create-ailk 0.19.1 → 0.20.0

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/general.test.tsx

@@ -126,7 +126,7 @@ import { seal } from "../../../../../lib/hub-session/seal";
 import { BillingAnchor } from "../general/billing-anchor";
 import { saveContact } from "../general/contact-actions";
 import Page from "../general/page";
-import { requestAccountDeletion, saveProfile } from "../profile-actions";
+import { saveProfile } from "../profile-actions";
 
 const PHOTO = "https://cdn.example.com/ada.png";
 const SESSION = {
@@ -211,7 +211,7 @@ async function clickSave(): Promise<void> {
 // ── 1. The frame (AC-1, AC-4) ──────────────────────────────────────────────────
 
 describe("AC-1 — the frame (D2, D7)", () => {
-  it("renders in the settings frame: Back to the Inbox, and the four tabs with General current", async () => {
+  it("renders in the settings frame: Back to the Inbox, and the five tabs with General current (#8438 D14 adds Privacy)", async () => {
     await renderPage();
     expect(screen.getByTestId("account-settings")).toContainElement(
       screen.getByRole("heading", { level: 1, name: "General" }),
@@ -224,6 +224,7 @@ describe("AC-1 — the frame (D2, D7)", () => {
       ["General", "/account/general"],
       ["Security", "/account/security"],
       ["Notifications", "/account/notifications"],
+      ["Privacy", "/account/privacy"],
       ["Billing", "/account/billing"],
     ]);
     expect(links[0]).toHaveAttribute("aria-current", "page");
@@ -239,6 +240,7 @@ describe("AC-1 — the frame (D2, D7)", () => {
       "href",
       "/fr/account/notifications",
     );
+    expect(screen.getByTestId("account-settings-rail-privacy")).toHaveAttribute("href", "/fr/account/privacy");
     expect(screen.getByTestId("account-settings-rail-billing")).toHaveAttribute("href", "/fr/account/billing");
   });
 
@@ -252,19 +254,19 @@ describe("AC-1 — the frame (D2, D7)", () => {
     }
   });
 
-  it("the pane holds the email read-only, the name and photo inputs, in order before the deletion block", async () => {
+  it("the pane holds the email read-only, the name and photo inputs", async () => {
     await renderPage();
     const pane = screen.getByTestId("account-settings-general");
     expect(within(pane).getByTestId("account-general-email")).toHaveTextContent("ada@example.com");
     expect(within(pane).queryByRole("textbox", { name: "Email" })).not.toBeInTheDocument();
     expect(within(pane).getByLabelText("Name")).toHaveValue("Ada Lovelace");
     expect(within(pane).getByLabelText("Photo")).toHaveValue(PHOTO);
-    const form = within(pane).getByTestId("account-general-form");
-    const deletion = within(pane).getByTestId("account-deletion");
-    expect(form.compareDocumentPosition(deletion) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
-    expect(within(deletion).getByTestId("account-deletion-request")).toHaveTextContent(
-      "Request account deletion",
-    );
+  });
+
+  it("renders no deletion block — Request account deletion moved to Privacy (#8438 D16)", async () => {
+    await renderPage();
+    expect(screen.queryByTestId("account-deletion")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
   });
 
   it("the photo is never rendered as an image", async () => {
@@ -284,7 +286,7 @@ describe("AC-1 — the frame (D2, D7)", () => {
     expect(within(control).getAllByRole("radio").map((r) => r.textContent)).toEqual(["Light", "Auto", "Dark"]);
   });
 
