@bygghammar/cms-platform 0.95.0 → 0.97.0

package/src/server/page-visibility-core.ts

@@ -11,6 +11,11 @@
  * | `page.listing.<page uuid>`    | `{ "listing": "link-only" }`   | listed         |
  * | `booking`                     | `{ "enabled": false }`         | booking on     |
  * | `booking.exception.<uuid>`    | `{ "exception": true }`        | no exception   |
+ * | `booking.landing.<uuid>`      | `{ "landing": true, "notice"?: … }` | not a landing page |
+ * | `booking.landing.default`     | `{ "notice": … }`              | built-in copy  |
+ *
+ * A landing page leaves the site's menus and page lists while booking is off
+ * and stays live and indexable (see `cms/booking-landing`).
  *
  * Keys use the page's id, never its key or address, so every alias and locale
  * of a page shares one decision, a restored page keeps its own, and a page
@@ -25,6 +30,14 @@
  * None of these rows is an `OVERRIDABLE_SETTING_KEYS` key, so the generic
  * settings save and reset cannot read, overwrite or erase them.
  */
+import {
+  NoticeValidationError,
+  noticeLinkHrefs,
+  normalizeNoticeContent,
+  normalizePageNoticeOverride,
+  type NoticeContent,
+  type PageNoticeOverride,
+} from "../cms/booking-landing";
 import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
 import {
   nextPublicationBoundary,
@@ -49,6 +62,8 @@ export const SITE_SETTINGS = "site_settings";
 export const PAGE_LISTING_PREFIX = "page.listing.";
 export const BOOKING_SETTING_KEY = "booking";
 export const BOOKING_EXCEPTION_PREFIX = "booking.exception.";
+export const BOOKING_LANDING_PREFIX = "booking.landing.";
+export const BOOKING_LANDING_DEFAULT_KEY = "booking.landing.default";
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
@@ -63,8 +78,28 @@ export type VisibilityDeps = {
    * by the browser.
    */
   protectedPageKeys: readonly string[];
+  /**
+   * The host's check of a booking-off notice link against its own routes:
+   * why the link may not be used (it leads to the host's booking page, or to a
+   * page hidden while booking is hidden), or null. Supplied by the host's
+   * server code. Without it only the platform's own rules apply (no booking
+   * site, safe address forms).
+   */
+  noticeTargetProblem?: (href: string) => string | null | Promise<string | null>;
 };
 
+/** Refuse a notice whose link the host says leads to booking or to a hidden page. */
+async function assertNoticeTargets(
+  deps: Pick<VisibilityDeps, "noticeTargetProblem">,
+  notice: NoticeContent | PageNoticeOverride,
+): Promise<void> {
+  if (!deps.noticeTargetProblem) return;
+  for (const href of noticeLinkHrefs(notice)) {
+    const problem = await deps.noticeTargetProblem(href);
+    if (problem) throw new NoticeValidationError(problem);
+  }
+}
+
 /** Someone else changed the same decision since the editor last looked. */
 export class VisibilityConflictError extends Error {
   readonly code = "visibility_conflict";
@@ -96,10 +131,31 @@ export async function readVisibilitySettingsCore(client: any): Promise<Visibilit
     booking: { enabled: true, version: null },
     listings: new Map(),
     exceptions: new Map(),
+    landings: new Map(),
+    landingDefault: { notice: null, version: null },
   };
   for (const row of (data ?? []) as SettingRow[]) {
     const version = row.updated_at ?? null;
-    if (row.key === BOOKING_SETTING_KEY) {
+    if (row.key === BOOKING_LANDING_DEFAULT_KEY) {
+      // Stored copy is read leniently: a field that no longer validates is
+      // left out rather than failing every public page.
+      const notice = record(row.value)["notice"];
+      settings.landingDefault = {
+        notice: notice == null ? null : normalizeNoticeContent(notice, false),
+        version,
+      };
+    } else if (row.key.startsWith(BOOKING_LANDING_PREFIX)) {
+      const pageId = row.key.slice(BOOKING_LANDING_PREFIX.length);
+      if (UUID.test(pageId)) {
+        const value = record(row.value);
+        settings.landings.set(pageId.toLowerCase(), {
+          // Only an explicit `true` makes a landing page.
+          landing: value["landing"] === true,
+          notice: normalizePageNoticeOverride(value["notice"], false),
+          version,
+        });
+      }
+    } else if (row.key === BOOKING_SETTING_KEY) {
       // Only an explicit `false` turns booking off; anything else is today's behaviour.
       settings.booking = { enabled: record(row.value)["enabled"] !== false, version };
     } else if (row.key.startsWith(PAGE_LISTING_PREFIX)) {
@@ -127,6 +183,8 @@ export type VisibilitySettings = {
   booking: { enabled: boolean; version: VersionToken };
   listings: Map<string, { listing: PageListing; version: VersionToken }>;
   exceptions: Map<string, { exception: boolean; version: VersionToken }>;
+  landings: Map<string, { landing: boolean; notice: PageNoticeOverride; version: VersionToken }>;
+  landingDefault: { notice: NoticeContent | null; version: VersionToken };
 };
 
