ldap-rest 1.1.0 → 1.2.1

package/dist/src/plugins/rabbitmq.d.ts

@@ -19,6 +19,7 @@
  */
 import DmPlugin from '../abstract/plugin';
 import type { DM } from '../bin';
+import type { HealthStatus } from '../lib/health';
 /** JSON-serialisable message payload. */
 export type RabbitMessage = Record<string, unknown>;
 /** Async handler invoked for each consumed message. */
@@ -46,6 +47,18 @@ interface RabbitClient {
     subscribe(exchange: string, routingKey: string, queue: string, handler: RabbitMessageHandler, options?: SubscribeOptions): Promise<void>;
     unsubscribe(queue: string): Promise<void>;
     close(clearSubscriptions?: boolean): Promise<void>;
+    isConnected(): boolean;
+}
+/** The logging contract of `@linagora/rabbitmq-client`: message first, then a context */
+interface ClientLogger {
+    debug(message: string, context?: unknown): void;
+    info(message: string, context?: unknown): void;
+    warn(message: string, context?: unknown): void;
+    error(message: string, context?: unknown): void;
+}
+interface RabbitClientOptions {
+    url: string;
+    logger: ClientLogger;
 }
 export default class RabbitMq extends DmPlugin {
     name: string;
@@ -59,6 +72,13 @@ export default class RabbitMq extends DmPlugin {
      * the broker is reachable — the connection is still lazy.
      */
     isAvailable(): boolean;
+    /**
+     * Degraded when a broker is configured and no connection to it stands:
+     * the state as it is, nothing opened for the probe, which would run the
+     * client's connection attempts on every probe while the broker is away.
+     * A plugin without a broker has nothing to report.
+     */
+    health(): HealthStatus;
     /**
      * Publish a JSON message to a topic exchange. No-op (returns silently) when
      * no broker is configured or the client is unavailable.
@@ -89,6 +109,22 @@ export default class RabbitMq extends DmPlugin {
      * retry policy in `getClient()` can be tested without a live broker.
      */
     protected connect(): Promise<RabbitClient>;
-    private registerShutdown;
+    /**
+     * Build and initialise a client of the given class: a test hands in a stub
+     * to see what the client is built with.
+     */
+    protected open(Client: new (options: RabbitClientOptions) => unknown): Promise<RabbitClient>;
+    /**
+     * The client's lines go through the plugin's logger, under its name, so
+     * they follow `--logger` and `--log-level`; without one the client writes
+     * to the console. An `Error` in the context is written as text: the JSON
+     * format keeps only its enumerable fields, which for a channel error is
+     * the code without the broker's message.
+     */
+    private clientLogger;
+    /** Set by `close`: a publish of what outlives the drain opens nothing */
+    private closed;
+    /** Close the broker connection; nothing opens one after */
+    close(): Promise<void>;
 }
 export {};

package/dist/src/plugins/scim/errors.d.ts

@@ -14,6 +14,8 @@ export declare class ScimError extends HttpError {
     scimType?: ScimErrorType;
     constructor(status: number, detail: string, scimType?: ScimErrorType);
 }
+/** The kind of a client value, for an error that quotes none of it */
+export declare const kindOf: (v: unknown) => string;
 export declare const scimInvalidFilter: (detail?: string) => ScimError;
 export declare const scimInvalidPath: (detail?: string) => ScimError;
 export declare const scimInvalidValue: (detail?: string) => ScimError;

package/dist/src/plugins/scim/types.d.ts

@@ -120,7 +120,8 @@ export interface BulkRequest {
     Operations: BulkOperationRequest[];
 }
 export interface BulkOperationResponse {
-    method: 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    /** Absent when the operation was not even an object */
+    method?: 'POST' | 'PUT' | 'PATCH' | 'DELETE';
     bulkId?: string;
     version?: string;
     location?: string;

package/dist/src/plugins/static.d.ts

@@ -65,6 +65,18 @@ export default class Static extends DmPlugin {
      * @returns its URL, or undefined when this plugin does not serve it
      */
     urlOf(file: string): string | undefined;
+    /**
+     * The URL its schema routes serve a schema file at, merged with what it
+     * extends and its placeholders replaced, for another plugin to announce
+     * it: one of the configuration's schema files it serves, or a file its
+     * `schemas/` directory reaches, through a link included. One that
+     * express.static would send as it stands, outside `schemas/` or not named
+     * `.json`, has none.
+     *
+     * @param file the schema file, as the other plugin reads it
+     * @returns its URL, or undefined when its schema routes do not serve it
+     */
+    schemaUrlOf(file: string): string | undefined;
     /** The path it serves under, which an earlier plugin may have taken */
     servedPath(): string;
     /**

