fix: add runtime validation for ConnectionMode (WAPI-1129)

[chakra-guy]

Summary

• Adds runtime validation for ConnectionMode values at connect-time in both WalletClient and DappClient
• Exports CONNECTION_MODES const array and isValidConnectionMode() type guard from core
• Previously, an invalid mode like "admin" would silently fall through to the UntrustedConnectionHandler via the else branch

Background

ConnectionMode was a TypeScript-only type ("trusted" | "untrusted") with no runtime enforcement. Since SessionRequest.mode can come from external sources (e.g. a QR code, deep link, or cross-origin message), a malformed value would bypass type safety at runtime. The Cyfrin audit flagged this as needing runtime validation.

Changes

• packages/core/src/domain/connection-mode.ts: Added CONNECTION_MODES const array and isValidConnectionMode() type guard
• packages/core/src/index.ts: Exports the new symbols
• packages/wallet-client/src/client.ts: Validates request.mode before handler selection
• packages/dapp-client/src/client.ts: Validates mode before creating session request
• packages/core/CHANGELOG.md: Documents the new exports

Test plan

• yarn build passes
• yarn test:unit passes (68/68 tests)

---

Note

Low Risk
Low risk: small, localized change that adds runtime guarding of externally-sourced mode values and only affects connect-time error handling/flow selection.

Overview
Adds runtime validation for ConnectionMode by introducing CONNECTION_MODES and the isValidConnectionMode() type guard in core and exporting them publicly.

Updates DappClient.connect() and WalletClient.connect() to reject invalid mode values (throwing SessionError) before entering CONNECTING and selecting a connection handler, preventing unexpected fall-through to the untrusted flow.

^{Written by Cursor Bugbot for commit b20564c. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

The base branch was changed.