@orkestrel/terminal 0.0.7 → 0.0.9

package/dist/src/core/index.js

@@ -1,6 +1,7 @@
-import { isArray, isBoolean, isNonEmptyString, isNumber, isRecord, isString, literalOf, rawShape, recordOf, stringShape } from "@orkestrel/contract";
-import { STATUS_ICONS, createStyler, stripControls } from "@orkestrel/console";
+import { STATUS_ICONS, createStyler, freezeStyle, strip, stripControls } from "@orkestrel/console";
+import { arrayOf, attempt, isArray, isBoolean, isNonEmptyString, isNumber, isRecord, isString, literalOf, parseJSON, rawShape, recordOf, stringShape } from "@orkestrel/contract";
 import { Emitter } from "@orkestrel/emitter";
+import { createForm, isFieldError, isFormError, parseForm, serializeForm } from "@orkestrel/form";
 import { createSSEParser } from "@orkestrel/sse";
 import { createDatabase, createMemoryDriver } from "@orkestrel/database";
 //#region src/core/constants.ts
@@ -127,42 +128,11 @@ var CONTROL_NAMES = Object.freeze({
 		ctrl: true
 	})
 });
-/** The default mask glyph a {@link import('./types.js').PasswordState} renders each input character as — `*`. */
+/** The default mask glyph {@link import('./helpers.js').createPasswordState} uses — `*`. */
 var DEFAULT_MASK = "*";
-/** Matches an email address — a non-trivial `local@domain.tld` shape. The `email` rule tests against this. */
-var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-/** Matches an HTTP(S) URL. The `url` rule tests against this. */
-var URL_PATTERN = /^https?:\/\/.+/;
-/** Matches a numeric value (integer or decimal, optional sign). The `numeric` rule tests against this. */
-var NUMERIC_PATTERN = /^-?\d+(\.\d+)?$/;
-/** Matches an integer (optional sign). The `integer` rule tests against this. */
-var INTEGER_PATTERN = /^-?\d+$/;
-/** Matches an alphanumeric string (letters and digits only). The `alphanumeric` rule tests against this. */
-var ALPHANUMERIC_PATTERN = /^[a-zA-Z0-9]+$/;
 /**
-* Each built-in validation rule's default error message — what the composed {@link
-* import('./types.js').Validator} returns when that rule fails (the `minimum` / `maximum`
-* messages are interpolated with the configured length at build time). Frozen; the source of
-* truth for the rule-failure copy.
-*/
-var RULE_MESSAGES = Object.freeze({
-	required: "This field is required",
-	minimum: "Must be at least {count} characters",
-	maximum: "Must be at most {count} characters",
-	pattern: "Must match pattern: {pattern}",
-	email: "Must be a valid email address",
-	url: "Must be a valid URL",
-	numeric: "Must be a numeric value",
-	integer: "Must be an integer",
-	alphanumeric: "Must contain only letters and digits",
-	invalid: "Invalid input"
-});
-/**
-* The prompt-view icon glyphs the reducers render the prompt line and choice rows with. PLAIN
-* glyphs — color is applied by the {@link import('./types.js').PromptState}'s
-* {@link import('@orkestrel/console').StylerInterface} at render time, never baked into the
-* constant (AGENTS — styling orthogonal to data; the rework fixes the terminal's ANSI-in-the-icon).
-* Frozen.
+* The six default glyphs {@link DEFAULT_PROMPT_THEME} assembles its `icons` from. Read only when
+* the default theme is assembled; a view reads its resolved theme and never this constant. Frozen.
 *
 * @remarks
 * - `question` — the leading mark on a prompt's message line.
@@ -178,16 +148,89 @@ var PROMPT_ICONS = Object.freeze({
 	checked: "☑",
 	unchecked: "☐"
 });
+/**
+* Every {@link import('./types.js').PromptRole}, in one frozen list — the role axis's source of
+* truth. {@link import('./helpers.js').createPromptTheme} walks it to merge a partial theme, and
+* a consumer building a complete role map reads it rather than retyping every name.
+*/
+var PROMPT_ROLES = Object.freeze([
+	"question",
+	"pointer",
+	"message",
+	"content",
+	"success",
+	"error",
+	"selected",
+	"focus",
+	"hint",
+	"muted",
+	"description"
+]);
+/**
+* The {@link import('./types.js').PromptTheme} every prompt renders with unless its options supply
+* another — the glyph set assembled from {@link PROMPT_ICONS} plus the console
+* {@link import('@orkestrel/console').STATUS_ICONS} `success` / `error` marks, and the console
+* {@link import('@orkestrel/console').Style} each role is painted with. Deeply frozen through the
+* console module's own {@link import('@orkestrel/console').freezeStyle}; the baseline
+* {@link import('./helpers.js').createPromptTheme} merges a partial theme over.
+*
+* @remarks
+* The default roles reproduce the views' historical coloring exactly: `question` / `pointer` cyan,
+* `message` / `focus` bold, `success` / `selected` green, `error` red, `hint` / `muted` /
+* `description` dim, and `content` the EMPTY style — an empty style renders bare text, so primary
+* content keeps the bytes it had before it became themeable.
+* Two roles sharing a style today are still two roles — re-mapping one leaves the other alone.
+*/
+var DEFAULT_PROMPT_THEME = Object.freeze({
+	icons: Object.freeze({
+		question: PROMPT_ICONS.question,
+		pointer: PROMPT_ICONS.pointer,
+		dot: PROMPT_ICONS.dot,
+		selected: PROMPT_ICONS.selected,
+		checked: PROMPT_ICONS.checked,
+		unchecked: PROMPT_ICONS.unchecked,
+		success: STATUS_ICONS.success,
+		error: STATUS_ICONS.error
+	}),
+	roles: Object.freeze({
+		question: freezeStyle({
+			foreground: "cyan",
+			attributes: []
+		}),
+		pointer: freezeStyle({
+			foreground: "cyan",
+			attributes: []
+		}),
+		message: freezeStyle({ attributes: ["bold"] }),
+		content: freezeStyle({ attributes: [] }),
+		success: freezeStyle({
+			foreground: "green",
+			attributes: []
+		}),
+		error: freezeStyle({
+			foreground: "red",
+			attributes: []
+		}),
+		selected: freezeStyle({
+			foreground: "green",
+			attributes: []
+		}),
+		focus: freezeStyle({ attributes: ["bold"] }),
+		hint: freezeStyle({ attributes: ["dim"] }),
+		muted: freezeStyle({ attributes: ["dim"] }),
+		description: freezeStyle({ attributes: ["dim"] })
+	})
+});
 /** How long (ms) the {@link import('./types.js').PromptInterface} broker parks an unanswered prompt before it expires — 5 minutes. */
 var DEFAULT_PROMPT_TIMEOUT_MS = 3e5;
 /** How long (ms) the {@link import('./types.js').PromptClientInterface} waits before each reconnect attempt — 2 seconds. */
 var DEFAULT_RECONNECT_DELAY_MS = 2e3;
 /**
-* The SSE `event:` names the broker emits and the {@link import('./types.js').PromptClient}
+* The SSE `event:` names the broker emits and the {@link import('./types.js').PromptClientInterface}
 * dispatches on. Frozen; the source of truth for the wire event vocabulary.
 *
 * @remarks
-* - `pending` — a serialized {@link import('./types.js').PendingPrompt} to dispatch + answer.
+* - `pending` — a serialized {@link import('./types.js').PendingForm} to dispatch and answer.
 * - `expire` — an `{ id }` payload: the broker expired a parked prompt (the client drops it).
 * - `shutdown` — the broker is going away; the client disconnects (no auto-reconnect) but stays reusable.
 */
@@ -196,12 +239,12 @@ var SSE_EVENTS = Object.freeze({
 	expire: "expire",
 	shutdown: "shutdown"
 });
-/** The auth-token request header the {@link import('./types.js').PromptClient} sends when a `token` is configured. */
+/** The auth-token request header the {@link import('./types.js').PromptClientInterface} sends. */
 var HEADER_TOKEN = "x-orkestrel-token";
 /** The `Accept` header value that opens the broker's SSE stream. */
 var ACCEPT_EVENT_STREAM = "text/event-stream";
 /**
-* The maximum number of characters the {@link import('./types.js').PromptClient} lets its
+* The maximum number of characters the {@link import('./types.js').PromptClientInterface} lets its
 * SSE parser buffer before treating the stream as hostile — 1 MiB, comfortably above any
 * legitimate prompt payload. Passed as the `limit` to `createSSEParser` so an unterminated
 * or oversized `data:` field cannot grow the buffer without bound (a memory-exhaustion guard).
@@ -210,19 +253,20 @@ var SSE_BUFFER_LIMIT = 1048576;
 //#endregion
 //#region src/core/errors.ts
 /**
-* An error a {@link import('./Prompt.js').Prompt} broker rejects a parked prompt's Promise with.
+* The error the terminal surfaces for its own refusals: parking on a destroyed or full broker, an
+* unusable driver stream, a manager routing fault, or a ctrl-c cancellation. A parked form's own
+* lifecycle failures reject through the form's `answer` with the form package's error, never with
+* this one.
 *
 * @remarks
-* Carries a {@link TerminalErrorCode} and an optional `context` bag (the prompt `id`). Thrown —
-* as a Promise rejection on the awaited prompt call — when a parked prompt is not answered before
-* its `timeout`, or when the broker is `destroy`ed while the prompt is still `pending` (both
-* `EXPIRE`); or when the user aborts an interactive server-`Terminal` prompt with ctrl-c
-* (`CANCEL`). Narrow a caught value with {@link isTerminalError} and branch on `error.code`.
+* Carries a {@link TerminalErrorCode} and an optional `context` bag naming the offending values:
+* `{ cap }` on `LIMIT`, `{ to, known }` on `TARGET`, and `{ from, to, path }` on `DEADLOCK`. Narrow
+* a caught value with {@link isTerminalError} and branch on `error.code`.
 */
 var TerminalError = class extends Error {
 	/** The machine-readable condition — see {@link TerminalErrorCode}. */
 	code;
-	/** An optional context bag naming the offending prompt id. */
+	/** An optional context bag naming the offending values — see the class {@link TerminalError remarks}. */
 	context;
 	constructor(code, message, context) {
 		super(message);
@@ -240,9 +284,11 @@ var TerminalError = class extends Error {
 * @example
 * ```ts
 * try {
-* 	const name = await prompt.input({ message: 'Your name' })
+* 	await terminal.ask(form)
 * } catch (error) {
-* 	if (isTerminalError(error) && error.code === 'EXPIRE') retryLater()
+* 	if (isTerminalError(error) && error.code === 'CANCEL') {
+* 		// the person aborted
+* 	}
 * }
 * ```
 */
@@ -251,26 +297,39 @@ function isTerminalError(value) {
 }
 //#endregion
 //#region src/core/validators.ts
-/** Narrow an unknown value to a {@link PromptType} — one of the six prompt forms. */
-var isPromptType = literalOf("input", "password", "confirm", "select", "checkbox", "editor");
-/** Narrow an unknown value to a {@link PendingPromptStatus}. */
-var isPendingPromptStatus = literalOf("pending", "answered", "expired");
+/** Narrow an unknown value to a {@link PendingFormStatus}. */
+var isPendingFormStatus = literalOf("pending", "answered", "expired");
 /**
-* Narrow an unknown wire value to a {@link PendingPrompt} before dispatching it.
+* Narrow an unknown wire value to a {@link PendingForm} envelope.
+*
+* @remarks
+* This guard checks the transport record and proves only that `schema` is a record. The Form
+* package's `parseForm` owns the schema payload and its semantic audit.
 *
 * @param value - The decoded wire value to inspect
-* @returns Whether `value` is a complete pending-prompt record
+* @returns Whether the value is a complete pending-form envelope
 */
-var isPendingPrompt = recordOf({
-	id: isNonEmptyString,
-	form: isPromptType,
-	message: isString,
-	options: isRecord,
-	status: isPendingPromptStatus,
-	time: isNumber,
-	from: isString,
-	to: isString
-}, ["from", "to"]);
+function isPendingForm(value) {
+	return recordOf({
+		id: isNonEmptyString,
+		schema: isRecord,
+		status: isPendingFormStatus,
+		time: isNumber,
+		from: isString,
+		to: isString
+	}, ["from", "to"])(value);
+}
+/**
+* Narrow an unknown value to a transport-neutral {@link WireEvent}.
