refactor: move mcp auth record ownership

src/wf_mcp/broker/service/core.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 from dataclasses import dataclass, field
 from typing import Any
 
+from wf_api.models import RawWorkflowPlan
+from wf_api.saved_subgraphs import SavedSubgraphTree
 from wf_artifacts import (
     DraftWorkspaceStore,
     RunStore,
@@ -15,29 +17,32 @@ from wf_core import (
     RunState,
     Workflow,
 )
-from wf_api.models import RawWorkflowPlan
-from wf_mcp.capabilities import CatalogNodeEntry, CatalogPromptEntry, CatalogResourceEntry
+from wf_mcp.capabilities import (
+    CatalogNodeEntry,
+    CatalogPromptEntry,
+    CatalogResourceEntry,
+)
 from wf_platform import (
     CapabilitySource,
 )
+
+from ...auth import AuthRecord
 from ...connections import ConnectionRegistry
 from ...events import EventBus, McpEvent
 from ...models import (
-    AuthRecord,
-    CatalogSnapshot,
     BrokerConfig,
+    CatalogSnapshot,
     ConnectionConfig,
 )
-from ...sdk import BackendAdapter
 from ...runtime import ToolExecutor
+from ...sdk import BackendAdapter
 from ...source_registry import SourceRegistryStore
-from .connection_service import ConnectionService
-from .content_access import ContentAccessService
 from ...storage import Store
-from wf_api.saved_subgraphs import SavedSubgraphTree
 from ..admin_capabilities import admin_source
 from ..catalog import CombinedCatalog
 from .builtins import builtin_sources
+from .connection_service import ConnectionService
+from .content_access import ContentAccessService
 from .events import BrokerEventRecorder
 from .source_catalog import SourceCatalogService
 from .upstream_transport import UpstreamTransportService

src/wf_mcp/broker/service/source_catalog.py

@@ -6,8 +6,13 @@ from dataclasses import dataclass, field
 from typing import Any
 
 from pydantic import BaseModel
+
 from wf_authoring import NodeReturn, NodeSpec
-from wf_mcp.capabilities import CatalogNodeEntry, CatalogPromptEntry, CatalogResourceEntry
+from wf_mcp.capabilities import (
+    CatalogNodeEntry,
+    CatalogPromptEntry,
+    CatalogResourceEntry,
+)
 from wf_platform import (
     CapabilityBuckets,
     CapabilitySource,
@@ -18,10 +23,10 @@ from wf_platform import (
     page_items,
 )
 
+from ...auth import AuthRecord
 from ...connections import ConnectionConfig, qualify_node_name
 from ...events import McpEvent, make_event
 from ...models import (
-    AuthRecord,
     CatalogSnapshot,
 )
 from ...runtime import ToolExecutor
@@ -30,7 +35,6 @@ from ...workflow.wrappers import _model_from_schema
 from ..catalog import CombinedCatalog, snapshot_from_specs
 from .specs import get_qualified_spec, qualify_spec
 
-
 ConnectionLookup = Callable[[str], ConnectionConfig]
 ConnectionList = Callable[[], list[ConnectionConfig]]
 ToolExecutorLookup = Callable[[ConnectionConfig], ToolExecutor]

src/wf_mcp/broker/service/source_registry_admin.py

@@ -6,8 +6,8 @@ from typing import Any
 
 from wf_api.source_registry_admin import WorkflowSourceRegistryMutationProvider
 
-from ...auth import connection_auth_diagnostic
-from ...models import AuthRecord, BrokerConfig, ConnectionConfig
+from ...auth import AuthRecord, connection_auth_diagnostic
+from ...models import BrokerConfig, ConnectionConfig
 from ...source_registry import (
     McpSourceRegistryEntry,
     SourceRegistryFile,
@@ -135,12 +135,18 @@ class SourceRegistryAdminProvider(WorkflowSourceRegistryMutationProvider):
         if self.connection_service is None or self.config is None:
             raise RuntimeError("source registry apply requires runtime service context")
 
