Am starting to build Lightning Web Components that will need to call an external API. Looks like I need to add CSP Trusted Sites and Remote Site Settings. So I created folders in /force-app/main/default called cspTrustedSites and remoteSiteSettings. Within them, I followed the metadata documentation.

Here's MyTrustedSites.cspTrustedSite:

<?xml version="1.0" encoding="UTF-8"?>
<CspTrustedSite xmlns="https://soap.sforce.com/2006/04/metadata">
  <description>For API calls, styles, fonts, media, and images</description>
  <masterLabel>My Trusted Sites</masterLabel>

When I issue sfdx package:version:create -p 0Ho... --installation-key-bypass -b 2gp-internal --code-coverage, I get this error:

Error (1): Component conversion failed: /var/folders/qd/REDACTED/T/0Ho...-REDACTED/md-files/cspTrustedSites/MyTrustedSites.cspTrustedSit: Could not infer a metadata type

Note: the error message omits the final "e" in the file extension but it's there. Seems to be an sfdx bug.

If I move the cspTrustedSites and remoteSiteSettings folders out of my project temporarily, I can create the package version.

sfdx --version
sfdx-cli/7.187.1 darwin-arm64 node-v18.14.0

Any thoughts on what I'm doing wrong?

  • Is the filename really MyTrustedSites.cspTrustedSit? There's a terminal e missing.
    – David Reed
    Commented Feb 14, 2023 at 2:58
  • Hey... thanks for jumping in. It actually ends in an "e". I tried shortening the name (a.cspTrustedSite) but that didn't change the way the error is displayed. I think it might be a red herring to the true problem. Have you ever bundled cspTrustedSites or remoteSiteSettings in a 2GP? Seems like it was possible in 1GPs. Commented Feb 14, 2023 at 3:24
  • I have not. Can you reproduce the same error with a minimal package that only contains your cspTrustedSites? That might be a reportable bug for the SFDX GitHub repo. You're on the latest CLI version?
    – David Reed
    Commented Feb 14, 2023 at 3:52
  • 1
    Yup. It is reproducible just with the cspTrustedSites and nothing else. Using sfdx-cli/7.187.1 darwin-arm64 node-v18.14.0 (latest/greatest). According to the docs for API v56, this metadata should be supported both for 1GP and 2GP... developer.salesforce.com/docs/metadata-coverage/56 Commented Feb 14, 2023 at 4:04

1 Answer 1


The full name of my metadata file was MyTrustedSites.cspTrustedSite. It needed to be MyTrustedSites.cspTrustedSite-meta.xml.

My mistake was using the file created by sf retrieve metadata without changing the name. Not sure why it doesn't add -meta.xml by default but...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .