@orkestrel/terminal 0.0.7 → 0.0.9

package/dist/src/core/index.d.cts

@@ -1,139 +1,71 @@
+import { CheckboxField } from '@orkestrel/form';
+import { ConfirmField } from '@orkestrel/form';
 import { DriverInterface } from '@orkestrel/database';
+import { EditorField } from '@orkestrel/form';
 import { EmitterErrorHandler } from '@orkestrel/emitter';
 import { EmitterHooks } from '@orkestrel/emitter';
 import { EmitterInterface } from '@orkestrel/emitter';
+import { FieldChoice } from '@orkestrel/form';
+import { FieldError } from '@orkestrel/form';
+import { FormInterface } from '@orkestrel/form';
+import { FormSchema } from '@orkestrel/form';
+import { FormValues } from '@orkestrel/form';
 import { Guard } from '@orkestrel/contract';
+import { JSONRecord } from '@orkestrel/contract';
+import { PasswordField } from '@orkestrel/form';
+import { Result } from '@orkestrel/contract';
+import { SelectField } from '@orkestrel/form';
+import { Style } from '@orkestrel/console';
 import { StylerInterface } from '@orkestrel/console';
 import { TableInterface } from '@orkestrel/database';
+import { TextField } from '@orkestrel/form';
 
 /** The `Accept` header value that opens the broker's SSE stream. */
 export declare const ACCEPT_EVENT_STREAM = "text/event-stream";
 
-/** Matches an alphanumeric string (letters and digits only). The `alphanumeric` rule tests against this. */
-export declare const ALPHANUMERIC_PATTERN: RegExp;
-
-/** The rejection reason a bare {@link PromptInterface.answer} returns — `'unknown'` (no such parked prompt) or `'rejected'` (failed validation / type-check). */
-export declare type AnswerError = 'unknown' | 'rejected';
-
-/** The outcome of a bare {@link PromptInterface.answer} call — the accepted `value` on success, else the {@link AnswerError}. */
-export declare type AnswerResult = {
-    readonly success: true;
-    readonly value: unknown;
+/**
+ * Why {@link PromptInterface.answer} refused. Names its axis with `reason`.
+ *
+ * @remarks
+ * - `unknown` — no form is parked under that id, or the one that was has already settled.
+ * - `rejected` — the authoritative form refused the values, and `errors` is exactly what it
+ *   reported. A client seeds its local form with the values it sent, applies each failure through
+ *   the form's `invalidate`, and asks again; the parked form stays parked until it accepts or
+ *   expires. This is the retry loop that makes a server-side `custom` rule enforceable, because
+ *   that rule never crossed the wire and the client could not have checked it.
+ */
+export declare type AnswerError = {
+    readonly reason: 'unknown';
 } | {
-    readonly success: false;
-    readonly error: AnswerError;
+    readonly reason: 'rejected';
+    readonly errors: readonly FieldError[];
 };
 
-/**
- * Append a rule-backed {@link Validator} to `validators` when the rule is enabled — a `false` /
- * `undefined` `check` is skipped, a function `check` is added verbatim (the custom override), and
- * a primitive `check` is wrapped via {@link buildRuleValidator}. Mutates `validators` in place.
- */
-export declare function appendRule(validators: Validator[], rule: string, check: boolean | number | string | Validator | undefined): void;
-
 /** Backspace (BS, U+0008) — Ctrl+H / some terminals' Backspace. */
 export declare const BACKSPACE: string;
 
-/** Wrap a named rule + its primitive check into a {@link Validator} (returns `true` or the rule's message). */
-export declare function buildRuleValidator(rule: string, check: boolean | number | string): Validator;
-
-/** A choice item in a {@link CheckboxOptions} prompt — a {@link PromptChoice} plus an optional initial `checked` state. */
-export declare interface CheckboxChoice {
-    readonly name: string;
-    readonly value: string;
-    readonly description?: string;
-    readonly checked?: boolean;
-}
-
-/**
- * Options for a multi-selection {@link import('./helpers.js').checkboxReduce} prompt.
- *
- * @remarks
- * `choices` accepts bare strings or full {@link CheckboxChoice} objects (with an optional
- * initial `checked`); {@link import('./helpers.js').createCheckboxState} normalizes them.
- * `min` / `max` gate submission — a submit with fewer than `min` or more than `max` selected
- * is rejected (the prompt stays active with the reason in the view).
- */
-export declare interface CheckboxOptions {
-    readonly message: string;
-    readonly choices: ReadonlyArray<string | CheckboxChoice>;
-    readonly min?: number;
-    readonly max?: number;
-    readonly styler?: StylerInterface;
-}
-
 /**
  * Advance a checkbox prompt by one {@link KeyEvent} — the pure
  * `(state, key) → PromptStep<readonly string[]>` reducer. `up` / `down` (and `k` / `j`) move the
  * focus (wrapping); `space` toggles the focused index in the checked set; return submits the
- * checked values in CHOICE order — gated by `min` / `max` (an out-of-range count stays active with
- * the reason in the view); ctrl-c cancels.
+ * checked values in choice order; ctrl-c cancels. The form applies selection-count rules.
  */
-export declare function checkboxReduce(state: CheckboxState, key: KeyEvent): PromptStep<readonly string[], CheckboxState>;
+export declare function checkboxReduce(state: ReturnType<typeof createCheckboxState>, key: KeyEvent): PromptStep<readonly string[], ReturnType<typeof createCheckboxState>>;
 
-/**
- * The immutable state of a checkbox prompt — the normalized choices, the styler, the `focused`
- * index, the set of `checked` indices, the optional `min` / `max` gate, and the current `error`.
- *
- * @remarks
- * Built by {@link import('./helpers.js').createCheckboxState}; advanced by
- * {@link import('./helpers.js').checkboxReduce}. `up` / `down` move `focus` (wrapping); `space`
- * toggles the focused index in `checked`; `return` submits the checked values in choice order
- * (rejected, with `error`, when the count is outside `[min, max]`). `checked` is modelled as a
- * readonly index array (plain JSON data, copy-on-write — no `Set` to clone).
- */
-export declare interface CheckboxState {
-    readonly message: string;
-    readonly choices: readonly CheckboxChoice[];
-    readonly styler: StylerInterface;
-    readonly focused: number;
-    readonly checked: readonly number[];
-    readonly min?: number;
-    readonly max?: number;
-    readonly error?: string;
-}
-
-/** Render a {@link CheckboxState} as a MULTI-LINE styled view — the header, one box per choice (focused + checked marked), a count, and any error. */
-export declare function checkboxView(state: CheckboxState): string;
-
-/**
- * Compose several {@link Validator}s into ONE short-circuiting validator — it runs them in order
- * and returns the FIRST error message, or `true` when all pass. The empty composition always
- * passes.
- */
-export declare function composeValidators(...validators: Validator[]): Validator;
-
-/** Options for a yes/no {@link import('./helpers.js').confirmReduce} confirmation prompt. */
-export declare interface ConfirmOptions {
-    readonly message: string;
-    readonly default?: boolean;
-    readonly styler?: StylerInterface;
-}
+/** Render a checkbox-field key state as a multi-line styled view. */
+export declare function checkboxView(state: ReturnType<typeof createCheckboxState>): string;
 
 /**
  * Advance a confirm prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<boolean>`
  * reducer. `y` / `Y` submits `true`, `n` / `N` submits `false`, return on an empty line submits
  * the `default`, ctrl-c cancels; any other key is ignored (stays active).
  */
-export declare function confirmReduce(state: ConfirmState, key: KeyEvent): PromptStep<boolean, ConfirmState>;
+export declare function confirmReduce(state: ReturnType<typeof createConfirmState>, key: KeyEvent): PromptStep<boolean, ReturnType<typeof createConfirmState>>;
 
 /**
- * The immutable state of a confirm prompt — its message, the default answer, and the styler.
- *
- * @remarks
- * Built by {@link import('./helpers.js').createConfirmState}; advanced by
- * {@link import('./helpers.js').confirmReduce}. `y` / `Y` submits `true`, `n` / `N` submits
- * `false`, and `enter` takes the `default` (rendered with the active letter capitalized in the
- * `(Y/n)` hint).
- */
-export declare interface ConfirmState {
-    readonly message: string;
-    readonly default: boolean;
-    readonly styler: StylerInterface;
-}
-
-/** Render a {@link ConfirmState} as a styled view — the header plus a `(Y/n)` hint with the default letter emphasized. */
-export declare function confirmView(state: ConfirmState): string;
+ * Render a confirm-field key state as a styled view. The selected role paints the default letter.
+ */
+export declare function confirmView(state: ReturnType<typeof createConfirmState>): string;
 
 /**
  * The single control BYTE → key descriptor table {@link import('./helpers.js').parseKey}
@@ -151,11 +83,37 @@ export declare const CONTROL_NAMES: Readonly<Record<string, {
     readonly ctrl: boolean;
 }>>;
 
-/** Build the initial {@link CheckboxState} from {@link CheckboxOptions} — normalizing choices, seeding the checked set, carrying min/max. */
-export declare function createCheckboxState(options: CheckboxOptions): CheckboxState;
+/**
+ * Build the initial checkbox-field key state.
+ *
+ * @param field - The checkbox field to render
+ * @param styler - The styler used to render the view
+ * @param theme - The optional terminal theme
+ * @returns The initial immutable key state
+ */
+export declare function createCheckboxState(field: CheckboxField, styler?: StylerInterface, theme?: PromptThemeOptions): {
+    message: string;
+    choices: FieldChoice[];
+    styler: StylerInterface;
+    theme: PromptTheme;
+    focused: number;
+    checked: readonly number[];
+};
 
-/** Build the initial {@link ConfirmState} from {@link ConfirmOptions} — defaulting the answer to `false`. */
-export declare function createConfirmState(options: ConfirmOptions): ConfirmState;
+/**
+ * Build the initial confirm-field key state.
+ *
+ * @param field - The confirm field to render
+ * @param styler - The styler used to render the view
+ * @param theme - The optional terminal theme
+ * @returns The initial immutable key state
+ */
+export declare function createConfirmState(field: ConfirmField, styler?: StylerInterface, theme?: PromptThemeOptions): {
+    message: string;
+    default: boolean;
+    styler: StylerInterface;
+    theme: PromptTheme;
+};
 
 /**
  * Create a {@link TerminalStoreInterface} backed by one table of the `databases` layer — the
@@ -174,11 +132,38 @@ export declare function createConfirmState(options: ConfirmOptions): ConfirmStat
  */
 export declare function createDatabaseTerminalStore(driver?: DriverInterface): TerminalStoreInterface;
 
-/** Build the initial {@link EditorState} from {@link EditorOptions} — resolving the validator + styler, seeding empty lines. */
-export declare function createEditorState(options: EditorOptions): EditorState;
+/**
+ * Build the initial editor-field key state.
+ *
+ * @param field - The editor field to render
+ * @param styler - The styler used to render the view
+ * @param theme - The optional terminal theme
+ * @returns The initial immutable key state
+ */
+export declare function createEditorState(field: EditorField, styler?: StylerInterface, theme?: PromptThemeOptions): {
+    message: string;
+    default: string;
+    styler: StylerInterface;
+    theme: PromptTheme;
+    lines: readonly string[];
+    current: string;
+};
 
-/** Build the initial {@link InputState} from {@link InputOptions} — resolving the validator + styler, seeding an empty value. */
-export declare function createInputState(options: InputOptions): InputState;
+/**
+ * Build the initial text-field key state.
+ *
+ * @param field - The text field to render
+ * @param styler - The styler used to render the view
+ * @param theme - The optional terminal theme
+ * @returns The initial immutable key state
+ */
+export declare function createInputState(field: TextField, styler?: StylerInterface, theme?: PromptThemeOptions): {
+    message: string;
+    default: string;
+    styler: StylerInterface;
+    theme: PromptTheme;
+    value: string;
+};
 
 /**
  * Create the in-memory {@link TerminalStoreInterface} — a process-lifetime `Map` of endpoint
@@ -195,43 +180,51 @@ export declare function createInputState(options: InputOptions): InputState;
  */
 export declare function createMemoryTerminalStore(): TerminalStoreInterface;
 
-/** Build the initial {@link PasswordState} from {@link PasswordOptions} — resolving the validator + styler + mask. */
-export declare function createPasswordState(options: PasswordOptions): PasswordState;
+/**
+ * Build the initial password-field key state.
+ *
+ * @param field - The password field to render
+ * @param styler - The styler used to render the view
+ * @param theme - The optional terminal theme
+ * @returns The initial immutable key state
+ */
+export declare function createPasswordState(field: PasswordField, styler?: StylerInterface, theme?: PromptThemeOptions): {
+    message: string;
+    mask: string;
+    styler: StylerInterface;
+    theme: PromptTheme;
+    value: string;
+};
 
 /**
- * Create the headless prompt {@link PromptInterface} BROKER — it parks each prompt call as a
- * pending prompt and resolves it when {@link PromptInterface.answer} arrives (or rejects on
- * timeout). The tri-surface's headless arm: subscribe `emitter.on('pending', …)` to forward each
- * prompt to whoever can answer (an SSE transport, a remote terminal), then route the answer back
- * through `answer(id, value)`.
+ * Create the headless {@link PromptInterface} broker. It parks live forms and applies remote
+ * answers to the authoritative instances.
  *
  * @param options - See {@link PromptOptions}
  * @returns A {@link PromptInterface}
  *
  * @remarks
- * - **Park-as-Promise.** `await prompt.input({ message })` blocks until `answer(id, value)` accepts
- *   a matching value; the value is validated (text forms) and type-checked to the form first.
- * - **Timeout → expire → reject (deterministic).** An unanswered prompt expires after
- *   `options.timeout` (default {@link import('./constants.js').DEFAULT_PROMPT_TIMEOUT_MS}) and its
- *   Promise rejects with a {@link import('./errors.js').TerminalError}; inject `options.timer` to
- *   drive expiry without real time.
+ * The caller awaits the parked form's own `answer`. Timeout or teardown destroys the form, so that
+ * promise rejects with the Form package's `ABANDONED` error. Inject `options.timer` to drive
+ * expiry without real time.
  *
  * @example
  * ```ts
  * import { createPrompt } from '@src/core'
+ * import { createForm } from '@orkestrel/form'
  *
  * const prompt = createPrompt()
- * prompt.emitter.on('pending', (pending) => send(pending)) // forward to a remote client
- * const name = await prompt.input({ message: 'Your name', validate: { required: true } })
+ * const form = createForm({ fields: [{ control: 'text', name: 'name' }] })
+ * const id = prompt.park(form)
+ * prompt.answer(id, { name: 'Ada' })
  * ```
  */
 export declare function createPrompt(options?: PromptOptions): PromptInterface;
 
 /**
  * Create the SSE prompt {@link PromptClientInterface} BRIDGE — it connects to a remote broker's SSE
- * endpoint, dispatches each received prompt to a LOCAL {@link import('./types.js').PromptFormInterface}
- * terminal (so a human at this machine answers a prompt parked elsewhere), and POSTs the answer
- * back. Universal — `fetch` / SSE are web-standard.
+ * endpoint, dispatches each received form to a local {@link import('./types.js').TerminalInterface},
+ * and POSTs the answer back. Universal — `fetch` / SSE are web-standard.
  *
  * @param options - See {@link PromptClientOptions} (`url` + `terminal` required)
  * @returns A {@link PromptClientInterface}
@@ -253,16 +246,51 @@ export declare function createPrompt(options?: PromptOptions): PromptInterface;
  */
 export declare function createPromptClient(options: PromptClientOptions): PromptClientInterface;
 
-/** Build the initial {@link SelectState} from {@link SelectOptions} — normalizing choices and pre-focusing the default. */
-export declare function createSelectState(options: SelectOptions): SelectState;
+/**
+ * Build a complete {@link PromptTheme} by merging a partial one over
+ * {@link DEFAULT_PROMPT_THEME}, leaf by leaf — each supplied icon replaces that glyph, each
+ * supplied role replaces that {@link Style}, and everything else keeps its default. Each supplied
+ * style is snapshotted through the console module's own
+ * {@link import('@orkestrel/console').freezeStyle}, so the result is deeply frozen and a caller
+ * mutating its own attribute list afterwards cannot reach into a built theme.
+ *
+ * @param options - The partial theme to merge, or `undefined` for the defaults
+ * @returns The resolved, deeply frozen theme every prompt state carries
+ *
+ * @example
+ * ```ts
+ * createPromptTheme() // the defaults
+ * createPromptTheme({
+ * 	icons: { pointer: '=>' },
+ * 	roles: { message: { foreground: 'magenta', attributes: ['bold'] } },
+ * })
+ * ```
+ */
+export declare function createPromptTheme(options?: PromptThemeOptions): PromptTheme;
+
+/**
+ * Build the initial select-field key state.
+ *
+ * @param field - The select field to render
+ * @param styler - The styler used to render the view
+ * @param theme - The optional terminal theme
+ * @returns The initial immutable key state
+ */
+export declare function createSelectState(field: SelectField, styler?: StylerInterface, theme?: PromptThemeOptions): {
+    message: string;
+    choices: FieldChoice[];
+    styler: StylerInterface;
+    theme: PromptTheme;
+    focused: number;
+};
 
