@patimweb/pi-teams 1.1.0 → 1.3.0

package/src/graph/messages.ts

@@ -9,9 +9,9 @@
 
 import type { TeamsConnection } from "../config/index.ts";
 import type { ChannelSummary, MessageLocation, MessageSummary, PersonRef } from "../types.ts";
-import { graphGetOptional, graphList, graphPost } from "./client.ts";
+import { graphGetOptional, graphList, graphPatch, graphPost } from "./client.ts";
 import { mapMessage } from "./mappers.ts";
-import { textToHtml } from "../utils/formatting.ts";
+import { markdownToTeamsHtml } from "../utils/richtext.ts";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 type Raw = Record<string, any>;
@@ -21,9 +21,15 @@ type Raw = Record<string, any>;
 // ---------------------------------------------------------------------------
 
 export interface MessageInput {
-	/** Message text — plain text unless `html` is true */
+	/**
+	 * Message text.
+	 *
+	 * Treated as lightweight markdown by default — bold, italic, code, bullets,
+	 * numbered lists, links and `# headings` are converted to the HTML Teams
+	 * renders. Set `html` to true to send raw HTML instead.
+	 */
 	body: string;
-	/** Treat `body` as raw HTML instead of escaping it */
+	/** Treat `body` as raw HTML instead of converting markdown */
 	html?: boolean;
 	/** Channel messages only */
 	subject?: string;
@@ -39,10 +45,14 @@ export interface MessageInput {
  * Mentions are the fiddly part: Teams requires an `<at id="N">` span in the
  * HTML *and* a matching entry in the `mentions` array. The display name is
  * replaced in the text so the caller can just write "@Anna Schmidt".
+ *
+ * Markdown is converted unless the caller says the body is already HTML: what
+ * comes back from a model is markdown, and markdown sent raw arrives as
+ * asterisks and dashes.
  */
 export function buildMessageBody(input: MessageInput): Record<string, unknown> {
 	const mentions = input.mentions ?? [];
-	let content = input.html ? input.body : textToHtml(input.body);
+	let content = input.html ? input.body : markdownToTeamsHtml(input.body);
 
 	const mentionEntries: Record<string, unknown>[] = [];
 	mentions.forEach((person, index) => {
@@ -282,62 +292,76 @@ export async function replyToChannelMessage(
 }
 
 /**
- * Path for the softDelete / undoSoftDelete actions.
+ * Path to one message in a chat — the base for editing and deleting.
+ *
+ * The user id is explicit: Graph does not accept `/me` in this position, which
+ * is why every caller resolves the signed-in user first.
  *
- * The chat form takes an explicit user id — Graph does not accept `/me` here —
- * which is why every caller has to resolve the signed-in user first.
+ * There is no channel form. Editing or deleting a channel post needs the
+ * `ChannelMessage.ReadWrite` scope, and this package deliberately does not ask
+ * for a permission it cannot rely on being granted.
  */
-export function deletePath(
-	location: MessageLocation,
-	messageId: string,
-	userId: string,
-	replyId?: string,
-): string {
-	if (location.kind === "chat") {
-		return (
-			`/users/${encodeURIComponent(userId)}` +
-			`/chats/${encodeURIComponent(location.chatId!)}` +
-			`/messages/${encodeURIComponent(messageId)}`
-		);
-	}
-	const base = `${channelPath(location.teamId!, location.channelId!)}/${encodeURIComponent(messageId)}`;
-	return replyId ? `${base}/replies/${encodeURIComponent(replyId)}` : base;
+export function messagePath(chatId: string, messageId: string, userId: string): string {
+	return (
+		`/users/${encodeURIComponent(userId)}` +
+		`/chats/${encodeURIComponent(chatId)}` +
+		`/messages/${encodeURIComponent(messageId)}`
+	);
 }
 
 /**
- * Delete one of the signed-in user's own messages (soft delete, as in the app).
+ * Delete one of the signed-in user's own chat messages (soft delete, as in the app).
  *
  * Graph exposes this as an action, not an HTTP DELETE, and only for the sender.
  */
 export async function softDeleteMessage(
 	conn: TeamsConnection,
-	location: MessageLocation,
+	chatId: string,
 	messageId: string,
 	userId: string,
-	options: { replyId?: string; signal?: AbortSignal } = {},
+	options: { signal?: AbortSignal } = {},
 ): Promise<void> {
-	await graphPost(
-		conn,
-		`${deletePath(location, messageId, userId, options.replyId)}/softDelete`,
-		undefined,
-		{ signal: options.signal },
-	);
+	await graphPost(conn, `${messagePath(chatId, messageId, userId)}/softDelete`, undefined, {
+		signal: options.signal,
+	});
 }
 
