effect-inngest 0.1.3 → 0.3.0-beta.0

package/dist/internal/serve/Signature.js

@@ -0,0 +1,123 @@
+import { InngestClient } from "../../Client.js";
+import { Array, Context, DateTime, Effect, Encoding, Layer, Option, Schema } from "effect";
+import * as NodeCrypto from "node:crypto";
+//#region src/internal/serve/Signature.ts
+var SignatureError = class extends Schema.TaggedErrorClass()("SignatureError", {
+	reason: Schema.Literals([
+		"missing_header",
+		"invalid_format",
+		"expired",
+		"invalid_signature",
+		"missing_signing_key"
+	]),
+	message: Schema.String
+}) {};
+var SignatureConfig = class extends Schema.Class("effect-inngest/SignatureConfig")({
+	verification: Schema.Literals(["disabled", "required"]),
+	signingKey: Schema.OptionFromUndefinedOr(Schema.String),
+	signingKeyFallback: Schema.OptionFromUndefinedOr(Schema.String)
+}) {};
+var PreparedSigningKey = class PreparedSigningKey extends Schema.Class("effect-inngest/PreparedSigningKey")({ bytes: Schema.Uint8Array }) {
+	static decode = (signingKey) => Schema.decodeUnknownOption(Schema.Uint8ArrayFromHex)(signingKey.replace(/^signkey-\w+-/, "")).pipe(Option.map((bytes) => PreparedSigningKey.make({ bytes })));
+	sign = (body, timestampSeconds) => NodeCrypto.createHmac("sha256", this.bytes).update(body).update(String(timestampSeconds)).digest();
+	verifies = (body, header) => {
+		const expected = this.sign(body, header.timestampSeconds);
+		return expected.length === header.signature.length && NodeCrypto.timingSafeEqual(expected, header.signature);
+	};
+};
+var SignatureHeader = class SignatureHeader extends Schema.Class("effect-inngest/SignatureHeader")({
+	timestampSeconds: Schema.Number,
+	signature: Schema.Uint8Array
+}) {
+	static decode = (header) => {
+		const params = new URLSearchParams(header);
+		return Schema.decodeUnknownEffect(SignatureParams)({
+			t: params.get("t") ?? "",
+			s: params.get("s") ?? ""
+		}).pipe(Effect.map(({ t, s }) => SignatureHeader.make({
+			timestampSeconds: t,
+			signature: s
+		})), Effect.mapError(() => SignatureError.make({
+			reason: "invalid_format",
+			message: `Invalid signature format: expected t=<int>&s=<64-hex>, got: ${header}`
+		})));
+	};
+	assertFresh = Effect.fn("effect-inngest/SignatureHeader/assertFresh")(function* () {
+		const now = yield* DateTime.now;
+		if (Math.abs(now.epochMilliseconds - this.timestampSeconds * 1e3) <= SIGNATURE_VALIDITY_WINDOW_MS) return;
+		return yield* SignatureError.make({
+			reason: "expired",
+			message: `Signature expired: timestamp ${this.timestampSeconds} is outside the validity window`
+		});
+	});
+};
+var SignedPayload = class extends Schema.Class("effect-inngest/SignedPayload")({
+	body: Schema.Uint8Array,
+	signature: Schema.OptionFromUndefinedOr(SignatureHeader)
+}) {
+	requireSignature = Effect.fn("effect-inngest/SignedPayload/requireSignature")(function() {
+		return Effect.fromOption(this.signature).pipe(Effect.mapError(() => SignatureError.make({
+			reason: "missing_header",
+			message: "Missing Inngest signature header"
+		})));
+	});
+};
+const SIGNATURE_VALIDITY_WINDOW_MS = 300 * 1e3;
+const TimestampSeconds = Schema.NumberFromString.pipe(Schema.check(Schema.isInt(), Schema.isGreaterThan(0)));
+const SignatureParams = Schema.Struct({
+	t: TimestampSeconds,
+	s: Schema.Uint8ArrayFromHex
+});
+const hashSigningKey = (signingKey) => Encoding.encodeHex(NodeCrypto.createHash("sha256").update(signingKey.replace(/^signkey-\w+-/, "")).digest());
+var Signature = class extends Context.Service()("effect-inngest/Signature", { make: (config) => Effect.gen(function* () {
+	const signingKey = config.signingKey.pipe(Option.flatMap(PreparedSigningKey.decode));
+	const fallbackSigningKey = config.signingKeyFallback.pipe(Option.flatMap(PreparedSigningKey.decode));
+	if (Option.isSome(config.signingKey) && Option.isNone(signingKey)) return yield* SignatureError.make({
+		reason: "invalid_format",
+		message: "Invalid signing key"
+	});
+	if (Option.isSome(config.signingKeyFallback) && Option.isNone(fallbackSigningKey)) return yield* SignatureError.make({
+		reason: "invalid_format",
+		message: "Invalid signing key"
+	});
+	const signingKeys = Array.getSomes([signingKey, fallbackSigningKey]);
+	return {
+		verify: Effect.fn("effect-inngest/Signature/verify")(function* (payload) {
+			if (config.verification === "disabled") return;
+			if (Array.isArrayEmpty(signingKeys)) return yield* SignatureError.make({
+				reason: "missing_signing_key",
+				message: "No signing key configured for signature verification"
+			});
+			const header = yield* payload.requireSignature();
+			yield* header.assertFresh();
+			if (!signingKeys.some((key) => key.verifies(payload.body, header))) return yield* SignatureError.make({
+				reason: "invalid_signature",
+				message: "Invalid signature"
+			});
+		}),
+		sign: Effect.fn("effect-inngest/Signature/sign")(function* (body) {
+			const key = yield* Option.match(signingKey, {
+				onNone: () => SignatureError.make({
+					reason: "missing_signing_key",
+					message: "No signing key configured for signing"
+				}),
+				onSome: Effect.succeed
+			});
+			const now = yield* DateTime.now;
+			const timestampSeconds = Math.floor(now.epochMilliseconds / 1e3);
+			return `t=${timestampSeconds}&s=${Encoding.encodeHex(key.sign(body, timestampSeconds))}`;
+		})
+	};
+}) }) {
+	static layer = (config) => Layer.effect(this, this.make(config));
+};
+const SignatureLive = Layer.effect(Signature, Effect.gen(function* () {
+	const client = yield* InngestClient;
+	return yield* Signature.make(SignatureConfig.make({
+		verification: client.mode === "dev" ? "disabled" : "required",
+		signingKey: Option.fromNullishOr(client.config.signingKey),
+		signingKeyFallback: Option.fromNullishOr(client.config.signingKeyFallback)
+	}));
+}));
+//#endregion
+export { Signature, SignatureError, SignatureHeader, SignatureLive, SignedPayload, hashSigningKey };

