Who the server believes is asking — the answer at ACCOUNT_PATH.
The browser already knows who it signed in as; this is the other side's verdict on the same credential, and the two can disagree for real reasons: a token minted for another origin, one that expired in a background tab, or a deployment with no identity provider configured at all. Anything the server will later refuse or attribute — a discovery claim, a guide session — is decided on this verdict, never on the client's.
Three states rather than a user id alone, because "nobody is signed in" and "this deployment cannot tell" are different sentences: the second is a fork or a local server without a key, and telling its visitor to sign in again would send them round a loop that cannot end.
net.ts:138Members
configuredreadonly
Whether this deployment can verify an account at all.
signedInreadonly
userIdreadonly
The provider's stable user id. null whenever signedIn is false.