Is it possible to (Unlocked) Package field encryption settings?

Question

I'm having issues proving whether it is or isn't possible to have field encryption settings packaged as part of an Unlocked Package (with a Namespace) and this encryption be enabled automatically upon install. Specifically Deterministic encryption using Shield.

There is no problem creating a package version with both Standard and Custom fields that include the Encryption Scheme in its metadata.

Account.Name
<?xml version="1.0" encoding="UTF-8"?>
<CustomField xmlns="http://soap.sforce.com/2006/04/metadata">
    <fullName>Name</fullName>
    <encryptionScheme>CaseInsensitiveDeterministicEncryption</encryptionScheme>
    <trackFeedHistory>true</trackFeedHistory>
    <trackHistory>false</trackHistory>
</CustomField>

Account.CustomField__c
<?xml version="1.0" encoding="UTF-8"?>
<CustomField xmlns="http://soap.sforce.com/2006/04/metadata">
    <fullName>CustomField__c</fullName>
    <caseSensitive>false</caseSensitive>
    <encryptionScheme>CaseInsensitiveDeterministicEncryption</encryptionScheme>
    <externalId>true</externalId>
    <label>CustomField__c</label>
    <length>30</length>
    <required>false</required>
    <trackFeedHistory>false</trackFeedHistory>
    <trackHistory>false</trackHistory>
    <type>Text</type>
    <unique>true</unique>
</CustomField>

I make sure that the target org has Encryption enabled and Key uploaded for Deterministic Encryption. When the package is installed though the fields are not set to be encrypted. Retrieving the fields from the Org there is no Encryption Scheme defined on them. Only when I take the same fields that I used to create the package version (add the namespace locally) and deploy them via CLI (so deploy instead of install) the Encryption Scheme is applied to them.

I have found that the Advanced Encryption Setting to encrypt managed fields is required in this case. So Managed really means "Namespaced" (not the first time I ran into that). Without this setting even the "deploy" did not add the Encryption.

I'm struggling to find any documentation that would say that installing encrypted fields should or should not be possible. There is no failure during installation.

UPDATE: When I take away the Platform Encryption feature setting from the package definition file it still validace and creates a version ok. Sounds like it's not packaging the Encryption Settings (?) or maybe it this is only relevant upon install so it doesn't break validation?

Answer 1

Updated 2024-01-08 I can no longer replicate the scenario where encryption is automatically applied to custom fields upon install in unlocked package. Salesforce support also stated that this does not happen. I must have made a mistake somewhere in my testing. Looks like it's not possible at all.

I still haven't found relevant Documentation that says why, but I think I found my answer:

It seems that it's not possible to enable Platform Encryption by Unlocked Package (version) install when the package has a Namespace.

Now the fun part:

It is possible to do this when the Unlocked Package does not have a Namespace. However, only if Platform Encryption setting is enabled in the package definition file.

{
  ...
  "features": [
        "PlatformEncryption"
    ],
  ...
}

If this setting is not present then the Package Version can be created and does not fail. But when it's installed, the field is not encrypted.

To be complete, when using a Namespace, the package version is created OK with or without the setting and field is never encrypted upon install.