package/dist/src/plugins/storage/file.d.ts

@@ -1,5 +1,6 @@
 import type winston from 'winston';
 import Store, { type StoredRecord } from '../../lib/storage/store';
+import type { HealthStatus } from '../../lib/health';
 export default class FileStore extends Store {
     name: string;
     private dir;
@@ -8,6 +9,9 @@ export default class FileStore extends Store {
     constructor(logger: winston.Logger, dir: string, abandonedAfterSeconds: number);
     /** The directory is created on demand, readable by this user alone. */
     ready(): Promise<void>;
+    open(): Promise<void>;
+    /** A directory this user may write a record in: entered and written */
+    health(): Promise<HealthStatus>;
     private path;
     /** `<deadline> <key>\n<value>` — the deadline first, so a short read still has it. */
     private static encode;

package/dist/src/plugins/storage/postgres.d.ts

@@ -1,19 +1,6 @@
-/**
- * @module plugins/storage/postgres
- *
- * A keyed store kept in one PostgreSQL table.
- *
- * `pg` is an optional dependency, loaded when this backend is chosen: a
- * deployment that keeps its records elsewhere never needs it installed.
- *
- * The key is kept verbatim, split into the consumer's namespace and its own
- * key: a `text` column has no reason to hash it the way a DN or a file name
- * must, so a `SELECT` says what a record is about.
- *
- * @group Plugins
- */
 import type winston from 'winston';
 import Store, { type StoredRecord } from '../../lib/storage/store';
+import { type HealthStatus } from '../../lib/health';
 type Pg = typeof import('pg');
 export default class PostgresStore extends Store {
     name: string;
@@ -26,6 +13,12 @@ export default class PostgresStore extends Store {
     /** Split out so a test can stand in for a missing package. */
     protected driver(): Promise<Pg>;
     open(): Promise<void>;
+    /**
+     * On a client of its own, closed after, with the budget as its timeouts:
+     * a query the pool never got an answer to would hold one of its
+     * connections for as long as the socket lives
+     */
+    health(): Promise<HealthStatus>;
     close(): Promise<void>;
     /**
      * The pool, once the table is known to be there. A failure is not kept:

package/dist/src/plugins/storage/valkey.d.ts

@@ -1,20 +1,6 @@
-/**
- * @module plugins/storage/valkey
- *
- * A keyed store kept in Valkey, or Redis.
- *
- * `iovalkey` is an optional dependency, loaded when this backend is chosen: a
- * deployment that keeps its records elsewhere never needs it installed.
- *
- * The only backend that expires its own records, so it has nothing to sweep.
- * The value still carries its deadline, in the shape the LDAP store uses:
- * reads judge expiry by it, as with every other backend, and the TTL only
- * reclaims the memory.
- *
- * @group Plugins
- */
 import type winston from 'winston';
 import Store, { type StoredRecord } from '../../lib/storage/store';
+import type { HealthStatus } from '../../lib/health';
 type IoValkey = typeof import('iovalkey');
 export default class ValkeyStore extends Store {
     name: string;
@@ -27,6 +13,7 @@ export default class ValkeyStore extends Store {
     /** Split out so a test can stand in for a missing package. */
     protected driver(): Promise<IoValkey>;
     open(): Promise<void>;
+    health(): Promise<HealthStatus>;
     close(): Promise<void>;
     /**
      * The client, once connected. A failed first connection is not kept: the

package/dist/src/plugins/storage.d.ts

@@ -30,10 +30,18 @@
 import DmPlugin from '../abstract/plugin';
 import type { DM } from '../bin';
 import type Store from '../lib/storage/store';
+import type { HealthStatus } from '../lib/health';
 export default class Storage extends DmPlugin {
     name: string;
     store: Store;
     constructor(server: DM);
+    close(): Promise<void>;
+    /** Set while the backend fails the probe, so the reason is logged once */
+    private degraded;
+    /** Counts the probes: only the latest says what the log lines say */
+    private probes;
+    /** The backend's own answer; a backend that cannot answer is degraded */
+    health(): Promise<HealthStatus>;
     /**
      * Release the single-instance hold.
      *

