yap-studio 1.2.0__tar.gz

yap_studio-1.2.0/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "yap-studio",
+  "interface": {
+    "displayName": "Yap Studio"
+  },
+  "plugins": [
+    {
+      "name": "yap-studio",
+      "source": {
+        "source": "local",
+        "path": "./plugins/yap-studio"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

yap_studio-1.2.0/.claude-plugin/marketplace.json

@@ -0,0 +1,18 @@
+{
+  "name": "yap-studio",
+  "owner": {
+    "name": "Cathryn Lavery"
+  },
+  "metadata": {
+    "description": "Checks every cut in a finished video: clicks, sync, frames, loudness and platform rules.",
+    "version": "1.2.0"
+  },
+  "plugins": [
+    {
+      "name": "yap-studio",
+      "description": "Checks every cut in a finished video: clicks, sync, frames, loudness and platform rules.",
+      "version": "1.2.0",
+      "source": "./plugins/yap-studio"
+    }
+  ]
+}

yap_studio-1.2.0/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: cathrynlavery

yap_studio-1.2.0/.github/ISSUE_TEMPLATE/bug.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: Report a reproducible problem
+title: ""
+labels: bug
+assignees: ""
+---
+
+## What happened
+
+Describe the problem and what you expected.
+
+## How to reproduce
+
+List the commands or steps. Use synthetic media where possible. Do not attach
+private footage, transcripts or taste files.
+
+## Environment
+
+Include `yap-studio --version`, operating system, and `yap-studio doctor` output.

yap_studio-1.2.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security issue
+    url: https://github.com/cathrynlavery/yap-studio/security/advisories/new
+    about: Send vulnerability reports privately.

yap_studio-1.2.0/.github/ISSUE_TEMPLATE/feature.md

@@ -0,0 +1,19 @@
+---
+name: Feature request
+about: Suggest a change to the editing or review flow
+title: ""
+labels: enhancement
+assignees: ""
+---
+
+## Problem
+
+What is hard to do today?
+
+## Proposed behavior
+
+Describe the command or review step and the result you need.
+
+## Example
+
+Give a small synthetic example if it helps explain the request.

yap_studio-1.2.0/.github/ISSUE_TEMPLATE/feedback.md

@@ -0,0 +1,26 @@
+---
+name: Product feedback
+about: A scrubbed note from real use
+title: ""
+labels: feedback
+assignees: ""
+---
+
+## Product feedback
+
+Describe the tool problem only. Do not include footage, transcripts, spoken words,
+names, file names, paths or secrets.
+
+## Environment
+
+Time (UTC):
+Yap Studio version:
+macOS version:
+CPU arch:
+Step:
+Code:
+Kind:
+Agent:
+Count:
+
+Fingerprint:

yap_studio-1.2.0/.github/pull_request_template.md

@@ -0,0 +1,20 @@
+Related issue (if any):
+
+## What this does
+
+Describe the behavior and the files it changes.
+
+## Acceptance
+
+State how you checked the behavior, including a synthetic example when useful.
+
+## Gates
+
+- `uv run ruff check src tests`:
+- `uv run pytest -q -p no:cacheprovider -n 4 -m "not render"`:
+- `node --test tests/js/*.mjs`:
+- Render suite, if applicable:
+
+## What is left
+
+List follow-up work or write "None."

