@reventlessdev/reventless-aws 3.0.0-alpha.223 → 3.0.0-alpha.225

package/src/plugin/cloner/ClonerRunner_Fargate.res.mjs

@@ -131,7 +131,8 @@ export const handler = async (event) => {
       memory: "4096",
       networkMode: "awsvpc",
       requiresCompatibilities: ["FARGATE"],
-      executionRoleArn: taskExecutionRole.arn
+      executionRoleArn: taskExecutionRole.arn,
+      tags: AWS_Tags$ReventlessAws.make(name, Cloner$ReventlessCore.componentType, "DataTransfer", undefined, name, undefined, undefined, undefined)
     }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
     let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name, Cloner$ReventlessCore.componentType, "Identity", undefined, undefined, undefined, undefined, undefined), opts);
     let lambda = new (Aws.lambda.Function)(name, {

package/src/util/Util_DeadLetterQueue.res

@@ -4,11 +4,20 @@ open PulumiAws
 let name = "DeadLetterQueue"
 let nameFifo = "FIFO" ++ name
 
+let queueTags = queueName =>
+  AWS.Tags.make(
+    ~name=queueName,
+    ~kind=ReventlessCore.ComponentType.Plugin,
+    ~role=DeadLetter,
+    ~scope=Plugin,
+  )
+
 let queue = SQS.Queue.make(
   ~name,
   ~args={
     SQS.Queue.visibilityTimeoutSeconds: 180->Pulumi.Input.make,
     sqsManagedSseEnabled: false->Pulumi.Input.make,
+    tags: queueTags(name),
   },
 )
 
@@ -19,6 +28,7 @@ let fifoQueue = SQS.Queue.make(
     contentBasedDeduplication: true->Pulumi.Input.make,
     visibilityTimeoutSeconds: 180->Pulumi.Input.make,
     sqsManagedSseEnabled: false->Pulumi.Input.make,
+    tags: queueTags(nameFifo),
   },
 )
 
@@ -89,11 +99,26 @@ ReventlessCore.Monitoring.notify(
 
 let lambda = handler->Pulumi.Output.make
 
-let _subscription = Util_EventSourceMapping.subscribeSqs(~lambda, ~name, ~queue, ~opts)
+let esmTags = esmName =>
+  AWS.Tags.make(
+    ~name=esmName,
+    ~kind=ReventlessCore.ComponentType.Plugin,
+    ~role=EventSourceMapping,
+    ~scope=Plugin,
+  )
+
+let _subscription = Util_EventSourceMapping.subscribeSqs(
+  ~lambda,
+  ~name,
+  ~queue,
+  ~tags=esmTags(name),
+  ~opts,
+)
 let _fifoSubscription = Util_EventSourceMapping.subscribeSqs(
   ~lambda,
   ~name=nameFifo,
   ~queue=fifoQueue,
+  ~tags=esmTags(nameFifo),
   ~opts,
 )
 let createQueuePolicyDocument = (name, queueArn: string, handlerArn: string) => {
@@ -122,7 +147,7 @@ let createQueuePolicyDocument = (name, queueArn: string, handlerArn: string) =>
 let _ =
   (queue.id, queue.arn, fifoQueue.id, fifoQueue.arn, handler.arn)
   ->Pulumi.Output.all5
-  ->Pulumi.Output.apply(((queueId, queueArn, fifoQueueId, fifoQueueArn, handlerArn)) => {
+  ->Pulumi.Output.apply(((_queueId, queueArn, _fifoQueueId, fifoQueueArn, handlerArn)) => {
     let lambdaPolicyDocument = PulumiAws.PolicyDocument.make(
       ~id=name ++ "SQSPolicy",
       ~statements=[
@@ -152,10 +177,20 @@ let _ =
       ~opts,
     )
 
