@reventlessdev/reventless-aws 3.0.0-alpha.223 → 3.0.0-alpha.225

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.225 (2026-07-22)
+
+### Bug Fixes
+
+* **aws:** keep an empty DCB tag value from breaking the append ([1c0ab40](https://github.com/ReventlessDev/reventless-core/commit/1c0ab40f25b596702a81f42686d77c5e423e9b44))
+* **aws:** key the disconnect schedule's rule name to the stack, not the Lambda ([05aebcf](https://github.com/ReventlessDev/reventless-core/commit/05aebcfacac34fd9c7cb42f353ee91e20066067e))
+* **aws:** tag every taggable resource the framework still left bare ([d4f7a90](https://github.com/ReventlessDev/reventless-core/commit/d4f7a908bcaf686ff59a85e300efac4e5e6199df))
+
+
+# 3.0.0-alpha.224 (2026-07-22)
+
+### Bug Fixes
+
+* **aws:** register the QueuePolicy -> Queue dependency so destroys order correctly ([81cf2b3](https://github.com/ReventlessDev/reventless-core/commit/81cf2b3198fea7ad280817d2414102089ba0f13d))
+* **aws:** scope the CommandTopic queue policy's EventBridge send grant ([2f5f148](https://github.com/ReventlessDev/reventless-core/commit/2f5f148f4d73b2997633207f071c8d055960cc75))
+
+
 # 3.0.0-alpha.223 (2026-07-22)
 
 * refactor!: retire the stale "Admin" vocabulary for platform-owned resources ([2770bd9](https://github.com/ReventlessDev/reventless-core/commit/2770bd96f309142bdfc65b9f36bd1a3ef60641bd))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.223",
+  "version": "3.0.0-alpha.225",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,13 +12,13 @@
     "@reventlessdev/rescript-effect": "0.1.0-alpha.30",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.57",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.177",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.80",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.178",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.41",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.104"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.104",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.42",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.58",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.80"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/AWS_Tags.res

@@ -103,6 +103,42 @@ let makeDict = (
   ]->Dict.fromArray
 }
 
+/***
+Framework-created AWS resource types that carry NO attribution tags, and why.
+Keep this list here rather than in a plan: it is what tells a coverage audit
+whether a bare resource is a gap to close or a fact to work around.
+
+**Cannot be tagged** — the provider type exposes no `tags` property at all
+(verified against `@pulumi/aws` 7.19.0; re-verify on a major provider bump, since
+AWS does add tag support over time — `lambda/eventSourceMapping` gained it after
+the first sweep and is now tagged):
+
+    aws:appsync/dataSource        aws:appsync/resolver (incl. aws-native)
+    aws:appsync/function          aws:appsync/sourceApiAssociation
+    aws:iam/rolePolicy            aws:iam/rolePolicyAttachment
+    aws:sqs/queuePolicy           aws:sns/topicSubscription
+    aws:lambda/permission         aws:lambda/invocation
+    aws:cloudwatch/logMetricFilter aws:cloudwatch/eventTarget
+    aws:s3/bucketPolicy           aws:s3/bucketPublicAccessBlock
+    aws:cloudfront/originAccessControl
+    aws:cognito/userPoolClient    aws:cognito/userGroup
+    aws:route53/record            aws:acm/certificateValidation
+    aws:ses/emailIdentity         aws:ses/identityPolicy
+
+Each is attributable only through its parent (function, log group, API, role,
+bucket, pool, certificate) — i.e. structurally, by URN ancestry. A consumer that
+treats "carries `reventless:*` tags" as universal will be wrong about every row
+above, and no amount of coverage work changes that. Note the ReScript binding for
+`IAM.RolePolicy` carries a `tags?` field that AWS ignores; do not read its
+presence as tag support.
+
+**Taggable, deliberately untagged** — `aws:s3/bucketObject`. Static-bundle assets
+are bucket *contents*, not infrastructure: they are fully attributed by the
+bucket that holds them, and S3 bills object tags per object per month, so tagging
+a few hundred bundle files would cost money to restate a fact the parent already
+carries.
+*/
+
 /**
 The same schema as `makeDict`, wrapped as a Pulumi input — what nearly every
 resource's `tags` field expects. Use `makeDict` only for the bindings that take