 /**
- * Create the multi-endpoint {@link TerminalManagerInterface} — a named registry of
+ * Create the multi-endpoint {@link TerminalManager} — a named registry of
  * {@link PromptInterface} brokers so several parties can `ask` prompts of each other by name,
  * with a transitive DEADLOCK check across every in-flight ask.
  *
  * @param options - See {@link TerminalManagerOptions}
- * @returns A {@link TerminalManagerInterface}
+ * @returns A {@link TerminalManager}
  *
  * @example
  * ```ts
@@ -348,9 +376,26 @@ export declare class DatabaseTerminalStore implements TerminalStoreInterface {
     delete(id: string): Promise<void>;
 }
 
-/** The default mask glyph a {@link import('./types.js').PasswordState} renders each input character as — `*`. */
+/** The default mask glyph {@link import('./helpers.js').createPasswordState} uses — `*`. */
 export declare const DEFAULT_MASK = "*";
 
+/**
+ * The {@link import('./types.js').PromptTheme} every prompt renders with unless its options supply
+ * another — the glyph set assembled from {@link PROMPT_ICONS} plus the console
+ * {@link import('@orkestrel/console').STATUS_ICONS} `success` / `error` marks, and the console
+ * {@link import('@orkestrel/console').Style} each role is painted with. Deeply frozen through the
+ * console module's own {@link import('@orkestrel/console').freezeStyle}; the baseline
+ * {@link import('./helpers.js').createPromptTheme} merges a partial theme over.
+ *
+ * @remarks
+ * The default roles reproduce the views' historical coloring exactly: `question` / `pointer` cyan,
+ * `message` / `focus` bold, `success` / `selected` green, `error` red, `hint` / `muted` /
+ * `description` dim, and `content` the EMPTY style — an empty style renders bare text, so primary
+ * content keeps the bytes it had before it became themeable.
+ * Two roles sharing a style today are still two roles — re-mapping one leaves the other alone.
+ */
+export declare const DEFAULT_PROMPT_THEME: PromptTheme;
+
 /** How long (ms) the {@link import('./types.js').PromptInterface} broker parks an unanswered prompt before it expires — 5 minutes. */
 export declare const DEFAULT_PROMPT_TIMEOUT_MS = 300000;
 
@@ -369,19 +414,6 @@ export declare function defaultTimer(callback: () => void, ms: number): TimerCan
 /** Delete (DEL, U+007F) — the usual Backspace byte on a Unix TTY. */
 export declare const DELETE: string;
 
-/**
- * Dispatch a {@link PendingPrompt} to the matching {@link PromptFormInterface} method — the bridge
- * step a {@link PromptClient} runs to drive a LOCAL terminal with a prompt issued elsewhere.
- * Reconstructs typed options from the wire-safe {@link PendingPrompt.options} (every field
- * §14-narrowed, never an `as`; the validator rebuilt from rules via {@link reconstructValidationRules}),
- * then calls the matching prompt form and returns its resolved value.
- *
- * @param terminal - The local {@link PromptFormInterface} to drive
- * @param pending - The decoded pending prompt to dispatch
- * @returns The prompt's resolved value (a `string` / `boolean` / `readonly string[]` per form)
- */
-export declare function dispatchPendingPrompt(terminal: PromptFormInterface, pending: PendingPrompt): Promise<string | boolean | readonly string[]>;
-
 /**
  * Apply a single line-editing {@link KeyEvent} to a text buffer — the editing shared by input /
  * password / editor. A printable key appends its character; `backspace` drops the last character;
@@ -390,85 +422,35 @@ export declare function dispatchPendingPrompt(terminal: PromptFormInterface, pen
  */
 export declare function editLine(value: string, key: KeyEvent): string | undefined;
 
-/** Options for a multi-line {@link import('./helpers.js').editorReduce} editor prompt (terminated by ctrl-d). */
-export declare interface EditorOptions {
-    readonly message: string;
-    readonly default?: string;
-    readonly validate?: Validator | ValidationRules;
-    readonly styler?: StylerInterface;
-}
-
 /**
  * Advance an editor prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
  * reducer. Printable characters extend the current line; backspace shrinks it; return commits the
  * current line and starts a fresh one; ctrl-d FINISHES (joining all lines, falling back to the
- * default when empty) through the validator; ctrl-c cancels. An invalid finish stays active with
- * the error.
+ * default when empty); ctrl-c cancels. The form validates the candidate after the driver fills it.
  */
-export declare function editorReduce(state: EditorState, key: KeyEvent): PromptStep<string, EditorState>;
+export declare function editorReduce(state: ReturnType<typeof createEditorState>, key: KeyEvent): PromptStep<string, ReturnType<typeof createEditorState>>;
 
 /**
- * The immutable state of an editor prompt — the committed `lines`, the in-progress `current`
- * line, plus the resolved validator + styler, the default, and the current `error`.
- *
- * @remarks
- * Built by {@link import('./helpers.js').createEditorState}; advanced by
- * {@link import('./helpers.js').editorReduce}. A printable key appends to `current`; `return`
- * commits `current` to `lines` and starts a fresh line; ctrl-d finishes, submitting
- * `lines + current` joined by newlines (or `default` when empty). The whole text is validated
- * on finish.
- */
-export declare interface EditorState {
-    readonly message: string;
-    readonly default: string;
-    readonly validator: Validator;
-    readonly styler: StylerInterface;
-    readonly lines: readonly string[];
-    readonly current: string;
-    readonly error?: string;
-}
-
-/** Render an {@link EditorState} as a MULTI-LINE styled view — the header (with a Ctrl+D hint), the committed lines, the in-progress line, and any error. */
-export declare function editorView(state: EditorState): string;
-
-/** Matches an email address — a non-trivial `local@domain.tld` shape. The `email` rule tests against this. */
-export declare const EMAIL_PATTERN: RegExp;
+ * Render an editor-field key state as a multi-line styled view with its finish hint.
+ */
+export declare function editorView(state: ReturnType<typeof createEditorState>): string;
 
-/** The styled error line (`✖ message`) — appended beneath a prompt view when the last submit failed validation. */
-export declare function errorLine(styler: StylerInterface, message: string): string;
+/** The styled error line (`✖ message`) a form driver appends for a field failure. */
+export declare function errorLine(styler: StylerInterface, theme: PromptTheme, message: string): string;
 
 /** Escape (ESC, U+001B) — the lone byte, and the lead byte of every CSI / SS3 sequence. */
 export declare const ESCAPE: string;
 
 /**
- * Evaluate ONE built-in validation rule against `input`, returning its error message when the
- * rule fails or `undefined` when it passes. The atomic check {@link buildRuleValidator} wraps
- * into a {@link Validator}. Pure.
- *
- * @remarks
- * A function `check` is the custom-override path: it is called and its `true` ⇒ pass, a string
- * ⇒ that message, anything else ⇒ the generic {@link RULE_MESSAGES.invalid}. A primitive `check`
- * runs the named built-in: `required` (non-empty trimmed), `minimum` / `maximum` (length
- * bounds, the message interpolated with the count), `pattern` (a regex source), and the
- * `email` / `url` / `numeric` / `integer` / `alphanumeric` pattern tests.
- *
- * @param rule - The rule name (`'required'`, `'minimum'`, …)
- * @param check - The configured value (a primitive toggle / bound / pattern, or a custom {@link Validator})
- * @param input - The input string to test
- * @returns The error message when the rule fails, else `undefined`
- */
-export declare function evaluateRule(rule: string, check: boolean | number | string | Validator, input: string): string | undefined;
-
-/**
- * A minimal `fetch` — the subset of the global `fetch` the {@link PromptClient} uses (open the
- * SSE stream, POST an answer). Injected so a test drives the client with a controlled
- * `Response` (a scripted SSE `ReadableStream`) instead of a real network.
+ * A minimal `fetch` — the subset of the global `fetch` a {@link PromptClientInterface} uses: open
+ * the SSE stream, POST an answer. Injected so a test drives the client with a scripted `Response`
+ * instead of a real network.
  */
 export declare type FetchHandler = (input: string, init?: FetchInit) => Promise<Response>;
 
 /**
- * The request init the {@link PromptClient} passes to its {@link FetchHandler} — the `fetch`
- * `RequestInit` fields it actually sets (method / headers / body / abort signal).
+ * The request init a {@link PromptClientInterface} passes to its {@link FetchHandler} — the
+ * `RequestInit` fields it actually sets.
  */
 export declare interface FetchInit {
     readonly method?: string;
@@ -477,55 +459,33 @@ export declare interface FetchInit {
     readonly signal?: AbortSignal;
 }
 
-/** The min/max gate for a checkbox submit — the rejection message when `count` is out of range, else `undefined`. */
-export declare function gateSelection(count: number, min?: number, max?: number): string | undefined;
-
 /** The default {@link import('./types.js').FetchHandler} — the global `fetch`, adapted to the minimal injected shape the {@link import('./PromptClient.js').PromptClient} uses. */
 export declare function globalFetch(input: string, init?: FetchInit): Promise<Response>;
 
-/** The auth-token request header the {@link import('./types.js').PromptClient} sends when a `token` is configured. */
+/** The auth-token request header the {@link import('./types.js').PromptClientInterface} sends. */
 export declare const HEADER_TOKEN = "x-orkestrel-token";
 
-/** Options for a single-line text {@link import('./helpers.js').inputReduce} prompt. */
-export declare interface InputOptions {
-    readonly message: string;
-    readonly default?: string;
-    readonly validate?: Validator | ValidationRules;
-    readonly styler?: StylerInterface;
-}
+/**
+ * Render a prompt header followed by a key hint painted with the `hint` role, or the header alone
+ * when no hint is supplied.
+ *
+ * @param styler - The console styler that renders each role
+ * @param theme - The resolved prompt theme
+ * @param message - The prompt's question text
+ * @param hint - The optional key hint to append
+ * @returns The rendered header with the optional hint
+ */
+export declare function hintedHeader(styler: StylerInterface, theme: PromptTheme, message: string, hint?: string): string;
 
 /**
  * Advance an input prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
  * reducer. Printable characters extend the value; backspace shrinks it; ctrl-u clears it; ctrl-c
- * cancels; return submits (the empty line falls back to the default) through the validator — an
- * invalid submit stays active with the error in the view.
+ * cancels; return produces the candidate value, with an empty line falling back to the default.
  */
-export declare function inputReduce(state: InputState, key: KeyEvent): PromptStep<string, InputState>;
+export declare function inputReduce(state: ReturnType<typeof createInputState>, key: KeyEvent): PromptStep<string, ReturnType<typeof createInputState>>;
 
-/**
- * The immutable state of a text input prompt — its options, the resolved validator + styler,
- * the accumulated `value`, and the current `error` (when the last submit failed validation).
- *
- * @remarks
- * Built by {@link import('./helpers.js').createInputState}; advanced by
- * {@link import('./helpers.js').inputReduce}. `value` accumulates printable characters and
- * shrinks on backspace; `error` holds the validation message shown in the view after a
- * rejected submit (cleared on the next keystroke).
- */
-export declare interface InputState {
-    readonly message: string;
-    readonly default: string;
-    readonly validator: Validator;
-    readonly styler: StylerInterface;
-    readonly value: string;
-    readonly error?: string;
-}
-
-/** Render an {@link InputState} as a styled view — the header, the typed value (or dimmed default hint), and any error. */
-export declare function inputView(state: InputState): string;
-
-/** Matches an integer (optional sign). The `integer` rule tests against this. */
-export declare const INTEGER_PATTERN: RegExp;
+/** Render a text-field key state as a styled view. */
+export declare function inputView(state: ReturnType<typeof createInputState>): string;
 
 /**
  * Whether a caught value is an `AbortError` — the {@link import('./PromptClient.js').PromptClient}
@@ -534,15 +494,6 @@ export declare const INTEGER_PATTERN: RegExp;
  */
 export declare function isAbortError(error: unknown): boolean;
 
-/** Narrow an unknown wire payload to an answer POST body — a non-empty `id` string plus a `value` key (of any shape) present. */
-export declare function isAnswerPayload(value: unknown): value is {
-    readonly id: string;
-    readonly value: unknown;
-};
-
-/** Narrow an unknown value to a {@link CheckboxChoice} — the `recordOf` shape inlined so no non-exported member lingers (§5). */
-export declare function isCheckboxChoice(value: unknown): value is CheckboxChoice;
-
 /**
  * Whether `url` is an INSECURE remote endpoint — a plain `http://` URL whose host is NOT a
  * loopback address. Pure string parsing (no `URL` global), so it stays total on malformed input.
@@ -565,25 +516,23 @@ export declare function isCheckboxChoice(value: unknown): value is CheckboxChoic
 export declare function isInsecureRemote(url: string): boolean;
 
 /**
- * Narrow an unknown wire value to a {@link PendingPrompt} before dispatching it.
+ * Narrow an unknown wire value to a {@link PendingForm} envelope.
+ *
+ * @remarks
+ * This guard checks the transport record and proves only that `schema` is a record. The Form
+ * package's `parseForm` owns the schema payload and its semantic audit.
  *
  * @param value - The decoded wire value to inspect
- * @returns Whether `value` is a complete pending-prompt record
+ * @returns Whether the value is a complete pending-form envelope
  */
-export declare const isPendingPrompt: Guard<PendingPrompt>;
+export declare function isPendingForm(value: unknown): value is PendingForm;
 
-/** Narrow an unknown value to a {@link PendingPromptStatus}. */
-export declare const isPendingPromptStatus: Guard<PendingPromptStatus>;
+/** Narrow an unknown value to a {@link PendingFormStatus}. */
+export declare const isPendingFormStatus: Guard<PendingFormStatus>;
 
 /** Whether a single character is a printable (non-control) character — used by {@link parseKey}'s char fallback. */
 export declare function isPrintable(character: string): boolean;
 
-/** Narrow an unknown value to a {@link PromptChoice} — the `recordOf` shape inlined so no non-exported member lingers (§5). */
-export declare function isPromptChoice(value: unknown): value is PromptChoice;
-
-/** Narrow an unknown value to a {@link PromptType} — one of the six prompt forms. */
-export declare const isPromptType: Guard<PromptType>;
-
 /**
  * Narrow an unknown caught value to a {@link TerminalError}.
  *
@@ -593,9 +542,11 @@ export declare const isPromptType: Guard<PromptType>;
  * @example
  * ```ts
  * try {
- * 	const name = await prompt.input({ message: 'Your name' })
+ * 	await terminal.ask(form)
  * } catch (error) {
- * 	if (isTerminalError(error) && error.code === 'EXPIRE') retryLater()
+ * 	if (isTerminalError(error) && error.code === 'CANCEL') {
+ * 		// the person aborted
+ * 	}
  * }
  * ```
  */
@@ -604,6 +555,14 @@ export declare function isTerminalError(value: unknown): value is TerminalError;
 /** Narrow an unknown value to a {@link TerminalSnapshot}. */
 export declare const isTerminalSnapshot: Guard<TerminalSnapshot>;
 
+/**
+ * Narrow an unknown value to a transport-neutral {@link WireEvent}.
+ *
+ * @param value - The candidate wire event
+ * @returns Whether the value carries an event name, serialized data, and an optional id
+ */
