[CLDAPP-423] Add Encryption Validation

[daehan-temporal]

What was changed

Adds Cloud CLI support for namespace payload encryption validation (EVE):

temporal cloud namespace encryption-validation get|set|enable|disable

namespace create also accepts optional --encryption-validation-* flags. If any of those flags is set, --encryption-validation-mode is required.

• set replaces the whole nested spec. Omitted optional flags are sent as empty/false.
• enable turns validation on. Unconfigured namespaces get defaults (warn / encoding / binary/encrypted). Disabled namespaces are re-enabled and keep metadata/inspect. Already-warn or already-deny is left unchanged. --deny only applies when turning validation on.
• disable sets mode to disabled and keeps metadata/inspect.

Pins go.temporal.io/cloud-sdk to v0.18.1-0.20260915065746-d48c11f885cb (v0.18.0 plus EncryptionValidation). Temporarily sends APIVersion: development because staging still gates this field.

Why?

Give customers a CLI to inspect and change namespace encryption-validation settings, with enable/disable for the common on/off path and set as an explicit replace.

Checklist

1. Closes - CLDAPP-423

2. How was this tested:

go test ./temporalcloudcli -run 'TestCreateNamespace_|TestNamespaceDescription|TestNamespaceEncryptionValidation'

3. Any docs updates needed?
   https://docs.temporal.io/cli/command-reference/cloud/namespace

---

Note

Medium Risk
Changes namespace security-related settings and forces a development API version on all Cloud clients until the gate is removed; misconfiguration in deny mode could block workflows.

Overview
Adds namespace payload encryption validation to the Temporal Cloud CLI, including a new encryption-validation command group with get, set, enable, and disable. Set fully replaces the nested spec (omitted flags become empty/false); enable applies sensible defaults or re-enables disabled config while preserving metadata; disable only sets mode to disabled.

namespace create now accepts optional --encryption-validation-* flags; if any are set, --encryption-validation-mode is required. The CLI pins go.temporal.io/cloud-sdk to a pre-release that exposes EncryptionValidation, and BuildCloudClient temporarily sends APIVersion: development so staging can use the new API. The --api-key flag help no longer mentions TEMPORAL_API_KEY.

^{Reviewed by Cursor Bugbot for commit 8dd25b5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8dd25b5. Configure here.}

[cursor]

Enable skips defaults after disable

Medium Severity

enable applies encoding / binary/encrypted defaults only when EncryptionValidation is nil. disable on an unconfigured namespace writes a disabled spec with empty metadata, so a later enable turns validation on without those defaults. The resulting warn/deny config has no metadata key or values, so payload identification does not match the documented enable path.

Additional Locations (1)

• temporalcloudcli/commands.namespace.encryption_validation.go#L140-L146

 

^{Reviewed by Cursor Bugbot for commit 8dd25b5. Configure here.}