 /** Restore a message that was soft-deleted. */
 export async function undoSoftDeleteMessage(
 	conn: TeamsConnection,
-	location: MessageLocation,
+	chatId: string,
 	messageId: string,
 	userId: string,
-	options: { replyId?: string; signal?: AbortSignal } = {},
+	options: { signal?: AbortSignal } = {},
 ): Promise<void> {
-	await graphPost(
-		conn,
-		`${deletePath(location, messageId, userId, options.replyId)}/undoSoftDelete`,
-		undefined,
-		{ signal: options.signal },
-	);
+	await graphPost(conn, `${messagePath(chatId, messageId, userId)}/undoSoftDelete`, undefined, {
+		signal: options.signal,
+	});
+}
+
+// ---------------------------------------------------------------------------
+// Editing
+// ---------------------------------------------------------------------------
+
+/**
+ * Rewrite one of the signed-in user's own chat messages.
+ *
+ * Only the body is patched: an edit replaces the text as it stands, and sending
+ * a fresh set of mention entities would silently re-notify people who were
+ * already notified by the original message.
+ */
+export async function updateMessage(
+	conn: TeamsConnection,
+	chatId: string,
+	messageId: string,
+	userId: string,
+	input: { body: string; html?: boolean },
+	options: { signal?: AbortSignal } = {},
+): Promise<void> {
+	const { body } = buildMessageBody({ body: input.body, html: input.html });
+	await graphPatch(conn, messagePath(chatId, messageId, userId), { body }, {
+		signal: options.signal,
+	});
 }
 
 // ---------------------------------------------------------------------------

package/src/safety/index.ts

@@ -39,7 +39,7 @@ export function isMutationTool(toolName: string): boolean {
  * needs a way to add an account or sign out. They also work before anything is
  * configured at all, which is the whole point of `teams_setup`.
  */
-export const LOCAL_CONFIG_TOOLS = new Set<string>(["teams_setup", "teams_logout"]);
+export const LOCAL_CONFIG_TOOLS = new Set<string>(["teams_setup", "teams_logout", "teams_watch"]);
 
 /**
  * Why a mutation must be refused outright, or undefined when it may proceed
@@ -82,6 +82,14 @@ const APP_ONLY_FORBIDDEN = new Set<string>([
 	"teams_create_chat",
 	"teams_delete_message",
 	"teams_react",
+	// The read-cursor actions are delegated-only in Graph ("Application: not
+	// supported"), so an app-only token gets a 403 with no explanation.
+	"teams_mark_read",
+	// An app-only token may only touch messages for migration and DLP, and a
+	// membership change with no person behind it is exactly the kind of write
+	// this gate exists to stop.
+	"teams_update_message",
+	"teams_chat_members",
 	"teams_set_presence",
 	"teams_set_status_message",
 ]);
@@ -120,12 +128,18 @@ export function formatMutationSummary(
 			const people = Array.isArray(params.participants) ? params.participants.join(", ") : text(params.participants);
 			return `Create a new chat with: ${text(people, 200)}`;
 		}
-		case "teams_create_channel":
-			return `Create channel "${text(params.name, 60)}" in team "${text(params.team, 60)}"`;
 		case "teams_delete_message":
 			return `Delete your message ${text(params.messageId, 60)}`;
 		case "teams_react":
 			return `${params.remove ? "Remove" : "Add"} reaction ${text(params.reaction, 10)} on message ${text(params.messageId, 50)}`;
+		case "teams_mark_read":
+			return `${params.read === false ? "Mark as unread" : "Mark as read"}: chat "${text(params.chat, 60)}"`;
+		case "teams_update_message":
+			return `Edit your message ${text(params.messageId, 50)} in ${text(params.chat ?? params.channel, 60)}:\n\n${text(params.body, 400)}`;
+		case "teams_chat_members":
+			return `${params.action === "remove" ? "Remove" : "Add"} ${text(params.person, 80)} ${params.action === "remove" ? "from" : "to"} the chat "${text(params.chat, 60)}"`;
+		case "teams_respond_invite":
+			return `${text(params.response, 20)} the invitation ${text(params.eventId, 50)}${params.comment ? `: "${text(params.comment, 160)}"` : ""}`;
 		case "teams_set_presence":
 			return `Set your Teams presence to ${text(params.availability, 30)}${params.expiresIn ? ` for ${text(params.expiresIn, 20)}` : ""}`;
 		case "teams_set_status_message":