+*
+* @param value - The candidate wire event
+* @returns Whether the value carries an event name, serialized data, and an optional id
+*/
+var isWireEvent = recordOf({
+	event: isString,
+	data: isString,
+	id: isString
+}, ["id"]);
 /** Narrow an unknown value to a {@link TerminalSnapshot}. */
 var isTerminalSnapshot = recordOf({
 	id: isNonEmptyString,
@@ -351,188 +410,246 @@ function isPrintable(character) {
 	return code >= 32 && code !== 127;
 }
 /**
-* Evaluate ONE built-in validation rule against `input`, returning its error message when the
-* rule fails or `undefined` when it passes. The atomic check {@link buildRuleValidator} wraps
-* into a {@link Validator}. Pure.
+* Build a complete {@link PromptTheme} by merging a partial one over
+* {@link DEFAULT_PROMPT_THEME}, leaf by leaf — each supplied icon replaces that glyph, each
+* supplied role replaces that {@link Style}, and everything else keeps its default. Each supplied
+* style is snapshotted through the console module's own
+* {@link import('@orkestrel/console').freezeStyle}, so the result is deeply frozen and a caller
+* mutating its own attribute list afterwards cannot reach into a built theme.
 *
-* @remarks
-* A function `check` is the custom-override path: it is called and its `true` ⇒ pass, a string
-* ⇒ that message, anything else ⇒ the generic {@link RULE_MESSAGES.invalid}. A primitive `check`
-* runs the named built-in: `required` (non-empty trimmed), `minimum` / `maximum` (length
-* bounds, the message interpolated with the count), `pattern` (a regex source), and the
-* `email` / `url` / `numeric` / `integer` / `alphanumeric` pattern tests.
-*
-* @param rule - The rule name (`'required'`, `'minimum'`, …)
-* @param check - The configured value (a primitive toggle / bound / pattern, or a custom {@link Validator})
-* @param input - The input string to test
-* @returns The error message when the rule fails, else `undefined`
-*/
-function evaluateRule(rule, check, input) {
-	if (typeof check === "function") {
-		const result = check(input);
-		if (result === true) return void 0;
-		return isString(result) ? result : RULE_MESSAGES.invalid;
-	}
-	switch (rule) {
-		case "required":
-			if (check === true && input.trim().length === 0) return RULE_MESSAGES.required;
-			break;
-		case "minimum":
-			if (isNumber(check) && [...input].length < check) return RULE_MESSAGES.minimum.replace("{count}", String(check));
-			break;
-		case "maximum":
-			if (isNumber(check) && [...input].length > check) return RULE_MESSAGES.maximum.replace("{count}", String(check));
-			break;
-		case "pattern":
-			if (isString(check)) {
-				let compiled;
-				try {
-					compiled = new RegExp(check);
-				} catch {
-					return RULE_MESSAGES.pattern.replace("{pattern}", check);
-				}
-				if (!compiled.test(input)) return RULE_MESSAGES.pattern.replace("{pattern}", check);
-			}
-			break;
-		case "email":
-			if (check === true && !EMAIL_PATTERN.test(input)) return RULE_MESSAGES.email;
-			break;
-		case "url":
-			if (check === true && !URL_PATTERN.test(input)) return RULE_MESSAGES.url;
-			break;
-		case "numeric":
-			if (check === true && !NUMERIC_PATTERN.test(input)) return RULE_MESSAGES.numeric;
-			break;
-		case "integer":
-			if (check === true && !INTEGER_PATTERN.test(input)) return RULE_MESSAGES.integer;
-			break;
-		case "alphanumeric":
-			if (check === true && !ALPHANUMERIC_PATTERN.test(input)) return RULE_MESSAGES.alphanumeric;
-			break;
-	}
-}
-/** Wrap a named rule + its primitive check into a {@link Validator} (returns `true` or the rule's message). */
-function buildRuleValidator(rule, check) {
-	return (input) => evaluateRule(rule, check, input) ?? true;
-}
-/**
-* Append a rule-backed {@link Validator} to `validators` when the rule is enabled — a `false` /
-* `undefined` `check` is skipped, a function `check` is added verbatim (the custom override), and
-* a primitive `check` is wrapped via {@link buildRuleValidator}. Mutates `validators` in place.
+* @param options - The partial theme to merge, or `undefined` for the defaults
+* @returns The resolved, deeply frozen theme every prompt state carries
+*
+* @example
+* ```ts
+* createPromptTheme() // the defaults
+* createPromptTheme({
+* 	icons: { pointer: '=>' },
+* 	roles: { message: { foreground: 'magenta', attributes: ['bold'] } },
+* })
+* ```
 */
-function appendRule(validators, rule, check) {
-	if (check === void 0 || check === false) return;
-	if (typeof check === "function") {
-		validators.push(check);
-		return;
-	}
-	validators.push(buildRuleValidator(rule, check));
+function createPromptTheme(options) {
+	const icons = {
+		...DEFAULT_PROMPT_THEME.icons,
+		...options?.icons
+	};
+	const roles = { ...DEFAULT_PROMPT_THEME.roles };
+	for (const role of PROMPT_ROLES) {
+		const style = options?.roles?.[role];
+		if (style !== void 0) roles[role] = freezeStyle(style);
+	}
+	return Object.freeze({
+		icons: Object.freeze(icons),
+		roles: Object.freeze(roles)
+	});
 }
 /**
-* Compose several {@link Validator}s into ONE short-circuiting validator — it runs them in order
-* and returns the FIRST error message, or `true` when all pass. The empty composition always
-* passes.
+* Sanitize text for one single-line display slot. Composes console's ANSI {@link strip} and C0
+* {@link stripControls} passes with removal of tab, line feed, and carriage return.
+*
+* @param text - The text to sanitize for a glyph or hint slot
+* @returns The text with ANSI sequences, every C0 control character, and DEL removed
+*
+* @example
+* ```ts
+* sanitizeDisplayText('Q\rOVERWRITE\nNEXT\tX') // 'QOVERWRITENEXTX'
+* ```
 */
-function composeValidators(...validators) {
-	return (input) => {
-		for (const validator of validators) {
-			const result = validator(input);
-			if (result !== true) return result;
-		}
-		return true;
-	};
+function sanitizeDisplayText(text) {
+	return stripControls(strip(text)).replaceAll("	", "").replaceAll("\n", "").replaceAll("\r", "");
 }
 /**
-* Compile a {@link Validator} or declarative {@link ValidationRules} (or nothing) into ONE
-* composed {@link Validator}. A bare validator passes through; rules are appended in the fixed
-* order (required → minimum → maximum → pattern → email → url → numeric → integer → alphanumeric
-* → custom) and composed; absent / empty input yields an always-passing validator. Pure.
+* Sanitize every terminal-readable string in a parsed form schema.
 *
 * @remarks
-* Unlike a prior variant (which returned `Validator | undefined`), this ALWAYS returns a
-* `Validator` — an absent or empty rule set yields a validator that returns `true` for every
-* input. That keeps a prompt's state unconditional (it always holds a real validator to apply on
-* submit), with no `undefined` branch at the call site.
+* Display strings pass through {@link sanitizeDisplayText}: labels, help, placeholders, masks,
+* choice labels and help, file accept entries, and pattern sources. Identity and answer strings
+* stay verbatim: schema, group, and field names, group references, choice values, and defaults.
+* Rewriting those would sever the rendering copy from the authoritative form. Field metadata is
+* removed because terminal neither renders nor interprets it. Pattern sources are sanitized as
+* text only and are never compiled or executed here.
 *
-* @param validate - A custom {@link Validator}, a {@link ValidationRules} bag, or `undefined`
-* @returns The composed {@link Validator} (always-passing when nothing was supplied)
+* @param schema - A schema already accepted by the Form package's `parseForm`
+* @returns A new schema with terminal-readable strings sanitized and field metadata omitted
 *
 * @example
 * ```ts
-* const v = resolveValidation({ required: true, minimum: 3 })
-* v('')    // 'This field is required'
-* v('ab')  // 'Must be at least 3 characters'
-* v('abc') // true
+* sanitizeSchema({ fields: [{ control: 'text', name: 'na\u001bme', label: 'N\u0000ame' }] })
+* // { fields: [{ control: 'text', name: 'na\u001bme', label: 'Name' }] }
 * ```
 */
-function resolveValidation(validate) {
-	if (validate === void 0) return passing;
-	if (typeof validate === "function") return validate;
-	const validators = [];
-	appendRule(validators, "required", validate.required);
-	appendRule(validators, "minimum", validate.minimum);
-	appendRule(validators, "maximum", validate.maximum);
-	appendRule(validators, "pattern", validate.pattern);
-	appendRule(validators, "email", validate.email);
-	appendRule(validators, "url", validate.url);
-	appendRule(validators, "numeric", validate.numeric);
-	appendRule(validators, "integer", validate.integer);
-	appendRule(validators, "alphanumeric", validate.alphanumeric);
-	if (typeof validate.custom === "function") validators.push(validate.custom);
-	if (validators.length === 0) return passing;
-	return composeValidators(...validators);
-}
-/** The always-passing {@link Validator} — the resolved validator when no rules were supplied. */
-function passing(_input) {
-	return true;
+function sanitizeSchema(schema) {
+	const groups = schema.groups?.map((group) => ({
+		name: group.name,
+		label: sanitizeDisplayText(group.label),
+		...group.help !== void 0 ? { help: sanitizeDisplayText(group.help) } : {}
+	}));
+	const fields = [];
+	for (const source of schema.fields) {
+		const { meta: _meta, ...field } = source;
+		const rule = field.rule === void 0 ? void 0 : {
+			...field.rule,
+			...field.rule.pattern !== void 0 ? { pattern: sanitizeDisplayText(field.rule.pattern) } : {}
+		};
+		const shared = {
+			name: field.name,
+			...field.label !== void 0 ? { label: sanitizeDisplayText(field.label) } : {},
+			...field.help !== void 0 ? { help: sanitizeDisplayText(field.help) } : {},
+			...field.group !== void 0 ? { group: field.group } : {},
+			...rule !== void 0 ? { rule } : {}
+		};
+		switch (field.control) {
+			case "text":
+			case "editor":
+				fields.push({
+					...field,
+					...shared,
+					...field.placeholder !== void 0 ? { placeholder: sanitizeDisplayText(field.placeholder) } : {}
+				});
+				break;
+			case "password":
+				fields.push({
+					...field,
+					...shared,
+					...field.mask !== void 0 ? { mask: sanitizeDisplayText(field.mask) } : {}
+				});
+				break;
+			case "number":
+				fields.push({
+					...field,
+					...shared,
+					...field.placeholder !== void 0 ? { placeholder: sanitizeDisplayText(field.placeholder) } : {}
+				});
+				break;
+			case "date":
+			case "time":
+			case "datetime":
+			case "color":
+				fields.push({
+					...field,
+					...shared
+				});
+				break;
+			case "confirm":
+				fields.push({
+					...field,
+					...shared
+				});
+				break;
+			case "select":
+				fields.push({
+					...field,
+					...shared,
+					choices: field.choices.map((choice) => ({
+						...choice,
+						value: choice.value,
+						label: sanitizeDisplayText(choice.label),
+						...choice.help !== void 0 ? { help: sanitizeDisplayText(choice.help) } : {}
+					}))
+				});
+				break;
+			case "checkbox":
+				fields.push({
+					...field,
+					...shared,
+					choices: field.choices.map((choice) => ({
+						...choice,
+						value: choice.value,
+						label: sanitizeDisplayText(choice.label),
+						...choice.help !== void 0 ? { help: sanitizeDisplayText(choice.help) } : {}
+					}))
+				});
+				break;
+			case "file":
+				fields.push({
+					...field,
+					...shared,
+					...field.accept !== void 0 ? { accept: field.accept.map(sanitizeDisplayText) } : {}
+				});
+				break;
+		}
+	}
+	return {
+		...schema.name !== void 0 ? { name: schema.name } : {},
+		...schema.label !== void 0 ? { label: sanitizeDisplayText(schema.label) } : {},
+		...schema.help !== void 0 ? { help: sanitizeDisplayText(schema.help) } : {},
+		...groups !== void 0 ? { groups } : {},
+		fields
+	};
 }
-/** Normalize a select choice input into a full {@link PromptChoice} (a bare string becomes both name and value). */
-function normalizeChoice(choice) {
-	return isString(choice) ? {
-		name: choice,
-		value: choice
-	} : choice;
+/**
+* Sanitize every glyph a wire-supplied {@link PromptThemeOptions} carries for a single-line display
+* slot. Only the icons need it: a role is guard-narrowed to a console {@link Style}, whose colors
+* and attributes are fixed name sets, so no role can carry a byte a terminal would act on.
