refactor: split mcp auth catalog stores

src/wf_mcp/broker/config.py

@@ -15,7 +15,7 @@ from ..source_registry import (
     FileSourceRegistryStore,
     workflow_mcp_source_to_connection_config,
 )
-from ..storage import FileStore
+from ..storage import FileAuthStore, FileCatalogStore, FileStore
 from .models import BrokerStoreRoots
 from .service import WfMcpService
 
@@ -164,11 +164,14 @@ def build_service_from_config(config: BrokerConfig) -> WfMcpService:
     runtime_factory = PersistentSessionFactory()
     store_roots = config.store_roots or BrokerStoreRoots.from_default(config.store_root)
     workflow_stores = file_workflow_stores(store_roots.workflow_root)
-    # FileStore still owns both auth files and catalog snapshots. Role roots are
-    # carried separately so a later FileStore split can move catalog_cache without a
-    # config migration.
+    # Keep FileStore as the compatibility facade on WfMcpService.store while
+    # focused services receive role-specific stores.
+    auth_store = FileAuthStore(store_roots.auth_root)
+    catalog_store = FileCatalogStore(store_roots.catalog_cache_root)
     service = WfMcpService(
         store=FileStore(store_roots.auth_root),
+        auth_store=auth_store,
+        catalog_store=catalog_store,
         artifact_store=workflow_stores.artifact_store,
         draft_workspace_store=workflow_stores.draft_workspace_store,
         run_store=workflow_stores.run_store,

src/wf_mcp/broker/server.py

@@ -68,7 +68,7 @@ def workflow_server_from_service(
     admin = WorkflowAdminApi(
         connections=service.connection_service,
         events=service.events,
-        auth=McpAuthAdminProvider(store=service.store),
+        auth=McpAuthAdminProvider(store=service.auth_store or service.store),
     )
     registry_provider = SourceRegistryAdminProvider(
         source_registry_store=source_registry_store,

src/wf_mcp/broker/service/auth_admin.py

@@ -6,7 +6,7 @@ from typing import Any
 from wf_api import WorkflowAdminAuthProvider
 from wf_api.auth import AuthRecord as NeutralAuthRecord
 
-from ...storage import Store
+from ...storage import AuthStore
 
 
 @dataclass(frozen=True, slots=True)
@@ -17,7 +17,7 @@ class McpAuthAdminProvider(WorkflowAdminAuthProvider):
     auth variants can provide richer safe display later.
     """
 
-    store: Store
+    store: AuthStore
 
     def list_auth_records(self) -> list[dict[str, Any]]:
         return [

src/wf_mcp/broker/service/core.py

@@ -37,7 +37,7 @@ from ...models import (
 from ...runtime import ToolExecutor
 from ...sdk import BackendAdapter
 from ...source_registry import SourceRegistryStore
-from ...storage import Store
+from ...storage import AuthStore, CatalogStore, Store
 from ..admin_capabilities import admin_source
 from ..catalog import CombinedCatalog
 from .builtins import builtin_sources
@@ -60,6 +60,8 @@ class WfMcpService:
     """
 
     store: Store
+    auth_store: AuthStore | None = None
+    catalog_store: CatalogStore | None = None
     default_catalog_max_age_seconds: int = 300
     event_bus: EventBus = field(default_factory=EventBus)
     include_builtin_specs: bool = True
@@ -83,13 +85,16 @@ class WfMcpService:
         """
         self.events = BrokerEventRecorder(self.event_bus)
         self.connection_service = ConnectionService(events=self.events)
+        auth_store = self.auth_store or self.store
+        catalog_store = self.catalog_store or self.store
         self.upstream = UpstreamTransportService(
-            store=self.store,
+            auth_store=auth_store,
+            catalog_store=catalog_store,
             event_sink=self.events.record_event,
             tool_executor=self.tool_executor,
         )
         self.source_catalog = SourceCatalogService(
-            store=self.store,
+            store=catalog_store,
             connection_lookup=self.connection_service.get,
             connection_list_enabled=self.connection_service.list_enabled,
             connection_list_all=self.connection_service.list_all,

src/wf_mcp/broker/service/source_catalog.py

@@ -30,7 +30,7 @@ from ...models import (
     CatalogSnapshot,
 )
 from ...runtime import ToolExecutor
-from ...storage import Store
+from ...storage import CatalogStore
 from ...workflow.wrappers import _model_from_schema
 from ..catalog import CombinedCatalog, snapshot_from_specs
 from .specs import get_qualified_spec, qualify_spec
@@ -51,7 +51,7 @@ class SourceCatalogService:
     the broker's configured tool executor.
     """
 
-    store: Store
+    store: CatalogStore
     connection_lookup: ConnectionLookup
     connection_list_enabled: ConnectionList
     connection_list_all: ConnectionList

src/wf_mcp/broker/service/upstream_transport.py

@@ -28,7 +28,7 @@ from wf_mcp.models import CatalogSnapshot, ConnectionConfig
 from wf_mcp.runtime import ToolExecutor
 from wf_mcp.sdk import BackendAdapter
 from wf_mcp.shared.errors import error_payload
-from wf_mcp.storage import Store
+from wf_mcp.storage import AuthStore, CatalogStore
 
 from ...auth import connection_auth_diagnostic
 from .adapters import require_adapter
@@ -45,7 +45,8 @@ class UpstreamTransportService:
     admin calls, discovery, generated workflow NodeSpecs, and live source checks.
     """
 
-    store: Store
+    auth_store: AuthStore
+    catalog_store: CatalogStore
     event_sink: EventSink
     adapters: dict[str, BackendAdapter] = field(default_factory=dict)
     tool_executor: ToolExecutor | None = None
@@ -54,7 +55,7 @@ class UpstreamTransportService:
         self.adapters[server] = adapter
 
     def save_auth(self, record: AuthRecord) -> None:
-        self.store.save_auth(record)
+        self.auth_store.save_auth(record)
         self.event_sink(
             make_event(
                 "auth_saved",
@@ -64,7 +65,7 @@ class UpstreamTransportService:
         )
 
     def load_auth(self, connection_id: str) -> AuthRecord | None:
-        return self.store.load_auth(connection_id)
+        return self.auth_store.load_auth(connection_id)
 
     def load_connection_auth(self, connection: ConnectionConfig) -> AuthRecord | None:
         """Resolve auth for a connection, preferring explicit source auth_ref.
@@ -251,7 +252,7 @@ class UpstreamTransportService:
                 fetched_at_epoch_ms=int(time.time() * 1000),
                 max_age_seconds=max_age_seconds or default_catalog_max_age_seconds,
             )
-            self.store.save_catalog(snapshot)
+            self.catalog_store.save_catalog(snapshot)
             record_catalog_change_events(connection.id, snapshot, "catalog_refresh")
             self.event_sink(
                 make_event(