feat: allow for multiple keys in snap_setState

[hmalik88]

Description

Updates snap_setState to accept an array of keys in the key parameter, allowing a Snap to set multiple state values in a single call.

Before

// Previous state
// { user: 'alice' }

// Only one key at a time
const value = await snap.request({
  method: 'snap_setState',
  params: { key: 'user', value: 'bob' },
});
// → { user: 'bob' }

After

// Previous state
// { user: 'alice', age: 21 }

// Multiple keys in one call
const values = await snap.request({
  method: 'snap_setState',
  params: { key: ['user', 'age'], value: { user: 'bob', age: 30 } }
});
// → { 'user': 'bob', 'age': 30 }

Behavior

• When key is a string[], value is expected to be an object and as a result those key/value pairs are set in state.
• All existing validation rules apply to each element in the array (dot-path syntax, forbidden keys).

---

Note

Medium Risk
Changes persisted Snap state merging logic and validation on a security-sensitive RPC path; behavior is additive for string keys but new null-default semantics for omitted array keys could surprise callers.

Overview
snap_setState now accepts key as a string array, so Snaps can update several state paths in one RPC call instead of one key at a time.

When key is an array, value must be an object whose properties map to those keys; keys listed in key but missing from value are written as null. Parameter validation uses StateKeysStruct / selectiveUnion (string vs array), with a dedicated invalid-params error if the value is not an object. SetStateParams in @metamask/snaps-sdk is updated to key?: string | string[].

Coverage adds unit tests in setState.test.ts, an integration test in the manage-state example, and the test-snaps SetState UI (comma-separated keys). Changelogs and Jest coverage thresholds are bumped accordingly.

^{Reviewed by Cursor Bugbot for commit 5a029af. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5a029af. Configure here.}

[cursor]

Example test uses unsupported getState keys

Medium Severity

The new example test calls getState with an array key, but snap_getState only accepts a string. That request is rejected as invalid params, so the assertion never receives the expected state object.

 

^{Reviewed by Cursor Bugbot for commit 5a029af. Configure here.}

[cursor]

Multi-key update is not atomic

Medium Severity

set mutates the cached state in place, and the multi-key loop writes each key before the next. If a later key fails, earlier writes stay in the in-memory cache even though the call errors, so later reads can see a partial update.

 

^{Reviewed by Cursor Bugbot for commit 5a029af. Configure here.}