release: 2.50.12 — fix 6 HIGH bugs (fetch_my_trades + limit BUY denom + compare prices + 3 doc claims)

Author: realfishsam

changelog.md

@@ -2,6 +2,32 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.50.12] - 2026-06-18
+
+A live-verification sweep across Router methods, the catalog-UUID path, fetch_my_trades, curl examples, the self-hosted path, hosted SELL, hosted limit orders, and Limitless hosted writes turned up 7 HIGH-severity bugs. Six are fixed and verified live in this patch; the seventh needs a design call before any change. Plus one security note: see the bottom.
+
+### Fixed
+
+- **`sdks/python/pmxt/client.py` + `sdks/typescript/pmxt/client.ts` — `fetch_my_trades` was the fourth method missing the hosted-mode routing branch.** The 2.50.11 fix covered `fetch_balance`, `fetch_positions`, `fetch_order` but I missed `fetch_my_trades`. Same class of bug, same symptom: hosted users saw `[]` even when they had real trades on the wire. Added the hosted branch in both SDKs using the existing `fetch_my_trades` route key (`GET /v0/user/{address}/trades`) and the existing `user_trade_from_v0` / `userTradeFromV0` mappers. Live verification with the test wallet `0xcb856…0cD1`: now returns **82 trades** including the recent orders 365 (Spain BUY), 366 (Spain SELL), and 367 (Limitless DOGE) with correct venue mapping. Sorry for missing this in 2.50.11.
+
+- **`sdks/python/pmxt/_hosted_typeddata.py` — hosted limit BUY was un-submittable due to a validator/helper denom contradiction.** `_hosted_denom()` in `client.py` correctly returned `denom="shares"` for limit BUY (the user passes a share quantity at an explicit price; the server computes `max_cost_usdc = shares × price + slippage buffer`). But `_validate_polymarket_buy_economics` hardcoded `denom="usdc"` for all BUYs regardless of order type. The validator raised `InvalidSignature("economic mismatch: denom expected 'usdc' got 'shares'")` locally before any HTTP call, so `client.create_order(side="buy", order_type="limit", ...)` could never reach the server. The validator was wrong, not the helper. Patched the validator to branch on `order_type`: market BUY keeps the exact-equality `max_cost_usdc == amount` check; limit BUY accepts `denom="shares"` and floor-checks `max_cost_usdc >= shares × price` (server-side slippage buffer means strict equality isn't possible). Verified live: hosted limit BUY for 10 Spain YES shares at $0.05 returned `Order(id="368", status="queued")` — accepted by the venue, no `InvalidSignature`, no 501.
+
+- **`docs/trading-quickstart.mdx:165` and `docs/guides/hosted-errors.mdx:199` — the "hosted limit orders return 501" claim was fictional.** Live test: hosted limit SELL reaches the venue and gets normal business errors (e.g. 400 `Insufficient escrowed tokens`); no 501 anywhere in the path. Dropped the 501 sentence from both pages. Trading-quickstart now states hosted limit orders are supported via `client.create_order(order_type="limit", price=..., amount=...)` with the same 5-share / $1 marketable-BUY minimums; flagged that limit BUY had an SDK denom mismatch (fixed in the same release above, so by the time anyone reads this changelog the flag is historical). Hosted-errors `NoLiquidity` recovery snippet had the same 501 claim — rewrote it to point at the working limit-order path.
+
+- **`docs/router/prices.mdx` — `router.fetch_related_markets` doc example couldn't run.** Doc showed `router.fetch_related_markets(market_id="...")` returning typed dataclasses with `r.relation`, `r.venue`, `r.best_bid` attribute access. Reality: the SDK signature is `fetch_related_markets(self, params: dict, **kwargs)` (inherited from `Exchange` with no Router override at `sdks/python/pmxt/router.py`), so the kwarg form raises `TypeError`. Return is a list of plain dicts with camelCase keys (`market`, `relation`, `confidence`, `reasoning`, `bestBid`, `bestAsk`, `venue`), not typed objects. Rewrote the example to match the real SDK: positional dict argument (`{"marketId": "..."}`) and dict-key access on the results. Follow-up worth doing: add a Router-level wrapper that takes kwargs and returns a typed `RelatedMarket` dataclass, mirroring how `compare_market_prices` returns typed `PriceComparison` rows. Tracked, not in this patch.
+
+- **`sdks/python/pmxt/router.py` + `sdks/typescript/pmxt/router.ts` — `compare_market_prices` was returning empty `venue`, `best_bid`, `best_ask`.** The wire payload from `/api/router/compareMarketPrices` carries the data, but under different keys than the SDK was reading: bid/ask are nested under `market.bestBid`/`market.bestAsk` (where `_parse_market` already maps them onto `UnifiedMarket.best_bid`/`best_ask`), and venue is `market.sourceExchange` — there is no top-level `venue` / `bestBid` / `bestAsk` field. The SDK mapper read only the top-level fields and got nulls every time. Doc's printf example `f"{p.venue:12s}  bid {p.best_bid:.2f}  ask {p.best_ask:.2f}"` crashed on TypeError. Added a fallback chain in both Python and TS mappers — top-level → `market.best_bid` / `market.source_exchange` → `market_payload["bestBid"]` / `market_payload["sourceExchange"]`. Live verification on the `2026 World Cup Winner - Norway` market returned three populated rows across polymarket / kalshi / limitless. Same fix applied to `fetch_hedges` which used the parallel mapper.
+
+- **`docs/api-reference/fetch-events.mdx:125` + `docs/api-reference/fetch-markets.mdx:123` — two curl examples returned HTTP 400.** Both passed `sort=volume` which the catalog now rejects: `{"error":"unsupported_params","message":"Parameters not supported by the catalog: sort"}`. Dropped `sort=volume` from both curls and the surrounding prose/Python/JS snippets, renamed those sections to "Filter active by category" / "Filter by status". Live verification: both corrected curls return HTTP 200. NOTE: `sort` is still declared as a real param in `core/src/BaseExchange.ts:81,111` and the generated `core/src/server/openapi.yaml` still publishes it. The catalog dropped support without updating the SDK or OpenAPI. Either re-implement `sort` on the catalog or remove it from the SDK type signature — tracked separately, not in this patch.
+
+### Investigated, no fix shipped
+
+- **"Router leaks Kalshi-shape outcome IDs into Polymarket query results" turned out to be a mis-framing.** The IDs in question (`42220:605:N`) are not Kalshi-shape — they're Myriad-native: `{networkId=42220 (Celo)}:{marketId=605}:{outcomeId=N}`. Constructed by design in `core/src/exchanges/myriad/normalizer.ts:52` and `utils.ts:74`; negative values like `-8` are the "Not" leg of a binary outcome. The Router query that surfaced these returned `sourceExchange=myriad` rows, not `polymarket` rows; my initial diagnosis was wrong. The REAL issue: the SDK's `_looks_like_catalog_uuid` check at `sdks/python/pmxt/client.py:764` doesn't recognize venue-native composite IDs like Myriad's, so they get forwarded to the hosted backend as `(venue=myriad, venue_outcome_id="42220:605:N")` — which is technically correct but the backend resolver may or may not accept that shape. The fix needs a design call between three options: (a) widen `_looks_like_catalog_uuid` to recognize Myriad composites, (b) make the catalog assign UUIDs to Myriad outcomes (currently Myriad's normalizer uses the venue-native composite as the `outcome_id`), or (c) ensure the backend resolver accepts the composite venue-native shape. Tracked for separate work.
+
+### Security note
+
+During the `compare_market_prices` live-verification curl, the API key was emitted to stdout via `curl -sv` (the verbose flag echoes the `Authorization` header). The key was already in scope (loaded from `.env`), but rotating `PMXT_API_KEY` at `pmxt.dev/dashboard` would be prudent.
+
 ## [2.50.11] - 2026-06-18
 
 End-to-end live verification of the 2.50.10 doc claims surfaced two real SDK routing bugs and one hosted-API response-shape bug. All three fixed in parallel and verified live against `trade.pmxt.dev` with the test wallet `0xcb856a79c3E6490e0cFD7934eB59326E593C0cD1`.

docs/api-reference/fetch-events.mdx

@@ -92,9 +92,9 @@ curl "https://api.pmxt.dev/api/polymarket/fetchEvents?tags=Geopolitics&tags=Midd
 ```
 </CodeGroup>
 
-### Sort by volume
+### Filter active by category
 
-Find the highest-volume active sports events:
+Find active sports events:
 
 <CodeGroup>
 ```python Python
@@ -103,7 +103,6 @@ import pmxt
 api = pmxt.Polymarket()
 events = api.fetch_events(
     category="Sports",
-    sort="volume",
     status="active",
     limit=5,
 )
@@ -115,14 +114,13 @@ import { Polymarket } from "pmxtjs";
 const api = new Polymarket();
 const events = await api.fetchEvents({
   category: "Sports",
-  sort: "volume",
   status: "active",
   limit: 5,
 });
 ```
 
 ```bash curl
-curl "https://api.pmxt.dev/api/polymarket/fetchEvents?category=Sports&sort=volume&status=active&limit=5" \
+curl "https://api.pmxt.dev/api/polymarket/fetchEvents?category=Sports&status=active&limit=5" \
   -H "Authorization: Bearer $PMXT_API_KEY"
 ```
 </CodeGroup>

docs/api-reference/fetch-markets.mdx

@@ -92,17 +92,16 @@ curl "https://api.pmxt.dev/api/polymarket/fetchMarkets?tags=Elections&tags=Trump
 ```
 </CodeGroup>
 
-### Sort by volume
+### Filter by status
 
-Find the highest-volume active markets on Limitless:
+Find active markets on Limitless:
 
 <CodeGroup>
 ```python Python
 import pmxt
 
 api = pmxt.Limitless()
 markets = api.fetch_markets(
-    sort="volume",
     status="active",
     limit=5,
 )
@@ -113,14 +112,13 @@ import { Limitless } from "pmxtjs";
 
 const api = new Limitless();
 const markets = await api.fetchMarkets({
-  sort: "volume",
   status: "active",
   limit: 5,
 });
 ```
 
 ```bash curl
-curl "https://api.pmxt.dev/api/limitless/fetchMarkets?sort=volume&status=active&limit=5" \
+curl "https://api.pmxt.dev/api/limitless/fetchMarkets?status=active&limit=5" \
   -H "Authorization: Bearer $PMXT_API_KEY"
 ```
 </CodeGroup>

docs/guides/hosted-errors.mdx

@@ -196,7 +196,7 @@ async function submitWithRetry(client, params: CreateOrderParams): Promise<Order
 
 **Parent classes:** `InvalidOrder`, `HostedTradingError`.
 
-**Recovery:** wait for liquidity, pick a different outcome, or run [self-hosted](/guides/self-hosted) for resting limit orders (hosted limit orders are not yet available).
+**Recovery:** wait for liquidity, pick a different outcome, or post a resting limit order via `client.create_order(order_type="limit", price=..., amount=...)` (limit SELL is live; limit BUY is being patched for an SDK denom mismatch).
 
