@opencoredev/social-sdk 0.3.0 → 0.4.0

package/dist/server/connections.d.ts

@@ -15,6 +15,10 @@ export interface ConnectionAttempt {
 }
 export interface ConnectionStart {
     readonly authorizationUrl: string;
+    /**
+     * Public attempt fields. The PKCE verifier always stays in the store, and so
+     * does `providerState` when the provider marks it secret.
+     */
     readonly attempt: Omit<ConnectionAttempt, "state" | "codeVerifier"> & {
         readonly state: string;
     };
@@ -30,9 +34,17 @@ export interface ConnectionProvider {
         readonly redirectUri: string;
         readonly state: string;
         readonly codeChallenge: string;
+        /** Account or server hint typed by the user, such as a Bluesky handle. */
+        readonly loginHint?: string;
     }): Promise<{
         readonly authorizationUrl: string;
         readonly providerState?: string;
+        /**
+         * Set when `providerState` holds secrets, such as a DPoP private key. The
+         * manager then keeps it in the store and leaves it out of the attempt
+         * returned by `begin`.
+         */
+        readonly providerStateSecret?: boolean;
     }>;
     complete(input: {
         readonly callbackUrl: string;
@@ -85,6 +97,8 @@ export declare class ConnectionManager {
         readonly redirectUri: string;
         readonly allowedRedirectUris: readonly string[];
         readonly provider: ConnectionProvider;
+        /** Passed to the provider unchanged. Bluesky uses it for a handle, DID, or server URL. */
+        readonly loginHint?: string;
     }): Promise<ConnectionStart>;
     discover(input: {
         readonly attemptId: string;

package/dist/server/connections.js

@@ -103,13 +103,14 @@ export class ConnectionManager {
         const codeVerifier = base64Url(this.#options.randomBytes(48));
         const attemptId = base64Url(this.#options.randomBytes(18));
         const expiresAt = new Date(now.getTime() + this.#options.ttlMs).toISOString();
-        const started = await input.provider.start({
+        const startInput = {
             platforms: input.platforms,
             capabilities: input.capabilities ?? [],
             redirectUri: input.redirectUri,
             state,
             codeChallenge: await challenge(codeVerifier),
-        });
+        };
+        const started = await input.provider.start(input.loginHint === undefined ? startInput : { ...startInput, loginHint: input.loginHint });
         const attemptBase = {
             id: attemptId,
             backend: input.backend,
@@ -128,6 +129,13 @@ export class ConnectionManager {
             : { ...attemptBase, providerState: started.providerState };
         await this.#options.store.save(attempt);
         const { state: publicState, codeVerifier: _privateVerifier, ...publicAttempt } = attempt;
+        if (started.providerStateSecret === true) {
+            const { providerState: _secretProviderState, ...withoutProviderState } = publicAttempt;
+            return {
+                authorizationUrl: started.authorizationUrl,
+                attempt: { ...withoutProviderState, state: publicState },
+            };
+        }
         return {
             authorizationUrl: started.authorizationUrl,
             attempt: { ...publicAttempt, state: publicState },

package/dist/server/egress.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Static egress checks for URLs that come from untrusted identity documents and
+ * server metadata. They only look at the URL itself: the scheme, `localhost`
+ * names, and IP-literal hosts. A hostname that resolves through DNS to a private
+ * address is not caught here, because `fetch` gives no portable way to see or pin
+ * the resolved address across Node.js, Bun, and edge runtimes. Server callers
+ * that need that guarantee inject a `fetch` that pins DNS results.
+ */
+/**
+ * Return why a URL must not be fetched, or `undefined` when the static checks
+ * pass. Only HTTPS is allowed, `localhost` names are rejected, and IP-literal
+ * hosts must be public unicast addresses.
+ */
+export declare function egressBlockReason(url: URL): string | undefined;

