@reventlessdev/reventless-aws 3.0.0-alpha.224 → 3.0.0-alpha.226

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.226 (2026-07-23)
+
+### Bug Fixes
+
+* **aws:** round-trip the DynamoDB Scan cursor in full-list connections ([0e21008](https://github.com/ReventlessDev/reventless-core/commit/0e2100860767a153a5c2f50a88fd6b501787c7f4))
+
+
+# 3.0.0-alpha.225 (2026-07-22)
+
+### Bug Fixes
+
+* **aws:** keep an empty DCB tag value from breaking the append ([1c0ab40](https://github.com/ReventlessDev/reventless-core/commit/1c0ab40f25b596702a81f42686d77c5e423e9b44))
+* **aws:** key the disconnect schedule's rule name to the stack, not the Lambda ([05aebcf](https://github.com/ReventlessDev/reventless-core/commit/05aebcfacac34fd9c7cb42f353ee91e20066067e))
+* **aws:** tag every taggable resource the framework still left bare ([d4f7a90](https://github.com/ReventlessDev/reventless-core/commit/d4f7a908bcaf686ff59a85e300efac4e5e6199df))
+
+
 # 3.0.0-alpha.224 (2026-07-22)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.224",
+  "version": "3.0.0-alpha.226",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,14 +11,14 @@
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.24",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.30",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.57",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
-    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.59",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.104",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.177",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.43",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.179",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.80",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.41"
+    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/AWS_Tags.res

@@ -103,6 +103,42 @@ let makeDict = (
   ]->Dict.fromArray
 }
 
+/***
+Framework-created AWS resource types that carry NO attribution tags, and why.
+Keep this list here rather than in a plan: it is what tells a coverage audit
+whether a bare resource is a gap to close or a fact to work around.
+
+**Cannot be tagged** — the provider type exposes no `tags` property at all
+(verified against `@pulumi/aws` 7.19.0; re-verify on a major provider bump, since
+AWS does add tag support over time — `lambda/eventSourceMapping` gained it after
+the first sweep and is now tagged):
+
+    aws:appsync/dataSource        aws:appsync/resolver (incl. aws-native)
+    aws:appsync/function          aws:appsync/sourceApiAssociation
+    aws:iam/rolePolicy            aws:iam/rolePolicyAttachment
+    aws:sqs/queuePolicy           aws:sns/topicSubscription
+    aws:lambda/permission         aws:lambda/invocation
+    aws:cloudwatch/logMetricFilter aws:cloudwatch/eventTarget
+    aws:s3/bucketPolicy           aws:s3/bucketPublicAccessBlock
+    aws:cloudfront/originAccessControl
+    aws:cognito/userPoolClient    aws:cognito/userGroup
+    aws:route53/record            aws:acm/certificateValidation
+    aws:ses/emailIdentity         aws:ses/identityPolicy
+
+Each is attributable only through its parent (function, log group, API, role,
+bucket, pool, certificate) — i.e. structurally, by URN ancestry. A consumer that
+treats "carries `reventless:*` tags" as universal will be wrong about every row
+above, and no amount of coverage work changes that. Note the ReScript binding for
+`IAM.RolePolicy` carries a `tags?` field that AWS ignores; do not read its
+presence as tag support.
+
+**Taggable, deliberately untagged** — `aws:s3/bucketObject`. Static-bundle assets
+are bucket *contents*, not infrastructure: they are fully attributed by the
+bucket that holds them, and S3 bills object tags per object per month, so tagging
+a few hundred bundle files would cost money to restate a fact the parent already
+carries.
+*/
+
 /**
 The same schema as `makeDict`, wrapped as a Pulumi input — what nearly every
 resource's `tags` field expects. Use `makeDict` only for the bindings that take

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res

@@ -211,4 +211,15 @@ let createLambdaPolicy = (
 }
 
 let subscribeLambda2SqsTopic = (~batchSize=?, lambda, name, queue, opts) =>
-  Util_EventSourceMapping.subscribeSqs(~lambda, ~name, ~queue, ~batchSize?, ~opts)
+  Util_EventSourceMapping.subscribeSqs(
+    ~lambda,
+    ~name,
+    ~queue,
+    ~batchSize?,
+    ~tags=AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.CommandTopic.componentType,
+      ~role=EventSourceMapping,
+    ),
+    ~opts,
+  )

package/src/adapter/CommandTopic/CommandTopicChannel_Helpers.res.mjs

@@ -6,8 +6,10 @@ import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
 
@@ -146,7 +148,7 @@ function createLambdaPolicy(lambdaRole, name, queue, resources, opts) {
 }
 
 function subscribeLambda2SqsTopic(batchSize, lambda, name, queue, opts) {
-  return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, batchSize, opts);
+  return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, batchSize, AWS_Tags$ReventlessAws.make(name, CommandTopic$ReventlessCore.componentType, "EventSourceMapping", undefined, undefined, undefined, undefined, undefined), opts);
 }
 
 export {

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res

@@ -77,6 +77,12 @@ let make: ReventlessCore.Counter_Adapter.handlerMaker = (
       ~targetName=name,
       ~sourceName,
       ~source,
+      ~tags=AWS.Tags.make(
+        ~name=sourceName->ReventlessCore.Util.baseName ++ ("2" ++ name),
+        ~kind=ReventlessCore.ComponentType.Counter,
+        ~role=EventSourceMapping,
+        ~component=name,
+      ),
       ~opts,
     )
 

package/src/adapter/Counter/CounterHandler_DynamoDbStream.res.mjs

@@ -2,6 +2,8 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Util$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_DynamoDbStream$ReventlessAws from "../../util/Util_DynamoDbStream.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
@@ -42,7 +44,7 @@ function make(name, referencesName, referencesDb, countsName, countsDb, param, s
     _0: "Counter"
   }, "Counter", match.code, match.sourceCodeHash, envVars, 1024, 30, undefined, undefined, undefined, undefined, undefined, componentOpts);
   let lambda = runtime.parts.lambda;
-  let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, opts);
+  let subscribe = (sourceName, source) => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, sourceName, source, AWS_Tags$ReventlessAws.make(Util$ReventlessCore.baseName(sourceName) + ("2" + name), "Counter", "EventSourceMapping", undefined, name, undefined, undefined, undefined), opts);
   subscribe(referencesName, referencesStream);
   subscribe(countsName, countsStream);
   return {

