[DO NOT MERGE] feat!: remove Authentication layer (v7.0.0), delegate Management token to @auth0/auth0-auth-js

.gitignore

@@ -3,4 +3,4 @@ node_modules
 /dist
 /docs
 /coverage
-*.lcov
+*.lcov.forge/

.version

@@ -1 +1 @@
-v6.2.0
+v7.0.0

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Change Log
 
+## [v7.0.0](https://github.com/auth0/node-auth0/tree/v7.0.0) (2026-08-17)
+
+[Full Changelog](https://github.com/auth0/node-auth0/compare/v6.2.0...v7.0.0)
+
+**⚠️ BREAKING CHANGES**
+
+- **Removed `AuthenticationClient` and `UserInfoClient` from main entrypoint**: The authentication layer has been separated into [`@auth0/auth0-auth-js`](https://github.com/auth0/node-auth0/tree/main/packages/auth0-auth-js). Use `AuthClient` from `@auth0/auth0-auth-js` for authentication operations, OAuth flows, token management, and user profile retrieval.
+- **Management token acquisition now uses `@auth0/auth0-auth-js` internally**: The `TokenProvider` class delegates to `@auth0/auth0-auth-js` for client credentials grant. Token expiration handling now uses absolute Unix timestamps (converted from seconds to milliseconds).
+- **mTLS requires explicit `customFetch` option**: When using `useMtls: true` with `@auth0/auth0-auth-js`, you must provide a `customFetch` function that configures the HTTPS agent with client certificates.
+
+**Migration Guide**
+
+See the [Migrating from v6 to v7](https://github.com/auth0/node-auth0/blob/master/README.md#migrating-from-v6-to-v7) section in the README for detailed upgrade instructions, including method mappings and mTLS configuration examples.
+
+The legacy entrypoint (`auth0/legacy`) continues to ship the v4.x API including `AuthenticationClient` for backward compatibility.
+
 ## [v6.2.0](https://github.com/auth0/node-auth0/tree/v6.2.0) (2026-08-05)
 
 [Full Changelog](https://github.com/auth0/node-auth0/compare/v6.1.0...v6.2.0)

README.md

@@ -34,20 +34,22 @@ npm install auth0
 
 ### Configure the SDK
 
-#### Authentication API Client
+#### Authentication
 
-This client can be used to access Auth0's [Authentication API](https://auth0.com/docs/api/authentication).
+For authentication operations (OAuth flows, token management, user sign-up), use [`@auth0/auth0-auth-js`](https://github.com/auth0/node-auth0/tree/main/packages/auth0-auth-js). As of v7, node-auth0 no longer ships `AuthenticationClient` in its main entrypoint. The authentication layer has been separated into a dedicated package.
 
 ```js
-import { AuthenticationClient } from "auth0";
+import { AuthClient } from "@auth0/auth0-auth-js";
 
-const auth0 = new AuthenticationClient({
+const auth = new AuthClient({
     domain: "{YOUR_TENANT_AND REGION}.auth0.com",
     clientId: "{YOUR_CLIENT_ID}",
     clientSecret: "{OPTIONAL_CLIENT_SECRET}",
 });
 ```
 
+See the [auth0-auth-js documentation](https://github.com/auth0/node-auth0/tree/main/packages/auth0-auth-js) for full API reference.
+
 #### Management API Client
 
 The Auth0 Management API is meant to be used by back-end servers or trusted parties performing administrative tasks. Generally speaking, anything that can be done through the Auth0 dashboard (and more) can also be done through this API.
@@ -169,25 +171,30 @@ types from the root `auth0` entry adds nothing to your bundle and does not pull
 > through a bundler. A plain CommonJS `require()` cannot tree-shake and loads the full
 > resource graph.
 
