react-native-update 10.48.3 → 10.50.0

package/ios/RCTPushy/RCTPushy.mm

@@ -2,6 +2,7 @@
 #import "RCTPushyDownloader.h"
 #import "ZipArchive.h"
 #include "../../cpp/patch_core/archive_patch_core.h"
+#include "../../cpp/patch_core/digest.h"
 #include "../../cpp/patch_core/hbc_transform_wire.h"
 #include "../../cpp/patch_core/error_codes.h"
 #include "../../cpp/patch_core/patch_core.h"
@@ -32,6 +33,10 @@ static NSString *const keyHashInfo = @"REACTNATIVECN_PUSHY_HASH_";
 static NSString *const keyFirstLoadMarked = @"REACTNATIVECN_PUSHY_FIRSTLOADMARKED_KEY";
 static NSString *const keyRolledBackMarked = @"REACTNATIVECN_PUSHY_ROLLEDBACKMARKED_KEY";
 static NSString *const KeyPackageUpdatedMarked = @"REACTNATIVECN_PUSHY_ISPACKAGEUPDATEDMARKED_KEY";
+// bundleHash cache: "<cacheKey>|<sha256hex>" where cacheKey identifies the
+// installed binary (packageVersion + embedded bundle size + mtime). Recomputed
+// only when the key changes, i.e. once per install.
+static NSString *const keyBundleHashCache = @"REACTNATIVECN_PUSHY_BUNDLEHASH_KEY";
 static NSString *const PushyErrorDomain = @"cn.reactnative.pushy";
 
 // file def
@@ -134,6 +139,25 @@ static BOOL PushyStringIsBlank(NSString *value) {
     return [[value stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] length] == 0;
 }
 
+// Server-provided identifiers (hash/originHash) are used as child names under
+// the download root; anything that could resolve outside of it (path
+// separators, "..", ".") must be rejected before touching the filesystem.
+static BOOL PushyIsSafePathComponent(NSString *value) {
+    if (PushyStringIsBlank(value)) {
+        return NO;
+    }
+    if ([value isEqualToString:@"."] || [value isEqualToString:@".."]) {
+        return NO;
+    }
+    if ([value containsString:@"/"] || [value containsString:@"\\"]) {
+        return NO;
+    }
+    if ([value rangeOfString:@"\0"].location != NSNotFound) {
+        return NO;
+    }
+    return YES;
+}
+
 static void PushyRejectError(RCTPromiseRejectBlock reject, NSError *error) {
     // Prefer the stable cross-platform code (error_codes.h); fall back to the
     // numeric NSError code for system errors that were not classified.
@@ -157,15 +181,28 @@ static pushy::patch::PatchManifest PushyPatchManifestFromJson(NSDictionary *json
     pushy::patch::PatchManifest manifest;
 
     NSDictionary *copies = json[@"copies"];
+    // Content checksum per copy target ("copiesCrc", pdiff manifests from
+    // CLI >= 2.21.2). The patch core verifies the copy source against it and
+    // fails the patch on mismatch, so the JS strategy chain falls back to the
+    // full package instead of copying drifted bytes from a rebuilt binary.
+    NSDictionary *copiesCrc = json[@"copiesCrc"];
+    if (![copiesCrc isKindOfClass:[NSDictionary class]]) {
+        copiesCrc = nil;
+    }
     for (NSString *to in copies) {
         NSString *from = copies[to];
         if (from.length <= 0) {
             from = to;
         }
-        manifest.copies.push_back(pushy::patch::CopyOperation{
-            PushyToStdString(from),
-            PushyToStdString(to),
-        });
+        pushy::patch::CopyOperation operation;
+        operation.from = PushyToStdString(from);
+        operation.to = PushyToStdString(to);
+        NSNumber *expectedCrc = copiesCrc[to];
+        if ([expectedCrc isKindOfClass:[NSNumber class]]) {
+            operation.has_expected_crc = true;
+            operation.expected_crc = (uint32_t)[expectedCrc unsignedLongLongValue];
+        }
+        manifest.copies.push_back(operation);
     }
 
