feat(copilot): managed profile testing and openaiCompatible provider support

- add native openaiCompatible provider type with flat baseUrl/apiKey/dialect
  config fields and declared per-model capabilities
- add admin-only probeManagedCopilotProfile GraphQL mutation that dispatches
  real probe requests against server-managed copilot profiles, reusing the
  BYOK probe engine with an AllowPrivate egress policy for self-hosted
  endpoints (Vertex profiles rejected; use workspace BYOK instead)
- expose providers.profiles app config descriptor to the admin console
- add 'AI Providers' settings group with JSON editor and per-profile Test
  action that probes declared capabilities and reports verified/failed
  status per model and operation

packages/common/graphql/src/graphql/admin/managed-profile.gql

@@ -0,0 +1,20 @@
+mutation probeManagedCopilotProfile($profileId: ID!, $checks: [ManagedProfileProbeCheckInput!]!) {
+  probeManagedCopilotProfile(profileId: $profileId, checks: $checks) {
+    connection {
+      kind
+      testedAt
+      errorKind
+    }
+    models {
+      modelId
+      checks {
+        operation
+        status {
+          kind
+          testedAt
+          errorKind
+        }
+      }
+    }
+  }
+}

packages/common/graphql/src/graphql/index.ts

@@ -512,6 +512,31 @@ export const listUsersQuery = {
 }`,
 };
 
+export const probeManagedCopilotProfileMutation = {
+  id: 'probeManagedCopilotProfileMutation' as const,
+  op: 'probeManagedCopilotProfile',
+  query: `mutation probeManagedCopilotProfile($profileId: ID!, $checks: [ManagedProfileProbeCheckInput!]!) {
+  probeManagedCopilotProfile(profileId: $profileId, checks: $checks) {
+    connection {
+      kind
+      testedAt
+      errorKind
+    }
+    models {
+      modelId
+      checks {
+        operation
+        status {
+          kind
+          testedAt
+          errorKind
+        }
+      }
+    }
+  }
+}`,
+};
+
 export const rotateAuthSigningKeyMutation = {
   id: 'rotateAuthSigningKeyMutation' as const,
   op: 'rotateAuthSigningKey',

packages/common/graphql/src/schema.ts

@@ -1641,6 +1641,36 @@ export interface ManageUserInput {
   name?: InputMaybe<Scalars['String']['input']>;
 }
 
+export interface ManagedProfileModelProbeCheckType {
+  __typename?: 'ManagedProfileModelProbeCheckType';
+  operation: ByokProbeOperation;
+  status: ManagedProfileProbeStatusType;
+}
+
+export interface ManagedProfileModelProbeType {
+  __typename?: 'ManagedProfileModelProbeType';
+  checks: Array<ManagedProfileModelProbeCheckType>;
+  modelId: Scalars['String']['output'];
+}
+
+export interface ManagedProfileProbeCheckInput {
+  modelId: Scalars['String']['input'];
+  operation: ByokProbeOperation;
+}
+
+export interface ManagedProfileProbeResultType {
+  __typename?: 'ManagedProfileProbeResultType';
+  connection: ManagedProfileProbeStatusType;
+  models: Array<ManagedProfileModelProbeType>;
+}
+
+export interface ManagedProfileProbeStatusType {
+  __typename?: 'ManagedProfileProbeStatusType';
+  errorKind: Maybe<Scalars['String']['output']>;
+  kind: ByokProbeStatusKind;
+  testedAt: Maybe<Scalars['DateTime']['output']>;
+}
+
 export enum McpAccessMode {
   READ_ONLY = 'READ_ONLY',
   READ_WRITE = 'READ_WRITE',
@@ -1813,6 +1843,8 @@ export interface Mutation {
   /** mention user in a doc */
   mentionUser: Scalars['ID']['output'];
   previewLicense: AdminLicensePreview;
+  /** Test a server-managed copilot provider profile by dispatching real probe requests. */
+  probeManagedCopilotProfile: ManagedProfileProbeResultType;
   probeWorkspaceByokDraft: WorkspaceByokProbeResultType;
   probeWorkspaceByokProfile: WorkspaceByokProbeResultType;
   publishDoc: DocType;
@@ -2115,6 +2147,11 @@ export interface MutationPreviewLicenseArgs {
   license: Scalars['Upload']['input'];
 }
 
+export interface MutationProbeManagedCopilotProfileArgs {
+  checks: Array<ManagedProfileProbeCheckInput>;
+  profileId: Scalars['ID']['input'];
+}
+
 export interface MutationProbeWorkspaceByokDraftArgs {
   input: ProbeWorkspaceByokDraftInput;
 }
@@ -4278,6 +4315,38 @@ export type ListUsersQuery = {
   }>;
 };
 
+export type ProbeManagedCopilotProfileMutationVariables = Exact<{
+  profileId: Scalars['ID']['input'];
+  checks: Array<ManagedProfileProbeCheckInput> | ManagedProfileProbeCheckInput;
+}>;
+
+export type ProbeManagedCopilotProfileMutation = {
+  __typename?: 'Mutation';
+  probeManagedCopilotProfile: {
+    __typename?: 'ManagedProfileProbeResultType';
+    connection: {
+      __typename?: 'ManagedProfileProbeStatusType';
+      kind: ByokProbeStatusKind;
+      testedAt: string | null;
+      errorKind: string | null;
+    };
+    models: Array<{
+      __typename?: 'ManagedProfileModelProbeType';
+      modelId: string;
+      checks: Array<{
+        __typename?: 'ManagedProfileModelProbeCheckType';
+        operation: ByokProbeOperation;
+        status: {
+          __typename?: 'ManagedProfileProbeStatusType';
+          kind: ByokProbeStatusKind;
+          testedAt: string | null;
+          errorKind: string | null;
+        };
+      }>;
+    }>;
+  };
+};
+
 export type RotateAuthSigningKeyMutationVariables = Exact<{
   expectedActiveKeyId: Scalars['String']['input'];
 }>;
@@ -8125,6 +8194,11 @@ export type Mutations =
       variables: ImportUsersMutationVariables;
       response: ImportUsersMutation;
     }
+  | {
+      name: 'probeManagedCopilotProfileMutation';
+      variables: ProbeManagedCopilotProfileMutationVariables;
+      response: ProbeManagedCopilotProfileMutation;
+    }
   | {
       name: 'rotateAuthSigningKeyMutation';
       variables: RotateAuthSigningKeyMutationVariables;