-  it("a contributed settings section renders after the deletion block (C8)", async () => {
+  it("a contributed settings section renders after the general form (C8)", async () => {
     const section: AccountSettingsSection = {
       id: "extra",
       title: "settings.general.title",
@@ -293,9 +295,9 @@ describe("AC-1 — the frame (D2, D7)", () => {
     accountSettingsSections.push(section);
     try {
       await renderPage();
-      const deletion = screen.getByTestId("account-deletion");
+      const form = screen.getByTestId("account-general-form");
       const extra = screen.getByTestId("account-settings-extra");
-      expect(deletion.compareDocumentPosition(extra) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
+      expect(form.compareDocumentPosition(extra) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
       expect(screen.getByTestId("extra-body")).toBeInTheDocument();
     } finally {
       accountSettingsSections.splice(accountSettingsSections.indexOf(section), 1);
@@ -387,7 +389,6 @@ describe("AC-3 — name and photo through the member API (D4, D8)", () => {
     mockPieces.mockResolvedValue(refusal(503, "tenant_unresolved"));
     await renderPage();
     expect(screen.getByLabelText("Photo")).toBeInTheDocument();
-    expect(screen.getByTestId("account-deletion-request")).toBeInTheDocument();
   });
 });
 
@@ -494,13 +495,6 @@ describe("AC-3 — a single site with no member API (a 404 from the pieces read)
     );
     expect(screen.getByLabelText("Name")).toHaveValue("Ada King");
   });
-
-  it("points the deletion request at Support, with no Request button (C2, D5)", async () => {
-    await renderPage();
-    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
-    expect(screen.getByTestId("account-deletion-support")).toHaveAttribute("href", "/account/support");
-    expect(screen.getByText("To ask for your account to be deleted, contact support.")).toBeInTheDocument();
-  });
 });
 
 // ── #8435 D13 (AC-6) — the contact details on this site ───────────────────────
@@ -527,23 +521,23 @@ describe("AC-6 — the contact details (#8435 D13)", () => {
     await renderPage();
     const section = screen.getByTestId("account-contact-section");
     expect(mockContact).toHaveBeenCalledWith(COOKIE_INIT);
-    expect(within(section).getByTestId("account-contact-given-name")).toHaveValue("Ada");
-    expect(within(section).getByTestId("account-contact-company")).toHaveValue("Engines Ltd");
+    expect(within(section).getByTestId("contact-given-name")).toHaveValue("Ada");
+    expect(within(section).getByTestId("contact-company")).toHaveValue("Engines Ltd");
     expect(within(section).getByTestId("field-addressLine1")).toHaveValue("1 Analytical Way");
     // The profile form's single "Save changes" button stays unique.
     expect(screen.getAllByRole("button", { name: "Save changes" })).toHaveLength(1);
-    expect(within(section).getByTestId("account-contact-save")).toHaveTextContent("Save contact details");
+    expect(within(section).getByTestId("contact-details-save")).toHaveTextContent("Save contact details");
   });
 
   it("with no confirmed contact yet, the form starts blank", async () => {
     await renderPage();
-    expect(screen.getByTestId("account-contact-given-name")).toHaveValue("");
+    expect(screen.getByTestId("contact-given-name")).toHaveValue("");
   });
 
   it("a failed read renders the section's unavailable line, not the form", async () => {
     mockContact.mockResolvedValue(refusal(503, "tenant_unresolved"));
     await renderPage();
-    expect(screen.queryByTestId("account-contact-form")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("contact-details-form")).not.toBeInTheDocument();
     expect(screen.getByTestId("account-contact-unavailable")).toHaveTextContent(
       "Contact details aren't available on this site right now.",
     );
@@ -565,9 +559,9 @@ describe("AC-6 — the contact details (#8435 D13)", () => {
   it("saving posts all six keys through saveContact and answers Saved", async () => {
     mockContact.mockResolvedValue(ok({ contact: CONTACT }));
     await renderPage();
-    fireEvent.change(screen.getByTestId("account-contact-company"), { target: { value: "Acme" } });
+    fireEvent.change(screen.getByTestId("contact-company"), { target: { value: "Acme" } });
     await act(async () => {
-      fireEvent.submit(screen.getByTestId("account-contact-form"));
+      fireEvent.submit(screen.getByTestId("contact-details-form"));
     });
     await waitFor(() => expect(mockUpdateContact).toHaveBeenCalledTimes(1));
     expect(mockUpdateContact).toHaveBeenCalledWith(
@@ -581,20 +575,20 @@ describe("AC-6 — the contact details (#8435 D13)", () => {
       },
       COOKIE_INIT,
     );
-    expect(await screen.findByTestId("account-contact-message")).toHaveTextContent("Saved.");
+    expect(await screen.findByTestId("contact-details-message")).toHaveTextContent("Saved.");
   });
 