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res

@@ -118,11 +118,19 @@ let toItem = (
   ->ReventlessCore.Message.decomposeMeta
   ->Array.forEach(((k, v)) => item->Dict.set(k, v))
 
-  // Add individual tag attributes for GSI queries
-  event.tags->Array.forEach(tag => {
-    let attrName = tagToAttributeName(tag.key)
-    item->Dict.set(attrName, tag.value->JSON.Encode.string)
-  })
+  // Add individual tag attributes for GSI queries. An empty tag value is a
+  // legitimate model state (a composite-partition member that is absent at this
+  // level of the hierarchy), but `tag_<key>` is a GSI hash key and DynamoDB
+  // rejects an empty string for a key attribute — the whole append fails. Skip
+  // the attribute instead: the index goes sparse (its intended mechanism), the
+  // event still records the tag in its `tags` payload, and `tag_composite`, the
+  // partition key and the OCC fences are all unaffected.
+  event.tags->Array.forEach(tag =>
+    if tag.value != "" {
+      let attrName = tagToAttributeName(tag.key)
+      item->Dict.set(attrName, tag.value->JSON.Encode.string)
+    }
+  )
 
   // Add composite tag attribute if multiple tags. The tag set here is exactly the
   // event's *entity* tags (no framework provenance tag is smuggled in — see
@@ -370,7 +378,7 @@ let resolveBaseItem = (table: resolvedTable, keyItem: JSON.t): Effect.t<
     }
   }
 
-let queryBySingleTagCrossPartitionStream = (
+let queryBySingleTagCrossPartitionStreamIndexed = (
   table: resolvedTable,
   tag: Reventless.DcbTag.tag,
   ~after: option<string>=?,
@@ -419,6 +427,21 @@ let queryBySingleTagCrossPartitionStream = (
   )
 }
 
+let queryBySingleTagCrossPartitionStream = (
+  table: resolvedTable,
+  tag: Reventless.DcbTag.tag,
+  ~after: option<string>=?,
+) =>
+  if tag.value == "" {
+    // `toItem` does not index an empty tag value (a GSI hash key cannot hold an
+    // empty string), so nothing carries it in this index. Querying for it would
+    // be rejected outright too — a key condition value cannot be empty either.
+    // The empty result is the honest answer; an exception is not.
+    Stream.empty
+  } else {
+    queryBySingleTagCrossPartitionStreamIndexed(table, tag, ~after?)
+  }
+
 // --- Query Item Execution ---
 
 let executeQueryItem = async (

package/src/adapter/DcbEventLog/DcbEventLogStorage_DynamoDb_Runtime.res.mjs

@@ -103,6 +103,9 @@ function toItem(position, event, partitionTag, recordedAt) {
     item[param[0]] = param[1];
   });
   event.tags.forEach(tag => {
+    if (tag.value === "") {
+      return;
+    }
     let attrName = tagToAttributeName(tag.key);
     item[attrName] = tag.value;
   });
@@ -281,7 +284,7 @@ function resolveBaseItem(table, keyItem) {
   }))), DynamoDb_Error$ReventlessAws.retrySchedule), err => Effect$1.fail(DynamoDb_Error$ReventlessAws.message(err))), result => result.Item);
 }
 
-function queryBySingleTagCrossPartitionStream(table, tag, after) {
+function queryBySingleTagCrossPartitionStreamIndexed(table, tag, after) {
   let indexName = tagToAttributeName(tag.key);
   let expressionAttributeValues = Object.fromEntries([[
       ":val",
@@ -326,6 +329,14 @@ function queryBySingleTagCrossPartitionStream(table, tag, after) {
   });
 }
 
+function queryBySingleTagCrossPartitionStream(table, tag, after) {
+  if (tag.value === "") {
+    return Stream$1.empty;
+  } else {
+    return queryBySingleTagCrossPartitionStreamIndexed(table, tag, after);
+  }
+}
+
 async function executeQueryItem(table, queryItem, after, crossPartitionTagKeysOpt) {
   let crossPartitionTagKeys = crossPartitionTagKeysOpt !== undefined ? crossPartitionTagKeysOpt : [];
   let tags = queryItem.tags;
@@ -1164,6 +1175,7 @@ export {
   buildQueryByPartitionKeyInput,
   queryByPartitionKey,
   resolveBaseItem,
+  queryBySingleTagCrossPartitionStreamIndexed,
   queryBySingleTagCrossPartitionStream,
   executeQueryItem,
   deduplicateByPosition,

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res

@@ -98,6 +98,17 @@ let connectSqsQueue2SnsTopics = (queue: PulumiAws.SQS.Queue.t, name, eventTopics
     })
 }
 
+// The EventCollector's transport wiring: one mapping per stream source plus one
+// per buffer queue. `~component=name` keeps them attributed to the collector they
+// feed, not to the mapping's own generated name.
+let esmTags = (name, esmName) =>
+  AWS.Tags.make(
+    ~name=esmName,
+    ~kind=ReventlessCore.EventCollector.componentType,
+    ~role=EventSourceMapping,
+    ~component=name,
+  )
+
 let connectLambda = (
   lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
   name: string,
@@ -254,6 +265,10 @@ let connectLambda = (
             ~targetName=name,
             ~sourceName=dynamoDbStreamResource.name,
             ~source=dynamoDbStreamResource->ReventlessCore.AdapterDeploytime.resolvedToResource,
+            ~tags=esmTags(
+              name,
+              dynamoDbStreamResource.name->ReventlessCore.Util.baseName ++ ("2" ++ name),
+            ),
             ~opts,
           )
         )
@@ -261,7 +276,13 @@ let connectLambda = (
 
   let subscriptionResources = queues->Array.mapWithIndex((queue, idx) => {
     let esmName = queues->Array.length > 1 ? `${name}Sqs${Int.toString(idx)}` : name
-    Util_EventSourceMapping.subscribeSqs(~lambda, ~name=esmName, ~queue, ~opts)
+    Util_EventSourceMapping.subscribeSqs(
+      ~lambda,
+      ~name=esmName,
+      ~queue,
+      ~tags=esmTags(name, esmName),
+      ~opts,
+    )
   })
 
   subscriptionResources

package/src/adapter/EventCollector/EventCollectorChannel_Helpers.res.mjs

@@ -5,11 +5,14 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Util$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as Util_SQS$ReventlessAws from "../../util/Util_SQS.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
+import * as EventCollector$ReventlessCore from "@reventlessdev/reventless-core/src/components/EventCollector/EventCollector.res.mjs";
 import * as AdapterDeploytime$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/AdapterDeploytime.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
 
