A read-only projection of a session: its identifier and payload, with no mutation surface.

Returned by ISessionService.fromHeaders for a session that can be opened from a Headers object alone — the headers-only read used by non-HTTP entry points (a WebSocket onOpen handler, an auth strategy reading a cookie) where there is no request context to commit onto. Because it exposes no set/destroy/regenerate, nothing handed out here can fail silently: a caller cannot write a value that would never persist.

data is returned verbatim, including any reserved keys the session plugin stores in the payload (e.g. the tenant binding key), so fromHeaders(...) and ISession.toJSON agree about the same session.