fix(cli): address review feedback on database usage and restore

- Validate --from/--to strictly: accept YYYY-MM-DD (expanded to midnight
  UTC, matching the API's ISO datetime contract) or a full ISO datetime,
  and reject rollover dates like 2026-02-30 that Date.parse silently
  accepts
- Keep --source-database in the CONFIRMATION_REQUIRED recovery command
  for cross-database restores
- Document DATABASE_BACKUP_NOT_FOUND and the date normalization rules in
  the command spec

Author: AmanVarshney01

docs/product/command-spec.md

@@ -873,7 +873,8 @@ Behavior:
 - resolves `<database>` by exact database id or exact database name inside the resolved project
 - `--branch <git-name>` narrows name resolution when the same database name exists on multiple Branches
 - `--from <iso-date>` and `--to <iso-date>` bound the reporting period; when omitted, the platform defaults the period to the current month so far
-- the CLI validates that `--from` and `--to` parse as dates and that `--from` is not after `--to` before calling the API
+- `--from` and `--to` accept a calendar date (`2026-06-01`) or an ISO datetime (`2026-06-01T12:00:00Z`); calendar dates are expanded to midnight UTC before calling the API, and the platform treats the end bound as inclusive of its day
+- the CLI rejects malformed or impossible calendar dates (for example `2026-02-30`) and a `--from` later than `--to` before calling the API
 - reports operations used (`ops`) and storage used (`GiB`) for the period, plus the resolved period bounds and the generation timestamp
 - read-only; never prints or returns connection strings, passwords, or endpoint secrets
 - fails with `DATABASE_NOT_FOUND` or `DATABASE_AMBIGUOUS` when the target cannot be selected safely
@@ -934,6 +935,7 @@ Behavior:
 - by default the backup must belong to the target database; `--source-database <database>` restores from another database's backup, for example a production backup into a scratch database, and requires access to both databases' projects
 - requires `--confirm <database-id>` where the value exactly matches the resolved target database id; `--yes` does not satisfy this confirmation
 - the restore runs asynchronously: the target database status becomes `recovering` until the restore completes, and `database show` reports the current status; `nextSteps` includes the show command
+- fails with `DATABASE_BACKUP_NOT_FOUND` when the backup id cannot be resolved for the source database
 - fails with `DATABASE_RESTORE_CONFLICT` when the target database is provisioning or already recovering
 - fails with `DATABASE_NOT_FOUND` or `DATABASE_AMBIGUOUS` when a database target cannot be selected safely
 - never prints or returns connection strings, passwords, or endpoint secrets

packages/cli/src/controllers/database.ts

@@ -489,14 +489,18 @@ export async function runDatabaseRestore(
       )
     : database;
 
+  const sourceDatabaseArg =
+    sourceDatabase.id === database.id
+      ? ""
+      : ` --source-database ${sourceDatabase.id}`;
   requireExactConfirmation({
     resourceName: "database",
     commandName: "database restore",
     id: database.id,
     confirm: flags.confirm,
     summary: "Confirm database restore",
     why: "Restoring immediately and irreversibly overwrites all data in the target database, so it requires the exact target database id.",
-    nextStep: `prisma-cli database restore ${database.id} --backup ${backupId} --confirm ${database.id}`,
+    nextStep: `prisma-cli database restore ${database.id} --backup ${backupId}${sourceDatabaseArg} --confirm ${database.id}`,
   });
 
   const restored = await provider.restoreDatabase({
@@ -568,6 +572,9 @@ export async function runDatabaseConnectionRotate(
   };
 }
 
+const USAGE_DATE_ONLY_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+const USAGE_DATETIME_PATTERN = /^\d{4}-\d{2}-\d{2}T/;
+
 function parseUsageDate(
   value: string | undefined,
   flagName: string,
@@ -576,20 +583,37 @@ function parseUsageDate(
     return undefined;
   }
 
+  // The Management API validates startDate/endDate as full ISO datetimes, so
+  // date-only input is expanded to midnight UTC. Date.parse alone is too
+  // permissive: it rolls over invalid calendar dates such as 2026-02-30, so
+  // the date part must round-trip through toISOString unchanged.
   const trimmed = value.trim();
-  if (!trimmed || Number.isNaN(Date.parse(trimmed))) {
-    throw usageError(
-      "Invalid usage period",
-      `${flagName} must be an ISO date such as 2026-06-01.`,
-      `Pass an ISO date to ${flagName}.`,
-      [
-        "prisma-cli database usage <database> --from 2026-06-01 --to 2026-06-30",
-      ],
-      "database",
-    );
+  if (USAGE_DATE_ONLY_PATTERN.test(trimmed) && isValidCalendarDate(trimmed)) {
+    return `${trimmed}T00:00:00.000Z`;
+  }
+  if (
+    USAGE_DATETIME_PATTERN.test(trimmed) &&
+    !Number.isNaN(Date.parse(trimmed)) &&
+    isValidCalendarDate(trimmed.slice(0, 10))
+  ) {
+    return trimmed;
   }
 
