Release @spwig/sdk 2.1.0 · Spwig/headless-sdk

2.1.0 (2026-07-26)

Catches the SDK up to the rest of the Spwig 1.7.0 release. Additive —
nothing that worked in 2.0.0 changes.

checkout.setContact({ email, first_name?, last_name?, password? }) →
POST /api/checkout/contact/. Records the customer's email/name on the
session, and — when a password is supplied — creates an account and signs
them in (the password is never stored or echoed back). This is the only
place a no-shipping guest's email is captured before payment, so
digital-only and booking-only carts (which skip the shipping step) must call
it before complete().
admin.analytics.getTraffic({ period?, start_date?, end_date? }) →
GET /api/admin/analytics/traffic/. Visitor overview, daily trends, top
pages, geographic distribution, and referrers. Reachable by a merchant API
token holding the analytics.traffic scope. New TrafficAnalytics and
related types.

admin.media.getUploadProgress() — /api/media/upload-progress/ is a
non-functional stub that returns a hardcoded progress: 100; the binding was
dead.
admin.auth.ssoMobileCallback() — /api/admin/auth/sso/mobile/callback/ is a
browser-driven OIDC redirect (returns a 302 to the app's custom scheme),
invoked by the identity provider, not a JSON API the SDK calls. The mobile SSO
flow is ssoMobileAuthorize() → OS-handled redirect → ssoMobileToken().

referrals.getMyReferrals() now calls the versioned DRF endpoint
/api/referrals/identities/me/ (a superset of ReferralDashboard) instead of
the uncontracted legacy /api/referrals/me/ aggregation view. Same return
type; no consumer change.
Marked the addressService, customizer, and admin.currencies modules as
⚠️ Uncontracted in their doc comments: they reach Spwig's storefront/admin
UI backends, which are deliberately not part of api-schema.yml and may change
without a contract bump. This is a reviewed decision, not an omission — see the
coverage-allowlist SCHEMA_MISSING notes.