package/dist/src/plugins/twake/drive.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Twake Drive Plugin
+ *
+ * Synchronizes LDAP user changes with Twake Drive via Admin API.
+ * Propagates email address, display name, and disk quota changes.
+ *
+ * @see https://docs.cozy.io/en/cozy-stack/admin/
+ */
 import TwakePlugin from '../../abstract/twakePlugin';
 import { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';

package/dist/src/plugins/twake/groups.d.ts

@@ -11,6 +11,7 @@ import { type LifecycleAttributes } from './lifecycleAttributes';
  */
 export declare const read: (entry: AttributesList, attribute: string) => string | undefined;
 export declare const ORG = "{org}";
+export declare function withOrg(pattern: string, org: string): string;
 /** A refusal the routes answer as `{ error, code }`. */
 export declare class RouteError extends Error {
     readonly status: number;
@@ -36,8 +37,6 @@ export declare function values(value: AttributeValue | undefined): string[];
 /** A DN spelled one way, to compare two spellings of it. */
 export declare function dnKey(dn: string): string;
 export declare function parentOf(dn: string): string;
-/** The RDN value of a DN, unescaped, or the DN itself if it has none. */
-export declare function rdnValue(dn: string): string;
 /**
  * The entries one level under a DN pattern holding `{org}`, the organization
  * captured as one RDN value: `(?:\\.|[^,])+` keeps an escaped comma inside it.

package/dist/src/plugins/twake/james.d.ts

@@ -1,5 +1,6 @@
 import type { Express } from 'express';
 import TwakePlugin from '../../abstract/twakePlugin';
+import type { HealthStatus } from '../../lib/health';
 import { type Role } from '../../abstract/plugin';
 import type { DM } from '../../bin';
 import type { AttributeValue } from '../../lib/ldapActions';
@@ -22,6 +23,7 @@ export default class James extends TwakePlugin {
         onLdapChange: string;
         ldapGroups: string;
     };
+    health(): Promise<HealthStatus>;
     private quotaAttr;
     private aliasAttr;
     private mailboxTypeAttr;

package/dist/src/plugins/twake/migrationProxy.d.ts

@@ -0,0 +1,71 @@
+/**
+ * @module plugins/twake/migrationProxy
+ *
+ * Keeps the migrated-users list of the Twake Mail migration proxy in step
+ * with the accounts of the directory: an account created during the
+ * migration has no mailbox on the old system, so the proxy has to route it
+ * to the new one from its first login, and the addresses of a migrated
+ * account have to follow it.
+ *
+ * See `docs/usage/plugins/integrations/mail-migration.md`.
+ */
+import type { Express } from 'express';
+import TwakePlugin from '../../abstract/twakePlugin';
+import { type Role } from '../../abstract/plugin';
+import type { DM } from '../../bin';
+import type { Hooks } from '../../hooks';
+import type { HealthStatus } from '../../lib/health';
+/**
+ * @openapi
+ * components:
+ *   schemas:
+ *     MailMigrationStatus:
+ *       type: object
+ *       required: [migrated]
+ *       properties:
+ *         migrated:
+ *           type: boolean
+ *           description: Whether the proxy routes the user to the new backend
+ */
+export default class MigrationProxy extends TwakePlugin {
+    name: string;
+    roles: Role[];
+    dependencies: {
+        onLdapChange: string;
+    };
+    private readonly branches;
+    private readonly aliasAttr;
+    /** The work on one entry waits for the work before it */
+    private readonly queues;
+    constructor(server: DM);
+    health(): Promise<HealthStatus>;
+    api(app: Express): void;
+    hooks: Hooks;
+    /**
+     * One entry at a time: two writes close together would otherwise race to
+     * the proxy, the second reading a list the first has not written yet
+     */
+    private inOrder;
+    /**
+     * The address the entry logs in with, and the ones that reach it, each
+     * once: an alias repeating the mail would otherwise be put and taken off
+     * in the same breath
+     */
+    private addresses;
+    /**
+     * An entry gaining its address is put on the list with all of them, one
+     * losing it is taken off; one keeping it has its addresses follow it when
+     * the proxy says it is migrated, and is left to the migration otherwise.
+     * The proxy folds usernames to lower case, so a change of case is none.
+     */
+    private follow;
+    private userUrl;
+    private call;
+    /**
+     * `HEAD /migratedUsers/{user}`: 204 when migrated, 404 otherwise. With
+     * `retry`, an answer of {@link PROXY_UNAVAILABLE} is asked again as a
+     * write would be; throws once the proxy has not said
+     */
+    isMigrated(address: string, retry?: boolean): Promise<boolean>;
+    private getMigrationStatus;
+}

package/docs/client-development/api/reference.md

@@ -93,11 +93,13 @@ Complete technical reference for the LDAP-Rest REST API including detailed speci
 | 500  | Internal Server Error | Server-side failure            | LDAP connection issues, database errors, plugin failures |
 | 503  | Service Unavailable   | Server temporarily unavailable | LDAP server down, maintenance mode                       |
 