     NSDictionary *deletes = json[@"deletes"];
@@ -243,6 +280,7 @@ static void PushyApplyStateToDefaults(NSUserDefaults *defaults, const pushy::sta
                  callback:(void (^)(NSError *error))callback;
 - (BOOL)switchVersion:(NSString *)hash error:(NSError **)error;
 - (BOOL)ensureDirectoryExistsAtPath:(NSString *)path;
++ (void)excludeFromBackup:(NSString *)path;
 - (void)unzipFileAtPath:(NSString *)path
           toDestination:(NSString *)destination
       completionHandler:(void (^)(NSError *error))completionHandler;
@@ -512,6 +550,56 @@ RCT_EXPORT_METHOD(restartApp:(RCTPromiseResolveBlock)resolve
     resolve(@true);
 }
 
+RCT_EXPORT_METHOD(getBundleHash:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+{
+    // bundleHash = sha256 of the bundle embedded in the binary — the identity
+    // of the binary itself, not of whatever hot update is currently running.
+    // It must hash exactly the bytes pdiff patches from (binaryBundleURL, the
+    // pdiff fromBundle). Lazily computed once per install, cached in defaults.
+    // Never rejects: an empty string means "unknown" and the server falls back
+    // to the buildTime heuristic.
+#if DEBUG
+    // Metro serves the bundle in debug; the embedded file (if any) is not what
+    // is running. Mirrors the dev behaviour of buildTime.
+    resolve(@"");
+#else
+    dispatch_async(_fileQueue, ^{
+        NSString *path = [[RCTPushy binaryBundleURL] path];
+        if (path == nil) {
+            resolve(@"");
+            return;
+        }
+        NSDictionary *attributes =
+            [[NSFileManager defaultManager] attributesOfItemAtPath:path error:nil];
+        if (attributes == nil) {
+            resolve(@"");
+            return;
+        }
+        NSString *cacheKey = [NSString stringWithFormat:@"%@|%llu|%.0f",
+            [RCTPushy packageVersion],
+            attributes.fileSize,
+            [attributes.fileModificationDate timeIntervalSince1970]];
+
+        NSUserDefaults *defaults = PushyDefaults();
+        NSString *cached = [defaults stringForKey:keyBundleHashCache];
+        NSString *cachedPrefix = [cacheKey stringByAppendingString:@"|"];
+        if ([cached hasPrefix:cachedPrefix]) {
+            resolve([cached substringFromIndex:cachedPrefix.length]);
+            return;
+        }
+
+        NSString *hash = PushyFromStdString(
+            pushy::digest::Sha256File(PushyToStdString(path))) ?: @"";
+        if (hash.length > 0) {
+            [defaults setObject:[cachedPrefix stringByAppendingString:hash]
+                         forKey:keyBundleHashCache];
+        }
+        resolve(hash);
+    });
+#endif
+}
+
 RCT_EXPORT_METHOD(markSuccess:(RCTPromiseResolveBlock)resolve
                                     rejecter:(RCTPromiseRejectBlock)reject)
 {
@@ -639,12 +727,12 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
     NSString *updateUrl = PushyOptionString(options, @"updateUrl");
     NSString *hash = PushyOptionString(options, @"hash");
 
-    if (PushyStringIsBlank(updateUrl) || PushyStringIsBlank(hash)) {
+    if (PushyStringIsBlank(updateUrl) || !PushyIsSafePathComponent(hash)) {
         callback(PushyErrorWithCode(pushy::error_codes::kInvalidOptions, ERROR_OPTIONS));
         return;
     }
     NSString *originHash = PushyOptionString(options, @"originHash");
-    if (type == PushyTypePatchFromPpk && PushyStringIsBlank(originHash)) {
+    if (type == PushyTypePatchFromPpk && !PushyIsSafePathComponent(originHash)) {
         callback(PushyErrorWithCode(pushy::error_codes::kInvalidOptions, ERROR_OPTIONS));
         return;
     }
@@ -838,7 +926,7 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
 