+    // `queueUrl` takes the queue's Output, not the resolved `queueId` string:
+    // that is what registers the policy -> queue dependency, without which
+    // Pulumi has no ordering constraint and can delete the queue first on a
+    // replacement, leaving the policy's delete polling a queue that is gone.
+    //
+    // Unlike the channel helpers, these two stay inside the apply. This module
+    // creates its resources at import time and this apply resolves late enough
+    // to race Jest's teardown; reshaping it (dropping the now-unused ids to
+    // narrow the tuple) shifts that timing and crashes the AWS unit suites, so
+    // `_queueId` / `_fifoQueueId` are deliberately kept.
     let _attachQueuePolicy = PulumiAws.SQS.QueuePolicy.make(
       ~name,
       ~args={
-        queueUrl: queueId->Pulumi.Input.make,
+        queueUrl: queue.id->Pulumi.Output.asInput,
         policy: createQueuePolicyDocument(name, queueArn, handlerArn),
       },
       ~opts=Some(opts),
@@ -163,7 +198,7 @@ let _ =
     let _attachFifoQueuePolicy = PulumiAws.SQS.QueuePolicy.make(
       ~name=nameFifo,
       ~args={
-        queueUrl: fifoQueueId->Pulumi.Input.make,
+        queueUrl: fifoQueue.id->Pulumi.Output.asInput,
         policy: createQueuePolicyDocument(nameFifo, fifoQueueArn, handlerArn),
       },
       ~opts=Some(opts),

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -17,7 +17,12 @@ let name = "DeadLetterQueue";
 
 let nameFifo = "FIFO" + name;
 
+function queueTags(queueName) {
+  return AWS_Tags$ReventlessAws.make(queueName, "Plugin", "DeadLetter", "Plugin", undefined, undefined, undefined, undefined);
+}
+
 let queue = new (Aws.sqs.Queue)(name, {
+  tags: queueTags(name),
   visibilityTimeoutSeconds: 180,
   sqsManagedSseEnabled: false
 });
@@ -25,6 +30,7 @@ let queue = new (Aws.sqs.Queue)(name, {
 let fifoQueue = new (Aws.sqs.Queue)(nameFifo, {
   contentBasedDeduplication: true,
   fifoQueue: true,
+  tags: queueTags(nameFifo),
   visibilityTimeoutSeconds: 180,
   sqsManagedSseEnabled: false
 });
@@ -73,9 +79,13 @@ Monitoring$ReventlessCore.notify("DeadLetterSink", name, Util_Lambda$ReventlessA
 
 let lambda = Pulumi.output(handler);
 
-let _subscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, opts);
+function esmTags(esmName) {
+  return AWS_Tags$ReventlessAws.make(esmName, "Plugin", "EventSourceMapping", "Plugin", undefined, undefined, undefined, undefined);
+}
+
+let _subscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, esmTags(name), opts);
 
-let _fifoSubscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, nameFifo, fifoQueue, undefined, opts);
+let _fifoSubscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, nameFifo, fifoQueue, undefined, esmTags(nameFifo), opts);
 
 function createQueuePolicyDocument(name, queueArn, handlerArn) {
   return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
@@ -132,17 +142,18 @@ Pulumi.all([
   }, opts);
   new (Aws.sqs.QueuePolicy)(name, {
     policy: createQueuePolicyDocument(name, queueArn, handlerArn),
-    queueUrl: param[0]
+    queueUrl: queue.id
   }, opts);
   new (Aws.sqs.QueuePolicy)(nameFifo, {
     policy: createQueuePolicyDocument(nameFifo, fifoQueueArn, handlerArn),
-    queueUrl: param[2]
+    queueUrl: fifoQueue.id
   }, opts);
 });
 
 export {
   name,
   nameFifo,
+  queueTags,
   queue,
   fifoQueue,
   opts,
@@ -154,6 +165,7 @@ export {
   layers,
   handler,
   lambda,
+  esmTags,
   _subscription,
   _fifoSubscription,
   createQueuePolicyDocument,

package/src/util/Util_EventSourceMapping.res

@@ -1,11 +1,16 @@
 open PulumiAws
 
+// `~tags` is required rather than optional: an EventSourceMapping is created by
+// several unrelated adapters, and an optional argument is exactly how the last
+// coverage sweep left these bare. Making the caller name the owning piece is the
+// regression guard — the same reasoning as `makeFromCodeAsset`'s `~componentKind`.
 let subscribe = (
   ~batchSize=?,
   ~lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
   ~targetName,
   ~sourceName,
   ~source: ReventlessInfra.Adapter.resource,
+  ~tags: Pulumi.Input.t<Aws.tags>,
   ~opts,
 ) =>
   EventSourceMapping.make(
@@ -17,6 +22,7 @@ let subscribe = (
       eventSourceArn: source.urn->Pulumi.Output.asInput,
       startingPosition: LATEST,
       ?batchSize,
+      tags,
     },
     ~opts=Some(opts),
   )
@@ -26,6 +32,7 @@ let subscribeSqs = (
   ~name,
   ~queue: PulumiAws.SQS.Queue.t,
   ~batchSize=?,
+  ~tags: Pulumi.Input.t<Aws.tags>,
   ~opts,
 ) => {
   let esm = EventSourceMapping.make(
@@ -36,6 +43,7 @@ let subscribeSqs = (
       ->Pulumi.Output.asInput,
       eventSourceArn: queue.arn->Pulumi.Output.asInput,
       ?batchSize,
+      tags,
     },
     ~opts=Some(opts),
   )