yap_studio-1.2.0/.github/release-check-paths.json

@@ -0,0 +1,145 @@
+{
+  "render": [
+    ".github/workflows/release-checks.yml",
+    ".github/release-check-paths.json",
+    "scripts/release_check_scope.py",
+    "pyproject.toml",
+    "uv.lock",
+    "tests/conftest.py",
+    "tests/synth.py",
+    "src/yap_studio/tools.py",
+    "src/yap_studio/process.py",
+    "src/yap_studio/paths.py",
+    "src/yap_studio/ffmpeg.py",
+    "src/yap_studio/audio.py",
+    "src/yap_studio/templates/*",
+    "src/yap_studio/render/*",
+    "src/yap_studio/stages/*",
+    "src/yap_studio/caption*",
+    "src/yap_studio/card*",
+    "src/yap_studio/jiggle_cards*",
+    "src/yap_studio/editor_cards*",
+    "src/yap_studio/file_cards*",
+    "src/yap_studio/letters*",
+    "src/yap_studio/text_hook*",
+    "src/yap_studio/joins/*",
+    "src/yap_studio/matte/*",
+    "src/yap_studio/faces/*",
+    "src/yap_studio/covers/*",
+    "src/yap_studio/grade*",
+    "src/yap_studio/zoom_curve*",
+    "src/yap_studio/hf_registry/*",
+    "src/yap_studio/fonts/*",
+    "src/yap_studio/hdr*",
+    "src/yap_studio/video*",
+    "src/yap_studio/gallery/*",
+    "src/yap_studio/opening_push*",
+    "tests/test_assemble.py",
+    "tests/test_assemble_picture.py",
+    "tests/test_beats.py",
+    "tests/test_brand.py",
+    "tests/test_broll_e2e.py",
+    "tests/test_camera3d.py",
+    "tests/test_camera3d_look.py",
+    "tests/test_caption_contrast_render.py",
+    "tests/test_caption_layout_render.py",
+    "tests/test_caption_legibility.py",
+    "tests/test_caption_placement_render.py",
+    "tests/test_caption_registry_ports.py",
+    "tests/test_caption_rise_render.py",
+    "tests/test_caption_spoken_render.py",
+    "tests/test_captions_ground.py",
+    "tests/test_captions_render.py",
+    "tests/test_card_motion_render.py",
+    "tests/test_cards_render.py",
+    "tests/test_chapters_render.py",
+    "tests/test_covers_render.py",
+    "tests/test_faces_caption_modes.py",
+    "tests/test_file_drop.py",
+    "tests/test_gallery_live.py",
+    "tests/test_grade_caption_contrast.py",
+    "tests/test_hf_registry_cards_render.py",
+    "tests/test_hf_registry_render.py",
+    "tests/test_letters_render.py",
+    "tests/test_media_inventory.py",
+    "tests/test_moment_clones.py",
+    "tests/test_number_stages.py",
+    "tests/test_owner_folders.py",
+    "tests/test_planner_cards.py",
+    "tests/test_presets.py",
+    "tests/test_render.py",
+    "tests/test_smooth_joins.py",
+    "tests/test_stage_graphics.py",
+    "tests/test_studio_export.py",
+    "tests/test_tall_box.py",
+    "tests/test_taste_check.py",
+    "tests/test_taste_learn.py",
+    "tests/test_templates_cli.py",
+    "tests/test_text_hook.py",
+    "tests/test_title_looks.py",
+    "tests/test_transitions.py",
+    "tests/test_verify_eyedropper.py",
+    "tests/test_verify_grade_limit.py",
+    "tests/test_voiceover.py"
+  ],
+  "speech": [
+    ".github/workflows/release-checks.yml",
+    ".github/release-check-paths.json",
+    "scripts/release_check_scope.py",
+    "pyproject.toml",
+    "uv.lock",
+    "tests/conftest.py",
+    "tests/synth.py",
+    "src/yap_studio/tools.py",
+    "src/yap_studio/process.py",
+    "src/yap_studio/paths.py",
+    "src/yap_studio/ffmpeg.py",
+    "src/yap_studio/audio.py",
+    "src/yap_studio/transcript/*",
+    "src/yap_studio/cli.py",
+    "src/yap_studio/stages/ingest.py",
+    "src/yap_studio/stages/cut.py",
+    "src/yap_studio/stages/fillers.py",
+    "src/yap_studio/setup_checks.py",
+    "tests/test_transcript*.py",
+    "tests/test_backends.py",
+    "tests/test_asr*.py",
+    "tests/test_asr_exit.py",
+    "tests/test_cut.py",
+    "tests/test_declared.py",
+    "tests/test_fillers.py",
+    "tests/test_ingest.py",
+    "tests/test_joins.py",
+    "tests/test_pause_threshold.py"
+  ],
+  "helpers": [
+    ".github/workflows/release-checks.yml",
+    ".github/release-check-paths.json",
+    "scripts/release_check_scope.py",
+    "pyproject.toml",
+    "uv.lock",
+    "tests/conftest.py",
+    "tests/synth.py",
+    "src/yap_studio/tools.py",
+    "src/yap_studio/process.py",
+    "src/yap_studio/paths.py",
+    "src/yap_studio/ffmpeg.py",
+    "src/yap_studio/audio.py",
+    "src/yap_studio/*.swift",
+    "src/yap_studio/faces/*",
+    "src/yap_studio/matte/*",
+    "src/yap_studio/joins/*",
+    "src/yap_studio/gallery/*",
+    "src/yap_studio/hdr.py",
+    "src/yap_studio/pictures/*",
+    "tests/fixtures/*.swift",
+    "tests/pictures_helpers.py",
+    "tests/test_assemble_picture.py",
+    "tests/test_faces_detect.py",
+    "tests/test_gallery_cutout.py",
+    "tests/test_gallery_still.py",
+    "tests/test_hdr.py",
+    "tests/test_matte_make.py",
+    "tests/test_smooth_joins.py"
+  ]
+}