 - (BOOL)switchVersion:(NSString *)hash error:(NSError **)error
 {
-    if (PushyStringIsBlank(hash)) {
+    if (!PushyIsSafePathComponent(hash)) {
         if (error != NULL) {
             *error = PushyErrorWithCode(pushy::error_codes::kInvalidOptions, ERROR_OPTIONS);
         }
@@ -867,6 +955,10 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
     NSFileManager *fileManager = [NSFileManager defaultManager];
     BOOL isDirectory = NO;
     if ([fileManager fileExistsAtPath:path isDirectory:&isDirectory]) {
+        if (isDirectory) {
+            // Directories created by older versions never got the flag.
+            [RCTPushy excludeFromBackup:path];
+        }
         return isDirectory;
     }
 
@@ -878,10 +970,27 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
     if (!success && error != nil) {
         RCTLogWarn(@"Pushy create directory error: %@", error.localizedDescription);
     }
+    if (success) {
+        [RCTPushy excludeFromBackup:path];
+    }
 
     return success;
 }
 
+// Everything under rctpushy is re-downloadable, and Application Support is
+// backed up to iCloud by default — Apple requires such content to be
+// excluded from backups.
++ (void)excludeFromBackup:(NSString *)path
+{
+    NSURL *url = [NSURL fileURLWithPath:path isDirectory:YES];
+    NSError *error = nil;
+    if (![url setResourceValue:@YES
+                        forKey:NSURLIsExcludedFromBackupKey
+                         error:&error]) {
+        RCTLogWarn(@"Pushy exclude from backup error: %@", error.localizedDescription);
+    }
+}
+
 - (void)unzipFileAtPath:(NSString *)path
           toDestination:(NSString *)destination
       completionHandler:(void (^)(NSError *error))completionHandler

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "10.48.3",
+  "version": "10.50.0",
   "description": "react-native hot update",
   "main": "src/index",
   "types": "src/index.ts",

package/react-native-update.podspec

@@ -111,6 +111,7 @@ Pod::Spec.new do |s|
   s.subspec 'RCTPushy' do |ss|
     ss.source_files = ['ios/RCTPushy/*.{h,m,mm}',
                        'cpp/patch_core/archive_patch_core.{h,cpp}',
+                       'cpp/patch_core/digest.{h,cpp}',
                        'cpp/patch_core/hbc_transform.{h,cpp}',
                        'cpp/patch_core/hbc_transform_wire.{h,cpp}',
                        'cpp/patch_core/patch_core.{h,cpp}',

package/src/NativePushy.ts

@@ -20,6 +20,12 @@ export interface Spec extends TurboModule {
   restartApp(): Promise<void>;
   setNeedUpdate(options: { hash: string }): Promise<void>;
   markSuccess(): Promise<void>;
+  /**
+   * sha256 of the JS bundle embedded in the binary (the pdiff source), lazily
+   * computed and cached natively. Resolves to an empty string when unknown
+   * (debug build, no embedded bundle, hash failure) — never rejects.
+   */
+  getBundleHash(): Promise<string>;
   resetToPackagedBundle(): Promise<void>;
   downloadPatchFromPpk(options: {
     updateUrl: string;

package/src/client.ts

@@ -8,6 +8,7 @@ import {
   cInfo,
   currentVersion,
   currentVersionInfo,
+  getBundleHash,
   isFirstTime,
   isRolledBack,
   PushyModule,
@@ -51,6 +52,7 @@ import {
   noop,
   promiseAny,
   testUrls,
+  warn,
 } from './utils';
 
 /**
@@ -99,7 +101,7 @@ const excludeConfiguredEndpoints = (
 
 assertWeb();
 
