@cfxlabsinc/b2b-services
    Preparing search index...
    SignInMethod:
        | { kind: "password" }
        | { kind: "passkey" }
        | { identityProvider: string; kind: "federated" }

    How the server established a session: the native sign-in it ran, or the IdP its own OAuth round trip went to. Never read off the ID token, whose identities lists every IdP linked to the user, not the one used now.