package/dist/server/egress.js

@@ -0,0 +1,115 @@
+/**
+ * Static egress checks for URLs that come from untrusted identity documents and
+ * server metadata. They only look at the URL itself: the scheme, `localhost`
+ * names, and IP-literal hosts. A hostname that resolves through DNS to a private
+ * address is not caught here, because `fetch` gives no portable way to see or pin
+ * the resolved address across Node.js, Bun, and edge runtimes. Server callers
+ * that need that guarantee inject a `fetch` that pins DNS results.
+ */
+/** IPv4 ranges that are never valid public destinations (RFC 6890 and successors). */
+const BLOCKED_V4 = [
+    [0x00000000, 8], // 0.0.0.0/8 "this network"
+    [0x0a000000, 8], // 10.0.0.0/8 private
+    [0x64400000, 10], // 100.64.0.0/10 carrier-grade NAT
+    [0x7f000000, 8], // 127.0.0.0/8 loopback
+    [0xa9fe0000, 16], // 169.254.0.0/16 link-local
+    [0xac100000, 12], // 172.16.0.0/12 private
+    [0xc0000000, 24], // 192.0.0.0/24 IETF protocol assignments
+    [0xc0000200, 24], // 192.0.2.0/24 documentation
+    [0xc0586300, 24], // 192.88.99.0/24 6to4 relay anycast
+    [0xc0a80000, 16], // 192.168.0.0/16 private
+    [0xc6120000, 15], // 198.18.0.0/15 benchmarking
+    [0xc6336400, 24], // 198.51.100.0/24 documentation
+    [0xcb007100, 24], // 203.0.113.0/24 documentation
+    [0xe0000000, 4], // 224.0.0.0/4 multicast
+    [0xf0000000, 4], // 240.0.0.0/4 reserved and broadcast
+];
+const V4_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+function parseV4(host) {
+    const match = V4_PATTERN.exec(host);
+    if (match === null)
+        return undefined;
+    let value = 0;
+    for (const part of match.slice(1)) {
+        const octet = Number(part);
+        if (octet > 255)
+            return undefined;
+        value = value * 256 + octet;
+    }
+    return value;
+}
+function blockedV4(address) {
+    return BLOCKED_V4.some(([base, bits]) => {
+        const size = 2 ** (32 - bits);
+        return address >= base && address < base + size;
+    });
+}
+/**
+ * Expand an IPv6 literal (without brackets) into eight hextets. The WHATWG URL
+ * parser always serializes IPv6 hosts in compressed hexadecimal form, so a
+ * dotted IPv4 tail never reaches this function; anything unexpected is rejected.
+ */
+function parseV6(host) {
+    const halves = host.split("::");
+    if (halves.length > 2)
+        return undefined;
+    const parse = (part) => {
+        if (part === undefined || part === "")
+            return [];
+        const out = [];
+        for (const group of part.split(":")) {
+            if (!/^[0-9a-f]{1,4}$/i.test(group))
+                return undefined;
+            out.push(Number.parseInt(group, 16));
+        }
+        return out;
+    };
+    const head = parse(halves[0]);
+    const rest = halves.length === 2 ? parse(halves[1]) : [];
+    if (head === undefined || rest === undefined)
+        return undefined;
+    const explicit = head.length + rest.length;
+    if (halves.length === 1 ? explicit !== 8 : explicit > 7)
+        return undefined;
+    return [...head, ...Array(8 - explicit).fill(0), ...rest];
+}
+function blockedV6(groups) {
+    const [a = 0, b = 0, c = 0, d = 0, e = 0, f = 0, g = 0, h = 0] = groups;
+    // IPv4-mapped (::ffff:0:0/96) and NAT64 (64:ff9b::/96): judge the embedded IPv4 address.
+    if ((a === 0 && b === 0 && c === 0 && d === 0 && e === 0 && f === 0xffff) ||
+        (a === 0x64 && b === 0xff9b && c === 0 && d === 0 && e === 0 && f === 0))
+        return blockedV4(g * 0x10000 + h);
+    // Only global unicast (2000::/3) can be public. This rejects ::, ::1, fc00::/7,
+    // fe80::/10, fec0::/10, ff00::/8, and IPv4-compatible addresses.
+    if ((a & 0xe000) !== 0x2000)
+        return true;
+    return ((a === 0x2001 && b < 0x0200) || // 2001::/23 IETF protocol assignments, including Teredo
+        (a === 0x2001 && b === 0x0db8) || // 2001:db8::/32 documentation
+        a === 0x2002 || // 2002::/16 6to4, which embeds an arbitrary IPv4 address
+        (a === 0x3fff && b < 0x1000) // 3fff::/20 documentation
+    );
+}
+/**
+ * Return why a URL must not be fetched, or `undefined` when the static checks
+ * pass. Only HTTPS is allowed, `localhost` names are rejected, and IP-literal
+ * hosts must be public unicast addresses.
+ */
+export function egressBlockReason(url) {
+    if (url.protocol !== "https:")
+        return "only HTTPS URLs are allowed";
+    if (url.username || url.password)
+        return "URLs with credentials are not allowed";
+    const host = url.hostname.toLowerCase().replace(/\.$/, "");
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return "localhost is not allowed";
+    if (host.startsWith("[") && host.endsWith("]")) {
+        const groups = parseV6(host.slice(1, -1));
+        return groups === undefined || blockedV6(groups)
+            ? "non-public IP addresses are not allowed"
+            : undefined;
+    }
+    const v4 = parseV4(host);
+    if (v4 !== undefined && blockedV4(v4))
+        return "non-public IP addresses are not allowed";
+    return undefined;
+}