-const defaultClientOptions: ClientOptions = {
+const createDefaultClientOptions = (): ClientOptions => ({
   appKey: '',
   autoMarkSuccess: true,
   updateStrategy: __DEV__ ? 'alwaysAlert' : 'alertUpdateAndIgnoreError',
@@ -107,7 +109,7 @@ const defaultClientOptions: ClientOptions = {
   logger: noop,
   debug: false,
   throwError: false,
-};
+});
 
 export const sharedState: {
   progressHandlers: Record<string, EmitterSubscription>;
@@ -131,6 +133,13 @@ export const sharedState: {
   applyingUpdate: false,
 };
 
+// The SDK is a process-level singleton: module-level sharedState, the global
+// i18n locale and the native update state are all per-process, so a second
+// client would silently share (and fight over) them. Constructing one is a
+// hard integration error, except for the idempotent re-creation of the same
+// client (same type + appKey), which dev fast-refresh triggers legitimately.
+let activeClient: Pushy | undefined;
+
 const assertHash = (hash: string) => {
   if (!sharedState.downloadedHash) {
     log(`no downloaded hash yet, ignore switch to ${hash}`);
@@ -145,7 +154,7 @@ const assertHash = (hash: string) => {
 
 // for China users
 export class Pushy {
-  options = { ...defaultClientOptions };
+  options: ClientOptions = createDefaultClientOptions();
   clientType: 'Pushy' | 'Cresc' = 'Pushy';
   lastChecking?: number;
   lastRespJson?: Promise<CheckResult>;
@@ -167,6 +176,23 @@ export class Pushy {
 
   constructor(options: ClientOptions, clientType?: 'Pushy' | 'Cresc') {
     this.clientType = clientType || 'Pushy';
+    if (activeClient) {
+      if (
+        activeClient.clientType === this.clientType &&
+        activeClient.options.appKey === options.appKey
+      ) {
+        // Same client re-created (e.g. fast refresh re-running the module
+        // that builds it): apply the latest options and hand back the
+        // existing instance instead of forking process-level state.
+        activeClient.setOptions(options);
+        // biome-ignore lint/correctness/noConstructorReturn: intentional singleton — identical re-creation must yield the existing instance
+        return activeClient;
+      }
+      throw new UpdateError(
+        i18n.t('error_client_singleton'),
+        'SINGLETON_VIOLATION'
+      );
+    }
     this.options.server = cloneServerConfig(SERVER_PRESETS[this.clientType]);
 
     i18n.setLocale(
@@ -191,8 +217,28 @@ export class Pushy {
         },
       });
     }
+    activeClient = this;
   }
 
+  /**
+   * Bumped on every setOptions call. `options` is mutated in place (its
+   * identity never changes), so reactive consumers (the UpdateProvider)
+   * subscribe via onOptionsChange and re-read using this version as the
+   * change signal.
+   */
+  optionsVersion = 0;
+  private optionsListeners = new Set<() => void>();
+  /**
+   * Subscribe to option changes (any setOptions call). Returns an
+   * unsubscribe function.
+   */
+  onOptionsChange = (listener: () => void) => {
+    this.optionsListeners.add(listener);
+    return () => {
+      this.optionsListeners.delete(listener);
+    };
+  };
+
   setOptions = (options: Partial<ClientOptions>) => {
     for (const [key, value] of Object.entries(options)) {
       if (value !== undefined) {
@@ -205,6 +251,34 @@ export class Pushy {
         }
       }
     }
+    this.optionsVersion++;
+    for (const listener of this.optionsListeners) {
+      try {
+        listener();
+      } catch (e: any) {
+        log('onOptionsChange listener error:', e?.message || e);
+      }
+    }
+  };
+
+  private providerMounted = false;
+  /**
+   * Called by UpdateProvider on mount. A second concurrently mounted
+   * provider is the same integration error as a second client — fail hard
+   * instead of double-subscribing app-state listeners and update checks.
+   * Returns the release function used on unmount.
+   */
+  claimProviderMount = () => {
+    if (this.providerMounted) {
+      throw new UpdateError(
+        this.t('error_provider_singleton'),
+        'SINGLETON_VIOLATION'
+      );
+    }
+    this.providerMounted = true;
+    return () => {
+      this.providerMounted = false;
+    };
   };
 
