@google/adk 2.2.0 → 2.3.0

package/dist/esm/plugins/tool_call_integrity_plugin.js

@@ -0,0 +1,339 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { createEvent, getFunctionCalls } from "../events/event.js";
+import {
+  INTERNAL_METADATA_PREFIX,
+  markRestored,
+  RESTORED_EVENT_KEY
+} from "../events/internal_metadata.js";
+import { logger } from "../utils/logger.js";
+import { BasePlugin } from "./base_plugin.js";
+const TOOL_CALL_HMAC_METADATA_KEY = `${INTERNAL_METADATA_PREFIX}fc_hmac`;
+const STAMP_PREFIX = "v1:";
+const _ToolCallIntegrityError = class _ToolCallIntegrityError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolCallIntegrityError";
+  }
+};
+__name(_ToolCallIntegrityError, "ToolCallIntegrityError");
+let ToolCallIntegrityError = _ToolCallIntegrityError;
+function jsonForm(value) {
+  const json = JSON.stringify(value);
+  return json === void 0 ? null : JSON.parse(json);
+}
+__name(jsonForm, "jsonForm");
+function canonicalJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+  }
+  if (value !== null && typeof value === "object") {
+    const object = value;
+    const entries = Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+__name(canonicalJson, "canonicalJson");
+function jsonArgs(args) {
+  const json = jsonForm(args != null ? args : {});
+  return json != null ? json : {};
+}
+__name(jsonArgs, "jsonArgs");
+function canonicalPayload(session, event, functionCall) {
+  var _a, _b, _c, _d, _e;
+  return new TextEncoder().encode(
+    canonicalJson({
+      app_name: session.appName,
+      user_id: session.userId,
+      session_id: session.id,
+      invocation_id: (_a = event.invocationId) != null ? _a : null,
+      branch: (_b = event.branch) != null ? _b : null,
+      author: (_c = event.author) != null ? _c : null,
+      name: (_d = functionCall.name) != null ? _d : null,
+      id: (_e = functionCall.id) != null ? _e : null,
+      args: jsonArgs(functionCall.args)
+    })
+  );
+}
+__name(canonicalPayload, "canonicalPayload");
+function isStampMap(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.values(value).every(
+    // eslint-disable-next-line no-control-regex
+    (stamp) => typeof stamp === "string" && /^[\x00-\x7f]*$/.test(stamp)
+  );
+}
+__name(isStampMap, "isStampMap");
+function isRestored(event) {
+  var _a;
+  return Boolean((_a = event.customMetadata) == null ? void 0 : _a[RESTORED_EVENT_KEY]);
+}
+__name(isRestored, "isRestored");
+function getStamps(event) {
+  var _a;
+  const stamps = (_a = event.customMetadata) == null ? void 0 : _a[TOOL_CALL_HMAC_METADATA_KEY];
+  if (stamps === void 0 || stamps === null) {
+    return {};
+  }
+  if (!isStampMap(stamps)) {
+    throw new ToolCallIntegrityError(
+      `Event '${event.id}' has a malformed integrity stamp.`
+    );
+  }
+  return stamps;
+}
+__name(getStamps, "getStamps");
+function hasStamp(stamps, callId) {
+  return Object.hasOwn(stamps, callId);
+}
+__name(hasStamp, "hasStamp");
+function toHex(bytes) {
+  return Array.from(
+    new Uint8Array(bytes),
+    (b) => b.toString(16).padStart(2, "0")
+  ).join("");
+}
+__name(toHex, "toHex");
+function fromHex(hex) {
+  if (!/^[0-9a-f]{64}$/.test(hex)) {
+    return void 0;
+  }
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+__name(fromHex, "fromHex");
+function getSubtleCrypto() {
+  var _a;
+  const subtle = (_a = globalThis.crypto) == null ? void 0 : _a.subtle;
+  if (!subtle) {
+    throw new Error(
+      "ToolCallIntegrityPlugin requires the Web Crypto API (globalThis.crypto.subtle), which is not available in this environment."
+    );
+  }
+  return subtle;
+}
+__name(getSubtleCrypto, "getSubtleCrypto");
+const _ToolCallIntegrityPlugin = class _ToolCallIntegrityPlugin extends BasePlugin {
+  /**
+   * @throws {Error} If `secretKey` is empty or contains a key that is not
+   *     non-empty bytes.
+   */
+  constructor(options) {
+    var _a, _b;
+    super((_a = options.name) != null ? _a : "tool_call_integrity");
+    const secretKey = options.secretKey;
+    const rawKeys = secretKey instanceof Uint8Array ? [secretKey] : Array.isArray(secretKey) ? [...secretKey] : [];
+    if (rawKeys.length === 0 || !rawKeys.every((key) => key instanceof Uint8Array && key.length > 0)) {
+      throw new Error(
+        "secretKey must be non-empty bytes or a non-empty list of them."
+      );
+    }
+    this.keys = rawKeys.map((key) => new Uint8Array(key));
+    this.allowUnstampedCalls = (_b = options.allowUnstampedCalls) != null ? _b : false;
+  }
+  /**
+   * Returns a copy with internal metadata removed and marked as restored.
+   *
+   * Use it on events that your code copies into another session, so that the
+   * history passes the integrity check. The copy only keeps the history: its
+   * function calls are never executed.
+   *
+   * @param event The event to copy. It is not modified.
+   * @returns The marked copy, ready to append to the new session.
+   */
+  static prepareRestoredEvent(event) {
+    return markRestored(createEvent(structuredClone(event)));
+  }
+  getCryptoKeys() {
+    if (!this.cryptoKeys) {
+      const subtle = getSubtleCrypto();
+      this.cryptoKeys = Promise.all(
+        this.keys.map(
+          (key) => subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, [
+            "sign",
+            "verify"
