syntax = "proto3";

package nominal.ingest.v2.internal;

import "nominal/protos/ingest/v2/ingest_service.proto";

option java_multiple_files = true;
option java_package = "io.nominal.ingest.v2.internal";

message IngestShadowRequest {
  nominal.ingest.v2.IngestRequest ingest_request = 1;
}

message IngestShadowResponse {
  nominal.ingest.v2.IngestResponse ingest_response = 1;
}

// Internal ingest service for inter-service RPCs. Uses a separate package so that
// the gRPC path (nominal.ingest.v2.internal.*) is excluded from public ingress.
//
// The shadow flag on the resulting ingest job and dataset files is a server-side
// concern: shadow rows are excluded from user-facing reads (search, list, metrics)
// and from billing/retention, so the flag must not be settable from a public API.
service InternalIngestService {
  // Submit a V2 ingest job whose ingest job and dataset files are tagged with
  // is_shadow=true. Internal-only: the gRPC path is excluded from public ingress,
  // and the caller's original auth header is forwarded so the same dataset-write
  // authorization checks apply as on the public ingest API.
  rpc IngestShadow(IngestShadowRequest) returns (IngestShadowResponse);
}
