Add EVE schema and mapping

[daehan-temporal]

What was changed

• Added payload encryption validation configuration to the namespace resource.
• Exposed the configuration through namespace data sources.
• Added validation, state conversion, import, update, disable, and empty-configuration handling.
• Added unit and acceptance test coverage.

Why?

Users need to configure and read namespace payload encryption validation through Terraform while keeping Terraform state consistent with the Cloud API.

Checklist

1. Closes #

2. How was this tested:

• go test ./internal/provider -count=1
• make test-namespace-encryption-validation
• Verified WARN, DENY, DISABLED, import, removal rejection, and empty configuration behavior.

3. Any docs updates needed?

• Updated namespace resource and data-source documentation.
• Updated the namespace resource example.
• Regenerated documentation with go generate ./....

---

Note

Medium Risk
Changes namespace create/update/read paths and depends on a development API version for encryption validation; misrouting or SDK/API drift could affect namespace operations, but scope is limited to the new optional block with explicit guards and tests.

Overview
Adds optional encryption_validation on temporalcloud_namespace so users can configure payload encryption validation (modes disabled, warn, deny, metadata key/values, header/failure inspection). The same block is exposed read-only on temporalcloud_namespace and temporalcloud_namespaces data sources.

API client: Namespace create/update and reads that need encryption validation use a second Cloud API client with development API version (DevelopmentCloudService()); stable client remains for other operations. go.temporal.io/cloud-sdk is bumped to a pre-release build that includes encryption validation types.

Lifecycle: Once set, encryption_validation cannot be removed from config (same pattern as fairness); users must set mode = "disabled". Empty {} leaves the feature unconfigured.

Docs, examples, Makefile target test-namespace-encryption-validation, unit tests, and acceptance tests cover mapping, import, and validation.

^{Reviewed by Cursor Bugbot for commit 3a5cd01. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit 3a5cd01. Configure here.}

[cursor]

Empty config bypasses removal guard

High Severity

The encryption_validation removal checks only IsNull(), so encryption_validation = {} slips through after a real mode was configured. That path treats the plan as zero, sends a nil spec, and selects the stable API client, so the Cloud value can remain while Terraform keeps planning the empty object away.

Additional Locations (2)

• internal/provider/namespace_resource.go#L827-L834
• internal/provider/namespace_resource.go#L948-L952

 

^{Reviewed by Cursor Bugbot for commit 3a5cd01. Configure here.}

[cursor]

Mode not required when fields set

Medium Severity

Schema text says that if any encryption_validation field is set, mode must be disabled, warn, or deny, but nothing enforces that. A non-zero object with only metadata_key, metadata_values, or inspect_* still maps omitted mode to UNSPECIFIED and sends it to the API.

Additional Locations (2)

• internal/provider/namespace_resource.go#L410-L416
• internal/provider/enums/namespace.go#L15-L28

 

^{Reviewed by Cursor Bugbot for commit 3a5cd01. Configure here.}