+          ])
+        )
+      );
+    }
+    return this.cryptoKeys;
+  }
+  async sign(payload) {
+    const [primary] = await this.getCryptoKeys();
+    const digest = await getSubtleCrypto().sign("HMAC", primary, payload);
+    return STAMP_PREFIX + toHex(digest);
+  }
+  /** `subtle.verify` compares in constant time. */
+  async verify(payload, stamp) {
+    if (!stamp.startsWith(STAMP_PREFIX)) {
+      return false;
+    }
+    const signature = fromHex(stamp.slice(STAMP_PREFIX.length));
+    if (!signature) {
+      return false;
+    }
+    const subtle = getSubtleCrypto();
+    for (const key of await this.getCryptoKeys()) {
+      if (await subtle.verify("HMAC", key, signature, payload)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  unstamped(name, callId) {
+    const message = `${name} call '${callId}' has no integrity stamp.`;
+    if (!this.allowUnstampedCalls) {
+      throw new ToolCallIntegrityError(message);
+    }
+    logger.warn(message);
+  }
+  async onEventCallback({
+    invocationContext,
+    event
+  }) {
+    var _a;
+    const session = invocationContext.session;
+    const calls = getFunctionCalls(event).filter((fc) => fc.id);
+    if (!event.partial) {
+      const seen = /* @__PURE__ */ new Set();
+      for (const fc of calls) {
+        if (seen.has(fc.id)) {
+          throw new ToolCallIntegrityError(
+            `Event '${event.id}' repeats function call ID '${fc.id}'.`
+          );
+        }
+        seen.add(fc.id);
+      }
+    }
+    const stamps = {};
+    for (const fc of calls) {
+      stamps[fc.id] = await this.sign(canonicalPayload(session, event, fc));
+    }
+    if (Object.keys(stamps).length > 0) {
+      event.customMetadata = {
+        ...(_a = event.customMetadata) != null ? _a : {},
+        [TOOL_CALL_HMAC_METADATA_KEY]: stamps
+      };
+    }
+    return void 0;
+  }
+  async beforeRunCallback({
+    invocationContext
+  }) {
+    const session = invocationContext.session;
+    for (const event of session.events) {
+      const calls = getFunctionCalls(event);
+      if (calls.length === 0 || isRestored(event)) {
+        continue;
+      }
+      const stamps = getStamps(event);
+      const verified = /* @__PURE__ */ new Set();
+      for (const fc of calls) {
+        if (!fc.id) {
+          continue;
+        }
+        if (!hasStamp(stamps, fc.id)) {
+          this.unstamped(fc.name, fc.id);
+          continue;
+        }
+        if (verified.has(fc.id)) {
+          throw new ToolCallIntegrityError(
+            `Event '${event.id}' has duplicate function call ID '${fc.id}'.`
+          );
+        }
+        const payload = canonicalPayload(session, event, fc);
+        if (!await this.verify(payload, stamps[fc.id])) {
+          throw new ToolCallIntegrityError(
+            `${fc.name} call '${fc.id}' does not match its integrity stamp.`
+          );
+        }
+        verified.add(fc.id);
+      }
+      const unmatched = Object.keys(stamps).filter((id) => !verified.has(id)).sort();
+      if (unmatched.length > 0) {
+        throw new ToolCallIntegrityError(
+          `Event '${event.id}' has integrity stamps with no matching call: ${JSON.stringify(unmatched)}.`
+        );
+      }
+    }
+    return void 0;
+  }
+  async beforeToolCallback({
+    tool,
+    toolArgs,
+    toolContext
+  }) {
+    const callId = toolContext.functionCallId;
+    if (!callId) {
+      throw new ToolCallIntegrityError(
+        `${tool.name} call has no ID, so its integrity cannot be checked.`
+      );
+    }
+    const session = toolContext.invocationContext.session;
+    const stored = [];
+    let restored = false;
+    for (const event of session.events) {
+      for (const fc of getFunctionCalls(event)) {
+        if (fc.id !== callId) {
+          continue;
+        }
+        if (isRestored(event)) {
+          restored = true;
+        } else {
+          stored.push([event, fc]);
+        }
+      }
+    }
+    if (stored.length === 0) {
+      if (restored) {
+        throw new ToolCallIntegrityError(
+          `${tool.name} call '${callId}' comes from restored history and cannot be executed.`
+        );
+      }
+      this.unstamped(tool.name, callId);
+      return void 0;
+    }
+    const trusted = [];
+    for (const [event, fc] of stored) {
+      const stamps = getStamps(event);
+      if (!hasStamp(stamps, callId)) {
+        this.unstamped(tool.name, callId);
+      } else if (!await this.verify(
+        canonicalPayload(session, event, fc),
+        stamps[callId]
+      )) {
+        throw new ToolCallIntegrityError(
+          `${tool.name} call '${callId}' does not match its integrity stamp.`
+        );
+      }
+      trusted.push(fc);
+    }
+    const executed = canonicalJson(jsonArgs(toolArgs));
+    const matches = trusted.some(
+      (fc) => fc.name === tool.name && canonicalJson(jsonArgs(fc.args)) === executed
+    );
+    if (!matches) {
+      throw new ToolCallIntegrityError(
+        `${tool.name} call '${callId}' arguments do not match its stored call.`
+      );
+    }
+    return void 0;
+  }
+};
+__name(_ToolCallIntegrityPlugin, "ToolCallIntegrityPlugin");
+let ToolCallIntegrityPlugin = _ToolCallIntegrityPlugin;
+export {
+  TOOL_CALL_HMAC_METADATA_KEY,
+  ToolCallIntegrityError,
+  ToolCallIntegrityPlugin
+};