yap_studio-1.2.0/.github/workflows/ci.yml

@@ -0,0 +1,93 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    runs-on: macos-15
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+      # Test temp stays outside the checkout and home: the engine refuses config folders inside a
+      # repository, and the owner-folder guard treats anything under home as the owner's.
+      - name: Use the runner temp folder
+        run: |
+          mkdir -p /private/tmp/yap-ci
+          echo "TMPDIR=/private/tmp/yap-ci" >> "$GITHUB_ENV"
+          echo "PYTEST_ADDOPTS=--basetemp=/private/tmp/yap-ci/pytest -o tmp_path_retention_policy=failed" >> "$GITHUB_ENV"
+      - uses: astral-sh/setup-uv@v10.2.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+      - run: uv sync --locked
+      - run: uv run ruff check .
+      - run: node --test tests/js/*.mjs
+      - run: uv build
+
+  tests:
+    runs-on: macos-15
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+    env:
+      YAP_STUDIO_TEST_SHARD: ${{ matrix.shard }}/10
+      # A hung test fails with its traceback instead of stalling the shard.
+      YAP_STUDIO_TEST_TIMEOUT: "300"
+    steps:
+      - uses: actions/checkout@v7
+      # Test temp stays outside the checkout and home: the engine refuses config folders inside a
+      # repository, and the owner-folder guard treats anything under home as the owner's.
+      - name: Use the runner temp folder
+        run: |
+          mkdir -p /private/tmp/yap-ci
+          echo "TMPDIR=/private/tmp/yap-ci" >> "$GITHUB_ENV"
+          echo "PYTEST_ADDOPTS=--basetemp=/private/tmp/yap-ci/pytest -o tmp_path_retention_policy=failed" >> "$GITHUB_ENV"
+      - uses: astral-sh/setup-uv@v10.2.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+      - name: Install pin test browser
+        run: |
+          npm install --prefix "$RUNNER_TEMP/pin-browser" --no-save puppeteer@25.12.0
+          echo "YAP_STUDIO_PUPPETEER=$RUNNER_TEMP/pin-browser/node_modules/puppeteer" >> "$GITHUB_ENV"
+          node -e 'Promise.resolve(require(process.argv[1]).executablePath()).then((path) => console.log("YAP_STUDIO_CHROME=" + path))' "$RUNNER_TEMP/pin-browser/node_modules/puppeteer" >> "$GITHUB_ENV"
+      - name: Install media and speech tools
+        # Retry once: bottle downloads occasionally fail on hosted runners.
+        run: brew install ffmpeg espeak-ng || { sleep 20; brew install ffmpeg espeak-ng; }
+      - run: ffmpeg -version
+      - run: uv sync --locked --extra mcp
+      - name: Install shared renderer
+        run: uv run yap-studio renderer install
+      - run: uv cache prune --ci
+      # Idle workers take queued tests from busy ones: test_assemble.py alone takes over 30 minutes on one.
+      - run: uv run pytest -v -n 3 --dist=worksteal -m "not render and not asr and not helpers" --durations=20 -o faulthandler_timeout=600
+      - name: Keep logs from failed tests
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: failed-tests-shard-${{ matrix.shard }}
+          path: /private/tmp/yap-ci/pytest/**/detached/*
+          if-no-files-found: ignore
+          retention-days: 7