package/dist/internal/wire/Duration.js

@@ -0,0 +1,19 @@
+import { Duration, Schema, SchemaGetter, SchemaTransformation } from "effect";
+const InngestDuration = Schema.Duration.pipe(Schema.check(Schema.makeFilter((duration) => Duration.isFinite(duration) && !Duration.isNegative(duration) ? void 0 : "a finite non-negative duration"))).pipe(Schema.encodeTo(Schema.String, {
+	decode: SchemaTransformation.durationFromString.decode,
+	encode: SchemaGetter.transform((duration) => {
+		const parts = Duration.parts(duration);
+		const weeks = Math.floor(parts.days / 7);
+		const days = parts.days % 7;
+		return [
+			weeks > 0 ? `${weeks}w` : "",
+			days > 0 ? `${days}d` : "",
+			parts.hours > 0 ? `${parts.hours}h` : "",
+			parts.minutes > 0 ? `${parts.minutes}m` : "",
+			parts.seconds > 0 ? `${parts.seconds}s` : "",
+			parts.millis > 0 ? `${parts.millis}ms` : ""
+		].join("") || "0s";
+	})
+}));
+//#endregion
+export { InngestDuration };

package/dist/internal/wire/Timestamp.js

@@ -0,0 +1,14 @@
+import { DateTime, Predicate, Schema, SchemaTransformation, identity } from "effect";
+//#region src/internal/wire/Timestamp.ts
+const TimestampInput = Schema.Union([
+	Schema.String,
+	Schema.Number,
+	Schema.DateValid
+]);
+const decode = (value) => Predicate.isString(value) ? value : DateTime.formatIso(DateTime.makeUnsafe(value));
+const InngestTimestamp = TimestampInput.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.transform({
+	decode,
+	encode: identity
+})));
+//#endregion
+export { InngestTimestamp };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "effect-inngest",
-  "version": "0.1.3",
+  "version": "0.3.0-beta.0",
   "description": "Native Effect client library for Inngest - build durable, type-safe workflows",
   "keywords": [
     "background-jobs",
@@ -91,33 +91,45 @@
     }
   },
   "scripts": {
-    "build": "tsdown",
-    "format": "oxfmt",
-    "lint": "oxlint --fix --type-aware --type-check --promise-plugin",
+    "build": "vp pack",
+    "test": "vp test run",
+    "coverage": "vp test run --coverage",
+    "test:watch": "vp test",
+    "format": "vp fmt",
+    "lint": "vp lint --fix --type-aware --type-check --promise-plugin && sg scan src",
+    "ast-grep": "sg scan src",
     "typecheck": "tsgo --noEmit",
-    "prepare": "effect-language-service patch",
+    "prepare": "vp config && effect-tsgo patch",
     "changeset": "changeset",
     "changeset:version": "changeset version",
     "changeset:publish": "bun run build && changeset publish"
   },
   "devDependencies": {
-    "@changesets/changelog-github": "^0.5.2",
-    "@changesets/cli": "^2.29.8",
-    "@effect/cluster": "^0.56.1",
-    "@effect/language-service": "0.72.0",
-    "@effect/platform": "^0.94.2",
-    "@effect/platform-bun": "^0.87.0",
-    "@types/bun": "1.3.6",
-    "@typescript/native-preview": "^7.0.0-dev.20260124.1",
-    "effect": "^3.15.0",
-    "oxfmt": "0.26.0",
-    "oxlint": "1.41.0",
-    "oxlint-tsgolint": "0.11.1",
-    "tsdown": "0.20.1",
-    "typescript": "^5.9.3"
+    "@ast-grep/cli": "^0.43.0",
+    "@changesets/changelog-github": "^0.6.0",
+    "@changesets/cli": "^2.31.0",
+    "@effect/platform-bun": "4.0.0-beta.83",
+    "@effect/tsgo": "0.14.3",
+    "@effect/vitest": "4.0.0-beta.83",
+    "@types/bun": "1.3.12",
+    "@typescript/native-preview": "^7.0.0-dev.20260420.1",
+    "@vitest/coverage-v8": "4.1.5",
+    "effect": "4.0.0-beta.83",
+    "inngest": "^4.5.1",
+    "mockttp": "^4.4.2",
+    "typescript": "^5.9.3",
+    "vite-plus": "latest"
   },
   "peerDependencies": {
-    "@effect/platform": ">=0.87.0",
-    "effect": ">=3.15.0"
-  }
+    "effect": ">=4.0.0-beta.83",
+    "typescript": ">=5.9"
+  },
+  "overrides": {
+    "vite": "npm:@voidzero-dev/vite-plus-core@latest",
+    "vitest": "npm:@voidzero-dev/vite-plus-test@latest"
+  },
+  "packageManager": "bun@1.3.13",
+  "trustedDependencies": [
+    "@ast-grep/cli"
+  ]
 }

package/src/Client.ts

@@ -1,18 +1,16 @@
 /**
  * @since 0.1.0
  */
-import * as HttpClient from "@effect/platform/HttpClient";
-import * as HttpClientRequest from "@effect/platform/HttpClientRequest";
-import * as HttpClientResponse from "@effect/platform/HttpClientResponse";
-import * as Config from "effect/Config";
-import type * as ConfigError from "effect/ConfigError";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
-import * as Option from "effect/Option";
-import * as Predicate from "effect/Predicate";
-import * as Schema from "effect/Schema";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import { Clock, Config, Context, Effect, Layer, Option, Predicate, Ref, Schedule, Schema } from "effect";
+import { CheckpointApiError, type CheckpointingOption } from "./internal/checkpoint.js";
 import * as Protocol from "./internal/protocol.js";
+import { hashSigningKey } from "./internal/serve/Signature.js";
+
+export type { CheckpointingOption } from "./internal/checkpoint.js";
+export { CheckpointApiError } from "./internal/checkpoint.js";
 
 /**
  * @since 0.1.0
@@ -35,7 +33,7 @@ const SDK_VERSION = "2.0.0";
 
 type ClientMode = "dev" | "cloud";
 
