Budibase/budibase · error · HTTPError

Project package contains unsupported files.

Error message

Project package contains unsupported files.

What it means

Project packages must contain only recognized entries: the manifest, project.json, dependency-index.json, and the docs directory (checked at imports.ts:946-961 against the allowed entry list). Any other file or directory in the archive root causes this HTTP 400, guarding against malformed or tampered packages.

Source

Thrown at packages/server/src/sdk/workspace/projects/backups/imports.ts:960

    }
    if (rootEntries.includes("db.txt")) {
      throw new HTTPError(
        "Workspace exports cannot be imported as Project packages.",
        400
      )
    }
    if (
      rootEntries.some(
        entry =>
          ![
            PROJECT_MANIFEST_FILE,
            PROJECT_FILE,
            PROJECT_DEPENDENCY_INDEX_FILE,
            PROJECT_DOCS_DIRECTORY,
          ].includes(entry)
      )
    ) {
      throw new HTTPError("Project package contains unsupported files.", 400)
    }

    const manifestPath = join(tmpPath, PROJECT_MANIFEST_FILE)
    const projectPath = join(tmpPath, PROJECT_FILE)
    const dependencyIndexPath = join(tmpPath, PROJECT_DEPENDENCY_INDEX_FILE)
    const docsPath = join(tmpPath, PROJECT_DOCS_DIRECTORY)

    await Promise.all([
      fsp.access(manifestPath).catch(() => {
        throw new HTTPError("Project package is missing manifest.json.", 400)
      }),
      fsp.access(projectPath).catch(() => {
        throw new HTTPError("Project package is missing project.json.", 400)
      }),
      fsp.access(dependencyIndexPath).catch(() => {
        throw new HTTPError(
          "Project package is missing dependency-index.json.",
          400

View on GitHub (pinned to a81a902e9a)

Solutions

1. Rebuild the package so its root contains only manifest.json, project.json, dependency-index.json and the docs directory
2. Re-export the package from the source workspace instead of hand-assembling it
3. If re-zipping manually, exclude OS/editor junk (.DS_Store, Thumbs.db, __MACOSX)
4. Inspect the archive root (tar -tf pkg.tgz | head) to find the offending entry named by the check

Example fix

null

import { createReadStream } from 'fs'
import { parse } from 'tar'
const ALLOWED = ['manifest.json', 'project.json', 'dependency-index.json', 'docs']
const bad: string[] = []
await new Promise<void>((resolve, reject) => {
  const ws = parse({ onReadEntry: (e: any) => { const root = e.path.split('/')[0]; if (!ALLOWED.includes(root)) bad.push(root) }, onEnd: () => resolve() })
  createReadStream(packagePath).pipe(ws as any)
  ws.on('error', reject)
})
if (bad.length) throw new Error(`unsupported entries in package root: ${[...new Set(bad)].join(', ')}`)

function hasOnlyAllowedRootEntries(entries: readonly string[], allowed: readonly string[]): entries is readonly string[] {
  return entries.every(e => allowed.includes(e))
}

try {
  await importProjectPackage(file)
} catch (err) {
  if (err instanceof HTTPError && err.status === 400 && err.message === 'Project package contains unsupported files.') {
    // inspect archive root, rebuild package with only the allowed entries
  } else {
    throw err
  }
}

When it happens

Trigger: Importing a tarball whose root contains files/directories other than the manifest file, PROJECT_FILE, PROJECT_DEPENDENCY_INDEX_FILE, and PROJECT_DOCS_DIRECTORY — the allowlist check at imports.ts:948-959 fails.

Common situations: Re-zipping an extracted package and accidentally including extra files (e.g. .DS_Store, __MACOSX, editor backups); adding custom files into the package expecting them to be imported; an export produced by an incompatible tool or version.

Related errors

• Project package is too large.
• Unsupported Project doc path '${relPath}'.
• Project package contains a doc without an id.
• Project package doc path does not match '${id}'.
• Project package doc '${id}' does not match resource type '${

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/0dd77d94421c7e7a. Report an issue: GitHub.