fix(usage): reject an empty custom date instead of reading it as absent

`if (!value) return true` let `?start-date=` through, the route's ternary turned
the empty string into `undefined`, and the partial-selection fallback answered
about the current period rather than the range named in the request.

Absent stays valid — the picker clears the param rather than blanking it, and a
missing bound is a real state the resolver handles. Explicitly blank is only
reachable from a hand-built request, where a 400 beats a window nobody asked for.

Deliberately different from `usageLimitSchema`, which does coerce `''` to its
default: that field declares one, so omission has a documented meaning. These
bounds declare none, so treating blank as absent substitutes a different answer
rather than a default one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/api/contracts/organization-usage.test.ts

@@ -37,6 +37,14 @@ describe('organization usage window contract', () => {
     expect(parseWindow({ startDate: '2026-02-30T00:00:00' }).success).toBe(false)
   })
 
+  it('refuses an empty date but allows an absent one', () => {
+    // The picker clears the param rather than blanking it, so `?start-date=` is a
+    // malformed request — and treating it as absent silently answered about the
+    // current period instead of the range the caller named.
+    expect(parseWindow({ startDate: '' }).success).toBe(false)
+    expect(parseWindow({}).success).toBe(true)
+  })
+
   it('treats an empty limit as omitted rather than as zero', () => {
     // `z.coerce.number()` turns `''` into `0`, which then fails `.min(1)` — so a
     // client serializing an unset filter got a 400 instead of the declared default.

apps/sim/lib/api/contracts/organization-usage.ts

@@ -63,7 +63,18 @@ const isoDateSchema = z
   .optional()
   .refine(
     (value) => {
-      if (!value) return true
+      /*
+        Absent is allowed; empty is not. A missing bound is a real state — the picker
+        clears the param rather than blanking it — and the resolver falls back to the
+        current period for it. An explicit `?start-date=` is a malformed request, and
+        treating it as absent silently answered about a different window than the one
+        asked for.
+
+        Deliberately unlike `usageLimitSchema`, which does coerce `''` to its default:
+        that field declares a default, so omission has a documented meaning. These
+        bounds have none — omitting one changes which period you get.
+      */
+      if (value === undefined) return true
       if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) return false
       return new Date(`${value}T00:00:00.000Z`).toISOString().slice(0, 10) === value
     },