fix(cloudflare): reject restore times finer than a millisecond

`new Date` keeps only milliseconds, so `--timestamp
2026-10-16T09:30:00.123456Z` restored to .123, an earlier instant than
the one written, which could cross a write. `void db restore` now
accepts at most three fractional digits and says so in its error.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Brooooooklyn

docs/reference/cli/database.md

@@ -96,7 +96,7 @@ void db restore --bookmark <bookmark> [--platform cloudflare] [--yes]
 void db restore --timestamp <iso-time> [--platform cloudflare] [--yes]
 ```
 
-Restore the deployed D1 database of a direct Cloudflare deploy with D1 [Time Travel](https://developers.cloudflare.com/d1/reference/time-travel/). Before `void deploy --platform cloudflare` applies migrations, it prints the `--bookmark` that undoes them. `--timestamp` restores the state at an ISO 8601 time with `Z` or an offset instead, such as `2026-10-16T09:30:00Z`. Time Travel keeps 7 days of history on Workers Free and 30 days on Workers Paid. An older bookmark or time can no longer be restored: Cloudflare rejects it and the database stays unchanged. To undo an older migration, write a new migration that reverses it.
+Restore the deployed D1 database of a direct Cloudflare deploy with D1 [Time Travel](https://developers.cloudflare.com/d1/reference/time-travel/). Before `void deploy --platform cloudflare` applies migrations, it prints the `--bookmark` that undoes them. `--timestamp` restores the state at an ISO 8601 time with `Z` or an offset instead, such as `2026-10-16T09:30:00Z`, with at most millisecond precision. Time Travel keeps 7 days of history on Workers Free and 30 days on Workers Paid. An older bookmark or time can no longer be restored: Cloudflare rejects it and the database stays unchanged. To undo an older migration, write a new migration that reverses it.
 
 If the project's saved destination is not Cloudflare and you deployed once with `void deploy --platform cloudflare`, pass `--platform cloudflare`; deploy prints the command with it.
 

packages/void/src/cli/db-args.ts

@@ -146,12 +146,12 @@ const ACTION_FLAGS: Record<DbArgs['action'], Array<string>> = {
 
 /**
  * Read a restore time as a UTC ISO string. A time without a zone would depend on where the
- * command runs, and `new Date` rolls impossible dates over (Feb 30 becomes Mar 2), so both are
- * rejected instead of restoring to a moment the user did not write.
+ * command runs, `new Date` rolls impossible dates over (Feb 30 becomes Mar 2), and it keeps only
+ * milliseconds, so all three are rejected instead of restoring to a moment the user did not write.
  */
 function parseRestoreTime(value: string): string | undefined {
   const match =
-    /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|([+-])(\d{2}):(\d{2}))$/i.exec(
+    /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,3})?)?(?:Z|([+-])(\d{2}):(\d{2}))$/i.exec(
       value,
     );
   const time = new Date(value);
@@ -273,7 +273,7 @@ export function parseDbArgs(args: Array<string>): DbArgs {
         const time = parseRestoreTime(timestamp);
         if (!time) {
           throw new Error(
-            'db: --timestamp must be a valid ISO 8601 time with Z or an offset, for example 2026-10-16T09:30:00Z.',
+            'db: --timestamp must be a valid ISO 8601 time with Z or an offset and at most millisecond precision, for example 2026-10-16T09:30:00Z.',
           );
         }
         return { action, target: { timestamp: time }, platform, yes: values.yes };

packages/void/test/unit/db-args.test.ts

@@ -216,6 +216,8 @@ describe('parseDbArgs', () => {
     ['2024-02-29T23:59:59Z', '2024-02-29T23:59:59.000Z'],
     ['2026-10-16T09:30:00-05:30', '2026-10-16T15:00:00.000Z'],
     ['2026-01-01T00:30:00+01:00', '2025-12-31T23:30:00.000Z'],
+    ['2026-10-16T09:30:00.5Z', '2026-10-16T09:30:00.500Z'],
+    ['2026-10-16T09:30:00.123+08:00', '2026-10-16T01:30:00.123Z'],
   ])('reads the restore time %s as %s', (input, utc) => {
     expect(parseDbArgs(['restore', '--timestamp', input])).toMatchObject({
       target: { timestamp: utc },
@@ -236,6 +238,8 @@ describe('parseDbArgs', () => {
     [['--timestamp', '2026-10-16T09:30:00'], 'with Z or an offset'],
     [['--timestamp', '2026-02-30T09:30:00Z'], 'must be a valid ISO 8601 time'],
     [['--timestamp', '2026-10-16T24:00:00Z'], 'must be a valid ISO 8601 time'],
+    // `new Date` would truncate this to .123, an earlier instant than the user wrote.
+    [['--timestamp', '2026-10-16T09:30:00.123456Z'], 'at most millisecond precision'],
     [['--platform', 'void', '--bookmark', '00000085-0000024c'], "accepts only 'cloudflare'"],
     [['--bookmark=--dry-run'], '--bookmark must be a D1 restore point'],
     [['--bookmark', 'not-hex'], '--bookmark must be a D1 restore point'],