test(management): cover telemetry header + mTLS fetch; drop dead export asserts

- token-provider: add TC-2.18/2.19/2.20 covering the previously untested
  buildTelemetryHeader path — telemetry:false omits the Auth0-Client header,
  clientInfo override sets custom name/version, and the default header decodes
  to valid identity JSON.
- fetch-option: add a test asserting the supplied mTLS fetch is actually
  invoked for the api/v2 request (prior mTLS test only checked construction).
- export-surface: remove the AuthenticationClient/UserInfoClient absence
  assertions — both classes are deleted, so the checks were trivially true.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: tusharpandey13

src/management/tests/unit/management-client-fetch-option.test.ts

@@ -79,4 +79,43 @@ describe("ManagementClient custom fetch option", () => {
         const [calledUrl] = myFetchMock.mock.calls[0] as [string, RequestInit];
         expect(calledUrl).toContain(DOMAIN);
     });
+
+    it("uses the supplied mTLS fetch for Management API requests when useMTLS is set", async () => {
+        // Client-credentials mode issues two calls through the supplied fetch:
+        // (1) the token request to the oauth endpoint, (2) the api/v2 request.
+        // Branch on URL so the token call gets a valid access_token and the
+        // api/v2 call gets a users payload.
+        const myFetchMock = jest.fn((url: string) => {
+            if (String(url).includes("/oauth/token")) {
+                return Promise.resolve(
+                    new Response(JSON.stringify({ access_token: "mtls-token", expires_in: 3600 }), {
+                        status: 200,
+                        headers: { "content-type": "application/json" },
+                    }),
+                );
+            }
+            return Promise.resolve(
+                new Response(JSON.stringify({ users: [], length: 0 }), {
+                    status: 200,
+                    headers: { "content-type": "application/json" },
+                }),
+            );
+        });
+
+        const client = new ManagementClient({
+            domain: DOMAIN,
+            clientId: "test-client-id",
+            clientSecret: "test-client-secret",
+            useMTLS: true,
+            fetch: myFetchMock as unknown as typeof fetch,
+        });
+
+        await client.users.list();
+
+        // The mTLS-capable fetch must actually be invoked for the api/v2 call,
+        // otherwise the client certificate is never presented on the request.
+        const apiCall = myFetchMock.mock.calls.find(([u]) => !String(u).includes("/oauth/token"));
+        expect(apiCall).toBeDefined();
+        expect(String(apiCall![0])).toContain(DOMAIN);
+    });
 });

src/management/tests/unit/token-provider.test.ts

@@ -485,4 +485,58 @@ describe("TokenProvider (raw fetch + jose)", () => {
             expect(err.message).toContain("token request failed");
         });
     });
+
+    // Helper: decode the Auth0-Client telemetry header (base64url JSON).
+    // The jose mock's base64url.encode uses the real Buffer base64url encoding,
+    // so Buffer decode round-trips it.
+    function decodeTelemetry(header: string): { name: string; version: string } {
+        return JSON.parse(Buffer.from(header, "base64url").toString());
+    }
+
+    describe("TC-2.18 — telemetry:false omits Auth0-Client header", () => {
+        it("should not send the auth0-client header when telemetry is disabled", async () => {
+            fetchSpy.mockResolvedValue(makeOkResponse({ access_token: "no-telemetry-token", expires_in: 3600 }));
+
+            const tp = new TokenProvider({ ...opts, telemetry: false } as any);
+            await tp.getAccessToken();
+
+            const callHeaders = (fetchSpy.mock.calls[0][1] as RequestInit).headers as Record<string, string>;
+            expect(callHeaders["auth0-client"]).toBeUndefined();
+        });
+    });
+
+    describe("TC-2.19 — clientInfo override sets custom name/version in Auth0-Client header", () => {
+        it("should encode the supplied clientInfo name and version", async () => {
+            fetchSpy.mockResolvedValue(makeOkResponse({ access_token: "client-info-token", expires_in: 3600 }));
+
+            const tp = new TokenProvider({
+                ...opts,
+                clientInfo: { name: "my-custom-sdk", version: "9.9.9" },
+            } as any);
+            await tp.getAccessToken();
+
+            const callHeaders = (fetchSpy.mock.calls[0][1] as RequestInit).headers as Record<string, string>;
+            expect(callHeaders["auth0-client"]).toBeDefined();
+            const decoded = decodeTelemetry(callHeaders["auth0-client"]);
+            expect(decoded.name).toBe("my-custom-sdk");
+            expect(decoded.version).toBe("9.9.9");
+        });
+    });
+
+    describe("TC-2.20 — default Auth0-Client header carries node-auth0 identity JSON", () => {
+        it("should send a decodable auth0-client header with name and version", async () => {
+            fetchSpy.mockResolvedValue(makeOkResponse({ access_token: "default-telemetry-token", expires_in: 3600 }));
+
+            const tp = new TokenProvider(opts);
+            await tp.getAccessToken();
+
+            const callHeaders = (fetchSpy.mock.calls[0][1] as RequestInit).headers as Record<string, string>;
+            expect(callHeaders["auth0-client"]).toBeDefined();
+            const decoded = decodeTelemetry(callHeaders["auth0-client"]);
+            expect(typeof decoded.name).toBe("string");
+            expect(decoded.name.length).toBeGreaterThan(0);
+            expect(typeof decoded.version).toBe("string");
+            expect(decoded.version.length).toBeGreaterThan(0);
+        });
+    });
 });

tests/lib/export-surface.test.ts

@@ -2,14 +2,6 @@ import { describe, it, expect } from "@jest/globals";
 import * as auth0 from "../../src/index.js";
 
 describe("Export Surface (v7.0.0)", () => {
-    it("should NOT export AuthenticationClient", () => {
-        expect((auth0 as any).AuthenticationClient).toBeUndefined();
-    });
-
-    it("should NOT export UserInfoClient", () => {
-        expect((auth0 as any).UserInfoClient).toBeUndefined();
-    });
-
     it("should export ManagementClient", () => {
         expect(auth0.ManagementClient).toBeDefined();
         expect(typeof auth0.ManagementClient).toBe("function");