# `Opsmaru.Incus.Images`
[🔗](https://github.com/upmaru/opsmaru-incus/blob/v0.1.0/lib/opsmaru/incus/images.ex#L1)

Native image transfers; host-owned sources/sinks and no mutation replay.

# `alias_architectures`

# `alias_type`

# `copy`

Copy using one explicit approved connection per side; no address fallback or replay.

Returns the accepted native handles as an `ImageCopy` without waiting or cleanup;
`wait_copy/2` completes it. Pull and push need `:approved_origin`, the HTTPS origin
of the side the other backend connects to. A failure keeps every accepted handle in
`response.accepted` and cancels none.

The source may be a resolved `OCI` value, as the pinned `CopyImage` takes a
`ProtocolOCI` source. A pull hands the target protocol `oci` and the registry
certificate; `:registry_credentials` (`{username, password}`, password `nil` for
a username-only URL) adds Go's escaped user information to the server URL for a
private registry. A relay converts through the host adapter. A push fails like
Go: the target's push token is requested and, after the native error, cancelled.

A `SimpleStreams` source works the same way, as the pinned `CopyImage` takes a
`ProtocolSimpleStreams` source: a pull hands the target protocol `simplestreams`
and the explicit certificate, a relay downloads through `SimpleStreams.image_file/4`
into the relay sinks, and a push fails natively after its token is cancelled.

# `download`

Download a public or token-authorized private image to host-owned binary sinks.

# `image_secret`

# `import`

# `wait_copy`

Wait for the operation that drives a copy, then perform the pinned cleanup.

The target drives pull and relay copies and the source export drives a push. Once
a push export reaches a final state, the target's token is cancelled, as natively.
Once a pull (against a server without `image_create_aliases`) or relay succeeds,
the requested aliases are created, as natively. A local deadline or read failure
performs no cleanup, so the copy may still run. Errors keep every handle in
`response.accepted`; nothing is replayed. Each alias is sent at most once: the
returned copy keeps only aliases never sent, and an alias failure names its alias
in `response.alias`, so waiting again never resends one.

---

*Consult [api-reference.md](api-reference.md) for complete listing*