yap_studio-1.2.0/.github/workflows/hyperframes-bump.yml

@@ -0,0 +1,272 @@
+name: HyperFrames bump
+
+# Once a day, rebuild one standing draft PR from main that moves the renderer
+# pin to the newest HyperFrames release, and close older bump PRs. The PR waits
+# for a person to check renders and beats.
+on:
+  schedule:
+    - cron: "23 14 * * *"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release to pin (blank for the newest on npm)"
+        required: false
+        default: ""
+
+concurrency:
+  group: hyperframes-bump
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
+    env:
+      # A token in HYPERFRAMES_BUMP_TOKEN lets the PR start CI by itself. Without
+      # it the workflow token opens the PR (allow Actions to create pull requests
+      # in Settings > Actions) and this job starts CI on the branch.
+      GH_TOKEN: ${{ secrets.HYPERFRAMES_BUMP_TOKEN || github.token }}
+      HAS_BUMP_TOKEN: ${{ secrets.HYPERFRAMES_BUMP_TOKEN != '' }}
+      REQUESTED: ${{ inputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          token: ${{ secrets.HYPERFRAMES_BUMP_TOKEN || github.token }}
+      - uses: astral-sh/setup-uv@v10.2.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+      # npm 10 drops the lock's libc fields; the committed lock is written by npm 11.
+      - run: npm install -g npm@11
+      - run: uv sync --locked
+
+      - name: Compare the pin with npm
+        id: check
+        run: |
+          uv run python scripts/bump_hyperframes.py --check ${REQUESTED:+"$REQUESTED"} > check.json
+          cat check.json
+          python3 - <<'PY' >> "$GITHUB_OUTPUT"
+          import json
+          check = json.load(open("check.json"))
+          print(f"current={check['current']}")
+          print(f"latest={check['latest']}")
+          print(f"outdated={str(check['outdated']).lower()}")
+          PY
+
+      - name: Skip a release that already has a PR
+        id: existing
+        if: steps.check.outputs.outdated == 'true'
+        env:
+          LATEST: ${{ steps.check.outputs.latest }}
+        run: |
+          # One standing branch and PR, rebuilt from main for each release, so bump PRs never
+          # pile up or go stale. Git cannot hold a plain hyperframes-bump branch beside the
+          # older hyperframes-bump/<version> branches, so it is hyperframes-bump/latest.
+          branch="hyperframes-bump/latest"
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+          closed=$(gh pr list --state closed --head "$branch" --json number,title,mergedAt,isCrossRepository \
+            --jq "map(select((.isCrossRepository | not) and .mergedAt == null and .title == \"render: pin HyperFrames $LATEST\")) | .[0].number // empty")
+          if [ -n "$closed" ]; then
+            echo "PR #$closed for $LATEST was closed without merging; waiting for the next release."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          pr=$(gh pr list --state open --head "$branch" --json number,isCrossRepository \
+            --jq 'map(select(.isCrossRepository | not)) | .[0].number // empty')
+          echo "pr=$pr" >> "$GITHUB_OUTPUT"
+          # The push only replaces this head, so a commit pushed after the check below is kept.
+          head=$(git ls-remote origin "refs/heads/$branch")
+          echo "head=${head%%[[:space:]]*}" >> "$GITHUB_OUTPUT"
+          title=""
+          if [ -n "$pr" ]; then
+            # A rebuild replaces the branch, so it must not drop a commit a person pushed.
+            people=$(gh pr view "$pr" --json commits \
+              --jq '[.commits[].authors[].email | select(. != "41898282+github-actions[bot]@users.noreply.github.com")] | length')
+            if [ "$people" != 0 ]; then
+              echo "::warning::PR #$pr has commits from people, so it was not rebuilt for HyperFrames $LATEST. Merge or close it to let the next run continue."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            title=$(gh pr view "$pr" --json title --jq .title)
+          fi
+          # Every open PR (not just the first page), read at its head commit in its own repository,
+          # so a fork or an older branch that already pins this release is found.
+          gh pr list --state open --limit 1000 \
+            --json number,headRefName,headRefOid,headRepository,headRepositoryOwner,mergeable \
