[daehan-temporal]

What was changed

Adds Cloud CLI support for namespace payload encryption validation (EVE):

temporal cloud namespace encryption-validation get|set|enable|disable

namespace create also accepts optional --encryption-validation-* flags. If any of those flags is set, --encryption-validation-mode is required.

• set replaces the whole nested spec. Omitted optional flags are sent as empty/false.
• enable turns validation on. Unconfigured namespaces get defaults (warn / encoding / binary/encrypted). Disabled namespaces are re-enabled and keep metadata/inspect. Already-warn or already-deny is left unchanged. --deny only applies when turning validation on.
• disable sets mode to disabled and keeps metadata/inspect.

Bumps go.temporal.io/cloud-sdk to v0.20.0, which includes EncryptionValidation and defaults to Cloud API v0.23.0.

Why?

Give customers a CLI to inspect and change namespace encryption-validation settings, with enable/disable for the common on/off path and set as an explicit replace.

Checklist

1. Closes - CLDAPP-423

2. How was this tested:

go test ./temporalcloudcli -run 'TestCreateNamespace_|TestNamespaceDescription|TestNamespaceEncryptionValidation'

3. Any docs updates needed?
   https://docs.temporal.io/cli/command-reference/cloud/namespace

---

Note

Medium Risk
Touches namespace security-adjacent settings and UpdateNamespace paths; mis-flagged updates could weaken or misconfigure validation, though changes are gated behind prompts and tests.

Overview
Adds experimental Cloud CLI support for namespace payload encryption validation with temporal cloud namespace encryption-validation get|set|enable|disable and documents it in commands.yml.

Extends namespace create with optional --encryption-validation-* flags, wiring them into CreateNamespace so any partial input requires an explicit --encryption-validation-mode.

Implements set/enable/disable via GetNamespace + UpdateNamespace with prompts, resource-version/async-operation handling, guardrails (e.g., at least one flag on set, mode required when unconfigured), and adds focused unit tests covering the new flows.

^{Reviewed by Cursor Bugbot for commit a99976b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8dd25b5. Configure here.}