+*
+* @param theme - The narrowed theme options a remote prompt supplied
+* @returns The same theme with every supplied glyph sanitized for a single-line display slot
+*/
+function sanitizeThemeIcons(theme) {
+	const icons = theme.icons;
+	if (icons === void 0) return theme;
+	const sanitized = {};
+	for (const [icon, glyph] of Object.entries(icons)) sanitized[icon] = sanitizeDisplayText(glyph);
+	return {
+		...theme,
+		icons: sanitized
+	};
 }
-/** Normalize a checkbox choice input into a full {@link CheckboxChoice} (a bare string becomes both name and value). */
-function normalizeCheckboxChoice(choice) {
-	return isString(choice) ? {
-		name: choice,
-		value: choice
-	} : choice;
+/** The styled prompt-message header (`? message`) — the leading line every active prompt view shares, themed by the `question` + `message` roles. */
+function promptHeader(styler, theme, message) {
+	return `${styler.render(theme.roles.question, theme.icons.question)} ${styler.render(theme.roles.message, message)}`;
 }
-/** The styled prompt-message header (`? message`) — the leading line every active prompt view shares. */
-function promptHeader(styler, message) {
-	return `${styler.cyan(PROMPT_ICONS.question)} ${styler.bold(message)}`;
+/**
+* Render a prompt header followed by a key hint painted with the `hint` role, or the header alone
+* when no hint is supplied.
+*
+* @param styler - The console styler that renders each role
+* @param theme - The resolved prompt theme
+* @param message - The prompt's question text
+* @param hint - The optional key hint to append
+* @returns The rendered header with the optional hint
+*/
+function hintedHeader(styler, theme, message, hint) {
+	const head = promptHeader(styler, theme, message);
+	return hint === void 0 ? head : `${head} ${styler.render(theme.roles.hint, hint)}`;
 }
-/** The styled submit line (`✔ message`) — the committed header an interactive prompt shows once resolved. */
-function submitHeader(styler, message) {
-	return `${styler.green(STATUS_ICONS.success)} ${styler.bold(message)}`;
+/** The styled submit line (`✔ message`) — the committed header an interactive prompt shows once resolved, themed by the `success` + `message` roles. */
+function submitHeader(styler, theme, message) {
+	return `${styler.render(theme.roles.success, theme.icons.success)} ${styler.render(theme.roles.message, message)}`;
 }
-/** The styled error line (`✖ message`) — appended beneath a prompt view when the last submit failed validation. */
-function errorLine(styler, message) {
-	return `${styler.red(STATUS_ICONS.error)} ${styler.red(message)}`;
+/** The styled error line (`✖ message`) a form driver appends for a field failure. */
+function errorLine(styler, theme, message) {
+	return `${styler.render(theme.roles.error, theme.icons.error)} ${styler.render(theme.roles.error, message)}`;
 }
-/** Build the initial {@link InputState} from {@link InputOptions} — resolving the validator + styler, seeding an empty value. */
-function createInputState(options) {
+/**
+* Build the initial text-field key state.
+*
+* @param field - The text field to render
+* @param styler - The styler used to render the view
+* @param theme - The optional terminal theme
+* @returns The initial immutable key state
+*/
+function createInputState(field, styler = createStyler(), theme) {
 	return {
-		message: options.message,
-		default: options.default ?? "",
-		validator: resolveValidation(options.validate),
-		styler: options.styler ?? createStyler(),
+		message: sanitizeDisplayText(field.label ?? field.name),
+		default: field.default ?? "",
+		styler,
+		theme: createPromptTheme(theme),
 		value: ""
 	};
 }
-/** Render an {@link InputState} as a styled view — the header, the typed value (or dimmed default hint), and any error. */
+/** Render a text-field key state as a styled view. */
 function inputView(state) {
-	const shown = state.value.length > 0 ? state.value : state.styler.dim(state.default);
-	const head = `${promptHeader(state.styler, state.message)} ${state.styler.cyan(PROMPT_ICONS.pointer)} ${shown}`;
-	return state.error === void 0 ? head : `${head}\n${errorLine(state.styler, state.error)}`;
+	const content = state.value.length > 0 ? state.value : state.default;
+	const role = state.value.length > 0 ? state.theme.roles.content : state.theme.roles.hint;
+	const shown = state.styler.render(role, sanitizeDisplayText(content));
+	return `${promptHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.pointer, state.theme.icons.pointer)} ${shown}`;
 }
 /**
 * Advance an input prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
 * reducer. Printable characters extend the value; backspace shrinks it; ctrl-u clears it; ctrl-c
-* cancels; return submits (the empty line falls back to the default) through the validator — an
-* invalid submit stays active with the error in the view.
+* cancels; return produces the candidate value, with an empty line falling back to the default.
 */
 function inputReduce(state, key) {
 	if (key.ctrl && key.name === "c") return {
@@ -540,27 +657,14 @@ function inputReduce(state, key) {
 		view: inputView(state),
 		status: "cancel"
 	};
-	const { error: _error, ...clear } = state;
 	if (key.name === "return") {
 		const answer = state.value.length > 0 ? state.value : state.default;
-		const result = state.validator(answer);
-		if (result !== true) {
-			const next = {
-				...state,
-				error: result
-			};
-			return {
-				state: next,
-				view: inputView(next),
-				status: "active"
-			};
-		}
 		return {
 			state: {
-				...clear,
+				...state,
 				value: answer
 			},
-			view: `${submitHeader(state.styler, state.message)} ${state.styler.dim(answer)}`,
+			view: `${submitHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.hint, sanitizeDisplayText(answer))}`,
 			status: "submit",
 			value: answer
 		};
@@ -572,7 +676,7 @@ function inputReduce(state, key) {
 		status: "active"
 	};
 	const next = {
-		...clear,
+		...state,
 		value
 	};
 	return {
@@ -581,27 +685,32 @@ function inputReduce(state, key) {
 		status: "active"
 	};
 }
-/** Build the initial {@link PasswordState} from {@link PasswordOptions} — resolving the validator + styler + mask. */
-function createPasswordState(options) {
+/**
+* Build the initial password-field key state.
+*
+* @param field - The password field to render
+* @param styler - The styler used to render the view
+* @param theme - The optional terminal theme
+* @returns The initial immutable key state
+*/
+function createPasswordState(field, styler = createStyler(), theme) {
 	return {
-		message: options.message,
-		mask: options.mask ?? "*",
-		validator: resolveValidation(options.validate),
-		styler: options.styler ?? createStyler(),
+		message: sanitizeDisplayText(field.label ?? field.name),
+		mask: sanitizeDisplayText(field.mask ?? "*"),
+		styler,
+		theme: createPromptTheme(theme),
 		value: ""
 	};
 }
-/** Render a {@link PasswordState} as a styled view — the header, the value masked to `mask` repeated, and any error. */
+/** Render a password-field key state as a styled view. */
 function passwordView(state) {
-	const masked = state.mask.repeat(state.value.length);
-	const head = `${promptHeader(state.styler, state.message)} ${state.styler.cyan(PROMPT_ICONS.pointer)} ${masked}`;
-	return state.error === void 0 ? head : `${head}\n${errorLine(state.styler, state.error)}`;
+	const masked = state.styler.render(state.theme.roles.content, state.mask.repeat(state.value.length));
+	return `${promptHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.pointer, state.theme.icons.pointer)} ${masked}`;
 }
 /**
 * Advance a password prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
 * reducer. Identical line-editing to {@link inputReduce} (printable extends, backspace shrinks,
-* ctrl-u clears, ctrl-c cancels) but the view masks the value; return submits through the
-* validator (no default fallback — a password has no echoed default).
+* ctrl-u clears, ctrl-c cancels) but the view masks the value. Return produces the candidate value.
 */
 function passwordReduce(state, key) {
 	if (key.ctrl && key.name === "c") return {
@@ -609,27 +718,12 @@ function passwordReduce(state, key) {
 		view: passwordView(state),
 		status: "cancel"
 	};
-	const { error: _error, ...clear } = state;
-	if (key.name === "return") {
-		const result = state.validator(state.value);
-		if (result !== true) {
-			const next = {
-				...state,
-				error: result
-			};
-			return {
-				state: next,
-				view: passwordView(next),
-				status: "active"
-			};
-		}
-		return {
-			state: clear,
-			view: `${submitHeader(state.styler, state.message)} ${state.styler.dim(state.mask.repeat(state.value.length))}`,
-			status: "submit",
-			value: state.value
-		};
-	}
+	if (key.name === "return") return {
+		state,
+		view: `${submitHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.hint, state.mask.repeat(state.value.length))}`,
+		status: "submit",
+		value: state.value
+	};
 	const value = editLine(state.value, key);
 	if (value === void 0) return {
 		state,
@@ -637,7 +731,7 @@ function passwordReduce(state, key) {
 		status: "active"
 	};
 	const next = {
-		...clear,
+		...state,
 		value
 	};
 	return {
@@ -646,18 +740,29 @@ function passwordReduce(state, key) {
 		status: "active"
 	};
 }
-/** Build the initial {@link ConfirmState} from {@link ConfirmOptions} — defaulting the answer to `false`. */
-function createConfirmState(options) {
+/**
+* Build the initial confirm-field key state.
+*
+* @param field - The confirm field to render
+* @param styler - The styler used to render the view
+* @param theme - The optional terminal theme
+* @returns The initial immutable key state
+*/
+function createConfirmState(field, styler = createStyler(), theme) {
 	return {
-		message: options.message,
-		default: options.default ?? false,
-		styler: options.styler ?? createStyler()
+		message: sanitizeDisplayText(field.label ?? field.name),
+		default: field.default ?? false,
+		styler,
+		theme: createPromptTheme(theme)
 	};
 }
-/** Render a {@link ConfirmState} as a styled view — the header plus a `(Y/n)` hint with the default letter emphasized. */
+/**
+* Render a confirm-field key state as a styled view. The selected role paints the default letter.
+*/
 function confirmView(state) {
-	const hint = state.default ? `${state.styler.green("Y")}${state.styler.dim("/n")}` : `${state.styler.dim("y/")}${state.styler.green("N")}`;
-	return `${promptHeader(state.styler, state.message)} ${state.styler.dim("(")}${hint}${state.styler.dim(")")}`;
+	const head = promptHeader(state.styler, state.theme, state.message);
+	const answer = state.default ? `${state.styler.render(state.theme.roles.selected, "Y")}${state.styler.render(state.theme.roles.hint, "/n")}` : `${state.styler.render(state.theme.roles.hint, "y/")}${state.styler.render(state.theme.roles.selected, "N")}`;
+	return `${head} ${state.styler.render(state.theme.roles.hint, "(")}${answer}${state.styler.render(state.theme.roles.hint, ")")}`;
 }
 /**
 * Advance a confirm prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<boolean>`
@@ -682,29 +787,37 @@ function confirmReduce(state, key) {
 	};
 	return {
 		state,
-		view: `${submitHeader(state.styler, state.message)} ${state.styler.dim(answer ? "yes" : "no")}`,
+		view: `${submitHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.hint, answer ? "yes" : "no")}`,
 		status: "submit",
 		value: answer
 	};
 }
-/** Build the initial {@link SelectState} from {@link SelectOptions} — normalizing choices and pre-focusing the default. */
-function createSelectState(options) {
-	const choices = options.choices.map(normalizeChoice);
-	const index = choices.findIndex((choice) => choice.value === options.default);
+/**
+* Build the initial select-field key state.
+*
+* @param field - The select field to render
+* @param styler - The styler used to render the view
+* @param theme - The optional terminal theme
+* @returns The initial immutable key state
+*/
+function createSelectState(field, styler = createStyler(), theme) {
+	const choices = [...field.choices];
+	const index = choices.findIndex((choice) => choice.value === field.default);
 	return {
-		message: options.message,
+		message: sanitizeDisplayText(field.label ?? field.name),
 		choices,
-		styler: options.styler ?? createStyler(),
+		styler,
+		theme: createPromptTheme(theme),
 		focused: index >= 0 ? index : 0
 	};
 }
-/** Render a {@link SelectState} as a MULTI-LINE styled view — the header followed by one row per choice, the focused row marked. */
+/** Render a select-field key state as a multi-line styled view. */
 function selectView(state) {
 	const lines = state.choices.map((choice, index) => {
 		const active = index === state.focused;
-		return `${active ? state.styler.cyan(PROMPT_ICONS.pointer) : " "} ${active ? state.styler.green(PROMPT_ICONS.selected) : state.styler.dim(PROMPT_ICONS.dot)} ${active ? state.styler.bold(choice.name) : choice.name}${choice.description === void 0 ? "" : `  ${state.styler.dim(choice.description)}`}`;
+		return `${active ? state.styler.render(state.theme.roles.pointer, state.theme.icons.pointer) : " "} ${active ? state.styler.render(state.theme.roles.selected, state.theme.icons.selected) : state.styler.render(state.theme.roles.muted, state.theme.icons.dot)} ${active ? state.styler.render(state.theme.roles.focus, choice.label) : state.styler.render(state.theme.roles.content, choice.label)}${choice.help === void 0 ? "" : `  ${state.styler.render(state.theme.roles.description, choice.help)}`}`;
 	});
-	return [promptHeader(state.styler, state.message), ...lines].join("\n");
+	return [promptHeader(state.styler, state.theme, state.message), ...lines].join("\n");
 }
 /**
 * Advance a select prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
@@ -751,7 +864,7 @@ function selectReduce(state, key) {
 		const value = choice?.value ?? "";
 		return {
 			state,
-			view: `${submitHeader(state.styler, state.message)} ${state.styler.dim(choice?.name ?? "")}`,
+			view: `${submitHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.hint, choice?.label ?? "")}`,
 			status: "submit",
 			value
 		};
@@ -762,44 +875,48 @@ function selectReduce(state, key) {
 		status: "active"
 	};
 }
-/** Build the initial {@link CheckboxState} from {@link CheckboxOptions} — normalizing choices, seeding the checked set, carrying min/max. */
-function createCheckboxState(options) {
-	const choices = options.choices.map(normalizeCheckboxChoice);
+/**
+* Build the initial checkbox-field key state.
+*
+* @param field - The checkbox field to render
+* @param styler - The styler used to render the view
+* @param theme - The optional terminal theme
+* @returns The initial immutable key state
+*/
+function createCheckboxState(field, styler = createStyler(), theme) {
+	const choices = [...field.choices];
 	const checked = choices.reduce((indices, choice, index) => {
-		if (choice.checked === true) indices.push(index);
+		if (field.default?.includes(choice.value) === true) indices.push(index);
 		return indices;
 	}, []);
 	return {
-		message: options.message,
+		message: sanitizeDisplayText(field.label ?? field.name),
 		choices,
-		styler: options.styler ?? createStyler(),
+		styler,
+		theme: createPromptTheme(theme),
 		focused: 0,
-		checked,
-		...options.min !== void 0 ? { min: options.min } : {},
-		...options.max !== void 0 ? { max: options.max } : {}
+		checked
 	};
 }
-/** Render a {@link CheckboxState} as a MULTI-LINE styled view — the header, one box per choice (focused + checked marked), a count, and any error. */
+/** Render a checkbox-field key state as a multi-line styled view. */
 function checkboxView(state) {
 	const lines = state.choices.map((choice, index) => {
 		const active = index === state.focused;
 		const ticked = state.checked.includes(index);
-		return `${active ? state.styler.cyan(PROMPT_ICONS.pointer) : " "} ${ticked ? state.styler.green(PROMPT_ICONS.checked) : state.styler.dim(PROMPT_ICONS.unchecked)} ${active ? state.styler.bold(choice.name) : choice.name}${choice.description === void 0 ? "" : `  ${state.styler.dim(choice.description)}`}`;
+		return `${active ? state.styler.render(state.theme.roles.pointer, state.theme.icons.pointer) : " "} ${ticked ? state.styler.render(state.theme.roles.selected, state.theme.icons.checked) : state.styler.render(state.theme.roles.muted, state.theme.icons.unchecked)} ${active ? state.styler.render(state.theme.roles.focus, choice.label) : state.styler.render(state.theme.roles.content, choice.label)}${choice.help === void 0 ? "" : `  ${state.styler.render(state.theme.roles.description, choice.help)}`}`;
 	});
-	const summary = state.styler.dim(`${state.checked.length} selected`);
-	const body = [
-		promptHeader(state.styler, state.message),
+	const summary = state.styler.render(state.theme.roles.hint, `${state.checked.length} selected`);
+	return [
+		promptHeader(state.styler, state.theme, state.message),
 		...lines,
 		summary
 	].join("\n");
-	return state.error === void 0 ? body : `${body}\n${errorLine(state.styler, state.error)}`;
 }
 /**
 * Advance a checkbox prompt by one {@link KeyEvent} — the pure
 * `(state, key) → PromptStep<readonly string[]>` reducer. `up` / `down` (and `k` / `j`) move the
 * focus (wrapping); `space` toggles the focused index in the checked set; return submits the
-* checked values in CHOICE order — gated by `min` / `max` (an out-of-range count stays active with
-* the reason in the view); ctrl-c cancels.
+* checked values in choice order; ctrl-c cancels. The form applies selection-count rules.
 */
 function checkboxReduce(state, key) {
 	if (key.ctrl && key.name === "c") return {
@@ -808,10 +925,9 @@ function checkboxReduce(state, key) {
 		status: "cancel"
 	};
 	const count = state.choices.length;
-	const { error: _error, ...clear } = state;
 	if ((key.name === "up" || key.name === "k") && count > 0) {
 		const next = {
-			...clear,
+			...state,
 			focused: (state.focused - 1 + count) % count
 		};
 		return {
@@ -822,7 +938,7 @@ function checkboxReduce(state, key) {
 	}
 	if ((key.name === "down" || key.name === "j") && count > 0) {
 		const next = {
-			...clear,
+			...state,
 			focused: (state.focused + 1) % count
 		};
 		return {
@@ -834,7 +950,7 @@ function checkboxReduce(state, key) {
 	if (key.name === "space" && count > 0) {
 		const checked = toggleIndex(state.checked, state.focused);
 		const next = {
-			...clear,
+			...state,
 			checked
 		};
 		return {
@@ -844,24 +960,12 @@ function checkboxReduce(state, key) {
 		};
 	}
 	if (key.name === "return") {
-		const error = gateSelection(state.checked.length, state.min, state.max);
-		if (error !== void 0) {
-			const next = {
-				...state,
-				error
-			};
-			return {
-				state: next,
-				view: checkboxView(next),
-				status: "active"
-			};
-		}
 		const ordered = [...state.checked].sort((a, b) => a - b);
 		const values = ordered.map((index) => state.choices[index]?.value).filter((value) => value !== void 0);
-		const summary = ordered.map((index) => state.choices[index]?.name).filter((name) => name !== void 0).join(", ");
+		const summary = ordered.map((index) => state.choices[index]?.label).filter((name) => name !== void 0).join(", ");
 		return {
-			state: clear,
-			view: `${submitHeader(state.styler, state.message)} ${state.styler.dim(summary)}`,
+			state,
+			view: `${submitHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.hint, summary)}`,
 			status: "submit",
 			value: values
 		};
@@ -876,33 +980,37 @@ function checkboxReduce(state, key) {
 function toggleIndex(indices, index) {
 	return indices.includes(index) ? indices.filter((i) => i !== index) : [...indices, index];
 }
-/** The min/max gate for a checkbox submit — the rejection message when `count` is out of range, else `undefined`. */
-function gateSelection(count, min, max) {
-	if (min !== void 0 && count < min) return `Select at least ${String(min)} option${min === 1 ? "" : "s"}`;
-	if (max !== void 0 && count > max) return `Select no more than ${String(max)} option${max === 1 ? "" : "s"}`;
-}
-/** Build the initial {@link EditorState} from {@link EditorOptions} — resolving the validator + styler, seeding empty lines. */
-function createEditorState(options) {
+/**
+* Build the initial editor-field key state.
+*
+* @param field - The editor field to render
+* @param styler - The styler used to render the view
+* @param theme - The optional terminal theme
+* @returns The initial immutable key state
+*/
+function createEditorState(field, styler = createStyler(), theme) {
 	return {
-		message: options.message,
-		default: options.default ?? "",
-		validator: resolveValidation(options.validate),
-		styler: options.styler ?? createStyler(),
+		message: sanitizeDisplayText(field.label ?? field.name),
+		default: field.default ?? "",
+		styler,
+		theme: createPromptTheme(theme),
 		lines: [],
 		current: ""
 	};
 }
-/** Render an {@link EditorState} as a MULTI-LINE styled view — the header (with a Ctrl+D hint), the committed lines, the in-progress line, and any error. */
+/**
+* Render an editor-field key state as a multi-line styled view with its finish hint.
+*/
 function editorView(state) {
-	const view = [`${promptHeader(state.styler, state.message)} ${state.styler.dim("(Ctrl+D to finish)")}`, ...[...state.lines, `${state.styler.cyan(PROMPT_ICONS.pointer)} ${state.current}`]].join("\n");
-	return state.error === void 0 ? view : `${view}\n${errorLine(state.styler, state.error)}`;
+	const head = hintedHeader(state.styler, state.theme, state.message, "(Ctrl+D to finish)");
+	const pointer = state.styler.render(state.theme.roles.pointer, state.theme.icons.pointer);
+	return [head, ...[...state.lines.map((line) => state.styler.render(state.theme.roles.content, line)), `${pointer} ${state.styler.render(state.theme.roles.content, state.current)}`]].join("\n");
 }
 /**
 * Advance an editor prompt by one {@link KeyEvent} — the pure `(state, key) → PromptStep<string>`
 * reducer. Printable characters extend the current line; backspace shrinks it; return commits the
 * current line and starts a fresh one; ctrl-d FINISHES (joining all lines, falling back to the
-* default when empty) through the validator; ctrl-c cancels. An invalid finish stays active with
-* the error.
+* default when empty); ctrl-c cancels. The form validates the candidate after the driver fills it.
 */
 function editorReduce(state, key) {
 	if (key.ctrl && key.name === "c") return {
@@ -910,33 +1018,20 @@ function editorReduce(state, key) {
 		view: editorView(state),
 		status: "cancel"
 	};
-	const { error: _error, ...clear } = state;
 	if (key.ctrl && key.name === "d") {
 		const lines = state.current.length > 0 ? [...state.lines, state.current] : state.lines;
 		const joined = lines.join("\n");
 		const answer = joined.length > 0 ? joined : state.default;
-		const result = state.validator(answer);
-		if (result !== true) {
-			const next = {
-				...state,
-				error: result
-			};
-			return {
-				state: next,
-				view: editorView(next),
-				status: "active"
-			};
-		}
 		return {
-			state: clear,
-			view: `${submitHeader(state.styler, state.message)} ${state.styler.dim(`${String(lines.length)} line${lines.length === 1 ? "" : "s"}`)}`,
+			state,
+			view: `${submitHeader(state.styler, state.theme, state.message)} ${state.styler.render(state.theme.roles.hint, `${String(lines.length)} line${lines.length === 1 ? "" : "s"}`)}`,
 			status: "submit",
 			value: answer
 		};
 	}
 	if (key.name === "return") {
 		const next = {
-			...clear,
+			...state,
 			lines: [...state.lines, state.current],
 			current: ""
 		};
@@ -953,7 +1048,7 @@ function editorReduce(state, key) {
 		status: "active"
 	};
 	const next = {
-		...clear,
+		...state,
 		current
 	};
 	return {
@@ -975,205 +1070,6 @@ function editLine(value, key) {
 	if (!key.ctrl && !key.meta && [...key.name].length === 1 && isPrintable(key.name)) return `${value}${key.sequence}`;
 }
 /**
-* Produce the WIRE-SAFE form of a prompt's options — the {@link PendingPrompt.options} a broker
-* serializes over SSE. Drops everything that cannot cross the wire (a `styler`, and any
-* function-valued `validate` rule), while KEEPING the declarative data a remote client needs to
-* reconstruct the prompt: the {@link ValidationRules} as data, plus `message` / `choices` /
-* `default` / `mask` / `min` / `max`. This is WHY T-a's validation is rules-as-data: a `Validator`
-* FUNCTION can't be serialized, but its declarative rules can — the client rebuilds the validator
-* from them via {@link resolveValidation}.