package/dist/server/oauth-internal.d.ts

@@ -0,0 +1,6 @@
+import type { ConnectionAttempt } from "./connections.js";
+export declare function readBounded(response: Response, maxBytes: number, operation: string): Promise<string>;
+export declare function validateCallback(input: {
+    readonly callbackUrl: string;
+    readonly attempt: ConnectionAttempt;
+}): URL;

package/dist/server/oauth-internal.js

@@ -0,0 +1,66 @@
+import { SocialError } from "../core/errors.js";
+// Internal helpers shared by the direct OAuth providers. Not exported from the package.
+function fail(operation, message, code) {
+    throw new SocialError({ code, operation, message });
+}
+export async function readBounded(response, maxBytes, operation) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+        fail("oauth.config", "maxResponseBytes must be a positive safe integer", "invalid_input");
+    if (!response.body)
+        return "";
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            total += part.value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                fail(operation, "OAuth provider response exceeded the configured size limit", "upstream_failure");
+            }
+            chunks.push(part.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const merged = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        merged.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(merged);
+}
+export function validateCallback(input) {
+    let callback;
+    try {
+        callback = new URL(input.callbackUrl);
+    }
+    catch {
+        fail("connections.complete", "OAuth callback URL is invalid", "invalid_input");
+    }
+    let expected;
+    try {
+        expected = new URL(input.attempt.redirectUri);
+    }
+    catch {
+        fail("connections.complete", "OAuth attempt redirect URI is invalid", "invalid_input");
+    }
+    if (callback.origin !== expected.origin ||
+        callback.pathname !== expected.pathname ||
+        callback.username ||
+        callback.password ||
+        callback.hash)
+        fail("connections.complete", "OAuth callback does not match the registered redirect", "unauthorized");
+    for (const [key, value] of expected.searchParams)
+        if (callback.searchParams.getAll(key).length !== 1 || callback.searchParams.get(key) !== value)
+            fail("connections.complete", "OAuth callback does not match the registered redirect", "unauthorized");
+    const states = callback.searchParams.getAll("state");
+    if (states.length !== 1 || states[0] !== input.attempt.state)
+        fail("connections.complete", "OAuth callback state did not match the authenticated attempt", "unauthorized");
+    return callback;
+}

package/dist/server/oauth.d.ts

@@ -1,4 +1,5 @@
 import type { ConnectionAccount, ConnectionAttempt, ConnectionProvider } from "./connections.js";
+export * from "./bluesky-oauth.js";
 export interface OAuthTokenSet {
     readonly accessToken: string;
     readonly refreshToken?: string;
@@ -49,4 +50,3 @@ export declare const tiktokOAuth: (options: OAuthProviderOptions) => ConnectionP
 export declare const instagramOAuth: (options: OAuthProviderOptions) => ConnectionProvider;
 export declare const linkedinOAuth: (options: OAuthProviderOptions) => ConnectionProvider;
 export declare function refreshOAuthToken(kind: ProviderKind, options: OAuthProviderOptions, current: OAuthTokenSet): Promise<OAuthTokenSet>;
-export {};