package/src/util/Util_EventSourceMapping.res.mjs

@@ -7,20 +7,22 @@ import * as AWS$ReventlessAws from "../adapter/AWS.res.mjs";
 import * as Util$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util.res.mjs";
 import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
 
-function subscribe(batchSize, lambda, targetName, sourceName, source, opts) {
+function subscribe(batchSize, lambda, targetName, sourceName, source, tags, opts) {
   return new (Aws.lambda.EventSourceMapping)(Util$ReventlessCore.baseName(sourceName) + ("2" + targetName), {
     functionName: Output$Pulumi.flatMap(lambda, lambda => lambda.arn),
     batchSize: batchSize,
     eventSourceArn: source.urn,
-    startingPosition: "LATEST"
+    startingPosition: "LATEST",
+    tags: tags
   }, opts);
 }
 
-function subscribeSqs(lambda, name, queue, batchSize, opts) {
+function subscribeSqs(lambda, name, queue, batchSize, tags, opts) {
   let esm = new (Aws.lambda.EventSourceMapping)(name, {
     functionName: Output$Pulumi.flatMap(lambda, lambda => lambda.arn),
     batchSize: batchSize,
-    eventSourceArn: queue.arn
+    eventSourceArn: queue.arn,
+    tags: tags
   }, opts);
   return Adapter$ReventlessInfra.make(esm.id, esm.id, esm.arn, esm.id.apply(param => AWS$ReventlessAws.SQS.service), undefined, undefined, undefined, Pulumi.output("aws:lambda:EventSourceMapping"), undefined, undefined);
 }

package/tests/CommandTopicQueuePolicyTest.res

@@ -0,0 +1,65 @@
+open JestGlobals
+
+// Guards the CommandTopic queue policy's service-principal scoping. The
+// EventBridge grant cannot name a single rule ARN — ScheduledPublisher creates
+// rules at runtime and EventBridge authorises SQS targets against the queue's
+// resource policy — so the condition keys are the only bound on who may send
+// into a command topic. A dropped condition is invisible at deploy time.
+
+let queueArn = "arn:aws:sqs:eu-west-1:123456789012:CatalogAggrCmdTopic-5150050"
+let lambdaArn = "arn:aws:lambda:eu-west-1:123456789012:function:AllAggregates-1a2b3c4"
+
+let policy =
+  CommandTopicChannel_Helpers.createQueuePolicyDocument(
+    ~name="CatalogAggrCmdTopic",
+    ~queueArn,
+    ~lambdaArn,
+  )->JSON.parseOrThrow
+
+let field = (json, key) =>
+  json->JSON.Decode.object->Option.flatMap(o => o->Dict.get(key))
+
+let statement = sid =>
+  policy
+  ->field("Statement")
+  ->Option.flatMap(JSON.Decode.array)
+  ->Option.getOr([])
+  ->Array.find(s => s->field("Sid")->Option.flatMap(JSON.Decode.string) == Some(sid))
+
+let condition = (sid, operator, key) =>
+  statement(sid)
+  ->Option.flatMap(s => s->field("Condition"))
+  ->Option.flatMap(c => c->field(operator))
+  ->Option.flatMap(o => o->field(key))
+  ->Option.flatMap(JSON.Decode.string)
+
+describe("CommandTopic queue policy — EventBridge grant", () => {
+  testSync("is scoped to this account", () => {
+    expect(
+      condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount"),
+    )->toEqual(Some("123456789012"))
+  })
+
+  testSync("is scoped to EventBridge rule ARNs in this account", () => {
+    expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn"))->toEqual(
+      Some("arn:aws:events:*:123456789012:rule/*"),
+    )
+  })
+
+  testSync("names the EventBridge service principal", () => {
+    let principal =
+      statement("AllowCloudWatchEventsToSendToQueue")
+      ->Option.flatMap(s => s->field("Principal"))
+      ->Option.flatMap(p => p->field("Service"))
+      ->Option.flatMap(JSON.Decode.string)
+    expect(principal)->toEqual(Some("events.amazonaws.com"))
+  })
+})
+
+describe("CommandTopic queue policy — Lambda grant", () => {
+  testSync("stays pinned to the consuming function ARN", () => {
+    expect(condition("AllowLambdaToAccessQueue", "ArnEquals", "AWS:SourceArn"))->toEqual(
+      Some(lambdaArn),
+    )
+  })
+})