-*
-* @remarks
-* - **Functions are dropped.** A top-level function value (e.g. a bare-`Validator` `validate`) is
-*   omitted entirely; the `styler` (a fluent function-bearing object) is dropped by key.
-* - **`validate` rules are flattened.** A {@link ValidationRules} bag is copied with each
-*   function rule replaced by `true` (the rule's INTENT survives as the built-in check; its
-*   custom function does not). A bare-function `validate` is dropped (no declarative form to keep).
-* - **`choices` are function-stripped.** Each choice keeps its plain fields (`name` / `value` /
-*   `description` / `checked`); a bare string passes through.
-*
-* @param options - The raw prompt options bag (may hold functions / a styler)
-* @returns A JSON-safe options record — only serializable, declarative data
-*/
-function serializePromptOptions(options) {
-	const result = {};
-	for (const [key, value] of Object.entries(options)) {
-		if (key === "styler" || typeof value === "function") continue;
-		if (key === "validate") {
-			const rules = serializeValidationRules(value);
-			if (rules !== void 0) result[key] = rules;
-			continue;
-		}
-		if (key === "choices") {
-			result[key] = serializeChoices(value);
-			continue;
-		}
-		result[key] = value;
-	}
-	return result;
-}
-/**
-* Flatten a `validate` option to its wire-safe {@link ValidationRules} DATA — a function rule
-* becomes `true` (its built-in check survives; its body cannot cross the wire). A bare-function
-* `validate` (no rules object) has no declarative form, so it yields `undefined` (dropped).
-*/
-function serializeValidationRules(validate) {
-	if (!isRecord(validate)) return void 0;
-	const rules = {};
-	for (const [rule, value] of Object.entries(validate)) rules[rule] = typeof value === "function" ? true : value;
-	return rules;
-}
-/** Strip functions from a `choices` option — each choice keeps its plain fields; a bare string passes through. */
-function serializeChoices(choices) {
-	if (!Array.isArray(choices)) return [];
-	return choices.map((choice) => {
-		if (isString(choice)) return choice;
-		if (!isRecord(choice)) return choice;
-		const normalized = {};
-		for (const [key, value] of Object.entries(choice)) if (typeof value !== "function") normalized[key] = value;
-		return normalized;
-	});
-}
-/**
-* Rebuild a wire-decoded `validate` payload into a {@link ValidationRules} bag — the inverse of
-* {@link serializeValidationRules}. Keeps only the primitive rule values (`boolean` / `number` /
-* `string`) a serialized prompt could carry; an empty / non-record / all-dropped payload yields
-* `undefined` (no rules to apply). The client feeds the result back through {@link resolveValidation}.
-*/
-function reconstructValidationRules(value) {
-	if (!isRecord(value)) return void 0;
-	const rules = {};
-	let count = 0;
-	for (const [rule, item] of Object.entries(value)) {
-		if (rule === "pattern") continue;
-		if (isBoolean(item) || isNumber(item) || isString(item)) {
-			rules[rule] = item;
-			count += 1;
-		}
-	}
-	if (count === 0) return void 0;
-	return rules;
-}
-/** Read one option by key, narrowed by `guard` — `undefined` when absent or off-shape (§14, never an `as`). */
-function resolveOption(options, key, guard) {
-	const value = options[key];
-	return guard(value) ? value : void 0;
-}
-/** Narrow an unknown value to a {@link PromptChoice} — the `recordOf` shape inlined so no non-exported member lingers (§5). */
-function isPromptChoice(value) {
-	return recordOf({
-		name: isString,
-		value: isString,
-		description: isString
-	}, ["description"])(value);
-}
-/** Narrow an unknown value to a {@link CheckboxChoice} — the `recordOf` shape inlined so no non-exported member lingers (§5). */
-function isCheckboxChoice(value) {
-	return recordOf({
-		name: isString,
-		value: isString,
-		description: isString,
-		checked: isBoolean
-	}, ["description", "checked"])(value);
-}
-/** Read a `choices` option as a list of bare strings / full choices — each element narrowed by `guard`, off-shape elements stringified. */
-function resolveChoices(options, guard) {
-	const choices = options.choices;
-	if (!Array.isArray(choices)) return [];
-	return choices.map((choice) => {
-		if (isString(choice)) return choice;
-		if (guard(choice)) return choice;
-		return String(choice);
-	});
-}
-/**
-* Sanitize a list of resolved choices' human-readable labels (`name` + `description`) with
-* {@link stripControls} — shared by the `select` and `checkbox` branches of
-* {@link dispatchPendingPrompt} so a remote-supplied choice can never inject raw control bytes
-* into the local terminal's rendered view.
-*
-* @param choices - The resolved choices (bare strings or full {@link PromptChoice} /
-*   {@link CheckboxChoice} objects) as returned by {@link resolveChoices}
-* @returns The same choices with every `name` / `description` control-stripped
-*/
-function sanitizeChoiceLabels(choices) {
-	return choices.map((choice) => {
-		if (isString(choice)) return stripControls(choice);
-		return {
-			...choice,
-			name: stripControls(choice.name),
-			...choice.description !== void 0 ? { description: stripControls(choice.description) } : {}
-		};
-	});
-}
-/**
-* Dispatch a {@link PendingPrompt} to the matching {@link PromptFormInterface} method — the bridge
-* step a {@link PromptClient} runs to drive a LOCAL terminal with a prompt issued elsewhere.
-* Reconstructs typed options from the wire-safe {@link PendingPrompt.options} (every field
-* §14-narrowed, never an `as`; the validator rebuilt from rules via {@link reconstructValidationRules}),
-* then calls the matching prompt form and returns its resolved value.
-*
-* @param terminal - The local {@link PromptFormInterface} to drive
-* @param pending - The decoded pending prompt to dispatch
-* @returns The prompt's resolved value (a `string` / `boolean` / `readonly string[]` per form)
-*/
-function dispatchPendingPrompt(terminal, pending) {
-	const options = pending.options;
-	const validate = reconstructValidationRules(options.validate);
-	const message = stripControls(pending.message);
-	switch (pending.form) {
-		case "input": {
-			const value = resolveOption(options, "default", isString);
-			return terminal.input({
-				message,
-				...value !== void 0 ? { default: stripControls(value) } : {},
-				...validate !== void 0 ? { validate } : {}
-			});
-		}
-		case "password": {
-			const value = resolveOption(options, "mask", isString);
-			return terminal.password({
-				message,
-				...value !== void 0 ? { mask: stripControls(value) } : {},
-				...validate !== void 0 ? { validate } : {}
-			});
-		}
-		case "confirm": {
-			const value = resolveOption(options, "default", isBoolean);
-			return terminal.confirm({
-				message,
-				...value !== void 0 ? { default: value } : {}
-			});
-		}
-		case "select": {
-			const value = resolveOption(options, "default", isString);
-			return terminal.select({
-				message,
-				choices: sanitizeChoiceLabels(resolveChoices(options, isPromptChoice)),
-				...value !== void 0 ? { default: stripControls(value) } : {}
-			});
-		}
-		case "checkbox": {
-			const min = resolveOption(options, "min", isNumber);
-			const max = resolveOption(options, "max", isNumber);
-			return terminal.checkbox({
-				message,
-				choices: sanitizeChoiceLabels(resolveChoices(options, isCheckboxChoice)),
-				...min !== void 0 ? { min } : {},
-				...max !== void 0 ? { max } : {}
-			});
-		}
-		case "editor": {
-			const value = resolveOption(options, "default", isString);
-			return terminal.editor({
-				message,
-				...value !== void 0 ? { default: stripControls(value) } : {},
-				...validate !== void 0 ? { validate } : {}
-			});
-		}
-	}
-}
-/**
 * The default {@link import('./types.js').TimerHandler} — a thin host `setTimeout` / `clearTimeout`
 * wrapper that arms `callback` after `ms` and returns a {@link TimerCancel}. The deadline seam
 * behind both the {@link import('./Prompt.js').Prompt} broker (its expiry) and the
@@ -1197,19 +1093,6 @@ function isAbortError(error) {
 	return (error instanceof DOMException || error instanceof Error) && error.name === "AbortError";
 }
 /**
-* Parse a JSON wire string TOTAL — a malformed / empty payload yields `undefined` (the caller's
-* guard then rejects it), never a throw. The {@link import('./PromptClient.js').PromptClient}
-* decodes every SSE `data` field through this before §14-narrowing it.
-*/
-function parseWireJSON(text) {
-	if (text.length === 0) return void 0;
-	try {
-		return JSON.parse(text);
-	} catch {
-		return;
-	}
-}
-/**
 * Whether `url` is an INSECURE remote endpoint — a plain `http://` URL whose host is NOT a
 * loopback address. Pure string parsing (no `URL` global), so it stays total on malformed input.
 *
@@ -1237,12 +1120,12 @@ function isInsecureRemote(url) {
 	const hostname = host.startsWith("[") ? host.slice(0, host.indexOf("]") + 1) : host.split(":")[0] ?? "";
 	return hostname !== "localhost" && hostname !== "127.0.0.1" && hostname !== "[::1]";
 }
-/** Serialize a parked {@link PendingPrompt} into a {@link WireEvent} — event `'pending'`, `data` the JSON-stringified prompt, `id` the prompt's own id (an SSE bridge sets its frame `id:` from this). */
-function serializePending(prompt) {
+/** Serialize a parked {@link PendingForm} into a {@link WireEvent}. */
+function serializePending(form) {
 	return {
 		event: "pending",
-		data: JSON.stringify(prompt),
-		id: prompt.id
+		data: JSON.stringify(form),
+		id: form.id
 	};
 }
 /** Serialize a parked prompt's expiry into a {@link WireEvent} — event `'expire'`, `data` the JSON-stringified `{ id }` payload. */
@@ -1259,44 +1142,24 @@ function serializeShutdown() {
 		data: ""
 	};
 }
-/** Narrow an unknown wire payload to an answer POST body — a non-empty `id` string plus a `value` key (of any shape) present. */
-function isAnswerPayload(value) {
-	return isRecord(value) && isNonEmptyString(value.id) && "value" in value;
-}
 //#endregion
 //#region src/core/Prompt.ts
 /**
-* The headless prompt BROKER (observable §13) — parks each {@link PromptInterface} call as a
-* pending prompt and returns a Promise that resolves when the prompt is {@link answer}ed (or
-* rejects on timeout / teardown). The tri-surface's headless arm: there is no terminal here, so a
-* transport forwards each `pending` event to whoever can answer, and {@link answer} resolves the
-* parked Promise — for environments where direct user access is unavailable (a headless server on
-* stdio, a browser with no TTY, a prompt issued on one machine answered on another).
+* The headless form broker. It parks live forms, exposes their serialized schemas, and applies
+* remote answers to the authoritative form.
 *
 * @remarks
-* - **Park-as-Promise.** Each `input` / `password` / `confirm` / `select` / `checkbox` / `editor`
-*   mints an id (`crypto.randomUUID()`), parks a wire-safe {@link PendingPrompt}, emits `pending`,
-*   and returns an unresolved Promise. The prompt's options are serialized
-*   ({@link serializePromptOptions}) so a transport can forward them as-is.