package/src/adapter/Adapter_Helpers.res

@@ -1,3 +1,9 @@
+// SQS queue ARN is `arn:aws:sqs:<region>:<accountId>:<name>` — segment index 4
+// (0-based). Used to scope queue-policy service principals to this account via
+// the aws:SourceAccount condition key.
+let accountIdOfQueueArn = (queueArn: string) =>
+  queueArn->String.split(":")->Array.get(4)->Option.getOr("")
+
 let dynamoDbStreamResources = eventTopicResources =>
   eventTopicResources->ReventlessCore.Util.Adapter.filterSupportedResolvedResources([
     AWS.DynamoDbStream.service,

package/src/adapter/Adapter_Helpers.res.mjs

@@ -1,8 +1,13 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AWS$ReventlessAws from "./AWS.res.mjs";
 import * as Util_Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Adapter.res.mjs";
 
+function accountIdOfQueueArn(queueArn) {
+  return Stdlib_Option.getOr(queueArn.split(":")[4], "");
+}
+
 function dynamoDbStreamResources(eventTopicResources) {
   return Util_Adapter$ReventlessCore.filterSupportedResolvedResources(eventTopicResources, [AWS$ReventlessAws.DynamoDbStream.service]);
 }
@@ -29,6 +34,7 @@ function dynamoDbResources(resources) {
 }
 
 export {
+  accountIdOfQueueArn,
   dynamoDbStreamResources,
   snsResources,
   sqsResources,

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res

@@ -1,55 +1,73 @@
 open PulumiAws.PolicyDocument
 open Adapter_Helpers
 
+let createQueuePolicyDocument = (~name, ~queueArn: string, ~lambdaArn: string) => {
+  let accountId = queueArn->accountIdOfQueueArn
+  PulumiAws.PolicyDocument.make(
+    ~id=name ++ "QueuePolicy",
+    ~statements=[
+      {
+        sid: "AllowLambdaToAccessQueue",
+        effect: Allow,
+        principal: Principals({
+          service: PrincipalId(AWS.Lambda.principal),
+        }),
+        actions: Actions(["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"]),
+        resources: Resource(queueArn),
+        conditions: {
+          arnEquals: [("AWS:SourceArn", ConditionValue(lambdaArn))]->Dict.fromArray,
+        },
+      },
+      {
+        // ScheduledPublisher creates EventBridge rules at runtime
+        // (PutRule/PutTargets) targeting this queue directly, and EventBridge
+        // authorises SQS targets against the queue's resource policy — so the
+        // grant cannot name a single rule ARN. Scope it to rules in this
+        // account instead: SourceAccount closes the cross-account hole,
+        // ArnLike narrows the in-account surface to Events rules.
+        sid: "AllowCloudWatchEventsToSendToQueue",
+        effect: Allow,
+        principal: Principals({
+          service: PrincipalId(AWS.CloudwatchEventRule.principal),
+        }),
+        actions: Actions(["sqs:SendMessage"]),
+        resources: Resource(queueArn),
+        conditions: {
+          stringEquals: [("aws:SourceAccount", ConditionValue(accountId))]->Dict.fromArray,
+          arnLike: [
+            ("aws:SourceArn", ConditionValue(`arn:aws:events:*:${accountId}:rule/*`)),
+          ]->Dict.fromArray,
+        },
+      },
+    ],
+  )->toJsonString
+}
+
 let createQueuePolicy = (
   queue: PulumiAws.SQS.Queue.t,
   name,
   lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
   opts,
 ) => {
-  let _ =
-    (queue.arn, queue.id, lambda->Pulumi.Output.flatMap(lambda => lambda.arn))
-    ->Pulumi.Output.all3
-    ->Pulumi.Output.apply(((queueArn, queueId, lambdaArn)) => {
-      let queuePolicyDocument =
-        PulumiAws.PolicyDocument.make(
-          ~id=name ++ "QueuePolicy",
-          ~statements=[
-            {
-              sid: "AllowLambdaToAccessQueue",
-              effect: Allow,
-              principal: Principals({
-                service: PrincipalId("lambda.amazonaws.com"),
-              }),
-              actions: Actions([
-                "sqs:ReceiveMessage",
-                "sqs:DeleteMessage",
-                "sqs:GetQueueAttributes",
-              ]),
-              resources: Resource(queueArn),
-              conditions: {
-                arnEquals: [("AWS:SourceArn", ConditionValue(lambdaArn))]->Dict.fromArray,
-              },
-            },
-            {
-              sid: "AllowCloudWatchEventsToSendToQueue",
-              effect: Allow,
-              principal: Principals({
-                service: PrincipalId("events.amazonaws.com"),
-              }),
-              actions: Actions(["sqs:SendMessage"]),
-              resources: Resource(queueArn),
-            },
-          ],
-        )
-        ->toJsonString
-        ->Pulumi.Input.make
-      let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
-        ~name,
-        ~args={queueUrl: queueId->Pulumi.Input.make, policy: queuePolicyDocument},
-        ~opts=Some(opts),
-      )
-    })
+  // The document is a *value* derived from resolved ARNs, so it is built in an
+  // apply. The QueuePolicy itself stays outside: passing `queue.id` as an Output
+  // is what registers the policy -> queue dependency, without which Pulumi has
+  // no ordering constraint and can delete the queue first on a replacement,
+  // leaving the policy's delete polling a queue that no longer exists.
+  let queuePolicyDocument =
+    (queue.arn, lambda->Pulumi.Output.flatMap(lambda => lambda.arn))
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((queueArn, lambdaArn)) =>
+      createQueuePolicyDocument(~name, ~queueArn, ~lambdaArn)
+    )
+  let _queuePolicy = PulumiAws.SQS.QueuePolicy.make(
+    ~name,
+    ~args={
+      queueUrl: queue.id->Pulumi.Output.asInput,
+      policy: queuePolicyDocument->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
 }
 
