feat(metadata): add dependency validation to publishPackage - check referenced items exist in package or are already published

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/metadata/src/metadata-manager.ts

@@ -375,6 +375,8 @@ export class MetadataManager implements IMetadataService {
     // Validation pass
     if (shouldValidate) {
       const validationErrors: Array<{ type: string; name: string; message: string }> = [];
+
+      // Schema validation
       for (const item of packageItems) {
         const result = await this.validate(item.type, item.data);
         if (!result.valid && result.errors) {
@@ -387,6 +389,36 @@ export class MetadataManager implements IMetadataService {
           }
         }
       }
+
+      // Dependency validation: referenced items must be in the same package or already published
+      const packageItemKeys = new Set(packageItems.map(i => `${i.type}:${i.name}`));
+      for (const item of packageItems) {
+        const deps = await this.getDependencies(item.type, item.name);
+        for (const dep of deps) {
+          const depKey = `${dep.targetType}:${dep.targetName}`;
+          // Skip if the dependency is within this package
+          if (packageItemKeys.has(depKey)) continue;
+          // Check if the dependency exists and has been published
+          const depItem = await this.get(dep.targetType, dep.targetName);
+          if (!depItem) {
+            validationErrors.push({
+              type: item.type,
+              name: item.name,
+              message: `Dependency '${dep.targetType}:${dep.targetName}' not found`,
+            });
+          } else {
+            const depMeta = depItem as any;
+            if (depMeta.publishedDefinition === undefined && depMeta.state !== 'active') {
+              validationErrors.push({
+                type: item.type,
+                name: item.name,
+                message: `Dependency '${dep.targetType}:${dep.targetName}' is not published`,
+              });
+            }
+          }
+        }
+      }
+
       if (validationErrors.length > 0) {
         return {
           success: false,

packages/metadata/src/metadata-service.test.ts

@@ -772,6 +772,78 @@ describe('MetadataManager — IMetadataService Contract', () => {
       expect(result.success).toBe(true);
       expect(result.itemsPublished).toBe(1);
     });
+
+    it('should fail when dependency is not found or not published', async () => {
+      await manager.register('view', 'opp_list', {
+        name: 'opp_list', label: 'Opp List', packageId: 'com.acme.dep',
+        metadata: { columns: ['name'] },
+      });
+
+      // Register a dependency pointing to a non-existent item
+      manager.addDependency({
+        sourceType: 'view',
+        sourceName: 'opp_list',
+        targetType: 'object',
+        targetName: 'opportunity',
+        kind: 'reference',
+      });
+
+      const result = await manager.publishPackage('com.acme.dep', { validate: true });
+      expect(result.success).toBe(false);
+      expect(result.validationErrors).toBeDefined();
+      expect(result.validationErrors!.some(e => e.message.includes('opportunity'))).toBe(true);
+    });
+
+    it('should pass dependency check when target is in the same package', async () => {
+      await manager.register('object', 'project', {
+        name: 'project', label: 'Project', packageId: 'com.acme.same',
+        metadata: { fields: ['name'] },
+      });
+      await manager.register('view', 'project_list', {
+        name: 'project_list', label: 'Project List', packageId: 'com.acme.same',
+        metadata: { columns: ['name'] },
+      });
+
+      // Dependency within the same package
+      manager.addDependency({
+        sourceType: 'view',
+        sourceName: 'project_list',
+        targetType: 'object',
+        targetName: 'project',
+        kind: 'reference',
+      });
+
+      const result = await manager.publishPackage('com.acme.same', { validate: true });
+      expect(result.success).toBe(true);
+      expect(result.itemsPublished).toBe(2);
+    });
+
+    it('should pass dependency check when target is already published', async () => {
+      // Pre-existing published object (different package)
+      await manager.register('object', 'account', {
+        name: 'account', label: 'Account', packageId: 'com.acme.core',
+        publishedDefinition: { fields: ['name'] },
+        state: 'active',
+      });
+
+      // View in a different package references the published object
+      await manager.register('view', 'account_list', {
+        name: 'account_list', label: 'Account List', packageId: 'com.acme.views',
+        metadata: { columns: ['name'] },
+      });
+
+      manager.addDependency({
+        sourceType: 'view',
+        sourceName: 'account_list',
+        targetType: 'object',
+        targetName: 'account',
+        kind: 'reference',
+      });
+
+      const result = await manager.publishPackage('com.acme.views', { validate: true });
+      expect(result.success).toBe(true);
+      expect(result.itemsPublished).toBe(1);
+    });
   });
 
   describe('revertPackage', () => {