Partial token snapshot returned by SupportsRefresh.refreshToken.
issuer and sub are optional because callers reuse the stored identity from the
original federation profile — the refresh grant does not re-assert identity. All other
token fields follow the same semantics as FederationProfile.
Partial token snapshot returned by
SupportsRefresh.refreshToken.issuerandsubare optional because callers reuse the stored identity from the original federation profile — the refresh grant does not re-assert identity. All other token fields follow the same semantics asFederationProfile.