   /**
@@ -450,11 +524,12 @@ export class Pushy {
   };
   requestCheckResult = async (
     endpoint: string,
-    fetchPayload: Parameters<typeof fetch>[1]
+    fetchPayload: Parameters<typeof fetch>[1],
+    signal?: AbortSignal
   ) => {
     const resp = await fetchWithTimeout(
       this.getCheckUrl(endpoint),
-      fetchPayload,
+      signal ? { ...fetchPayload, signal } : fetchPayload,
       DEFAULT_FETCH_TIMEOUT_MS
     );
 
@@ -476,9 +551,13 @@ export class Pushy {
     const { endpoint, value } = await executeEndpointFallback<CheckResult>({
       configuredEndpoints: this.getConfiguredCheckEndpoints(),
       getRemoteEndpoints: this.getRemoteEndpoints,
-      tryEndpoint: async (currentEndpoint) => {
+      tryEndpoint: async (currentEndpoint, signal) => {
         try {
-          return await this.requestCheckResult(currentEndpoint, fetchPayload);
+          return await this.requestCheckResult(
+            currentEndpoint,
+            fetchPayload,
+            signal
+          );
         } catch (e) {
           log('check endpoint failed', currentEndpoint, e);
           throw e;
@@ -591,6 +670,11 @@ export class Pushy {
       this.notifyAfterCheckUpdate({ status: 'skipped' });
       return;
     }
+    // 内容寻址的二进制身份,服务端据此精确判定 pdiff 适用性(取代 buildTime
+    // 启发式)。同步读 core 里已预取的值:还没算完就省略字段(服务端回退
+    // buildTime 启发式),下一次检查自然带上——绝不为它 await、拖慢或复杂化
+    // 检查流程。
+    const bundleHash = __DEV__ ? '' : getBundleHash();
     const now = Date.now();
     if (
       this.lastRespJson &&
@@ -620,6 +704,7 @@ export class Pushy {
       cInfo,
       // 可消费的 diff 轨道版本(2 = hdiffv2 轨道),服务端据此门控下发
       ...(supportedDiffVersion ? { diffV: supportedDiffVersion } : {}),
+      ...(bundleHash ? { bundleHash } : {}),
       ...extra,
     };
     if (__DEV__) {
@@ -651,6 +736,16 @@ export class Pushy {
 
       log('checking result:', result);
 
+      if (result?.bundleStatus === 'unknownBundle') {
+        // 服务端判定当前二进制内嵌 bundle 未注册,增量已被降级为全量。只面向
+        // 开发者(日志 + 遥测,控制台聚合是主渠道);终端用户无感知。
+        warn(this.t('warn_unknown_bundle'));
+        this.report({
+          type: 'bundleMismatch',
+          data: bundleHash ? { bundleHash } : {},
+        });
+      }
+
       this.notifyAfterCheckUpdate({ status: 'completed', result });
       return result;
     } catch (e: any) {
@@ -886,6 +981,23 @@ export class Pushy {
       delete sharedState.progressHandlers[hash];
     }
     delete sharedState.progressCallbacks[hash];
+    if (succeeded && errorMessages.length > 0) {
+      // An earlier strategy failed and a later one rescued the download
+      // (e.g. pdiff copiesCrc mismatch on a rebuilt binary → full). Surface
+      // the degradation: it is invisible to the end user but tells the
+      // platform that incremental delivery is failing for this binary.
+      this.report({
+        type: 'downloadFallback',
+        // UpdateError.code already carries the classified native rejection
+        // code (PATCH_FAILED vs DOWNLOAD_FAILED).
+        code: lastError?.code,
+        data: {
+          newVersion: hash,
+          succeeded,
+        },
+        message: errorMessages.join(';'),
+      });
+    }
     if (!succeeded) {
       const message = errorMessages.join(';');
       if (lastError) {

package/src/core.ts

@@ -71,6 +71,33 @@ export const supportedDiffVersion: number =
   PushyConstants.supportedDiffVersion || 0;
 let uuid = PushyConstants.uuid;
 
