feat(core-consent): extend generator with consent template + fix withCapture brand propagation

- Add consent to CORE_PACKAGE_GENERATORS in turbo/generators/config.ts so
  pnpm turbo gen core-package consent is a valid command (not hand-rollable)
- Create turbo/generators/templates/core-package/consent/ mirroring the
  analytics template shape (AGENTS.md, package.json, tsconfig, turbo, vitest,
  eslint, src/index.ts scaffolds)
- Regenerate packages/core-consent/ from the new template (replaces the
  previous hand-rolled attempt that violated the generator-first rule)
- Add __consentChecked to withCapture PROPAGATED_BRANDS so the brand bubbles
  through the full withSpan→withCapture wrapper chain to the outermost binding
  that assertFeatureConformance reads

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

turbo/generators/config.ts

@@ -782,17 +782,40 @@ import noRealtimeHandlerReexport from "./rules/no-realtime-handler-reexport.js";
         },
         printAnalyticsNextSteps,
       ],
+      consent: () => [
+        () => {
+          assertOptionalPackageNotPresent("core-consent");
+          return "Guard passed — packages/core-consent does not exist yet.";
+        },
+        ...emitTemplateTree("core-package/consent", "packages/core-consent"),
+        () => {
+          addToTranspilePackages(
+            "apps/web-next/next.config.mjs",
+            "@repo/core-consent",
+          );
+          return "Added @repo/core-consent to transpilePackages.";
+        },
+        printConsentNextSteps,
+      ],
     };
 
   plop.setGenerator("core-package", {
     description:
-      "Scaffold an optional core package (realtime, events, trpc, ui, audit, analytics)",
+      "Scaffold an optional core package (realtime, events, trpc, ui, audit, analytics, consent)",
     prompts: [
       {
         type: "list",
         name: "name",
         message: "Which optional core package?",
-        choices: ["analytics", "audit", "events", "realtime", "trpc", "ui"],
+        choices: [
+          "analytics",
+          "audit",
+          "consent",
+          "events",
+          "realtime",
+          "trpc",
+          "ui",
+        ],
       },
     ],
     actions: (answers) => {
@@ -1517,6 +1540,30 @@ function printAnalyticsNextSteps(): string {
   ].join("\n");
 }
 
+function printConsentNextSteps(): string {
+  return [
+    "─────────────────────────────────────────────────────────────",
+    "@repo/core-consent scaffolded into packages/core-consent/.",
+    "",
+    "Next steps:",
+    "",
+    "  1. pnpm install   # link the new workspace package",
+    "",
+    "  2. Implement consent-types.ts, consent.interface.ts, and withConsent",
+    "     in packages/core-consent/src/ (see story 03-core-consent-foundation)",
+    "",
+    "  3. Add @repo/core-consent to feature package.json files that need consent",
+    "",
+    "  4. Wire IConsent into apps/web-next/src/server/bind-production.ts:",
+    '     - import { type IConsent } from "@repo/core-consent";',
+    "     - add consent field to BindAllDeps and BindProductionContext",
+    "     - pass the consent instance into each feature binder",
+    "",
+    "  5. pnpm typecheck && pnpm lint && pnpm test",
+    "─────────────────────────────────────────────────────────────",
+  ].join("\n");
+}
+
 function coreUiComponentActions(a: {
   tier: "atom" | "molecule" | "organism";
   name: string;

turbo/generators/templates/core-package/consent/AGENTS.md.hbs

@@ -0,0 +1,29 @@
+# @repo/core-consent
+
+Optional core package providing a vendor-neutral consent management interface. Scaffold via `pnpm turbo gen core-package consent`.
+
+## Structure
+
+```
+src/
+  consent-types.ts        # ConsentCategory, ConsentState, UserConsentState
+  consent.interface.ts    # IConsent — isGranted, grant, withdraw, getCategories
+  with-consent.ts         # withConsent wrapper attaching ConsentChecked brand
+  index.ts                # Barrel export
+```
+
+## Design
+
+`IConsent` exposes four methods:
+
+- `isGranted(category)` — synchronous check whether consent is granted
+- `grant(category)` — record consent grant for a category
+- `withdraw(category)` — record consent withdrawal for a category
+- `getCategories()` — list all known consent states
+
+The interface is vendor-neutral: no storage implementation is bundled here. Concrete implementations (e.g. a Payload-backed store) are wired at DI bind time in `bind-production`.
+
+`withConsent` wraps a use-case factory at bind time, attaches the `__consentChecked` brand, and is the innermost wrapper in the composition chain:
+`withSpan → withCapture → withAudit → withAnalytics → withConsent → factory(deps)`
+
+See `docs/architecture/agent-first-workflow-and-conformance.md` for the dependency-injection conventions.

turbo/generators/templates/core-package/consent/eslint.config.js.hbs

@@ -0,0 +1,3 @@
+import baseConfig from "@repo/core-eslint/base";
+
+export default baseConfig;

turbo/generators/templates/core-package/consent/package.json.hbs

@@ -0,0 +1,26 @@
+{
+  "name": "@repo/core-consent",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "scripts": {
+    "build": "tsc --noEmit",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  },
+  "dependencies": {
+    "@repo/core-shared": "workspace:*"
+  },
+  "devDependencies": {
+    "@repo/core-eslint": "workspace:*",
+    "@repo/core-testing": "workspace:*",
+    "@repo/core-typescript": "workspace:*",
+    "@vitest/coverage-v8": "^3.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.0.0"
+  }
+}

turbo/generators/templates/core-package/consent/src/index.ts.hbs

@@ -0,0 +1,2 @@
+// placeholder — populated by story 03-core-consent-foundation
+export {};

turbo/generators/templates/core-package/consent/tsconfig.json.hbs

@@ -0,0 +1,12 @@
+{
+  "extends": "@repo/core-typescript/base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["**/*.ts"],
+  "exclude": ["node_modules", "dist"]
+}

turbo/generators/templates/core-package/consent/turbo.json.hbs

@@ -0,0 +1,4 @@
+{
+  "extends": ["//"],
+  "tags": ["core"]
+}

turbo/generators/templates/core-package/consent/vitest.config.ts.hbs

@@ -0,0 +1,9 @@
+import path from "node:path";
+import { mergeConfig } from "vitest/config";
+import { nodeVitestConfig } from "@repo/core-typescript/vitest.base.node";
+
+export default mergeConfig(nodeVitestConfig, {
+  resolve: {
+    alias: { "@": path.resolve(__dirname, "./src") },
+  },
+});