+export declare const isWireEvent: Guard<WireEvent>;
+
 /**
  * The Control Sequence Introducer lead (`ESC[`) for the navigation keys — the prefix of the
  * arrow / home / end / delete sequences {@link SEQUENCE_NAMES} is keyed by. Named `KEY_CSI`
@@ -616,23 +575,21 @@ export declare const KEY_CSI: string;
 export declare const KEY_SS3: string;
 
 /**
- * One decoded keypress — the universal, TTY-agnostic representation of a single key, the
- * output of {@link import('./helpers.js').parseKey}. A reducer reads `name` (and the
- * modifier flags) to decide its transition; the raw `sequence` is preserved so a printable
- * character round-trips and an unknown escape is never lost.
+ * One decoded keypress — the TTY-agnostic representation of a single key, the output of
+ * {@link import('./helpers.js').parseKey}. A driver reads `name` and the modifier flags to decide
+ * its transition; `sequence` is preserved so a printable character round-trips and an unknown
+ * escape is never lost.
  *
  * @remarks
- * - `name` — the canonical key name: a control / navigation key (`return`, `backspace`,
- *   `tab`, `escape`, `up` / `down` / `left` / `right`, `space`, `home`, `end`, `delete`),
- *   a named ctrl combo (`c` with `ctrl` true for ctrl-c, likewise `d` / `u` / `a` / `e`),
- *   or the printable character itself (`'a'`, `'7'`, `'?'`). An UNRECOGNIZED sequence
- *   yields `name: ''` (empty) — never a throw (the decoder is total).
- * - `sequence` — the exact input bytes as a string (a `Uint8Array` is decoded UTF-8). The
- *   driver writes this verbatim for a printable key; a reducer that needs the literal char
- *   reads it.
- * - `ctrl` / `meta` / `shift` — the modifier flags. `ctrl` is `true` for a C0 control byte
- *   (ctrl-c / ctrl-d / ctrl-u / ctrl-a / ctrl-e and the like); `meta` is `true` for an
- *   ESC-prefixed (Alt) sequence; `shift` is `true` for an uppercase-letter printable.
+ * - `name` — the canonical key name: a control or navigation key (`return`, `backspace`, `tab`,
+ *   `escape`, `up` / `down` / `left` / `right`, `space`, `home`, `end`, `delete`), a named ctrl
+ *   combo (`c` with `ctrl` true for ctrl-c, likewise `d` / `u` / `a` / `e`), or the printable
+ *   character itself (`'a'`, `'7'`, `'?'`). An unrecognized sequence yields `name: ''`; the decoder
+ *   is total and never throws.
+ * - `sequence` — the exact input bytes as a string (a `Uint8Array` is decoded UTF-8). The driver
+ *   writes this verbatim for a printable key.
+ * - `ctrl` / `meta` / `shift` — the modifier flags. `ctrl` is true for a C0 control byte, `meta`
+ *   for an ESC-prefixed (Alt) sequence, `shift` for an uppercase-letter printable.
  */
 export declare interface KeyEvent {
     readonly name: string;
@@ -684,43 +641,31 @@ export declare class MemoryTerminalStore implements TerminalStoreInterface {
 /** Line feed (`\n`, U+000A) — Enter on some terminals / pasted input. */
 export declare const NEWLINE: string;
 
-/** Normalize a checkbox choice input into a full {@link CheckboxChoice} (a bare string becomes both name and value). */
-export declare function normalizeCheckboxChoice(choice: string | CheckboxChoice): CheckboxChoice;
-
-/** Normalize a select choice input into a full {@link PromptChoice} (a bare string becomes both name and value). */
-export declare function normalizeChoice(choice: string | PromptChoice): PromptChoice;
-
-/** Matches a numeric value (integer or decimal, optional sign). The `numeric` rule tests against this. */
-export declare const NUMERIC_PATTERN: RegExp;
-
 /**
- * One parked prompt's runtime state inside the broker — the wire-safe {@link PendingPrompt} record
- * it exposes, plus the live machinery that settles that prompt's Promise. `respond` is the per-form
- * gate-and-resolve closure: it validates + type-checks an answer and (on accept) resolves the parked
- * Promise, returning whether it accepted; it closes over the form's precisely-typed `resolve`, so no
- * per-form generic leaks into `answer`. `expire` rejects the parked Promise; `cancel` clears the
- * injected expiry timer ({@link TimerCancel}).
+ * One parked form's runtime state inside the broker — the live form, the wire-safe record the
+ * broker exposes, and the cancel for its expiry timer.
+ *
+ * @remarks
+ * `form` is the AUTHORITATIVE form the caller parked, not a copy: an answer fills and submits this
+ * one, so a `custom` rule that never crossed the wire still decides. Expiry destroys it, which
+ * abandons it and settles the caller's promise through the form's own lifecycle. `pending` is the
+ * wire record, whose `status` tracks the ticket.
  */
 export declare interface Parked {
-    readonly prompt: PendingPrompt;
-    readonly respond: (value: unknown) => unknown;
-    readonly expire: () => void;
+    readonly form: FormInterface;
+    readonly pending: PendingForm;
     readonly cancel: TimerCancel;
 }
 
 /**
- * The request to {@link PromptInterface.park} a prompt directly — the general form the six
- * `PromptFormInterface` methods each wrap via a private `gateFor(form, options)` dispatch.
+ * The parking envelope — everything the broker needs about a park that the form itself does not
+ * say.
  *
  * @remarks
- * - `form` — which {@link PromptType} to park.
- * - `options` — that form's options bag ({@link PromptFormOptions}).
- * - `from` / `to` — set ONLY by a {@link TerminalManagerInterface} (the attribution edge); a
- *   direct broker caller leaves both `undefined`.
+ * `from` and `to` are the attribution edge, set ONLY by a {@link TerminalManagerInterface}: which
+ * endpoint asked, which endpoint must answer. A direct broker caller passes no request at all.
  */
 export declare interface ParkRequest {
-    readonly form: PromptType;
-    readonly options: PromptFormOptions;
     readonly from?: string;
     readonly to?: string;
 }
@@ -758,127 +703,70 @@ export declare interface ParkRequest {
  */
 export declare function parseKey(input: string | Uint8Array): KeyEvent;
 
-/**
- * Parse a JSON wire string TOTAL — a malformed / empty payload yields `undefined` (the caller's
- * guard then rejects it), never a throw. The {@link import('./PromptClient.js').PromptClient}
- * decodes every SSE `data` field through this before §14-narrowing it.
- */
-export declare function parseWireJSON(text: string): unknown;
-
-/** The always-passing {@link Validator} — the resolved validator when no rules were supplied. */
-export declare function passing(_input: string): true;
-
-/** Options for a masked password {@link import('./helpers.js').passwordReduce} prompt. */
-export declare interface PasswordOptions {
-    readonly message: string;
-    readonly mask?: string;
-    readonly validate?: Validator | ValidationRules;
-    readonly styler?: StylerInterface;
-}
-
 /**
  * Advance a password prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
  * reducer. Identical line-editing to {@link inputReduce} (printable extends, backspace shrinks,
- * ctrl-u clears, ctrl-c cancels) but the view masks the value; return submits through the
- * validator (no default fallback — a password has no echoed default).
+ * ctrl-u clears, ctrl-c cancels) but the view masks the value. Return produces the candidate value.
  */
-export declare function passwordReduce(state: PasswordState, key: KeyEvent): PromptStep<string, PasswordState>;
-
-/**
- * The immutable state of a password prompt — like {@link InputState} but with a `mask`
- * character the view renders in place of each input character.
- *
- * @remarks
- * Built by {@link import('./helpers.js').createPasswordState}; advanced by
- * {@link import('./helpers.js').passwordReduce}. The `value` is the real (unmasked) input;
- * the view shows `mask` repeated `value.length` times.
- */
-export declare interface PasswordState {
-    readonly message: string;
-    readonly mask: string;
-    readonly validator: Validator;
-    readonly styler: StylerInterface;
-    readonly value: string;
-    readonly error?: string;
-}
+export declare function passwordReduce(state: ReturnType<typeof createPasswordState>, key: KeyEvent): PromptStep<string, ReturnType<typeof createPasswordState>>;
 
-/** Render a {@link PasswordState} as a styled view — the header, the value masked to `mask` repeated, and any error. */
-export declare function passwordView(state: PasswordState): string;
+/** Render a password-field key state as a styled view. */
+export declare function passwordView(state: ReturnType<typeof createPasswordState>): string;
 
 /**
- * One prompt PARKED by the broker — an id-keyed, wire-safe record of a {@link PromptFormInterface}
- * call awaiting a remote answer. The value a `pending` listener receives and the broker serializes
- * over SSE to a {@link PromptClient}.
+ * One form PARKED by the broker — an id-keyed, wire-safe record of a live form awaiting a remote
+ * answer. The value a `pending` listener receives and the broker serializes over SSE to a
+ * {@link PromptClientInterface}.
  *
  * @remarks
- * - `id` — the unique id (minted via `crypto.randomUUID()`); the key for {@link PromptInterface.answer}.
- * - `form` — which prompt form was called ({@link PromptType}); the discriminant a client
- *   dispatches on (named for its axis — the prompt form — never `kind` / `type`).
- * - `message` — the prompt's question (lifted out of `options` for direct display).
- * - `options` — the WIRE-SAFE options (a `validate` FUNCTION dropped; the declarative
- *   {@link ValidationRules} data + `choices` / `default` / `mask` kept — see
- *   {@link import('./helpers.js').serializePromptOptions}). A client reconstructs the validator
- *   from the rules via {@link resolveValidation}.
- * - `status` — the current {@link PendingPromptStatus}.
- * - `time` — the creation timestamp (ms since epoch).
- * - `from` / `to` — the OPTIONAL attribution edge a {@link TerminalManagerInterface} stamps on a
- *   parked prompt (which endpoint asked, which endpoint must answer); absent for a bare broker
- *   {@link PromptInterface} used directly (no manager attribution).
- */
-export declare interface PendingPrompt {
+ * - `id` — the unique id, minted with `crypto.randomUUID()`; the key for
+ *   {@link PromptInterface.answer}.
+ * - `schema` — the parked form's schema projected to JSON by the dependency's own `serializeForm`.
+ *   Every `custom` validator is dropped on the way out, so an authoritative rule the wire cannot
+ *   carry stays server-side and is enforced when the answer comes back.
+ * - `status` — the ticket's {@link PendingFormStatus}.
+ * - `time` — the creation timestamp, ms since epoch.
+ * - `from` / `to` — the attribution edge a {@link TerminalManagerInterface} stamps on a parked
+ *   form: which endpoint asked, which endpoint must answer. Both absent for a bare broker used
+ *   directly.
+ */
+export declare interface PendingForm {
     readonly id: string;
-    readonly form: PromptType;
-    readonly message: string;
-    readonly options: Readonly<Record<string, unknown>>;
-    readonly status: PendingPromptStatus;
+    readonly schema: JSONRecord;
+    readonly status: PendingFormStatus;
     readonly time: number;
     readonly from?: string;
     readonly to?: string;
 }
 
 /**
- * The lifecycle status of a parked {@link PendingPrompt} — where a brokered prompt stands.
- * Names its axis (the pending prompt's progression), never `kind` (AGENTS §4.4).
+ * The lifecycle status of a parked {@link PendingForm} — where the TICKET stands, which is not
+ * where the form stands. A ticket is `pending` until somebody answers it; the form it carries has
+ * its own status, and the two are separate facts about separate entities.
  *
  * @remarks
- * - `pending` — parked, awaiting an {@link PromptInterface.answer} (the Promise is unresolved).
- * - `answered` — answered and accepted (the Promise resolved with the validated value).
- * - `expired` — timed out (or torn down by `destroy`) before an answer (the Promise rejected).
+ * - `pending` — parked, awaiting {@link PromptInterface.answer}.
+ * - `answered` — answered and accepted, so the parked form settled.
+ * - `expired` — timed out, or torn down by `destroy`, before an answer.
  */
-export declare type PendingPromptStatus = 'pending' | 'answered' | 'expired';
+export declare type PendingFormStatus = 'pending' | 'answered' | 'expired';
 
 /**
- * The headless prompt BROKER (observable §13) — parks each {@link PromptInterface} call as a
- * pending prompt and returns a Promise that resolves when the prompt is {@link answer}ed (or
- * rejects on timeout / teardown). The tri-surface's headless arm: there is no terminal here, so a
- * transport forwards each `pending` event to whoever can answer, and {@link answer} resolves the
- * parked Promise — for environments where direct user access is unavailable (a headless server on
- * stdio, a browser with no TTY, a prompt issued on one machine answered on another).
+ * The headless form broker. It parks live forms, exposes their serialized schemas, and applies
+ * remote answers to the authoritative form.
  *
  * @remarks
- * - **Park-as-Promise.** Each `input` / `password` / `confirm` / `select` / `checkbox` / `editor`
- *   mints an id (`crypto.randomUUID()`), parks a wire-safe {@link PendingPrompt}, emits `pending`,
- *   and returns an unresolved Promise. The prompt's options are serialized
- *   ({@link serializePromptOptions}) so a transport can forward them as-is.
- * - **Answer validates + type-checks.** {@link answer} runs the prompt's per-form gate: it
- *   type-checks `value` to the form (string / boolean / string[]) AND, for the text forms, runs
- *   the validator resolved from the original `validate` rules. A rejected answer returns `false`
- *   and the prompt stays `pending`; an accepted answer resolves the Promise, emits `answer`, and
- *   removes the prompt.
- * - **Timeout → expire → reject.** An unanswered prompt expires after `timeout` ms (via the
- *   INJECTED timer): `expire` fires and the parked Promise rejects with a {@link TerminalError}
- *   (`code: 'EXPIRE'`). {@link destroy} expires every still-pending prompt the same way.
- * - **Deterministic.** The timer is injectable ({@link import('./types.js').TimerHandler}); a test
- *   supplies one that fires on demand, so expiry is driven without real time.
+ * A parked record carries one call to `serializeForm`. A failed fill or submit leaves the record
+ * parked for another answer. A successful submit settles the form once, emits `answer`, and removes
+ * the record. Timeout and teardown abandon every unsettled form through its own `destroy` method.
  *
  * @example
  * ```ts
- * const prompt = createPrompt({ timeout: 60_000 })
- * prompt.emitter.on('pending', (pending) => broadcast(pending)) // forward to a client
- *
- * const name = await prompt.input({ message: 'Your name' }) // parks; resolves on answer()
- * // ...elsewhere, a client POSTs the answer back:
- * prompt.answer(id, 'Ada') // resolves the awaited input() above
+ * const form = createForm({ fields: [{ control: 'text', name: 'name' }] })
+ * const prompt = createPrompt()
+ * const id = prompt.park(form)
+ * prompt.answer(id, { name: 'Ada' })
+ * await form.answer // { name: 'Ada' }
  * ```
  */
 export declare class Prompt implements PromptInterface {
@@ -886,25 +774,16 @@ export declare class Prompt implements PromptInterface {
     constructor(options?: PromptOptions);
     get emitter(): EmitterInterface<PromptEventMap>;
     get count(): number;
-    pending(): readonly PendingPrompt[];
-    pending(id: string): PendingPrompt | undefined;
-    answer(id: string, value: unknown): AnswerResult;
-    park(request: ParkRequest): Ticket;
-    input(options: InputOptions): Promise<string>;
-    password(options: PasswordOptions): Promise<string>;
-    confirm(options: ConfirmOptions): Promise<boolean>;
-    select(options: SelectOptions): Promise<string>;
-    checkbox(options: CheckboxOptions): Promise<readonly string[]>;