+// bundleHash = sha256 of the JS bundle embedded in the binary (the pdiff
+// source). Content identity for the server's pdiff-applicability check,
+// replacing the buildTime heuristic. Natively lazy-computed and cached;
+// prefetched fire-and-forget at module load so the value is usually settled
+// before the first checkUpdate builds its body. Until then (first install,
+// slow device) getBundleHash returns '' and the field is simply omitted — the
+// server falls back to the buildTime heuristic and the next check carries it.
+// Deliberately synchronous at read time: checkUpdate must not await anything
+// between its dedup window and the fetch, and a hash is never worth delaying
+// a check for.
+let bundleHash = '';
+// The JS layer can arrive via hot update onto an older binary whose native
+// module predates the method, hence the feature detect. On web PushyModule is
+// a noop Proxy and the call settles to ''.
+if (typeof PushyModule.getBundleHash === 'function') {
+  Promise.resolve(PushyModule.getBundleHash())
+    .then((hash: unknown) => {
+      bundleHash = String(hash || '');
+    })
+    .catch((e: any) => {
+      log('getBundleHash failed:', e?.message || e);
+    });
+}
+
+/** '' while unknown (not yet computed, debug build, no embedded bundle, older native). */
+export const getBundleHash = (): string => bundleHash;
+
 async function getLocalHashInfo(hash: string) {
   return JSON.parse(await PushyModule.getLocalHashInfo(hash));
 }

package/src/endpoint.ts

@@ -14,9 +14,10 @@ export interface EndpointAttemptFailure {
 export interface ExecuteEndpointFallbackOptions<T> {
   configuredEndpoints: string[];
   getRemoteEndpoints?: () => Promise<string[]>;
-  tryEndpoint: (endpoint: string) => Promise<T>;
+  tryEndpoint: (endpoint: string, signal?: AbortSignal) => Promise<T>;
   random?: () => number;
   now?: () => number;
+  hedgeDelayMs?: number;
   onFirstFailure?: (failure: EndpointAttemptFailure) => void | Promise<void>;
 }
 
@@ -54,60 +55,104 @@ export const pickRandomEndpoint = (
   return endpoints[Math.floor(random() * endpoints.length)];
 };
 
-export async function selectFastestSuccessfulEndpoint<T>(
+export const DEFAULT_HEDGE_DELAY_MS = 250;
+
+/**
+ * Hedged race over the candidate endpoints: the first candidate starts
+ * immediately, each following one is only started after `hedgeDelayMs` of
+ * silence (or immediately when a previous attempt failed). The first
+ * successful response wins and every other in-flight request is aborted, so
+ * one slow endpoint never gates a fast one, and healthy rounds send a single
+ * request instead of blasting every candidate at once.
+ */
+export function selectFastestSuccessfulEndpoint<T>(
   endpoints: string[],
-  tryEndpoint: (endpoint: string) => Promise<T>,
-  now: () => number = Date.now
+  tryEndpoint: (endpoint: string, signal?: AbortSignal) => Promise<T>,
+  now: () => number = Date.now,
+  hedgeDelayMs: number = DEFAULT_HEDGE_DELAY_MS
 ): Promise<{
-  successes: EndpointAttemptSuccess<T>[];
+  success?: EndpointAttemptSuccess<T>;
   failures: EndpointAttemptFailure[];
 }> {
-  const attempts = await Promise.all(
-    endpoints.map(async (endpoint) => {
-      const start = now();
-      try {
-        const value = await tryEndpoint(endpoint);
-        return {
-          ok: true as const,
-          endpoint,
-          value,
-          duration: now() - start,
-        };
-      } catch (error) {
-        return {
-          ok: false as const,
-          endpoint,
-          error: normalizeError(error),
-        };
-      }
-    })
-  );
-
-  const successes: EndpointAttemptSuccess<T>[] = [];
-  const failures: EndpointAttemptFailure[] = [];
-
-  for (const attempt of attempts) {
-    if (attempt.ok) {
-      successes.push({
-        endpoint: attempt.endpoint,
-        value: attempt.value,
-        duration: attempt.duration,
-      });
-      continue;
+  return new Promise((resolve) => {
+    if (!endpoints.length) {
+      resolve({ failures: [] });
+      return;
     }
 
