Merge branch 'fix/g09' into fix/integrated

internal/ipc/server.go

@@ -529,7 +529,11 @@ type Server struct {
 
 // WrapKeyFunc — wraps the store encryption key under the passkey-derived
 // secret (a 32-byte WebAuthn PRF output) and persists the wrapped blob.
-type WrapKeyFunc func(ctx context.Context, secret []byte) error
+//
+// explicit distinguishes "the operator asked for the cold-start key to be
+// written" from "a passkey was asserted". Only the first may overwrite a blob
+// that is already there; see cmd/mavend/keyfile.go.
+type WrapKeyFunc func(ctx context.Context, secret []byte, explicit bool) error
 
 // UnlockFunc — unwraps the store encryption key using the passkey-derived
 // secret and completes daemon initialization.
@@ -996,7 +1000,7 @@ func (s *Server) dispatch(ctx context.Context, req Request) (json.RawMessage, er
 			if err := unmarshalParams(req.Params, &p); err != nil {
 				return nil, err
 			}
-			return marshalResult(nil), s.WrapKeyFn(ctx, p.Secret)
+			return marshalResult(nil), s.WrapKeyFn(ctx, p.Secret, p.Explicit)
 		}
 		return nil, fmt.Errorf("%w: %s", ErrUnknownMethod, req.Method)