package/dist/server/oauth.js

@@ -1,6 +1,10 @@
-/* oxlint-disable anti-slop/no-runtime-typeof, anti-slop/no-unknown-parameters, anti-slop/no-unsafe-dictionary-type, anti-slop/require-safety-comment-for-type-assertion, anti-slop/require-readable-spacing -- OAuth responses are unknown by contract and validated at this boundary. */
 import { SocialError } from "../core/errors.js";
-import { connectedAccountRef } from "../core/types.js";
+import { definedFields } from "../core/fields.js";
+import { connectedAccountRef, } from "../core/types.js";
+import { isJsonValue } from "../transport/json.js";
+import { isFiniteNumber, isJsonObject, isString } from "../transport/validation.js";
+import { readBounded, validateCallback } from "./oauth-internal.js";
+export * from "./bluesky-oauth.js";
 const configs = {
     youtube: {
         auth: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -63,17 +67,36 @@ function fail(operation, message, code = "upstream_failure", cause) {
     throw new SocialError({ code, operation, message, cause });
 }
 function asRecord(value, operation = "oauth.response") {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
+    if (!isJsonObject(value))
         fail(operation, "OAuth provider returned an invalid response");
     return value;
 }
 function requiredString(value, field, operation = "oauth.response") {
-    if (typeof value !== "string" || value.length === 0 || value.length > 8192)
+    if (!isString(value) || value.length === 0 || value.length > 8192)
         fail(operation, `OAuth provider response is missing ${field}`);
     return value;
 }
 function optionalString(value) {
-    return typeof value === "string" && value.length > 0 && value.length <= 8192 ? value : undefined;
+    return isString(value) && value.length > 0 && value.length <= 8192 ? value : undefined;
+}
+/** Any string, including an empty one, otherwise the fallback. */
+function stringOr(value, fallback) {
+    return isString(value) ? value : fallback;
+}
+/**
+ * Plain `JSON.parse`, checked against the JSON grammar. OAuth bodies keep native
+ * number parsing rather than the lossless integer handling in transport/json.
+ */
+function parseJsonText(raw) {
+    const parsed = JSON.parse(raw);
+    if (!isJsonValue(parsed))
+        throw new SyntaxError("Expected a JSON value");
+    return parsed;
+}
+function isAbortError(error) {
+    if (error instanceof DOMException)
+        return error.name === "AbortError";
+    return (typeof error === "object" && error !== null && "name" in error && error.name === "AbortError");
 }
 function errorForResponse(status, operation, providerCode) {
     if (status === 400 && providerCode === "invalid_grant")
@@ -97,38 +120,6 @@ function errorForResponse(status, operation, providerCode) {
         upstreamStatus: status,
     });
 }
-async function readBounded(response, maxBytes, operation) {
-    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
-        fail("oauth.config", "maxResponseBytes must be a positive safe integer", "invalid_input");
-    if (!response.body)
-        return "";
-    const reader = response.body.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        for (;;) {
-            const part = await reader.read();
-            if (part.done)
-                break;
-            total += part.value.byteLength;
-            if (total > maxBytes) {
-                await reader.cancel();
-                fail(operation, "OAuth provider response exceeded the configured size limit", "upstream_failure");
-            }
-            chunks.push(part.value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const merged = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        merged.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return new TextDecoder().decode(merged);
-}
 async function body(response, operation, maxBytes) {
     const raw = await readBounded(response, maxBytes, operation);
     const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
@@ -136,11 +127,11 @@ async function body(response, operation, maxBytes) {
         let providerCode;
         try {
             const parsed = contentType.includes("json") || raw.trimStart().startsWith("{")
-                ? JSON.parse(raw)
+                ? parseJsonText(raw)
                 : Object.fromEntries(new URLSearchParams(raw).entries());
-            if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            if (isJsonObject(parsed)) {