-    failures.push({
-      endpoint: attempt.endpoint,
-      error: attempt.error,
-    });
-  }
+    const failures: EndpointAttemptFailure[] = [];
+    const controllers: AbortController[] = [];
+    let nextIndex = 0;
+    let pending = 0;
+    let settled = false;
+    let hedgeTimer: ReturnType<typeof setTimeout> | undefined;
 
-  successes.sort((left, right) => left.duration - right.duration);
+    const finish = (success?: EndpointAttemptSuccess<T>) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (hedgeTimer) {
+        clearTimeout(hedgeTimer);
+      }
+      for (const controller of controllers) {
+        controller.abort();
+      }
+      resolve({ success, failures });
+    };
+
+    const launchNext = () => {
+      if (hedgeTimer) {
+        clearTimeout(hedgeTimer);
+        hedgeTimer = undefined;
+      }
+      if (settled || nextIndex >= endpoints.length) {
+        return;
+      }
+      const endpoint = endpoints[nextIndex++];
+      const controller =
+        typeof AbortController === 'undefined'
+          ? undefined
+          : new AbortController();
+      if (controller) {
+        controllers.push(controller);
+      }
+      pending++;
+      const start = now();
+      tryEndpoint(endpoint, controller?.signal)
+        .then((value) => {
+          if (controller) {
+            // Only the losing requests get aborted, not the winner's own
+            // (already settled) one.
+            const index = controllers.indexOf(controller);
+            if (index >= 0) {
+              controllers.splice(index, 1);
+            }
+          }
+          finish({ endpoint, value, duration: now() - start });
+        })
+        .catch((error) => {
+          pending--;
+          if (settled) {
+            // Losers cancelled after a win must not count as failures.
+            return;
+          }
+          failures.push({ endpoint, error: normalizeError(error) });
+          if (nextIndex < endpoints.length) {
+            // A failure frees its slot: hedge the next candidate right away
+            // instead of waiting out the stagger.
+            launchNext();
+          } else if (pending === 0) {
+            finish(undefined);
+          }
+        });
+      if (!settled && nextIndex < endpoints.length) {
+        hedgeTimer = setTimeout(launchNext, hedgeDelayMs);
+      }
+    };
 
-  return {
-    successes,
-    failures,
-  };
+    launchNext();
+  });
 }
 
 export async function executeEndpointFallback<T>({
@@ -116,6 +161,7 @@ export async function executeEndpointFallback<T>({
   tryEndpoint,
   random = Math.random,
   now = Date.now,
+  hedgeDelayMs = DEFAULT_HEDGE_DELAY_MS,
   onFirstFailure,
 }: ExecuteEndpointFallbackOptions<T>): Promise<EndpointAttemptSuccess<T>> {
   const excludedEndpoints = new Set<string>();
@@ -154,14 +200,15 @@ export async function executeEndpointFallback<T>({
         throw lastError;
       }
 
-      const { successes, failures } = await selectFastestSuccessfulEndpoint(
+      const { success, failures } = await selectFastestSuccessfulEndpoint(
         candidates,
         tryEndpoint,
-        now
+        now,
+        hedgeDelayMs
       );
 
-      if (successes.length) {
-        return successes[0];
+      if (success) {
+        return success;
       }
 
       for (const failure of failures) {