// The enrolment live-session fast path's DECISION, pure and dependency-free
// so it's unit-testable in Node (#1378; the harness style of serverlist.js).
// A candidate exists only when both halves of a live home session are present
// in the given store — the link token AND the tab-scoped DEK (home.js
// § session state; the DEK never outlives the tab by design). The caller
// (enroll.js trySessionReuse) still validates both against the server — fetch
// the blob, unseal it — before trusting them; this only decides whether
// there's anything to try instead of a fresh passkey ceremony.
export function reuseCandidate(store) {
  try {
    const token = (store && store.getItem("home_token")) || "";
    const dek = (store && store.getItem("home_dek")) || "";
    return token && dek ? { token, dek } : null;
  } catch {
    return null; // storage unavailable (private mode) — ceremony it is
  }
}