package/dist/esm/runner/in_memory_runner.js

@@ -18,28 +18,23 @@ const _InMemoryRunner = class _InMemoryRunner extends Runner {
    * @param params The configuration for the runner.
    * @param params.app An optional application instance to run.
    * @param params.agent The root agent to run.
-   * @param params.appName The application name. Defaults to `'InMemoryRunner'`.
+   * @param params.appName The application name. Defaults to `app.name` when
+   *     `app` is provided, or `'InMemoryRunner'` otherwise.
    * @param params.plugins An optional list of plugins.
    * @param params.resumabilityConfig An optional resumability configuration.
    */
   constructor(params) {
-    var _a;
-    const {
-      agent,
-      appName = "InMemoryRunner",
-      plugins = [],
-      app,
-      resumabilityConfig
-    } = params;
+    var _a, _b;
+    const { agent, appName, plugins = [], app, resumabilityConfig } = params;
     super({
       app,
-      appName,
+      appName: (_a = appName != null ? appName : app == null ? void 0 : app.name) != null ? _a : "InMemoryRunner",
       agent,
       plugins,
       artifactService: new InMemoryArtifactService(),
       sessionService: new InMemorySessionService(),
       memoryService: new InMemoryMemoryService(),
-      resumabilityConfig: (_a = app == null ? void 0 : app.resumabilityConfig) != null ? _a : resumabilityConfig
+      resumabilityConfig: (_b = app == null ? void 0 : app.resumabilityConfig) != null ? _b : resumabilityConfig
     });
   }
 };

