feat(inventory): add Inventory endpoint family

[armando-rodriguez-cko]

Summary

Implements the new Inventory product added to the API on 2026-09-10: stock adjustments,
atomic multi-variant reservations (create/get/commit/release), stock levels (get/set), and
beta product knowledge (get/set/delete). All 10 endpoints require the OAuth scope
agentic:inventory, no secret/public key support, reusing this SDK's existing OAuth
client-credentials pattern (already used by Issuing, NetworkTokens, etc).

Also verified the same swagger diff's PaymentSessionCaptureFlag/PaymentSessionCaptureOn
and PaymentInterfacesPanPreference/PaymentInterfacesProvisionNetworkToken schema
extraction: confirmed no-op for this SDK (this SDK has no PaymentInterfaces domain at all,
and capture/capture_on are already untyped pass-through body fields).

Changes

• src/api/inventory/inventory.js — new Inventory class, all 10 methods, documented via
  JSDoc (this SDK has no hand-maintained typed request/response classes)
• src/oauth-scopes.js — added AGENTIC_INVENTORY scope constant
• src/index.js / src/endpoints-factory.js — wired the new client in
• types/dist/api/inventory/inventory.d.ts, types/dist/index.d.ts, types/dist/Checkout.d.ts
  — hand-written TypeScript declarations matching every other domain's loose
  Promise<Object> typing
• test/inventory/inventory-unit.js — 10 unit tests (Mocha/Chai/nock), 949 passing overall

API Reference

• POST /inventory/adjustments
• POST /inventory/reservations
• GET /inventory/reservations/{id}
• POST /inventory/reservations/{id}/commit
• POST /inventory/reservations/{id}/release
• GET /inventory/{variant_id}
• PUT /inventory/{variant_id}
• GET /inventory/{variant_id}/product (Beta)
• PUT /inventory/{variant_id}/product (Beta)
• DELETE /inventory/{variant_id}/product (Beta)

Breaking changes

None. Purely additive.

README

No README changes needed.

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:src/oauth-scopes.js

Operational gates

• ✅ jira_ticket (INT-1698)
• ✅ independent_review

Files analysed: 8

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — src/oauth-scopes.js	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

Adds a new Inventory endpoint family with 10 methods, tests, TypeScript declarations, and OAuth scope constant — the implementation looks structurally consistent with the rest of the SDK, but the diff is truncated so the full inventory.js source and part of the test file cannot be fully verified.

For you to decide

• The diff is truncated: the full src/api/inventory/inventory.js (363 lines) and test/inventory/inventory-unit.js (203 lines) are cut off, so methods beyond roughly getInventoryLevels (setInventoryLevels, getInventoryProduct, setInventoryProduct, deleteInventoryProduct) cannot be verified for correctness.
• The visible adjustInventory, createInventoryReservation, getInventoryReservation, commitInventoryReservation, releaseInventoryReservation, and getInventoryLevels all follow the same post/get/put + determineError pattern used consistently elsewhere in the SDK — no obvious bugs in what is shown.
• The ENDPOINTS import in endpoints-factory.js presumably re-exports from a barrel file that must include Inventory; that barrel file is not shown in the diff, so the wiring could be incomplete if it was not updated.
• The getInventoryLevels query-string forwarding is tested by checking the captured URI equals /inventory/var_123?expand=product, which is a reasonable integration check, but the actual URL-building logic in inventory.js is in the truncated section and cannot be confirmed.
• The Checkout.d.ts places inventory: Inventory after onboardingSimulator and before config, which is consistent with the pattern for other recently added domains — no type-declaration issues visible.
• Whether this API endpoint family is live/stable enough to ship in this SDK version, and whether the 2026-09-10 swagger date is intentional (future-dated), is a product/deployment decision that requires human context.

⚠️ The diff was too large to read in full, so this review covers only part of the change.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud