test: cover Xquik MCP auth with portable temp paths

[kriptoburak]

What and Why

• Add a focused Xquik fixture for generated MCP API-key header authentication.
• Verify configured API-key auth disables implicit bearer fallback.
• Verify the generated server keeps x-api-key, XQUIK_API_KEY, and the canonical API base URL.
• Model the current /x/tweets/search path and paginated tweets response envelope.
• Replace the test suite's hardcoded /tmp path with Node's cross-platform tmpdir().

Independent Repository Fix

The feature suite used mkdtemp("/tmp/feat-test-"), which assumes a Unix filesystem and a writable /tmp. Using join(tmpdir(), "feat-test-") preserves the same cleanup behavior while supporting Windows and custom temporary-directory environments.

Validation

• npm run check
• npx tsx tests/features.test.ts
• npm test with Python 3.12, matching CI
• Full generated TypeScript, Python, Go, Java, Ruby, and C# verification
• Generated mock and MCP self-tests
• git diff --check
• Source, disclosure, punctuation, and secret-shape checks

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[kriptoburak]

Published current-upstream repair fdd4420ee3e535f4b4ab21239e6c95347cf5caec as 1 signed commit.

The Xquik fixture matches the canonical API base, /x/tweets/search path, paginated response schema, and x-api-key contract while retaining generated MCP authentication regression coverage. The independent repository fix replaces the Unix-only /tmp path with Node's portable tmpdir().

Validation passed for typecheck, build, focused features, the full 6-language generation matrix under Python 3.13, generated mock behavior, MCP self-tests, current public OpenAPI parity, whitespace, and the current upstream diff. No contributor action remains.