/**
 * DI token for the lazily-loaded `EntraGroupToRoleResolver`.
 *
 * The resolver wraps a `Map<groupGuid, FunctionalRole>` parsed
 * once at boot from `infra/<env>-tenant.entra.json` (per ADR-0025
 * §"Sources of truth — Entra-side configuration"). The token is
 * separate from the class import so the BFF can swap the
 * implementation (an empty-map stub when no file is configured,
 * a real one when `ENTRA_GROUP_MAP_PATH` resolves) without the
 * consumers caring.
 */
export const ENTRA_GROUP_TO_ROLE_RESOLVER = Symbol('ENTRA_GROUP_TO_ROLE_RESOLVER');