uplim.api.v1.InternalPipelineRunsService

postAbortBlobUpload

AbortBlobUpload cancels an in-progress S3 multipart upload and frees its buffered parts. The side-car calls this best-effort on any mid-stream error between StartBlobUpload and CompleteBlobUpload — a PresignUploadPart / part-PUT / CompleteBlobUpload failure would otherwise orphan the multipart, which is billed indefinitely (the managed `pipeline-runs/` scratch prefix has no AbortIncompleteMultipartUpload lifecycle rule, unlike `runs/` locals). object_key is scoped to this run/step exactly like PresignUploadPart / CompleteBlobUpload.

postAppendStepLogChunk

Per-line log forwarder: side-car calls in addition to its in- memory buffering so live UI subscribers see lines as they're produced. In-process pub-sub on the api side; lines aren't persisted here (FinaliseStepLogs handles durability at step end). Best-effort: if no subscribers are listening the call is a no-op.

postCompleteBlobUpload

postEnqueueRun

-------- Run lifecycle -------- Atomically creates a PipelineRun + one StepRun per snapshotted step (all PENDING). Caller dispatches each step after this returns.

postFinaliseBlobOutput

postFinaliseStepLogs

Uploads the per-step log object (JSONL bytes) to S3 at runs/<run_id>/<step_id>/logs.jsonl. Side-car calls once during CompleteStep with the full accumulated log content. Records logs_object_key + logs_truncated on the StepRun row.

postGetActivePipelineForResource

-------- Active pipeline lookup -------- Returns the published pipeline (with current snapshot id) for the given resource binding, or empty if none configured.

postGetIntegrationConfigForResource

Returns the flat string→string config map for the integration that owns the given content-type URN. Source v1: the URN's IntegrationContentType.thumbnail_parser_config JSON, flattened to top-level keys. Used by the dispatcher to resolve `${{ integration.config.<name> }}` references.

postReturns the requested integration secrets as CIPHERTEXT ONLY + the key id (kid) each was encrypted under. The pipeline coordinator decrypts locally using its private-key bundle — the api never holds the private key in this trust split.

Plan-locked: "upl-im-api holds only the public key (encrypt on write), upl-im-pipeline holds the private key (decrypt at run time when materializing the declared subset into the step pod). API can never read secret values back, only overwrite." Names are declared by the step manifest's required_secrets; the dispatcher batch-fetches only what's referenced by `${{ secrets.<name> }}`. Names with no row are omitted from the response.

postGetPipelineRunStatus is the coordinator's poll-for-cancel hook (audit-III). Returns just `status` (no nested steps/snapshot) so the dispatcher can cheaply check whether to abort the in-flight run between/during step dispatches. When status flips to CANCELLED outside the coordinator (admin UI hitting PipelineAdminService. CancelPipelineRun) the dispatcher sees it on its next poll and tears down the step's Job + skips remaining steps.

Cheap: single SELECT id, status, finished_at on PipelineRun. Coordinator polls ~ every 2s while a step's Job is in flight.

postGetRenderWorkerContext

GetRenderWorkerContext returns the worker-bridge context the puppeteer dispatcher feeds into the headless renderer for THIS step. The renderer SDK's WorkerRendererProvider reads `upload`/`config`/ `__auth_token`/`__api_base_url` via the bridge's getInput; without them upload/scope resolve null and the worker can't render. The api resolves the run's resource upload (with a browser-fetchable content_url) so the dispatcher can supply them. Self-authed with the per-step JWT.

postGetResourceMetadataKV

Returns every live KV entry on a resource — used by the dispatcher to resolve `${{ resource.metadata.<key> }}` references against the accumulated state (built-in pre-step writes like common:mime + anything earlier pipeline runs wrote).

postGetStepBundle

GetStepBundle returns a fresh presigned download URL for THIS step's published JS bundle (the registry tarball: dist/ + manifest). The side-car calls this on boot for js-kind steps, downloads + extracts the tarball to /work/bundle, then signals ready so user code finds its entrypoint. Self-authenticates with the per-step JWT (X-Upl-Step-Token): the claims must match run_id/step_id, so a pod can only fetch its own step's bundle. Returns FailedPrecondition if the step is not a registry-bundle (js) step.

