Enterprise edition

Output Pipeline

At a glance

NextPDF Enterprise coordinates large-scale batch execution of NextPDF Pro output-pipeline manifests with a configurable concurrency limit and an optional compliance handoff on completed outputs. It is the batch layer on top of the Pro output pipeline.

Availability & licensing

This capability ships in NextPDF Enterprise (nextpdf/enterprise) and activates with an Enterprise-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compare editions and get a license.

The Enterprise batch surface builds on the Pro output pipeline (pro.output.pipeline), which is a prerequisite rather than the gate. There is no separate per-feature capability code; the batch orchestrator and compliance handoff are available wherever the licensed nextpdf/enterprise package is installed.

Install

composer require nextpdf/enterprise:^3

Conceptual overview

BatchPipelineOrchestrator executes many PipelineManifest instances as one batch. Each manifest is run through the Pro PipelineExecutor; the orchestrator adds batch coordination, a bounded-resource guard (the number of manifests per batch is capped), per-batch timeout handling, and an optional compliance handoff.

BatchPipelineConfig controls three things: the maximum concurrent worker callbacks, an optional global batch timeout in milliseconds, and whether a compliance check runs on every output after the pipeline completes. When the compliance check is enabled, ComplianceHandoff integrates as a pipeline step that re-validates each derived PDF through the Enterprise compliance gateway, so a document modified by the pipeline is re-checked rather than trusted from its pre-modification state.

In production deployments, parallel worker dispatch and backpressure are handled by a separate execution sidecar; the PHP orchestrator described here provides the batch coordination and the compliance-handoff logic, and is invoked by the job worker rather than directly by request handlers.

Why it works this way

High-volume batch generation splits into two concerns: coordinating which manifests run under what guarantees, and driving raw parallel throughput. NextPDF keeps coordination and compliance semantics in this deterministic PHP orchestrator, and delegates parallel worker dispatch and backpressure to a separate execution sidecar. That boundary lets the throughput layer scale concurrency independently while the orchestrator stays simple, bounded, and auditable. A hard cap on manifests per batch keeps peak memory predictable, so one large submission cannot degrade the worker pool. The compliance handoff re-validates each derived output instead of trusting its pre-modification state, and fails closed. A completed manifest passes only when the gateway confirms conformance, never by default.

Design background: High-volume document generation.

API surface

Class	Responsibility
`BatchPipelineOrchestrator`	Execute many manifests as a batch with bounded concurrency.
`BatchPipelineConfig`	Max concurrency, batch timeout, compliance-on-complete toggle.
`BatchPipelineResult`	Aggregate: per-manifest results, completed and failed counts, timing.
`ComplianceHandoff`	Optional end-of-pipeline compliance re-validation step.

Code sample — Quick start

use NextPDF\Enterprise\OutputPipeline\BatchPipelineOrchestrator;

$result = (new BatchPipelineOrchestrator($executor))->executeBatch($manifests);

Code sample — Production

use NextPDF\Enterprise\OutputPipeline\BatchPipelineOrchestrator;
use NextPDF\Enterprise\OutputPipeline\BatchPipelineConfig;

$config = new BatchPipelineConfig(
    maxConcurrency: 4,
    timeoutMs: 600_000,
    complianceCheckOnComplete: true,
);

$result = (new BatchPipelineOrchestrator($executor, $config))
    ->executeBatch($manifests, $variablesMap);

$logger->info('pipeline.batch', [
    'completed' => $result->completedCount,
    'failed'    => $result->failedCount,
]);

Edge cases & gotchas

The batch enforces an upper bound on the number of manifests; exceeding it raises a resource-guard error rather than degrading silently.
A global timeout of zero means no batch timeout; set a finite value in production so a stuck manifest cannot block the batch indefinitely.
The compliance handoff requires a recognizable PDF in the upstream step output; if none is found the step reports a failure for that manifest rather than passing silently.
This module depends on the Pro output pipeline; it adds batch coordination, not a new step model.

Performance

Throughput scales with the configured concurrency and the per-manifest cost. Concurrency should be set conservatively relative to the worker pool so callbacks do not saturate it. The per-batch manifest cap bounds peak memory.

Security notes

The batch orchestrator processes whatever manifests and variables the caller supplies; treat pipeline inputs as you would any other untrusted PDF workload. The compliance handoff is a re-validation aid, not an authorization control.

Data residency & PII mitigations

Batch outputs may contain personal data. Processing is in-process and local; no outbound network calls are made by this orchestrator. Apply your own retention controls to batch outputs.

Safe telemetry & log scrubbing

Batch results report counts and timing, not document content. Scrub manifest identifiers from logs if they encode tenant or case data.

Conformance

No standards conformance is claimed for this module; it is an orchestration layer. The optional compliance handoff defers to the Enterprise compliance gateway, which carries its own references.

FIPS-mode behavior

This module performs no cryptographic operations.

Threat model

The primary inputs are caller-supplied manifests and variables. Mitigations: a hard cap on manifests per batch, bounded concurrency, optional re-validation of derived outputs, and no network I/O in the orchestrator itself.

Behavior contract

executeBatch() runs each manifest through the Pro pipeline executor and returns per-manifest results with completed and failed counts and timing.
A hard cap bounds the number of manifests per batch; exceeding it raises a resource-guard error rather than degrading silently.
A zero global timeout means no batch timeout; a finite value bounds a stuck manifest.
When enabled, the compliance handoff re-validates each derived PDF and reports a step failure when no recognizable PDF is found upstream rather than passing silently.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.

Core fallback

NextPDF Core has no output-pipeline model. A Core-only deployment composes its own steps directly against the Core API; there is no manifest, no batch coordination, and no compliance handoff.

Pro fallback

In a Pro-only deployment, the supported surface is the single-manifest Pro output pipeline (pro.output.pipeline): the Pro PipelineExecutor runs one manifest at a time. Pro does not provide the batch orchestrator, the bounded-concurrency batch guard, the per-batch timeout, or the Enterprise compliance handoff; a configuration that requests batch orchestration or the compliance handoff in a Pro-only deployment has no Enterprise component to satisfy it. See Pro overview for the Pro pipeline surface.

Enterprise boundary note

The batch coordination, the resource-guard bounds, and the compliance-handoff wiring are described at the behavior level only. The internal sidecar dispatch protocol, the internal backpressure semantics, and the internal compliance-gateway wiring are out of scope for the public surface and are not reproduced here.

Deployment boundary

In production, parallel worker dispatch and backpressure are handled by a separate execution sidecar; the PHP orchestrator described here provides batch coordination and compliance-handoff logic and is invoked by the job worker, not directly by request handlers. Worker-pool sizing, sidecar provisioning, and concurrency limits relative to the PHP worker pool are the operator’s responsibility. The compliance handoff is a re-validation aid, not an authorization control.

Legal-compliance boundary

The optional compliance handoff re-runs a validation pass over derived documents. It reports findings; it does not certify a document, guarantee regulatory sufficiency, or constitute legal advice. Judging whether an output meets your obligations is your responsibility.