Sync user archive across all interfaces

Align user-removal UX and API surface semantics with the new archive\nbehavior for manually managed users.\n\nFrontend copy and actions now use archive wording, and list rows are\nrefetched after the mutation so archived users reappear as inactive.\n\nMCP removeUser now documents and returns archived_user_id, n8n labels\nand response mapping now use archive semantics, and the CLI gains a\nuser archive command backed by the same mutation.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

pkg/server/api/connect/v1/profile_resolvers.go

@@ -113,15 +113,15 @@ func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUse
 	err := r.iam.OrganizationService.RemoveUser(ctx, input.OrganizationID, input.ProfileID)
 	if err != nil {
 		if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok {
-			return nil, gqlutils.Conflict(ctx, err)
+			return nil, gqlutils.Conflictf(ctx, "user is managed by SCIM and cannot be archived")
 		}
 
 		if _, ok := errors.AsType[*iam.ErrLastActiveOwner](err); ok {
-			return nil, gqlutils.Conflict(ctx, err)
+			return nil, gqlutils.Conflictf(ctx, "cannot archive last active owner")
 		}
 
 		if errors.Is(err, coredata.ErrResourceInUse) {
-			return nil, gqlutils.Conflict(ctx, err)
+			return nil, gqlutils.Conflictf(ctx, "cannot archive user")
 		}
 
 		r.logger.ErrorCtx(ctx, "cannot remove user from organization", log.Error(err))

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -2923,21 +2923,21 @@ func (r *Resolver) RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest,
 	err := r.iamSvc.OrganizationService.RemoveUser(ctx, input.OrganizationID, input.ProfileID)
 	if err != nil {
 		if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok {
-			return nil, types.RemoveUserOutput{}, fmt.Errorf("user is managed by SCIM and cannot be removed: %w", err)
+			return nil, types.RemoveUserOutput{}, fmt.Errorf("user is managed by SCIM and cannot be archived: %w", err)
 		}
 
 		if _, ok := errors.AsType[*iam.ErrLastActiveOwner](err); ok {
-			return nil, types.RemoveUserOutput{}, fmt.Errorf("cannot remove last active owner: %w", err)
+			return nil, types.RemoveUserOutput{}, fmt.Errorf("cannot archive last active owner: %w", err)
 		}
 
 		if errors.Is(err, coredata.ErrResourceInUse) {
-			return nil, types.RemoveUserOutput{}, fmt.Errorf("cannot remove user: %w", err)
+			return nil, types.RemoveUserOutput{}, fmt.Errorf("cannot archive user: %w", err)
 		}
 
-		return nil, types.RemoveUserOutput{}, fmt.Errorf("remove user: %w", err)
+		return nil, types.RemoveUserOutput{}, fmt.Errorf("archive user: %w", err)
 	}
 
-	return nil, types.RemoveUserOutput{DeletedUserID: input.ProfileID}, nil
+	return nil, types.RemoveUserOutput{ArchivedUserID: input.ProfileID}, nil
 }
 
 func (r *Resolver) DeleteDataProtectionImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDataProtectionImpactAssessmentInput) (*mcp.CallToolResult, types.DeleteDataProtectionImpactAssessmentOutput, error) {

pkg/server/api/mcp/v1/specification.yaml

@@ -1709,16 +1709,16 @@ components:
           description: Organization ID
         profile_id:
           $ref: "#/components/schemas/GID"
-          description: User (profile) ID to remove
+          description: User (profile) ID to archive
 
     RemoveUserOutput:
       type: object
       required:
-        - deleted_user_id
+        - archived_user_id
       properties:
-        deleted_user_id:
+        archived_user_id:
           $ref: "#/components/schemas/GID"
-          description: Deleted user (profile) ID
+          description: Archived user (profile) ID
 
     GetProfileInput:
       type: object
@@ -11934,7 +11934,7 @@ tools:
     outputSchema:
       $ref: "#/components/schemas/UpdateMembershipOutput"
   - name: removeUser
-    description: Remove a user from the organization
+    description: Archive a user in the organization
     hints:
       readonly: false
     inputSchema: