v1.0.2

Fixed

• makeClient now rejects tlsOptions paired with a plain ldap:// URL instead of silently constructing a client that will fail every operation. ldapts treats a non-empty tlsOptions as "use implicit TLS" regardless of URL scheme, and this client never calls the separate .startTLS() upgrade method — so ldap://host:389 + tlsOptions opened a raw TLS handshake against a plaintext-LDAP port, which the server silently drops before any LDAP message parses. Every operation (getUser, checkPassword, ...) then failed identically, indistinguishable from a wrong password. Found via jump-host, where it broke every SSH password login. Use ldaps:// (typically :636) when tlsOptions is set.