package/dist/esm/runner/runner.js

@@ -31,8 +31,13 @@ import {
   BuiltInCodeExecutor,
   isBuiltInCodeExecutor
 } from "../code_executors/built_in_code_executor.js";
+import { buildAbortEvents, isAbortEvent } from "../events/abort_events.js";
 import { createEvent } from "../events/event.js";
 import { createEventActions } from "../events/event_actions.js";
+import {
+  internalMetadata,
+  withoutInternalMetadata
+} from "../events/internal_metadata.js";
 import { PluginManager } from "../plugins/plugin_manager.js";
 import {
   runAsyncGeneratorWithOtelContext,
@@ -60,8 +65,8 @@ const _Runner = class _Runner {
    */
   constructor(input) {
     this[_a] = true;
-    var _a2, _b, _c, _d, _e, _f, _g, _h, _i;
-    const appName = (_b = (_a2 = input.app) == null ? void 0 : _a2.name) != null ? _b : input.appName;
+    var _a2, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+    const appName = (_b = input.appName) != null ? _b : (_a2 = input.app) == null ? void 0 : _a2.name;
     const agent = (_d = (_c = input.app) == null ? void 0 : _c.rootAgent) != null ? _d : input.agent;
     if (!agent) {
       throw new Error(
@@ -78,6 +83,20 @@ const _Runner = class _Runner {
     this.memoryService = input.memoryService;
     this.credentialService = input.credentialService;
     this.resumabilityConfig = (_i = (_h = input.app) == null ? void 0 : _h.resumabilityConfig) != null ? _i : input.resumabilityConfig;
+    this.autoCreateSession = (_j = input.autoCreateSession) != null ? _j : false;
+  }
+  /**
+   * Looks the session up, creating it first when `autoCreateSession` is set.
+   *
+   * A runner with no `appName` cannot address a session, so it falls through to
+   * the plain lookup rather than creating one under an undefined app name.
+   */
+  async resolveSession(userId, sessionId) {
+    const key = { appName: this.appName, userId, sessionId };
+    if (this.autoCreateSession && this.appName) {
+      return this.sessionService.getOrCreateSession(key);
+    }
+    return this.sessionService.getSession(key);
   }
   /**
    * Runs the agent with a new, ephemeral session.
@@ -138,12 +157,8 @@ const _Runner = class _Runner {
         ctx,
         this,
         async function* () {
-          var _a2, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
-          const session = await this.sessionService.getSession({
-            appName: this.appName,
-            userId,
-            sessionId
-          });
+          var _a2, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l;
+          const session = await this.resolveSession(userId, sessionId);
           if ((_a2 = params.abortSignal) == null ? void 0 : _a2.aborted) {
             return;
           }
@@ -218,7 +233,8 @@ const _Runner = class _Runner {
                 author: "user",
                 actions: stateDelta ? createEventActions({ stateDelta }) : void 0,
                 content: newMessage,
-                customMetadata: params.customMetadata
+                // Callers cannot set ADK-internal keys.
+                customMetadata: withoutInternalMetadata(params.customMetadata)
               })
             });
             if ((_e = params.abortSignal) == null ? void 0 : _e.aborted) {
@@ -253,35 +269,45 @@ const _Runner = class _Runner {
               }
               yield earlyExitEvent;
             } else {
-              for await (const event of this.runRoot(invocationContext)) {
-                if ((_h = params.abortSignal) == null ? void 0 : _h.aborted) {
-                  return;
-                }
-                const modifiedEvent = await this.pluginManager.runOnEventCallback({
-                  invocationContext,
-                  event
-                });
-                const outputEvent = modifiedEvent ? {
-                  ...modifiedEvent,
-                  id: event.id,
-                  invocationId: event.invocationId,
-                  timestamp: event.timestamp,
-                  author: modifiedEvent.author || event.author,
-                  branch: (_i = modifiedEvent.branch) != null ? _i : event.branch
-                } : event;
-                if (!event.partial) {
-                  await this.sessionService.appendEvent({
-                    session,
-                    event: outputEvent
-                  });
+              let abortSealed = false;
+              const sealAbortedInvocation = /* @__PURE__ */ __name(() => {
+                abortSealed = true;
+                return this.synthesizeAbortEvents(invocationContext);
+              }, "sealAbortedInvocation");
+              try {
+                for await (const event of this.runRoot(invocationContext)) {
+                  if ((_h = params.abortSignal) == null ? void 0 : _h.aborted) {
+                    break;
+                  }
+                  const outputEvent = await this.processAndAppendEvent(
+                    invocationContext,
+                    event
+                  );
+                  if ((_i = params.abortSignal) == null ? void 0 : _i.aborted) {
+                    break;
+                  }
+                  yield outputEvent;
                 }
                 if ((_j = params.abortSignal) == null ? void 0 : _j.aborted) {
+                  for (const abortEvent of await sealAbortedInvocation()) {
