refactor: expose metro and remote config node apis

[thymikee]

Summary

Expose reusable Node APIs for remote Metro and remote-config without making server code shell out to the CLI.

This stays as stable subpath exports from agent-device rather than splitting packages yet:

• agent-device/metro
• agent-device/remote-config
• agent-device/contracts

Cleanup in this PR keeps the public surface intentionally small and the ownership boundaries explicit:

• agent-device/metro exposes explicit public types and a narrowed prepareRemoteMetro() result instead of the full internal Metro prepare payload
• agent-device/remote-config only exposes path resolution and resolved-profile loading
• agent-device/contracts exposes an explicit daemon contract surface without leaking CliFlags / CommandFlags
• remote-config parsing and env/default resolution are library-owned in a shared core module, with the CLI reduced to a small adapter back into CliFlags
• shared source-value parsing/env-name helpers back both the remote-config schema and the CLI option schema, with a test that keeps their metadata aligned
• normalizeBaseUrl() now avoids regex-based trailing-slash trimming to satisfy CodeQL's ReDoS warning
• CLI commands remain thin wrappers over the library helpers

Public API added by this PR:

agent-device/metro

• prepareRemoteMetro(options: PrepareRemoteMetroOptions): Promise<PrepareRemoteMetroResult>
• ensureMetroTunnel(options: EnsureMetroTunnelOptions): Promise<EnsureMetroTunnelResult>
• stopMetroTunnel(options: StopMetroTunnelOptions): Promise<void>
• buildIosRuntimeHints(baseUrl: string): MetroRuntimeHints
• buildAndroidRuntimeHints(baseUrl: string): MetroRuntimeHints
• types: PrepareRemoteMetroOptions, PrepareRemoteMetroResult, EnsureMetroTunnelOptions, EnsureMetroTunnelResult, StopMetroTunnelOptions, MetroRuntimeHints, MetroBridgeResult

agent-device/remote-config

• resolveRemoteConfigPath(options: RemoteConfigProfileOptions): string
• resolveRemoteConfigProfile(options: RemoteConfigProfileOptions): ResolvedRemoteConfigProfile
• types: RemoteConfigProfile, RemoteConfigProfileOptions, ResolvedRemoteConfigProfile

agent-device/contracts

• types: SessionRuntimeHints, DaemonInstallSource, DaemonLockPolicy, DaemonRequestMeta, DaemonRequest, DaemonArtifact, DaemonResponseData, DaemonError, DaemonResponse

Touched files in final branch diff: 15.

Validation

• pnpm format
• pnpm check:tooling
• pnpm vitest run src/utils/__tests__/cli-option-schema.test.ts src/__tests__/remote-config-public.test.ts src/__tests__/cli-client-commands.test.ts src/__tests__/close-remote-metro.test.ts
• pnpm vitest run src/__tests__/metro-public.test.ts src/__tests__/remote-config-public.test.ts src/__tests__/client-metro-companion.test.ts src/__tests__/client-metro-companion-worker.test.ts src/__tests__/client-metro-auto-companion.test.ts src/__tests__/close-remote-metro.test.ts src/__tests__/cli-client-commands.test.ts
• pnpm vitest run src/utils/__tests__/url.test.ts
• node --test test/integration/installed-package-metro.test.ts

Known gap:

• pnpm check:unit still has unrelated baseline failures in existing tests under src/core/__tests__/dispatch-back.test.ts, src/core/__tests__/dispatch-push.test.ts, src/core/__tests__/dispatch-trigger-app-event.test.ts, and src/platforms/android/__tests__/devices.test.ts

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://callstackincubator.github.io/agent-device/pr-preview/pr-372/
Built to branch gh-pages at 2026-04-10 10:59 UTC. Preview will be ready when the GitHub Pages deployment is complete.