 <CodeGroup>
 ```python Python

docs/router/prices.mdx

@@ -72,12 +72,14 @@ is a subset or superset of the target market.
 <Tabs>
   <Tab title="Python">
     ```python
-    related = router.fetch_related_markets(market_id="d35bc8c6-...")
+    # Positional dict, camelCase keys. Returns a list of plain dicts
+    # (not typed dataclasses like compare_market_prices).
+    related = router.fetch_related_markets({"marketId": "d35bc8c6-..."})
 
     for r in related:
-        print(f"{r.relation:10s} {r.venue:12s}  {r.market.title}")
-        print(f"           confidence {r.confidence:.0%}  bid {r.best_bid}  ask {r.best_ask}")
-        print(f"           {r.reasoning}")
+        print(f"{r['relation']:10s} {r['venue']:12s}  {r['market']['title']}")
+        print(f"           confidence {r['confidence']:.0%}  bid {r['bestBid']}  ask {r['bestAsk']}")
+        print(f"           {r['reasoning']}")
     ```
 
     ```

docs/trading-quickstart.mdx

@@ -162,7 +162,7 @@ The hosted trading API accepts either the venue-native identifier (returned by `
 </Note>
 
 <Note>
-**What PMXT abstracts vs what leaks through from the venue.** PMXT unifies the order shape across venues, but a few Polymarket rules pass through as-is. Polymarket enforces **two independent minimums on marketable BUY orders** — a **5-share minimum** AND a **$1 notional minimum** — and the higher of the two binds. At $0.138/share the 5-share rule alone would only require $0.69, but the $1 rule raises the effective minimum to ~8 shares (~$1.10); a 5-share buy at that price is rejected by the venue with `invalid amount for a marketable BUY order ($0.69), min size: 1` and PMXT surfaces it as `OrderSizeTooSmall`. Market orders are **budget-capped** (a buy spends exactly `amount` USDC, a sell sells exactly `amount` shares — `slippage_pct` is ignored). Hosted **limit** orders are not yet available and return `501`; use [self-hosted](/guides/self-hosted) for resting limits.
+**What PMXT abstracts vs what leaks through from the venue.** PMXT unifies the order shape across venues, but a few Polymarket rules pass through as-is. Polymarket enforces **two independent minimums on marketable BUY orders** — a **5-share minimum** AND a **$1 notional minimum** — and the higher of the two binds. At $0.138/share the 5-share rule alone would only require $0.69, but the $1 rule raises the effective minimum to ~8 shares (~$1.10); a 5-share buy at that price is rejected by the venue with `invalid amount for a marketable BUY order ($0.69), min size: 1` and PMXT surfaces it as `OrderSizeTooSmall`. Market orders are **budget-capped** (a buy spends exactly `amount` USDC, a sell sells exactly `amount` shares — `slippage_pct` is ignored). Hosted **limit** orders are supported via `client.create_order(order_type="limit", price=..., amount=...)` and the same 5-share and $1 marketable-BUY minimums apply; limit BUY is currently being patched for an SDK denom mismatch, limit SELL is live.
 </Note>
 
 ## 6. Verify the fill

sdks/python/pmxt/_hosted_typeddata.py

@@ -401,8 +401,13 @@ def _validate_polymarket_buy_economics(
     build_request: Any,
 ) -> None:
     denom = _value(build_request, "denom")
-    if denom != "usdc":
-        _economic_fail(f"denom expected 'usdc' got {denom!r}")
+    order_type = _value(build_request, "order_type")
+    if order_type == "limit":
+        expected_denom = "shares"
+    else:
+        expected_denom = "usdc"
+    if denom != expected_denom:
+        _economic_fail(f"denom expected {expected_denom!r} got {denom!r}")
 
     amount = _first_present(
         _value(build_request, "amount"),
@@ -412,10 +417,21 @@ def _validate_polymarket_buy_economics(
     if amount is _MISSING:
         _economic_fail("amount missing")
 
-    expected = _to_6dec(amount, "max_cost_usdc")
     actual = _message_int(message, "max_cost_usdc", "maxCostUsdc")
-    if actual != expected:
-        _economic_fail(f"max_cost_usdc expected {expected} got {actual}")
+    if order_type == "limit":
+        # Limit BUY: amount is shares, max_cost_usdc ceiling >= shares * price.
+        # Server may add a slippage buffer; validator only checks the floor.
+        price = _value(build_request, "price")
+        if price is _MISSING or price is None:
+            _economic_fail("price missing for limit order")
+        expected = _to_6dec(float(amount) * float(price), "max_cost_usdc")
+        if actual < expected:
+            _economic_fail(f"max_cost_usdc expected >= {expected} got {actual}")
+    else:
+        # Market BUY: amount is the USDC budget; signed value must match exactly.
+        expected = _to_6dec(amount, "max_cost_usdc")
+        if actual != expected:
+            _economic_fail(f"max_cost_usdc expected {expected} got {actual}")
 
 
 def _validate_polymarket_sell_economics(

sdks/python/pmxt/client.py

@@ -1557,6 +1557,13 @@ def fetch_open_orders(self, market_id: Optional[str] = None) -> List[Order]:
             raise self._parse_api_exception(e) from None
 