 /**
@@ -304,7 +362,14 @@ export async function setBookingExceptionCore(
   if (!UUID.test(input.pageId)) throw new Error("Page not found");
   // Adding needs a page that exists; removing works even for one in the trash.
   let name = "this page";
-  if (input.exception) name = (await readLivePage(context.supabase, input.pageId)).name;
+  if (input.exception) {
+    name = (await readLivePage(context.supabase, input.pageId)).name;
+    // A page cannot both keep its booking links and be a booking-off landing page.
+    const settings = await readVisibilitySettingsCore(context.supabase);
+    if (settings.landings.get(input.pageId.toLowerCase())?.landing === true) {
+      throw new BookingConflictError(name, "landing");
+    }
+  }
   invalidatePublishedCache();
   const version = await compareAndSwap(
     context.supabase,
@@ -329,6 +394,114 @@ export async function setBookingExceptionCore(
   return { exception: input.exception, version };
 }
 
+/** Thrown when one page would both keep its booking links and be a booking-off landing page. */
+export class BookingConflictError extends Error {
+  readonly code = "booking_conflict";
+  constructor(name: string, already: "exception" | "landing") {
+    super(
+      already === "exception"
+        ? `“${name}” keeps its booking links while booking is hidden, so it cannot also be hidden ` +
+            "from the website. Remove it from “Pages that keep their booking links” first."
+        : `“${name}” is hidden from the website while booking is hidden, so it cannot also keep ` +
+            "its booking links. Remove it from “Pages hidden from the website while booking is hidden” first.",
+    );
+    this.name = "BookingConflictError";
+  }
+}
+
+/**
+ * Add a page to, or remove it from, the booking-off landing pages, or change
+ * its own notice.
+ *
+ * Adding needs a page that exists, is not protected (the start page and the
+ * contact page always stay in the menus) and does not keep its booking links.
+ * Removing works even for a page in the trash, and drops its own notice.
+ * Listing, publication, schedules and indexing are not touched: the page stays
+ * exactly as reachable and indexable as it was.
+ */
+export async function setBookingLandingCore(
+  deps: VisibilityDeps,
+  input: {
+    pageId: string;
+    landing: boolean;
+    notice?: unknown;
+    expectedVersion: VersionToken;
+  },
+): Promise<{ landing: boolean; version: string }> {
+  const { context } = deps;
+  await assertStaff(context);
+  if (!UUID.test(input.pageId)) throw new Error("Page not found");
+  const pageId = input.pageId.toLowerCase();
+  let name = "this page";
+  let value: Record<string, unknown> = { landing: false };
+  if (input.landing) {
+    const page = await readLivePage(context.supabase, pageId);
+    name = page.name;
+    assertNotProtected(deps.protectedPageKeys, page, "hidden from the website while booking is hidden");
+    // Validated here as well as in the request schema: the core is the authority.
+    const notice = normalizePageNoticeOverride(input.notice ?? null, true);
+    await assertNoticeTargets(deps, notice);
+    const settings = await readVisibilitySettingsCore(context.supabase);
+    if (settings.exceptions.get(pageId)?.exception === true) {
+      throw new BookingConflictError(name, "exception");
+    }
+    value = Object.keys(notice).length > 0 ? { landing: true, notice } : { landing: true };
+  }
+  invalidatePublishedCache();
+  const version = await compareAndSwap(
+    context.supabase,
+    `${BOOKING_LANDING_PREFIX}${pageId}`,
+    value,
+    input.expectedVersion,
+    context.userId,
+    `whether ${input.landing ? `“${name}”` : name} is hidden while booking is hidden`,
+  );
+  invalidatePublishedCache();
+  await auditAs(context, {
+    action: "booking.landing",
+    entity: "pages",
+    entityId: pageId,
+    meta: {
+      landing: input.landing,
+      ownNotice: input.landing && "notice" in value,
+      description: input.landing
+        ? `Set "${name}" to leave the website's menus and page lists while booking is hidden; it stays reachable and indexable.`
+        : "Removed a page from the pages hidden from the website while booking is hidden.",
+    },
+  });
+  return { landing: input.landing, version };
+}
+
+/** Save the site-wide booking-off notice. */
+export async function setBookingLandingDefaultCore(