-interface ClientConfig {
+export interface ClientConfig {
   /**
    * The ID of this instance, most commonly a reference to the application it
    * resides in.
@@ -111,6 +109,29 @@ interface ClientConfig {
    * The path where the Inngest serve handler is mounted. Used for registration.
    */
   readonly servePath?: string | undefined;
+
+  /**
+   * The framework adapter serving this app, e.g. "bun" or "nodejs". Used for
+   * protocol headers and registration metadata.
+   */
+  readonly framework?: string | undefined;
+
+  /**
+   * Whether to use checkpointing by default for executions of functions
+   * created using this client.
+   *
+   * - `false` disables checkpointing for all functions on this client.
+   * - `true` enables checkpointing with safe defaults (`bufferedSteps: 1`,
+   *   `maxInterval: 0`, `maxRuntime: 10s`). Steps are checkpointed to the
+   *   Inngest API as they complete instead of yielding a 206 per step.
+   * - An object lets you tune `bufferedSteps`, `maxInterval`, `maxRuntime`.
+   *
+   * Per-function `checkpointing` overrides this setting. Defaults to `true`
+   * (checkpointing enabled).
+   *
+   * @default true
+   */
+  readonly checkpointing?: CheckpointingOption | undefined;
 }
 
 export const EventPayload = Schema.Struct({
@@ -122,14 +143,14 @@ export const EventPayload = Schema.Struct({
 });
 
 const SendEventResponse = Schema.Struct({
-  ids: Schema.optionalWith(Schema.Array(Schema.String), { default: () => [] }),
+  ids: Schema.Array(Schema.String).pipe(Schema.withDecodingDefault(Effect.succeed([]))),
   status: Schema.optional(Schema.Number),
 });
 
 type EventPayload = typeof EventPayload.Type;
 type SendEventResponse = typeof SendEventResponse.Type;
 
-class SendEventError extends Schema.TaggedError<SendEventError>()("SendEventError", {
+class SendEventError extends Schema.TaggedErrorClass<SendEventError>()("SendEventError", {
   message: Schema.String,
   events: Schema.Array(Schema.String),
 }) {}
@@ -141,6 +162,26 @@ interface InngestClientService {
   readonly eventBaseUrl: string;
   readonly apiBaseUrl: string;
   readonly sendEvent: (events: ReadonlyArray<EventPayload>) => Effect.Effect<SendEventResponse, SendEventError>;
+  /**
+   * Async checkpoint API call per spec §10.3.1.
+   *
+   * POSTs `{run_id, fn_id, qi_id, steps, ts}` to
+   * `{apiBaseUrl}/v1/checkpoint/{runId}/async` with a hashed-signing-key
+   * Bearer token. Retries 5xx responses with exponential backoff + jitter
+   * (5 attempts). On 401, falls back to the configured fallback signing key
+   * for the remainder of the client's lifetime (one-way switch).
+   *
+   * @internal
+   */
+  readonly checkpointAsync: (args: {
+    readonly runId: string;
+    readonly fnId: string;
+    readonly qiId: string;
+    readonly requestId?: string;
+    readonly generationId?: number;
+    readonly requestStartedAt?: number;
+    readonly steps: ReadonlyArray<typeof Protocol.GeneratorOpcode.Type>;
+  }) => Effect.Effect<void, CheckpointApiError>;
 }
 
 /**
@@ -149,7 +190,20 @@ interface InngestClientService {
  * @since 0.1.0
  * @category context
  */
-export class InngestClient extends Context.Tag("effect-inngest/InngestClient")<InngestClient, InngestClientService>() {}
+export class InngestClient extends Context.Service<InngestClient, InngestClientService>()(
+  "effect-inngest/InngestClient",
+) {}
+
+/**
+ * Static Inngest application configuration.
+ *
+ * This is the narrow dependency for internals that need app settings but not
+ * client behavior such as event sending or checkpoint API calls.
+ *
+ * @since 0.1.0
+ * @category context
+ */
+export class InngestConfig extends Context.Service<InngestConfig, ClientConfig>()("effect-inngest/InngestConfig") {}
 
 const resolveMode = (config: ClientConfig): ClientMode => config.mode ?? "dev";
 
