Session service registered under CAPABILITIES.SESSION.
from(ctx: IRequestContext): ISession
Returns the session the middleware loaded for this request.
This is the single entry point: the middleware, route handlers, the CSRF middleware, and framework bridges all read the same instance, so no caller can observe a differently-configured session.
fromHeaders(headers: Headers): Promise<SessionView | null>
Opens a session from a Headers object alone — the headers-only read for
non-HTTP entry points that have no request context to commit onto (a
WebSocket onOpen handler, an auth strategy reading a cookie).
This is READ-ONLY: it never commits, never advances the session's seen
stamp, and never writes to the store or the cookie. It runs the same
envelope-open, snapshot-parse, and store-read path as the load behind
ISessionService.from, so it inherits real revocation on the
store strategy.