-  return trimmed;
+  throw usageError(
+    "Invalid usage period",
+    `${flagName} must be an ISO date such as 2026-06-01 or an ISO datetime such as 2026-06-01T12:00:00Z.`,
+    `Pass an ISO date or datetime to ${flagName}.`,
+    ["prisma-cli database usage <database> --from 2026-06-01 --to 2026-06-30"],
+    "database",
+  );
+}
+
+function isValidCalendarDate(datePart: string): boolean {
+  const timestamp = Date.parse(`${datePart}T00:00:00.000Z`);
+  return (
+    !Number.isNaN(timestamp) &&
+    new Date(timestamp).toISOString().startsWith(datePart)
+  );
 }
 
 function parseBackupLimit(value: string | undefined): number | undefined {

packages/cli/tests/database.test.ts

@@ -546,6 +546,70 @@ describe("database commands", () => {
     expect(stderr).toContain("1.25 GiB");
   });
 
+  it("normalizes calendar dates and accepts ISO datetimes for usage periods", async () => {
+    const { cwd, stateDir } = await setupLinkedProject();
+
+    const dateOnly = await executeCli({
+      argv: [
+        "database",
+        "usage",
+        "db_123",
+        "--from",
+        "2026-06-01",
+        "--to",
+        "2026-06-30",
+        "--json",
+      ],
+      cwd,
+      stateDir,
+      fixturePath,
+    });
+    const dateOnlyPayload = JSON.parse(dateOnly.stdout);
+
+    expect(dateOnly.exitCode).toBe(0);
+    expect(dateOnlyPayload.result.period).toMatchObject({
+      start: "2026-06-01T00:00:00.000Z",
+      end: "2026-06-30T00:00:00.000Z",
+    });
+
+    const dateTime = await executeCli({
+      argv: [
+        "database",
+        "usage",
+        "db_123",
+        "--from",
+        "2026-06-01T12:00:00Z",
+        "--json",
+      ],
+      cwd,
+      stateDir,
+      fixturePath,
+    });
+    const dateTimePayload = JSON.parse(dateTime.stdout);
+
+    expect(dateTime.exitCode).toBe(0);
+    expect(dateTimePayload.result.period.start).toBe("2026-06-01T12:00:00Z");
+  });
+
+  it("rejects impossible calendar dates for usage periods", async () => {
+    const { cwd, stateDir } = await setupLinkedProject();
+
+    const result = await executeCli({
+      argv: ["database", "usage", "db_123", "--from", "2026-02-30", "--json"],
+      cwd,
+      stateDir,
+      fixturePath,
+    });
+    const payload = JSON.parse(result.stdout);
+
+    expect(result.exitCode).toBe(2);
+    expect(payload).toMatchObject({
+      ok: false,
+      command: "database.usage",
+      error: { code: "USAGE_ERROR" },
+    });
+  });
+
   it("rejects an invalid usage period before calling the API", async () => {
     const { cwd, stateDir } = await setupLinkedProject();
 
@@ -779,6 +843,33 @@ describe("database commands", () => {
     });
   });
 
+  it("keeps --source-database in the confirmation recovery command", async () => {
+    const { cwd, stateDir } = await setupLinkedProject();
+
+    const result = await executeCli({
+      argv: [
+        "database",
+        "restore",
+        "acme-preview",
+        "--backup",
+        "bkp_201",
+        "--source-database",
+        "acme-production",
+        "--json",
+      ],
+      cwd,
+      stateDir,
+      fixturePath,
+    });
+    const payload = JSON.parse(result.stdout);
+
+    expect(result.exitCode).toBe(2);
+    expect(payload.error.code).toBe("CONFIRMATION_REQUIRED");
+    expect(payload.nextSteps).toEqual([
+      "prisma-cli database restore db_123 --backup bkp_201 --source-database db_456 --confirm db_123",
+    ]);
+  });
+
   it("restores from another database's backup with --source-database", async () => {
     const { cwd, stateDir } = await setupLinkedProject();