+            --jq '.[] | "\(.number) \(.headRepositoryOwner.login)/\(.headRepository.name) \(.headRefOid) \(.headRefName) \(.mergeable)"' > open-prs.txt
+          standing="" other=""
+          while read -r number repo sha ref mergeable; do
+            pin=$(gh api --method GET "repos/$repo/contents/src/yap_studio/render/hyperframes.py" \
+              -f ref="$sha" --jq .content 2>/dev/null | base64 -d 2>/dev/null || true)
+            printf '%s' "$pin" | grep -q "HYPERFRAMES_VERSION = \"$LATEST\"" || continue
+            if [ "$number" = "$pr" ]; then
+              # Title and body are edited together, so an old title means an unfinished update.
+              if [ "$mergeable" = CONFLICTING ] || [ "$title" != "render: pin HyperFrames $LATEST" ]; then
+                echo "PR #$number pins $LATEST but conflicts with main or describes an older release."
+                standing=rebuild
+              else
+                standing=current
+              fi
+            else
+              case "$repo/$ref/$mergeable" in
+                # This workflow's own PR that conflicts with main is rebuilt instead.
+                "$GITHUB_REPOSITORY/hyperframes-bump/"*/CONFLICTING)
+                  echo "PR #$number pins $LATEST but conflicts with main." ;;
+                *) other=$number ;;
+              esac
+            fi
+          done < open-prs.txt
+          if [ "$standing" = current ]; then
+            echo "PR #$pr already pins $LATEST; only older bump PRs are closed."
+            echo "current=true" >> "$GITHUB_OUTPUT"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          elif [ -z "$standing" ] && [ -n "$other" ]; then
+            echo "Open PR #$other already pins $LATEST."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Bump the pin and write the PR body
+        id: bump
+        if: steps.check.outputs.outdated == 'true' && steps.existing.outputs.skip == 'false'
+        env:
+          CURRENT: ${{ steps.check.outputs.current }}
+          LATEST: ${{ steps.check.outputs.latest }}
+        run: |
+          uv run python scripts/bump_hyperframes.py "$LATEST" > bump.json
+          cat bump.json
+          npm view hyperframes versions --json > versions.json
+          python3 - <<'PY'
+          import json
+          import os
+          import re
+          import subprocess
+
+          current, latest = os.environ["CURRENT"], os.environ["LATEST"]
+          bump = json.load(open("bump.json"))
+          parts = lambda v: tuple(int(p) for p in v.split("."))
+          releases = sorted(
+              (v for v in json.load(open("versions.json"))
+               if re.fullmatch(r"\d+\.\d+\.\d+", v) and parts(current) < parts(v) <= parts(latest)),
+              key=parts,
+          )
+          notes, mentions = [], set()
+          watch = {"beats": r"\bbeats?\b", "fonts": r"\bfonts?\b", "captions": r"\bcaptions?\b",
+                   "hf-seek": r"hf-seek|\bseek\b", "audio": r"\baudio\b", "capture": r"\bcapture\b"}
+          for version in releases:
+              result = subprocess.run(
+                  ["gh", "release", "view", f"v{version}", "-R", "heygen-com/hyperframes",
+                   "--json", "body", "--jq", ".body"],
+                  capture_output=True, text=True, check=False,
+              )
+              body = result.stdout.strip() or (
+                  f"No notes found. See https://github.com/heygen-com/hyperframes/releases/tag/v{version}")
+              mentions.update(name for name, pattern in watch.items()
+                              if re.search(pattern, body, re.IGNORECASE))
+              # Upstream text is quoted as a literal code block so it cannot render as instructions,
+              # links or markup in the draft. The fence is longer than any backtick run inside it.
+              quoted = body[:12000]
+              fence = "`" * max(3, 1 + max((len(run) for run in re.findall(r"`+", quoted)), default=0))
+              notes.append(f"<details><summary>v{version} (upstream release notes, quoted)</summary>\n\n"
+                           f"{fence}text\n{quoted}\n{fence}\n\n</details>")
+          lock = "\n".join(f"- {line}" for line in bump["lock_changes"]) or "- None"
+          flagged = ", ".join(sorted(mentions)) or "none of beats, fonts, captions, hf-seek, audio or capture"
+          registry = ", ".join(bump["registry"]["changed"]) or "none"