-#### UserInfo API Client
+#### User Profile Information
 
-This client can be used to retrieve user profile information.
+To retrieve user profile information, use the `getUserInfo` method from `@auth0/auth0-auth-js`:
 
 ```js
-import { UserInfoClient } from "auth0";
+import { AuthClient } from "@auth0/auth0-auth-js";
 
-const userInfo = new UserInfoClient({
+const auth = new AuthClient({
     domain: "{YOUR_TENANT_AND REGION}.auth0.com",
+    clientId: "{YOUR_CLIENT_ID}",
 });
 
 // Get user info with an access token
-const userProfile = await userInfo.getUserInfo(accessToken);
+const userProfile = await auth.getUserInfo(accessToken);
 ```
 
+As of v7, node-auth0 no longer ships `UserInfoClient`. Use `AuthClient.getUserInfo()` from `@auth0/auth0-auth-js` instead.
+
 ## Legacy Usage
 
 If you are migrating from the legacy `node-auth0` package (v4.x) or need to maintain compatibility with legacy code, you can use the legacy export which provides the `node-auth0` v4.x API interface.
 
+**Note:** The legacy entrypoint still includes `AuthenticationClient` from the v4.x API. This is separate from the v7 main entrypoint, which no longer ships authentication clients.
+
 ### Installing Legacy Version
 
 The legacy version (`node-auth0` v4.x) is available through the `/legacy` export path:
@@ -202,7 +209,7 @@ const { ManagementClient, AuthenticationClient } = require("auth0/legacy");
 
 ### Legacy Configuration
 
-The legacy API uses the `node-auth0` v4.x configuration format and method signatures, which are different from the current v6 API:
+The legacy API uses the `node-auth0` v4.x configuration format and method signatures, which are different from the current API:
 
