unwrapSessionDataKey(session: { token: string; wrappedDataKey: WrappedKey | null; }): Promise<CryptoKey>
Unwrap a session's DATA_KEY from its token. An authenticated session that reaches a data-key operation always carries a wrapped data key, so a missing one is a broken invariant — throw rather than invent a key.
Promise<CryptoKey>