package/src/status.ts

@@ -27,6 +27,10 @@ export interface ConnectionCard {
 	otherAccounts: string[];
 	/** Rendered scope rules */
 	permissionSummary: string;
+	/** Listen mode is switched on */
+	watching?: boolean;
+	/** One line on what the watcher is doing, when it runs */
+	watchSummary?: string;
 }
 
 export function buildConnectionCard(
@@ -50,6 +54,19 @@ export function buildConnectionCard(
 		expiresAt: cache.expiresAt ? new Date(cache.expiresAt).toISOString() : undefined,
 		otherAccounts: conn.allAccounts.map((a) => a.name).filter((name) => name !== conn.account),
 		permissionSummary: formatPermissions(conn.permissions),
+		// What the configuration asks for; a caller that knows whether the watcher
+		// is actually running overrides this with the runtime truth.
+		watching: conn.watch.enabled,
+		watchSummary: conn.watch.enabled
+			? [
+					`every ${conn.watch.intervalSeconds} s`,
+					conn.watch.chats.length > 0 ? conn.watch.chats.join(", ") : "all recent chats",
+					conn.watch.from.length > 0 ? `from ${conn.watch.from.join(", ")}` : undefined,
+					`max ${conn.watch.maxTriggersPerHour}/h`,
+				]
+					.filter(Boolean)
+					.join(" · ")
+			: undefined,
 	};
 }
 
@@ -59,7 +76,8 @@ export function buildConnectionLabel(card: ConnectionCard | undefined): string {
 	if (!card.signedIn) return `Teams · ${card.account} · not signed in`;
 
 	const scope = card.tenant === card.account ? card.account : `${card.account}/${card.tenant}`;
-	return `✓ Teams · ${scope}${card.user ? ` · ${card.user}` : ""}`;
+	const listening = card.watching ? " · 👂 listening" : "";
+	return `✓ Teams · ${scope}${card.user ? ` · ${card.user}` : ""}${listening}`;
 }
 
 /** Rich markdown for `/teams-status` and the expanded card. */
@@ -98,6 +116,9 @@ export function formatStatusText(card: ConnectionCard | undefined): string {
 	if (card.otherAccounts.length > 0) {
 		lines.push(`- **Other accounts:** ${card.otherAccounts.join(", ")}`);
 	}
+	lines.push(
+		`- **Listen mode:** ${card.watching ? `on — ${card.watchSummary ?? "running"}` : "off"}`,
+	);
 
 	lines.push("", "### What pi may do", "", card.permissionSummary);
 	return lines.join("\n");

package/src/tools/shared.ts

@@ -88,6 +88,30 @@ export function connectionFor(
 	return resolveConnection(account, tenant);
 }
 
+// ---------------------------------------------------------------------------
+// Consent gates
+// ---------------------------------------------------------------------------
+
+/**
+ * Whether this account asks for a delegated scope.
+ *
+ * A delegated scope cannot be granted unless it was requested, so the
+ * configuration is a reliable gate: if it is missing here, the Graph call
+ * cannot succeed, and its failure would be a consent error that says nothing
+ * about the one-line fix.
+ */
+export function hasScope(conn: TeamsConnection, scope: string): boolean {
+	return conn.scopes.some((entry) => entry.toLowerCase() === scope.toLowerCase());
+}
+
+/** The message to return when a tool needs a scope the account does not request. */
+export function missingScopeError(scope: string, feature: string): string {
+	return (
+		`${feature} needs the Microsoft Graph scope "${scope}", which this account does not request. ` +
+		`Add it to "scopes" in pi-teams.json (or have an admin grant it in Entra ID) and run teams_login again.`
+	);
+}
+
 // ---------------------------------------------------------------------------
 // Identity cache
 // ---------------------------------------------------------------------------

