@proveanything/smartlinks 2.0.68 → 2.0.70

package/dist/docs/server-functions.md

@@ -587,7 +587,10 @@ Key records to the returned canonical `id`, and refuse `null` — otherwise anyo
 empty fields** — it never overwrites a name or field the contact already has, because a visitor's typed
 details are unverified. It's race-safe: two simultaneous entries with one email end on one contact.
 Returns `{ contactId, created }`. `forCaller()` is the signed-in caller's own contact (`null` when
-anonymous). **Never return contact ids to public callers** — keep them on your records.
+anonymous): `{ contactId, email, phone, firstName, lastName, displayName, tags, customFields }`. Use it
+to check what a member is before returning member-only content — a level the staff set
+(`customFields.level`), a tag. It includes staff-only fields, so return only what the caller may see
+(see members.md). **Never return contact ids to public callers** — keep them on your records.
 
 This is not consent. A ticked "keep me updated" box is evidence you can record (below); subscribing
 someone to marketing is the double opt-in flow (`comms.signup`, see comms.md).

package/dist/openapi.yaml

@@ -2116,6 +2116,44 @@ paths:
             schema:
               type: object
               additionalProperties: true
+  /admin/collection/{collectionId}/authKit/{authKitId}/invite:
+    post:
+      tags:
+        - authKit
+      summary: Invite someone to be a member of a site with its own logins (admin).
+      operationId: authKit_invite
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: collectionId
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: authKitId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthKitInviteResponse"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AuthKitInviteRequest"
   /admin/collection/{collectionId}/batch:
     get:
       tags:
@@ -9898,10 +9936,7 @@ paths:
         content:
           application/json:
             schema:
-              type: string
-              enum:
-                - email
-                - sms
+              $ref: "#/components/schemas/MfaFactor"
   /authkit/{clientId}/mfa/challenge/verify:
     post:
       tags:
@@ -10058,6 +10093,58 @@ paths:
           description: Unauthorized
         404:
           description: Not found
+  /authkit/{clientId}/mfa/factors/totp/confirm:
+    post:
+      tags:
+        - authKit
+      summary: Confirm authenticator-app enrollment with the 6-digit code the app shows (authenticated).
+      operationId: authKit_confirmTotpMfa
+      security: []
+      parameters:
+        - name: clientId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MfaEnrolledResponse"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
+  /authkit/{clientId}/mfa/factors/totp/enroll:
+    post:
+      tags:
+        - authKit
+      summary: "Begin authenticator-app enrollment (authenticated): a new secret for Google Authenticator, Microsoft Authenticator, 1Password and the like."
+      operationId: authKit_enrollTotpMfa
+      security: []
+      parameters:
+        - name: clientId
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MfaTotpEnrollResponse"
+        400:
+          description: Bad request
+        401:
+          description: Unauthorized
+        404:
+          description: Not found
   /authkit/{clientId}/mfa/factors/{factor}:
     get:
       tags:
@@ -19790,6 +19877,37 @@ components:
         - userId
         - anonymous
         - via
+    CallerContact:
+      type: object
+      properties:
+        contactId:
+          type: string
+        email:
+          type: string
+        phone:
+          type: string
+        firstName:
+          type: string
+        lastName:
+          type: string
+        displayName:
+          type: string
+        tags:
+          type: array
+          items:
+            type: string
+        customFields:
+          type: object
+          additionalProperties: true
+      required:
+        - contactId
+        - email
+        - phone
+        - firstName
+        - lastName
+        - displayName
+        - tags
+        - customFields
     ServerFunctionContext:
       type: object
       properties:
@@ -22894,15 +23012,9 @@ components:
         availableFactors:
           type: array
           items:
-            type: string
-            enum:
-              - email
-              - sms
+            $ref: "#/components/schemas/MfaFactor"
         preferredFactor:
-          type: string
-          enum:
-            - email
-            - sms
+          $ref: "#/components/schemas/MfaFactor"
         maskedDestinations:
           type: object
           additionalProperties: true
@@ -22918,10 +23030,7 @@ components:
           type: object
           additionalProperties: true
         factor:
-          type: string
-          enum:
-            - email
-            - sms
+          $ref: "#/components/schemas/MfaFactor"
         destination:
           type: string
         expiresAt:
@@ -22951,6 +23060,28 @@ components:
         - mfaSessionToken
         - destination
         - expiresAt
+    MfaTotpEnrollResponse:
+      type: object
+      properties:
+        mfaSessionToken:
+          type: string
+        secret:
+          type: string
+        otpauthUri:
+          type: string
+        issuer:
+          type: string
+        account:
+          type: string
+        expiresAt:
+          type: string
+      required:
+        - mfaSessionToken
+        - secret
+        - otpauthUri
+        - issuer
+        - account
+        - expiresAt
     MfaEnrolledResponse:
       type: object
       properties:
@@ -22958,10 +23089,7 @@ components:
           type: object
           additionalProperties: true
         factor:
-          type: string
-          enum:
-            - email
-            - sms
+          $ref: "#/components/schemas/MfaFactor"
       required:
         - enrolled
         - factor
@@ -22977,6 +23105,9 @@ components:
         sms:
           type: object
           additionalProperties: true
+        totp:
+          type: object
+          additionalProperties: true
         recoveryCodesRemaining:
           type: number
         mfaEnabledForClient:
@@ -23372,8 +23503,51 @@ components:
             type: string
         identity:
           $ref: "#/components/schemas/AuthKitIdentity"
+        signUp:
+          type: string
+          enum:
+            - open
+            - invite
       required:
         - id
+    AuthKitInviteRequest:
+      type: object
+      properties:
+        email:
+          type: string
+        firstName:
+          type: string
+        lastName:
+          type: string
+        displayName:
+          type: string
+        customFields:
+          type: object
+          additionalProperties: true
+        redirectUrl:
+          type: string
+      required:
+        - email
+    AuthKitInviteResponse:
+      type: object
+      properties:
+        ok:
+          type: object
+          additionalProperties: true
+        userId:
+          type: string
+        contactId:
+          type: string
+        created:
+          type: boolean
+        expiresAt:
+          type: string
+      required:
+        - ok
+        - userId
+        - contactId
+        - created
+        - expiresAt
     AuthKitIdentity:
       type: object
       properties:
@@ -23465,6 +23639,13 @@ components:
         - INVALID_APPLE_TOKEN
         - ACCOUNT_EXISTS_UNVERIFIED
         - APPLE_AUTH_FAILED
+        - SIGN_UP_CLOSED
+    MfaFactor:
+      type: string
+      enum:
+        - email
+        - sms
+        - totp
     MfaErrorCode:
       type: string
       enum:

package/dist/testing/index.js

@@ -241,7 +241,7 @@ export function createFunctionTestContext(opts) {
             mem.contacts.push(Object.assign(Object.assign({}, d), { email, phone, contactId }));
             return { contactId, created: true };
         }), 'contacts.upsert'),
-        forCaller: gated('contacts', 'write', ct.forCaller ? ct.forCaller.bind(ct) : (async () => (opts.caller && opts.caller.userId ? { contactId: `contact-of-${opts.caller.userId}` } : null)), 'contacts.forCaller'),
+        forCaller: gated('contacts', 'write', ct.forCaller ? ct.forCaller.bind(ct) : (async () => (opts.caller && opts.caller.userId ? { contactId: `contact-of-${opts.caller.userId}`, email: null, phone: null, firstName: null, lastName: null, displayName: null, tags: [], customFields: {} } : null)), 'contacts.forCaller'),
     };
     const it = impl.interactions || {};
     sl.interactions = {

package/dist/types/appManifest.d.ts

@@ -437,16 +437,16 @@ export interface ServerFunctionSl {
     /**
      * Contacts (`sl:contacts:write`). `upsert` finds by email/phone or creates, and only FILLS EMPTY
      * fields — never overwrites (details typed by a visitor are unverified). `forCaller` is the signed-in
-     * caller's own contact (null when anonymous). Never return contact ids to public callers.
+     * caller's own contact with its tags and custom fields (null when anonymous) — check a member's level
+     * (`customFields.level`) here before returning member-only content. It includes staff-only fields:
+     * return only what the caller may see. Never return contact ids to public callers.
      */
     contacts: {
         upsert(details: ContactUpsertDetails): Promise<{
             contactId: string;
             created: boolean;
         }>;
-        forCaller(): Promise<{
-            contactId: string;
-        } | null>;
+        forCaller(): Promise<CallerContact | null>;
     };
     /**
      * Interactions (`sl:interactions:write`). `record` stores an event of one of THIS app's interaction
@@ -502,6 +502,18 @@ export interface ServerFunctionCaller {
     /** How the function was triggered. */
     via: AppFunctionTriggerType;
 }
+/** The signed-in caller's own contact, as a server function sees it (`ctx.sl.contacts.forCaller()`). */
+export interface CallerContact {
+    contactId: string;
+    email: string | null;
+    phone: string | null;
+    firstName: string | null;
+    lastName: string | null;
+    displayName: string | null;
+    tags: string[];
+    /** The collection's custom contact fields — including staff-only ones (a member's level, a paid-until date). */
+    customFields: Record<string, unknown>;
+}
 /**
  * The context handed to every SmartLinks server function. The platform builds a
  * fresh one per invocation and pre-scopes each handle to the function's declared

package/dist/types/authKit.d.ts

@@ -128,7 +128,9 @@ export interface AppleLoginOptions {
  * `ACCOUNT_EXISTS_UNVERIFIED` case also carries `requiresEmailVerification: true`
  * in `SmartlinksApiError.details`.
  */
-export type AuthKitErrorCode = 'MISSING_APPLE_TOKEN' | 'APPLE_AUTH_NOT_CONFIGURED' | 'INVALID_APPLE_TOKEN' | 'ACCOUNT_EXISTS_UNVERIFIED' | 'APPLE_AUTH_FAILED';
+export type AuthKitErrorCode = 'MISSING_APPLE_TOKEN' | 'APPLE_AUTH_NOT_CONFIGURED' | 'INVALID_APPLE_TOKEN' | 'ACCOUNT_EXISTS_UNVERIFIED' | 'APPLE_AUTH_FAILED' | 'SIGN_UP_CLOSED';
+/** A second-step method: a code by email or text message, or from an authenticator app. */
+export type MfaFactor = 'email' | 'sms' | 'totp';
 /**
  * Details carried on the `MFA_REQUIRED` error thrown by any session-issuing login method
  * (see the gate list above) when the client's MFA policy requires a step-up. Surfaced as
@@ -139,18 +141,20 @@ export interface MfaRequiredDetails {
     /** Short-lived (10 min) and single-use. Pass it to every challenge/finalize call below. */
     mfaSessionToken: string;
     /** Only factors the user actually enrolled. */
-    availableFactors: Array<'email' | 'sms'>;