 let createLambdaPolicy = (
@@ -100,10 +118,10 @@ let createLambdaPolicy = (
                       "dynamodb:UpdateItem",
                       "dynamodb:DeleteItem",
                       "dynamodb:BatchWriteItem",
-                      // Phase 7 cross-partition fences emit read-only
-                      // `ConditionCheck` entries inside `TransactWriteItems`
-                      // when a write doesn't touch the cross-partition tag's
-                      // partition itself; this needs its own IAM action.
+                      // Cross-partition fences emit read-only `ConditionCheck`
+                      // entries inside `TransactWriteItems` when a write
+                      // doesn't touch the cross-partition tag's partition
+                      // itself; this needs its own IAM action.
                       "dynamodb:ConditionCheckItem",
                     ]),
                     resources: Resources(
@@ -193,4 +211,15 @@ let createLambdaPolicy = (
 }
 
 let subscribeLambda2SqsTopic = (~batchSize=?, lambda, name, queue, opts) =>
-  Util_EventSourceMapping.subscribeSqs(~lambda, ~name, ~queue, ~batchSize?, ~opts)
+  Util_EventSourceMapping.subscribeSqs(
+    ~lambda,
+    ~name,
+    ~queue,
+    ~batchSize?,
+    ~tags=AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.CommandTopic.componentType,
+      ~role=EventSourceMapping,
+    ),
+    ~opts,
+  )

