Copy using one explicit approved connection per side; no address fallback or replay.

Returns the accepted native handles as an ImageCopy without waiting or cleanup; wait_copy/2 completes it. Pull and push need :approved_origin, the HTTPS origin of the side the other backend connects to. A failure keeps every accepted handle in response.accepted and cancels none.

The source may be a resolved OCI value, as the pinned CopyImage takes a ProtocolOCI source. A pull hands the target protocol oci and the registry certificate; :registry_credentials ({username, password}, password nil for a username-only URL) adds Go's escaped user information to the server URL for a private registry. A relay converts through the host adapter. A push fails like Go: the target's push token is requested and, after the native error, cancelled.

A SimpleStreams source works the same way, as the pinned CopyImage takes a ProtocolSimpleStreams source: a pull hands the target protocol simplestreams and the explicit certificate, a relay downloads through SimpleStreams.image_file/4 into the relay sinks, and a push fails natively after its token is cancelled.

Download a public or token-authorized private image to host-owned binary sinks.

Wait for the operation that drives a copy, then perform the pinned cleanup.

The target drives pull and relay copies and the source export drives a push. Once a push export reaches a final state, the target's token is cancelled, as natively. Once a pull (against a server without image_create_aliases) or relay succeeds, the requested aliases are created, as natively. A local deadline or read failure performs no cleanup, so the copy may still run. Errors keep every handle in response.accepted; nothing is replayed. Each alias is sent at most once: the returned copy keeps only aliases never sent, and an alias failure names its alias in response.alias, so waiting again never resends one.