package/src/tools/teams-availability.ts

@@ -0,0 +1,224 @@
+/**
+ * teams_availability — when everybody is free.
+ *
+ * Reads *free/busy*, not calendars: `getSchedule` is what a delegated token may
+ * see about a colleague's day, and it is also the reason this works with the
+ * scopes already granted — `findMeetingTimes` demands `Calendars.Read.Shared`,
+ * a scope nobody has consented to just to ask "Tuesday at two?".
+ *
+ * Scheduling is then a second step on purpose. This tool answers the question;
+ * `teams_create_meeting` acts on it once the user has agreed to a slot.
+ */
+
+import { Type } from "typebox";
+import { getSchedule } from "../graph/calendar.ts";
+import { resolveUserId } from "../graph/me.ts";
+import { assertAccess } from "../safety/index.ts";
+import {
+	formatNaiveDay,
+	formatSlotRange,
+	truncate,
+} from "../utils/formatting.ts";
+import {
+	describeBusy,
+	findCommonFreeSlots,
+	localDayStart,
+	localNow,
+	localTimeZone,
+	type BusyView,
+} from "../utils/slots.ts";
+import {
+	AccountParam,
+	LimitParam,
+	TenantParam,
+	connectionFor,
+	currentUser,
+	run,
+	textResult,
+	type ToolContext,
+	type ToolResult,
+} from "./shared.ts";
+
+/** How far ahead the default search looks. */
+const DEFAULT_SEARCH_DAYS = 7;
+
+export const teamsAvailabilityTool = {
+	name: "teams_availability",
+	description:
+		"Find when the signed-in user and other people are all free, using Microsoft Graph free/busy. " +
+		"Only availability is read — never the appointments themselves. " +
+		"By default it searches the next 7 days for slots on weekdays between 09:00 and 17:00; pass 'start' and " +
+		"'end' (ISO 8601 local date-times) to look at an exact window instead. " +
+		"Use it before teams_create_meeting when the goal is to find a time rather than to book one.",
+	parameters: Type.Object({
+		people: Type.Optional(
+			Type.Array(Type.String(), {
+				description:
+					"Names, e-mail addresses or UPNs of everyone who has to be there; the signed-in user is always included",
+			}),
+		),
+		start: Type.Optional(
+			Type.String({
+				description:
+					"ISO 8601 local date-time, e.g. '2026-09-15T09:00:00'. Default: today, in 'timeZone'",
+			}),
+		),
+		end: Type.Optional(
+			Type.String({
+				description:
+					"ISO 8601 local date-time. Default: 7 days after 'start'",
+			}),
+		),
+		durationMinutes: Type.Optional(
+			Type.Number({ description: "Length of the meeting to look for, in minutes (default 30)" }),
+		),
+		timeZone: Type.Optional(
+			Type.String({
+				description:
+					"IANA or Windows time zone the times are expressed in. Defaults to this machine's time zone",
+			}),
+		),
+		account: AccountParam,
+		tenant: TenantParam,
+		limit: LimitParam,
+	}),
+	promptSnippet: "Find a free slot for several people",
+	promptGuidelines: [
+		"Use teams_availability to find a time before creating a meeting; propose the slots it returns and let the user pick.",
+		"Availability is other people's data: pass it on as times, not as an account of how busy someone is.",
+	],
+
+	async execute(
+		_toolCallId: string,
+		params: {
+			people?: string[];
+			start?: string;
+			end?: string;
+			durationMinutes?: number;
+			timeZone?: string;
+			account?: string;
+			tenant?: string;
+			limit?: number;
+		},
+		signal: AbortSignal | undefined,
+		_onUpdate: undefined,
+		ctx: ToolContext,
+	): Promise<ToolResult> {
+		return run(async () => {
+			const conn = connectionFor(ctx, params.account, params.tenant);
+			const me = await currentUser(conn, signal);
+
+			const timeZone = params.timeZone ?? localTimeZone();
