TypeScript SDK: Metaculus missing apiToken constructor parameter — authentication impossible #1370

Gap

The TypeScript SDK Metaculus class has no way to accept or forward an API token, making authenticated Metaculus API calls impossible from TypeScript. The Python SDK handles this correctly.

Core

core/src/server/exchange-factory.ts:110-114 passes credentials?.apiToken to the MetaculusExchange constructor:

case 'metaculus':
    return new MetaculusExchange({
        apiToken: credentials?.apiToken || process.env.METACULUS_API_TOKEN,
    });

core/src/exchanges/metaculus/index.ts:65 stores the token:

this.apiToken = credentials?.apiToken;

core/src/BaseExchange.ts:386 declares apiToken in ExchangeCredentials:

apiToken?: string;

TypeScript SDK

sdks/typescript/pmxt/client.ts:231-290 — ExchangeOptions has no apiToken field.

sdks/typescript/pmxt/client.ts:464-474 — Exchange.getCredentials() does not include apiToken in the returned credentials object:

protected getCredentials(): ExchangeCredentials | undefined {
    if (!this.apiKey && !this.privateKey) {
        return undefined;
    }
    return {
        apiKey: this.apiKey,
        privateKey: this.privateKey,
        funderAddress: this.proxyAddress,
        signatureType: this.signatureType,
    };
}

sdks/typescript/pmxt/client.ts:3360-3364 — Metaculus class uses generic ExchangeOptions, no apiToken param.

Because ExchangeOptions has no apiToken and getCredentials() never returns one, the sidecar always receives credentials?.apiToken === undefined and falls back to process.env.METACULUS_API_TOKEN only. There is no programmatic path to pass a token from TypeScript.

Python SDK

sdks/python/pmxt/client.py:329 — base Exchange.__init__ accepts api_token: Optional[str] = None.
sdks/python/pmxt/client.py:371 — stores self.api_token = api_token.
sdks/python/pmxt/client.py:563-564 — _get_credentials_dict() includes it:

if self.api_token:
    creds["apiToken"] = self.api_token

sdks/python/pmxt/_exchanges.py:336 — Metaculus.__init__ accepts api_token and forwards it. Python is correct.

Evidence

• core/src/server/exchange-factory.ts:110-114
• core/src/BaseExchange.ts:386
• sdks/typescript/pmxt/client.ts:231-290 (ExchangeOptions — no apiToken)
• sdks/typescript/pmxt/client.ts:464-474 (getCredentials — apiToken absent)
• sdks/typescript/pmxt/client.ts:3360-3364 (Metaculus class)
• sdks/python/pmxt/client.py:329,371,563-564
• sdks/python/pmxt/_exchanges.py:336

Impact

TypeScript SDK users cannot authenticate with Metaculus. Any call requiring authentication silently falls back to the environment variable or fails. The gap is invisible — no error at construction time, failure only surfaces at runtime when the sidecar rejects the unauthenticated request.

Found by automated Core-to-SDK surface coverage audit