Returns the session the middleware loaded for this request.
This is the single entry point: the middleware, route handlers, the CSRF middleware, and framework bridges all read the same instance, so no caller can observe a differently-configured session.
The request context
The session for this request
Opens a session from a Headers object alone — the headers-only read for
non-HTTP entry points that have no request context to commit onto (a
WebSocket onOpen handler, an auth strategy reading a cookie).
This is READ-ONLY: it never commits, never advances the session's seen
stamp, and never writes to the store or the cookie. It runs the same
envelope-open, snapshot-parse, and store-read path as the load behind
ISessionService.from, so it inherits real revocation on the
store strategy.
The request headers to read the session cookie from
A read-only SessionView, or null when there is no
usable session — the cookie is absent, the envelope cannot be opened, the
snapshot cannot be parsed, the absolute expiry or idle timeout has passed,
or the stored entry is gone (revoked)
Session service registered under
CAPABILITIES.SESSION.Example
Since
0.2.0