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs

@@ -5,53 +5,67 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
 
+function createQueuePolicyDocument(name, queueArn, lambdaArn) {
+  let accountId = Adapter_Helpers$ReventlessAws.accountIdOfQueueArn(queueArn);
+  return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [
+    {
+      Sid: "AllowLambdaToAccessQueue",
+      Principal: {
+        Service: AWS$ReventlessAws.Lambda.principal
+      },
+      Effect: "Allow",
+      Action: [
+        "sqs:ReceiveMessage",
+        "sqs:DeleteMessage",
+        "sqs:GetQueueAttributes"
+      ],
+      Resource: queueArn,
+      Condition: {
+        ArnEquals: Object.fromEntries([[
+            "AWS:SourceArn",
+            lambdaArn
+          ]])
+      }
+    },
+    {
+      Sid: "AllowCloudWatchEventsToSendToQueue",
+      Principal: {
+        Service: AWS$ReventlessAws.CloudwatchEventRule.principal
+      },
+      Effect: "Allow",
+      Action: ["sqs:SendMessage"],
+      Resource: queueArn,
+      Condition: {
+        StringEquals: Object.fromEntries([[
+            "aws:SourceAccount",
+            accountId
+          ]]),
+        ArnLike: Object.fromEntries([[
+            "aws:SourceArn",
+            `arn:aws:events:*:` + accountId + `:rule/*`
+          ]])
+      }
+    }
+  ]));
+}
+
 function createQueuePolicy(queue, name, lambda, opts) {
-  Pulumi.all([
+  let queuePolicyDocument = Pulumi.all([
     queue.arn,
-    queue.id,
     Output$Pulumi.flatMap(lambda, lambda => lambda.arn)
-  ]).apply(param => {
-    let queueArn = param[0];
-    let queuePolicyDocument = PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [
-      {
-        Sid: "AllowLambdaToAccessQueue",
-        Principal: {
-          Service: "lambda.amazonaws.com"
-        },
-        Effect: "Allow",
-        Action: [
-          "sqs:ReceiveMessage",
-          "sqs:DeleteMessage",
-          "sqs:GetQueueAttributes"
-        ],
-        Resource: queueArn,
-        Condition: {
-          ArnEquals: Object.fromEntries([[
-              "AWS:SourceArn",
-              param[2]
-            ]])
-        }
-      },
-      {
-        Sid: "AllowCloudWatchEventsToSendToQueue",
-        Principal: {
-          Service: "events.amazonaws.com"
-        },
-        Effect: "Allow",
-        Action: ["sqs:SendMessage"],
-        Resource: queueArn
-      }
-    ]));
-    new (Aws.sqs.QueuePolicy)(name, {
-      policy: queuePolicyDocument,
-      queueUrl: param[1]
-    }, opts);
-  });
+  ]).apply(param => createQueuePolicyDocument(name, param[0], param[1]));
+  new (Aws.sqs.QueuePolicy)(name, {
+    policy: queuePolicyDocument,
+    queueUrl: queue.id
+  }, opts);
 }
 
 function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
@@ -134,10 +148,11 @@ function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
 }
 
 function subscribeLambda2SqsTopic(batchSize, lambda, name, queue, opts) {
-  return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, batchSize, opts);
+  return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, batchSize, AWS_Tags$ReventlessAws.make(name, CommandTopic$ReventlessCore.componentType, "EventSourceMapping", undefined, undefined, undefined, undefined, undefined), opts);
 }
 
 export {
+  createQueuePolicyDocument,
   createQueuePolicy,
   createLambdaPolicy,
   subscribeLambda2SqsTopic,

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res

@@ -77,6 +77,12 @@ let make: ReventlessCore.Counter_Adapter.handlerMaker = (
       ~targetName=name,
       ~sourceName,
       ~source,
+      ~tags=AWS.Tags.make(
+        ~name=sourceName->ReventlessCore.Util.baseName ++ ("2" ++ name),
+        ~kind=ReventlessCore.ComponentType.Counter,
+        ~role=EventSourceMapping,
+        ~component=name,
+      ),
       ~opts,
     )
 

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res.mjs

@@ -2,6 +2,8 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Util$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_DynamoDbStream$ReventlessAws from "../../util/Util_DynamoDbStream.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
@@ -42,7 +44,7 @@ function make(name, referencesName, referencesDb, countsName, countsDb, param, s
     _0: "Counter"
   }, "Counter", match.code, match.sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, componentOpts);
   let lambda = runtime.parts.lambda;
-  let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, opts);
+  let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, AWS_Tags$ReventlessAws.make(Util$ReventlessCore.baseName(sourceName) + ("2" + name), "Counter", "EventSourceMapping", undefined, name, undefined, undefined, undefined), opts);
   subscribe(referencesName, referencesStream);
   subscribe(countsName, countsStream);
   return {

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -118,11 +118,19 @@ let toItem = (
   ->ReventlessCore.Message.decomposeMeta
   ->Array.forEach(((k, v)) => item->Dict.set(k, v))
 