@@ -68,6 +71,10 @@ function connectSqsQueue2SnsTopics(queue, name, eventTopics, opts) {
   });
 }
 
+function esmTags(name, esmName) {
+  return AWS_Tags$ReventlessAws.make(esmName, EventCollector$ReventlessCore.componentType, "EventSourceMapping", undefined, name, undefined, undefined, undefined);
+}
+
 function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources, opts) {
   Pulumi.all([
     toResources(eventTopics),
@@ -141,11 +148,11 @@ function connectLambda(lambda, name, lambdaRole, queues, eventTopics, resources,
       ])),
       role: lambdaRole.id
     }, opts);
-    dynamoDbStreamResources.map(dynamoDbStreamResource => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, dynamoDbStreamResource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(dynamoDbStreamResource), opts));
+    dynamoDbStreamResources.map(dynamoDbStreamResource => Util_EventSourceMapping$ReventlessAws.subscribe(undefined, lambda, name, dynamoDbStreamResource.name, AdapterDeploytime$ReventlessCore.resolvedToResource(dynamoDbStreamResource), esmTags(name, Util$ReventlessCore.baseName(dynamoDbStreamResource.name) + ("2" + name)), opts));
   });
   return queues.map((queue, idx) => {
     let esmName = queues.length > 1 ? name + `Sqs` + idx.toString() : name;
-    return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, esmName, queue, undefined, opts);
+    return Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, esmName, queue, undefined, esmTags(name, esmName), opts);
   });
 }
 
@@ -155,6 +162,7 @@ export {
   createQueuePolicy,
   subscribeQueue2SnsTopic,
   connectSqsQueue2SnsTopics,
+  esmTags,
   connectLambda,
 }
 /* log Not a pure module */

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res

@@ -108,6 +108,12 @@ let make = (
       )
       ->Pulumi.Output.asInput,
       sqsManagedSseEnabled: false->Pulumi.Input.make,
+      tags: AWS.Tags.make(
+        ~name=name ++ "EventLogSubQueue",
+        ~kind=ReventlessCore.EventTopic.componentType,
+        ~role=EventLogSubscription,
+        ~component=name,
+      ),
     },
     ~opts,
   )
@@ -266,6 +272,12 @@ let make = (
     ~lambda=lambdaOutput,
     ~name=name ++ "EventLogSubEventSourceMapping",
     ~queue,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "EventLogSubEventSourceMapping",
+      ~kind=ReventlessCore.EventTopic.componentType,
+      ~role=EventSourceMapping,
+      ~component=name,
+    ),
     ~opts,
   )
 }

package/src/adapter/EventLogSubscription/EventLogSubscription_AppSync.res.mjs

@@ -81,6 +81,7 @@ export async function handler(event) {
 function make(name, topicName, eventTopicOutputs, eventsApi, opts) {
   let queue = new (Aws.sqs.Queue)(name + "EventLogSubQueue", {
     redrivePolicy: Util_DeadLetterQueue$ReventlessAws.queue.arn.apply(dlqArn => SQS_Queue$PulumiAws.RedrivePolicy.make(dlqArn, 5)),
+    tags: AWS_Tags$ReventlessAws.make(name + "EventLogSubQueue", EventTopic$ReventlessCore.componentType, "EventLogSubscription", undefined, name, undefined, undefined, undefined),
     visibilityTimeoutSeconds: 60,
     sqsManagedSseEnabled: false
   }, opts);
@@ -172,7 +173,7 @@ function make(name, topicName, eventTopicOutputs, eventsApi, opts) {
     sourceCodeHash: sourceCodeHash
   }, opts);
   let lambdaOutput = Pulumi.output(lambda);
-  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambdaOutput, name + "EventLogSubEventSourceMapping", queue, undefined, opts);
+  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambdaOutput, name + "EventLogSubEventSourceMapping", queue, undefined, AWS_Tags$ReventlessAws.make(name + "EventLogSubEventSourceMapping", EventTopic$ReventlessCore.componentType, "EventSourceMapping", undefined, name, undefined, undefined, undefined), opts);
 }
 
 export {

package/src/adapter/Postgres/PgProjectionFeed.res

@@ -51,6 +51,14 @@ let makeQueue = (
       )
       ->Pulumi.Output.asInput,
       sqsManagedSseEnabled: false->Pulumi.Input.make,
+      // Plugin substrate: one shared feed per plugin ("AllReadModelsFeed"), not a
+      // resource any single component owns.
+      tags: AWS.Tags.make(
+        ~name,
+        ~kind=ReventlessCore.ComponentType.Plugin,
+        ~role=EventCollector,
+        ~scope=Plugin,
+      ),
     },
     ~opts,
   )
@@ -69,7 +77,18 @@ let connect = (
   ~lambdaRole: PulumiAws.IAM.Role.t,
   ~opts: Pulumi.CustomResourceOptions.t,
 ) => {
-  let _esm = Util_EventSourceMapping.subscribeSqs(~lambda, ~name, ~queue, ~opts)
+  let _esm = Util_EventSourceMapping.subscribeSqs(
+    ~lambda,
+    ~name,
+    ~queue,
+    ~tags=AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.ComponentType.Plugin,
+      ~role=EventSourceMapping,
+      ~scope=Plugin,
+    ),
+    ~opts,
+  )
   let _policy = queue.arn->Pulumi.Output.apply(queueArn => {
     open PulumiAws.PolicyDocument
     PulumiAws.IAM.RolePolicy.make(