-    /** `sms` is preferred over `email` when both are enrolled. */
-    preferredFactor: 'email' | 'sms';
+    availableFactors: MfaFactor[];
+    /** `totp`, then `sms`, then `email`: the first one the user enrolled. */
+    preferredFactor: MfaFactor;
+    /** `totp` is "your authenticator app" (nothing is sent for it). */
     maskedDestinations: {
         email?: string;
         sms?: string;
+        totp?: string;
     };
 }
 /** Response from {@link authKit.mfaChallengeSend}. */
 export interface MfaChallengeSendResponse {
     success: true;
-    factor: 'email' | 'sms';
+    factor: MfaFactor;
     /** Masked, e.g. `"j***@x.com"` or `"+1******1234"`. */
     destination: string;
     /** ISO timestamp, 10 minutes from send. */
@@ -179,10 +183,22 @@ export interface MfaEnrollSendResponse {
     destination: string;
     expiresAt: string;
 }
-/** Response from {@link authKit.confirmEmailMfa} / {@link authKit.confirmSmsMfa}. */
+/** Response from {@link authKit.enrollTotpMfa}: show `otpauthUri` as a QR code, and `secret` for typing in. */
+export interface MfaTotpEnrollResponse {
+    mfaSessionToken: string;
+    /** Base32, for people who type it into their app instead of scanning. Returned only here. */
+    secret: string;
+    /** `otpauth://totp/…` — render it as a QR code for the app to scan. */
+    otpauthUri: string;
+    /** What the app shows the entry as: the site, and the account. */
+    issuer: string;
+    account: string;
+    expiresAt: string;
+}
+/** Response from {@link authKit.confirmEmailMfa} / {@link authKit.confirmSmsMfa} / {@link authKit.confirmTotpMfa}. */
 export interface MfaEnrolledResponse {
     enrolled: true;
-    factor: 'email' | 'sms';
+    factor: MfaFactor;
 }
 /** Response from {@link authKit.getMfaFactors}. */
 export interface MfaFactorsResponse {
@@ -195,6 +211,11 @@ export interface MfaFactorsResponse {
             enrolledAt: string;
             destination: string;
         };
+        /** `destination` is "Authenticator app". */
+        totp?: {
+            enrolledAt: string;
+            destination: string;
+        };
     };
     recoveryCodesRemaining: number;
     mfaEnabledForClient: boolean;
@@ -415,6 +436,36 @@ export interface AuthKitConfig {
      * site, its own passwords). Switch with {@link authKit.setIdentity}; never via create/update.
      */
     identity?: AuthKitIdentity;
+    /**
+     * Who may join a site with its own logins. `open` (default): anyone can create an account.
+     * `invite`: only people the site's admins invite ({@link authKit.invite}). Every way of signing up
+     * (password, magic link, phone, Google, Apple, LinkedIn, WhatsApp) then refuses anyone else with
+     * `SIGN_UP_CLOSED` (403), and "send me a link / a code" answers as if sent without sending anything,
+     * so nobody can find out who is a member. Hide your "Create an account" option when it's `invite`.
+     * Setting `invite` needs own logins first (`OWN_LOGINS_REQUIRED`, 409).
+     */
+    signUp?: 'open' | 'invite';
+}
+/** Body of {@link authKit.invite}. */
+export interface AuthKitInviteRequest {
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    displayName?: string;
+    /** Set on their contact in this collection, e.g. `{ level: 'member' }` (staff-only and visible fields alike). */
+    customFields?: Record<string, unknown>;
+    /** Where the emailed link opens: the site's sign-in page (one of its own addresses). Default: the kit's `redirectUrl`. */
+    redirectUrl?: string;
+}
+/** Result of {@link authKit.invite}. The sign-in link itself only goes to their inbox. */
+export interface AuthKitInviteResponse {
+    ok: true;
+    userId: string;
+    contactId: string;
+    /** true when their account was made by this invite; false when they had one (they got a new link). */
+    created: boolean;
+    /** When the emailed link stops working (it works once). */
+    expiresAt: string;
 }
 /** An AuthKit's member pool. */
 export interface AuthKitIdentity {

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.68  |  Generated: 2026-10-17T10:04:22.637Z
+Version: 2.0.70  |  Generated: 2026-10-24T08:16:51.896Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2808,7 +2808,7 @@ interface ServerFunctionSl {
   tags: { resolve(id: string): Promise<ResolvedTag | null> };
   contacts: {
   upsert(details: ContactUpsertDetails): Promise<{ contactId: string; created: boolean }>;
-  forCaller(): Promise<{ contactId: string } | null>;
+  forCaller(): Promise<CallerContact | null>;
   };
   interactions: { record(event: ServerFunctionInteractionEvent): Promise<{ eventId: string }> };
   tools: { run<T = any>(name: string, args?: Record<string, any>): Promise<T> };
@@ -2830,6 +2830,20 @@ interface ServerFunctionCaller {
 }
 ```
 
+**CallerContact** (interface)
+```typescript
+interface CallerContact {
+  contactId: string;
+  email: string | null;
+  phone: string | null;
+  firstName: string | null;
+  lastName: string | null;
+  displayName: string | null;
+  tags: string[];
+  customFields: Record<string, unknown>;
+}
+```
+
 **ServerFunctionContext** (interface)
 ```typescript
 interface ServerFunctionContext {
@@ -4565,9 +4579,9 @@ interface AppleLoginOptions {
 ```typescript
 interface MfaRequiredDetails {
   mfaSessionToken: string
-  availableFactors: Array<'email' | 'sms'>
-  preferredFactor: 'email' | 'sms'
-  maskedDestinations: { email?: string; sms?: string }
+  availableFactors: MfaFactor[]
+  preferredFactor: MfaFactor
+  maskedDestinations: { email?: string; sms?: string; totp?: string }
 }
 ```
 