-        before = {connection.id: connection for connection in self.connection_service.list_all()}
+        before = {
+            connection.id: connection
+            for connection in self.connection_service.list_all()
+        }
         self.connection_service.sync_connections_from_config(
             self.config,
             source_registry_store=self.source_registry_store,
         )
-        after = {connection.id: connection for connection in self.connection_service.list_all()}
+        after = {
+            connection.id: connection
+            for connection in self.connection_service.list_all()
+        }
 
         if self.ensure_adapter is not None:
             for connection in after.values():

src/wf_mcp/broker/service/specs.py

@@ -4,9 +4,8 @@ from collections.abc import Mapping
 from typing import Any
 
 from wf_authoring import NodeSpec
-
-from wf_platform import CapabilitySource
 from wf_mcp.connections import qualify_node_name
+from wf_platform import CapabilitySource
 
 
 def qualify_spec(connection_id: str, spec: NodeSpec[Any, Any]) -> NodeSpec[Any, Any]:

src/wf_mcp/broker/service/upstream_transport.py

@@ -10,19 +10,21 @@ import anyio
 import httpx
 from mcp.client.streamable_http import StreamableHTTPError
 from mcp.shared.exceptions import McpError
+
 from wf_artifacts import (
     DependencyDiagnostic,
     DiagnosticSeverity,
     WorkflowArtifact,
     WorkflowDeployment,
 )
+from wf_mcp.auth import AuthRecord
 from wf_mcp.broker.catalog import snapshot_from_specs
 from wf_mcp.broker.discovery import (
     discover_connection_capabilities,
     specs_from_discovered_tools,
 )
 from wf_mcp.events import McpEvent, make_event
-from wf_mcp.models import AuthRecord, CatalogSnapshot, ConnectionConfig
+from wf_mcp.models import CatalogSnapshot, ConnectionConfig
 from wf_mcp.runtime import ToolExecutor
 from wf_mcp.sdk import BackendAdapter
 from wf_mcp.shared.errors import error_payload

src/wf_mcp/broker/service/workflow_operation_context.py

@@ -4,8 +4,6 @@ from collections.abc import Sequence
 from dataclasses import dataclass
 from typing import Any
 
-from wf_artifacts import DependencyDiagnostic, WorkflowArtifact, WorkflowDeployment
-from wf_authoring import NodeSpec
 from wf_api.operation_context import (
     WorkflowEventRecorder,
     WorkflowLiveSourceChecker,
@@ -13,6 +11,9 @@ from wf_api.operation_context import (
     WorkflowRuntimeRunner,
     WorkflowSpecProvider,
 )
+from wf_artifacts import DependencyDiagnostic, WorkflowArtifact, WorkflowDeployment
+from wf_authoring import NodeSpec
+
 from .core import WfMcpService
 from .events import BrokerEventRecorder
 from .source_catalog import SourceCatalogService

src/wf_mcp/broker/service/workflow_runtime.py

@@ -4,6 +4,13 @@ from collections.abc import Callable
 from dataclasses import dataclass
 from typing import Any
 
+from wf_api.models import RawWorkflowPlan
+from wf_api.runtime_dependencies import resolve_runtime_dependencies
+from wf_api.saved_subgraphs import (
+    SavedSubgraphTree,
+    prepare_saved_subgraphs,
+    resolve_saved_subgraph_tree,
+)
 from wf_artifacts import WorkflowArtifact, WorkflowArtifactStore, WorkflowDeployment
 from wf_authoring import NodeSpec
 from wf_core import (
@@ -14,13 +21,6 @@ from wf_core import (
     execute_workflow_result_async,
     resume_workflow_result_async,
 )
-from wf_api.models import RawWorkflowPlan
-from wf_api.runtime_dependencies import resolve_runtime_dependencies
-from wf_api.saved_subgraphs import (
-    SavedSubgraphTree,
-    prepare_saved_subgraphs,
-    resolve_saved_subgraph_tree,
-)
 
 from ...events import McpEvent, make_event
 from .source_catalog import SourceCatalogService