package/src/adapter/Postgres/PgProjectionFeed.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Aws from "@pulumi/aws";
 import * as SQS_Queue$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/SQS/SQS_Queue.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_DeadLetterQueue$ReventlessAws from "../../util/Util_DeadLetterQueue.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
@@ -15,6 +16,7 @@ function getFeedQueues() {
 function makeQueue(name, scope, includeClassic, includeDcb, opts) {
   let queue = new (Aws.sqs.Queue)(name, {
     redrivePolicy: Util_DeadLetterQueue$ReventlessAws.queue.arn.apply(dlqArn => SQS_Queue$PulumiAws.RedrivePolicy.make(dlqArn, 5)),
+    tags: AWS_Tags$ReventlessAws.make(name, "Plugin", "EventCollector", "Plugin", undefined, undefined, undefined, undefined),
     visibilityTimeoutSeconds: 120,
     sqsManagedSseEnabled: false
   }, opts);
@@ -29,7 +31,7 @@ function makeQueue(name, scope, includeClassic, includeDcb, opts) {
 }
 
 function connect(name, queue, lambda, lambdaRole, opts) {
-  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, opts);
+  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, AWS_Tags$ReventlessAws.make(name, "Plugin", "EventSourceMapping", "Plugin", undefined, undefined, undefined, undefined), opts);
   queue.arn.apply(queueArn => new (Aws.iam.RolePolicy)(name + `Receive`, {
     policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `ReceivePolicy`, [{
         Sid: "AllowReceiveFeedQueue",

package/src/adapter/Runtime/EventCollectorEntryPoint.mjs

@@ -430,7 +430,11 @@ const importFromAsset = (() => {
 async function buildHandler() {
   const config = parseHandlerConfig(process.env["HANDLER_CONFIG"]);
   const pluginDefinition = loadPluginDefinition();
-  const lambdaFunctionName = process.env["AWS_LAMBDA_FUNCTION_NAME"] || "unknown";
+  // Stack name, not the function name — see PluginExtensionPointEntryPoint for
+  // why the disconnect schedule's rule prefix must not carry a content hash.
+  // Both entry points instantiate the same admin Plugin EP module, so they have
+  // to derive this identically.
+  const environment = process.env["Environment"] || "unknown";
 
   // runtimeOps carries only what the admin EP mapping's callHandler actually
   // needs: sendMessageToChannel for ForwardCommand. Cross-plugin SNS
@@ -496,7 +500,7 @@ async function buildHandler() {
       // Admin's Plugin EP: invoke the Make functor with runtime ops.
       const epModule = mappingsMod.Make({
         runtimeOps,
-        environment: lambdaFunctionName,
+        environment,
         // Connect-driven schema self-heal retired (Phase 4b) — the ApiSchemaPush
         // SideEffect on ApiFragmentRegistry events is the single schema writer.
         updateApiSchema: undefined,

package/src/adapter/Runtime/PluginExtensionPointEntryPoint.mjs

@@ -37,10 +37,17 @@ function buildHandler() {
   // Instantiate Plugin EP mapping. updateApiSchema and manageSubscriptions are
   // admin-only hooks; this Lambda only handles incoming commands (Heartbeat,
   // ForwardCommand) so they stay undefined here.
-  const lambdaFunctionName = process.env["AWS_LAMBDA_FUNCTION_NAME"] || "unknown";
+  //
+  // `environment` prefixes the disconnect schedule's EventBridge rule name, so it
+  // must be stable across deploys and unique per stack. The stack name is both;
+  // AWS_LAMBDA_FUNCTION_NAME is neither — it carries a content hash, so replacing
+  // this Lambda would orphan every outstanding rule the previous generation
+  // created. EventCollectorEntryPoint instantiates the same EP module and must
+  // agree, or one Lambda creates rules the other cannot delete.
+  const environment = process.env["Environment"] || "unknown";
   const pluginModule = pluginEPPluginMake({
     runtimeOps,
-    environment: lambdaFunctionName,
+    environment,
     updateApiSchema: undefined,
     manageSubscriptions: undefined,
   });

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -27,15 +27,21 @@ let make: ReventlessCore.Runtime.environmentMaker<'event, context, 'result, part
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
+  // Legacy path (see above): no component kind reaches here because nothing calls
+  // it, so it is attributed to the Platform rather than to an invented domain kind.
+  let tags = AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Platform, ~role=Runtime, ~scope=Platform)
+
   let lambdaRole = IAM.Role.makeWithDefaultPolicy(
     ~name,
     ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
     ~opts?,
   )
-
-  // Legacy path (see above): no component kind reaches here because nothing calls
-  // it, so it is attributed to the Platform rather than to an invented domain kind.
-  let tags = AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Platform, ~role=Runtime, ~scope=Platform)
   let lambda =
     handler->Pulumi.Output.apply(handler =>
       Lambda.CallbackFunction.make(

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -29,8 +29,8 @@ function make(name, handler, memorySizeOpt, timeoutOpt, opts) {
   let memorySize = memorySizeOpt !== undefined ? memorySizeOpt : 1024;
   let timeout = timeoutOpt !== undefined ? timeoutOpt : 30;
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
-  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), undefined, opts$1);
   let tags = AWS_Tags$ReventlessAws.make(name, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   let lambda = handler.apply(handler => new (Aws.lambda.CallbackFunction)(name, Lambda$PulumiAws.CallbackFunction.Args.make(handler, lambdaRole, undefined, undefined, undefined, memorySize, timeout, undefined, undefined, undefined, tags, undefined), opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined));
   return {
     parts: {

