add ProxyJump function

internal/keymgr/pack.go

@@ -22,8 +22,10 @@ type BuildResult struct {
 // directory, packs everything into a single AES-256-encrypted 7z archive
 // under outDir, and then wipes the scratch directory (including the
 // plaintext private key) from disk. password is shared across one export
-// batch and must be communicated to the recipient out-of-band.
-func BuildUserArchive(scratchDir, outDir, jumpHost string, jumpPort int, username, password string, forwards []model.Forward) (*BuildResult, error) {
+// batch and must be communicated to the recipient out-of-band. proxyJump
+// selects the client config/instructions style (see model.User.ProxyJump);
+// when true, local ports are never allocated at all — they're not needed.
+func BuildUserArchive(scratchDir, outDir, jumpHost string, jumpPort int, username, password string, forwards []model.Forward, proxyJump bool) (*BuildResult, error) {
 	userScratch := filepath.Join(scratchDir, username)
 	if err := os.MkdirAll(userScratch, 0o700); err != nil {
 		return nil, fmt.Errorf("create scratch dir: %w", err)
@@ -36,14 +38,20 @@ func BuildUserArchive(scratchDir, outDir, jumpHost string, jumpPort int, usernam
 	}
 	keyFileName := filepath.Base(kp.PrivateKeyPath)
 
-	allocated := AllocateLocalPorts(forwards)
+	var cfg, instr string
+	if proxyJump {
+		cfg = RenderClientConfigProxyJump(jumpHost, jumpPort, username, keyFileName, forwards)
+		instr = RenderInstructionsProxyJump(username, keyFileName, forwards)
+	} else {
+		allocated := AllocateLocalPorts(forwards)
+		cfg = RenderClientConfig(jumpHost, jumpPort, username, keyFileName, allocated)
+		instr = RenderInstructions(username, keyFileName, allocated)
+	}
 
-	cfg := RenderClientConfig(jumpHost, jumpPort, username, keyFileName, allocated)
 	if err := os.WriteFile(filepath.Join(userScratch, "config"), []byte(cfg), 0o600); err != nil {
 		return nil, fmt.Errorf("write config: %w", err)
 	}
 
-	instr := RenderInstructions(username, keyFileName, allocated)
 	if err := os.WriteFile(filepath.Join(userScratch, "INSTRUCTIONS.txt"), []byte(instr), 0o600); err != nil {
 		return nil, fmt.Errorf("write instructions: %w", err)
 	}