                 const error = parsed["error"];
-                providerCode = typeof error === "string" ? error : undefined;
+                providerCode = isString(error) ? error : undefined;
             }
         }
         catch {
@@ -154,7 +145,7 @@ async function body(response, operation, maxBytes) {
         contentType.includes("+json") ||
         raw.trimStart().startsWith("{")) {
         try {
-            return asRecord(JSON.parse(raw), operation);
+            return asRecord(parseJsonText(raw), operation);
         }
         catch {
             fail(operation, "OAuth provider returned malformed JSON");
@@ -177,9 +168,9 @@ function tokenSet(data, operation = "oauth.token") {
     const expires = data["expires_in"];
     let expiresAt;
     if (expires !== undefined) {
-        const seconds = typeof expires === "number"
+        const seconds = isFiniteNumber(expires)
             ? expires
-            : typeof expires === "string" && /^\d+(?:\.\d+)?$/.test(expires)
+            : isString(expires) && /^\d+(?:\.\d+)?$/.test(expires)
                 ? Number(expires)
                 : Number.NaN;
         if (!Number.isFinite(seconds) || seconds < 0 || seconds > 31_536_000_000)
@@ -189,17 +180,7 @@ function tokenSet(data, operation = "oauth.token") {
     const refreshToken = optionalString(data["refresh_token"]);
     const scopes = parseScopes(data["scope"]);
     const tokenType = optionalString(data["token_type"]);
-    // oxlint-disable-next-line anti-slop/no-known-value-widening -- validated boundary or fixture contract.
-    const result = { accessToken };
-    if (refreshToken !== undefined)
-        result.refreshToken = refreshToken;
-    if (expiresAt !== undefined)
-        result.expiresAt = expiresAt;
-    if (scopes !== undefined)
-        result.scopes = scopes;
-    if (tokenType !== undefined)
-        result.tokenType = tokenType;
-    return result;
+    return { accessToken, ...definedFields({ refreshToken, expiresAt, scopes, tokenType }) };
 }
 function tokenResult(data, kind) {
     let nested = data;
@@ -238,11 +219,7 @@ async function request(fetcher, url, init, operation, options) {
     catch (error) {
         if (error instanceof SocialError)
             throw error;
-        if ((error instanceof DOMException && error.name === "AbortError") ||
-            (typeof error === "object" &&
-                error !== null &&
-                "name" in error &&
-                error.name === "AbortError"))
+        if (isAbortError(error))
             fail(operation, "OAuth provider request timed out", "timeout");
         fail(operation, "OAuth provider request failed", "upstream_failure", error);
     }
@@ -261,35 +238,6 @@ function validateLinkedInVersion(value) {
         fail("oauth.config", "LinkedIn OAuth requires an explicit YYYYMM API version", "invalid_input");
     return value;
 }
-function validateCallback(input) {
-    let callback;
-    try {
-        callback = new URL(input.callbackUrl);
-    }
-    catch {
-        fail("connections.complete", "OAuth callback URL is invalid", "invalid_input");
-    }
-    let expected;
-    try {
-        expected = new URL(input.attempt.redirectUri);
-    }
-    catch {
-        fail("connections.complete", "OAuth attempt redirect URI is invalid", "invalid_input");
-    }
-    if (callback.origin !== expected.origin ||
-        callback.pathname !== expected.pathname ||
-        callback.username ||
-        callback.password ||
-        callback.hash)
-        fail("connections.complete", "OAuth callback does not match the registered redirect", "unauthorized");
-    for (const [key, value] of expected.searchParams)
-        if (callback.searchParams.getAll(key).length !== 1 || callback.searchParams.get(key) !== value)
-            fail("connections.complete", "OAuth callback does not match the registered redirect", "unauthorized");
-    const states = callback.searchParams.getAll("state");
-    if (states.length !== 1 || states[0] !== input.attempt.state)
-        fail("connections.complete", "OAuth callback state did not match the authenticated attempt", "unauthorized");
-    return callback;
-}
 function providerIdentity(kind, hint, discovered) {
     if (hint === undefined)
         return;
@@ -416,14 +364,14 @@ async function discover(kind, token, hint, backend, fetcher, options) {
         return items.map((item) => {
             const row = asRecord(item, "youtube.account");