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -410,14 +410,21 @@ let finish = (
     // isolates the bad record across those retries instead of redelivering
     // the whole batch each time.
     entries->Array.forEach(entry => {
+      let esmName = entry.topicName ++ "Stream2" ++ name ++ "StateTopic"
       let _esm = EventSourceMapping.make(
-        ~name=entry.topicName ++ "Stream2" ++ name ++ "StateTopic",
+        ~name=esmName,
         ~args={
           EventSourceMapping.functionName: lambda.arn->Pulumi.Output.asInput,
           eventSourceArn: entry.streamArn->Pulumi.Output.asInput,
           startingPosition: LATEST,
           maximumRetryAttempts: 3,
           bisectBatchOnFunctionError: true,
+          tags: AWS.Tags.make(
+            ~name=esmName,
+            ~kind=ReventlessCore.QueryDb.componentType,
+            ~role=EventSourceMapping,
+            ~component=name,
+          ),
         },
         ~opts=Some(opts),
       )

package/src/adapter/StateTopic/StateTopic_AppSync.res.mjs

@@ -284,12 +284,14 @@ function finish(eventsApi, opts) {
     sourceCodeHash: sourceCodeHash
   }, opts);
   entries.forEach(entry => {
-    new (Aws.lambda.EventSourceMapping)(entry.topicName + "Stream2" + name + "StateTopic", {
+    let esmName = entry.topicName + "Stream2" + name + "StateTopic";
+    new (Aws.lambda.EventSourceMapping)(esmName, {
       functionName: lambda.arn,
       bisectBatchOnFunctionError: true,
       eventSourceArn: entry.streamArn,
       maximumRetryAttempts: 3,
-      startingPosition: "LATEST"
+      startingPosition: "LATEST",
+      tags: AWS_Tags$ReventlessAws.make(esmName, QueryDb$ReventlessCore.componentType, "EventSourceMapping", undefined, name, undefined, undefined, undefined)
     }, opts);
   });
   registry[key] = [];

package/src/plugin/cloner/ClonerRunner_Fargate.res

@@ -209,6 +209,12 @@ export const handler = async (event) => {
           cpu: "1024"->Pulumi.Input.make,
           requiresCompatibilities: ["FARGATE"],
           networkMode: #awsvpc,
+          tags: AWS.Tags.make(
+            ~name,
+            ~kind=ReventlessCore.Cloner.componentType,
+            ~role=DataTransfer,
+            ~component=name,
+          ),
         },
         ~opts?,
       )

package/src/plugin/cloner/ClonerRunner_Fargate.res.mjs

@@ -131,7 +131,8 @@ export const handler = async (event) => {
       memory: "4096",
       networkMode: "awsvpc",
       requiresCompatibilities: ["FARGATE"],
-      executionRoleArn: taskExecutionRole.arn
+      executionRoleArn: taskExecutionRole.arn,
+      tags: AWS_Tags$ReventlessAws.make(name, Cloner$ReventlessCore.componentType, "DataTransfer", undefined, name, undefined, undefined, undefined)
     }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
     let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name, Cloner$ReventlessCore.componentType, "Identity", undefined, undefined, undefined, undefined, undefined), opts);
     let lambda = new (Aws.lambda.Function)(name, {

package/src/util/Util_DeadLetterQueue.res

@@ -4,11 +4,20 @@ open PulumiAws
 let name = "DeadLetterQueue"
 let nameFifo = "FIFO" ++ name
 
+let queueTags = queueName =>
+  AWS.Tags.make(
+    ~name=queueName,
+    ~kind=ReventlessCore.ComponentType.Plugin,
+    ~role=DeadLetter,
+    ~scope=Plugin,
+  )
+
 let queue = SQS.Queue.make(
   ~name,
   ~args={
     SQS.Queue.visibilityTimeoutSeconds: 180->Pulumi.Input.make,
     sqsManagedSseEnabled: false->Pulumi.Input.make,
+    tags: queueTags(name),
   },
 )
 
@@ -19,6 +28,7 @@ let fifoQueue = SQS.Queue.make(
     contentBasedDeduplication: true->Pulumi.Input.make,
     visibilityTimeoutSeconds: 180->Pulumi.Input.make,
     sqsManagedSseEnabled: false->Pulumi.Input.make,
+    tags: queueTags(nameFifo),
   },
 )
 
@@ -89,11 +99,26 @@ ReventlessCore.Monitoring.notify(
 
 let lambda = handler->Pulumi.Output.make
 
-let _subscription = Util_EventSourceMapping.subscribeSqs(~lambda, ~name, ~queue, ~opts)
+let esmTags = esmName =>
+  AWS.Tags.make(
+    ~name=esmName,
+    ~kind=ReventlessCore.ComponentType.Plugin,
+    ~role=EventSourceMapping,
+    ~scope=Plugin,
+  )
+
+let _subscription = Util_EventSourceMapping.subscribeSqs(
+  ~lambda,
+  ~name,
+  ~queue,
+  ~tags=esmTags(name),
+  ~opts,
+)
 let _fifoSubscription = Util_EventSourceMapping.subscribeSqs(
   ~lambda,
   ~name=nameFifo,
   ~queue=fifoQueue,
+  ~tags=esmTags(nameFifo),
   ~opts,
 )
 let createQueuePolicyDocument = (name, queueArn: string, handlerArn: string) => {

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -17,7 +17,12 @@ let name = "DeadLetterQueue";
 
 let nameFifo = "FIFO" + name;
 
+function queueTags(queueName) {
+  return AWS_Tags$ReventlessAws.make(queueName, "Plugin", "DeadLetter", "Plugin", undefined, undefined, undefined, undefined);
+}
+
 let queue = new (Aws.sqs.Queue)(name, {
+  tags: queueTags(name),
   visibilityTimeoutSeconds: 180,
   sqsManagedSseEnabled: false
 });
@@ -25,6 +30,7 @@ let queue = new (Aws.sqs.Queue)(name, {
 let fifoQueue = new (Aws.sqs.Queue)(nameFifo, {
   contentBasedDeduplication: true,
   fifoQueue: true,
+  tags: queueTags(nameFifo),
   visibilityTimeoutSeconds: 180,
   sqsManagedSseEnabled: false
 });
@@ -73,9 +79,13 @@ Monitoring$ReventlessCore.notify("DeadLetterSink", name, Util_Lambda$ReventlessA
 
 let lambda = Pulumi.output(handler);
 