+  deps: Pick<VisibilityDeps, "context" | "noticeTargetProblem">,
+  input: { notice: unknown; expectedVersion: VersionToken },
+): Promise<{ version: string }> {
+  const { context } = deps;
+  await assertStaff(context);
+  const notice = normalizeNoticeContent(input.notice, true);
+  await assertNoticeTargets(deps, notice);
+  invalidatePublishedCache();
+  const version = await compareAndSwap(
+    context.supabase,
+    BOOKING_LANDING_DEFAULT_KEY,
+    { notice },
+    input.expectedVersion,
+    context.userId,
+    "the booking-off notice",
+  );
+  invalidatePublishedCache();
+  await auditAs(context, {
+    action: "booking.landing.default",
+    entity: SITE_SETTINGS,
+    entityId: BOOKING_LANDING_DEFAULT_KEY,
+    meta: {
+      description: "Changed the notice booking-off landing pages show while booking is hidden.",
+    },
+  });
+  return { version };
+}
+
 /** Booking setting and its exception pages, for the settings screen. */
 export type BookingSettingsView = {
   enabled: boolean;
@@ -346,6 +519,28 @@ export type BookingSettingsView = {
    * ones: adding a page back has to send the version of the row it left.
    */
   rowVersions: Record<string, VersionToken>;
+  /** Booking-off landing pages and their notice. */
+  landing: {
+    /** The stored default notice (empty fields use the built-in copy), and its version. */
+    default: { notice: NoticeContent | null; version: VersionToken };
+    pages: Array<{
+      pageId: string;
+      key: string | null;
+      name: string | null;
+      /** The page is in the trash or gone: the setting does nothing until restored. */
+      missing: boolean;
+      notice: PageNoticeOverride;
+      version: VersionToken;
+      /**
+       * Stored as a booking exception too. It is treated as an exception only
+       * — it keeps its booking links and stays in the menus — until somebody
+       * removes it from one of the lists.
+       */
+      conflict: boolean;
+    }>;
+    /** Versions of every stored landing row by page id, removed ones included. */
+    rowVersions: Record<string, VersionToken>;
+  };
 };
 
 export async function readBookingSettingsCore(
@@ -355,17 +550,40 @@ export async function readBookingSettingsCore(
   await assertStaff(context);
   const settings = await readVisibilitySettingsCore(context.supabase);
   const ids = [...settings.exceptions].filter(([, row]) => row.exception).map(([id]) => id);
+  const landingIds = [...settings.landings].filter(([, row]) => row.landing).map(([id]) => id);
   const pages = new Map<string, PageRow>();
-  if (ids.length > 0) {
+  const wanted = [...new Set([...ids, ...landingIds])];
+  if (wanted.length > 0) {
     const { data, error } = await context.supabase
       .from("pages")
       .select("id,key,name")
-      .in("id", ids)
+      .in("id", wanted)
       .is("deleted_at", null);
     if (error) throw new Error(error.message);
     for (const row of (data ?? []) as PageRow[]) pages.set(row.id.toLowerCase(), row);
   }
+  const byName = (a: { name: string | null }, b: { name: string | null }) =>
+    (a.name ?? "~").localeCompare(b.name ?? "~");
   return {
+    landing: {
+      default: settings.landingDefault,
+      pages: landingIds
+        .map((pageId) => {
+          const page = pages.get(pageId);
+          const row = settings.landings.get(pageId)!;
+          return {
+            pageId,
+            key: page?.key ?? null,
+            name: page?.name ?? null,
+            missing: !page,
+            notice: row.notice,
+            version: row.version,
+            conflict: settings.exceptions.get(pageId)?.exception === true,
+          };
+        })
+        .sort(byName),
+      rowVersions: Object.fromEntries([...settings.landings].map(([id, row]) => [id, row.version])),
+    },
     enabled: settings.booking.enabled,
     version: settings.booking.version,
     exceptions: ids
@@ -443,8 +661,16 @@ async function readPublicPolicy(client: any): Promise<PublicPolicySnapshot> {
       live: publicVersionId(byPage.get(row.id) ?? [], now) !== null,
       listing: settings.listings.get(id)?.listing ?? "listed",
       bookingException: settings.exceptions.get(id)?.exception === true,
+      bookingLanding: settings.landings.get(id)?.landing === true,
+      landingNotice: settings.landings.get(id)?.landing ? settings.landings.get(id)!.notice : null,
     };
   });
 