   it("a refused telephone shows its own line and keeps the fields as typed", async () => {
     mockUpdateContact.mockResolvedValue(refusal(400, "telephone_invalid"));
     await renderPage();
-    fireEvent.change(screen.getByTestId("account-contact-company"), { target: { value: "Acme" } });
+    fireEvent.change(screen.getByTestId("contact-company"), { target: { value: "Acme" } });
     await act(async () => {
-      fireEvent.submit(screen.getByTestId("account-contact-form"));
+      fireEvent.submit(screen.getByTestId("contact-details-form"));
     });
-    expect(await screen.findByTestId("account-contact-message")).toHaveTextContent(
+    expect(await screen.findByTestId("contact-details-message")).toHaveTextContent(
       "Enter the phone number with its country code.",
     );
-    expect(screen.getByTestId("account-contact-company")).toHaveValue("Acme");
+    expect(screen.getByTestId("contact-company")).toHaveValue("Acme");
   });
 });
 
@@ -638,57 +632,8 @@ describe("AC-6 — saveContact (#8435 D13)", () => {
   });
 });
 
-// ── 4. The deletion request (AC-4) ────────────────────────────────────────────
-
-describe("AC-4 — Request account deletion through the member API (D5)", () => {
-  async function requestDeletion(): Promise<void> {
-    await act(async () => {
-      fireEvent.click(screen.getByTestId("account-deletion-request"));
-    });
-  }
-
-  it.each([
-    ["site-operator", "Sent to the site operator."],
-    ["hub-operator", "Sent to the hub operator."],
-  ])("an answer naming %s shows %s — the answer picks the line", async (sentTo, line) => {
-    mockRequestDeletion.mockResolvedValue(ok({ sentTo }));
-    await renderPage();
-    await requestDeletion();
-    expect(mockRequestDeletion).toHaveBeenCalledWith({}, COOKIE_INIT);
-    await waitFor(() => expect(screen.getByRole("status")).toHaveTextContent(line));
-    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
-    expect(mockLeadsSubmit).not.toHaveBeenCalled();
-  });
-
-  it("a refusal shows its line and keeps the button", async () => {
-    mockRequestDeletion.mockResolvedValue(refusal(403, "email_unverified"));
-    await renderPage();
-    await requestDeletion();
-    await waitFor(() =>
-      expect(screen.getByRole("alert")).toHaveTextContent("Confirm your email address first, then ask again."),
-    );
-    expect(screen.getByTestId("account-deletion-request")).toBeEnabled();
-  });
-
-  it.each([
-    [refusal(403, "email_unverified"), "unverified"],
-    [refusal(404, "not_found"), "unavailable"],
-    [refusal(503, "not_configured"), "unavailable"],
-    [refusal(503, "delivery_failed"), "unavailable"],
-    [refusal(500, "internal"), "failed"],
-  ])("requestAccountDeletion maps %j to %s", async (answer, reason) => {
-    mockRequestDeletion.mockResolvedValue(answer);
-    await expect(requestAccountDeletion()).resolves.toEqual({ ok: false, reason });
-    expect(mockRequestDeletion).toHaveBeenCalledWith({}, COOKIE_INIT);
-  });
-
-  it("requestAccountDeletion answers who it went to, and a throw is failed", async () => {
-    mockRequestDeletion.mockResolvedValue(ok({ sentTo: "hub-operator" }));
-    await expect(requestAccountDeletion()).resolves.toEqual({ ok: true, sentTo: "hub-operator" });
-    mockRequestDeletion.mockRejectedValue(new TypeError("fetch failed"));
-    await expect(requestAccountDeletion()).resolves.toEqual({ ok: false, reason: "failed" });
-  });
-});
+// The deletion-request cases moved to privacy.test.tsx — Request account
+// deletion now renders on Privacy, not General (#8438 D16).
 
