ExternalAuthIdentityProvider fails when creating package version

[cloudconduitgit]

Summary

sf package version create (2GP managed package) fails to infer the metadata type for an ExternalAuthIdentityProvider source file, even though the type is fully supported by the Metadata API, listed in the SDR metadataRegistry.json, and returned by sf org list metadata-types for my org.

Building the package version produces:

Error (1): .../externalAuthIdentityProviders/Xero.externalAuthIdentityProvider-meta.xml: Could not infer a metadata type

Steps To Reproduce

1. In a DX project, create the file
   <packageDir>/main/default/externalAuthIdentityProviders/Xero.externalAuthIdentityProvider-meta.xml
   (directory externalAuthIdentityProviders, suffix externalAuthIdentityProvider) with the content below.
2. Create a 2GP managed package version that includes this directory:

 sf package version create --package <package> --installation-key-bypass --code-coverage --wait 60

3. Observe the "Could not infer a metadata type" error.

Xero.externalAuthIdentityProvider-meta.xml:

<?xml version="1.0" encoding="UTF-8"?>
<ExternalAuthIdentityProvider xmlns="http://soap.sforce.com/2006/04/metadata">
    <authenticationFlow>AuthorizationCode</authenticationFlow>
    <authenticationProtocol>OAuth</authenticationProtocol>
    <externalAuthIdentityProviderParameters>
        <parameterName>AuthorizeUrl</parameterName>
        <parameterType>AuthorizeUrl</parameterType>
        <parameterValue>https://login.xero.com/identity/connect/authorize</parameterValue>
    </externalAuthIdentityProviderParameters>
    <externalAuthIdentityProviderParameters>
        <parameterName>ClientAuthentication</parameterName>
        <parameterType>ClientAuthentication</parameterType>
        <parameterValue>ClientSecretBasic</parameterValue>
    </externalAuthIdentityProviderParameters>
    <externalAuthIdentityProviderParameters>
        <parameterName>PkceEnabled</parameterName>
        <parameterType>IdentityProviderOptions</parameterType>
        <parameterValue>false</parameterValue>
    </externalAuthIdentityProviderParameters>
    <externalAuthIdentityProviderParameters>
        <parameterName>TokenUrl</parameterName>
        <parameterType>TokenUrl</parameterType>
        <parameterValue>https://identity.xero.com/connect/token</parameterValue>
    </externalAuthIdentityProviderParameters>
    <label>Xero</label>
</ExternalAuthIdentityProvider>

Expected result

The file resolves to the ExternalAuthIdentityProvider metadata type and the package version builds normally.

Actual result

Error (1): .../externalAuthIdentityProviders/Xero.externalAuthIdentityProvider-meta.xml: Could not infer a metadata type

Try this:

A metadata type lookup for "Xero.externalAuthIdentityProvider-meta.xml" found the following close matches:
-- Did you mean ".externalDataConnector-meta.xml" instead for the "ExternalDataConnector" metadata type?
-- Did you mean ".paymentGatewayProvider-meta.xml" instead for the "PaymentGatewayProvider" metadata type?
-- Did you mean ".externalCredential-meta.xml" instead for the "ExternalCredential" metadata type?
-- Did you mean ".externalAIModel-meta.xml" instead for the "ExternalAIModel" metadata type?

Why this looks like a bug (not a missing/unsupported type)

• SDR registry - ExternalAuthIdentityProvider is present in
  https://github.com/forcedotcom/source-deploy-retrieve/blob/main/src/registry/metadataRegistry.json
• Metadata Coverage Report - the type is available via Metadata API:
  https://developer.salesforce.com/docs/metadata-coverage
• My org - sf org list metadata-types returns it (from metadata-types.json):

  {
    "directoryName": "externalAuthIdentityProviders",
    "inFolder": false,
    "metaFile": false,
    "suffix": "externalAuthIdentityProvider",
    "xmlName": "ExternalAuthIdentityProvider",
    "childXmlNames": []
  }

The directory name (externalAuthIdentityProviders) and suffix (externalAuthIdentityProvider) on disk match the org's describe exactly, so type inference should succeed.

System Information

Shell: PowerShell (Windows 11)

JSON Output of 'sf version --verbose --json' below.

{
  "architecture": "win32-x64",
  "cliVersion": "@salesforce/cli/2.136.8",
  "nodeVersion": "node-v22.22.2",
  "osVersion": "Windows_NT 10.0.22000",
  "rootPath": "C:\\Users\\Frank\\AppData\\Local\\sf\\client\\2.136.8-266ec84",
  "shell": "powershell",
  "pluginVersions": [
    "@ind-rcg/modeler-sfdx-cli-plugin 262.1022.0 (user) published 26 days ago (Fri May 08 2026)",
    "@oclif/plugin-autocomplete 3.2.49 (core)",
    "@oclif/plugin-commands 4.1.54 (core)",
    "@oclif/plugin-help 6.2.49 (core)",
    "@oclif/plugin-not-found 3.2.86 (core)",
    "@oclif/plugin-plugins 5.4.68 (core)",
    "@oclif/plugin-search 1.2.49 (core)",
    "@oclif/plugin-update 4.7.40 (core)",
    "@oclif/plugin-version 2.2.46 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.65 (core)",
    "@oclif/plugin-which 3.2.54 (core)",
    "@salesforce/cli 2.136.8 (core)",
    "agent 1.40.3 (core)",
    "apex 3.9.29 (core)",
    "api 1.3.33 (core)",
    "auth 4.4.0 (core)",
    "code-analyzer 5.12.0 (user) published 37 days ago (Mon Apr 27 2026) (latest is 5.13.0)",
    "data 4.0.101 (core)",
    "deploy-retrieve 3.24.48 (core)",
    "info 3.4.133 (core)",
    "lightning-dev 6.2.17 (user) published 67 days ago (Sat Mar 28 2026)",
    "limits 3.3.89 (core)",
    "marketplace 1.3.26 (core)",
    "org 5.11.1 (core)",
    "packaging 1.26.1 (user) published 984 days ago (Sat Sep 23 2023) (latest is 2.28.6)",
    "schema 3.3.114 (core)",
    "settings 2.4.80 (core)",
    "sobject 1.4.108 (core)",
    "telemetry 3.8.21 (core)",
    "templates 56.17.2 (core)",
    "trust 3.8.9 (core)",
    "user 3.10.0 (core)",
    "@salesforce/sfdx-scanner 4.12.0 (user) published 399 days ago (Wed Apr 30 2025)",
    "sfdmu 5.6.4 (user) published 47 days ago (Fri Apr 17 2026)",
    "sfdx-git-delta 6.31.0 (user) published 110 days ago (Fri Feb 13 2026)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.