-  return { known: true, bookingEnabled: settings.booking.enabled, pages, revalidateAt };
+  return {
+    known: true,
+    bookingEnabled: settings.booking.enabled,
+    pages,
+    revalidateAt,
+    landingDefault: settings.landingDefault.notice,
+  };
 }

package/src/server/popup-optin-webhook-core.ts

@@ -25,6 +25,14 @@
  * Server-only. Never import from client code.
  */
 
+import {
+  fetchTransport,
+  injectedFetchResolver,
+  safeRequest,
+  WEBHOOK_POLICY,
+  type Resolver,
+  type Transport,
+} from "./outbound-http";
 import { checkWebhookUrl } from "./webhook-url-guard";
 
 export const POPUP_WEBHOOK_SCHEMA_VERSION = 1;
@@ -56,8 +64,15 @@ export interface OptInWebhookInput {
   readonly timeoutMs?: number;
   readonly maxResponseBytes?: number;
   readonly maxRedirects?: number;
-  /** Injected in tests. */
+  /**
+   * Test seam: requests go through this fetch instead of the network. Every
+   * hop is still checked and followed by the outbound policy, but names are
+   * not looked up and the connection is not pinned. Production passes none.
+   */
   readonly fetchImpl?: typeof fetch;
+  /** Test seams for the pinned path: a fake resolver and transport. */
+  readonly resolver?: Resolver;
+  readonly transport?: Transport;
   readonly now?: () => number;
 }
 
@@ -147,71 +162,6 @@ export async function signBody(
     .digest("hex");
 }
 
-/**
- * Read at most `limit` bytes of a response, then stop.
- *
- * A receiver that answers with a gigabyte would otherwise hold this server's
- * memory hostage. Nothing is done with the body but the read has to be bounded.
- */
-async function drainBounded(
-  response: Response,
-  limit: number,
-): Promise<boolean> {
-  const body = response.body;
-  if (body === null) return true;
-  const reader = body.getReader();
-  let total = 0;
-  try {
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done) return true;
-      total += value?.byteLength ?? 0;
-      if (total > limit) return false;
-    }
-  } finally {
-    await reader.cancel().catch(() => undefined);
-  }
-}
-
-/**
- * POST with every redirect hop re-validated.
- *
- * `redirect: "manual"` is what makes the guard meaningful: with the default
- * `follow`, the runtime chases a 302 into the private network before any of
- * this code sees it.
- */
-async function postWithGuardedRedirects(
-  url: string,
-  init: RequestInit,
-  options: { fetchImpl: typeof fetch; maxRedirects: number; maxBytes: number },
-): Promise<
-  | { response: Response; oversize: boolean }
-  | { blocked: DeliveryOutcome["errorCategory"] }
-> {
-  let target = url;
-  for (let hop = 0; hop <= options.maxRedirects; hop += 1) {
-    const check = checkWebhookUrl(target);
-    if (!check.ok) return { blocked: "blocked-endpoint" };
-
-    const response = await options.fetchImpl(target, {
-      ...init,
-      redirect: "manual",
-    });
-
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get("location");
-      if (location === null) return { response, oversize: false };
-      // Resolve relative redirects against the hop we actually made.
-      target = new URL(location, target).toString();
-      continue;
-    }
-
-    const withinLimit = await drainBounded(response, options.maxBytes);
-    return { response, oversize: !withinLimit };
-  }
-  return { blocked: "too-many-redirects" };
-}
-
 /**
  * Deliver one opt-in. Never throws.
  *
@@ -224,9 +174,6 @@ export async function deliverOptInWebhook(
 ): Promise<DeliveryOutcome> {
   const now = input.now ?? Date.now;
   const startedAt = now();
-  const fetchImpl = input.fetchImpl ?? fetch;
-  const maxBytes = input.maxResponseBytes ?? DEFAULT_MAX_BYTES;
-  const maxRedirects = input.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
 
   const check = checkWebhookUrl(input.endpoint);
   if (!check.ok) {
@@ -242,84 +189,76 @@ export async function deliverOptInWebhook(
   const timestamp = String(Math.floor(now() / 1000));
   const signature = await signBody(input.signingSecret, timestamp, body);
 
-  const controller = new AbortController();
-  const timer = setTimeout(
-    () => controller.abort(),
-    input.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-  );
-
-  try {
-    const result = await postWithGuardedRedirects(
-      check.url.toString(),
-      {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          "user-agent": "cms-platform-webhooks/1",
-          "x-webhook-event":
-            input.test === true ? "popup.opt_in.test" : "popup.opt_in",
-          "x-webhook-event-id": input.eventId,
-          // The receiver deduplicates on this. Retries of the same opt-in
-          // reuse the same value, which is what makes a retry safe.
-          "x-webhook-idempotency-key": input.eventId,
-          "x-webhook-timestamp": timestamp,
-          "x-webhook-signature": `v1=${signature}`,
-        },
-        body,
-        signal: controller.signal,
-      },
-      { fetchImpl, maxRedirects, maxBytes },
-    );
+  // Every hop is checked, looked up, pinned and capped by the shared outbound
+  // policy; redirects are followed there, never by the runtime.
+  const network = input.fetchImpl
+    ? { transport: fetchTransport(input.fetchImpl), resolver: injectedFetchResolver }
+    : { transport: input.transport, resolver: input.resolver };
+  const result = await safeRequest({
+    url: check.url.toString(),
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "user-agent": "cms-platform-webhooks/1",
+      "x-webhook-event": input.test === true ? "popup.opt_in.test" : "popup.opt_in",
+      "x-webhook-event-id": input.eventId,
+      // The receiver deduplicates on this. Retries of the same opt-in
+      // reuse the same value, which is what makes a retry safe.
+      "x-webhook-idempotency-key": input.eventId,
+      "x-webhook-timestamp": timestamp,
+      "x-webhook-signature": `v1=${signature}`,
+    },
+    body,
+    policy: {
+      ...WEBHOOK_POLICY,
+      timeoutMs: input.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      maxResponseBytes: input.maxResponseBytes ?? DEFAULT_MAX_BYTES,
+      maxRedirects: input.maxRedirects ?? DEFAULT_MAX_REDIRECTS,
+    },
+    ...network,
+  });
+  const durationMs = now() - startedAt;
 
-    if ("blocked" in result) {
-      return {
-        ok: false,
-        errorCategory: result.blocked,
-        error:
-          result.blocked === "too-many-redirects"
-            ? "The endpoint redirected too many times."
-            : "The endpoint redirected to an address inside this server's network.",
-        durationMs: now() - startedAt,
-      };
+  if (!result.ok) {
+    switch (result.failure) {
+      case "blocked-url":
+      case "blocked-address":
+        return {
+          ok: false,
+          errorCategory: "blocked-endpoint",
+          error: "The endpoint, or an address it redirected to, is not a public https address.",
+          durationMs,
+        };
+      case "cross-origin-redirect":
+        return {
+          ok: false,
+          errorCategory: "blocked-endpoint",
+          error: "The endpoint redirected to another site; an opt-in is only sent to the configured address.",
+          durationMs,
+        };
+      case "too-many-redirects":
+        return { ok: false, errorCategory: "too-many-redirects", error: "The endpoint redirected too many times.", durationMs };
+      case "too-large":
+        return { ok: false, errorCategory: "too-large", error: "The endpoint's reply was too large.", durationMs };
+      case "timeout":
+        return { ok: false, errorCategory: "timeout", error: "The endpoint did not answer in time.", durationMs };
+      default:
+        return { ok: false, errorCategory: "network", error: "The endpoint could not be reached.", durationMs };
     }
+  }
 