-* - **Answer validates + type-checks.** {@link answer} runs the prompt's per-form gate: it
-*   type-checks `value` to the form (string / boolean / string[]) AND, for the text forms, runs
-*   the validator resolved from the original `validate` rules. A rejected answer returns `false`
-*   and the prompt stays `pending`; an accepted answer resolves the Promise, emits `answer`, and
-*   removes the prompt.
-* - **Timeout → expire → reject.** An unanswered prompt expires after `timeout` ms (via the
-*   INJECTED timer): `expire` fires and the parked Promise rejects with a {@link TerminalError}
-*   (`code: 'EXPIRE'`). {@link destroy} expires every still-pending prompt the same way.
-* - **Deterministic.** The timer is injectable ({@link import('./types.js').TimerHandler}); a test
-*   supplies one that fires on demand, so expiry is driven without real time.
+* A parked record carries one call to `serializeForm`. A failed fill or submit leaves the record
+* parked for another answer. A successful submit settles the form once, emits `answer`, and removes
+* the record. Timeout and teardown abandon every unsettled form through its own `destroy` method.
 *
 * @example
 * ```ts
-* const prompt = createPrompt({ timeout: 60_000 })
-* prompt.emitter.on('pending', (pending) => broadcast(pending)) // forward to a client
-*
-* const name = await prompt.input({ message: 'Your name' }) // parks; resolves on answer()
-* // ...elsewhere, a client POSTs the answer back:
-* prompt.answer(id, 'Ada') // resolves the awaited input() above
+* const form = createForm({ fields: [{ control: 'text', name: 'name' }] })
+* const prompt = createPrompt()
+* const id = prompt.park(form)
+* prompt.answer(id, { name: 'Ada' })
+* await form.answer // { name: 'Ada' }
 * ```
 */
 var Prompt = class {
@@ -1322,211 +1185,164 @@ var Prompt = class {
 		return this.#parked.size;
 	}
 	pending(id) {
-		if (id !== void 0) return this.#parked.get(id)?.prompt;
-		const result = [];
-		for (const parked of this.#parked.values()) result.push(parked.prompt);
-		return result;
-	}
-	answer(id, value) {
-		const parked = this.#parked.get(id);
-		if (parked === void 0) return {
-			success: false,
-			error: "unknown"
-		};
-		const accepted = parked.respond(value);
-		if (accepted === void 0) return {
-			success: false,
-			error: "rejected"
+		if (id !== void 0) return this.#parked.get(id)?.pending;
+		const forms = [];
+		for (const parked of this.#parked.values()) forms.push(parked.pending);
+		return forms;
+	}
+	park(form, request) {
+		if (this.#destroyed) {
+			form.destroy();
+			throw new TerminalError("EXPIRE", "The broker has been destroyed");
+		}
+		if (this.#cap !== void 0 && this.#parked.size >= this.#cap) {
+			form.destroy();
+			throw new TerminalError("LIMIT", `The parked-form cap (${String(this.#cap)}) was reached`, { cap: this.#cap });
+		}
+		const id = crypto.randomUUID();
+		const pending = {
+			id,
+			schema: serializeForm(form.schema),
+			status: "pending",
+			time: Date.now(),
+			...request?.from !== void 0 ? { from: request.from } : {},
+			...request?.to !== void 0 ? { to: request.to } : {}
 		};
-		parked.cancel();
-		this.#emitter.emit("answer", id, accepted);
-		this.#parked.delete(id);
+		const cancel = this.#timer(() => this.#expire(id), this.#timeout);
+		this.#parked.set(id, {
+			form,
+			pending,
+			cancel
+		});
+		this.#emitter.emit("pending", pending);
+		return id;
+	}
+	answer(id, values) {
+		const outcome = attempt(() => this.#answer(id, values));
+		if (outcome.success) return outcome.value;
 		return {
-			success: true,
-			value: accepted
+			success: false,
+			error: {
+				reason: "rejected",
+				errors: [{
+					field: "form",
+					message: "The form rejected the answer"
+				}]
+			}
 		};
 	}
-	park(request) {
-		const gate = this.#gate(request.form, request.options);
-		return this.#park(request.form, request.options.message, request.options, gate, request.from, request.to);
-	}
-	input(options) {
-		return this.#park("input", options.message, options, this.#gate("input", options)).value;
-	}
-	password(options) {
-		return this.#park("password", options.message, options, this.#gate("password", options)).value;
-	}
-	confirm(options) {
-		return this.#park("confirm", options.message, options, this.#gate("confirm", options)).value;
-	}
-	select(options) {
-		return this.#park("select", options.message, options, this.#gate("select", options)).value;
-	}
-	checkbox(options) {
-		return this.#park("checkbox", options.message, options, this.#gate("checkbox", options)).value;
-	}
-	editor(options) {
-		return this.#park("editor", options.message, options, this.#gate("editor", options)).value;
-	}
 	destroy() {
 		if (this.#destroyed) return;
 		this.#destroyed = true;
 		for (const id of [...this.#parked.keys()]) this.#expire(id);
-		this.#parked.clear();
 		this.#emitter.destroy();
 	}
-	#park(form, message, options, gate, from, to) {
-		if (this.#destroyed) return {
-			id: crypto.randomUUID(),
-			value: Promise.reject(new TerminalError("EXPIRE", "broker destroyed"))
-		};
-		if (this.#cap !== void 0 && this.#parked.size >= this.#cap) return {
-			id: crypto.randomUUID(),
-			value: Promise.reject(new TerminalError("LIMIT", `parked-prompt cap (${this.#cap}) reached`, { cap: this.#cap }))
-		};
-		const id = crypto.randomUUID();
-		const prompt = {
-			id,
-			form,
-			message,
-			options: serializePromptOptions(options),
-			status: "pending",
-			time: Date.now(),
-			...from !== void 0 ? { from } : {},
-			...to !== void 0 ? { to } : {}
-		};
-		return {
-			id,
-			value: new Promise((resolve, reject) => {
-				const cancel = this.#timer(() => this.#expire(id), this.#timeout);
-				const respond = this.#createRespond(id, gate, resolve);
-				const expire = this.#createExpire(id, reject);
-				this.#parked.set(id, {
-					prompt,
-					respond,
-					expire,
-					cancel
-				});
-				this.#emitter.emit("pending", prompt);
-			})
-		};
-	}
-	#createRespond(id, gate, resolve) {
-		return (answer) => {
-			const accepted = gate(answer);
-			if (accepted === void 0) return void 0;
-			const current = this.#parked.get(id);
-			if (current !== void 0) this.#parked.set(id, {
-				...current,
-				prompt: {
-					...current.prompt,
-					status: "answered"
-				}
-			});
-			resolve(accepted);
-			return accepted;
+	#answer(id, values) {
+		const parked = this.#parked.get(id);
+		if (parked === void 0 || parked.pending.status !== "pending") return {
+			success: false,
+			error: { reason: "unknown" }
 		};
-	}
-	#createExpire(id, reject) {
-		return () => reject(new TerminalError("EXPIRE", `prompt ${id} expired`, { id }));
-	}
-	#gate(form, options) {
-		switch (form) {
-			case "input":
-			case "password":
-			case "editor": {
-				if (!this.#isTextOptions(form, options)) return () => void 0;
-				const validator = resolveValidation(options.validate);
-				return (value) => isString(value) && validator(value) === true ? value : void 0;
+		const outcome = attempt(() => this.#submit(parked.form, values));
+		if (!outcome.success) return {
+			success: false,
+			error: {
+				reason: "rejected",
+				errors: this.#errors(outcome.error, parked.form)
 			}
-			case "confirm":
-				if (!this.#isConfirmOptions(form, options)) return () => void 0;
-				return (value) => isBoolean(value) ? value : void 0;
-			case "select": {
-				if (!this.#isSelectOptions(form, options)) return () => void 0;
-				const values = new Set(options.choices.map(normalizeChoice).map((choice) => choice.value));
-				return (value) => isString(value) && values.has(value) ? value : void 0;
+		};
+		if (!outcome.value.success) return {
+			success: false,
+			error: {
+				reason: "rejected",
+				errors: outcome.value.error
 			}
-			case "checkbox": {
-				if (!this.#isCheckboxOptions(form, options)) return () => void 0;
-				const values = new Set(options.choices.map(normalizeCheckboxChoice).map((choice) => choice.value));
-				const { min, max } = options;
-				return (value) => {
-					if (!isArray(value) || !value.every(isString)) return void 0;
-					if (!value.every((item) => values.has(item))) return void 0;
-					if (min !== void 0 && value.length < min) return void 0;
-					if (max !== void 0 && value.length > max) return void 0;
-					return value;
-				};
+		};
+		parked.cancel();
+		const answered = {
+			...parked,
+			pending: {
+				...parked.pending,
+				status: "answered"
 			}
+		};
+		this.#parked.set(id, answered);
+		this.#emitter.emit("answer", id, outcome.value.value);
+		this.#parked.delete(id);
+		return outcome.value;
+	}
+	#submit(form, values) {
+		for (const [field, value] of Object.entries(values)) {
+			const outcome = attempt(() => form.fill(field, value));
+			if (!outcome.success) return {
+				success: false,
+				error: this.#errors(outcome.error, form, field)
+			};
 		}
+		return form.submit();
+	}
+	#errors(error, form, field) {
+		if (isFormError(error)) {
+			if (isFieldError(error.context)) return [error.context];
+			const named = error.context?.field;
+			return [{
+				field: typeof named === "string" ? named : this.#field(form, field),
+				message: error.message
+			}];
+		}
+		return [{
+			field: this.#field(form, field),
+			message: "The form rejected the answer"
+		}];
 	}
-	#isTextOptions(form, _options) {
-		return form === "input" || form === "password" || form === "editor";
-	}
-	#isConfirmOptions(form, _options) {
-		return form === "confirm";
-	}
-	#isSelectOptions(form, _options) {
-		return form === "select";
-	}
-	#isCheckboxOptions(form, _options) {
-		return form === "checkbox";
+	#field(form, field) {
+		return field ?? form.schema.fields[0]?.name ?? form.schema.name ?? "form";
 	}
 	#expire(id) {
 		const parked = this.#parked.get(id);
-		if (parked === void 0) return;
+		if (parked === void 0 || parked.pending.status !== "pending") return;
 		parked.cancel();
-		this.#parked.set(id, {
+		const expired = {
 			...parked,
-			prompt: {
-				...parked.prompt,
+			pending: {
+				...parked.pending,
 				status: "expired"
 			}
-		});
+		};
+		this.#parked.set(id, expired);
+		parked.form.destroy();
 		this.#emitter.emit("expire", id);
 		this.#parked.delete(id);
-		parked.expire();
 	}
 };
 //#endregion
 //#region src/core/PromptClient.ts
 /**
-* The SSE prompt BRIDGE (observable §13) — the client-side counterpart to
-* {@link import('./Prompt.js').Prompt}. Connects to a remote broker's SSE endpoint, receives
-* serialized pending prompts, dispatches EACH to a LOCAL {@link PromptFormInterface} terminal (so
-* a human at THIS machine answers a prompt parked elsewhere), and POSTs the answer back.
-* Universal — `fetch` + SSE are web-standard, so it runs in a browser or on a server; the
-* injected `fetch` / timer make it fully deterministic in tests.
+* The SSE form bridge. It ingests serialized forms from a remote broker, renders them through a
+* local terminal, and posts answers back without blocking the event stream.
 *
 * @remarks
-* - **Connect + reconnect.** {@link connect} opens the SSE stream (via the injected `fetch` + the
-*   core `SSEParser`) and loops, reconnecting after the stream drops with the `delay` backoff
-*   (driven by the injected timer) — unless `reconnect` is `false`, the client was
-*   {@link destroy}ed, or the drop was a deliberate {@link disconnect} (an abort).
-* - **Dispatch + answer.** Each decoded `pending` event is narrowed to a `PendingPrompt` (§14 —
-*   never an `as`), dispatched to `terminal`, and its resolved value POSTed back to `url`.