 // ── 5. #billing (AC-6) ────────────────────────────────────────────────────────
 

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/hub-mode.test.tsx

@@ -248,13 +248,12 @@ describe("AC-5 — General and Billing on a hub-mode spoke (#8232)", () => {
       mockMemberRead.mockResolvedValue({ ok: true, body: [] });
     });
 
-    it("renders the name and photo form and the deletion button, with no link to the hub's settings", async () => {
+    it("renders the name and photo form, with no link to the hub's settings", async () => {
       await renderGeneral();
       expect(screen.getByTestId("account-general-form")).toBeInTheDocument();
       expect(screen.getByLabelText("Name")).toHaveValue("Ada Lovelace");
       // No hub read carries the photo, so the field starts empty (C5).
       expect(screen.getByLabelText("Photo")).toHaveValue("");
-      expect(screen.getByTestId("account-deletion-request")).toBeInTheDocument();
       expect(screen.queryByTestId("account-settings-manage-on-hub")).not.toBeInTheDocument();
       expect(screen.queryByTestId("account-privacy-manage-on-hub")).not.toBeInTheDocument();
       expect(document.querySelector(`a[href^="${HUB}"]`)).toBeNull();
@@ -279,10 +278,32 @@ describe("AC-5 — General and Billing on a hub-mode spoke (#8232)", () => {
         user: { name: "Ada King" },
       });
     });
+  });
 
-    it("the deletion request goes through the member API and names the hub operator", async () => {
-      mockRequestDeletion.mockResolvedValue({ ok: true, body: { sentTo: "hub-operator" } });
+  describe("a hub that answers no member route (the fixture's 404)", () => {
+    it("shows the name read-only and offers no save", async () => {
       await renderGeneral();
+      expect(screen.getByTestId("account-general-name-text")).toHaveTextContent("Ada Lovelace");
+      expect(screen.queryByTestId("account-general-form")).not.toBeInTheDocument();
+      expect(screen.queryByLabelText("Photo")).not.toBeInTheDocument();
+      expect(document.querySelector(`a[href^="${HUB}"]`)).toBeNull();
+      expect(mockUpdateUser).not.toHaveBeenCalled();
+    });
+  });
+
+  // #8438 D16 — Request account deletion moved to Privacy; the hub-mode
+  // deletion coverage above moves with it, expectations unchanged.
+  describe("Privacy's deletion block on a hub-mode spoke (moved from General, #8438 D16)", () => {
+    async function renderPrivacy(): Promise<void> {
+      const { default: PrivacyPage } = await import("../privacy/page");
+      render(await PrivacyPage({ params: Promise.resolve({ locale: "en" }) }));
+    }
+
+    it("a hub that answers the member routes: the deletion request goes through the member API and names the hub operator", async () => {
+      mockMemberRead.mockResolvedValue({ ok: true, body: [] });
+      mockRequestDeletion.mockResolvedValue({ ok: true, body: { sentTo: "hub-operator" } });
+      await renderPrivacy();
+      expect(screen.getByTestId("account-deletion-request")).toBeInTheDocument();
       await act(async () => {
         fireEvent.click(screen.getByTestId("account-deletion-request"));
       });
@@ -290,19 +311,12 @@ describe("AC-5 — General and Billing on a hub-mode spoke (#8232)", () => {
       await waitFor(() => expect(screen.getByRole("status")).toHaveTextContent("Sent to the hub operator."));
       expect(mockLeadsSubmit).not.toHaveBeenCalled();
     });
-  });
 
-  describe("a hub that answers no member route (the fixture's 404)", () => {
-    it("shows the name read-only and offers no save and no deletion path", async () => {
-      await renderGeneral();
-      expect(screen.getByTestId("account-general-name-text")).toHaveTextContent("Ada Lovelace");
-      expect(screen.queryByTestId("account-general-form")).not.toBeInTheDocument();
-      expect(screen.queryByLabelText("Photo")).not.toBeInTheDocument();
+    it("a hub that answers no member route: offers no deletion path", async () => {
+      await renderPrivacy();
       expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
       expect(screen.queryByTestId("account-deletion-support")).not.toBeInTheDocument();
       expect(screen.getByText("This site can't take deletion requests right now.")).toBeInTheDocument();
-      expect(document.querySelector(`a[href^="${HUB}"]`)).toBeNull();
-      expect(mockUpdateUser).not.toHaveBeenCalled();
     });
   });
 

