[DO NOT MERGE] feat!: remove Authentication layer (v7.0.0), delegate Management token to @auth0/auth0-auth-js

[tusharpandey13]

WIP

Summary

Removes the Authentication layer from node-auth0, reducing the main entrypoint to a Management-API-only SDK (v7.0.0). The ManagementClient continues to work: its internal Management API token acquisition now delegates to @auth0/auth0-auth-js instead of the removed in-package AuthenticationClient.

This is the node-auth0 side of the auth-separation initiative. It assumes @auth0/auth0-auth-js DX-parity and gap features are already published (targeting ^1.12.1).

Draft — opened for review of approach and breaking-change surface before finalizing. Depends on the auth-separation program decisions (deprecation window, target version).

What changed

• Removed src/auth/ (9 files) and src/userinfo/ — AuthenticationClient and UserInfoClient no longer exported from the main entrypoint.
• Re-pointed Management token acquisition: TokenProvider now uses @auth0/auth0-auth-js AuthClient.getTokenByClientCredentials(). Preserves the 10s leeway refresh, in-flight de-duplication, and both client-secret and client-assertion credential modes.
• Removed dead shared infra: src/lib/runtime.ts (BaseAPI, auth-only) and auth-only src/utils.ts helpers (mtlsPrefix, resolveValueToPromise). Kept generateClientInfo for Management telemetry.
• Dependency: added @auth0/auth0-auth-js ^1.12.1; removed uuid (auth-only).
• Version: 6.2.0 → 7.0.0.
• Docs: README updated to point auth/OAuth/userinfo usage at @auth0/auth0-auth-js; added a "Migrating from v6 to v7" section with a method-mapping table; CHANGELOG v7.0.0 entry.

Breaking changes

• AuthenticationClient and UserInfoClient are gone from the auth0 main entrypoint. Use @auth0/auth0-auth-js (AuthClient) for authentication, OAuth, token exchange, passwordless, database, and userinfo operations. The auth0/legacy entrypoint (delegating to auth0-legacy v4) still ships them.
• mTLS: Management clients using mTLS must now supply an explicit fetch option. @auth0/auth0-auth-js requires a customFetch when useMtls is set; the previous DNS-prefix-only behavior no longer applies to token acquisition.

Implementation notes

• TokenResponse.expiresAt from @auth0/auth0-auth-js is an absolute Unix timestamp in seconds; TokenProvider converts it to milliseconds (expiresAt * 1000) before comparing against Date.now(). Getting this wrong would cause refresh storms or stale-token 401s — covered by tests.
• Telemetry identity is preserved: the internal token request advertises node-auth0 via the AuthClient telemetry option (matched to the published TelemetryConfig shape).

Testing

• New src/management/tests/unit/token-provider.test.ts mocks @auth0/auth0-auth-js and covers: both credential modes, cache hit, leeway refresh (with the expiresAt seconds→ms boundary), in-flight de-dup, error propagation, error-not-cached, and expiry.
• New tests/lib/export-surface.test.ts asserts AuthenticationClient/UserInfoClient are absent from the main entrypoint.
• Deleted obsolete tests/auth/**, tests/userinfo/**, tests/lib/runtime.test.ts.
• Jest: @auth0/auth0-auth-js maps to a lightweight CJS stub in the unit/wire projects (the package's CJS bundle pulls in ESM-only openid-client, which Jest's CJS runtime cannot load); the ESM root-tests project allows transforming openid-client/oauth4webapi.
• yarn build and yarn lint:check pass; unit suite 545/545.

Validation status

• Build (CJS + ESM)
• Lint
• Unit tests (545 passing) + export-surface
• Wire tests — a pre-existing MSW/localStorage failure in the reviewer's local Node runtime (fails identically on base v6.2.0), unrelated to this change; needs a run on a supported Node version in CI

Open questions

1. Target version gating: does v7 wait on all G1–G8 being GA in @auth0/auth0-auth-js, or only on getTokenByClientCredentials (the only method node-auth0 itself needs)?
2. Deprecation window / release sequencing per the auth-separation program.
3. mTLS: is requiring an explicit fetch acceptable, or should node-auth0 construct an mTLS-capable fetch to hand over?

🤖 Generated with Claude Code