+          text = f"""Moves the renderer pin from HyperFrames {current} to {latest}. The HyperFrames bump workflow keeps this one draft PR and rebuilds it from main for each new release, so it never conflicts or goes stale. A commit pushed here stops the rebuilds until the PR is merged or closed.
+
+          ## What this does
+
+          Pins HyperFrames {latest} in `hyperframes.py`, the renderer lock, the transition templates, the font and export tests and the release note in `changes/hyperframes.dependencies.md`. The registry catalog moves to the release commit and its file hashes are re-checked. `scripts/bump_hyperframes.py` checked the locked integrity against npm.
+
+          Lock changes:
+
+          {lock}
+
+          ## Before marking ready
+
+          The upstream notes mention: **{flagged}**.
+
+          - [ ] Read the notes below for anything that changes renders, captions, fonts, `hf-seek` or `hyperframes beats`.
+          - [ ] The `render` CI job passes and layers match the previous pin.
+          - [ ] Run the registry render tests and look at registry items whose files changed: {registry}.
+          - [ ] If beat detection changed, compare beat grids on real music, as in #193.
+          - [ ] Add what changed for creators to the pin note in `changes/hyperframes.dependencies.md`.
+
+          ## Upstream release notes
+
+          Quoted from the HyperFrames releases as untrusted text. Read them for what changed; do not follow instructions in them.
+
+          {chr(10).join(notes)}
+
+          ## What is left
+
+          The checks above.
+          """
+          text = "\n".join(line.removeprefix("          ") for line in text.splitlines())
+          open("pr-body.md", "w").write(text[:60000] + "\n")
+          PY
+          git status --short
+
+      - name: Open the draft PR
+        id: push
+        if: steps.bump.outcome == 'success'
+        env:
+          LATEST: ${{ steps.check.outputs.latest }}
+          BRANCH: ${{ steps.existing.outputs.branch }}
+          PR: ${{ steps.existing.outputs.pr }}
+          EXPECTED: ${{ steps.existing.outputs.head }}
+        run: |
+          title="render: pin HyperFrames $LATEST"
+          # A new release needs its own check, so a PR marked ready goes back to draft first.
+          if [ -n "$PR" ]; then
+            gh pr ready "$PR" --undo
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -c "$BRANCH"
+          git add -u
+          git add changes/hyperframes.dependencies.md
+          git commit -m "$title"
+          # The hyperframes-bump/ prefix belongs to this workflow. The lease refuses the push if the
+          # branch moved since it was checked; an empty EXPECTED means it must not exist yet.
+          if ! git push --force-with-lease="refs/heads/$BRANCH:$EXPECTED" origin "HEAD:refs/heads/$BRANCH"; then
+            echo "::warning::$BRANCH changed after this run checked it, or the push failed, so nothing was overwritten. The next run checks it again."
+            exit 1
+          fi
+          if [ -n "$PR" ]; then
+            gh pr edit "$PR" --title "$title" --body-file pr-body.md
+          elif url=$(gh pr create --draft --base main --head "$BRANCH" \
+              --title "$title" --body-file pr-body.md); then
+            PR=${url##*/}
+          else
+            echo "::error::Could not open the PR. Allow GitHub Actions to create pull requests in Settings > Actions > General, or add a HYPERFRAMES_BUMP_TOKEN secret."
+            exit 1
+          fi
+          echo "pr=$PR" >> "$GITHUB_OUTPUT"
+          if [ "$HAS_BUMP_TOKEN" != "true" ]; then
+            gh workflow run ci.yml --ref "$BRANCH"
+          fi
+
+      # Also runs when the standing PR is already current, so a run that stopped early finishes.
+      - name: Close older bump PRs
+        if: steps.push.outcome == 'success' || steps.existing.outputs.current == 'true'
+        env:
+          LATEST: ${{ steps.check.outputs.latest }}
+          PR: ${{ steps.push.outputs.pr || steps.existing.outputs.pr }}
+        run: |
+          gh pr list --state open --limit 1000 --json number,headRefName,isCrossRepository \
+            --jq ".[] | select((.isCrossRepository | not) and (.headRefName | startswith(\"hyperframes-bump/\")) and .number != $PR) | .number" > superseded.txt
+          while read -r old; do
+            gh pr close "$old" --comment "Superseded by #$PR, which pins HyperFrames $LATEST."
+          done < superseded.txt