Remembers, for ONE TAB, enough to carry a visitor across a reload without asking them to start over:
the session JWT the widget holds (so a single-use invite link that was redeemed and then removed from
the address bar still works after a reload), and the last session's ids (so the next start can chain to
it and its channels' saved state resumes).
Lifted from the Caliber widget's resume-token store and cut down to what is generic. What Caliber kept
and this does not: the multi-tier cookie/localStorage backends and the cross-tab resume window — those
serve an assessment-specific, server-signed "reattach to my in-flight interview" flow. This store is
sessionStorage only: it dies with the tab, which is the right lifetime for an anonymous visitor's
credential.
SANCTIONED EXCEPTION TO THE no-localStorage RULE (the rule governs authenticated user PREFERENCES,
which go through UserInfoEngine): this is anonymous session CONTINUITY — a signed, expiring credential
and opaque ids — not a preference. The blob holds NO email, name or any other PII, and expiry is enforced
on read.
Storage is injected so the store is unit-testable without a DOM; production wires sessionStorage.
Remembers, for ONE TAB, enough to carry a visitor across a reload without asking them to start over: the session JWT the widget holds (so a single-use invite link that was redeemed and then removed from the address bar still works after a reload), and the last session's ids (so the next start can chain to it and its channels' saved state resumes).
Lifted from the Caliber widget's resume-token store and cut down to what is generic. What Caliber kept and this does not: the multi-tier cookie/localStorage backends and the cross-tab resume window — those serve an assessment-specific, server-signed "reattach to my in-flight interview" flow. This store is
sessionStorageonly: it dies with the tab, which is the right lifetime for an anonymous visitor's credential.SANCTIONED EXCEPTION TO THE no-
localStorageRULE (the rule governs authenticated user PREFERENCES, which go throughUserInfoEngine): this is anonymous session CONTINUITY — a signed, expiring credential and opaque ids — not a preference. The blob holds NO email, name or any other PII, and expiry is enforced on read.Storage is injected so the store is unit-testable without a DOM; production wires
sessionStorage.