protected static final String AAD_DEFAULT_ROLES = "aad.default.roles";

    /** Session attribute key for storing Entra ID states. */
    protected static final String STATES = "entraidStates";

    /** OAuth2 state parameter name. */
    protected static final String STATE = "state";

    /** OAuth2 error parameter name. */
    protected static final String ERROR = "error";

import static com.google.common.util.concurrent.MoreExecutors.directExecutor;
import static com.google.common.util.concurrent.Service.State.FAILED;
import static com.google.common.util.concurrent.Service.State.NEW;
import static com.google.common.util.concurrent.Service.State.RUNNING;
import static com.google.common.util.concurrent.Service.State.STARTING;

import com.google.common.cache.LocalCache.ValueReference;
import org.jspecify.annotations.Nullable;

/**
 * An entry in a reference map.
 *
 * <p>Entries in the map can be in the following states:
 *
 * <p>Valid:
 *
 * <ul>
 *   <li>Live: valid key/value are set
 *   <li>Loading: loading is pending
 * </ul>
 *
 * <p>Invalid:
 *
 * <ul>

import com.google.common.cache.LocalCache.ValueReference;
import org.jspecify.annotations.Nullable;

/**
 * An entry in a reference map.
 *
 * <p>Entries in the map can be in the following states:
 *
 * <p>Valid:
 *
 * <ul>
 *   <li>Live: valid key/value are set
 *   <li>Loading: loading is pending
 * </ul>
 *
 * <p>Invalid:
 *
 * <ul>

 * instances; usually this is [OkHttpClient].
 *
 * ## Web Socket Lifecycle
 *
 * Upon normal operation each web socket progresses through a sequence of states:
 *
 *  * **Connecting:** the initial state of each web socket. Messages may be enqueued but they won't
 *    be transmitted until the web socket is open.
 *
 *  * **Open:** the web socket has been accepted by the remote peer and is fully operational.

	PrepareContext(ctx context.Context, query string) (*sql.Stmt, error)
}

// New creates a new Stmt object for executing SQL queries.
// It caches the Stmt object for future use and handles preparation and error states.
// Parameters:
//
//	ctx: Context for the request, used to carry deadlines, cancellation signals, etc.
//	key: The key representing the SQL query, used for caching and preparing the statement.

    // Fail fast on a null. We throw NPE here because the contract of Executor states that it throws
    // NPE on null listener, so we propagate that contract up into the add method as well.
    checkNotNull(runnable, "Runnable was null.");
    checkNotNull(executor, "Executor was null.");

    // Lock while we check state. We must maintain the lock while adding the new pair so that

## Recap { #recap }

Use multiple Pydantic models and inherit freely for each case.

The spec also states that the `username` and `password` must be sent as form data (so, no JSON here).

### `scope` { #scope }

The spec also says that the client can send another form field "`scope`".

The form field name is `scope` (in singular), but it is actually a long string with "scopes" separated by spaces.

Each "scope" is just a string (without spaces).

     * everywhere.
     */
    static final class Sync<V> extends AbstractQueuedSynchronizer {

      private static final long serialVersionUID = 0L;

      /* Valid states. */
      static final int RUNNING = 0;
      static final int COMPLETING = 1;
      static final int COMPLETED = 2;
      static final int CANCELLED = 4;
      static final int INTERRUPTED = 8;

      private V value;