-let _subscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, opts);
+function esmTags(esmName) {
+  return AWS_Tags$ReventlessAws.make(esmName, "Plugin", "EventSourceMapping", "Plugin", undefined, undefined, undefined, undefined);
+}
+
+let _subscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, esmTags(name), opts);
 
-let _fifoSubscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, nameFifo, fifoQueue, undefined, opts);
+let _fifoSubscription = Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, nameFifo, fifoQueue, undefined, esmTags(nameFifo), opts);
 
 function createQueuePolicyDocument(name, queueArn, handlerArn) {
   return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "QueuePolicy", [{
@@ -143,6 +153,7 @@ Pulumi.all([
 export {
   name,
   nameFifo,
+  queueTags,
   queue,
   fifoQueue,
   opts,
@@ -154,6 +165,7 @@ export {
   layers,
   handler,
   lambda,
+  esmTags,
   _subscription,
   _fifoSubscription,
   createQueuePolicyDocument,

package/src/util/Util_EventSourceMapping.res

@@ -1,11 +1,16 @@
 open PulumiAws
 
+// `~tags` is required rather than optional: an EventSourceMapping is created by
+// several unrelated adapters, and an optional argument is exactly how the last
+// coverage sweep left these bare. Making the caller name the owning piece is the
+// regression guard — the same reasoning as `makeFromCodeAsset`'s `~componentKind`.
 let subscribe = (
   ~batchSize=?,
   ~lambda: Pulumi.Output.t<PulumiAws.Lambda.Function.t>,
   ~targetName,
   ~sourceName,
   ~source: ReventlessInfra.Adapter.resource,
+  ~tags: Pulumi.Input.t<Aws.tags>,
   ~opts,
 ) =>
   EventSourceMapping.make(
@@ -17,6 +22,7 @@ let subscribe = (
       eventSourceArn: source.urn->Pulumi.Output.asInput,
       startingPosition: LATEST,
       ?batchSize,
+      tags,
     },
     ~opts=Some(opts),
   )
@@ -26,6 +32,7 @@ let subscribeSqs = (
   ~name,
   ~queue: PulumiAws.SQS.Queue.t,
   ~batchSize=?,
+  ~tags: Pulumi.Input.t<Aws.tags>,
   ~opts,
 ) => {
   let esm = EventSourceMapping.make(
@@ -36,6 +43,7 @@ let subscribeSqs = (
       ->Pulumi.Output.asInput,
       eventSourceArn: queue.arn->Pulumi.Output.asInput,
       ?batchSize,
+      tags,
     },
     ~opts=Some(opts),
   )

package/src/util/Util_EventSourceMapping.res.mjs

@@ -7,20 +7,22 @@ import * as AWS$ReventlessAws from "../adapter/AWS.res.mjs";
 import * as Util$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util.res.mjs";
 import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
 
-function subscribe(batchSize, lambda, targetName, sourceName, source, opts) {
+function subscribe(batchSize, lambda, targetName, sourceName, source, tags, opts) {
   return new (Aws.lambda.EventSourceMapping)(Util$ReventlessCore.baseName(sourceName) + ("2" + targetName), {
     functionName: Output$Pulumi.flatMap(lambda, lambda => lambda.arn),
     batchSize: batchSize,
     eventSourceArn: source.urn,
-    startingPosition: "LATEST"
+    startingPosition: "LATEST",
+    tags: tags
   }, opts);
 }
 
-function subscribeSqs(lambda, name, queue, batchSize, opts) {
+function subscribeSqs(lambda, name, queue, batchSize, tags, opts) {
   let esm = new (Aws.lambda.EventSourceMapping)(name, {
     functionName: Output$Pulumi.flatMap(lambda, lambda => lambda.arn),
     batchSize: batchSize,
-    eventSourceArn: queue.arn
+    eventSourceArn: queue.arn,
+    tags: tags
   }, opts);
   return Adapter$ReventlessInfra.make(esm.id, esm.id, esm.arn, esm.id.apply(param => AWS$ReventlessAws.SQS.service), undefined, undefined, undefined, Pulumi.output("aws:lambda:EventSourceMapping"), undefined, undefined);
 }

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res

@@ -559,6 +559,56 @@ describe("Runtime.toItem — tag_composite is keyed on the event's entity tags",
   })
 })
 
+describe("Runtime.toItem — an empty tag value skips its GSI attribute", () => {
+  // `tag_<key>` is a GSI hash key, and DynamoDB rejects an empty string for a key
+  // attribute — writing one fails the whole append. An empty value is legitimate
+  // (an absent composite-partition member), so the attribute is skipped and that
+  // index goes sparse. See docs/plans/dcb-empty-tag-values-break-append.md.
+  let tagOf = (key, value): Reventless.DcbTag.tag => {key, value}
+  let tags = [tagOf("environment", "prod"), tagOf("componentName", "")]
+  let storedEvent: ReventlessCore.DcbEventLog_Adapter.rawStoredEvent = {
+    eventType: "ResourceAdded",
+    data: JSON.Object(Dict.make()),
+    tags,
+    meta: testMeta(),
+  }
+  let item =
+    Runtime.toItem("100", storedEvent, ~recordedAt="2026-07-08T00:00:00Z")
+    ->JSON.Decode.object
+    ->Option.getOrThrow
+
+  testSync("the non-empty tag keeps its attribute", () => {
+    expect(item->Dict.get("tag_environment"))->toEqual(Some("prod"->JSON.Encode.string))
+  })
+
+  testSync("the empty tag has no attribute at all", () => {
+    expect(item->Dict.get("tag_componentName"))->toEqual(None)
+  })
+
+  testSync("tag_composite still carries both tags", () => {
+    expect(item->Dict.get("tag_composite"))->toEqual(
+      Some(Runtime.compositeTagKey(tags)->JSON.Encode.string),
+    )
+  })
+
+  testSync("the tags payload records the empty value verbatim", () => {
+    let payloadTags =
+      item
+      ->Dict.get("tags")
+      ->Option.flatMap(JSON.Decode.array)
+      ->Option.getOrThrow
+      ->Array.filterMap(t =>
+        t
+        ->JSON.Decode.object
+        ->Option.map(o => (
+          o->Dict.get("key")->Option.flatMap(JSON.Decode.string)->Option.getOr(""),
+          o->Dict.get("value")->Option.flatMap(JSON.Decode.string)->Option.getOr("!missing"),
+        ))
+      )
+    expect(payloadTags)->toEqual([("environment", "prod"), ("componentName", "")])
+  })
+})
+
 describe("Runtime.buildConditionalTransactItems — folded create guard (after=None)", () => {
   let event = (eventType, tags): ReventlessCore.DcbEventLog_Adapter.rawStoredEvent => {
     eventType,