package/tests/CommandTopicQueuePolicyTest.res.mjs

@@ -0,0 +1,53 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as CommandTopicChannel_Helpers$ReventlessAws from "../src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs";
+
+let queueArn = "arn:aws:sqs:eu-west-1:123456789012:CatalogAggrCmdTopic-5150050";
+
+let lambdaArn = "arn:aws:lambda:eu-west-1:123456789012:function:AllAggregates-1a2b3c4";
+
+let policy = JSON.parse(CommandTopicChannel_Helpers$ReventlessAws.createQueuePolicyDocument("CatalogAggrCmdTopic", queueArn, lambdaArn));
+
+function field(json, key) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => o[key]);
+}
+
+function statement(sid) {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(field(policy, "Statement"), Stdlib_JSON.Decode.array), []).find(s => Primitive_object.equal(Stdlib_Option.flatMap(field(s, "Sid"), Stdlib_JSON.Decode.string), sid));
+}
+
+function condition(sid, operator, key) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement(sid), s => field(s, "Condition")), c => field(c, operator)), o => field(o, key)), Stdlib_JSON.Decode.string);
+}
+
+globalThis.describe("CommandTopic queue policy — EventBridge grant", () => {
+  globalThis.test("is scoped to this account", () => {
+    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "StringEquals", "aws:SourceAccount")).toEqual("123456789012");
+  });
+  globalThis.test("is scoped to EventBridge rule ARNs in this account", () => {
+    globalThis.expect(condition("AllowCloudWatchEventsToSendToQueue", "ArnLike", "aws:SourceArn")).toEqual("arn:aws:events:*:123456789012:rule/*");
+  });
+  globalThis.test("names the EventBridge service principal", () => {
+    let principal = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(statement("AllowCloudWatchEventsToSendToQueue"), s => field(s, "Principal")), p => field(p, "Service")), Stdlib_JSON.Decode.string);
+    globalThis.expect(principal).toEqual("events.amazonaws.com");
+  });
+});
+
+globalThis.describe("CommandTopic queue policy — Lambda grant", () => {
+  globalThis.test("stays pinned to the consuming function ARN", () => {
+    globalThis.expect(condition("AllowLambdaToAccessQueue", "ArnEquals", "AWS:SourceArn")).toEqual(lambdaArn);
+  });
+});
+
+export {
+  queueArn,
+  lambdaArn,
+  policy,
+  field,
+  statement,
+  condition,
+}
+/* policy Not a pure module */

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -559,6 +559,56 @@ describe("Runtime.toItem — tag_composite is keyed on the event's entity tags",
   })
 })
 
+describe("Runtime.toItem — an empty tag value skips its GSI attribute", () => {
+  // `tag_<key>` is a GSI hash key, and DynamoDB rejects an empty string for a key
+  // attribute — writing one fails the whole append. An empty value is legitimate
+  // (an absent composite-partition member), so the attribute is skipped and that
+  // index goes sparse. See docs/plans/dcb-empty-tag-values-break-append.md.
+  let tagOf = (key, value): Reventless.DcbTag.tag => {key, value}
+  let tags = [tagOf("environment", "prod"), tagOf("componentName", "")]
+  let storedEvent: ReventlessCore.DcbEventLog_Adapter.rawStoredEvent = {
+    eventType: "ResourceAdded",
+    data: JSON.Object(Dict.make()),
+    tags,
+    meta: testMeta(),
+  }
+  let item =
+    Runtime.toItem("100", storedEvent, ~recordedAt="2026-07-08T00:00:00Z")
+    ->JSON.Decode.object
+    ->Option.getOrThrow
+
+  testSync("the non-empty tag keeps its attribute", () => {
+    expect(item->Dict.get("tag_environment"))->toEqual(Some("prod"->JSON.Encode.string))
+  })
+
+  testSync("the empty tag has no attribute at all", () => {
+    expect(item->Dict.get("tag_componentName"))->toEqual(None)
+  })
+
+  testSync("tag_composite still carries both tags", () => {
+    expect(item->Dict.get("tag_composite"))->toEqual(
+      Some(Runtime.compositeTagKey(tags)->JSON.Encode.string),
+    )
+  })
+
+  testSync("the tags payload records the empty value verbatim", () => {
+    let payloadTags =
+      item
+      ->Dict.get("tags")
+      ->Option.flatMap(JSON.Decode.array)
+      ->Option.getOrThrow
+      ->Array.filterMap(t =>
+        t
+        ->JSON.Decode.object
+        ->Option.map(o => (
+          o->Dict.get("key")->Option.flatMap(JSON.Decode.string)->Option.getOr(""),
+          o->Dict.get("value")->Option.flatMap(JSON.Decode.string)->Option.getOr("!missing"),
+        ))
+      )
+    expect(payloadTags)->toEqual([("environment", "prod"), ("componentName", "")])
+  })
+})
+
 describe("Runtime.buildConditionalTransactItems — folded create guard (after=None)", () => {
   let event = (eventType, tags): ReventlessCore.DcbEventLog_Adapter.rawStoredEvent => {
     eventType,