+                    yield abortEvent;
+                  }
                   return;
                 }
-                yield outputEvent;
+              } finally {
+                if (((_k = params.abortSignal) == null ? void 0 : _k.aborted) && !abortSealed) {
+                  try {
+                    await sealAbortedInvocation();
+                  } catch (e) {
+                    logger.error(
+                      `Failed to seal aborted invocation ${invocationContext.invocationId}.`,
+                      e
+                    );
+                  }
+                }
               }
               await this.pluginManager.runAfterRunCallback({ invocationContext });
-              if ((_k = params.abortSignal) == null ? void 0 : _k.aborted) {
+              if ((_l = params.abortSignal) == null ? void 0 : _l.aborted) {
                 return;
               }
             }
@@ -313,6 +339,56 @@ const _Runner = class _Runner {
     }
     yield* runNodeAsInvocation(this.agent, invocationContext);
   }
+  /**
+   * Runs the on_event plugin callbacks on an event and appends the result to
+   * the session unless it is partial.
+   *
+   * @returns The event as streamed to the caller.
+   */
+  async processAndAppendEvent(invocationContext, event) {
+    var _a2;
+    const modifiedEvent = await this.pluginManager.runOnEventCallback({
+      invocationContext,
+      event
+    });
+    const outputEvent = modifiedEvent ? {
+      ...withInternalMetadataOf(event, modifiedEvent),
+      id: event.id,
+      invocationId: event.invocationId,
+      timestamp: event.timestamp,
+      author: modifiedEvent.author || event.author,
+      branch: (_a2 = modifiedEvent.branch) != null ? _a2 : event.branch
+    } : event;
+    if (!event.partial) {
+      await this.sessionService.appendEvent({
+        session: invocationContext.session,
+        event: outputEvent
+      });
+    }
+    return outputEvent;
+  }
+  /**
+   * Seals an aborted invocation in session history: answers its dangling
+   * function calls with error responses, or records a plain abort event when
+   * there is nothing to answer.
+   *
+   * @returns The synthetic events after plugin processing and persistence.
+   */
+  async synthesizeAbortEvents(invocationContext) {
+    const abortEvents = buildAbortEvents({
+      events: invocationContext.session.events,
+      invocationId: invocationContext.invocationId,
+      rootAgentName: this.agent.name,
+      branch: invocationContext.branch
+    });
+    const outputEvents = [];
+    for (const event of abortEvents) {
+      outputEvents.push(
+        await this.processAndAppendEvent(invocationContext, event)
+      );
+    }
+    return outputEvents;
+  }
   /**
    * Saves artifacts from the message parts and replaces the inline data with
    * a file name placeholder and optional file reference.
@@ -514,7 +590,7 @@ const _Runner = class _Runner {
             if ((_d2 = params.abortSignal) == null ? void 0 : _d2.aborted) {
               return;
             }
-            const eventToProcess = modifiedEvent != null ? modifiedEvent : event;
+            const eventToProcess = modifiedEvent ? withInternalMetadataOf(event, modifiedEvent) : event;
             if (!eventToProcess.partial && !isLiveModelMediaEventWithInlineData(eventToProcess)) {
               await this.sessionService.appendEvent({
                 session,
@@ -533,6 +609,18 @@ const _Runner = class _Runner {
 };
 __name(_Runner, "Runner");
 let Runner = _Runner;
+function withInternalMetadataOf(original, replacement) {
+  var _a2;
+  const internal = internalMetadata(original.customMetadata);
+  if (Object.keys(internal).length === 0) {
+    return replacement;
+  }
+  return {
+    ...replacement,
+    customMetadata: { ...(_a2 = replacement.customMetadata) != null ? _a2 : {}, ...internal }
+  };
+}
+__name(withInternalMetadataOf, "withInternalMetadataOf");
 function isLiveModelMediaEventWithInlineData(event) {
   var _a2;
   const parts = (_a2 = event.content) == null ? void 0 : _a2.parts;
@@ -547,7 +635,8 @@ function isLiveModelMediaEventWithInlineData(event) {
 }
 __name(isLiveModelMediaEventWithInlineData, "isLiveModelMediaEventWithInlineData");
 function determineAgentForResumption(session, rootAgent, resumabilityConfig) {
-  const event = findEventByLastFunctionResponseId(session.events);
+  const lastEvent = session.events[session.events.length - 1];
+  const event = lastEvent && !isAbortEvent(lastEvent) ? findEventByLastFunctionResponseId(session.events) : null;
   const isResumable = Boolean(resumabilityConfig == null ? void 0 : resumabilityConfig.isResumable);
   if (event && event.author && isResumable) {
     const conflictingAuthors = getConflictingFunctionResponseAuthors(
@@ -571,7 +660,7 @@ function determineAgentForResumption(session, rootAgent, resumabilityConfig) {
   for (let i = session.events.length - 1; i >= 0; i--) {
     logger.debug("event:", stringifyWithRedactedInlineData(session.events[i]));
     const event2 = session.events[i];
-    if (event2.author === "user" || !event2.author) {
+    if (event2.author === "user" || !event2.author || isAbortEvent(event2)) {
       continue;
     }
     if (event2.author === rootAgent.name) {

