GraphKit

0.2.0

GraphKit.psd1

                                #

# Module manifest for module 'GraphKit'

#

# Generated by: Adam Gell

#

# Generated on: 8/15/2026

#

@{

# Script module or binary module file associated with this manifest.

RootModule = 'GraphKit.psm1'

# Version number of this module.

ModuleVersion = '0.2.0'

# Supported PSEditions

# CompatiblePSEditions = @()

# ID used to uniquely identify this module

GUID = '212637ed-2571-4e88-8df2-888a0c163ccd'

# Author of this module

Author = 'Adam Gell'

# Company or vendor of this module

CompanyName = 'Adam Gell'

# Copyright statement for this module

Copyright = '(c) Adam Gell. All rights reserved.'

# Description of the functionality provided by this module

Description = 'App-only, multi-tenant Microsoft Graph execution and analysis layer with explicit Intune and Entra operation semantics.'

# Minimum version of the PowerShell engine required by this module

PowerShellVersion = '7.4'

# Name of the PowerShell host required by this module

# PowerShellHostName = ''

# Minimum version of the PowerShell host required by this module

# PowerShellHostVersion = ''

# Minimum version of Microsoft .NET Framework required by this module. This prerequisite is valid for the PowerShell Desktop edition only.

# DotNetFrameworkVersion = ''

# Minimum version of the common language runtime (CLR) required by this module. This prerequisite is valid for the PowerShell Desktop edition only.

# ClrVersion = ''

# Processor architecture (None, X86, Amd64) required by this module

# ProcessorArchitecture = ''

# Modules that must be imported into the global environment prior to importing this module

RequiredModules = @(

    # MSAL delivery vehicle only - Connect-MgGraph is never called. See the design spec.

    @{ ModuleName = 'Microsoft.Graph.Authentication'; ModuleVersion = '2.38.1' }

    @{ ModuleName = 'Microsoft.PowerShell.SecretManagement'; ModuleVersion = '1.1.2' }

)

# Assemblies that must be loaded prior to importing this module

# RequiredAssemblies = @()

# Script files (.ps1) that are run in the caller's environment prior to importing this module.

# ScriptsToProcess = @()

# Type files (.ps1xml) to be loaded when importing this module

# TypesToProcess = @()

# Format files (.ps1xml) to be loaded when importing this module

# CopyPaths in build.yaml only PACKAGES the format file; it must also be

# REGISTERED here or default views silently never apply.

FormatsToProcess = @('Formats/GraphKit.Format.ps1xml')

# Modules to import as nested modules of the module specified in RootModule/ModuleToProcess

# NestedModules = @()

# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.

FunctionsToExport = @('Compare-GraphPermission','Export-GraphResult','Get-GraphAppRegistrationPermission','Get-GraphContext','Get-GraphObject','Get-GraphOperation','Get-GraphTenant','Grant-GraphAppPermission','Import-GraphLegacyProfile','Invoke-GraphBatch','Invoke-GraphOperation','Register-GraphTenant','Remove-GraphTenant','Test-GraphPermission','Test-GraphTenant','Use-GraphTenant')

# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.

CmdletsToExport = @()

# Variables to export from this module

VariablesToExport = @()

# Aliases to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no aliases to export.

AliasesToExport = @()

# DSC resources to export from this module

DscResourcesToExport = @()

# List of all modules packaged with this module

# ModuleList = @()

# List of all files packaged with this module

# FileList = @()

# Private data to pass to the module specified in RootModule/ModuleToProcess. This may also contain a PSData hashtable with additional module metadata used by PowerShell.

PrivateData = @{

    PSData = @{

        # Tags applied to this module. These help with module discovery in online galleries.

        # No spaces permitted; PSGallery adds 'PSModule' itself.

        Tags = @(

            'Microsoft365'

            'MicrosoftGraph'

            'Graph'

            'Intune'

            'Entra'

            'EntraID'

            'MDM'

            'DeviceManagement'

            'MultiTenant'

            'AppOnly'

            'Automation'

            'Windows'

            'Linux'

            'MacOS'

        )

        # A URL to the license for this module.

        LicenseUri = 'https://opensource.org/licenses/MIT'

        # A URL to the main website for this project.

        # ProjectUri = ''

        # A URL to an icon representing this module.

        # IconUri = ''

        # ReleaseNotes of this module

        ReleaseNotes = @'

0.2.0

A minor bump rather than a patch: three changes alter the output or the calling contract of

commands that shipped in 0.1.1, and the catalog grew from 55 operations to 69.

