feat(spec,rest,lint)!: retire the form field's publicPicker and the anonymous lookup route (#21180) (#21222)

Fixes #21180

Clause-②: yes (narrowing)

Retires the form field's `publicPicker` block and deletes the anonymous
lookup route `GET /forms/:slug/lookup/:field`. This is the second half
of ruling E on #21079 (record `5933054144`, maintainer 「同意E」,
2026-10-01). Anonymous public forms no longer take lookup,
`master_detail` or `user` fields. The ruling reverses the #7467 model
("declare `publicPicker`"). It is an immediate retirement under ADR-0087
D2: no alias window and no dual spelling. No new gate: the resolve
route's existing strip becomes unconditional.

The ADR-0061 note rides a separate docs-only PR (Tier H), not this one.

## What changed

| surface | change |
| --- | --- |
| spec | `FormFieldBaseSchema.publicPicker` is a `retiredKey()`
tombstone carrying the card's prescription (FROM → TO below).
`FormFieldPublicPickerSchema`, `FormFieldPublicPicker` and
`FormFieldPublicPickerParsed` are deleted (no other reader). |
| ADR-0087 | D2 conversion `form-field-public-picker-removed` (protocol
18, `retiredFromLoadPath`, `retiredAfter: 17.5.0`, order 53). One
`STEP18_RATIONALE` fragment. D3 semantic entry
`form-field-public-picker-retired`. `RETIRED_KEYS_BY_MAJOR[18]` gets
`ui/FormField:publicPicker` and `RETIRED_DEFS_BY_MAJOR[18]` gets
`ui/FormFieldPublicPicker`. The registry is regenerated by
`gen:migration-registry`, never hand-typed inside its markers. |
| rest | The picker handler is deleted, with its literal `guest_portal`
picker context and its picker-only helper `view-filter-rule-lowering.ts`
(no other importer, not exported). The ledger row
(`rest-route-ledger.ts`) goes too. The resolve route's strip loses its
`publicPicker` condition: lookup / `master_detail` / `user` fields are
always left off the anonymous rendering. |
| error codes | `LOOKUP_NOT_PUBLIC` and `LOOKUP_TARGET_MISSING` leave
`error-code-ledger.zod.ts`. This follows the ledger's own retirement
rule ("A row whose last EMITTER is deleted comes out with it"), so the
row is deleted, with no graded tombstone. The picker handler was the
only producer of both codes. |
| lint | The `publicPicker` claiming reader in
`validate-preset-comparands.ts` is removed, with its cases. The
now-unused `graph` parameter of `boundObjectOf` / `bindAncestors` goes
too (`noUnusedParameters`). |
| tests | Deleted: `public-form-lookup-picker.test.ts`,
`public-form-lookup-picker-queryable-key.test.ts`,
`public-form-lookup-filter-lowering.test.ts`,
`view-public-picker.test.ts`,
`public-picker-queryable-key.dogfood.test.ts`. Re-pinned:
`public-form-routes.test.ts`, `public-form-routes.stored-row.test.ts`,
`rest-server-query-number-census.test.ts`,
`rest-server-canonical-query-ast.test.ts`,
`view-union-branch-focus.test.ts`, `protocol.save-union-issues.test.ts`,
and the picker door case of `zero-set-masking.dogfood.test.ts`. New:
`form-field-public-picker-retirement.test.ts` (tombstone at four doors,
the conversion, registration, and a tree-scoped absence pin over the
radius already declared for `@objectstack/spec`). |
| docs | The picker section of `content/docs/ui/forms.mdx` is replaced
by a short statement of current behaviour. The references regenerate.
The platform checklist item `access-security.public-form-intake` moves
to revision 2: its 403 clause now asserts the route's absence. |
| generated / ledgers | Regenerated: api-surface, export-origins,
declaration-map, json-schema manifest, authorable-surface (the def's
four lines deleted deliberately, the key marked `[RETIRED]`), strictness
counts and references. `dropped-refinements.baseline.json` is corrected
as the build printed it. `engine-double-contract.pinned.json` is
regenerated with `--write`: 6 losses, all from the two deleted test
files. The `check:route-envelope` pins are banked: 43 → 39 and 58 → 54,
the four `{ code, error }` answers the deleted handler carried. |
| changeset | `.changeset/21180-retire-public-picker.md`: BREAKING,
`Clause-②: yes (narrowing)`, the card's FROM → TO, and the ADR-0087
marker `registered form-field-public-picker-removed,
form-field-public-picker-retired`. |

**FROM → TO:** delete the `publicPicker` block; an anonymous public form
no longer offers record search. Use a `select` field with static
`options`, or put the form behind sign-in.