@@ -159,64 +213,181 @@ const resolveEventBaseUrl = (config: ClientConfig, mode: ClientMode): string =>
 const resolveApiBaseUrl = (config: ClientConfig, mode: ClientMode): string =>
   config.apiBaseUrl ?? (mode === "dev" ? DEFAULT_DEV_SERVER_URL : DEFAULT_API_BASE_URL);
 
-const makeClient = (config: ClientConfig, httpClient: HttpClient.HttpClient): InngestClientService => {
-  const mode = resolveMode(config);
-  const eventBaseUrl = resolveEventBaseUrl(config, mode);
-  const apiBaseUrl = resolveApiBaseUrl(config, mode);
-
-  const sendEvent = (events: ReadonlyArray<EventPayload>): Effect.Effect<SendEventResponse, SendEventError> => {
-    if (!config.eventKey && mode === "cloud") {
-      return new SendEventError({
-        message: "Event key is required to send events in cloud mode",
-        events: events.map((e) => e.name),
-      });
-    }
-
-    const key = config.eventKey ?? "local";
-    const url = new URL(`e/${key}`, eventBaseUrl).toString();
-    const eventNames = events.map((e) => e.name);
-    const now = Date.now();
-
-    const payloads = events.map((e) => ({
-      name: e.name,
-      data: e.data ?? {},
-      ts: e.ts ?? now,
-      id: e.id,
-      v: e.v,
-    }));
-
-    const request = HttpClientRequest.post(url).pipe(
-      HttpClientRequest.setHeaders({
-        "Content-Type": "application/json",
-        [Protocol.Headers.SDK]: `effect-ts:v${SDK_VERSION}`,
-        ...(config.env ? { [Protocol.Headers.Env]: config.env } : {}),
-      }),
-    );
+const isRetriable = (error: CheckpointApiError): boolean => Predicate.isUndefined(error.status) || error.status >= 500;
+
+const defaultCheckpointRetrySchedule: Schedule.Schedule<unknown, CheckpointApiError> = Schedule.exponential(
+  "100 millis",
+  2.0,
+).pipe(
+  Schedule.jittered,
+  Schedule.both(Schedule.recurs(5)),
+  Schedule.while((m: Schedule.Metadata<unknown, CheckpointApiError>) => isRetriable(m.input)),
+);
+
+export const CheckpointRetrySchedule = Context.Reference<Schedule.Schedule<unknown, CheckpointApiError>>(
+  "effect-inngest/internal/CheckpointRetrySchedule",
+  { defaultValue: () => defaultCheckpointRetrySchedule },
+);
 