@@ -4575,7 +4589,7 @@ interface MfaRequiredDetails {
 ```typescript
 interface MfaChallengeSendResponse {
   success: true
-  factor: 'email' | 'sms'
+  factor: MfaFactor
   destination: string
   expiresAt: string
 }
@@ -4590,11 +4604,23 @@ interface MfaEnrollSendResponse {
 }
 ```
 
+**MfaTotpEnrollResponse** (interface)
+```typescript
+interface MfaTotpEnrollResponse {
+  mfaSessionToken: string
+  secret: string
+  otpauthUri: string
+  issuer: string
+  account: string
+  expiresAt: string
+}
+```
+
 **MfaEnrolledResponse** (interface)
 ```typescript
 interface MfaEnrolledResponse {
   enrolled: true
-  factor: 'email' | 'sms'
+  factor: MfaFactor
 }
 ```
 
@@ -4604,6 +4630,7 @@ interface MfaFactorsResponse {
   enrolledFactors: {
   email?: { enrolledAt: string; destination: string }
   sms?: { enrolledAt: string; destination: string }
+  totp?: { enrolledAt: string; destination: string }
   }
   recoveryCodesRemaining: number
   mfaEnabledForClient: boolean
@@ -4866,6 +4893,30 @@ interface AuthKitConfig {
   security?: AuthKitSecurityConfig
   collectionIds?: string[]
   identity?: AuthKitIdentity
+  signUp?: 'open' | 'invite'
+}
+```
+
+**AuthKitInviteRequest** (interface)
+```typescript
+interface AuthKitInviteRequest {
+  email: string
+  firstName?: string
+  lastName?: string
+  displayName?: string
+  customFields?: Record<string, unknown>
+  redirectUrl?: string
+}
+```
+
+**AuthKitInviteResponse** (interface)
+```typescript
+interface AuthKitInviteResponse {
+  ok: true
+  userId: string
+  contactId: string
+  created: boolean
+  expiresAt: string
 }
 ```
 
@@ -4934,6 +4985,8 @@ interface AuthKitLockoutPolicy {
 
 **AuthKitErrorCode** = ``
 
+**MfaFactor** = `'email' | 'sms' | 'totp'`
+
 **MfaErrorCode** = ``
 
 **VerifyStatus** = `'pending' | 'verified' | 'failed' | 'expired' | 'unknown'`
@@ -11291,8 +11344,8 @@ Update the authenticated user's profile and replace the bearer token when refres
 **deleteAccount**(clientId: string, password: string, confirmText: string) → `Promise<SuccessResponse>`
 Update the authenticated user's profile and replace the bearer token when refreshed claims are returned.
 
-**mfaChallengeSend**(clientId: string, mfaSessionToken: string, factor: 'email' | 'sms') → `Promise<MfaChallengeSendResponse>`
-Send (or resend) an MFA challenge code to the given factor (public).
+**mfaChallengeSend**(clientId: string, mfaSessionToken: string, factor: MfaFactor) → `Promise<MfaChallengeSendResponse>`
+Send (or resend) an MFA challenge code to the given factor (public). For `totp` nothing is sent — it tells the server the code will come from their authenticator app; then {@link mfaChallengeVerify}.
 
 **mfaChallengeVerify**(clientId: string, mfaSessionToken: string, code: string, trustDevice?: boolean, deviceLabel?: string) → `Promise<MfaFinalizeResponse>`
 Verify an MFA challenge code and finalize the login (public). On success this behaves like {@link login} — the bearer token is adopted and the cache invalidated. it and pass it to future {@link login} calls to skip the challenge on this device.
@@ -11315,10 +11368,16 @@ Begin SMS-factor enrollment; sends a code to the given phone number (authenticat
 **confirmSmsMfa**(clientId: string, mfaSessionToken: string, code: string) → `Promise<MfaEnrolledResponse>`
 Confirm SMS-factor enrollment with the code sent by {@link enrollSmsMfa} (authenticated).
 
+**enrollTotpMfa**(clientId: string) → `Promise<MfaTotpEnrollResponse>`
+Begin authenticator-app enrollment (authenticated): a new secret for Google Authenticator, Microsoft Authenticator, 1Password and the like. Show `otpauthUri` as a QR code (and `secret` for typing in), then {@link confirmTotpMfa} with the code the app shows. Nothing is kept until then; setting up again replaces the previous app once confirmed.