-*   Dispatch is strictly SERIAL: the read loop drives the terminal for ONE prompt at a time and
-*   only reads/dispatches the next event after the current prompt fully settles (its answer
-*   POSTed). A prompt id redelivered (e.g. after a reconnect) WHILE its prior dispatch is still
-*   in flight is skipped (a `#seen` set tracks in-flight ids); once that dispatch settles (or the
-*   broker sends `expire` for the id) the id is dropped from `#seen`, so a later redelivery of the
-*   SAME id after completion is dispatched again — the client does not dedupe across completion.
-* - **Server signals.** An `expire` event (the broker dropped a parked prompt) emits `expire`; a
-*   `shutdown` event calls {@link disconnect} (not {@link destroy}) — the client stops streaming
-*   without auto-reconnect but stays reusable; a later {@link connect} recovers it.
-* - **Lean events (§13).** `connect` / `disconnect` / `expire` / `error` — errors are `unknown`.
-*   `disconnect` fires exactly once per connected-to-disconnected transition, whether triggered by
-*   the server ending the stream cleanly or by a deliberate {@link disconnect} / {@link destroy}.
+* - **Connect + reconnect.** {@link connect} opens the SSE stream and reconnects after a transport
+*   drop with the injected backoff unless reconnect is disabled, the client was destroyed, or
+*   {@link disconnect} deliberately stopped it.
+* - **Ingest + render.** Each `pending` envelope passes through `isPendingForm`, Form's `parseForm`,
+*   and terminal's `sanitizeSchema`, then enters a serial render queue. The SSE reader never awaits
+*   that queue, so `expire` and `shutdown` remain live while a person is answering.
+* - **Safe local form.** The rendering copy omits every wire `pattern`, because Form compiles a
+*   pattern during local evaluation. The broker's parked form retains it and remains authoritative.
+* - **Refusal retry.** A structured `rejected` response seeds a new rendering form with the values
+*   just submitted, applies every {@link FieldError} through `invalidate`, and asks again. No retry
+*   counter truncates the loop; acceptance, expiry, and shutdown are its bounds.
+* - **Replay safety.** A replayed id is skipped while it is queued, rendering, or posting. Once an
+*   attempt ends, a later delivery of that id may be rendered again.
 *
 * @example
 * ```ts
 * const client = createPromptClient({
 * 	url: 'http://localhost:3001/prompts',
-* 	terminal: createTerminal(), // a local PromptFormInterface (T-c)
-* 	on: { connect: () => log('connected') },
+* 	terminal: createTerminal(),
 * })
-* await client.connect() // streams remote prompts to the local terminal, POSTs answers back
+* await client.connect()
 * ```
 */
 var PromptClient = class {
@@ -1544,8 +1360,11 @@ var PromptClient = class {
 	#connecting = false;
 	#connected = false;
 	#destroyed = false;
+	#draining = false;
 	#warnedInsecureToken = false;
 	#seen = /* @__PURE__ */ new Set();
+	#queue = /* @__PURE__ */ new Map();
+	#active;
 	constructor(options) {
 		this.url = options.url;
 		this.#terminal = options.terminal;
@@ -1566,8 +1385,7 @@ var PromptClient = class {
 		return this.#connected;
 	}
 	async connect() {
-		if (this.#destroyed) return;
-		if (this.#connecting) return;
+		if (this.#destroyed || this.#connecting) return;
 		this.#connecting = true;
 		while (this.#connecting && !this.#destroyed) {
 			try {
@@ -1596,7 +1414,7 @@ var PromptClient = class {
 		if (this.#destroyed) return;
 		this.#destroyed = true;
 		this.disconnect();
-		this.#seen.clear();
+		this.#interrupt();
 		this.#emitter.destroy();
 	}
 	async #stream() {
@@ -1622,49 +1440,158 @@ var PromptClient = class {
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (done) break;
-				for (const event of parser.parse(decoder.decode(value, { stream: true }))) await this.#handle(event);
+				for (const event of parser.parse(decoder.decode(value, { stream: true }))) {
+					this.#handle(event);
+					if (!this.#connecting) break;
+				}
+				if (!this.#connecting) break;
 			}
 		} finally {
 			reader.releaseLock();
 		}
 		this.#markDisconnected();
 	}
-	async #handle(event) {
+	#handle(event) {
 		if (event.event === SSE_EVENTS.pending) {
-			const parsed = parseWireJSON(event.data);
-			if (isPendingPrompt(parsed) && !this.#seen.has(parsed.id)) await this.#dispatch(parsed.id, parsed);
+			const parsed = parseJSON(event.data);
+			if (!isPendingForm(parsed) || this.#seen.has(parsed.id)) return;
+			const schema = parseForm(parsed.schema);
+			if (schema === void 0) {
+				this.#emitter.emit("error", /* @__PURE__ */ new Error(`broker sent an invalid form schema for ${parsed.id}`));
+				return;
+			}
+			this.#seen.add(parsed.id);
+			this.#queue.set(parsed.id, sanitizeSchema(schema));
+			this.#drain();
 			return;
 		}
 		if (event.event === SSE_EVENTS.expire) {
-			const parsed = parseWireJSON(event.data);
-			if (isRecord(parsed) && isString(parsed.id)) {
-				this.#seen.delete(parsed.id);
-				this.#emitter.emit("expire", parsed.id);
-			}
+			const parsed = parseJSON(event.data);
+			if (isRecord(parsed) && isString(parsed.id)) this.#expire(parsed.id);
 			return;
 		}
-		if (event.event === SSE_EVENTS.shutdown) this.disconnect();
+		if (event.event === SSE_EVENTS.shutdown) {
+			this.disconnect();
+			this.#interrupt();
+		}
 	}
-	async #dispatch(id, pending) {
-		this.#seen.add(id);
+	async #drain() {
+		if (this.#draining) return;
+		this.#draining = true;
 		try {
-			const value = await dispatchPendingPrompt(this.#terminal, pending);
-			await this.#post(id, value);
-		} catch (error) {
-			this.#emitter.emit("error", error);
+			while (!this.#destroyed) {
+				let queued;
+				for (const entry of this.#queue) {
+					queued = entry;
+					break;
+				}
+				if (queued === void 0) return;
+				const [id, schema] = queued;
+				this.#queue.delete(id);
+				try {
+					await this.#render(id, schema);
+				} catch (error) {
+					const active = this.#active;
+					if (active?.id !== id || !active.stopped) this.#emitter.emit("error", error);
+				} finally {
+					const active = this.#active;
+					if (active?.id === id) {
+						active.form.destroy();
+						this.#active = void 0;
+					}
+					if (!this.#queue.has(id)) this.#seen.delete(id);
+				}
+			}
 		} finally {
-			this.#seen.delete(id);
+			this.#draining = false;
 		}
 	}
-	async #post(id, value) {
-		if (!(await this.#fetch(this.url, {
+	async #render(id, schema) {
+		let values;
+		let errors = [];
+		while (this.#seen.has(id) && !this.#destroyed) {
+			const form = this.#createRenderingForm(schema, values);
+			this.#active = {
+				id,
+				form,
+				stopped: false
+			};
+			for (const error of errors) form.invalidate(error.field, sanitizeDisplayText(error.message));
+			const submitted = await this.#terminal.ask(form);
+			const active = this.#active;
+			if (active?.id !== id || active.stopped) return;
+			const rejected = await this.#post(id, submitted);
+			const posted = this.#active;
+			if (posted?.id !== id || posted.stopped || rejected === void 0) return;
+			values = submitted;
+			errors = rejected;
+			form.destroy();
+			this.#active = void 0;
+		}
+	}
+	#createRenderingForm(schema, values) {
+		const fields = schema.fields.map((field) => {
+			if (field.rule?.pattern === void 0) return field;
+			const { pattern: _pattern, ...rule } = field.rule;
+			return {
+				...field,
+				rule
+			};
+		});
+		const form = createForm({
+			...schema,
+			fields
+		}, values === void 0 ? void 0 : { values });
+		form.answer.catch(() => void 0);
+		return form;
+	}
+	async #post(id, values) {
+		const response = await this.#fetch(this.url, {
 			method: "POST",
 			headers: this.#headers({ "Content-Type": "application/json" }),
 			body: JSON.stringify({
 				id,
-				value
+				values
 			})
-		})).ok) this.#emitter.emit("error", /* @__PURE__ */ new Error(`broker rejected answer ${id}`));
+		});
+		if (!response.ok) this.#emitter.emit("error", /* @__PURE__ */ new Error(`broker rejected answer ${id}`));
+		const parsed = parseJSON(await response.text());
+		if (!isRecord(parsed) || !isBoolean(parsed.success)) {
+			this.#emitter.emit("error", /* @__PURE__ */ new Error(`broker returned an invalid answer result for ${id}`));
+			return;
+		}
+		if (parsed.success) return void 0;
+		const error = parsed.error;
+		if (!isRecord(error) || !isString(error.reason)) {
+			this.#emitter.emit("error", /* @__PURE__ */ new Error(`broker returned an invalid answer error for ${id}`));
+			return;
+		}
+		if (error.reason === "unknown") return void 0;
+		if (error.reason === "rejected" && arrayOf(isFieldError)(error.errors)) return error.errors;
+		this.#emitter.emit("error", /* @__PURE__ */ new Error(`broker returned an invalid answer refusal for ${id}`));
+	}
+	#expire(id) {
+		const active = this.#active;
+		if (active?.id === id) {
+			this.#active = {
+				...active,
+				stopped: true
+			};
+			this.#seen.delete(id);
+			active.form.destroy();
+		} else if (this.#queue.delete(id)) this.#seen.delete(id);
+		this.#emitter.emit("expire", id);
+	}
+	#interrupt() {
+		this.#queue.clear();
+		this.#seen.clear();
+		const active = this.#active;
+		if (active === void 0) return;
+		this.#active = {
+			...active,
+			stopped: true
+		};
+		active.form.destroy();
 	}
 	#markDisconnected() {
 		if (!this.#connected) return;
@@ -1697,8 +1624,8 @@ var PromptClient = class {
 //#region src/core/TerminalManager.ts
 /**
 * The multi-endpoint terminal MANAGER — a registry of named {@link PromptInterface} brokers (one
-* per endpoint), so several parties can `ask` prompts of each other by NAME with a `from` → `to`
-* attribution edge on every parked prompt, and a transitive DEADLOCK check across all in-flight
+* per endpoint), so several parties can `ask` forms of each other by NAME with a `from` → `to`
+* attribution edge on every parked form, and a transitive DEADLOCK check across all in-flight
 * asks.
 *
 * @remarks
@@ -1709,22 +1636,23 @@ var PromptClient = class {
 * - **`ask`.** The target must already be mounted via {@link add} — `ask` never auto-adds it;
 *   rejects `TARGET` for an unknown `to` (listing the known names). Rejects `DEADLOCK` when parking
 *   `from → to` would close a cycle over the CURRENT in-flight edge set (walked transitively);
-*   otherwise parks through the target's broker and resolves with the ORIGINAL ticket Promise (edge
-*   cleanup is attached via `.then`, never altering the value/rejection the caller observes).
+*   otherwise parks the caller's live form through the target's broker and returns that form's own
+*   `answer` promise. Edge cleanup never alters the value or rejection the caller observes.
 * - **Durable open / save.** `open(name)` restores an EMPTY broker from the `store` (parked
 *   Promises are process-bound and never resurrected); `save(name)` persists the endpoint's
 *   configured `timeout`.
-* - **Removal.** `remove` drops one endpoint or a batch (§9.2, array overload FIRST), destroying
-*   each broker (which expires every prompt still parked on it). `clear` drops all; `destroy` is
-*   idempotent.
+* - **Removal.** `remove` drops one endpoint, a batch (§9.2, array overload FIRST), or every
+*   endpoint when called without an argument. It destroys each broker, which expires every form
+*   still parked on it. `destroy` is idempotent.