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res.mjs

@@ -690,6 +690,53 @@ globalThis.describe("Runtime.toItem — tag_composite is keyed on the event's en
   });
 });
 
+globalThis.describe("Runtime.toItem — an empty tag value skips its GSI attribute", () => {
+  let tags = [
+    {
+      key: "environment",
+      value: "prod"
+    },
+    {
+      key: "componentName",
+      value: ""
+    }
+  ];
+  let storedEvent_data = {};
+  let storedEvent_meta = testMeta();
+  let storedEvent = {
+    eventType: "ResourceAdded",
+    data: storedEvent_data,
+    tags: tags,
+    meta: storedEvent_meta
+  };
+  let item = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.toItem("100", storedEvent, undefined, "2026-07-08T00:00:00Z")), undefined);
+  globalThis.test("the non-empty tag keeps its attribute", () => {
+    globalThis.expect(item["tag_environment"]).toEqual("prod");
+  });
+  globalThis.test("the empty tag has no attribute at all", () => {
+    globalThis.expect(item["tag_componentName"]).toEqual(undefined);
+  });
+  globalThis.test("tag_composite still carries both tags", () => {
+    globalThis.expect(item["tag_composite"]).toEqual(DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.compositeTagKey(tags));
+  });
+  globalThis.test("the tags payload records the empty value verbatim", () => {
+    let payloadTags = Stdlib_Array.filterMap(Stdlib_Option.getOrThrow(Stdlib_Option.flatMap(item["tags"], Stdlib_JSON.Decode.array), undefined), t => Stdlib_Option.map(Stdlib_JSON.Decode.object(t), o => [
+      Stdlib_Option.getOr(Stdlib_Option.flatMap(o["key"], Stdlib_JSON.Decode.string), ""),
+      Stdlib_Option.getOr(Stdlib_Option.flatMap(o["value"], Stdlib_JSON.Decode.string), "!missing")
+    ]));
+    globalThis.expect(payloadTags).toEqual([
+      [
+        "environment",
+        "prod"
+      ],
+      [
+        "componentName",
+        ""
+      ]
+    ]);
+  });
+});
+
 globalThis.describe("Runtime.buildConditionalTransactItems — folded create guard (after=None)", () => {
   let event = (eventType, tags) => ({
     eventType: eventType,