-**Example 500 Response:**
+**Example 500 Response** (the failure is in the server's logs; `message`
+names it only when the server runs with `--debug`):
 
 ```json
 {
-  "error": "LDAP bind error"
+  "error": "Internal Server Error",
+  "message": "An error occurred"
 }
 ```
 
@@ -805,13 +807,7 @@ Failed to fetch
 
 #### Problem: LDAP Connection Failed
 
-**Error:**
-
-```json
-{
-  "error": "LDAP bind error"
-}
-```
+**Error:** a 500 answer, with `LDAP bind error` in the server's logs.
 
 **Checklist:**
 

package/docs/client-development/api/rest-api.md

@@ -1335,19 +1335,13 @@ no `limit` was given —
 
 #### 500 Internal Server Error
 
-**LDAP Connection Error:**
+The failure is in the server's logs, not in the response; the message names
+it only when the server runs with `--debug`:
 
 ```json
 {
-  "error": "LDAP bind error"
-}
-```
-
-**General Server Error:**
-
-```json
-{
-  "error": "Internal server error: <details>"
+  "error": "Internal Server Error",
+  "message": "An error occurred"
 }
 ```
 

package/docs/client-development/schemas/README.md

@@ -169,7 +169,10 @@ This will be replaced with the actual LDAP base at runtime (e.g., `ou=users,dc=e
 
 ## Attribute Types
 
-LDAP-Rest supports three main attribute types: `string`, `array`, and `pointer`.
+LDAP-Rest supports three main attribute types: `string`, `array`, and `pointer`,
+plus `number`, `integer`, `boolean` and `date` for single values. What a
+client sends has to have the shape of the type, see
+[what a value must look like](#what-a-value-must-look-like).
 
 ### String Type
 
@@ -337,7 +340,7 @@ Complete reference for all attribute properties.
 
 | Property   | Type            | Applies To          | Description                                                                           | Example                             |
 | ---------- | --------------- | ------------------- | ------------------------------------------------------------------------------------- | ----------------------------------- |
-| `type`     | string          | All                 | Attribute data type: `"string"`, `"array"`, `"pointer"`, `"number"`, `"integer"`      | `"string"`                          |
+| `type`     | string          | All                 | `"string"`, `"array"`, `"pointer"`, `"number"`, `"integer"`, `"boolean"`, `"date"`    | `"string"`                          |
 | `required` | boolean         | All                 | Whether the attribute must be present                                                 | `true`                              |
 | `fixed`    | boolean         | All                 | Whether the attribute value cannot be changed after creation                          | `true`                              |
 | `role`     | string/string[] | String              | Semantic role, or roles, for special handling (see [Semantic Roles](#semantic-roles)) | `"identifier"`                      |
@@ -364,6 +367,32 @@ Defines the data type of the attribute. Supported values:
 - `"pointer"`: Reference to another LDAP entry (DN)
 - `"number"`: Numeric value (integer or float)
 - `"integer"`: Integer value only
+- `"boolean"`: `true` or `false`, stored as `TRUE` / `FALSE`
+- `"date"`: LDAP generalized time, as text
+
+#### What a value must look like
+
+A single-valued attribute takes one value, an `array` a list. A list of one
+value stands for that value and one value for a list of one, so what a read
+answers, one value where the attribute holds one, can be sent back as is;
+two values or more for a single-valued attribute are refused. Each element
+of an `array` follows `items.type`, text without `items`. A `number` or
+`integer` is a JSON number or its text (`42`, `"42"`), a `boolean` a JSON
+boolean or the directory's `TRUE` / `FALSE`; anything else for them, and
+anything but text for a `string`, `date` or `pointer`, is refused; an
+attribute with `normalize` takes any text, read after validation. In a
+`replace`, `null` or `[]` clears an attribute; in an `add` or on a creation
+they are refused as no value. A `delete` naming the attribute, or naming it
+with no value, removes it, unless it is `required`; naming values removes
+those, every value it holds included, as the server does not read what
+remains, and `''` names no value. An empty string sent as a value is
+checked against `test`, refused for a pointer, and missing for a `required`
+attribute. Every refusal answers 400 with the attribute's name.
+
+Every entity route applies these rules; `test/lib/entitySchema.contract.test.ts`
+asserts them on a flat entity, a group and an organization alike. In the
+server they are enforced by `EntityValidator` (`src/lib/entitySchema/validator.ts`)
+alone: ESLint refuses the import of the schema helpers anywhere else.
 