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/item.test.tsx

@@ -9,8 +9,12 @@
  *   2. An unknown kind, or an id the kind did not load, is a not-found —
  *      never an empty frame.
  *   3. A failed read renders an error with Retry (D12's posture).
+ *   4. A message whose `action` is `onboarding` has an Open onboarding
+ *      action to the locale's `/account/onboarding`; a message with no
+ *      action has none (#8515 D6, AC-4).
  *
- * The `purchase` kind reads `member.purchases` (#8231 D5).
+ * The `purchase` kind reads `member.purchases` (#8231 D5); the `message`
+ * kind reads `member.messages`.
  */
 import { fireEvent, render, screen, within } from "@testing-library/react";
 
@@ -52,11 +56,15 @@ jest.mock("../../../../../auth", () => ({
 
 const mockSignupMe = jest.fn();
 const mockMemberPurchases = jest.fn();
+const mockMemberMessages = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
   waitlistSignups: { me: (...args: unknown[]) => mockSignupMe(...args) },
   subscription: { me: jest.fn() },
-  member: { purchases: (...args: unknown[]) => mockMemberPurchases(...args) },
+  member: {
+    purchases: (...args: unknown[]) => mockMemberPurchases(...args),
+    messages: (...args: unknown[]) => mockMemberMessages(...args),
+  },
 }));
 
 const mockNotFound = jest.fn(() => {
@@ -85,9 +93,30 @@ const PURCHASE = {
   purchasedAt: "2026-09-04T10:00:00.000Z",
 };
 
+const MESSAGE = {
+  id: "int_plain",
+  subject: "Hello",
+  body: "A note.",
+  file: null,
+  action: null,
+  createdAt: "2026-10-14T09:00:00.000Z",
+  readAt: null,
+};
+const MESSAGES = [
+  MESSAGE,
+  {
+    ...MESSAGE,
+    id: "int_onboarding",
+    subject: "Your onboarding questions",
+    body: "Open this message in your account and choose Open onboarding.",
+    action: "onboarding",
+  },
+];
+
 beforeEach(() => {
   mockGetSession.mockReset().mockResolvedValue(SESSION);
   mockMemberPurchases.mockReset().mockResolvedValue({ ok: true, body: { items: [PURCHASE] } });
+  mockMemberMessages.mockReset().mockResolvedValue({ ok: true, body: { items: MESSAGES } });
   mockSignupMe.mockReset();
   mockNotFound.mockClear();
   mockRefresh.mockReset();
@@ -139,3 +168,29 @@ describe("one Inbox item", () => {
     expect(mockRefresh).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("a message's onboarding action (#8515 D6, AC-4)", () => {
+  it("an onboarding message links to the locale's onboarding page", async () => {
+    await renderItem("message", "int_onboarding", "fr");
+    const links = screen
+      .getAllByRole("link", { name: "Open onboarding" })
+      .map((link) => link.getAttribute("href"));
+    expect(links.length).toBeGreaterThan(0);
+    expect(links.every((href) => href === "/fr/account/onboarding")).toBe(true);
+    expect(screen.getByTestId("account-item-action-onboarding-desk")).toHaveAttribute(
+      "href",
+      "/fr/account/onboarding",
+    );
+    // The body stays plain text.
+    expect(
+      screen.getByText("Open this message in your account and choose Open onboarding.").closest("a"),
+    ).toBeNull();
+  });
+
+  it("a message with no action has no onboarding link", async () => {
+    await renderItem("message", "int_plain", "fr");
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Hello");
+    expect(screen.queryByRole("link", { name: "Open onboarding" })).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-item-action-onboarding-desk")).not.toBeInTheDocument();
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/layout.test.tsx

@@ -472,6 +472,7 @@ describe("the settings routes take the screen (#8430)", () => {
     ["/account/general", "en"],
     ["/account/security", "en"],
     ["/account/notifications", "en"],
+    ["/account/privacy", "en"],
     ["/account/billing", "en"],
     ["/fr/account/billing", "fr"],
   ])("on %s the page renders alone — no rail, no Inbox, no AppShell frame", async (path, locale) => {
@@ -527,6 +528,7 @@ describe("one main landmark (#8441)", () => {
     general: async () => (await import("../general/page")).default,
     security: async () => (await import("../security/page")).default,
     notifications: async () => (await import("../notifications/page")).default,
+    privacy: async () => (await import("../privacy/page")).default,
     billing: async () => (await import("../billing/page")).default,
   };
 

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/notifications.test.tsx

@@ -1,13 +1,15 @@
 /**
  * Tests for /[locale]/account/notifications — User settings › Notifications
- * (#8339 D8, NEW). Moved from general.test.tsx's "Privacy" cookie-settings
- * link (#8339 D12, C6) — notification preferences are a later unit's scope.
+ * (#8339 D8; #8438 D15, AC-8). Always renders (decision A): one
+ * `ConsentSwitchList` of the registry's `area: "communications"` purposes,
+ * or one empty line with none declared. The cookie-settings link moved to
+ * Privacy (#8438 D14) — this tab no longer renders it.
  */
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { render, screen, within } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 
 jest.mock("next-intl/server", () => {
   const msgs: unknown = require("../../../../../messages/en.json");
@@ -29,13 +31,14 @@ jest.mock("next-intl/server", () => {
         );
       };
     },
+    getLocale: jest.fn().mockResolvedValue("en"),
   };
 });
 
 jest.mock("next/headers", () => ({
   __esModule: true,
   headers: jest.fn().mockResolvedValue(new Headers()),
-  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc", get: () => undefined }),
 }));
 
 const mockGetSession = jest.fn();
@@ -45,13 +48,19 @@ jest.mock("../../../../../auth", () => ({
   auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
 }));
 
+const mockConsents = jest.fn();
+const mockSetConsent = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
   waitlistSignups: { me: jest.fn() },
   flowCheckouts: { me: jest.fn() },
   subscription: { me: jest.fn(), portalSession: jest.fn() },
   leads: { submit: jest.fn() },
-  member: { pieces: jest.fn().mockResolvedValue({ ok: true, body: [] }) },
+  member: {
+    pieces: jest.fn().mockResolvedValue({ ok: true, body: [] }),
+    consents: (...args: unknown[]) => mockConsents(...args),
+    setConsent: (...args: unknown[]) => mockSetConsent(...args),
+  },
   hubSignIn: { me: jest.fn() },
   visitorForwardHeaders: () => null,
 }));
@@ -75,6 +84,31 @@ const SESSION = {
   },
 };
 
+const ok = <T,>(body: T) => ({ ok: true, body });
+
+function communicationsPurpose(
+  overrides: Partial<{
+    id: string;
+    kind: "consent" | "preference";
+    effective: boolean;
+    state: { granted: boolean; at: string; source: string; policyVersion: number } | null;
+  }> = {},
+) {
+  return {
+    id: overrides.id ?? "marketing_email",
+    kind: overrides.kind ?? "consent",
+    area: "communications" as const,
+    required: false,
+    signUp: false,
+    description: "Product news and offers.",
+    statement: "Receive product news and offers by email.",
+    policyHref: "/privacy",
+    policyVersion: 1,
+    state: overrides.state === undefined ? null : overrides.state,
+    effective: overrides.effective ?? false,
+  };
+}
+
 let contentRoot: string;
 
 beforeEach(() => {
@@ -82,6 +116,8 @@ beforeEach(() => {
   process.env.AILK_CONTENT_ROOT = contentRoot;
   writeFileSync(join(contentRoot, "_site.mdx"), '---\nsiteName: "Test"\n---\n');
   mockGetSession.mockReset().mockResolvedValue(SESSION);
+  mockConsents.mockReset().mockResolvedValue(ok({ purposes: [] }));
+  mockSetConsent.mockReset();
 });
 
 afterEach(() => {
@@ -98,7 +134,7 @@ describe("the frame (D7, D8)", () => {
     expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Notifications");
     expect(screen.getByTestId("account-settings-back")).toHaveAttribute("href", "/account");
     expect(screen.getByTestId("account-settings-rail-notifications")).toHaveAttribute("aria-current", "page");
-    expect(screen.getByTestId("account-settings-rail-billing")).not.toHaveAttribute("aria-current");
+    expect(screen.getByTestId("account-settings-rail-privacy")).not.toHaveAttribute("aria-current");
   });
 });
 