package/tests/DcbEventLogStorage_DynamoDb_RuntimeTest.res.mjs

@@ -690,6 +690,53 @@ globalThis.describe("Runtime.toItem — tag_composite is keyed on the event's en
   });
 });
 
+globalThis.describe("Runtime.toItem — an empty tag value skips its GSI attribute", () => {
+  let tags = [
+    {
+      key: "environment",
+      value: "prod"
+    },
+    {
+      key: "componentName",
+      value: ""
+    }
+  ];
+  let storedEvent_data = {};
+  let storedEvent_meta = testMeta();
+  let storedEvent = {
+    eventType: "ResourceAdded",
+    data: storedEvent_data,
+    tags: tags,
+    meta: storedEvent_meta
+  };
+  let item = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.toItem("100", storedEvent, undefined, "2026-07-08T00:00:00Z")), undefined);
+  globalThis.test("the non-empty tag keeps its attribute", () => {
+    globalThis.expect(item["tag_environment"]).toEqual("prod");
+  });
+  globalThis.test("the empty tag has no attribute at all", () => {
+    globalThis.expect(item["tag_componentName"]).toEqual(undefined);
+  });
+  globalThis.test("tag_composite still carries both tags", () => {
+    globalThis.expect(item["tag_composite"]).toEqual(DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.compositeTagKey(tags));
+  });
+  globalThis.test("the tags payload records the empty value verbatim", () => {
+    let payloadTags = Stdlib_Array.filterMap(Stdlib_Option.getOrThrow(Stdlib_Option.flatMap(item["tags"], Stdlib_JSON.Decode.array), undefined), t => Stdlib_Option.map(Stdlib_JSON.Decode.object(t), o => [
+      Stdlib_Option.getOr(Stdlib_Option.flatMap(o["key"], Stdlib_JSON.Decode.string), ""),
+      Stdlib_Option.getOr(Stdlib_Option.flatMap(o["value"], Stdlib_JSON.Decode.string), "!missing")
+    ]));
+    globalThis.expect(payloadTags).toEqual([
+      [
+        "environment",
+        "prod"
+      ],
+      [
+        "componentName",
+        ""
+      ]
+    ]);
+  });
+});
+
 globalThis.describe("Runtime.buildConditionalTransactItems — folded create guard (after=None)", () => {
   let event = (eventType, tags) => ({
     eventType: eventType,

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -38,3 +38,44 @@ describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
     expect(code->String.includes("attribute_exists"))->toBe(false)
   })
 })
+
+// Tripwires for docs/plans/aws-scan-connection-cursor-roundtrip.md. The Scan
+// resolver's cursor must round-trip DynamoDB's own continuation token, not a
+// synthetic index — every list past page 1 was unreachable before this.
+describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
+  let code = AppSync_Resolver_Retrying.Functions.listAllItemsConnection(~labelField="name")->codeOf
+
+  testSync("Fix 1: response encodes the real nextToken as the cursor", () => {
+    expect(code->String.includes("const next = ctx.result?.nextToken ?? null;"))->toBe(true)
+    expect(
+      code->String.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))"),
+    )->toBe(true)
+    expect(code->String.includes("hasNextPage: !!next,"))->toBe(true)
+  })
+
+  testSync("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+    expect(code->String.includes("JSON.parse(util.base64Decode(ctx.args.after))"))->toBe(true)
+    expect(code->String.includes("nextToken: after,"))->toBe(true)
+  })
+
+  testSync("Fix 1: the old synthetic-index cursor is gone", () => {
+    // The regression: `cursor: ctx.args.after ? ctx.args.after + '_' + i : '' + i`.
+    expect(code->String.includes("ctx.args.after + '_' + i"))->toBe(false)
+  })
+
+  testSync("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+    expect(code->String.includes("ctx.args.before != null || ctx.args.last != null"))->toBe(true)
+    expect(code->String.includes("UnsupportedPagination"))->toBe(true)
+  })
+
+  testSync("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
+    expect(
+      code->String.includes(
+        "const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;",
+      ),
+    )->toBe(true)
+    expect(
+      code->String.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary"),
+    )->toBe(true)
+  })
+})

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -29,6 +29,30 @@ globalThis.describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection"
   });
 });
 
+globalThis.describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined);
+  globalThis.test("Fix 1: response encodes the real nextToken as the cursor", () => {
+    globalThis.expect(code.includes("const next = ctx.result?.nextToken ?? null;")).toBe(true);
+    globalThis.expect(code.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))")).toBe(true);
+    globalThis.expect(code.includes("hasNextPage: !!next,")).toBe(true);
+  });
+  globalThis.test("Fix 1: request decodes `after` back to the DynamoDB token", () => {
+    globalThis.expect(code.includes("JSON.parse(util.base64Decode(ctx.args.after))")).toBe(true);
+    globalThis.expect(code.includes("nextToken: after,")).toBe(true);
+  });
+  globalThis.test("Fix 1: the old synthetic-index cursor is gone", () => {
+    globalThis.expect(code.includes("ctx.args.after + '_' + i")).toBe(false);
+  });
+  globalThis.test("Fix 2: backward paging (last/before) is rejected, not silently mishandled", () => {
+    globalThis.expect(code.includes("ctx.args.before != null || ctx.args.last != null")).toBe(true);
+    globalThis.expect(code.includes("UnsupportedPagination")).toBe(true);
+  });
+  globalThis.test("Fix 3: an empty/short filtered page still yields a resumable boundary cursor", () => {
+    globalThis.expect(code.includes("const boundary = next ? util.base64Encode(JSON.stringify({ token: next, index: -1 })) : null;")).toBe(true);
+    globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : boundary")).toBe(true);
+  });
+});
+
 export {
   codeOf,
 }