             const snippet = asRecord(row["snippet"] ?? {}, "youtube.account");
-            return account("youtube", backend, requiredString(row["id"], "channel id", "youtube.account"), typeof snippet["title"] === "string" ? snippet["title"] : "YouTube channel");
+            return account("youtube", backend, requiredString(row["id"], "channel id", "youtube.account"), stringOr(snippet["title"], "YouTube channel"));
         });
     }
     if (kind === "x") {
         const data = await request(fetcher, "https://api.x.com/2/users/me", { headers: auth }, "x.account", options);
         const row = asRecord(data["data"], "x.account");
         return [
-            account("x", backend, requiredString(row["id"], "user id", "x.account"), typeof row["name"] === "string" ? row["name"] : "X account"),
+            account("x", backend, requiredString(row["id"], "user id", "x.account"), stringOr(row["name"], "X account")),
         ];
     }
     if (kind === "threads") {
@@ -432,7 +380,7 @@ async function discover(kind, token, hint, backend, fetcher, options) {
             fail("oauth.config", "Threads API version is invalid", "invalid_input");
         const data = await request(fetcher, `https://graph.threads.net/${version}/me?fields=id,username`, { headers: auth }, "threads.account", options);
         return [
-            account("threads", backend, requiredString(data["id"], "user id", "threads.account"), typeof data["username"] === "string" ? data["username"] : "Threads account"),
+            account("threads", backend, requiredString(data["id"], "user id", "threads.account"), stringOr(data["username"], "Threads account")),
         ];
     }
     if (kind === "tiktok") {
@@ -440,7 +388,7 @@ async function discover(kind, token, hint, backend, fetcher, options) {
         const row = asRecord(data["data"], "tiktok.account");
         const user = asRecord(row["user"], "tiktok.account");
         return [
-            account("tiktok", backend, requiredString(user["open_id"], "open_id", "tiktok.account"), typeof user["display_name"] === "string" ? user["display_name"] : "TikTok account"),
+            account("tiktok", backend, requiredString(user["open_id"], "open_id", "tiktok.account"), stringOr(user["display_name"], "TikTok account")),
         ];
     }
     if (kind === "instagram") {
@@ -454,13 +402,13 @@ async function discover(kind, token, hint, backend, fetcher, options) {
             ? hint
             : discoveredId;
         return [
-            account("instagram", backend, discoveredAccountId, typeof data["username"] === "string" ? data["username"] : "Instagram account"),
+            account("instagram", backend, discoveredAccountId, stringOr(data["username"], "Instagram account")),
         ];
     }
     const version = validateLinkedInVersion(options.linkedinApiVersion);
     const data = await request(fetcher, "https://api.linkedin.com/v2/userinfo", { headers: { ...auth, "LinkedIn-Version": version } }, "linkedin.account", options);
     const subject = requiredString(data["sub"], "member id", "linkedin.account");
-    const member = account("linkedin", backend, `urn:li:person:${subject}`, typeof data["name"] === "string" ? data["name"] : "LinkedIn member");
+    const member = account("linkedin", backend, `urn:li:person:${subject}`, stringOr(data["name"], "LinkedIn member"));
     let acl;
     try {
         acl = await request(fetcher, "https://api.linkedin.com/rest/organizationAcls?q=roleAssignee", { headers: { ...auth, "LinkedIn-Version": version } }, "linkedin.organizations", options);
@@ -475,11 +423,10 @@ async function discover(kind, token, hint, backend, fetcher, options) {
     const elements = Array.isArray(acl["elements"]) ? acl["elements"] : [];
     const organizations = elements.flatMap((entry) => {
         const row = asRecord(entry, "linkedin.organizations");
-        const target = typeof row["organizationTarget"] === "string"
-            ? row["organizationTarget"]
-            : typeof row["organizationalTarget"] === "string"
-                ? row["organizationalTarget"]
-                : "";
+        const organizationTarget = row["organizationTarget"];
+        const target = isString(organizationTarget)
+            ? organizationTarget
+            : stringOr(row["organizationalTarget"], "");
         const role = row["role"];
         if ((role !== "ADMINISTRATOR" &&
             role !== "CONTENT_ADMINISTRATOR" &&