-    editor(options: EditorOptions): Promise<string>;
+    pending(): readonly PendingForm[];
+    pending(id: string): PendingForm | undefined;
+    park(form: FormInterface, request?: ParkRequest): string;
+    answer(id: string, values: FormValues): Result<FormValues, AnswerError>;
     destroy(): void;
 }
 
 /**
- * The prompt-view icon glyphs the reducers render the prompt line and choice rows with. PLAIN
- * glyphs — color is applied by the {@link import('./types.js').PromptState}'s
- * {@link import('@orkestrel/console').StylerInterface} at render time, never baked into the
- * constant (AGENTS — styling orthogonal to data; the rework fixes the terminal's ANSI-in-the-icon).
- * Frozen.
+ * The six default glyphs {@link DEFAULT_PROMPT_THEME} assembles its `icons` from. Read only when
+ * the default theme is assembled; a view reads its resolved theme and never this constant. Frozen.
  *
  * @remarks
  * - `question` — the leading mark on a prompt's message line.
@@ -921,49 +800,39 @@ export declare const PROMPT_ICONS: Readonly<{
     unchecked: "☐";
 }>;
 
-/** A choice item in a {@link SelectOptions} prompt — its displayed `name`, its resolved `value`, and an optional one-line `description`. */
-export declare interface PromptChoice {
-    readonly name: string;
-    readonly value: string;
-    readonly description?: string;
-}
+/**
+ * Every {@link import('./types.js').PromptRole}, in one frozen list — the role axis's source of
+ * truth. {@link import('./helpers.js').createPromptTheme} walks it to merge a partial theme, and
+ * a consumer building a complete role map reads it rather than retyping every name.
+ */
+export declare const PROMPT_ROLES: readonly PromptRole[];
 
 /**
- * The SSE prompt BRIDGE (observable §13) — the client-side counterpart to
- * {@link import('./Prompt.js').Prompt}. Connects to a remote broker's SSE endpoint, receives
- * serialized pending prompts, dispatches EACH to a LOCAL {@link PromptFormInterface} terminal (so
- * a human at THIS machine answers a prompt parked elsewhere), and POSTs the answer back.
- * Universal — `fetch` + SSE are web-standard, so it runs in a browser or on a server; the
- * injected `fetch` / timer make it fully deterministic in tests.
+ * The SSE form bridge. It ingests serialized forms from a remote broker, renders them through a
+ * local terminal, and posts answers back without blocking the event stream.
  *
  * @remarks
- * - **Connect + reconnect.** {@link connect} opens the SSE stream (via the injected `fetch` + the
- *   core `SSEParser`) and loops, reconnecting after the stream drops with the `delay` backoff
- *   (driven by the injected timer) — unless `reconnect` is `false`, the client was
- *   {@link destroy}ed, or the drop was a deliberate {@link disconnect} (an abort).
- * - **Dispatch + answer.** Each decoded `pending` event is narrowed to a `PendingPrompt` (§14 —
- *   never an `as`), dispatched to `terminal`, and its resolved value POSTed back to `url`.
- *   Dispatch is strictly SERIAL: the read loop drives the terminal for ONE prompt at a time and
- *   only reads/dispatches the next event after the current prompt fully settles (its answer
- *   POSTed). A prompt id redelivered (e.g. after a reconnect) WHILE its prior dispatch is still
- *   in flight is skipped (a `#seen` set tracks in-flight ids); once that dispatch settles (or the
- *   broker sends `expire` for the id) the id is dropped from `#seen`, so a later redelivery of the
- *   SAME id after completion is dispatched again — the client does not dedupe across completion.
- * - **Server signals.** An `expire` event (the broker dropped a parked prompt) emits `expire`; a
- *   `shutdown` event calls {@link disconnect} (not {@link destroy}) — the client stops streaming
- *   without auto-reconnect but stays reusable; a later {@link connect} recovers it.
- * - **Lean events (§13).** `connect` / `disconnect` / `expire` / `error` — errors are `unknown`.
- *   `disconnect` fires exactly once per connected-to-disconnected transition, whether triggered by
- *   the server ending the stream cleanly or by a deliberate {@link disconnect} / {@link destroy}.
+ * - **Connect + reconnect.** {@link connect} opens the SSE stream and reconnects after a transport
+ *   drop with the injected backoff unless reconnect is disabled, the client was destroyed, or
+ *   {@link disconnect} deliberately stopped it.
+ * - **Ingest + render.** Each `pending` envelope passes through `isPendingForm`, Form's `parseForm`,
+ *   and terminal's `sanitizeSchema`, then enters a serial render queue. The SSE reader never awaits
+ *   that queue, so `expire` and `shutdown` remain live while a person is answering.
+ * - **Safe local form.** The rendering copy omits every wire `pattern`, because Form compiles a
+ *   pattern during local evaluation. The broker's parked form retains it and remains authoritative.
+ * - **Refusal retry.** A structured `rejected` response seeds a new rendering form with the values
+ *   just submitted, applies every {@link FieldError} through `invalidate`, and asks again. No retry
+ *   counter truncates the loop; acceptance, expiry, and shutdown are its bounds.
+ * - **Replay safety.** A replayed id is skipped while it is queued, rendering, or posting. Once an
+ *   attempt ends, a later delivery of that id may be rendered again.
  *
  * @example
  * ```ts
  * const client = createPromptClient({
  * 	url: 'http://localhost:3001/prompts',
- * 	terminal: createTerminal(), // a local PromptFormInterface (T-c)
- * 	on: { connect: () => log('connected') },
+ * 	terminal: createTerminal(),
  * })
- * await client.connect() // streams remote prompts to the local terminal, POSTs answers back
+ * await client.connect()
  * ```
  */
 export declare class PromptClient implements PromptClientInterface {
@@ -978,13 +847,15 @@ export declare class PromptClient implements PromptClientInterface {
 }
 
 /**
- * The client's event map (AGENTS §13) — lean, errors `unknown`, no listener-error event.
+ * The client's event map — lean, errors `unknown`, no listener-error event.
  *
  * @remarks
  * - `connect` — the SSE stream opened.
- * - `disconnect` — the SSE stream closed (the server ended it, or {@link PromptClientInterface.disconnect}).
- * - `expire` — the remote broker signalled a parked prompt expired (carries its `id`).
- * - `error` — a connection / dispatch / POST fault (errors are `unknown`).
+ * - `disconnect` — the SSE stream closed, by the server or by
+ *   {@link PromptClientInterface.disconnect}.
+ * - `expire` — the remote broker signalled that a parked form expired, carrying its id. The client
+ *   destroys the local form rendering it, or drops it from the queue if it has not started.
+ * - `error` — a connection, render, or POST fault.
  */
 export declare type PromptClientEventMap = {
     readonly connect: readonly [];
@@ -994,17 +865,22 @@ export declare type PromptClientEventMap = {
 };
 
 /**
- * The SSE prompt BRIDGE (observable §13) — the client-side counterpart to {@link PromptInterface}.
- * Connects to a remote broker's SSE endpoint, receives serialized {@link PendingPrompt}s,
- * dispatches EACH to a local {@link PromptFormInterface} terminal, and POSTs the answer back —
- * so a human at this machine answers prompts a broker parked elsewhere.
+ * The SSE form BRIDGE — the client-side counterpart to {@link PromptInterface}. It receives
+ * serialized {@link PendingForm} records from a remote broker, rebuilds each schema locally, drives
+ * it through a {@link TerminalInterface}, and POSTs the answer back, so a human at this machine
+ * answers forms a broker parked elsewhere.
  *
  * @remarks
- * - **Connect.** {@link connect} opens the SSE stream (via the injected `fetch` + the core
- *   `SSEParser`) and resolves when the stream ends; it reconnects with the `delay` backoff
- *   unless `reconnect` is `false` or the client was {@link destroy}ed.
- * - **Dispatch + answer.** Each decoded prompt is narrowed (§14) and dispatched to `terminal`;
- *   the resolved value POSTs back to `url`.
+ * - **Connect.** {@link connect} opens the SSE stream through the injected `fetch` and resolves
+ *   when the stream ends. It reconnects on the `delay` backoff unless `reconnect` is false or the
+ *   client was destroyed.
+ * - **Ingest, then render.** Ingestion never waits on a render. Each decoded record is narrowed,
+ *   its schema parsed and sanitized, and queued; one form is driven at a time while the stream
+ *   keeps reading, so an unanswered form never starves the connection.
+ * - **Never trust the wire.** Every rendered string is sanitized, and a `pattern` that arrived over
+ *   the wire is never executed locally. The authoritative form decides.
+ * - **Refusal retries.** A rejected answer comes back with the parked form's own errors; the client
+ *   applies them to the local form and asks again until the answer is accepted or the form expires.
  * - **`connected`** reflects whether the stream is currently open.
  */
 export declare interface PromptClientInterface {
@@ -1017,27 +893,27 @@ export declare interface PromptClientInterface {
 }
 
 /**
- * Options for {@link import('./factories.js').createPromptClient} / the {@link PromptClientInterface}.
+ * Options for {@link import('./factories.js').createPromptClient} and the
+ * {@link PromptClientInterface}.
  *
  * @remarks
- * - `url` — the remote broker's SSE endpoint (GET opens the stream; answers POST back to it).
- * - `terminal` — the LOCAL {@link PromptFormInterface} each remote prompt is dispatched to, so a
- *   human at THIS machine answers a prompt issued elsewhere.
- * - `token` — an optional auth token, sent as the
- *   {@link import('./constants.js').HEADER_TOKEN} header on every request.
- * - `reconnect` — whether to reconnect after the stream drops (default `true`).
+ * - `url` — the remote broker's SSE endpoint. A GET opens the stream; answers POST back to it.
+ * - `terminal` — the LOCAL {@link TerminalInterface} each remote form is driven through, so a human
+ *   at THIS machine answers a form parked elsewhere.
+ * - `token` — an optional auth token, sent as the {@link import('./constants.js').HEADER_TOKEN}
+ *   header on every request.
+ * - `reconnect` — whether to reconnect after the stream drops, default true.
  * - `delay` — ms to wait before each reconnect attempt (default
  *   {@link import('./constants.js').DEFAULT_RECONNECT_DELAY_MS}).
- * - `on` — initial {@link PromptClientEventMap} listeners (AGENTS §8/§13).
- * - `error` — the emitter's listener-error handler (AGENTS §13).
- * - `fetch` — the injected {@link FetchHandler} (default the global `fetch`); supply a scripted
- *   fetch to drive the client deterministically in tests.
- * - `timer` — the injected {@link TimerHandler} for the reconnect backoff (default the host
- *   `setTimeout`); supply a deterministic timer to drive reconnection without real time.
+ * - `on` — initial {@link PromptClientEventMap} listeners.
+ * - `error` — the emitter's listener-error handler.
+ * - `fetch` — the injected {@link FetchHandler}, default the global `fetch`.
+ * - `timer` — the injected {@link TimerHandler} for the reconnect backoff, default the host
+ *   `setTimeout`.
  */
 export declare interface PromptClientOptions {
     readonly url: string;
-    readonly terminal: PromptFormInterface;
+    readonly terminal: TerminalInterface;
     readonly token?: string;
     readonly reconnect?: boolean;
     readonly delay?: number;
@@ -1048,98 +924,77 @@ export declare interface PromptClientOptions {
 }
 
 /**
- * The broker's event map (AGENTS §13) — lean, errors `unknown`, no listener-error event.
+ * The broker's event map — lean, errors `unknown`, no listener-error event.
  *
  * @remarks
- * - `pending` — a prompt was parked (carries the wire-safe {@link PendingPrompt}); a transport
- *   forwards it to remote clients.
- * - `answer` — a parked prompt was answered (carries its `id` + the accepted `value`).
- * - `expire` — a parked prompt timed out (or was torn down) unanswered (carries its `id`).
+ * - `pending` — a form was parked; a transport forwards the wire record to remote clients.
+ * - `answer` — a parked form was answered and accepted, carrying its id and the settled values.
+ * - `expire` — a parked form timed out or was torn down unanswered, carrying its id.
  */
 export declare type PromptEventMap = {
-    readonly pending: readonly [prompt: PendingPrompt];
-    readonly answer: readonly [id: string, value: unknown];
+    readonly pending: readonly [form: PendingForm];
+    readonly answer: readonly [id: string, values: FormValues];
     readonly expire: readonly [id: string];
 };
 
+/** The styled prompt-message header (`? message`) — the leading line every active prompt view shares, themed by the `question` + `message` roles. */
+export declare function promptHeader(styler: StylerInterface, theme: PromptTheme, message: string): string;
+
 /**
- * The shared ASYNC prompt contract — the six prompt forms as Promise-returning methods. The
- * ONE vocabulary BOTH the headless {@link PromptInterface} broker (this module) and the server
- * `Terminal` driver (T-c) implement, so a prompt issued through this surface resolves the same
- * way on every surface (local TTY, headless broker, remote bridge).
+ * One glyph slot a rendered field draws — the icon axis of a {@link PromptTheme}. A named value
+ * set, not a toggle, so it stays a union.
  *
  * @remarks
- * Each method takes the prompt's `*Options` and resolves to that form's value type:
- * - `input` / `password` / `select` / `editor` → a `string`
- * - `confirm` → a `boolean`
- * - `checkbox` → a `readonly string[]` (the checked values, in choice order)
- *
- * This is a behavioral CONTRACT (the method surface), not an observable entity — the broker and
- * the driver add their own emitter / lifecycle on top. The {@link PromptClient} dispatches a
- * remote {@link PendingPrompt} to a LOCAL `PromptFormInterface` (so a human at this machine
- * answers a prompt parked elsewhere).
- */
-export declare interface PromptFormInterface {
-    input(options: InputOptions): Promise<string>;
-    password(options: PasswordOptions): Promise<string>;
-    confirm(options: ConfirmOptions): Promise<boolean>;
-    select(options: SelectOptions): Promise<string>;
-    checkbox(options: CheckboxOptions): Promise<readonly string[]>;
-    editor(options: EditorOptions): Promise<string>;
-}
-
-/**
- * The union of every prompt form's options bag — the `options` a {@link ParkRequest} carries,
- * narrowed at the call site by the paired {@link PromptType}.
+ * - `question` — the leading mark on a field's label line.
+ * - `pointer` — the cursor before the input or the focused choice row.
+ * - `dot` / `selected` — an unfocused / focused row marker in a choice list.
+ * - `checked` / `unchecked` — a checked / unchecked box in a multi-choice list.
+ * - `success` / `error` — the mark on a settled field's line / on its failure line.
  */
-export declare type PromptFormOptions = InputOptions | PasswordOptions | ConfirmOptions | SelectOptions | CheckboxOptions | EditorOptions;
-
-/** The styled prompt-message header (`? message`) — the leading line every active prompt view shares. */
-export declare function promptHeader(styler: StylerInterface, message: string): string;
+export declare type PromptIcon = 'question' | 'pointer' | 'dot' | 'selected' | 'checked' | 'unchecked' | 'success' | 'error';
 
 /**
- * The headless prompt BROKER (observable §13) — implements {@link PromptFormInterface} by
- * PARKING each call as a {@link PendingPrompt} and returning a Promise that resolves when the
- * prompt is {@link answer}ed (or rejects on timeout). The local-TTY / headless / remote
- * tri-surface's headless arm: no terminal here — a transport forwards each `pending` to whoever
- * can answer, and {@link answer} resolves the parked Promise.
+ * The headless form BROKER — parks a live form until somebody elsewhere answers it. The headless