## The PM's hypotheses, measured

- **H1, the census.** At BASE `b9087d77e9`: 280 lines. By pattern:
`publicPicker` 129, `FormFieldPublicPicker` 43, `LOOKUP_NOT_PUBLIC` 19,
`/lookup/:field` 35, `guest_portal` 65. No producer exists outside spec,
tests, docs and the REST route; no example declares one. After, at
`dafa22868`: `publicPicker` 106, `FormFieldPublicPicker` 10,
`LOOKUP_NOT_PUBLIC` 0, `/lookup/:field` 15, `guest_portal` 59. The kit
accounts for the residue: the tombstone, the conversion and registry
entries, the retirement and union pins, the H2/H3 pins, and generated
artefacts (references, authorable-surface, and the base anchor, which
only its own generator writes). Untouched history also remains: two
dated audits, `releases/v15.mdx`, the ADR-0061 sentence, and the pending
`.changeset/21062-picker-queryable-key.md`. `guest_portal` remains as
permission-set names (examples, plugin-security tests, the published
skill's resolve/submit text) and as the submit route's context. In
`rest-server.ts` the picker's literal context was 1 of the 7 lines; the
other 6 are the submit route and its docblock. All of those are outside
this card.
- **H2, the strip depended on the key.** It did: `if (t !== 'lookup' &&
t !== 'master_detail' && t !== 'user') return true; return
!!cfg?.publicPicker;`. The condition is deleted; the function now
returns the type test, with no new branch. Pinned by a stored row
carrying the old block on a lookup, a `master_detail` and a `user`
field: only the text field `subject` renders.
- **H3, gone, not refused.** On the in-process `HonoHttpServer`, with
the unmatched-request seam installed as `HonoServerPlugin.start()`
installs it, `GET /api/v1/forms/test/lookup/owner_id` answers `404` with
`error.code` `ENDPOINT_NOT_FOUND`. That body is byte-identical (path
aside) to a never-registered sibling path, and `findData` is never
called. The registered resolve route on the same harness answers 200,
the lit control.
- **H4, the ledger rule.** Deletion, per the rule's own text. The
`objectui` consumer check: zero readers at the old pin `e420df310f` and
the new pin `31971ff1e2` (only an exemption reason string in a parity
test). The `cloud` consumer check is NOT MEASURED: code search returned
zero for both the codes and a lit control (`"@objectstack/spec"`), so it
cannot see that repository.
- **H5, `os validate` on a fixture.** Before, at BASE: the fixture
authoring `publicPicker: { displayFields: ['name'], maxResults: 10 }`
gave exit 0, `valid: true`. After: exit 1, `valid: false`. The text face
prints the prescription at
`views.0.formViews.contact.sections.0.fields.1.publicPicker`. The
control fixture, identical without the key, gives exit 0 both times.
- **Pin stop condition.** objectui at `.objectui-sha` imports neither
name at `e420df310f` nor, after #21149 moved it, at `31971ff1e2`: 7
string mentions and 0 import lines, with a lit control of 392 files
importing `@objectstack/spec/ui`. Its spec-parity test enumerates
`FormFieldSchema.in.shape`, and the tombstone keeps the key there. No
pin bump rides this PR.

## Reverse verification (the fix committed first, then BASE's route code
restored)

Run against `rest-server.ts` and the lowering module restored from BASE
(blob `c673773e46`, verified on disk by hash). The pins import source,
so no rebuild was needed. All three new pins went red in the expected
direction:

- strip: `expected [ 'subject', 'contact_id', …(2) ] to deeply equal [
'subject' ]`
- route registered: `expected true to be false`
- route answer: `expected 403 to be 404`

The other 20 cases in the file stayed green. Restore: back to the HEAD
blob `b52e360ec3`, `git diff HEAD` empty, `git status` clean, with a
trap on the script.