-    return HttpClientRequest.schemaBodyJson(Schema.Array(EventPayload))(request, payloads).pipe(
-      Effect.flatMap(httpClient.execute),
-      Effect.flatMap(HttpClientResponse.schemaBodyJson(SendEventResponse)),
-      Effect.map((response) => ({ ids: response.ids, status: response.status })),
-      Effect.scoped,
-      Effect.catchAll(
-        (error) =>
+const makeClient = (config: ClientConfig, httpClient: HttpClient.HttpClient): Effect.Effect<InngestClientService> =>
+  Effect.gen(function* () {
+    const mode = resolveMode(config);
+    const eventBaseUrl = resolveEventBaseUrl(config, mode);
+    const apiBaseUrl = resolveApiBaseUrl(config, mode);
+    const retrySchedule = yield* CheckpointRetrySchedule;
+
+    /**
+     * One-way switch: once the fallback signing key succeeds for any
+     * checkpoint API call, all subsequent calls use it first. Per spec
+     * §10.3.4.
+     */
+    const useFallbackKey = yield* Ref.make(false);
+
+    const sendEvent = Effect.fn("InngestClient.sendEvent")(function* (events: ReadonlyArray<EventPayload>) {
+      if (!config.eventKey && mode === "cloud") {
+        return yield* Effect.fail(
           new SendEventError({
-            message: `Failed to send events: ${Predicate.hasProperty(error, "message") ? (error.message as string) : "Unknown error"}`,
-            events: eventNames,
+            message: "Event key is required to send events in cloud mode",
+            events: events.map((e) => e.name),
           }),
-      ),
+        );
+      }
+
+      const key = config.eventKey ?? "NO_EVENT_KEY_SET";
+      const url = new URL(`e/${key}`, eventBaseUrl).toString();
+      const eventNames = events.map((e) => e.name);
+      const now = yield* Clock.currentTimeMillis;
+
+      const payloads = events.map((e) => ({
+        name: e.name,
+        data: e.data ?? {},
+        ts: e.ts ?? now,
+        id: e.id,
+        v: e.v,
+      }));
+
+      const request = HttpClientRequest.post(url).pipe(
+        HttpClientRequest.setHeaders({
+          "Content-Type": "application/json",
+          [Protocol.Headers.SDK]: `effect-ts:v${SDK_VERSION}`,
+          ...(config.env ? { [Protocol.Headers.Env]: config.env } : {}),
+        }),
+      );
+
+      return yield* HttpClientRequest.schemaBodyJson(Schema.Array(EventPayload))(request, payloads).pipe(
+        Effect.flatMap(httpClient.execute),
+        Effect.flatMap(HttpClientResponse.schemaBodyJson(SendEventResponse)),
+        Effect.map((response) => ({ ids: response.ids, status: response.status })),
+        Effect.scoped,
+        Effect.catch((error) =>
+          Effect.fail(
+            new SendEventError({
+              message: `Failed to send events: ${Predicate.hasProperty(error, "message") ? (error.message as string) : "Unknown error"}`,
+              events: eventNames,
+            }),
+          ),
+        ),
+      );
+    });
+
+    /**
+     * Issue a checkpoint POST with the given signing key. Returns a tagged
+     * error on non-2xx so the caller can decide whether to retry, swap keys,
+     * or fall back.
+     */
+    const checkpointRequest = (
+      runId: string,
+      body: string,
+      hashedSigningKey: string,
+    ): Effect.Effect<void, CheckpointApiError> => {