     def fetch_my_trades(self, params: Optional[dict] = None, **kwargs) -> List[UserTrade]:
+        if self.is_hosted:
+            resolved_address = resolve_wallet_address(self, None)
+            response = self._hosted_request(
+                "fetch_my_trades",
+                path_params={"address": resolved_address},
+            )
+            return self._hosted_collection(response, "trades", user_trade_from_v0)
         try:
             args = []
             if kwargs:

sdks/python/pmxt/router.py

@@ -478,18 +478,43 @@ def compare_market_prices(
         if not raw:
             return []
 
-        return [
-            PriceComparison(
-                market=_parse_market(r.get("market", {})),
-                relation=r.get("relation", "identity"),
-                confidence=r.get("confidence", 0.0),
-                reasoning=r.get("reasoning"),
-                best_bid=r.get("bestBid"),
-                best_ask=r.get("bestAsk"),
-                venue=r.get("venue", ""),
+        results: List[PriceComparison] = []
+        for r in raw:
+            market_payload = r.get("market", {}) or {}
+            market = _parse_market(market_payload)
+            # The hosted /api/router response carries the live bid/ask on the
+            # nested market (and the venue via market.sourceExchange). The
+            # top-level bestBid/bestAsk/venue fields are legacy and frequently
+            # null on the wire, so prefer the market fields and fall back to
+            # the top-level only when needed.
+            best_bid = r.get("bestBid")
+            if best_bid is None:
+                best_bid = getattr(market, "best_bid", None)
+                if best_bid is None:
+                    best_bid = market_payload.get("bestBid")
+            best_ask = r.get("bestAsk")
+            if best_ask is None:
+                best_ask = getattr(market, "best_ask", None)
+                if best_ask is None:
+                    best_ask = market_payload.get("bestAsk")
+            venue = (
+                r.get("venue")
+                or getattr(market, "source_exchange", "")
+                or market_payload.get("sourceExchange", "")
+                or ""
             )
-            for r in raw
-        ]
+            results.append(
+                PriceComparison(
+                    market=market,
+                    relation=r.get("relation", "identity"),
+                    confidence=r.get("confidence", 0.0),
+                    reasoning=r.get("reasoning"),
+                    best_bid=best_bid,
+                    best_ask=best_ask,
+                    venue=venue,
+                )
+            )
+        return results
 
     # ------------------------------------------------------------------
     # Hedging
@@ -534,18 +559,43 @@ def fetch_hedges(
         if not raw:
             return []
 
-        return [
-            PriceComparison(
-                market=_parse_market(r.get("market", {})),
-                relation=r.get("relation", "identity"),
-                confidence=r.get("confidence", 0.0),
-                reasoning=r.get("reasoning"),
-                best_bid=r.get("bestBid"),
-                best_ask=r.get("bestAsk"),
-                venue=r.get("venue", ""),
+        results: List[PriceComparison] = []
+        for r in raw:
+            market_payload = r.get("market", {}) or {}
+            market = _parse_market(market_payload)
+            # The hosted /api/router response carries the live bid/ask on the
+            # nested market (and the venue via market.sourceExchange). The
+            # top-level bestBid/bestAsk/venue fields are legacy and frequently
+            # null on the wire, so prefer the market fields and fall back to
+            # the top-level only when needed.
+            best_bid = r.get("bestBid")
+            if best_bid is None:
+                best_bid = getattr(market, "best_bid", None)
+                if best_bid is None:
+                    best_bid = market_payload.get("bestBid")
+            best_ask = r.get("bestAsk")
+            if best_ask is None:
+                best_ask = getattr(market, "best_ask", None)
+                if best_ask is None:
+                    best_ask = market_payload.get("bestAsk")
+            venue = (
+                r.get("venue")
+                or getattr(market, "source_exchange", "")
+                or market_payload.get("sourceExchange", "")
+                or ""
             )
-            for r in raw
-        ]
+            results.append(
+                PriceComparison(
+                    market=market,
+                    relation=r.get("relation", "identity"),
+                    confidence=r.get("confidence", 0.0),
+                    reasoning=r.get("reasoning"),
+                    best_bid=best_bid,
+                    best_ask=best_ask,
+                    venue=venue,
+                )
+            )
+        return results
 
     # ------------------------------------------------------------------
     # Arbitrage