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res

@@ -458,3 +458,61 @@ describe("DCB DynamoDb integration — per-type fence granularity", () => {
     expect(conflicts >= 1)->toBe(true)
   })
 })
+
+// An empty tag value is a legitimate model state (an absent member of a composite
+// partition key), and the in-memory and SQLite backends have always accepted one.
+// DynamoDB used to reject the whole append: `tag_<key>` is a GSI hash key and a key
+// attribute cannot hold an empty string. The adapter now skips that one attribute,
+// leaving the index sparse — everything else about the event is unchanged.
+// See docs/plans/dcb-empty-tag-values-break-append.md.
+describe("DCB DynamoDb integration — an empty tag value does not break the append", () => {
+  let tags = [tag("orderId", "O-empty"), tag("customerId", "")]
+
+  testAsync("appends, and reads back through its partition with the tag intact", async () => {
+    let table = await H.freshTable()
+    let result = await Runtime.appendConditional(
+      table,
+      [event("OrderPlaced", tags)],
+      {query: [{tags: tags}], after: ?None},
+      ~partitionTag=simple("orderId"),
+    )
+    expect(isOk(result))->toBe(true)
+
+    let byPartition = await Runtime.read(table)(~query=[{tags: [tag("orderId", "O-empty")]}])
+    expect(byPartition.events->Array.length)->toBe(1)
+    let stored = byPartition.events->Array.getUnsafe(0)
+    expect(stored.eventType)->toBe("OrderPlaced")
+    // The event records the empty value verbatim — only the index skips it.
+    expect(stored.tags->Array.map(t => (t.key, t.value)))->toEqual([
+      ("orderId", "O-empty"),
+      ("customerId", ""),
+    ])
+  })
+
+  testAsync("is found by a composite (multi-tag) read", async () => {
+    let table = await H.freshTable()
+    let _ = await Runtime.appendUnconditional(
+      table,
+      [event("OrderPlaced", tags)],
+      ~partitionTag=simple("orderId"),
+    )
+    let composite = await Runtime.read(table)(~query=[{tags: tags}])
+    expect(composite.events->Array.length)->toBe(1)
+  })
+
+  testAsync("is absent from that tag's single-tag index rather than erroring", async () => {
+    let table = await H.freshTable()
+    let _ = await Runtime.appendUnconditional(
+      table,
+      [event("OrderPlaced", tags)],
+      ~partitionTag=simple("orderId"),
+    )
+    // A cross-partition read goes through the `tag_customerId` GSI, which carries
+    // no empty-valued key. DynamoDB would reject the key condition outright, so the
+    // adapter short-circuits: empty result, no exception.
+    let crossPartition = await Runtime.read(table, ~crossPartitionTagKeys=["customerId"])(
+      ~query=[{tags: [tag("customerId", "")]}],
+    )
+    expect(crossPartition.events->Array.length)->toBe(0)
+  })
+})

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res.mjs

@@ -563,6 +563,84 @@ globalThis.describe("DCB DynamoDb integration — per-type fence granularity", (
   });
 });
 
+globalThis.describe("DCB DynamoDb integration — an empty tag value does not break the append", () => {
+  let tags = [
+    {
+      key: "orderId",
+      value: "O-empty"
+    },
+    {
+      key: "customerId",
+      value: ""
+    }
+  ];
+  globalThis.test("appends, and reads back through its partition with the tag intact", async () => {
+    let table = await DcbIntegrationHarness$ReventlessAws.freshTable();
+    let result = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.appendConditional(table, [event("OrderPlaced", tags)], {
+      query: [{
+          tags: tags
+        }]
+    }, {
+      TAG: "Simple",
+      _0: {
+        key: "orderId"
+      }
+    }, undefined);
+    globalThis.expect(isOk(result)).toBe(true);
+    let byPartition = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.read(table, undefined)([{
+        tags: [{
+            key: "orderId",
+            value: "O-empty"
+          }]
+      }], undefined);
+    globalThis.expect(byPartition.events.length).toBe(1);
+    let stored = byPartition.events[0];
+    globalThis.expect(stored.eventType).toBe("OrderPlaced");
+    globalThis.expect(stored.tags.map(t => [
+      t.key,
+      t.value
+    ])).toEqual([
+      [
+        "orderId",
+        "O-empty"
+      ],
+      [
+        "customerId",
+        ""
+      ]
+    ]);
+  });
+  globalThis.test("is found by a composite (multi-tag) read", async () => {
+    let table = await DcbIntegrationHarness$ReventlessAws.freshTable();
+    await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.appendUnconditional(table, [event("OrderPlaced", tags)], {
+      TAG: "Simple",
+      _0: {
+        key: "orderId"
+      }
+    });
+    let composite = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.read(table, undefined)([{
+        tags: tags
+      }], undefined);
+    globalThis.expect(composite.events.length).toBe(1);
+  });
+  globalThis.test("is absent from that tag's single-tag index rather than erroring", async () => {
+    let table = await DcbIntegrationHarness$ReventlessAws.freshTable();
+    await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.appendUnconditional(table, [event("OrderPlaced", tags)], {
+      TAG: "Simple",
+      _0: {
+        key: "orderId"
+      }
+    });
+    let crossPartition = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.read(table, ["customerId"])([{
+        tags: [{
+            key: "customerId",
+            value: ""
+          }]
+      }], undefined);
+    globalThis.expect(crossPartition.events.length).toBe(0);
+  });
+});
+
 let H;
 
 let Runtime;