SDK drift: Python's base Exchange class has no api_secret parameter, unlike TypeScript's base Exchange #1694

Drift

TypeScript's base Exchange class accepts apiSecret as a first-class constructor option, stores it, and forwards it in every request's credentials via getCredentials() — so it works for every TS exchange subclass. Python's shared ExchangeOptions TypedDict was recently updated (#1511) to type api_secret: str as if it were a universal option, but the Python base Exchange.__init__/_get_credentials_dict never actually accepts or forwards it.

TypeScript SDK

• sdks/typescript/pmxt/client.ts:235-236 — apiSecret?: string; on ExchangeOptions
• sdks/typescript/pmxt/client.ts:326 — protected apiSecret?: string;
• sdks/typescript/pmxt/client.ts:364 — this.apiSecret = options.apiSecret;
• sdks/typescript/pmxt/client.ts:469-479:

protected getCredentials(): ExchangeCredentials | undefined {
    if (!this.apiKey && !this.apiSecret && !this.privateKey) { return undefined; }
    return { apiKey: this.apiKey, apiSecret: this.apiSecret, privateKey: this.privateKey, ... };
}

Python SDK

• sdks/python/pmxt/models.py:659 — api_secret: str is declared in the shared ExchangeOptions TypedDict.
• sdks/python/pmxt/client.py:324-337 (Exchange.__init__) — no api_secret parameter at all.
• sdks/python/pmxt/client.py:553-569 (_get_credentials_dict) — never reads or forwards api_secret; the None-short-circuit ignores it entirely.
• Only 4 hand-written subclasses in _exchanges.py (Polymarket, Limitless, Probable, GeminiTitan — lines 16, 81, 195, 463) have their own independent api_secret param/handling, predating this and not wired through the shared base class.

Expected

Either Python's base Exchange class should accept and forward api_secret the same way TypeScript's does (matching the now-shared ExchangeOptions type), or the type declaration should not claim universal support that the implementation doesn't provide.

Impact

A caller trusting the Python type hints (ExchangeOptions.api_secret) will pass api_secret to any Python exchange subclass expecting it to reach the sidecar — as it now does in TypeScript for any venue — and it will be silently dropped. This is a real, user-facing functional gap introduced by two recent commits (TS: #1375, Python: #1511) that only fixed one side each.

Found by automated SDK cross-language drift audit