OPCFoundation
diff --git a/‎.azurepipelines/ci.yml‎
Lines changed: 7 additions & 0 deletions b/‎.azurepipelines/ci.yml‎
Lines changed: 7 additions & 0 deletions
diff --git a/‎.azurepipelines/sln.yml‎
Lines changed: 5 additions & 1 deletion b/‎.azurepipelines/sln.yml‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎.azurepipelines/test.yml‎
Lines changed: 4 additions & 0 deletions b/‎.azurepipelines/test.yml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎.github/workflows/codeql-analysis.yml‎
Lines changed: 10 additions & 0 deletions b/‎.github/workflows/codeql-analysis.yml‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎Nuget.Config‎
Lines changed: 5 additions & 0 deletions b/‎Nuget.Config‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 29 additions & 6 deletions b/‎README.md‎
Lines changed: 29 additions & 6 deletions
diff --git a/‎Samples/GDS/ClientControls/Controls/DeviceOnboardingDialog.cs‎
Lines changed: 6 additions & 6 deletions b/‎Samples/GDS/ClientControls/Controls/DeviceOnboardingDialog.cs‎
Lines changed: 6 additions & 6 deletions
diff --git a/‎Samples/GDS/Common/DeviceRegistrarNodeManager.cs‎
Lines changed: 26 additions & 9 deletions b/‎Samples/GDS/Common/DeviceRegistrarNodeManager.cs‎
Lines changed: 26 additions & 9 deletions
diff --git a/‎Tests/SampleClients.Tests/GdsClientTests.cs‎
Lines changed: 7 additions & 7 deletions b/‎Tests/SampleClients.Tests/GdsClientTests.cs‎
Lines changed: 7 additions & 7 deletions
diff --git a/‎docs/TESTING.md‎
Lines changed: 2 additions & 1 deletion b/‎docs/TESTING.md‎
Lines changed: 2 additions & 1 deletion
@@ -28,7 +28,14 @@ jobs:
   pool:
     vmImage: $(poolImage)
   steps:
+  # The OPC UA preview packages come from the OPC Foundation GitHub Packages
+  # feed, which requires authentication even though it is public. The
+  # Github-Feed NuGet service connection holds the credentials (a GitHub
+  # personal access token with the read:packages scope) for the feed URL
+  # declared in Nuget.Config, see 'Preview NuGet feed' in README.md.
   - task: NuGetAuthenticate@1
+    inputs:
+      nuGetServiceConnections: 'Github-Feed'
   - task: NuGetToolInstaller@1
     inputs:
       versionSpec: '>=7.0.x'
 
@@ -3,11 +3,15 @@
 #
 jobs:
 - job: buildallsln
-  displayName: Build Solutions 
+  displayName: Build Solutions
   pool:
     vmImage: 'windows-2025-vs2026'
   steps:
+  # see ci.yml: the Github-Feed NuGet service connection authenticates the
+  # OPC Foundation GitHub Packages feed declared in Nuget.Config.
   - task: NuGetAuthenticate@1
+    inputs:
+      nuGetServiceConnections: 'Github-Feed'
   - task: UseDotNet@2
     displayName: 'Install .NET 10.0'
     inputs:
 
@@ -18,7 +18,11 @@ jobs:
     DOTNET_CLI_TELEMETRY_OPTOUT: true
     DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
   steps:
+  # see ci.yml: the Github-Feed NuGet service connection authenticates the
+  # OPC Foundation GitHub Packages feed declared in Nuget.Config.
   - task: NuGetAuthenticate@1
+    inputs:
+      nuGetServiceConnections: 'Github-Feed'
   - task: UseDotNet@2
     displayName: 'Install .NET 10.0'
     inputs:
 
@@ -24,6 +24,9 @@ jobs:
     permissions:
       actions: read
       contents: read
+      # read the OPC UA preview packages from the OPC Foundation GitHub
+      # Packages feed declared in Nuget.Config
+      packages: read
       security-events: write
 
     strategy:
@@ -57,6 +60,13 @@ jobs:
     - name: Setup MSBuild.exe
       uses: microsoft/setup-msbuild@v3.0.0
 
+    # The preview packages come from the OPC Foundation GitHub Packages feed,
+    # which requires authentication even though it is public. The workflow
+    # token is enough to read public packages; the credentials are written
+    # into the checked-out Nuget.Config, which the restores below read.
+    - name: Authenticate GitHub Packages
+      run: dotnet nuget update source opcfoundation-github --username "${{ github.actor }}" --password "${{ secrets.GITHUB_TOKEN }}" --store-password-in-clear-text --configfile Nuget.Config
+
     - name: Restore Packages
       run: |
         nuget restore "UA Quickstart Applications.sln"
 
@@ -3,5 +3,10 @@
   <packageSources>
     <clear/>
     <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+    <!-- Preview packages of the OPC UA .NET Standard stack, published by the
+         nuget-publish workflow of OPCFoundation/UA-.NETStandard on every master
+         build. GitHub Packages requires authentication even for public feeds:
+         use a personal access token with read:packages scope, see README.md. -->
+    <add key="opcfoundation-github" value="https://nuget.pkg.github.com/OPCFoundation/index.json" protocolVersion="3" />
   </packageSources>
 </configuration>
@@ -126,13 +126,36 @@ These paired client/server samples each demonstrate a specific OPC UA feature se
 ## Getting Started
 All the tools you need for .Net Standard come with the .Net Core tools. See [here](https://docs.microsoft.com/en-us/dotnet/articles/core/getting-started) for what you need.
 
-## Preview NuGet packages
+## Preview NuGet feed
 
-The samples build against the preview packages of the OPC UA .NET Standard stack from the
-public [nuget.org](https://www.nuget.org/packages/OPCFoundation.NetStandard.Opc.Ua/) feed -
-no authentication or extra package source is needed. The version the samples currently build
-against is pinned in a single place, the `OpcUaNetStandardVersion` property in
-[targets.props](targets.props).
+The samples build against the preview packages of the OPC UA .NET Standard stack, which
+[the nuget-publish workflow](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/.github/workflows/nuget-publish.yml)
+publishes to the [GitHub Packages feed of the OPC Foundation organization](https://github.com/orgs/OPCFoundation/packages)
+on every master build. The feed is declared in [Nuget.Config](Nuget.Config):
+
+```
+https://nuget.pkg.github.com/OPCFoundation/index.json
+```
+
+GitHub Packages requires authentication even for public feeds. To restore locally, create a
+[personal access token](https://github.com/settings/tokens) with the `read:packages` scope and store
+it for the feed once (in your user-level NuGet configuration, not in the repository):
+
+```
+dotnet nuget update source opcfoundation-github --username <your-github-username> --password <your-token> --store-password-in-clear-text
+```
+
+Alternatively add the credentials to `%AppData%\NuGet\NuGet.Config` (Windows) or
+`~/.nuget/NuGet/NuGet.Config` (Linux/macOS) with the same `opcfoundation-github` key.
+
+The [Azure DevOps pipelines](.azurepipelines) authenticate through the `Github-Feed` NuGet
+service connection of the Azure DevOps project, which the `NuGetAuthenticate` task hands to
+the restore steps. The service connection is of type NuGet with basic authentication: the
+feed URL must match the one in [Nuget.Config](Nuget.Config) exactly, the username can be
+anything, and the password is a token with the `read:packages` scope as above.
+
+The version the samples currently build against is pinned in a single place, the
+`OpcUaNetStandardVersion` property in [targets.props](targets.props).
 
 ## Debugging the Opc.Ua.Core Nuget packages
 
 
@@ -264,29 +264,29 @@ private async Task CallRegistrarAsync(bool register)
             {
                 var client = new OnboardingClient(m_session, m_registrarNodeId, m_telemetry);
 
-                byte[][] tickets = new byte[m_tickets.Count][];
+                ByteString[] tickets = new ByteString[m_tickets.Count];
 
                 for (int ii = 0; ii < m_tickets.Count; ii++)
                 {
-                    tickets[ii] = m_tickets[ii].Ticket;
+                    tickets[ii] = m_tickets[ii].Ticket.ToByteString();
                 }
 
-                int[] results = register
+                ArrayOf<StatusCode> results = register
                     ? await client.RegisterTicketsAsync(tickets)
                     : await client.UnregisterTicketsAsync(tickets);
 
                 for (int ii = 0; ii < TicketsListView.Items.Count; ii++)
                 {
-                    TicketsListView.Items[ii].SubItems[2].Text = ii < results.Length
-                        ? new StatusCode((uint)results[ii]).ToString()
+                    TicketsListView.Items[ii].SubItems[2].Text = ii < results.Count
+                        ? results[ii].ToString()
                         : "---";
                 }
 