+      const url = new URL(`v1/checkpoint/${runId}/async`, apiBaseUrl).toString();
+      const request = HttpClientRequest.post(url).pipe(
+        HttpClientRequest.setHeaders({
+          "Content-Type": "application/json",
+          ...(config.env ? { [Protocol.Headers.Env]: config.env } : {}),
+        }),
+        HttpClientRequest.bearerToken(hashedSigningKey),
+        HttpClientRequest.bodyText(body, "application/json"),
+      );
+
+      return httpClient.execute(request).pipe(
+        Effect.scoped,
+        Effect.catch((error) =>
+          Effect.fail(
+            new CheckpointApiError({
+              message: `Network error issuing checkpoint: ${Predicate.hasProperty(error, "message") ? (error.message as string) : String(error)}`,
+            }),
+          ),
+        ),
+        Effect.flatMap((response) => {
+          if (response.status >= 200 && response.status < 300) {
+            return Effect.void;
+          }
+          return Effect.fail(
+            new CheckpointApiError({
+              message: `Checkpoint API returned ${response.status}`,
+              status: response.status,
+            }),
+          );
+        }),
+      );
+    };
+
+    const checkpointAsync: InngestClientService["checkpointAsync"] = Effect.fn("InngestClient.checkpointAsync")(
+      function* (args) {
+        const signingKey = config.signingKey;
+        if (!signingKey && mode !== "dev") {
+          return yield* Effect.fail(
+            new CheckpointApiError({ message: "No signing key configured for checkpoint API" }),
+          );
+        }
+
+        const now = yield* Clock.currentTimeMillis;
+        const body = JSON.stringify({
+          run_id: args.runId,
+          fn_id: args.fnId,
+          qi_id: args.qiId,
+          request_id: args.requestId,
+          generation_id: args.generationId,
+          request_started_at: args.requestStartedAt,
+          steps: args.steps,
+          ts: now,
+        });
+
+        const fallbackKey = config.signingKeyFallback;
+
+        // Single attempt: tries the chosen key first; on 401 with primary,
+        // tries the fallback once and flips the Ref.
+        const attempt: Effect.Effect<void, CheckpointApiError> = Ref.get(useFallbackKey).pipe(
+          Effect.flatMap((usingFallback) => {
+            const primaryKey = usingFallback && fallbackKey ? fallbackKey : signingKey;
+            const primaryToken = primaryKey ? hashSigningKey(primaryKey) : "";
+            return checkpointRequest(args.runId, body, primaryToken).pipe(
+              Effect.catch((error) =>
+                error.status === 401 && !usingFallback && fallbackKey
+                  ? checkpointRequest(args.runId, body, hashSigningKey(fallbackKey)).pipe(
+                      Effect.andThen(Ref.set(useFallbackKey, true)),
+                    )
+                  : Effect.fail(error),
+              ),
+            );
+          }),
+        );
+
+        return yield* attempt.pipe(Effect.retry(retrySchedule));
+      },
     );
-  };
-
-  return {
-    [TypeId]: TypeId,
-    config,
-    mode,
-    eventBaseUrl,
-    apiBaseUrl,
-    sendEvent,
-  };
-};
+
+    return {
+      [TypeId]: TypeId,
+      config,
+      mode,
+      eventBaseUrl,
+      apiBaseUrl,
+      sendEvent,
+      checkpointAsync,
+    };
+  });
 