 #### `required` (Optional, default: `false`)
 
@@ -674,13 +703,8 @@ Common validation patterns:
 
 ### Type Validation
 
-Attribute values must match their declared type:
-
-- **String**: Single text value
-- **Array**: Multiple values (may be empty unless required)
-- **Number**: Numeric value (integer or float)
-- **Integer**: Integer value only
-- **Pointer**: Valid DN string
+Attribute values must have the shape of their declared type, see
+[what a value must look like](#what-a-value-must-look-like).
 
 ### Fixed Attributes
 
@@ -780,6 +804,7 @@ twake/
 ```bash
 npx ldap-rest \
   --ldap-base 'dc=example,dc=com' \
+  --ldap-dn 'cn=admin,dc=example,dc=com' --ldap-pwd secret \
   --plugin core/ldap/flatGeneric \
   --ldap-flat-schema ./static/schemas/twake/users.json \
   --plugin core/ldap/groups \
@@ -842,6 +867,7 @@ ad/
 ```bash
 npx ldap-rest \
   --ldap-base 'dc=example,dc=com' \
+  --ldap-dn 'cn=admin,dc=example,dc=com' --ldap-pwd secret \
   --plugin core/ldap/flatGeneric \
   --ldap-flat-schema ./static/schemas/ad/users.json \
   --plugin core/ldap/groups \
@@ -910,6 +936,7 @@ standard/
 ```bash
 npx ldap-rest \
   --ldap-base 'dc=example,dc=com' \
+  --ldap-dn 'cn=admin,dc=example,dc=com' --ldap-pwd secret \
   --plugin core/ldap/flatGeneric \
   --ldap-flat-schema ./static/schemas/standard/users.json \
   --plugin core/ldap/groups \
@@ -1055,6 +1082,7 @@ Save your schema and reference it when starting LDAP-Rest:
 ```bash
 npx ldap-rest \
   --ldap-base 'dc=example,dc=com' \
+  --ldap-dn 'cn=admin,dc=example,dc=com' --ldap-pwd secret \
   --plugin core/ldap/flatGeneric \
   --ldap-flat-schema ./path/to/custom-users.json
 ```
@@ -1131,18 +1159,29 @@ it with a 500.
 ### Served Schemas
 
 `core/static` serves the merged schema. The configuration API gives each
-entity its merged schema inline (`schema`) and, with `core/static`, a
-`schemaUrl` made of the file path from its first `schemas` directory:
-`/etc/ldap-rest/schemas/users.json` gets `/static/schemas/users.json`.
-`core/static` serves a configured schema file at that URL even when it is
-outside `--static-path`, and before a shipped schema of the same URL:
-`/etc/ldap-rest/schemas/twake/users.json` is what
-`/static/schemas/twake/users.json` returns. An option left at its default
-does not count: without `--group-schema`, a `--static-path` of your own
-still serves its `schemas/twake/groups.json`. If two configured files get
-the same URL, the first one is served there and a warning names the other.
-A file outside any `schemas` directory has no `schemaUrl`; its schema is
-still inline.
+entity its merged schema inline (`schema`) and, where a static plugin's
+schema routes serve that very file, its `schemaUrl`, under the plugin's own
+`--static-name`:
+
+- a schema file of the configuration gets the file path from its first
+  `schemas` directory, `/etc/ldap-rest/schemas/users.json` getting
+  `/static/schemas/users.json`. `core/static` serves it at that URL even
+  when it is outside `--static-path`, and before a shipped schema of the
+  same URL: `/etc/ldap-rest/schemas/twake/users.json` is what
+  `/static/schemas/twake/users.json` returns. If two configured files get
+  the same URL, the first one is served there and a warning names the
+  other;
+- a file the `schemas/` directory of `--static-path` holds, that directory
+  being a link or not, gets its path in it, if it is named `.json`.
+
+An option left at its default does not count as configured: without
+`--group-schema`, a `--static-path` of your own still serves its
+`schemas/twake/groups.json`, and no `schemaUrl` is given unless that file is
+the package's, through a link. A static plugin loaded under another name, or with a
+`static_name` of its own, is asked as well, the one registered as `static`
+first. A file no static plugin serves merged has no `schemaUrl`, one
+express.static would send as it stands included (outside `schemas/`, or not
+named `.json`); its schema is still inline.
 