 #### Legacy Management Client
 
@@ -345,6 +352,65 @@ try {
 }
 ```
 
+## Migrating from v6 to v7
+
+Version 7.0.0 removes authentication clients from the main entrypoint. The authentication layer has been separated into [`@auth0/auth0-auth-js`](https://github.com/auth0/node-auth0/tree/main/packages/auth0-auth-js).
+
+### Install the authentication package
+
+```bash
+npm install @auth0/auth0-auth-js
+```
+
+### Update imports
+
+```js
+// v6
+import { AuthenticationClient, UserInfoClient } from "auth0";
+
+// v7
+import { AuthClient } from "@auth0/auth0-auth-js";
+```
+
+### Method mapping
+
+| v6 (node-auth0)                                     | v7 (@auth0/auth0-auth-js)                     |
+| --------------------------------------------------- | --------------------------------------------- |
+| `authenticationClient.authorizationCodeGrant(...)`  | `authClient.getTokenByCode(...)`              |
+| `authenticationClient.clientCredentialsGrant(...)`  | `authClient.getTokenByClientCredentials(...)` |
+| `authenticationClient.refreshTokenGrant(...)`       | `authClient.getTokenByRefreshToken(...)`      |
+| `authenticationClient.passwordGrant(...)`           | `authClient.getTokenByPassword(...)`          |
+| `authenticationClient.revokeRefreshToken(...)`      | `authClient.revokeToken(...)`                 |
+| `authenticationClient.database.signUp(...)`         | `authClient.signUp(...)`                      |
+| `authenticationClient.database.changePassword(...)` | `authClient.changePassword(...)`              |
+| `authenticationClient.passwordless.*`               | `authClient.passwordless.*` (sub-client)      |
+| `userInfoClient.getUserInfo(accessToken)`           | `authClient.getUserInfo(accessToken)`         |
+
+### mTLS configuration
+
+If you use mTLS, you must now provide an explicit `customFetch` option:
+
+```js
+import { AuthClient } from "@auth0/auth0-auth-js";
+import https from "https";
+import fetch from "node-fetch";
+
+const agent = new https.Agent({
+    cert: fs.readFileSync("client-cert.pem"),
+    key: fs.readFileSync("client-key.pem"),
+});
+
+const auth = new AuthClient({
+    domain: "your-tenant.auth0.com",
+    clientId: "YOUR_CLIENT_ID",
+    clientSecret: "YOUR_CLIENT_SECRET",
+    useMtls: true,
+    customFetch: (url, init) => fetch(url, { ...init, agent }),
+});
+```
+
+See the [auth0-auth-js documentation](https://github.com/auth0/node-auth0/tree/main/packages/auth0-auth-js) for complete API details.
+
 ## Request and Response Types
 
 The SDK exports all request and response types as TypeScript interfaces. You can import them directly:
@@ -375,8 +441,6 @@ const actions = await client.actions.list(listParams);
 ### Key Classes
 
 - **ManagementClient** - for Auth0 Management API operations
-- **AuthenticationClient** - for Auth0 Authentication API operations
-- **UserInfoClient** - for retrieving user profile information
 
 ## Exception Handling
 

eslint.config.mjs

@@ -168,7 +168,6 @@ export default [
             "*.config.mjs",
             "scripts/",
             "tests/data/",
-            "tests/auth/fixtures/",
             "**/*.d.ts",
             "**/*.d.mts",
             // Generated API files - these are auto-generated and should not be linted

jest.config.mjs

@@ -27,11 +27,16 @@ export default {
             displayName: "unit",
             preset: "ts-jest",
             testEnvironment: "node",
+            roots: ["<rootDir>/src/management/tests"],
+            testPathIgnorePatterns: ["/tests/wire/"],
+            // Use lightweight CJS stub to avoid ESM openid-client dependency.
+            // The real @auth0/auth0-auth-js dist/index.cjs requires ESM openid-client,
+            // which Jest's CJS runtime cannot load. token-provider.test.ts uses its own
+            // jest.mock() and fully covers token-acquisition behavior.
             moduleNameMapper: {
                 "^(\.{1,2}/.*)\.js$": "$1",
+                "^@auth0/auth0-auth-js$": "<rootDir>/src/management/tests/__mocks__/auth0-auth-js.cjs",
             },
-            roots: ["<rootDir>/src/management/tests"],
-            testPathIgnorePatterns: ["/tests/wire/"],
             setupFilesAfterEnv: ["<rootDir>/src/management/tests/setup.ts"],
             transform: {
                 "^.+\\.tsx?$": [
@@ -48,6 +53,7 @@ export default {
             testEnvironment: "node",
             moduleNameMapper: {
                 "^(\.{1,2}/.*)\.js$": "$1",
+                "^@auth0/auth0-auth-js$": "<rootDir>/src/management/tests/__mocks__/auth0-auth-js.cjs",
             },
             roots: ["<rootDir>/src/management/tests/wire"],
             setupFilesAfterEnv: [
@@ -69,6 +75,8 @@ export default {
             testEnvironment: "node",
             moduleNameMapper: {
                 "^(\\.{1,2}/.*)\\.js$": "$1",
+                // Use CJS stub to avoid ESM openid-client dependency in export-surface test
+                "^@auth0/auth0-auth-js$": "<rootDir>/src/management/tests/__mocks__/auth0-auth-js.cjs",
             },
             extensionsToTreatAsEsm: [".ts"],
             transform: {
@@ -88,4 +96,4 @@ export default {
     ],
     workerThreads: false,
     passWithNoTests: true,
-};
+};

package.json

@@ -1,6 +1,6 @@
 {
     "name": "auth0",
-    "version": "6.2.0",
+    "version": "7.0.0",
     "private": false,
     "repository": {
         "type": "git",
@@ -1699,7 +1699,7 @@
         "validate": "yarn lint:check && yarn format --check && yarn build && yarn test && yarn lint:package"
     },
     "dependencies": {
-        "uuid": "^11.1.1",
+        "@auth0/auth0-auth-js": "^1.12.1",
         "jose": "^5.0.0",
         "auth0-legacy": "npm:auth0@^4.37.1"
     },