 /**
  * Create an InngestClient layer from a config.
@@ -231,10 +402,16 @@ const makeClient = (config: ClientConfig, httpClient: HttpClient.HttpClient): In
  * })
  * ```
  */
-export const layer = (config: ClientConfig): Layer.Layer<InngestClient, never, HttpClient.HttpClient> =>
-  Layer.effect(
-    InngestClient,
-    Effect.map(HttpClient.HttpClient, (httpClient) => makeClient(config, httpClient)),
+export const layer = (config: ClientConfig): Layer.Layer<InngestClient | InngestConfig, never, HttpClient.HttpClient> =>
+  Layer.mergeAll(
+    Layer.succeed(InngestConfig, config),
+    Layer.effect(
+      InngestClient,
+      Effect.gen(function* () {
+        const httpClient = yield* HttpClient.HttpClient;
+        return yield* makeClient(config, httpClient);
+      }),
+    ),
   );
 
 /**
@@ -244,13 +421,13 @@ export const layer = (config: ClientConfig): Layer.Layer<InngestClient, never, H
  * @category layers
  */
 export const layerConfig = (
-  config: Config.Config.Wrap<ClientConfig>,
-): Layer.Layer<InngestClient, ConfigError.ConfigError, HttpClient.HttpClient> =>
-  Layer.effect(
-    InngestClient,
-    Effect.flatMap(Config.unwrap(config), (resolvedConfig) =>
-      Effect.map(HttpClient.HttpClient, (httpClient) => makeClient(resolvedConfig, httpClient)),
-    ),
+  config: Config.Wrap<ClientConfig>,
+): Layer.Layer<InngestClient | InngestConfig, Config.ConfigError, HttpClient.HttpClient> =>
+  Layer.unwrap(
+    Effect.gen(function* () {
+      const resolvedConfig = yield* Config.unwrap(config);
+      return layer(resolvedConfig);
+    }),
   );
 
 /**
@@ -266,14 +443,15 @@ export const layerConfig = (
  * @since 0.1.0
  * @category layers
  */
-export const layerFromEnv: Layer.Layer<InngestClient, ConfigError.ConfigError, HttpClient.HttpClient> = layerConfig(
-  Config.all({
-    id: Config.string("INNGEST_APP_ID").pipe(Config.withDefault("app")),
-    eventKey: Config.string("INNGEST_EVENT_KEY").pipe(Config.option, Config.map(Option.getOrUndefined)),
-    signingKey: Config.string("INNGEST_SIGNING_KEY").pipe(Config.option, Config.map(Option.getOrUndefined)),
-    signingKeyFallback: Config.string("INNGEST_SIGNING_KEY_FALLBACK").pipe(
-      Config.option,
-      Config.map(Option.getOrUndefined),
-    ),
-  }),
-);
+export const layerFromEnv: Layer.Layer<InngestClient | InngestConfig, Config.ConfigError, HttpClient.HttpClient> =
+  layerConfig(
+    Config.all({
+      id: Config.string("INNGEST_APP_ID").pipe(Config.withDefault("app")),
+      eventKey: Config.string("INNGEST_EVENT_KEY").pipe(Config.option, Config.map(Option.getOrUndefined)),
+      signingKey: Config.string("INNGEST_SIGNING_KEY").pipe(Config.option, Config.map(Option.getOrUndefined)),
+      signingKeyFallback: Config.string("INNGEST_SIGNING_KEY_FALLBACK").pipe(
+        Config.option,
+        Config.map(Option.getOrUndefined),
+      ),
+    }),
+  );