 ---
 

package/docs/plugin-development/README.md

@@ -61,20 +61,22 @@ export default class MyPlugin extends DmPlugin {
 - **this.config**: Complete configuration object
 - **this.logger**: Winston logger instance
 - **this.registeredHooks**: Access to global hook registry
+- **this.fetch**: `fetch` timed into the
+  [outbound metrics](../usage/operations.md#metrics) under the plugin's
+  name; the lint refuses a bare `fetch` or `node-fetch` under `src`, and a
+  plugin with a `fetch` member of its own has to rename it
 
 ### Error Handling and Server Resilience
 
-LDAP-Rest includes robust error handling to ensure the server remains operational even when plugins encounter errors:
-
-#### Global Error Handling
-
-The server automatically catches and handles:
-
-- **Uncaught exceptions** in plugin code
-- **Unhandled promise rejections**
-- **Errors in async route handlers**
-
-All errors are logged with full stack traces without crashing the server.
+An error a route handler or a hook throws is logged with its stack; the
+request is answered with a 5xx when the hook ran before the operation, and
+the server keeps serving. An exception nothing catches, in a timer or an
+event handler, is not: the binary shuts down and exits with 1, and a
+promise rejection nothing handles is logged and counted, see
+[shutdown](../usage/operations.md#shutdown); a host assembling the server
+chooses with `exitOnCrash()`. A plugin holding a connection, a timer or a
+queue implements `close()`, see
+[for plugin authors](../usage/operations.md#for-plugin-authors).
 
 #### Using asyncHandler
 
@@ -175,7 +177,7 @@ export default class WebhookNotifier extends DmPlugin {
   // Private methods
   private async sendWebhook(event: string, data: unknown): Promise<void> {
     try {
-      await fetch(this.config.webhook_url as string, {
+      await this.fetch(this.config.webhook_url as string, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ event, data }),
@@ -1153,7 +1155,7 @@ export default class NotificationPlugin extends DmPlugin {
     const timeoutId = setTimeout(() => controller.abort(), this.webhookTimeout);
 
     try {
-      const response = await fetch(this.webhookUrl, {
+      const response = await this.fetch(this.webhookUrl, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',

package/docs/plugin-development/dependencies.md

@@ -204,6 +204,14 @@ overrides builds a second instance, and it needs a name of its own.
 - **Consumes Hooks**: (Hooks provided by `onLdapChange`)
 - **Notes**: Synchronizes LDAP users/groups with Apache James mail server
 
+#### `migrationProxy` (twake/migrationProxy)
+
+- **Dependencies**:
+  - `onLdapChange: 'core/ldap/onChange'` ⚠️ **Required**
+- **Provides Hooks**: None
+- **Consumes Hooks**: `onLdapEntryChange` (provided by `onLdapChange`)
+- **Notes**: Keeps the migrated-users list of the Twake Mail migration proxy, see [mail-migration](../usage/plugins/integrations/mail-migration.md)
+
 #### `calendar` (twake/calendar)
 
 - **Dependencies**:

package/docs/plugin-development/hooks.md

@@ -9,7 +9,7 @@ those typed in [hooks.ts](../../src/hooks.ts), which is the reference.
 
 ## [LDAP](../../src/lib/ldapActions.ts) hooks
 
-- **ldapopts**: called before any ldapsearch to modify search options
+- **ldapsearchopts**: called before any ldapsearch to modify search options
 - **ldapsearchresult**: called after any ldapsearch to modify search result
 - **ldapaddrequest**: called before any ldapadd
 - **ldapadddone**: launched once an ldapadd has written the entry, not awaited

package/docs/usage/README.md

@@ -88,4 +88,5 @@ The system will:
 - **[Plugins](plugins/README.md)** - Choose and configure plugins
 - **[Upgrading](upgrading.md)** - What to check before deploying a new version
 - **[Directory audit](directory-audit.md)** - What a schema would refuse in an existing directory
+- **[Operations](operations.md)** - Health and readiness probes
 - **[Troubleshooting](troubleshooting.md)** - Problem resolution