class SessionService
implements ISessionService
Since 0.2.0

Loads, exposes, and commits the per-request session.

Constructors

SessionService(
config: ResolvedSessionConfig,
ring: KeyRing,
store?: ISessionStore
)
Parameters
config: ResolvedSessionConfig

Resolved configuration

ring: KeyRing

Derived key ring; index 0 seals

Runtime capabilities

optional
store: ISessionStore

Server-side store; omit for the cookie strategy

Properties

readonly
keyCount: number

How many keys can open a cookie, for the health indicator.

readonly
mode: string

How the cookie is protected, for the health indicator.

readonly
strategy: "cookie" | "store"

Which strategy is in effect, for the health indicator.

Methods

close(): Promise<void>

Releases store resources; called from the plugin's onClose.

Since 0.2.0
commit(
ctx: IRequestContext,
session: Session
): Promise<void>

Writes the session back, when it needs writing.

A clean session emits no header at all: committing on every request would rewrite the cookie on pure reads and defeat downstream caching.

from(ctx: IRequestContext): ISession

Returns the session the middleware loaded for this request.

This is the single entry point: the middleware, route handlers, the CSRF middleware, and framework bridges all read the same instance, so no caller can observe a differently-configured session.

Since 0.3.0
fromHeaders(headers: Headers): Promise<SessionView | null>

Opens a session from a Headers object alone — the headers-only read for non-HTTP entry points that have no request context to commit onto (a WebSocket onOpen handler, an auth strategy reading a cookie).

Read-only by contract: it runs the same envelope-open, snapshot-parse, and store-read path as SessionService.load but never advances the session's seen stamp, never commits, and never writes to the store. It returns null for every condition load treats as "no usable session" — the cookie is absent or empty, the envelope cannot be opened, the snapshot cannot be parsed, the absolute expiry or idle timeout has passed, or (on the store strategy) the stored entry is gone.

Since 0.2.0
load(ctx: IRequestContext): Promise<Session>

Loads the session for a request, falling back to a fresh one whenever the cookie is absent, malformed, tampered with, expired, idle, or (on the store strategy) no longer present server-side.

Since 0.2.0
storeHealth(): Promise<boolean | undefined>

Reports store reachability for the health indicator.

Usage

import { SessionService } from "session-plugin/src/index.ts";