+ * arm of the local-TTY / headless / remote trio: there is no terminal here, so a transport forwards
+ * each `pending` record to whoever can answer, and {@link answer} drives the parked form to
+ * settlement.
  *
  * @remarks
- * - **Park-as-Promise.** Each `input` / `password` / … call mints an id, parks a
- *   {@link PendingPrompt}, emits `pending`, and returns an unresolved Promise. {@link park} is the
- *   general entry point the six form methods wrap.
- * - **Answer validates.** {@link answer} validates `value` against the prompt's resolved
- *   validator AND type-checks it to the prompt form before accepting; a bad answer is rejected
- *   (an {@link AnswerResult} failure, the prompt stays `pending`).
- * - **Timeout → expire → reject.** An unanswered prompt expires after `timeout` ms — `expire`
- *   fires and the parked Promise rejects (a {@link import('./errors.js').TerminalError}). The
- *   timer is injectable for deterministic tests.
- * - **Accessors (§9.1).** `pending()` lists the parked prompts; `pending(id)` looks one up.
- */
-export declare interface PromptInterface extends PromptFormInterface {
+ * - **The form is the unit.** {@link park} takes a live form, mints an id, emits `pending`, and
+ *   returns the id. It wraps no promise, because the caller already holds one: the form's own
+ *   `answer`.
+ * - **The parked form is authoritative.** {@link answer} fills and submits THAT form, so every rule
+ *   it carries decides, including a `custom` validator the wire dropped. A refusal returns the
+ *   form's own errors and leaves the form parked.
+ * - **Timeout abandons.** An unanswered form is destroyed after `timeout` ms; `expire` fires and
+ *   the caller's promise rejects on the form's own lifecycle. The timer is injectable.
+ * - **Accessors.** `pending()` lists the parked records; `pending(id)` looks one up.
+ */
+export declare interface PromptInterface {
     readonly emitter: EmitterInterface<PromptEventMap>;
     readonly count: number;
-    park(request: ParkRequest): Ticket;
-    pending(): readonly PendingPrompt[];
-    pending(id: string): PendingPrompt | undefined;
-    answer(id: string, value: unknown): AnswerResult;
+    park(form: FormInterface, request?: ParkRequest): string;
+    pending(): readonly PendingForm[];
+    pending(id: string): PendingForm | undefined;
+    answer(id: string, values: FormValues): Result<FormValues, AnswerError>;
     destroy(): void;
 }
 
 /**
- * Options for {@link import('./factories.js').createPrompt} / the {@link PromptInterface} broker.
+ * Options for {@link import('./factories.js').createPrompt} and every {@link PromptInterface}
+ * broker, including one a {@link TerminalManagerInterface} mounts per endpoint.
  *
  * @remarks
- * - `on` — initial {@link PromptEventMap} listeners (AGENTS §8/§13).
- * - `error` — the emitter's listener-error handler (AGENTS §13).
- * - `timeout` — ms a parked prompt waits before it expires + its Promise rejects (default
+ * - `on` — initial {@link PromptEventMap} listeners.
+ * - `error` — the emitter's listener-error handler.
+ * - `timeout` — ms a parked form waits before it expires and is abandoned (default
  *   {@link import('./constants.js').DEFAULT_PROMPT_TIMEOUT_MS}).
- * - `timer` — the injected {@link TimerHandler} (default the host `setTimeout`); supply a
+ * - `timer` — the injected {@link TimerHandler}, default the host `setTimeout`; supply a
  *   deterministic timer to drive expiry in tests without real time.
- * - `cap` — the maximum number of prompts this broker will hold PARKED at once (default
- *   UNBOUNDED — no cap unless supplied). Once `count` reaches `cap`, a new park is rejected with
- *   a {@link import('./errors.js').TerminalError} (`code: 'LIMIT'`) WITHOUT parking, minting an
- *   id, emitting `pending`, or arming the expiry timer — the runaway-asker memory ceiling.
+ * - `cap` — the maximum number of forms this broker holds parked at once, default unbounded. Once
+ *   `count` reaches `cap` a new park is refused with a
+ *   {@link import('./errors.js').TerminalError} coded `LIMIT`, without parking, minting an id,
+ *   emitting `pending`, or arming a timer. The runaway-asker memory ceiling.
  */
 export declare interface PromptOptions {
     readonly on?: EmitterHooks<PromptEventMap>;
@@ -1150,33 +1005,50 @@ export declare interface PromptOptions {
 }
 
 /**
- * The discriminant of a {@link PromptStep} — where the prompt stands after a key. `active`:
- * keep prompting (the input was consumed, or rejected by validation). `submit`: the prompt
- * resolved with its `value`. `cancel`: the user aborted (ctrl-c). Names its axis (the prompt's
- * progression), never `kind` (AGENTS §4.4).
+ * One styling slot a rendered field paints through — the semantic axis of a {@link PromptTheme}. A
+ * role says what a fragment MEANS; the theme decides what that meaning looks like, so a consumer
+ * re-maps styled output by naming roles rather than reimplementing a renderer.
+ *
+ * @remarks
+ * - `question` — the leading mark on an active field's line.
+ * - `pointer` — the cursor before the input or the focused choice row.
+ * - `message` — the field's own label text.
+ * - `content` — the field's primary content: the typed value, the mask run, an unfocused choice
+ *   label, or a committed editor line. Its default is the EMPTY style, so unthemed content renders
+ *   as bare text.
+ * - `success` / `error` — a settled field's mark / a failure mark and its message.
+ * - `selected` — a chosen value: the checked box, the focused choice marker, the confirm default
+ *   letter.
+ * - `focus` — the label of the row the cursor is on.
+ * - `hint` — dim supplementary text: a default value, a key hint, a selection count, a committed
+ *   answer.
+ * - `muted` — a dim off-state mark: an unfocused choice marker, an unchecked box, a fallback index.
+ * - `description` — a choice's one-line help text.
+ */
+export declare type PromptRole = 'question' | 'pointer' | 'message' | 'content' | 'success' | 'error' | 'selected' | 'focus' | 'hint' | 'muted' | 'description';
+
+/**
+ * Where one field's reducer stands after a key. `active`: keep asking, because the key was
+ * consumed or the answer was refused. `submit`: the field resolved with its `value`. `cancel`: the
+ * user aborted with ctrl-c. Names its axis, never `kind`.
  */
 export declare type PromptStatus = 'active' | 'submit' | 'cancel';
 
 /**
- * The result of one reducer step — the next `state`, the rendered `view`, the `status`, and,
- * on `submit`, the resolved `value`. The whole contract between a pure prompt reducer and the
- * impure driver: the driver applies the next `state`, writes the `view`, and — when `status`
- * is `submit` — reads `value`.
+ * The result of one reducer step — the next `state`, the rendered `view`, the `status`, and, on
+ * `submit`, the resolved `value`. The whole contract between a pure reducer and the impure driver:
+ * the driver applies the next `state`, writes the `view`, and reads `value` on `submit`.
  *
- * @typeParam T - The prompt's resolved value type (`string` for input / password / select /
- *   editor, `boolean` for confirm, `readonly string[]` for checkbox).
- * @typeParam S - The prompt's concrete state shape ({@link InputState}, {@link SelectState}, …) —
- *   carried directly so `state` stays precisely typed with no union narrowing or assertion.
+ * @typeParam T - The value this field resolves to, as its control admits it.
+ * @typeParam S - The reducer's concrete state shape, carried directly so `state` stays precisely
+ *   typed with no union narrowing and no assertion.
  *
  * @remarks
- * - `state` — the next immutable prompt state (feed it to the next reduce call). On `submit` /
- *   `cancel` it is the final state.
- * - `view` — the styled string to render NOW (possibly MULTI-LINE for `select` / `checkbox`),
- *   built through the state's {@link StylerInterface}. On an invalid `submit` it carries the
- *   error; the driver re-renders it each step.
- * - `status` — the {@link PromptStatus}: `active` to continue, `submit` when resolved, `cancel`
- *   on abort.
- * - `value` — present ONLY on a `submit` step, carrying the prompt's resolved value.
+ * - `state` — the next immutable state; feed it to the next reduce call. On `submit` or `cancel` it
+ *   is the final state.
+ * - `view` — the styled string to render now, possibly multi-line. On a refused `submit` it carries
+ *   the failure; the driver re-renders it each step.
+ * - `value` — present ONLY on a `submit` step.
  */
 export declare interface PromptStep<T, S> {
     readonly state: S;
@@ -1186,105 +1058,81 @@ export declare interface PromptStep<T, S> {
 }
 
 /**
- * The six prompt KINDS this core provides — the value family a higher-level broker (T-b)
- * dispatches on. Names the prompt axis; a named value set (not a toggle), so it stays a union.
- */
-export declare type PromptType = 'input' | 'password' | 'confirm' | 'select' | 'checkbox' | 'editor';
+ * A resolved PRESENTATION — the glyph for every {@link PromptIcon} and the console {@link Style}
+ * for every {@link PromptRole}. Plain JSON data with no functions, so it crosses the wire with the
+ * form it decorates. Built by {@link import('./helpers.js').createPromptTheme}.
+ *
+ * @remarks
+ * A role's value is the console module's own {@link Style} — the one style model the whole console
+ * and terminal system shares — so a renderer paints a role through
+ * {@link import('@orkestrel/console').StylerInterface} and this package holds no second style
+ * vocabulary. A `Style` carries a foreground, a background, and an attribute list, so a role can
+ * express a background color, which a styler's accessor chain cannot name.
+ */
+export declare interface PromptTheme {
+    readonly icons: Readonly<Record<PromptIcon, string>>;
+    readonly roles: Readonly<Record<PromptRole, Style>>;
+}
 
 /**
- * The union of a resolved prompt's value shapes — a `string` (`input` / `password` / `select` /
- * `editor`), a `boolean` (`confirm`), or a `readonly string[]` (`checkbox`, the checked values in
- * choice order). The type a {@link Ticket}'s `value` Promise resolves to.
+ * The PARTIAL {@link PromptTheme} an option bag carries — every icon and every role is optional,
+ * and {@link import('./helpers.js').createPromptTheme} merges what is supplied over
+ * {@link import('./constants.js').DEFAULT_PROMPT_THEME} leaf by leaf. Supplying one icon or one
+ * role leaves every other slot at its default.
  */
-export declare type PromptValue = string | boolean | readonly string[];
+export declare interface PromptThemeOptions {
+    readonly icons?: Readonly<Partial<Record<PromptIcon, string>>>;
+    readonly roles?: Readonly<Partial<Record<PromptRole, Style>>>;
+}
+
+/** Carriage return (`\r`, U+000D) — Enter on most terminals. */
+export declare const RETURN: string;
 
 /**
- * Rebuild a wire-decoded `validate` payload into a {@link ValidationRules} bag — the inverse of
- * {@link serializeValidationRules}. Keeps only the primitive rule values (`boolean` / `number` /
- * `string`) a serialized prompt could carry; an empty / non-record / all-dropped payload yields
- * `undefined` (no rules to apply). The client feeds the result back through {@link resolveValidation}.
+ * Sanitize text for one single-line display slot. Composes console's ANSI {@link strip} and C0
+ * {@link stripControls} passes with removal of tab, line feed, and carriage return.
+ *
+ * @param text - The text to sanitize for a glyph or hint slot
+ * @returns The text with ANSI sequences, every C0 control character, and DEL removed
+ *
+ * @example
+ * ```ts
+ * sanitizeDisplayText('Q\rOVERWRITE\nNEXT\tX') // 'QOVERWRITENEXTX'
+ * ```
  */
-export declare function reconstructValidationRules(value: unknown): ValidationRules | undefined;
-
-/** Read a `choices` option as a list of bare strings / full choices — each element narrowed by `guard`, off-shape elements stringified. */
-export declare function resolveChoices<TChoice extends PromptChoice | CheckboxChoice>(options: Readonly<Record<string, unknown>>, guard: Guard<TChoice>): ReadonlyArray<string | TChoice>;
-
-/** Read one option by key, narrowed by `guard` — `undefined` when absent or off-shape (§14, never an `as`). */
-export declare function resolveOption<T>(options: Readonly<Record<string, unknown>>, key: string, guard: Guard<T>): T | undefined;
+export declare function sanitizeDisplayText(text: string): string;
 
 /**
- * Compile a {@link Validator} or declarative {@link ValidationRules} (or nothing) into ONE
- * composed {@link Validator}. A bare validator passes through; rules are appended in the fixed
- * order (required → minimum → maximum → pattern → email → url → numeric → integer → alphanumeric
- * → custom) and composed; absent / empty input yields an always-passing validator. Pure.
+ * Sanitize every terminal-readable string in a parsed form schema.
  *
  * @remarks
- * Unlike a prior variant (which returned `Validator | undefined`), this ALWAYS returns a
- * `Validator` — an absent or empty rule set yields a validator that returns `true` for every
- * input. That keeps a prompt's state unconditional (it always holds a real validator to apply on
- * submit), with no `undefined` branch at the call site.
+ * Display strings pass through {@link sanitizeDisplayText}: labels, help, placeholders, masks,
+ * choice labels and help, file accept entries, and pattern sources. Identity and answer strings
+ * stay verbatim: schema, group, and field names, group references, choice values, and defaults.
+ * Rewriting those would sever the rendering copy from the authoritative form. Field metadata is
+ * removed because terminal neither renders nor interprets it. Pattern sources are sanitized as
+ * text only and are never compiled or executed here.
  *
- * @param validate - A custom {@link Validator}, a {@link ValidationRules} bag, or `undefined`
- * @returns The composed {@link Validator} (always-passing when nothing was supplied)
+ * @param schema - A schema already accepted by the Form package's `parseForm`
+ * @returns A new schema with terminal-readable strings sanitized and field metadata omitted
  *
  * @example
  * ```ts
- * const v = resolveValidation({ required: true, minimum: 3 })
- * v('')    // 'This field is required'
- * v('ab')  // 'Must be at least 3 characters'
- * v('abc') // true
+ * sanitizeSchema({ fields: [{ control: 'text', name: 'na\u001bme', label: 'N\u0000ame' }] })
+ * // { fields: [{ control: 'text', name: 'na\u001bme', label: 'Name' }] }
  * ```
  */
-export declare function resolveValidation(validate?: Validator | ValidationRules): Validator;
-
-/** Carriage return (`\r`, U+000D) — Enter on most terminals. */
-export declare const RETURN: string;
+export declare function sanitizeSchema(schema: FormSchema): FormSchema;
 
 /**
- * Each built-in validation rule's default error message — what the composed {@link
- * import('./types.js').Validator} returns when that rule fails (the `minimum` / `maximum`
- * messages are interpolated with the configured length at build time). Frozen; the source of
- * truth for the rule-failure copy.
- */
-export declare const RULE_MESSAGES: Readonly<{
-    required: "This field is required";
-    minimum: "Must be at least {count} characters";
-    maximum: "Must be at most {count} characters";
-    pattern: "Must match pattern: {pattern}";
-    email: "Must be a valid email address";
-    url: "Must be a valid URL";
-    numeric: "Must be a numeric value";
-    integer: "Must be an integer";
-    alphanumeric: "Must contain only letters and digits";
-    invalid: "Invalid input";
-}>;
-
-/**
- * Sanitize a list of resolved choices' human-readable labels (`name` + `description`) with
- * {@link stripControls} — shared by the `select` and `checkbox` branches of
- * {@link dispatchPendingPrompt} so a remote-supplied choice can never inject raw control bytes
