feat(wrapper-generator): commit v1.0 wrapper module sources under src…

[Joywambui-maina]

Addresses #3705 — the committable layout under src/{Module}/ and the target-framework decision.

Changes proposed in this pull request

• Commit the generated Kiota client and wrapper cmdlets for all 35 cmdlet-producing v1.0 modules under src/{Module}/wrapper/{ApiVersion}/, so a clean checkout builds them with only the .NET SDK — kiota is needed to regenerate, never to compile.
• Nest the API version under wrapper/, not above it. AutoRest owns src/{Module}/{ApiVersion}/and runs withclear-output-folder, so wrapper source placed there is deleted whenever the AutoRest modules regenerate — observed: generating Mail removed its wrapper tree. src/{Module}/` itself is never cleared.
• Target netstandard2.0 for both projects instead of net10.0. The compatibility contract comes from the module every wrapper references — src/Authentication/Authentication/Microsoft.Graph.Authentication.psd1declaresPowerShellVersion 5.1andCompatiblePSEditions Core, Desktop` — and a manifest binds one un-conditioned dll path, so a single framework must satisfy both editions.
• Re-include the wrapper tree in .gitignore. Kiota derives directory names from Graph URL paths, so segments like Publish/, Log/ and BackupRestore/ collided with the existing Visual Studio rules and silently dropped 174 real source files.
• Record kiota-lock.json's spec path relative to its output folder. It was absolute and machine-local, so every clone differed.
• Stop DirectoryObjects claiming directory.publicKeyInfrastructureRoot. The mapping gave the family to both DirectoryObjects and Identity.DirectoryManagement, emitting 11 identical public cmdlets from two modules; the published-command inventory assigns it to Identity.DirectoryManagement alone.
• Repoint Test-BodyBindingCoverage.ps1 and Compare-WrapperOperationInventory.ps1 at the committed corpus, and replace the inventory's newest-write-time generator stamp with a SHA-256 over the generator's sources, embedded data and project file.
• Add docs/WrapperCmdlets-V1.0.csv and -Summary.csv as the reviewable inventory.

How to review this

34,443 files, 34,427 of them generated. Read docs/WrapperCmdlets-V1.0.csv, not the tree — one row per emitted cmdlet with its module, verb, noun and request path, plus per-module totals in the summary. The 16 hand-written files are the whole reviewable surface: .gitignore, config/ModulesMapping.jsonc, the two openApiDocs* re-slices, six scripts, two
csproj templates, Program.cs, and two docs.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

[Peter Ombwa (peombwa)]

The GitOps/AdvancedSecurity check is failing because Microsoft.Kiota.Bundle 2.0.0 transitively pulls in System.Text.Json v8.0.0, which is affected by two high-severity Denial of Service vulnerabilities:

• CVE-2024-30105 – .NET Denial of Service Vulnerability
• CVE-2024-43485 – .NET Denial of Service Vulnerability

To fix this, add an explicit PackageReference pinning System.Text.Json to 10.0.3 in each affected wrapper Client.csproj, the same way it's already pinned in [Authentication.Core.csproj (line 30):

<PackageReference Include="System.Text.Json" Version="10.0.3" />

msgraph-sdk-powershell/src/Authentication/Authentication.Core/Microsoft.Graph.Authentication.Core.csproj

Line 30 in c7a6aee

<PackageReference Include="System.Text.Json" Version="10.0.3" />

[Joywambui-maina]

Done in f7b83ce - thanks, and 10.0.3 was the right call over what I was about to use.

Pinned System.Text.Json to 10.0.3 in tools/Templates/WrapperClient.csproj.template and in all 38 committed Client.csproj, matching the pin in Authentication.Core.csproj so the repository keeps one answer rather than two.

I had been about to pin 8.0.5, which is the minimum version that patches both advisories (CVE-2024-30105 is fixed in 8.0.4, CVE-2024-43485 in 8.0.5, so 8.0.4 alone is still vulnerable). That would have worked but diverged from the existing convention for no reason.

Verified rather than assumed, since the client projects are netstandard2.0:

• a netstandard2.0 restore with Microsoft.Kiota.Bundle 2.0.0 plus the pin resolves System.Text.Json/10.0.3; without it, 8.0.0
• Authentication.Core targets netstandard2.0;net6.0;net472, so 10.0.3 was already proven on that framework here
• Mail rebuilds clean with the pin

Diff is 39 files, +117/-0 - the template and the csprojs only, no generated output.