/**
 * DI token for the dedicated AES-256-GCM key the OBO downstream
 * token cache uses to encrypt stored entries. Provided by the
 * `DownstreamModule` factory from `assertOboCacheEncryptionKey()`
 * (which decodes + validates the env var at boot).
 *
 * Distinct from `SESSION_ENCRYPTION_KEY` per ADR-0014 §"Token cache
 * (for OBO)": "distinct from SESSION_ENCRYPTION_KEY (ADR-0010) so a
 * cache-key compromise does not cascade into session compromise".
 */
export const OBO_CACHE_KEY = 'OBO_CACHE_KEY';