- * into the local terminal's rendered view.
+ * Sanitize every glyph a wire-supplied {@link PromptThemeOptions} carries for a single-line display
+ * slot. Only the icons need it: a role is guard-narrowed to a console {@link Style}, whose colors
+ * and attributes are fixed name sets, so no role can carry a byte a terminal would act on.
  *
- * @param choices - The resolved choices (bare strings or full {@link PromptChoice} /
- *   {@link CheckboxChoice} objects) as returned by {@link resolveChoices}
- * @returns The same choices with every `name` / `description` control-stripped
+ * @param theme - The narrowed theme options a remote prompt supplied
+ * @returns The same theme with every supplied glyph sanitized for a single-line display slot
  */
-export declare function sanitizeChoiceLabels<TChoice extends PromptChoice | CheckboxChoice>(choices: ReadonlyArray<string | TChoice>): ReadonlyArray<string | TChoice>;
-
-/**
- * Options for a single-selection {@link import('./helpers.js').selectReduce} prompt.
- *
- * @remarks
- * `choices` accepts bare strings (used as both `name` and `value`) or full {@link PromptChoice}
- * objects; {@link import('./helpers.js').createSelectState} normalizes them. `default` pre-focuses
- * the choice whose `value` matches it.
- */
-export declare interface SelectOptions {
-    readonly message: string;
-    readonly choices: ReadonlyArray<string | PromptChoice>;
-    readonly default?: string;
-    readonly styler?: StylerInterface;
-}
+export declare function sanitizeThemeIcons(theme: PromptThemeOptions): PromptThemeOptions;
 
 /**
  * Advance a select prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
@@ -1292,26 +1140,10 @@ export declare interface SelectOptions {
  * focused choice's `value`; ctrl-c cancels. An empty choice list can never submit (a higher layer
  * guards against it); any other key is ignored.
  */
-export declare function selectReduce(state: SelectState, key: KeyEvent): PromptStep<string, SelectState>;
+export declare function selectReduce(state: ReturnType<typeof createSelectState>, key: KeyEvent): PromptStep<string, ReturnType<typeof createSelectState>>;
 
-/**
- * The immutable state of a select prompt — the normalized choices, the styler, and the
- * `focused` index (the highlighted row).
- *
- * @remarks
- * Built by {@link import('./helpers.js').createSelectState}; advanced by
- * {@link import('./helpers.js').selectReduce}. `up` / `down` move `focused` (wrapping at the
- * ends); `return` submits the focused choice's `value`.
- */
-export declare interface SelectState {
-    readonly message: string;
-    readonly choices: readonly PromptChoice[];
-    readonly styler: StylerInterface;
-    readonly focused: number;
-}
-
-/** Render a {@link SelectState} as a MULTI-LINE styled view — the header followed by one row per choice, the focused row marked. */
-export declare function selectView(state: SelectState): string;
+/** Render a select-field key state as a multi-line styled view. */
+export declare function selectView(state: ReturnType<typeof createSelectState>): string;
 
 /**
  * The exact escape SEQUENCE → canonical key NAME table {@link import('./helpers.js').parseKey}
@@ -1327,53 +1159,20 @@ export declare function selectView(state: SelectState): string;
  */
 export declare const SEQUENCE_NAMES: Readonly<Record<string, string>>;
 
-/** Strip functions from a `choices` option — each choice keeps its plain fields; a bare string passes through. */
-export declare function serializeChoices(choices: unknown): readonly unknown[];
-
 /** Serialize a parked prompt's expiry into a {@link WireEvent} — event `'expire'`, `data` the JSON-stringified `{ id }` payload. */
 export declare function serializeExpire(id: string): WireEvent;
 
-/** Serialize a parked {@link PendingPrompt} into a {@link WireEvent} — event `'pending'`, `data` the JSON-stringified prompt, `id` the prompt's own id (an SSE bridge sets its frame `id:` from this). */
-export declare function serializePending(prompt: PendingPrompt): WireEvent;
-
-/**
- * Produce the WIRE-SAFE form of a prompt's options — the {@link PendingPrompt.options} a broker
- * serializes over SSE. Drops everything that cannot cross the wire (a `styler`, and any
- * function-valued `validate` rule), while KEEPING the declarative data a remote client needs to
- * reconstruct the prompt: the {@link ValidationRules} as data, plus `message` / `choices` /
- * `default` / `mask` / `min` / `max`. This is WHY T-a's validation is rules-as-data: a `Validator`
- * FUNCTION can't be serialized, but its declarative rules can — the client rebuilds the validator
- * from them via {@link resolveValidation}.
- *
- * @remarks
- * - **Functions are dropped.** A top-level function value (e.g. a bare-`Validator` `validate`) is
- *   omitted entirely; the `styler` (a fluent function-bearing object) is dropped by key.
- * - **`validate` rules are flattened.** A {@link ValidationRules} bag is copied with each
- *   function rule replaced by `true` (the rule's INTENT survives as the built-in check; its
- *   custom function does not). A bare-function `validate` is dropped (no declarative form to keep).
- * - **`choices` are function-stripped.** Each choice keeps its plain fields (`name` / `value` /
- *   `description` / `checked`); a bare string passes through.
- *
- * @param options - The raw prompt options bag (may hold functions / a styler)
- * @returns A JSON-safe options record — only serializable, declarative data
- */
-export declare function serializePromptOptions(options: object): Readonly<Record<string, unknown>>;
+/** Serialize a parked {@link PendingForm} into a {@link WireEvent}. */
+export declare function serializePending(form: PendingForm): WireEvent;
 
 /** The {@link WireEvent} a broker/manager sends when it is going away — event `'shutdown'`, no payload. */
 export declare function serializeShutdown(): WireEvent;
 
-/**
- * Flatten a `validate` option to its wire-safe {@link ValidationRules} DATA — a function rule
- * becomes `true` (its built-in check survives; its body cannot cross the wire). A bare-function
- * `validate` (no rules object) has no declarative form, so it yields `undefined` (dropped).
- */
-export declare function serializeValidationRules(validate: unknown): Readonly<Record<string, unknown>> | undefined;
-
 /** Space (U+0020). */
 export declare const SPACE = " ";
 
 /**
- * The maximum number of characters the {@link import('./types.js').PromptClient} lets its
+ * The maximum number of characters the {@link import('./types.js').PromptClientInterface} lets its
  * SSE parser buffer before treating the stream as hostile — 1 MiB, comfortably above any
  * legitimate prompt payload. Passed as the `limit` to `createSSEParser` so an unterminated
  * or oversized `data:` field cannot grow the buffer without bound (a memory-exhaustion guard).
@@ -1381,11 +1180,11 @@ export declare const SPACE = " ";
 export declare const SSE_BUFFER_LIMIT = 1048576;
 
 /**
- * The SSE `event:` names the broker emits and the {@link import('./types.js').PromptClient}
+ * The SSE `event:` names the broker emits and the {@link import('./types.js').PromptClientInterface}
  * dispatches on. Frozen; the source of truth for the wire event vocabulary.
  *
  * @remarks
- * - `pending` — a serialized {@link import('./types.js').PendingPrompt} to dispatch + answer.
+ * - `pending` — a serialized {@link import('./types.js').PendingForm} to dispatch and answer.
  * - `expire` — an `{ id }` payload: the broker expired a parked prompt (the client drops it).
  * - `shutdown` — the broker is going away; the client disconnects (no auto-reconnect) but stays reusable.
  */
@@ -1395,62 +1194,87 @@ export declare const SSE_EVENTS: Readonly<{
     shutdown: "shutdown";
 }>;
 
-/** The styled submit line (`✔ message`) — the committed header an interactive prompt shows once resolved. */
-export declare function submitHeader(styler: StylerInterface, message: string): string;
+/** The styled submit line (`✔ message`) — the committed header an interactive prompt shows once resolved, themed by the `success` + `message` roles. */
+export declare function submitHeader(styler: StylerInterface, theme: PromptTheme, message: string): string;
 
 /** Tab (`\t`, U+0009). */
 export declare const TAB: string;
 
-/** The rejection reason a {@link TerminalManagerInterface.answer} call returns — an {@link AnswerError}, plus `'terminal'` (no such endpoint). */
-export declare type TerminalAnswerError = AnswerError | 'terminal';
-
-/** The outcome of a {@link TerminalManagerInterface.answer} call — the accepted `value` on success, else the {@link TerminalAnswerError}. */
-export declare type TerminalAnswerResult = {
-    readonly success: true;
-    readonly value: unknown;
-} | {
-    readonly success: false;
-    readonly error: TerminalAnswerError;
+/**
+ * Why a {@link TerminalManagerInterface.answer} call refused — an {@link AnswerError} from the
+ * endpoint's own broker, or `terminal` when no endpoint is mounted under that name. One
+ * discriminant, `reason`, across both.
+ */
+export declare type TerminalAnswerError = AnswerError | {
+    readonly reason: 'terminal';
 };
 
 /**
- * An error a {@link import('./Prompt.js').Prompt} broker rejects a parked prompt's Promise with.
+ * The error the terminal surfaces for its own refusals: parking on a destroyed or full broker, an
+ * unusable driver stream, a manager routing fault, or a ctrl-c cancellation. A parked form's own
+ * lifecycle failures reject through the form's `answer` with the form package's error, never with
+ * this one.
  *
  * @remarks
- * Carries a {@link TerminalErrorCode} and an optional `context` bag (the prompt `id`). Thrown —
- * as a Promise rejection on the awaited prompt call — when a parked prompt is not answered before
- * its `timeout`, or when the broker is `destroy`ed while the prompt is still `pending` (both
- * `EXPIRE`); or when the user aborts an interactive server-`Terminal` prompt with ctrl-c
- * (`CANCEL`). Narrow a caught value with {@link isTerminalError} and branch on `error.code`.
+ * Carries a {@link TerminalErrorCode} and an optional `context` bag naming the offending values:
+ * `{ cap }` on `LIMIT`, `{ to, known }` on `TARGET`, and `{ from, to, path }` on `DEADLOCK`. Narrow
+ * a caught value with {@link isTerminalError} and branch on `error.code`.
  */
 export declare class TerminalError extends Error {
     /** The machine-readable condition — see {@link TerminalErrorCode}. */
     readonly code: TerminalErrorCode;
-    /** An optional context bag naming the offending prompt id. */
+    /** An optional context bag naming the offending values — see the class {@link TerminalError remarks}. */
     readonly context?: Readonly<Record<string, unknown>>;
     constructor(code: TerminalErrorCode, message: string, context?: Readonly<Record<string, unknown>>);
 }
 
 /**
  * The machine-readable condition carried by a {@link import('./errors.js').TerminalError} — the
- * axis a `catch` branches on. Names its axis (the failure condition), never `kind` (AGENTS §4.4).
+ * axis a `catch` branches on. Names its axis (the failure condition), never `kind`.
  *
  * @remarks
- * - `EXPIRE` — a parked broker prompt was not answered before its `timeout` (or the broker was
- *   `destroy`ed while it was still pending); the prompt's Promise rejects with this.
- * - `CANCEL` — the user aborted an interactive prompt (ctrl-c) at the server `Terminal` (T-c)
- *   driver; the awaited prompt call rejects with this so a caller can branch on `error.code`.
- * - `LIMIT` — a broker's optional `cap` on concurrently-parked prompts was already reached; the
- *   new call is rejected WITHOUT parking (never counted, never emitted, no timer armed).
- * - `DESTROYED` — a call reached an already-`destroy`ed {@link TerminalManagerInterface} (`add`
- *   at entry, or `open` whose `store` read resolved after a `destroy` happened in the gap).
+ * Every code here is terminal's own. A refusal that belongs to the form — a malformed schema, a
+ * value a control cannot hold, a write to a settled form — arrives as the dependency's own
+ * `FormError` and is never re-coded.
+ *
+ * - `EXPIRE` — `park` was called on an already-`destroy`ed broker: the given form is destroyed and
+ *   the call throws before minting an id. A parked form that times out is abandoned instead, not
+ *   coded `EXPIRE` — the broker destroys it and the caller's `answer` promise rejects on the
+ *   form's own lifecycle with the Form package's `ABANDONED` error.
+ * - `CANCEL` — the user aborted at the server `Terminal` driver with ctrl-c.
+ * - `DRIVER` — the driver could not read the terminal it was given.
+ * - `DEADLOCK` — an endpoint was asked to answer its own question.
+ * - `TARGET` — the named endpoint cannot be reached.
+ * - `LIMIT` — the broker's optional `cap` on concurrently parked forms was already reached. The
+ *   new call is refused WITHOUT parking: no id, no `pending` event, no timer.
+ * - `DESTROYED` — a call reached an already-destroyed {@link TerminalManagerInterface}.
  */
 export declare type TerminalErrorCode = 'EXPIRE' | 'CANCEL' | 'DRIVER' | 'DEADLOCK' | 'TARGET' | 'LIMIT' | 'DESTROYED';
 
+/**
+ * The contract for asking a form of a human at a keyboard — one method, because a form is one
+ * question however many fields it holds. The server `Terminal` implements it against a real TTY;
+ * a {@link PromptClientInterface} holds one to answer forms parked elsewhere.
+ *
+ * @remarks
+ * `ask` drives the form the caller passes: it walks the schema's fields in order, binds each
+ * keystroke through the form's own `fill`, submits, and returns the settled values. The returned
+ * promise is the form's `answer`, so a caller holding the form can await either one. Ctrl-c at an
+ * interactive driver is the one exception: it rejects THIS promise with a `TerminalError` coded
+ * `CANCEL` and leaves the form `editing`, so the form's own `answer` stays pending for its owner.
+ *
+ * A driver never owns the form's lifetime. To interrupt an active walk, destroy the form: it
+ * abandons, `answer` rejects, and the driver stops rendering on the form's `abandon` event. That
+ * is the only cancellation channel, which is why this contract needs no second method.
+ */
+export declare interface TerminalInterface {
+    ask(form: FormInterface): Promise<FormValues>;
+}
+
 /**
  * The multi-endpoint terminal MANAGER — a registry of named {@link PromptInterface} brokers (one
- * per endpoint), so several parties can `ask` prompts of each other by NAME with a `from` → `to`
- * attribution edge on every parked prompt, and a transitive DEADLOCK check across all in-flight
+ * per endpoint), so several parties can `ask` forms of each other by NAME with a `from` → `to`
+ * attribution edge on every parked form, and a transitive DEADLOCK check across all in-flight
  * asks.
  *
  * @remarks
@@ -1461,22 +1285,23 @@ export declare type TerminalErrorCode = 'EXPIRE' | 'CANCEL' | 'DRIVER' | 'DEADLO
  * - **`ask`.** The target must already be mounted via {@link add} — `ask` never auto-adds it;
  *   rejects `TARGET` for an unknown `to` (listing the known names). Rejects `DEADLOCK` when parking
  *   `from → to` would close a cycle over the CURRENT in-flight edge set (walked transitively);
- *   otherwise parks through the target's broker and resolves with the ORIGINAL ticket Promise (edge
- *   cleanup is attached via `.then`, never altering the value/rejection the caller observes).
+ *   otherwise parks the caller's live form through the target's broker and returns that form's own
+ *   `answer` promise. Edge cleanup never alters the value or rejection the caller observes.
  * - **Durable open / save.** `open(name)` restores an EMPTY broker from the `store` (parked
  *   Promises are process-bound and never resurrected); `save(name)` persists the endpoint's
  *   configured `timeout`.
