fix!: rename ActivityDefaultOptions, order the duration guard, state schedule update concurrency

Review remediation on the v8 audit branch.

- `ActivityDefaultOptions` -> `ContractActivityOptions`. The property was
  renamed to `activityOptions` in the earlier sweep but the type name was
  missed; the new name also keeps the contract-level, portable subset
  distinct from Temporal's own `ActivityOptions`, which is what the
  worker-side `activityOptionsByName` overrides take.

- `assertDuration` checks the cheap length cap before running the regex.
  The pattern is linear so this was never exploitable, just the wrong order.

- `TypedScheduleHandle.update`'s JSDoc claimed Temporal retries `updateFn`
  on a server-side conflict. It does not: in SDK 1.20.3 `ScheduleHandle.update`
  describes once, calls `updateFn` once, and `_updateSchedule` sends no
  conflict token, so `UpdateSchedule` is unconditional. Concurrent updates are
  last-writer-wins in the raw SDK too. Documented plainly, including the one
  thing the wrapper does change (an extra `describe`, slightly widening the
  window) and the one guarantee it keeps (validated options == persisted
  options).

Author: btravers

packages/client/src/schedule.ts

@@ -132,12 +132,18 @@ export type TypedScheduleHandle = {
    * has no schema to check it against); prefer delete + `create` for
    * contract-level changes.
    *
-   * Implementation note: validation is asynchronous (schemas may be), so
-   * the description is fetched by this wrapper and the *already-computed*
-   * options are handed to Temporal's `ScheduleHandle.update`. `updateFn` is
-   * therefore invoked exactly once per call — on a server-side conflict the
-   * same computed options are retried, rather than `updateFn` being re-run
-   * against a fresh description.
+   * Concurrency: **last writer wins.** Temporal's `UpdateSchedule` RPC is
+   * unconditional — the TypeScript SDK sends no conflict token and does not
+   * re-run `updateFn` on a conflict — so a concurrent modification landing
+   * between the read and the write is overwritten. That is true of the raw
+   * SDK too; this wrapper does not weaken it, but it does widen the window
+   * slightly: validation is asynchronous (schemas may be), so the wrapper
+   * fetches the description itself and hands the *already-computed* options
+   * to `ScheduleHandle.update`, which describes again internally. `updateFn`
+   * is invoked exactly once per call, and the options that are validated are
+   * exactly the options that are persisted.
+   *
+   * If two writers can race on one schedule, serialize them yourself.
    */
   update: (
     updateFn: (

packages/contract/src/builder.ts

@@ -570,7 +570,9 @@ function assertDuration(context: string, key: string, value: unknown): void {
   if (typeof value !== "string") {
     fail(`${context}: ${key} must be an ms-formatted string or a number of milliseconds`);
   }
-  if (!MS_DURATION_PATTERN.test(value) || value.length > 100) {
+  // Cheap length cap first: the regex is linear, but there is no reason to
+  // run it over an arbitrarily long string when the cap rejects it anyway.
+  if (value.length > 100 || !MS_DURATION_PATTERN.test(value)) {
     fail(
       `${context}: ${key} has invalid duration "${value}" — expected an ms-formatted string (a number followed by an optional unit ms/s/m/h/d/w/y or its long form, e.g. "30s", "5 minutes", "1.5h") or a number of milliseconds`,
     );

packages/contract/src/index.ts

@@ -28,7 +28,7 @@ export type {
   InferErrorData,
   InferErrorDataInput,
   // Contract-level activity option defaults
-  ActivityDefaultOptions,
+  ContractActivityOptions,
   ActivityRetryPolicy,
   DurationValue,
   // Search attributes

packages/contract/src/types.ts

@@ -64,7 +64,8 @@ export type ActivityRetryPolicy = {
 };
 
 /**
- * Contract-level default `ActivityOptions` for a single activity.
+ * Contract-level default activity options for a single activity — the
+ * portable subset of Temporal's `ActivityOptions`.
  *
  * Declared on `defineActivity` so operational behavior (timeouts, retry
  * policy) ships with the contract as a single source of truth shared by
@@ -80,7 +81,7 @@ export type ActivityRetryPolicy = {
  * deliberately excluded — those belong to the worker's
  * `activityOptionsByName`, not the portable contract.
  */
-export type ActivityDefaultOptions = {
+export type ContractActivityOptions = {
   readonly startToCloseTimeout?: DurationValue;
   readonly scheduleToCloseTimeout?: DurationValue;
   readonly scheduleToStartTimeout?: DurationValue;
@@ -99,7 +100,7 @@ export type ActivityDefinition<
   readonly input: TInput;
   readonly output: TOutput;
   readonly errors?: TErrors;
-  readonly activityOptions?: ActivityDefaultOptions;
+  readonly activityOptions?: ContractActivityOptions;
 };
 
 /**