Extract app auth cache integration

NEXT_STEPS.md

@@ -9,6 +9,7 @@ Estado al cierre:
 - Refactor tecnico posterior:
   - `svrs/auth/engine-auth.ts` ya delega CSRF en `csrf-flow.ts`, coherente con password/session/recovery/device flows.
   - `svrs/auth/handlers.ts` delega helpers HTTP/CSRF/error-safe en `handler-runtime.ts`; conserva solo rutas y delegacion al engine.
+  - `arts/aapp/active-app.svelte.ts` delega invalidacion Auth -> Permissions/Cache en `integrations/auth-cache.ts`.
   - `libs/cach/engine.ts` centraliza eventos de lectura con `emitForContext(...)`.
   - `arts/conn/connection.ts` usa `createConnectionIdFactory(...)` desde helpers.
   - `arts/conn/connection.ts` delega auth/request/ACK request-reply en `connection-requests.ts`.

src/arts/aapp/active-app.svelte.ts

@@ -6,7 +6,6 @@ import {
 	type ActiveAuthOptions
 } from '$auth';
 import { createActiveCache } from '$cach';
-import { CACHE_SCOPE_PUBLIC } from '$libs/cach';
 import { createActiveConnections as createActiveConnectionsRegistry } from '$conn';
 import type { ActiveConnections, ActiveConnectionsOptions, ConnectionMap } from '$conn';
 import { createActiveFrontend } from '$fend';
@@ -37,6 +36,7 @@ import {
 	bindFrontendStorage,
 	loadPersistedFrontendPreferences
 } from './integrations/frontend-storage';
+import { createAuthCacheInvalidator } from './integrations/auth-cache';
 import {
 	APP_ERROR_ALREADY_CREATED_PERMISSIONS,
 	APP_ERROR_ALREADY_CREATED_AUTH,
@@ -236,19 +236,10 @@ export function createActiveApp<S extends LangNode = LangNode>(
 				...authOptions,
 				logger: Logger,
 				http: createEngineHttpAuthClient(Http),
-				cach: {
-					async invalidate(input) {
-						Permissions?.invalidate();
-						await Promise.all(
-							input.tags.map((tag) =>
-								Cache.invalidate({
-									tag,
-									scope: CACHE_SCOPE_PUBLIC
-								})
-							)
-						);
-					}
-				}
+				cach: createAuthCacheInvalidator({
+					cache: Cache,
+					permissions: () => Permissions
+				})
 			});
 			Auth = built;
 			return built;

src/arts/aapp/integrations/auth-cache.ts

@@ -0,0 +1,23 @@
+import { CACHE_SCOPE_PUBLIC } from '$libs/cach';
+import type { AuthClientCachPort } from '$libs/auth/contracts';
+import type { ActiveCache } from '$cach';
+import type { ActivePermissions } from '$perm';
+
+export function createAuthCacheInvalidator(input: {
+	readonly cache: ActiveCache;
+	readonly permissions: () => ActivePermissions | undefined;
+}): AuthClientCachPort {
+	return {
+		async invalidate(event) {
+			input.permissions()?.invalidate();
+			await Promise.all(
+				event.tags.map((tag) =>
+					input.cache.invalidate({
+						tag,
+						scope: CACHE_SCOPE_PUBLIC
+					})
+				)
+			);
+		}
+	};
+}