diff --git a/extension/src/service-worker/session.ts b/extension/src/service-worker/session.ts
new file mode 100644
index 0000000..e6af83e
--- /dev/null
+++ b/extension/src/service-worker/session.ts
@@ -0,0 +1,24 @@
+/// Single module-scope "current" SessionHandle.
+///
+/// α assumes one vault per extension install. The master key lives only
+/// inside WASM linear memory (wrapped in Zeroizing<[u8;32]>); this module
+/// just holds the opaque handle that names it.
+
+import type { SessionHandle } from '../../wasm/relicario_wasm';
+
+let current: SessionHandle | null = null;
+
+export function setCurrent(h: SessionHandle): void { current = h; }
+
+export function getCurrent(): SessionHandle | null { return current; }
+
+export function requireCurrent(): SessionHandle {
+  if (!current) throw new Error('vault_locked');
+  return current;
+}
+
+export function clearCurrent(): void {
+  if (!current) return;
+  try { current.free(); } catch { /* already freed */ }
+  current = null;
+}