package/dist/esm/sessions/db/operations.js

@@ -281,7 +281,7 @@ async function getConnectionOptionsFromUri(uri) {
     );
     return {
       entities: ENTITIES,
-      dbName: uri === "sqlite://:memory:" ? ":memory:" : uri.substring("sqlite://".length),
+      dbName: uri === "sqlite://:memory:" || uri === "sqlite:///:memory:" ? ":memory:" : uri.substring("sqlite://".length),
       driver: SqliteDriver
     };
   }

package/dist/esm/sessions/in_memory_session_service.js

@@ -47,7 +47,9 @@ const _InMemorySessionService = class _InMemorySessionService extends BaseSessio
     var _a;
     const filteredState = state ? trimTempState(state) : void 0;
     const session = createSession({
-      id: sessionId || randomUUID(),
+      // Surrounding whitespace is dropped so that a later lookup by the bare
+      // id finds the session, and a blank id gets a generated one.
+      id: (sessionId == null ? void 0 : sessionId.trim()) || randomUUID(),
       appName,
       userId,
       state: filteredState,

package/dist/esm/sessions/state.js

@@ -74,16 +74,19 @@ const _State = class _State {
   /**
    * Returns the value of the state dict for the given key.
    *
+   * Only keys the state holds itself are found. Names inherited from
+   * `Object.prototype`, such as `toString`, are treated as missing.
+   *
    * @param key The key to get the value for.
    * @param defaultValue The default value to return if the key is not found.
    * @return The value of the state for the given key, or the default value if
    *     not found.
    */
   get(key, defaultValue) {
-    if (key in this.delta) {
+    if (Object.hasOwn(this.delta, key)) {
       return this.delta[key];
     }
-    if (key in this.value) {
+    if (Object.hasOwn(this.value, key)) {
       return this.value[key];
     }
     return defaultValue;
@@ -101,10 +104,11 @@ const _State = class _State {
     recordStateWrite(this.value, this.delta, key);
   }
   /**
-   * Whether the state has pending delta.
+   * Whether the state holds the given key, either as a stored value or as a
+   * pending delta. Names inherited from `Object.prototype` are not keys.
    */
   has(key) {
-    return key in this.value || key in this.delta;
+    return Object.hasOwn(this.value, key) || Object.hasOwn(this.delta, key);
   }
   /**
    * Whether the state has pending delta.