@@ -116,25 +152,73 @@ describe("the standalone shape (#8430)", () => {
   });
 });
 
-describe("cookie settings (D7, moved from general.test.tsx)", () => {
-  it("links to /privacy#cookie-settings", async () => {
+describe("AC-8 — always present, one empty line with no communications purposes declared", () => {
+  it("renders exactly one account-notifications-empty line and no cookie link", async () => {
+    await renderPage();
+    expect(screen.getByTestId("account-notifications-empty")).toHaveTextContent(
+      "There's nothing to set here yet.",
+    );
+    expect(screen.queryByTestId("account-cookie-settings")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-notifications")).not.toBeInTheDocument();
+  });
+
+  it("the tab link is present in the frame regardless", async () => {
+    await renderPage();
+    expect(screen.getByTestId("account-settings-rail-notifications")).toBeInTheDocument();
+  });
+});
+
+describe("AC-8 — a declared communications preference defaults on with no row", () => {
+  it("renders one switch, on", async () => {
+    mockConsents.mockResolvedValue(
+      ok({ purposes: [communicationsPurpose({ kind: "preference", effective: true, state: null })] }),
+    );
     await renderPage();
-    expect(screen.getByTestId("account-cookie-settings")).toHaveAttribute(
-      "href",
-      "/privacy#cookie-settings",
+    expect(screen.queryByTestId("account-notifications-empty")).not.toBeInTheDocument();
+    expect(screen.getByTestId("account-notifications-marketing_email-switch")).toBeChecked();
+  });
+});
+
+describe("AC-8 — a declared communications consent defaults off with no row", () => {
+  it("renders one switch, off", async () => {
+    mockConsents.mockResolvedValue(
+      ok({ purposes: [communicationsPurpose({ kind: "consent", effective: false, state: null })] }),
     );
+    await renderPage();
+    expect(screen.getByTestId("account-notifications-marketing_email-switch")).not.toBeChecked();
   });
 
-  it("a non-default locale prefixes the link", async () => {
-    await renderPage("fr");
-    expect(screen.getByTestId("account-cookie-settings")).toHaveAttribute(
-      "href",
-      "/fr/privacy#cookie-settings",
+  it("toggling calls setConsentAction through member.setConsent", async () => {
+    mockConsents.mockResolvedValue(
+      ok({ purposes: [communicationsPurpose({ kind: "consent", effective: false, state: null })] }),
+    );
+    mockSetConsent.mockResolvedValue(
+      ok({
+        purpose: communicationsPurpose({
+          kind: "consent",
+          effective: true,
+          state: { granted: true, at: "2026-10-12T12:00:00.000Z", source: "account_settings", policyVersion: 1 },
+        }),
+      }),
+    );
+    await renderPage();
+    fireEvent.click(screen.getByTestId("account-notifications-marketing_email-switch"));
+    await waitFor(() => expect(mockSetConsent).toHaveBeenCalledTimes(1));
+    expect(mockSetConsent).toHaveBeenCalledWith(
+      { purposeId: "marketing_email", granted: true, locale: "en" },
+      expect.objectContaining({ headers: expect.objectContaining({ cookie: "session=abc" }) }),
+    );
+    expect(await screen.findByTestId("account-notifications-marketing_email-date")).toHaveTextContent(
+      "Given Oct 12, 2026",
     );
   });
+});
 
-  it("renders no deletion button", async () => {
+describe("a failed consents read", () => {
+  it("shows the unavailable line, not a broken switch list", async () => {
+    mockConsents.mockResolvedValue({ ok: false, status: 503, body: null });
     await renderPage();
-    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
+    expect(screen.getByTestId("account-notifications-unavailable")).toBeInTheDocument();
+    expect(screen.queryByTestId("account-notifications-empty")).not.toBeInTheDocument();
   });
 });