-    const { response, oversize } = result;
-    if (oversize) {
-      return {
-        ok: false,
-        status: response.status,
-        errorCategory: "too-large",
-        error: "The endpoint's reply was too large.",
-        durationMs: now() - startedAt,
-      };
-    }
-    if (!response.ok) {
-      return {
-        ok: false,
-        status: response.status,
-        errorCategory: "http-error",
-        // Deliberately not the response body: it is attacker-influenced text
-        // that would end up in an administrator's screen and the logs.
-        error: `The endpoint answered ${response.status}.`,
-        durationMs: now() - startedAt,
-      };
-    }
-    return { ok: true, status: response.status, durationMs: now() - startedAt };
-  } catch (caught) {
-    const aborted =
-      caught instanceof Error &&
-      (caught.name === "AbortError" || caught.message.includes("aborted"));
+  if (result.status < 200 || result.status >= 300) {
     return {
       ok: false,
-      errorCategory: aborted ? "timeout" : "network",
-      error: aborted
-        ? "The endpoint did not answer in time."
-        : "The endpoint could not be reached.",
-      durationMs: now() - startedAt,
+      status: result.status,
+      errorCategory: "http-error",
+      // Deliberately not the response body: it is attacker-influenced text
+      // that would end up in an administrator's screen and the logs.
+      error: `The endpoint answered ${result.status}.`,
+      durationMs,
     };
-  } finally {
-    clearTimeout(timer);
   }
+  return { ok: true, status: result.status, durationMs };
 }
 
 // ---------------------------------------------------------------------------

package/src/server/schemas.ts

@@ -11,6 +11,8 @@
  */
 import { z } from "zod";
 
+import { NOTICE_LIMITS, parseNoticeCtaHref } from "../cms/booking-landing";
+
 /* ------------------------------------------------------------------ shared */
 
 export const uuid = z.string().uuid();
@@ -33,6 +35,37 @@ export const cmsKey = z
 
 export const listLimit = z.object({ limit: z.number().min(1).max(500).default(200) });
 
+/* ------------------------------------------------------- booking-off notice */
+
+/** Text per language, bounded. Content rules (limits, links) are re-checked by the core. */
+const noticeText = (max: number) =>
+  z.record(z.string().regex(/^[a-z]{2}(-[a-z0-9]{2,8})?$/i), z.string().max(max)).refine(
+    (value) => Object.keys(value).length <= 8,
+    "Too many languages",
+  );
+
+const noticeCtaSchema = z.object({
+  label: noticeText(NOTICE_LIMITS.ctaLabel),
+  href: z
+    .string()
+    .max(NOTICE_LIMITS.href)
+    .refine((href) => parseNoticeCtaHref(href).ok, {
+      message: "Use an address on this site (/…) or an https:// address that does not lead to booking.",
+    }),
+});
+
+export const noticeSchema = z.object({
+  heading: noticeText(NOTICE_LIMITS.heading).optional(),
+  body: noticeText(NOTICE_LIMITS.body).optional(),
+  cta: noticeCtaSchema.nullable().optional(),
+});
+
+export const noticeOverrideSchema = z.object({
+  heading: noticeText(NOTICE_LIMITS.heading).optional(),
+  body: noticeText(NOTICE_LIMITS.body).optional(),
+  cta: z.union([noticeCtaSchema, z.literal("none")]).optional(),
+});
+
 /* ---------------------------------------------------------------- edit locks */
 
 /**
@@ -148,6 +181,18 @@ export const pageSchemas = {
     exception: z.boolean(),
     expectedVersion: z.string().min(1).max(64).nullable(),
   }),
+  /** A booking-off landing page, added, removed, or given its own notice. */
+  setBookingLanding: z.object({
+    pageId: uuid,
+    landing: z.boolean(),
+    notice: noticeOverrideSchema.nullable().optional(),
+    expectedVersion: z.string().min(1).max(64).nullable(),
+  }),
+  /** The site-wide booking-off notice. */
+  setBookingLandingDefault: z.object({
+    notice: noticeSchema,
+    expectedVersion: z.string().min(1).max(64).nullable(),
+  }),
   duplicatePage: z.object({
     pageId: uuid,
     name: z.string().min(1).max(120),