#366 bucket-policy GlobalArgsSchema requires Bucket and PolicyDocument, blocking workflow-YAML direct execution of get

Summary

@swamp/aws/s3/bucket-policy's GlobalArgsSchema declares both Bucket and PolicyDocument as required non-optional strings. As a result, direct execution via workflow YAML (task.modelType: "[@swamp](/u/swamp)/aws/s3/bucket-policy" + task.modelName: ...) fails Zod validation at parse time, even when the step is calling get — where the bucket name is logically a method-time input, not instance configuration.

The sibling model @swamp/aws/s3/bucket declares all its globalArguments as optional, which is why direct execution works there. The inconsistency is the bug.

Where

// .swamp/pulled-extensions/@swamp/aws/s3/models/bucket_policy.ts (2026.04.23.3)
const GlobalArgsSchema = z.object({
  Bucket: z.string(),          // <- required non-optional
  PolicyDocument: z.string(),  // <- required non-optional
});

InputsSchema correctly declares the same fields at the method side, which is also where they belong — at method-call time, not at instance-create time.

Reproduction

1. Pull @swamp/aws/s3@2026.04.23.3.

2. Author a workflow YAML step that direct-execs get on this model:

   - name: bucket-policy-lookup-${{ self.bucketName }}
     forEach: { item: bucketName, in: ${{ inputs.bucketNames }} }
     task:
       type: model_method
       modelType: "@swamp/aws/s3/bucket-policy"
       modelName: "policy-lookup-${{ self.bucketName }}"
       methodName: get
       inputs:
         identifier: ${{ self.bucketName }}

3. Run the workflow.

4. Observe: validation fails with expected string, received undefined on Bucket and PolicyDocument.

Expected

Either:

• GlobalArgsSchema.Bucket and .PolicyDocument are optional (matching the sibling @swamp/aws/s3/bucket model), or
• the workflow YAML task: { type: model_method } schema gains an optional globalArgs: block so direct-exec steps can supply them inline.

In both cases, direct execution of get should succeed without requiring a pre-created instance.

Actual

Workflow parsing rejects the step because the model's GlobalArgsSchema requires both fields, but the workflow task schema only accepts inputs:. There's no documented way to supply globalArguments for direct execution. The Zod error is cryptic for someone who hasn't read both schemas — the bucket name is in inputs.identifier already, which gives no hint that the failure is at the instance-creation layer.

Impact

Any consumer that wants to fan a get call across N buckets must:

1. Pre-create a single shared model instance with placeholder globalArgs:

   swamp model create @swamp/aws/s3/bucket-policy audit-bucket-policy \
     --global Bucket=placeholder \
     --global 'PolicyDocument={}'

2. Use modelIdOrName: audit-bucket-policy in the forEach step rather than the cleaner modelType + modelName direct-exec form.

Per-iteration calls then serialize on the shared instance's lock. Acceptable for small N, but it's ergonomic friction and adds a separate models/<type>/<id>.yaml artefact the consumer must keep in sync.

Workaround

The shared-instance pattern above.

Suggested resolutions (any one is sufficient)

1. Relax GlobalArgsSchema. Mark Bucket and PolicyDocument as z.string().optional() in bucket_policy.ts's GlobalArgsSchema. They are not needed at instance-create time when the only method called is get. The sibling @swamp/aws/s3/bucket model is already shaped this way. Smallest patch.

2. Allow globalArgs in workflow YAML direct execution. Extend the task: { type: model_method } schema with an optional globalArgs: block so direct-exec steps can supply them inline. Larger change but fixes the underlying expressiveness gap for any model with required globalArgs.

Option 1 is the smaller, more targeted fix.

Related

• Issue #363 — StateSchema.PolicyDocument schema mismatch on this same extension. The two are independent bugs in the same file; fixing one doesn't fix the other.

Environment

• swamp 20260516.045246.0-sha.e6eda98d
• @swamp/aws/s3 2026.04.23.3
• AWS region eu-west-1, CloudControl path
• macOS 25.4.0 / Deno bundled with swamp

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/aws/s3@2026.04.23.3
• swamp: 20260516.045246.0-sha.e6eda98d
• OS: darwin (aarch64)
• Deno: 2.7.14+19bd3d8
• Shell: /bin/zsh