                 StatusLabel.Text = String.Format(
                     CultureInfo.CurrentCulture,
                     "{0} {1} ticket(s).",
                     register ? "Registered" : "Unregistered",
-                    results.Length);
+                    results.Count);
             }
             catch (Exception exception)
             {
 
@@ -82,14 +82,17 @@ public class DeviceRegistrarNodeManager : AsyncCustomNodeManager
         private readonly ITicketStore m_ticketStore;
 
         /// <summary>
-        /// Creates the node manager over the supplied ticket store.
+        /// Creates the node manager over the supplied ticket store. The Onboarding
+        /// companion model namespace is the manager's second namespace, because the two
+        /// Method nodes carry the model's type-declaration NodeIds - see
+        /// <see cref="CreateTicketMethod"/>.
         /// </summary>
         /// <exception cref="ArgumentNullException"><paramref name="ticketStore"/> is <c>null</c>.</exception>
         public DeviceRegistrarNodeManager(
             IServerInternal server,
             ApplicationConfiguration configuration,
             ITicketStore ticketStore)
-            : base(server, configuration, NamespaceUri)
+            : base(server, configuration, NamespaceUri, Opc.Ua.Onboarding.Namespaces.OpcUaOnboarding)
         {
             m_ticketStore = ticketStore ?? throw new ArgumentNullException(nameof(ticketStore));
         }
@@ -110,8 +113,14 @@ public override async ValueTask CreateAddressSpaceAsync(
             };
             #pragma warning restore CA2000
 
-            MethodState register = CreateTicketMethod(registrar, "RegisterTickets");
-            MethodState unregister = CreateTicketMethod(registrar, "UnregisterTickets");
+            MethodState register = CreateTicketMethod(
+                registrar,
+                "RegisterTickets",
+                Opc.Ua.Onboarding.MethodIds.DeviceRegistrarAdminType_RegisterTickets);
+            MethodState unregister = CreateTicketMethod(
+                registrar,
+                "UnregisterTickets",
+                Opc.Ua.Onboarding.MethodIds.DeviceRegistrarAdminType_UnregisterTickets);
 
             registrar.AddChild(register);
             registrar.AddChild(unregister);
@@ -139,21 +148,29 @@ public override async ValueTask CreateAddressSpaceAsync(
         /// </summary>
         /// <remarks>
         /// <para>
-        /// Two details are dictated by the SDK rather than by Part 21. The BrowseNames are
-        /// created in namespace 0, because <c>OnboardingClient</c> resolves the two Methods
-        /// with an ns=0 browse path and finds nothing otherwise. And the <c>Tickets</c>
+        /// Three details are dictated by the SDK rather than by Part 21, and they let both
+        /// client generations call the Methods. The NodeId is the type-declaration MethodId
+        /// of the Onboarding companion model, because the current generated
+        /// <c>OnboardingClient</c> calls that id on the wrapped instance directly - which
+        /// OPC UA Part 4 permits - and this hand-built registrar has no instantiated type to
+        /// answer for it otherwise. The BrowseName stays in namespace 0, because the earlier
+        /// <c>OnboardingClient</c> generation resolves the Methods with an ns=0 browse path.
+        /// And the <c>Tickets</c>
         /// argument is declared as a <c>ByteString</c> array rather than as the Part 21
         /// <c>EncodedTicket</c> alias: <c>MethodState</c> type-checks every input argument
         /// against the declared DataType, and ns=0 models <c>EncodedTicket</c> with
         /// <c>String</c> as its base type, so the ByteString array both halves of the SDK
         /// actually exchange would be rejected with <c>Bad_TypeMismatch</c>.
         /// </para>
         /// </remarks>
-        private MethodState CreateTicketMethod(NodeState parent, string name)
+        private MethodState CreateTicketMethod(
+            NodeState parent,
+            string name,
+            ExpandedNodeId typeMethodId)
         {
             #pragma warning disable CA2000 // Justification: Node ownership is transferred to the server address space.
             var method = new MethodState(parent) {
-                NodeId = new NodeId(name, NamespaceIndex),
+                NodeId = ExpandedNodeId.ToNodeId(typeMethodId, SystemContext.NamespaceUris),
                 BrowseName = new QualifiedName(name),
                 DisplayName = new LocalizedText(name),
                 ReferenceTypeId = ReferenceTypeIds.HasComponent,
 
@@ -536,24 +536,24 @@ private static async Task RegisterAnOnboardingTicketAsync(
                 ExpandedNodeId.ToNodeId(registrar.NodeId, gdsClient.Session.NamespaceUris),
                 NullTelemetry.Instance);
 
-            byte[][] tickets = [[1, 2, 3, 4]];
+            ByteString[] tickets = [new byte[] { 1, 2, 3, 4 }.ToByteString()];
 
-            int[] registered = await client.RegisterTicketsAsync(tickets, ct).ConfigureAwait(true);
+            ArrayOf<StatusCode> registered = await client.RegisterTicketsAsync(tickets, ct).ConfigureAwait(true);
 
-            Assert.That(registered, Has.Length.EqualTo(1), "RegisterTickets did not report a result per ticket.");
+            Assert.That(registered.Count, Is.EqualTo(1), "RegisterTickets did not report a result per ticket.");
             Assert.That(
-                StatusCode.IsGood(new StatusCode((uint)registered[0])),
+                StatusCode.IsGood(registered[0]),
                 Is.True,
                 "The registrar rejected the ticket.");
 
             phase.Enter("removing the onboarding ticket again");
 
-            int[] removed = await client.UnregisterTicketsAsync(tickets, CancellationToken.None)
+            ArrayOf<StatusCode> removed = await client.UnregisterTicketsAsync(tickets, CancellationToken.None)
                 .ConfigureAwait(true);
 
-            Assert.That(removed, Has.Length.EqualTo(1), "UnregisterTickets did not report a result per ticket.");
+            Assert.That(removed.Count, Is.EqualTo(1), "UnregisterTickets did not report a result per ticket.");
             Assert.That(
-                StatusCode.IsGood(new StatusCode((uint)removed[0])),
+                StatusCode.IsGood(removed[0]),
                 Is.True,
                 "The registrar did not remove the ticket it had just accepted.");
         }
 
@@ -322,7 +322,8 @@ is what every other sample in the repository uses.
 `s_knownIssues` in `SampleServerTests` (and the same list in `SampleClientTests`) reports a
 listed sample as **ignored** rather than failed, and fails the moment it starts working, so
 an entry cannot rot. Both lists are used sparingly: a sample that is broken is worth fixing,
-not parking. Both lists are currently empty.
+not parking. Both lists are currently empty - the StateMachines subscription failure that
+was briefly parked turned out to be the test pressing the wrong cause, fixed for good.
 
 ## What Tier 1.5 checks today
Original file line number	Diff line number	Diff line change
`@@ -264,29 +264,29 @@ private async Task CallRegistrarAsync(bool register)`
`264`	`264`	`{`
`265`	`265`	`var client = new OnboardingClient(m_session, m_registrarNodeId, m_telemetry);`
`266`	`266`
`267`		`- byte[][] tickets = new byte[m_tickets.Count][];`
	`267`	`+ ByteString[] tickets = new ByteString[m_tickets.Count];`
`268`	`268`
`269`	`269`	`for (int ii = 0; ii < m_tickets.Count; ii++)`
`270`	`270`	`{`
`271`		`- tickets[ii] = m_tickets[ii].Ticket;`
	`271`	`+ tickets[ii] = m_tickets[ii].Ticket.ToByteString();`
`272`	`272`	`}`
`273`	`273`
`274`		`- int[] results = register`
	`274`	`+ ArrayOf<StatusCode> results = register`
`275`	`275`	`? await client.RegisterTicketsAsync(tickets)`
`276`	`276`	`: await client.UnregisterTicketsAsync(tickets);`
`277`	`277`
`278`	`278`	`for (int ii = 0; ii < TicketsListView.Items.Count; ii++)`
`279`	`279`	`{`
`280`		`- TicketsListView.Items[ii].SubItems[2].Text = ii < results.Length`
`281`		`- ? new StatusCode((uint)results[ii]).ToString()`
	`280`	`+ TicketsListView.Items[ii].SubItems[2].Text = ii < results.Count`
	`281`	`+ ? results[ii].ToString()`
`282`	`282`	`: "---";`
`283`	`283`	`}`
`284`	`284`
`285`	`285`	`StatusLabel.Text = String.Format(`
`286`	`286`	`CultureInfo.CurrentCulture,`
`287`	`287`	`"{0} {1} ticket(s).",`
`288`	`288`	`register ? "Registered" : "Unregistered",`
`289`		`- results.Length);`
	`289`	`+ results.Count);`
`290`	`290`	`}`
`291`	`291`	`catch (Exception exception)`
`292`	`292`	`{`