-  // Add individual tag attributes for GSI queries
-  event.tags->Array.forEach(tag => {
-    let attrName = tagToAttributeName(tag.key)
-    item->Dict.set(attrName, tag.value->JSON.Encode.string)
-  })
+  // Add individual tag attributes for GSI queries. An empty tag value is a
+  // legitimate model state (a composite-partition member that is absent at this
+  // level of the hierarchy), but `tag_<key>` is a GSI hash key and DynamoDB
+  // rejects an empty string for a key attribute — the whole append fails. Skip
+  // the attribute instead: the index goes sparse (its intended mechanism), the
+  // event still records the tag in its `tags` payload, and `tag_composite`, the
+  // partition key and the OCC fences are all unaffected.
+  event.tags->Array.forEach(tag =>
+    if tag.value != "" {
+      let attrName = tagToAttributeName(tag.key)
+      item->Dict.set(attrName, tag.value->JSON.Encode.string)
+    }
+  )
 
   // Add composite tag attribute if multiple tags. The tag set here is exactly the
   // event's *entity* tags (no framework provenance tag is smuggled in — see
@@ -370,7 +378,7 @@ let resolveBaseItem = (table: resolvedTable, keyItem: JSON.t): Effect.t<
     }
   }
 
-let queryBySingleTagCrossPartitionStream = (
+let queryBySingleTagCrossPartitionStreamIndexed = (
   table: resolvedTable,
   tag: Reventless.DcbTag.tag,
   ~after: option<string>=?,
@@ -419,6 +427,21 @@ let queryBySingleTagCrossPartitionStream = (
   )
 }
 
+let queryBySingleTagCrossPartitionStream = (
+  table: resolvedTable,
+  tag: Reventless.DcbTag.tag,
+  ~after: option<string>=?,
+) =>
+  if tag.value == "" {
+    // `toItem` does not index an empty tag value (a GSI hash key cannot hold an
+    // empty string), so nothing carries it in this index. Querying for it would
+    // be rejected outright too — a key condition value cannot be empty either.
+    // The empty result is the honest answer; an exception is not.
+    Stream.empty
+  } else {
+    queryBySingleTagCrossPartitionStreamIndexed(table, tag, ~after?)
+  }
+
 // --- Query Item Execution ---
 
 let executeQueryItem = async (

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs

@@ -103,6 +103,9 @@ function toItem(position, event, partitionTag, recordedAt) {
     item[param[0]] = param[1];
   });
   event.tags.forEach(tag => {
+    if (tag.value === "") {
+      return;
+    }
     let attrName = tagToAttributeName(tag.key);
     item[attrName] = tag.value;
   });
@@ -281,7 +284,7 @@ function resolveBaseItem(table, keyItem) {
   }))), DynamoDb_Error$ReventlessAws.retrySchedule), err => Effect$1.fail(DynamoDb_Error$ReventlessAws.message(err))), result => result.Item);
 }
 
-function queryBySingleTagCrossPartitionStream(table, tag, after) {
+function queryBySingleTagCrossPartitionStreamIndexed(table, tag, after) {
   let indexName = tagToAttributeName(tag.key);
   let expressionAttributeValues = Object.fromEntries([[
       ":val",
@@ -326,6 +329,14 @@ function queryBySingleTagCrossPartitionStream(table, tag, after) {
   });
 }
 
+function queryBySingleTagCrossPartitionStream(table, tag, after) {
+  if (tag.value === "") {
+    return Stream$1.empty;
+  } else {
+    return queryBySingleTagCrossPartitionStreamIndexed(table, tag, after);
+  }
+}
+
 async function executeQueryItem(table, queryItem, after, crossPartitionTagKeysOpt) {
   let crossPartitionTagKeys = crossPartitionTagKeysOpt !== undefined ? crossPartitionTagKeysOpt : [];
   let tags = queryItem.tags;
@@ -1164,6 +1175,7 @@ export {
   buildQueryByPartitionKeyInput,
   queryByPartitionKey,
   resolveBaseItem,
+  queryBySingleTagCrossPartitionStreamIndexed,
   queryBySingleTagCrossPartitionStream,
   executeQueryItem,
   deduplicateByPosition,