postIncrementStepAttempt

Bumps StepRun.attempt for the named (run, step). Dispatcher calls this before each retry of a transient-failure step so the UI's run-detail row reflects "attempt 2 of N". audit-QQ.

postListStepBlobOutputs

Returns presigned GET URLs + mime + size for each blob a step recorded. Used by the dispatcher to resolve `${{ steps.<id>.outputs.blobs.<name> }}` references in later steps. Two flavours: - committed blobs (UploadMetadata): from pipeline-runs/<runId>/ <stepId>/<name> in the storage bucket - local blobs (run-scoped scratch): from runs/<runId>/locals/ <stepId>/<name> in the same bucket, 7d S3 lifecycle Returns both in one call so the dispatcher doesn't double-RPC.

postListStepKVOutputs

-------- Cross-step output reads (dispatcher-side) -------- Returns the KV outputs a specific step recorded — used by the dispatcher to resolve `${{ steps.<id>.outputs.kv.<key> }}` references in later steps. Reads StepRun.kv_output_keys_json to know which keys this step authored, then fetches the matching live UploadMetadataKV rows. Returns empty when the step hasn't completed.

postListStepLocalOutputs

Returns a step's run-scoped local outputs (the typed SetStepLocal values, not the localBlobs S3 objects). Used by the dispatcher to resolve `${{ steps.<id>.outputs.locals.<name> }}` references in later steps. Reads StepRun.local_outputs_json directly — no UploadMetadataKV hop.

postMarkRunCancelled

postMarkRunFailed

postMarkRunStarted

postMarkRunSucceeded

postMarkStepFailed

postMarkStepSkipped

postMarkStepStarted

-------- Step lifecycle --------

postMarkStepSucceeded

postMintBlobOutputUpload

-------- Step output mint + commit -------- Two-phase blob output: mint a presigned PUT URL, the side-car PUTs, then Finalise verifies + writes the UploadMetadata row.

postMintLocalBlobUpload

Run-scoped scratch (no commit to UploadMetadata*). Mint presigned PUT for local blobs; persist scalar/JSON locals onto StepRun.

postPresignUploadPart

postRecordStepLogs

postRecordStepOutputs

postRecordStepUtilisation

postReportStepSpans

ReportStepSpans ingests OpenTelemetry spans the runtime (side-car + user code) emitted for THIS step — the in-pod "meta upload" RPCs and direct S3 source-fetch / blob-PUT that never reach the api otherwise. Self-authenticates with the per-step JWT (X-Upl-Step-Token): the claims must match run_id/step_id, so a pod can only report spans for its own step. The coordinator drains these into the trace store as children of the pipeline.step.<id> span.

postLate-binds a `RendererRef.content_type_urn` to the renderer archive currently configured for the named content type. Called by the puppeteer dispatcher in upl-im-pipeline immediately before launching headless Chrome for a step run. Resolves via IntegrationContentType.renderer.archive_upload_id — same field the interactive portal renderer uses — so swapping the renderer takes effect on the next run without republishing the step or pipeline.

Returns NotFound when the URN doesn't match any content type, or FailedPrecondition when the matched content type has no enabled renderer with an archive_upload_id. The dispatcher classifies both as the step's `RendererUnboundError`.

postSetStepKVOutput

Single-phase KV output. Coord resolves output_name → registered IntegrationMetadataKey via the snapshot's kv_output_bindings, validates value_type, and writes UploadMetadataKV.

postSetStepLocal

postSetUploadCommonMetadataKV

Pre-step write path: bypasses the step / snapshot binding model so the pipeline coordinator can record built-in pre-step outputs (common:mime, common:classified_urn, common:virus_clean, …) before any user step runs. Keys must be in the well-known common:* set (handler rejects anything else). User-step writes still go through SetStepKVOutput with snapshot-bound value_type validation.

postStartBlobUpload

-------- Streamed (multipart) blob output (M0.5) -------- For PutBlobOutput / CommitBlobOutputFile on the side-car socket: the side-car streams bytes to S3 without any presigned URL or bucket credential crossing the socket to user code. The api holds the creds and initiates the S3 multipart upload; only the side-car sees the per-part presigned PUT URLs. StartBlobUpload → PresignUploadPart (per ~5MB part) → CompleteBlobUpload; the side-car then calls the existing FinaliseBlobOutput (same object key) for the metadata write.