 *
 * @example
 * ```ts
+* const form = createForm({ fields: [{ control: 'text', name: 'name' }] })
 * const manager = new TerminalManager()
 * manager.add('agent')
-* const name = manager.ask('user', 'agent', 'input', { message: 'Your name' })
-* manager.answer('agent', manager.pending('agent')[0].id, 'Ada')
-* await name // 'Ada'
+* const answer = manager.ask('user', 'agent', form)
+* manager.answer('agent', manager.pending('agent')[0].id, { name: 'Ada' })
+* await answer // { name: 'Ada' }
 * ```
 */
 var TerminalManager = class {
@@ -1768,6 +1696,8 @@ var TerminalManager = class {
 		const timer = options?.timer ?? this.#timer;
 		const cap = options?.cap ?? this.#cap;
 		const broker = createPrompt({
+			...options?.on !== void 0 ? { on: options.on } : {},
+			...options?.error !== void 0 ? { error: options.error } : {},
 			...timeout !== void 0 ? { timeout } : {},
 			...timer !== void 0 ? { timer } : {},
 			...cap !== void 0 ? { cap } : {}
@@ -1781,11 +1711,11 @@ var TerminalManager = class {
 		broker.emitter.on("answer", listeners.answer);
 		broker.emitter.on("expire", listeners.expire);
 		this.#terminals.set(name, broker);
-		this.#config.set(name, options ?? {});
+		this.#config.set(name, { ...options });
 		this.#listeners.set(name, listeners);
 		return broker;
 	}
-	ask(from, to, form, options) {
+	ask(from, to, form) {
 		const broker = this.#terminals.get(to);
 		if (broker === void 0) {
 			const known = this.terminals();
@@ -1800,21 +1730,18 @@ var TerminalManager = class {
 			to,
 			path: cycle
 		}));
-		const ticket = broker.park({
-			form,
-			options,
+		const id = broker.park(form, {
 			from,
 			to
 		});
-		if (broker.pending(ticket.id) !== void 0) {
-			this.#edges.set(ticket.id, {
+		if (broker.pending(id) !== void 0) {
+			this.#edges.set(id, {
 				from,
 				to
 			});
-			const clear = this.#createEdgeClear(ticket.id);
-			ticket.value.then(clear, clear);
+			form.answer.then(this.#createEdgeClear(id), this.#createEdgeClear(id));
 		}
-		return ticket.value;
+		return form.answer;
 	}
 	pending(to) {
 		if (to !== void 0) {
@@ -1825,13 +1752,15 @@ var TerminalManager = class {
 		for (const broker of this.#terminals.values()) result.push(...broker.pending());
 		return result;
 	}
-	answer(to, id, value) {
+	answer(to, id, values) {
 		const broker = this.#terminals.get(to);
 		if (broker === void 0) return {
 			success: false,
-			error: "terminal"
+			error: { reason: "terminal" }
 		};
-		return broker.answer(id, value);
+		const result = broker.answer(id, values);
+		if (result.success) this.#edges.delete(id);
+		return result;
 	}
 	async open(name) {
 		if (this.#destroyed) throw new TerminalError("DESTROYED", "manager destroyed");
@@ -1855,6 +1784,10 @@ var TerminalManager = class {
 		return true;
 	}
 	remove(names) {
+		if (names === void 0) {
+			for (const name of [...this.#terminals.keys()]) this.#removeOne(name);
+			return;
+		}
 		if (isArray(names)) {
 			let removed = false;
 			for (const name of names) if (this.#removeOne(name)) removed = true;
@@ -1862,23 +1795,27 @@ var TerminalManager = class {
 		}
 		return this.#removeOne(names);
 	}
-	clear() {
-		for (const name of [...this.#terminals.keys()]) this.#removeOne(name);
-	}
 	destroy() {
 		if (this.#destroyed) return;
 		this.#destroyed = true;
-		this.clear();
+		this.remove();
+		this.#edges.clear();
 		this.#emitter.destroy();
 	}
 	#createPendingListener() {
-		return (prompt) => this.#emitter.emit("pending", prompt);
+		return (form) => this.#emitter.emit("pending", form);
 	}
 	#createAnswerListener(name) {
-		return (id, value) => this.#emitter.emit("answer", name, id, value);
+		return (id, values) => {
+			this.#edges.delete(id);
+			this.#emitter.emit("answer", name, id, values);
+		};
 	}
 	#createExpireListener(name) {
-		return (id) => this.#emitter.emit("expire", name, id);
+		return (id) => {
+			this.#edges.delete(id);
+			this.#emitter.emit("expire", name, id);
+		};
 	}
 	#createEdgeClear(id) {
 		return () => {
@@ -1898,8 +1835,12 @@ var TerminalManager = class {
 		this.#terminals.delete(name);
 		this.#config.delete(name);
 		this.#listeners.delete(name);
+		this.#clearEdges(name);
 		return true;
 	}
+	#clearEdges(to) {
+		for (const [id, edge] of this.#edges) if (edge.to === to) this.#edges.delete(id);
+	}
 	#findCycle(from, to) {
 		if (from === to) return [from, to];
 		const visited = /* @__PURE__ */ new Set([to]);
@@ -2047,30 +1988,26 @@ var DatabaseTerminalStore = class {
 //#endregion
 //#region src/core/factories.ts
 /**
-* Create the headless prompt {@link PromptInterface} BROKER — it parks each prompt call as a
-* pending prompt and resolves it when {@link PromptInterface.answer} arrives (or rejects on
-* timeout). The tri-surface's headless arm: subscribe `emitter.on('pending', …)` to forward each
-* prompt to whoever can answer (an SSE transport, a remote terminal), then route the answer back
-* through `answer(id, value)`.
+* Create the headless {@link PromptInterface} broker. It parks live forms and applies remote
+* answers to the authoritative instances.
 *
 * @param options - See {@link PromptOptions}
 * @returns A {@link PromptInterface}
 *
 * @remarks
-* - **Park-as-Promise.** `await prompt.input({ message })` blocks until `answer(id, value)` accepts
-*   a matching value; the value is validated (text forms) and type-checked to the form first.
-* - **Timeout → expire → reject (deterministic).** An unanswered prompt expires after
-*   `options.timeout` (default {@link import('./constants.js').DEFAULT_PROMPT_TIMEOUT_MS}) and its
-*   Promise rejects with a {@link import('./errors.js').TerminalError}; inject `options.timer` to
-*   drive expiry without real time.
+* The caller awaits the parked form's own `answer`. Timeout or teardown destroys the form, so that
+* promise rejects with the Form package's `ABANDONED` error. Inject `options.timer` to drive
+* expiry without real time.
 *
 * @example
 * ```ts
 * import { createPrompt } from '@src/core'
+* import { createForm } from '@orkestrel/form'
 *
 * const prompt = createPrompt()
-* prompt.emitter.on('pending', (pending) => send(pending)) // forward to a remote client
-* const name = await prompt.input({ message: 'Your name', validate: { required: true } })
+* const form = createForm({ fields: [{ control: 'text', name: 'name' }] })
+* const id = prompt.park(form)
+* prompt.answer(id, { name: 'Ada' })
 * ```
 */
 function createPrompt(options) {
@@ -2078,9 +2015,8 @@ function createPrompt(options) {
 }
 /**
 * Create the SSE prompt {@link PromptClientInterface} BRIDGE — it connects to a remote broker's SSE
-* endpoint, dispatches each received prompt to a LOCAL {@link import('./types.js').PromptFormInterface}
-* terminal (so a human at this machine answers a prompt parked elsewhere), and POSTs the answer
-* back. Universal — `fetch` / SSE are web-standard.
+* endpoint, dispatches each received form to a local {@link import('./types.js').TerminalInterface},
+* and POSTs the answer back. Universal — `fetch` / SSE are web-standard.
 *
 * @param options - See {@link PromptClientOptions} (`url` + `terminal` required)
 * @returns A {@link PromptClientInterface}
@@ -2104,12 +2040,12 @@ function createPromptClient(options) {
 	return new PromptClient(options);
 }
 /**
-* Create the multi-endpoint {@link TerminalManagerInterface} — a named registry of
+* Create the multi-endpoint {@link TerminalManager} — a named registry of
 * {@link PromptInterface} brokers so several parties can `ask` prompts of each other by name,
 * with a transitive DEADLOCK check across every in-flight ask.
 *
 * @param options - See {@link TerminalManagerOptions}
-* @returns A {@link TerminalManagerInterface}
+* @returns A {@link TerminalManager}
 *
 * @example
 * ```ts
@@ -2163,6 +2099,6 @@ function createDatabaseTerminalStore(driver = createMemoryDriver()) {
 	}).table("terminals"));
 }
 //#endregion
-export { ACCEPT_EVENT_STREAM, ALPHANUMERIC_PATTERN, BACKSPACE, CONTROL_NAMES, CTRL_A, CTRL_C, CTRL_D, CTRL_E, CTRL_U, DEFAULT_MASK, DEFAULT_PROMPT_TIMEOUT_MS, DEFAULT_RECONNECT_DELAY_MS, DELETE, DatabaseTerminalStore, EMAIL_PATTERN, ESCAPE, HEADER_TOKEN, INTEGER_PATTERN, KEY_CSI, KEY_SS3, MemoryTerminalStore, NEWLINE, NUMERIC_PATTERN, PROMPT_ICONS, Prompt, PromptClient, RETURN, RULE_MESSAGES, SEQUENCE_NAMES, SPACE, SSE_BUFFER_LIMIT, SSE_EVENTS, TAB, TerminalError, TerminalManager, URL_PATTERN, appendRule, buildRuleValidator, checkboxReduce, checkboxView, composeValidators, confirmReduce, confirmView, createCheckboxState, createConfirmState, createDatabaseTerminalStore, createEditorState, createInputState, createMemoryTerminalStore, createPasswordState, createPrompt, createPromptClient, createSelectState, createTerminalManager, defaultTimer, dispatchPendingPrompt, editLine, editorReduce, editorView, errorLine, evaluateRule, gateSelection, globalFetch, inputReduce, inputView, isAbortError, isAnswerPayload, isCheckboxChoice, isInsecureRemote, isPendingPrompt, isPendingPromptStatus, isPrintable, isPromptChoice, isPromptType, isTerminalError, isTerminalSnapshot, normalizeCheckboxChoice, normalizeChoice, parseKey, parseWireJSON, passing, passwordReduce, passwordView, promptHeader, reconstructValidationRules, resolveChoices, resolveOption, resolveValidation, sanitizeChoiceLabels, selectReduce, selectView, serializeChoices, serializeExpire, serializePending, serializePromptOptions, serializeShutdown, serializeValidationRules, submitHeader, toggleIndex };
+export { ACCEPT_EVENT_STREAM, BACKSPACE, CONTROL_NAMES, CTRL_A, CTRL_C, CTRL_D, CTRL_E, CTRL_U, DEFAULT_MASK, DEFAULT_PROMPT_THEME, DEFAULT_PROMPT_TIMEOUT_MS, DEFAULT_RECONNECT_DELAY_MS, DELETE, DatabaseTerminalStore, ESCAPE, HEADER_TOKEN, KEY_CSI, KEY_SS3, MemoryTerminalStore, NEWLINE, PROMPT_ICONS, PROMPT_ROLES, Prompt, PromptClient, RETURN, SEQUENCE_NAMES, SPACE, SSE_BUFFER_LIMIT, SSE_EVENTS, TAB, TerminalError, TerminalManager, checkboxReduce, checkboxView, confirmReduce, confirmView, createCheckboxState, createConfirmState, createDatabaseTerminalStore, createEditorState, createInputState, createMemoryTerminalStore, createPasswordState, createPrompt, createPromptClient, createPromptTheme, createSelectState, createTerminalManager, defaultTimer, editLine, editorReduce, editorView, errorLine, globalFetch, hintedHeader, inputReduce, inputView, isAbortError, isInsecureRemote, isPendingForm, isPendingFormStatus, isPrintable, isTerminalError, isTerminalSnapshot, isWireEvent, parseKey, passwordReduce, passwordView, promptHeader, sanitizeDisplayText, sanitizeSchema, sanitizeThemeIcons, selectReduce, selectView, serializeExpire, serializePending, serializeShutdown, submitHeader, toggleIndex };
 
 //# sourceMappingURL=index.js.map