+
+**confirmTotpMfa**(clientId: string, mfaSessionToken: string, code: string) → `Promise<MfaEnrolledResponse>`
+Confirm authenticator-app enrollment with the 6-digit code the app shows (authenticated).
+
 **generateMfaRecoveryCodes**(clientId: string, password: string) → `Promise<`
 Generate a fresh set of recovery codes, invalidating any previous set (authenticated). Returned **in plaintext, exactly once** — nothing else in the API ever returns them again, so the caller must display/export them immediately.
 
-**removeMfaFactor**(clientId: string, factor: 'email' | 'sms', password: string) → `Promise<SuccessResponse>`
+**removeMfaFactor**(clientId: string, factor: MfaFactor, password: string) → `Promise<SuccessResponse>`
 Remove an enrolled MFA factor (authenticated). Server route is DELETE with a body.
 
 **listTrustedDevices**(clientId: string) → `Promise<`
@@ -11345,8 +11404,11 @@ Update an AuthKit client config (admin). This is how the account **security poli
 **setIdentity**(collectionId: string, authKitId: string, body: { mode: 'own' }) → `Promise<AuthKitSetIdentityResponse>`
 Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites. One way: a site with its own members can't go back to the shared pool. Members who signed up before keep their SmartLinks account until moved across. Errors: `MEMBER_POOL_CONFLICT` (409) when another AuthKit already gives one of its collections its own logins (one per collection); `PERMISSION_DENIED` (403) unless you administer every collection it serves.
 
+**invite**(collectionId: string, authKitId: string, body: AuthKitInviteRequest) → `Promise<AuthKitInviteResponse>`
+Invite someone to be a member of a site with its own logins (admin). Makes their account if they have none (the only way in when the site is invitation only — `signUp: 'invite'`), finds or creates their contact in this collection with the `customFields` you pass (their level), links the two, and emails them a sign-in link to the site (`redirectUrl`, default the kit's) that works once for 7 days. The page it opens handles it like any magic link: `mode=magicLink&token=…` → {@link verifyMagicLink}. Inviting someone again sends a fresh link. Errors: `OWN_LOGINS_REQUIRED` (409), `INVALID_EMAIL` (400), `INVALID_REDIRECT_URL` (400, not one of this site's addresses), `TOO_MANY_INVITES` (429, 5 an hour per address).
+
 **remove**(collectionId: string, authKitId: string) → `Promise<void>`
-Give this AuthKit its **own logins** (admin): its members become accounts of this site only — the same email can be a separate account, with its own password, on another site — rather than SmartLinks accounts shared across sites. One way: a site with its own members can't go back to the shared pool. Members who signed up before keep their SmartLinks account until moved across. Errors: `MEMBER_POOL_CONFLICT` (409) when another AuthKit already gives one of its collections its own logins (one per collection); `PERMISSION_DENIED` (403) unless you administer every collection it serves.
+Invite someone to be a member of a site with its own logins (admin). Makes their account if they have none (the only way in when the site is invitation only — `signUp: 'invite'`), finds or creates their contact in this collection with the `customFields` you pass (their level), links the two, and emails them a sign-in link to the site (`redirectUrl`, default the kit's) that works once for 7 days. The page it opens handles it like any magic link: `mode=magicLink&token=…` → {@link verifyMagicLink}. Inviting someone again sends a fresh link. Errors: `OWN_LOGINS_REQUIRED` (409), `INVALID_EMAIL` (400), `INVALID_REDIRECT_URL` (400, not one of this site's addresses), `TOO_MANY_INVITES` (429, 5 an hour per address).
 
 ### batch