Deploying

A deploy is PUT /services/{owner}/{name}, made by an owner of the account with a session or an API key that has the deploy scope. The account needs a plan or the trial.

berm.toml

berm.toml sits beside the program's Cargo.toml. It takes these keys and refuses any other.

Key	Value
name	The service's name: lowercase letters, digits, - and _.
image	The OCI repository the program is pushed to, without a tag.
public	The tools the service makes public.
[crons]	A schedule for each #[cron] tool. See Crons and wakes.

The image

• Cloud pulls the image from ghcr.io without credentials, so the package must be public.
• The tag is resolved to a digest once, at deploy.
• A service runs one version. Rolling back is deploying an older tag.
• Its name and data are kept across deploys.
• A service is private from its first deploy. See Access.

What a deploy refuses

A refused deploy leaves the running version serving.

Status	When
400	The name or a cron expression is invalid, or a migration fails.
402	The account has no plan or trial.
403	The caller is not an owner of the account.
409	It makes a tool public that public does not list.
409	It undoes a cron schedule an owner set since the last deploy. Forcing overrides this.
409	It breaks a tool or event a caller used in the last 30 days. The answer names each caller and its last use. Forcing overrides this.
422	The program uses a host function Cloud does not serve.

A deploy with force set goes past the two refusals that say so.

Removing a service

DELETE /services/{owner}/{name} removes the service with its calls, logs, crons, wakes and secrets. Usage already metered stays on the account.