BREAKING-ISH - existing callers should read these three:

- Every export format now redacts declared secret-bearing properties. Previously only -As Json

  redacted, while -As Csv, -As Markdown and the VaultEvidence rows.json wrote rows raw. Use

  -NoRedact for the previous behaviour.

- CSV cells beginning = + - @ are prefixed with an apostrophe so a spreadsheet does not execute

  them as formulas. Strings only; negative numbers are untouched.

- Invoke-GraphOperation now supports -WhatIf, and operations declared High impact require -Force.

  Nothing prompts by default, so unattended writes still run - but a High-impact call without

  -Force now fails instead of executing.

WRITE OPERATIONS - the catalog is no longer read-only.

Eight writes ship, each declaring an Impact (Low/Medium/High) that governs how hard it is to run

by accident. What counts as mutating is declared by the descriptor's ReplayPolicy, never inferred

from the HTTP verb, because two descriptors are POSTs that change nothing. ManagedDevice.Wipe is

the only High-impact operation and requires -Force; -Force bypasses that confirmation and nothing

else. Every assignment write ships with the read that makes it usable, because Graph's /assign is

a REPLACE and omitted assignments are removed.

Added: ManagedDevice.SyncDevice / Retire / Delete / Wipe, DeviceCompliancePolicy.Assign,

DeviceConfiguration.Assign, ConfigurationPolicy.AssignBeta.

FIXED - a wrong answer that looked like a right one:

- A PathTemplate that fixes a query option now extends it with '&' instead of a second '?'.

  Resolve-GraphUri always joined with '?', so a fixed option plus a caller-supplied one produced

  '?$expand=a?$filter=b' - not two options, since the second '?' becomes part of the first

  option's value. Graph answered 200 and IGNORED the filter, returning a complete collection that

  read as a filtered one.

- Get-GraphOperation returns a deep copy. It previously handed out cached catalog objects, so a

  caller mutating one changed the descriptor every later operation used, CredentialPolicy

  included.

- Actions may declare no request body. The action strategy demanded one from every action, which

  excluded most of the write surface: Intune device actions are bodyless POSTs and deletes carry

  no body at all.

ADDED - descriptors, 55 -> 69:

- The Administrative Template walk: GroupPolicyConfiguration / GroupPolicyDefinitionValue /

  GroupPolicyPresentationValue (ListBeta). The two child operations fix a load-bearing $expand in

  their path; without it the rows come back 200 with no indication of which setting they

  configure.

- ConfigurationPolicyAssignment.ListBeta, closing a silent gap - assignment reads existed for

  compliance, device configuration and mobile apps, so a reconciliation across policy types

  contributed nothing for Settings Catalog and still reported success.

- AuthorizationPolicy.Get, DirectorySetting.List and DirectorySettingTemplate.List. The templates

  are not optional: /settings returns only INSTANTIATED settings, so an absent row means the

  template default applies - not that the tenant is unconfigured.

- Descriptors may declare SensitiveProperties and Impact, both validated at load.

Requires PowerShell 7.4+. 721 tests, 0 skipped, green on Windows, Linux and macOS across

PowerShell 7.4 and 7.6.

'@

        # Prerelease string of this module

        Prerelease =  ''

        # Flag to indicate whether the module requires explicit user acceptance for install/update/save

        # RequireLicenseAcceptance = $false

        # External dependent modules of this module

        # Both RequiredModules entries are satisfied from PSGallery, never from whatever

        # repository GraphKit itself is installed from. Without this declaration, PowerShellGet

        # resolving a local or private repository demands the dependencies exist in that SAME

        # repository and fails the install - which a consumer cannot fix from their side.

        # Reported with a live repro by a downstream consumer packaging against a local repo.

        ExternalModuleDependencies = @(

            'Microsoft.Graph.Authentication'

            'Microsoft.PowerShell.SecretManagement'

        )

    } # End of PSData hashtable

} # End of PrivateData hashtable

# HelpInfo URI of this module

# HelpInfoURI = ''

# Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.

# DefaultCommandPrefix = ''

}