TypeScript SDK has no apiToken credential field — every authenticated Metaculus call fails #1585

Gap

Metaculus authenticates via a bearer-style API token (Authorization: Token <apiToken>), read from credentials.apiToken. Core, the sidecar factory, and the Python SDK all thread this field through correctly. The TypeScript SDK has no apiToken field anywhere — not in ExchangeOptions, not in Exchange.getCredentials(), and the Metaculus subclass adds no override. Every authenticated Metaculus call made through the TS SDK (createOrder, cancelOrder, or any higher-rate-limit read) fails with AuthenticationError, with no way to supply a token.

Core

• core/src/BaseExchange.ts:385-386 — ExchangeCredentials.apiToken?: string — "Metaculus: Authorization: Token <apiToken> for higher rate limits".
• core/src/exchanges/metaculus/index.ts:65 — this.apiToken = credentials?.apiToken;; used at lines 93-111 to build the Authorization header, and errors.ts:65,75 / cancelOrder.ts:54 / createOrder.ts:300 all instruct callers to "Pass { apiToken: "..." } when constructing MetaculusExchange."
• core/src/server/exchange-factory.ts:112-113 — the "metaculus" case forwards credentials?.apiToken || process.env.METACULUS_API_TOKEN.

TypeScript SDK

Missing entirely. grep -n "apiToken" sdks/typescript/pmxt/client.ts returns zero matches. ExchangeOptions (client.ts:231) and Exchange.getCredentials() (client.ts:469-480) only carry apiKey, apiSecret, privateKey, funderAddress, signatureType. The Metaculus class (client.ts:3418-3422) is a bare passthrough adding no override. Notably, sdks/typescript/API_REFERENCE.md:2037 already documents apiToken: string as part of ExchangeCredentials — the docs describe a field that was never wired into client.ts.

Python SDK

Correctly implemented — sdks/python/pmxt/_exchanges.py:341,357,564 threads api_token → creds["apiToken"] through to the sidecar request body. This is a TypeScript-only gap.

Evidence

Direct verification: grep -n "apiToken" sdks/typescript/pmxt/client.ts → no hits. grep -n "apiToken" core/src/BaseExchange.ts core/src/exchanges/metaculus/*.ts core/src/server/exchange-factory.ts → confirms core reads/requires/forwards it (see file:line list above).

Impact

Every TypeScript SDK user of Metaculus is unable to authenticate at all — no constructor field exists to pass a token through. Reads that don't need elevated rate limits may work unauthenticated, but any authenticated call (order placement/cancellation, or higher rate-limit access) is completely broken for TS users, while Python users are unaffected. This is a functional blocker, not a cosmetic gap.

Found by automated Core-to-SDK surface coverage audit