+			const duration = Math.min(Math.max(params.durationMinutes ?? 30, 5), 1440);
+
+			// Default: the coming week, searched inside working hours. An explicit
+			// window is honoured as-is — asking "are we free at 20:00?" is a
+			// legitimate question that a 09:00–17:00 filter would answer wrongly.
+			const explicit = !!params.start || !!params.end;
+			const start = params.start ?? localDayStart(0);
+			const end = params.end ?? localDayStart(DEFAULT_SEARCH_DAYS);
+
+			/** scheduleId (lower case) → what to call that person */
+			const names = new Map<string, string>();
+			const schedules: string[] = [];
+
+			const selfAddress = me.mail ?? me.upn;
+			schedules.push(selfAddress);
+			names.set(selfAddress.toLowerCase(), `${me.displayName} (you)`);
+
+			const unresolved: string[] = [];
+			for (const reference of params.people ?? []) {
+				const person = await resolveUserId(conn, reference, signal);
+				if (!person) {
+					unresolved.push(reference);
+					continue;
+				}
+
+				// Free/busy is other people's data, so the people rules apply.
+				assertAccess(conn, "read", "people", person.displayName, [
+					person.displayName,
+					person.upn,
+					person.mail,
+					person.id,
+				]);
+
+				const address = person.mail ?? person.upn;
+				if (!address) {
+					unresolved.push(reference);
+					continue;
+				}
+				if (!schedules.some((entry) => entry.toLowerCase() === address.toLowerCase())) {
+					schedules.push(address);
+					names.set(address.toLowerCase(), person.displayName);
+				}
+			}
+
+			const windows = await getSchedule(conn, {
+				schedules,
+				start,
+				end,
+				timeZone,
+				intervalMinutes: duration,
+				signal,
+			});
+
+			const views: BusyView[] = windows.map((window) => ({
+				name: names.get(window.scheduleId.toLowerCase()) ?? window.scheduleId,
+				view: window.availabilityView,
+			}));
+
+			const slots = findCommonFreeSlots(
+				views,
+				{
+					start,
+					intervalMinutes: duration,
+					notBefore: explicit ? undefined : localNow(),
+					workingHoursOnly: !explicit,
+				},
+				params.limit ?? 5,
+			);
+
+			const who = [...names.values()].map((name) => truncate(name, 60)).join(", ");
+			const windowLabel = explicit
+				? `${formatSlotRange(start, end)}`
+				: `${formatNaiveDay(start)} – ${formatNaiveDay(end)} on weekdays, 09:00–17:00`;
+
+			const lines = [
+				`## Free/busy — ${windowLabel} (${timeZone}), ${duration} min`,
+				"",
+				`Checked: ${who}`,
+				"",
+			];
+
+			if (slots.length === 0) {
+				lines.push("**No slot where everybody is free.**", "");
+				if (windows.length > 0) {
+					lines.push("Busy blocks:", ...describeBusy(windows, names), "");
+				}
+			} else {
+				lines.push(`**${slots.length} slot(s) with everybody free:**`, "");
+				for (const slot of slots) {
+					lines.push(`- ${formatSlotRange(slot.start, slot.end)}`);
+				}
+				lines.push("");
+			}
+
+			if (unresolved.length > 0) {
+				lines.push(`_Could not resolve: ${unresolved.join(", ")} — use teams_find_user._`, "");
+			}
+
+			// The individual blocks are only useful when a slot was proposed and the
+			// reader wants to sanity-check it, or when nothing was found at all.
+			if (slots.length > 0 && windows.some((window) => window.busy.length > 0)) {
+				lines.push("Busy blocks in the window:", ...describeBusy(windows, names), "");
+			}
+
+			return textResult(lines.join("\n").trimEnd(), {
+				slots: slots.length,
+				people: schedules.length,
+				unresolved: unresolved.length,
+				timeZone,
+			});
+		});
+	},
+};

package/src/tools/teams-chat-members.ts

@@ -0,0 +1,148 @@
+/**
+ * teams_chat_members — bring someone into a group chat, or take them out.
+ *
+ * Teams has no "invite" for a chat: either the person is a member of the
+ * conversation or they cannot see it. That makes adding a real change to who
+ * can read the history, which is why it goes through the safety gates and the
+ * person is checked against the member rules before Graph is called.
+ */
+
+import { Type } from "typebox";
+import { addChatMember, listChatMembers, matchChatMember, removeChatMember } from "../graph/chats.ts";
+import { resolveUserId } from "../graph/me.ts";
+import { auditWrite } from "../safety/audit.ts";
+import { assertAccess } from "../safety/index.ts";
+import { requireChat } from "./resolve.ts";
+import {
+	AccountParam,
+	TenantParam,
+	connectionFor,
+	currentUser,
+	errorResult,
+	hasScope,
+	missingScopeError,
+	run,
+	textResult,
+	type ToolContext,
+	type ToolResult,
+} from "./shared.ts";
+
+export const teamsChatMembersTool = {
+	name: "teams_chat_members",
+	description:
+		"Add a person to an existing Microsoft Teams group chat, or remove one. " +
+		"Takes a chat ID, the group chat topic, or a participant's name/e-mail, plus who to add or remove. " +
+		"A 1:1 chat cannot be extended — use teams_create_chat with everyone in it to make it a group chat. " +
+		"Removing someone additionally needs the ChatMember.ReadWrite scope.",
+	parameters: Type.Object({
+		chat: Type.String({ description: "Chat ID, group chat topic, or a participant's name/e-mail" }),
+		action: Type.Union([Type.Literal("add"), Type.Literal("remove")], {
+			description: "'add' to bring someone in, 'remove' to take them out",
+		}),
+		person: Type.String({
+			description: "Who to add or remove, by name, e-mail address or user principal name",
+		}),
+		account: AccountParam,
+		tenant: TenantParam,
+	}),
+	promptSnippet: "Add or remove a member of a Teams chat",
+	promptGuidelines: [
+		"Adding a member gives them the chat's history from that point on, so confirm the person with the user when the name is ambiguous.",
+	],
+
+	async execute(
+		_toolCallId: string,
+		params: {
+			chat: string;
+			action: "add" | "remove";
+			person: string;
+			account?: string;
+			tenant?: string;
+		},
+		signal: AbortSignal | undefined,
+		_onUpdate: undefined,
+		ctx: ToolContext,
+	): Promise<ToolResult> {
+		return run(async () => {
+			const conn = connectionFor(ctx, params.account, params.tenant);
+			const me = await currentUser(conn, signal);
+			const chat = await requireChat(conn, params.chat, "write", signal);
+
+			if (params.action === "add") {
+				if (chat.chatType === "oneOnOne") {
+					return errorResult(
+						`"${chat.label}" is a 1:1 chat and cannot be extended. Use teams_create_chat with ` +
+							`everyone who should be in it to start a group chat.`,
+					);
+				}
+
+				const person = await resolveUserId(conn, params.person, signal);
+				if (!person) {
+					return errorResult(
+						`No person matching "${params.person}". Use teams_find_user to find the exact name or e-mail.`,
+					);
+				}
+
+				// The people already in the chat were checked by requireChat; the one
+				// about to join has to be checked on its own.
+				assertAccess(conn, "write", "people", person.displayName, [
+					person.displayName,
+					person.upn,
+					person.mail,
+					person.id,
+				]);
+
+				await addChatMember(conn, chat.id, person, { signal });
+
+				auditWrite(conn.audit, {
+					tool: "teams_chat_members",
+					account: conn.account,
+					tenant: conn.tenant,
+					actor: me.upn,
+					target: `chat:${chat.label}`,
+					summary: `added ${person.displayName} to the chat`,
+				});
+
+				return textResult(`✅ ${person.displayName} added to "${chat.label}".`, {
+					chatId: chat.id,
+					action: "add",
+				});
+			}
+
+			// Removal takes the membership id, not the user id — a scope the default
+			// configuration leaves out, so the answer is the fix rather than a 403.
+			if (!hasScope(conn, "ChatMember.ReadWrite")) {
+				return errorResult(
+					missingScopeError("ChatMember.ReadWrite", "Removing a member from a chat"),
+				);
+			}
+
+			const person = await resolveUserId(conn, params.person, signal).catch(() => undefined);
+			const members = await listChatMembers(conn, chat.id, { signal });
+			const reference = person?.id ?? person?.upn ?? person?.mail ?? params.person;
+			const member = matchChatMember(members, reference) ?? matchChatMember(members, params.person);
+
+			if (!member) {
+				const known = members.map((entry) => entry.displayName).join(", ") || "(none visible)";
+				return errorResult(`"${params.person}" is not a member of "${chat.label}". Members: ${known}.`);
+			}
+
+			await removeChatMember(conn, chat.id, member.membershipId, { signal });
+
+			auditWrite(conn.audit, {
+				tool: "teams_chat_members",
+				account: conn.account,
+				tenant: conn.tenant,
+				actor: me.upn,
+				target: `chat:${chat.label}`,
+				summary: `removed ${member.displayName} from the chat`,
+			});
+
+			return textResult(`✅ ${member.displayName} removed from "${chat.label}".`, {
+				chatId: chat.id,
+				action: "remove",
+				membershipId: member.membershipId,
+			});
+		});
+	},
+};