
model URI and prefix metadata. Include any required identifier sidecars.
Import OPCFoundation.Opc.Ua.SourceGeneration.props as for normal model generation.
Only client extensions are emitted: no duplicate states, data types, proxies, schemas, or model-dependency metadata. The existing model and dependency readers resolve types and codecs; the checked-in XML remains the source of truth. This mode cannot be combined with fluent-accessor-only or NodeManager generation. A missing or differently prefixed model producer is a generation error.
| Property | Default | Purpose |
|---|---|---|
ModelSourceGeneratorClientAccessorsOnly |
false |
Emit client extensions over a referenced model. |
ModelSourceGeneratorClientAccessorNamespace |
Model prefix plus .Client |
Namespace for the extensions. |
ModelSourceGeneratorClientAccessorClassName |
Model name plus ClientMembers |
Partial extension class name. |
Each fixed-name declared variable gets a <Name>Variable() extension returning
ClientVariable<T>, with exact generated/native codecs and the declared write
permission. Reads preserve the original DataValue, quality and timestamps in
ClientRead<T>; writes still require server authorization. Observations use the
existing streaming subscription. Repeated Object placeholders get typed
Enumerate<Name>Async() extensions, including conforming vendor subtypes.
The helpers use the proxy's existing ISession or ManagedSession, not a second
connection owner. Unavailable optional variables are not fabricated as defaults.
Implementation details
The source generator is implemented using the Roslyn API,which provides a rich set of tools for analyzing
and generating C# code. The generator finds all marker attributes such as [DataType] in your code and
builds the model design from it. It then processes the model design to generate the necessary C# code.
The annotated types are grouped by namespace. Each namespace will result in a separate generated file.
A namespace can be annotated with a namespace URI which