From 7781a518482e9256a94c5158fd4f2506051340ec Mon Sep 17 00:00:00 2001
From: adlee-was-taken <aaron.daniel.lee@gmail.com>
Date: Mon, 20 Apr 2026 19:52:54 -0400
Subject: [PATCH] feat(ext/sw): SessionHandle lifecycle module

---
 extension/src/service-worker/session.ts | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 extension/src/service-worker/session.ts

diff --git a/extension/src/service-worker/session.ts b/extension/src/service-worker/session.ts
new file mode 100644
index 0000000..e6af83e
--- /dev/null
+++ b/extension/src/service-worker/session.ts
@@ -0,0 +1,24 @@
+/// Single module-scope "current" SessionHandle.
+///
+/// α assumes one vault per extension install. The master key lives only
+/// inside WASM linear memory (wrapped in Zeroizing<[u8;32]>); this module
+/// just holds the opaque handle that names it.
+
+import type { SessionHandle } from '../../wasm/relicario_wasm';
+
+let current: SessionHandle | null = null;
+
+export function setCurrent(h: SessionHandle): void { current = h; }
+
+export function getCurrent(): SessionHandle | null { return current; }
+
+export function requireCurrent(): SessionHandle {
+  if (!current) throw new Error('vault_locked');
+  return current;
+}
+
+export function clearCurrent(): void {
+  if (!current) return;
+  try { current.free(); } catch { /* already freed */ }
+  current = null;
+}