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res

@@ -458,3 +458,61 @@ describe("DCB DynamoDb integration — per-type fence granularity", () => {
     expect(conflicts >= 1)->toBe(true)
   })
 })
+
+// An empty tag value is a legitimate model state (an absent member of a composite
+// partition key), and the in-memory and SQLite backends have always accepted one.
+// DynamoDB used to reject the whole append: `tag_<key>` is a GSI hash key and a key
+// attribute cannot hold an empty string. The adapter now skips that one attribute,
+// leaving the index sparse — everything else about the event is unchanged.
+// See docs/plans/dcb-empty-tag-values-break-append.md.
+describe("DCB DynamoDb integration — an empty tag value does not break the append", () => {
+  let tags = [tag("orderId", "O-empty"), tag("customerId", "")]
+
+  testAsync("appends, and reads back through its partition with the tag intact", async () => {
+    let table = await H.freshTable()
+    let result = await Runtime.appendConditional(
+      table,
+      [event("OrderPlaced", tags)],
+      {query: [{tags: tags}], after: ?None},
+      ~partitionTag=simple("orderId"),
+    )
+    expect(isOk(result))->toBe(true)
+
+    let byPartition = await Runtime.read(table)(~query=[{tags: [tag("orderId", "O-empty")]}])
+    expect(byPartition.events->Array.length)->toBe(1)
+    let stored = byPartition.events->Array.getUnsafe(0)
+    expect(stored.eventType)->toBe("OrderPlaced")
+    // The event records the empty value verbatim — only the index skips it.
+    expect(stored.tags->Array.map(t => (t.key, t.value)))->toEqual([
+      ("orderId", "O-empty"),
+      ("customerId", ""),
+    ])
+  })
+
+  testAsync("is found by a composite (multi-tag) read", async () => {
+    let table = await H.freshTable()
+    let _ = await Runtime.appendUnconditional(
+      table,
+      [event("OrderPlaced", tags)],
+      ~partitionTag=simple("orderId"),
+    )
+    let composite = await Runtime.read(table)(~query=[{tags: tags}])
+    expect(composite.events->Array.length)->toBe(1)
+  })
+
+  testAsync("is absent from that tag's single-tag index rather than erroring", async () => {
+    let table = await H.freshTable()
+    let _ = await Runtime.appendUnconditional(
+      table,
+      [event("OrderPlaced", tags)],
+      ~partitionTag=simple("orderId"),
+    )
+    // A cross-partition read goes through the `tag_customerId` GSI, which carries
+    // no empty-valued key. DynamoDB would reject the key condition outright, so the
+    // adapter short-circuits: empty result, no exception.
+    let crossPartition = await Runtime.read(table, ~crossPartitionTagKeys=["customerId"])(
+      ~query=[{tags: [tag("customerId", "")]}],
+    )
+    expect(crossPartition.events->Array.length)->toBe(0)
+  })
+})

package/tests/integration/DcbEventLogStorage_DynamoDb_IntegrationTest.res.mjs

@@ -563,6 +563,84 @@ globalThis.describe("DCB DynamoDb integration — per-type fence granularity", (
   });
 });
 
+globalThis.describe("DCB DynamoDb integration — an empty tag value does not break the append", () => {
+  let tags = [
+    {
+      key: "orderId",
+      value: "O-empty"
+    },
+    {
+      key: "customerId",
+      value: ""
+    }
+  ];
+  globalThis.test("appends, and reads back through its partition with the tag intact", async () => {
+    let table = await DcbIntegrationHarness$ReventlessAws.freshTable();
+    let result = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.appendConditional(table, [event("OrderPlaced", tags)], {
+      query: [{
+          tags: tags
+        }]
+    }, {
+      TAG: "Simple",
+      _0: {
+        key: "orderId"
+      }
+    }, undefined);
+    globalThis.expect(isOk(result)).toBe(true);
+    let byPartition = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.read(table, undefined)([{
+        tags: [{
+            key: "orderId",
+            value: "O-empty"
+          }]
+      }], undefined);
+    globalThis.expect(byPartition.events.length).toBe(1);
+    let stored = byPartition.events[0];
+    globalThis.expect(stored.eventType).toBe("OrderPlaced");
+    globalThis.expect(stored.tags.map(t => [
+      t.key,
+      t.value
+    ])).toEqual([
+      [
+        "orderId",
+        "O-empty"
+      ],
+      [
+        "customerId",
+        ""
+      ]
+    ]);
+  });
+  globalThis.test("is found by a composite (multi-tag) read", async () => {
+    let table = await DcbIntegrationHarness$ReventlessAws.freshTable();
+    await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.appendUnconditional(table, [event("OrderPlaced", tags)], {
+      TAG: "Simple",
+      _0: {
+        key: "orderId"
+      }
+    });
+    let composite = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.read(table, undefined)([{
+        tags: tags
+      }], undefined);
+    globalThis.expect(composite.events.length).toBe(1);
+  });
+  globalThis.test("is absent from that tag's single-tag index rather than erroring", async () => {
+    let table = await DcbIntegrationHarness$ReventlessAws.freshTable();
+    await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.appendUnconditional(table, [event("OrderPlaced", tags)], {
+      TAG: "Simple",
+      _0: {
+        key: "orderId"
+      }
+    });
+    let crossPartition = await DcbEventLogStorage_DynamoDb_Runtime$ReventlessAws.read(table, ["customerId"])([{
+        tags: [{
+            key: "customerId",
+            value: ""
+          }]
+      }], undefined);
+    globalThis.expect(crossPartition.events.length).toBe(0);
+  });
+});
+
 let H;
 
 let Runtime;