- * - **Removal.** `remove` drops one endpoint or a batch (§9.2, array overload FIRST), destroying
- *   each broker (which expires every prompt still parked on it). `clear` drops all; `destroy` is
- *   idempotent.
+ * - **Removal.** `remove` drops one endpoint, a batch (§9.2, array overload FIRST), or every
+ *   endpoint when called without an argument. It destroys each broker, which expires every form
+ *   still parked on it. `destroy` is idempotent.
  *
  * @example
  * ```ts
+ * const form = createForm({ fields: [{ control: 'text', name: 'name' }] })
  * const manager = new TerminalManager()
  * manager.add('agent')
- * const name = manager.ask('user', 'agent', 'input', { message: 'Your name' })
- * manager.answer('agent', manager.pending('agent')[0].id, 'Ada')
- * await name // 'Ada'
+ * const answer = manager.ask('user', 'agent', form)
+ * manager.answer('agent', manager.pending('agent')[0].id, { name: 'Ada' })
+ * await answer // { name: 'Ada' }
  * ```
  */
 export declare class TerminalManager implements TerminalManagerInterface {
@@ -1486,91 +1311,83 @@ export declare class TerminalManager implements TerminalManagerInterface {
     get count(): number;
     terminal(name: string): PromptInterface | undefined;
     terminals(): readonly string[];
-    add(name: string, options?: TerminalOptions): PromptInterface;
-    ask(from: string, to: string, form: 'input' | 'password' | 'editor', options: InputOptions | PasswordOptions | EditorOptions): Promise<string>;
-    ask(from: string, to: string, form: 'confirm', options: ConfirmOptions): Promise<boolean>;
-    ask(from: string, to: string, form: 'select', options: SelectOptions): Promise<string>;
-    ask(from: string, to: string, form: 'checkbox', options: CheckboxOptions): Promise<readonly string[]>;
-    pending(): readonly PendingPrompt[];
-    pending(to: string): readonly PendingPrompt[];
-    answer(to: string, id: string, value: unknown): TerminalAnswerResult;
+    add(name: string, options?: PromptOptions): PromptInterface;
+    ask(from: string, to: string, form: FormInterface): Promise<FormValues>;
+    pending(): readonly PendingForm[];
+    pending(to: string): readonly PendingForm[];
+    answer(to: string, id: string, values: FormValues): Result<FormValues, TerminalAnswerError>;
     open(name: string): Promise<PromptInterface | undefined>;
     save(name: string): Promise<boolean>;
     remove(names: readonly string[]): boolean;
     remove(name: string): boolean;
-    clear(): void;
+    remove(): void;
     destroy(): void;
 }
 
 /**
- * The manager's event map (AGENTS §13) — the name-attributed re-emission of every mounted
- * broker's events, so a caller subscribes once for ALL endpoints instead of per-broker.
+ * The manager's event map — the name-attributed re-emission of every mounted broker's events, so a
+ * caller subscribes once for ALL endpoints instead of once per broker.
  *
  * @remarks
- * - `pending` — an endpoint parked a prompt (carries the {@link PendingPrompt}, itself carrying
- *   `from` / `to`).
- * - `answer` — an endpoint's parked prompt was answered (`to` names the endpoint).
- * - `expire` — an endpoint's parked prompt timed out (`to` names the endpoint).
+ * - `pending` — an endpoint parked a form; the record itself carries `from` and `to`.
+ * - `answer` — an endpoint's parked form was answered; `to` names the endpoint.
+ * - `expire` — an endpoint's parked form expired; `to` names the endpoint.
  */
 export declare type TerminalManagerEventMap = {
-    readonly pending: readonly [prompt: PendingPrompt];
-    readonly answer: readonly [to: string, id: string, value: unknown];
+    readonly pending: readonly [form: PendingForm];
+    readonly answer: readonly [to: string, id: string, values: FormValues];
     readonly expire: readonly [to: string, id: string];
 };
 
 /**
- * The multi-endpoint terminal MANAGER (§9.1/§9.2) — a registry of named {@link PromptInterface}
- * brokers (one per endpoint), so several parties (agents, tools, humans) can `ask` prompts of
- * each other by NAME, attributed with a `from` → `to` edge on every parked {@link PendingPrompt}.
+ * The multi-endpoint terminal MANAGER — a registry of named {@link PromptInterface} brokers, one
+ * per endpoint, so several parties (agents, tools, humans) can ask forms of each other BY NAME,
+ * attributed with a `from` → `to` edge on every parked record.
  *
  * @remarks
- * - **Accessors (§9.1).** `terminal(name)` looks up one endpoint's broker; `terminals()` lists
- *   every mounted endpoint name.
- * - **`add`** mints (or returns the existing) broker for `name` — idempotent, never clobbers a
- *   live endpoint.
- * - **`ask`** is the attributed convenience: parks a prompt from `from` to `to` (auto-`add`ing
- *   `to` if absent) and resolves with the typed value, precisely overloaded per {@link PromptType}.
- * - **`pending()`** lists every endpoint's parked prompts; `pending(to)` scopes to one endpoint.
+ * - **Accessors.** `terminal(name)` looks up one endpoint's broker; `terminals()` lists every
+ *   mounted endpoint name.
+ * - **`add`** mints, or returns, the broker for `name`. Idempotent; it never clobbers a live
+ *   endpoint.
+ * - **`ask`** is the attributed convenience: it parks `form` from `from` to `to`, adding `to` if it
+ *   is absent, and resolves with the settled values.
+ * - **`pending()`** lists every endpoint's parked records; `pending(to)` scopes to one endpoint.
  * - **`answer`** routes to the named endpoint's broker.
- * - **`open`** restores (or returns the live) broker for `name` from the `store`.
- * - **`save`** persists an endpoint's config snapshot to the `store` (`false` when there is no
- *   store, or `name` is unknown).
- * - **Batch `remove` (§9.2).** The array overload is declared FIRST — `remove(names)` removes each
- *   listed endpoint (`true` when any of the named terminals was removed); `remove(name)` removes one.
- * - **`clear`** removes every endpoint without destroying the manager; **`destroy`** tears down
- *   every broker, then the manager's own emitter.
+ * - **`open`** restores, or returns the live, broker for `name` from the `store`.
+ * - **`save`** persists an endpoint's config snapshot; false when there is no store, or `name` is
+ *   unknown.
+ * - **Batch `remove`.** The array overload is declared FIRST: `remove(names)` removes each listed
+ *   endpoint and reports whether any named terminal was removed; `remove(name)` removes one;
+ *   `remove()` removes every endpoint without destroying the manager.
+ * - **`destroy`** tears down every broker, then the manager's own emitter.
  */
 export declare interface TerminalManagerInterface {
     readonly emitter: EmitterInterface<TerminalManagerEventMap>;
     readonly count: number;
     terminal(name: string): PromptInterface | undefined;
     terminals(): readonly string[];
-    add(name: string, options?: TerminalOptions): PromptInterface;
-    ask(from: string, to: string, form: 'input' | 'password' | 'editor', options: InputOptions | PasswordOptions | EditorOptions): Promise<string>;
-    ask(from: string, to: string, form: 'confirm', options: ConfirmOptions): Promise<boolean>;
-    ask(from: string, to: string, form: 'select', options: SelectOptions): Promise<string>;
-    ask(from: string, to: string, form: 'checkbox', options: CheckboxOptions): Promise<readonly string[]>;
-    pending(): readonly PendingPrompt[];
-    pending(to: string): readonly PendingPrompt[];
-    answer(to: string, id: string, value: unknown): TerminalAnswerResult;
+    add(name: string, options?: PromptOptions): PromptInterface;
+    ask(from: string, to: string, form: FormInterface): Promise<FormValues>;
+    pending(): readonly PendingForm[];
+    pending(to: string): readonly PendingForm[];
+    answer(to: string, id: string, values: FormValues): Result<FormValues, TerminalAnswerError>;
     open(name: string): Promise<PromptInterface | undefined>;
     save(name: string): Promise<boolean>;
     remove(names: readonly string[]): boolean;
     remove(name: string): boolean;
-    clear(): void;
+    remove(): void;
     destroy(): void;
 }
 
 /**
- * Options for {@link import('./factories.js').createTerminalManager} / the
+ * Options for {@link import('./factories.js').createTerminalManager} and the
  * {@link TerminalManagerInterface}.
  *
  * @remarks
- * - `store` — the optional {@link TerminalStoreInterface} backing `open` / `save`.
- * - `timeout` / `timer` / `cap` — the manager-wide default for each endpoint's broker (overridable
- *   per {@link TerminalManagerInterface.add} call via {@link TerminalOptions}, exactly like
- *   `timeout` / `timer`).
- * - `on` / `error` — the manager's {@link EmitterHooks} + {@link EmitterErrorHandler} (AGENTS §13).
+ * - `store` — the optional {@link TerminalStoreInterface} backing `open` and `save`.
+ * - `timeout` / `timer` / `cap` — the manager-wide default for each endpoint's broker, overridable
+ *   per {@link TerminalManagerInterface.add} call.
+ * - `on` / `error` — the manager's own emitter hooks and listener-error handler.
  */
 export declare interface TerminalManagerOptions {
     readonly store?: TerminalStoreInterface;
@@ -1581,28 +1398,29 @@ export declare interface TerminalManagerOptions {
     readonly error?: EmitterErrorHandler;
 }
 
-/** Options for {@link import('./factories.js').createTerminal} / a manager-owned {@link PromptInterface} broker — the per-endpoint `timeout` + injected `timer` + optional `cap` on concurrently-parked prompts. */
-export declare interface TerminalOptions {
-    readonly timeout?: number;
-    readonly timer?: TimerHandler_2;
-    readonly cap?: number;
-}
-
-/** One endpoint's persisted CONFIG snapshot — `id` is the endpoint name; `timeout` its configured default. Parked Promises are process-bound and are never resurrected — `open` always restores an EMPTY broker. */
+/**
+ * One endpoint's persisted CONFIG snapshot — `id` is the endpoint name and `timeout` its configured
+ * default. Parked forms are process-bound and are never resurrected, so `open` always restores an
+ * EMPTY broker.
+ */
 export declare interface TerminalSnapshot {
     readonly id: string;
     readonly timeout?: number;
 }
 
-/** One opaque persisted row — the shape a `TableInterface<TerminalSnapshotRow>`-backed store reads/writes; `snapshot` is narrowed with {@link import('./validators.js').isTerminalSnapshot} on read. */
+/**
+ * One opaque persisted row — the shape a `TableInterface<TerminalSnapshotRow>`-backed store reads
+ * and writes. `snapshot` is narrowed with {@link import('./validators.js').isTerminalSnapshot} on
+ * read.
+ */
 export declare interface TerminalSnapshotRow {
     readonly id: string;
     readonly snapshot: unknown;
 }
 
 /**
- * The point-access persistence seam (AGENTS §5 — Stores) for a {@link TerminalManagerInterface}'s
- * endpoint configs. Every primitive is async; `delete` of an absent id is a no-op.
+ * The point-access persistence seam for a {@link TerminalManagerInterface}'s endpoint configs.
+ * Every primitive is async; deleting an absent id is a no-op.
  */
 export declare interface TerminalStoreInterface {
     get(id: string): Promise<TerminalSnapshot | undefined>;
@@ -1610,20 +1428,14 @@ export declare interface TerminalStoreInterface {
     delete(id: string): Promise<void>;
 }
 
-/** The handle {@link PromptInterface.park} returns — the parked prompt's `id` plus the Promise that resolves (or rejects) with its {@link PromptValue}. */
-export declare interface Ticket {
-    readonly id: string;
-    readonly value: Promise<PromptValue>;
-}
-
 /** Cancel a pending {@link TimerHandler} deadline — idempotent, safe to call after the timer fired. */
 export declare type TimerCancel = () => void;
 
 /**
  * One injected timer — arms a deadline `callback` to fire after `ms`, returning a
  * {@link TimerCancel} that cancels it. The broker's timeout seam: the default wraps the host
- * `setTimeout` / `clearTimeout`; a test injects a deterministic timer that captures the callback
- * and fires it on demand (no real time, no global fake-timer patching).
+ * `setTimeout` and `clearTimeout`; a test injects a deterministic timer that captures the callback
+ * and fires it on demand, with no real time and no global patching.
  */
 declare type TimerHandler_2 = (callback: () => void, ms: number) => TimerCancel;
 export { TimerHandler_2 as TimerHandler }
@@ -1631,59 +1443,12 @@ export { TimerHandler_2 as TimerHandler }
 /** Toggle `index` in a readonly index list — copy-on-write, returning the new sorted-by-insertion list. */
 export declare function toggleIndex(indices: readonly number[], index: number): readonly number[];
 
-/** Matches an HTTP(S) URL. The `url` rule tests against this. */
-export declare const URL_PATTERN: RegExp;
-
 /**
- * Declarative validation rules for a text prompt — each key toggles (or overrides) one
- * built-in check. {@link import('./helpers.js').resolveValidation} compiles a `ValidationRules`
- * (or a bare {@link Validator}) into ONE composed {@link Validator}.
- *
- * @remarks
- * Each rule is EITHER a primitive that turns on the built-in check, OR a {@link Validator}
- * that replaces it with custom logic:
- *
- * - `required` — `true` ⇒ input must be non-empty after trimming.
- * - `minimum` — a number ⇒ input must be at least that many characters.
- * - `maximum` — a number ⇒ input must be at most that many characters.
- * - `pattern` — a string ⇒ input must match that regex source.
- * - `email` — `true` ⇒ input must look like an email address.
- * - `url` — `true` ⇒ input must look like an HTTP(S) URL.
- * - `numeric` — `true` ⇒ input must be a number (integer or decimal).
- * - `integer` — `true` ⇒ input must be an integer.
- * - `alphanumeric` — `true` ⇒ input must contain only letters and digits.
- * - `custom` — an arbitrary {@link Validator} escape hatch.
- *
- * Rules compose in the fixed order above; the FIRST failing rule short-circuits and its
- * message is returned. A `false` / `undefined` rule is skipped.
- */
-export declare interface ValidationRules {
-    readonly required?: boolean | Validator;
-    readonly minimum?: number | Validator;
-    readonly maximum?: number | Validator;
-    readonly pattern?: string | Validator;
-    readonly email?: boolean | Validator;
-    readonly url?: boolean | Validator;
-    readonly numeric?: boolean | Validator;
-    readonly integer?: boolean | Validator;
-    readonly alphanumeric?: boolean | Validator;
-    readonly custom?: Validator;
-}
-
-/**
- * A single input validator — given the current input string, returns `true` when the input
- * is valid, or an error MESSAGE string when it is not. The atomic unit the validation engine
- * composes and the prompts apply on submit.
- *
- * @remarks
- * A `Validator` is total and pure — it never throws and never mutates. The `true | string`
- * shape (not `boolean`) is deliberate: an invalid result CARRIES its message, so a prompt
- * can render the exact reason. {@link import('./helpers.js').composeValidators} runs several
- * in order and returns the FIRST error (short-circuiting), so the most specific rule wins.
+ * One SSE-shaped wire frame — the `event` name, its already-stringified `data` payload, and an
+ * optional `id`. The transport-neutral shape {@link import('./helpers.js').serializePending},
+ * {@link import('./helpers.js').serializeExpire}, and
+ * {@link import('./helpers.js').serializeShutdown} build, with no `http` dependency.
  */
-export declare type Validator = (input: string) => true | string;
-
-/** One SSE-shaped wire frame — the `event` name, its `data` payload (already JSON-stringified), and an optional `id`. The transport-neutral shape {@link import('./helpers.js').serializePending} / {@link import('./helpers.js').serializeExpire} / {@link import('./helpers.js').serializeShutdown} build, with no `http` dependency. */
 export declare interface WireEvent {
     readonly event: string;
     readonly data: string;