keryx media push¶

Description¶

Upload a workspace's changed media to the object store and re-pin media.lock (spec 0039, R-STO-½).

The push is incremental by content hash: every media file (everything under vo/, cards/, cover/, portrait/, plus cover.png, music*, and reel-*.mp4) is sha256-hashed and compared against the workspace's media.lock manifest — only new or changed files upload. Each upload overwrites its stable bucket key, minting a new object version; the manifest records the version id and hash, so the git commit that carries media.lock pins this exact media state. Files deleted locally drop out of the manifest but their object versions are retained in the bucket (keryx never deletes; retention is bucket lifecycle policy — R-STO-6).

Pushing the project's fonts¶

A project's typefaces live in .keryx/fonts, outside any workspace, and travel through the same store (spec 0058 D4). Push them by omitting the workspace:

keryx media push          # the project's own kinds — today, its fonts
keryx media push -w slug  # one reel workspace, as before

Without this a colleague who cloned the repository rendered in the embedded fallback face, because font add wrote the file locally and nothing distributed it. A reel build hydrates fonts before it composes cards, so once pushed they arrive automatically.

Run it before committing workspace changes — or use the studio's Commit & push, which performs the same sync automatically so the refreshed manifest rides in the same commit as the board.

Usage¶

keryx media push -w <slug>

Flag
`-w, --workspace`	The reel workspace slug. Omit it to push the project's own kinds instead — today, its fonts.

Run keryx media push --help for the authoritative, always-current flag set.

Output¶

media push: my-post — 3 pushed (2.1 MiB), 12 unchanged

With --output json, the standard envelope carries {pushed, pushed_bytes, unchanged, removed}.

Errors¶

No object store configured — set the top-level storage: section in the project's .keryx.yaml (see keryx media); until then keryx is local-only.
Bucket problems (unreachable, missing, no credentials) surface with the provider's error; credentials resolve via the AWS default chain (env, SSO/shared config, IAM role in CI) — never from keryx config.