Module support 

support.* types — the helpdesk-facing corner of KLP.

Two features share the namespace:

• support.upload_diagnostics — one-click “サポートに問い合わせる” diagnostics bundle. Per SPEC §2.1: the agent collects {pc_id, recent_inventory, last_N_events, agent_log_tail}, zips them, uploads to the JetStream Object Store, and the backend opens a helpdesk ticket. The Client App shows the resulting ticket URL so the user can paste it into the chat / email follow-up.
• support.unlock / support.lock / support.status — the operator-code display gate in front of client.unlock-scoped jobs: the IT desk types a secret code on the user’s PC to reveal actions that have no business sitting in that user’s everyday catalog. Listing-only — see kanade_shared::manifest::ClientHint::unlock.

Structs

SupportLockParams

support.lock params — no selectors: locking is all-or-nothing. The button means “I’m done, close it all”, and a partial lock would leave a scope open that the banner no longer advertises.

SupportLockResult

support.lock response — how many grants were dropped (0 when the caller held none; locking is idempotent, never an error).

SupportStatusParams

support.status params — no selectors; the answer is always “what does the calling OS user hold right now”.

SupportStatusResult

support.status response — the caller’s live grants (empty ⇒ locked). Expired grants are swept before answering, so every entry here is currently in force.

SupportUnlockParams

support.unlock params — the code the IT desk typed into the Client App. Compared against the argon2id hashes in ServerSettings::support_codes; the plaintext never leaves the agent process (it is not logged, and audit events record only the outcome).

SupportUnlockResult

support.unlock response — every grant the caller holds after the redeem, not just the newly-added one, so the client can render the whole banner from one reply.

SupportUploadDiagnosticsParams

support.upload_diagnostics params — optional user-supplied context so the helpdesk has triage info at ticket-open time without a second round-trip.

SupportUploadDiagnosticsResult

support.upload_diagnostics response.

UnlockGrant

One live unlock grant — every client.unlock: <scope> job is listed for the caller until expires_at.