## Tests and gates (head `dafa22868`, after merging `main` at
`5e5ce48ce`)

- `@objectstack/rest`, whole package: 252 files, 4776 passed. Typecheck
green, including `check:test-typecheck`.
- `@objectstack/lint`, whole package (pre-merge, untouched by `main`):
118 files, 5486 passed. Typecheck green.
- `@objectstack/spec`: the local project ran 593 files with one failure,
the ledger's header totals (fixed: 212 → 210 schemas, 617 → 613 sites),
then 27/27. The repo project: 48 files, 849 passed. After the merge:
`src/ui`, `src/conversions`, `src/migrations`, error-code ledger,
migrate-sentence, alias-integrity and the merge-shape scripts give 120
files, 4299 passed. `check:generated`: 15/15 current. Typecheck green,
including `check:scripts-typecheck` and `check:test-typecheck`, which
compiles the new test's `@ts-expect-error`.
- `@objectstack/metadata-protocol`: `protocol.save-union-issues.test.ts`
25/25. Typecheck green.
- `@objectstack/cli`: unit tier 242 files, 3435 passed. The integration
tier is declared to CI.
- `@objectstack/dogfood`: `zero-set-masking` and
`expression-conformance`, 8/8. Typecheck green.
- Derived gates: `dispatch-gates --commands` on this head gives 138
families. All 138 ran to exit 0. `--ran` reconciliation: 138 run, 0
NOT-MEASURED, a derived zero with every exit code recorded. Three
refusals were cleared by building their prerequisites, not by skipping:
`check:skill-examples` and `check:dual-build-cjs-loads` exited 3 until
seven packages outside this diff were built. `check:pm-dispatch-gates`
and `check:type-check-debt` were re-run without the runner's 480 s cap.
- Lint, as a proven narrowing: eslint's own config lints
`**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}` and enables no type-aware
linting. The 21 touched code files were all linted (`--format json`): 0
errors, 0 warnings. The repo-wide `pnpm lint` is CI's.
- Changeset gates, against BASE: `check:adr-0087-registration`
(registered, both ids new here), `check:empty-changeset`,
`check-changeset-no-major` and `check:doc-authoring` all pass. The level
axis needs this PR's payload, so CI judges it.

## Serial with #21079 (PR #21217)

At open time PR #21217 is a draft and not merged, so this PR is first of
the pair. This branch deletes both of #21062's picker pins and removes
the picker door case of `zero-set-masking.dogfood.test.ts`, along with
the public form and inquiry object only that case booted, since the
fixture can no longer carry the retired key. The record-door case is
byte-identical. If #21217 lands first, `main` gets merged here and these
deletions are kept. `security-plugin.ts` and `security-service.ts` are
untouched.

## Acceptance notes (observed, not filed)

- `.changeset/21062-picker-queryable-key.md` is an unreleased changeset
describing a change to the route this PR deletes. If both ship in one
release, the compiled notes will describe a route that no longer exists.
Left for the release compiler; this PR does not edit another PR's
changeset.
- `objectSchema` from `GET /forms/:slug` still publishes the definitions
of declared lookup / `master_detail` / `user` fields. The ruled strip
covers the rendered sections only, and widening it would be a new gate.
- `ISecurityService.getQueryableFields` loses its only REST reader with
the picker (`#20935`). The method stays: it lives in #21079's surface.
- objectui's parity test carries an exemption reason that describes the
retired route. It stays accurate until objectui moves to the spec
release that carries this; then its prose is stale (the key stays in the
shape).
- Two dated audits (`docs/audits/2026-06-*`) and the ADR-0096 table name
the route as history and are left as written.

## Deviations

- Changeset grade is `minor`, not `major`: the skill and
`check-changeset-no-major` refuse `major` in the launch window. BREAKING
is carried by the banner, the `Clause-②` line and the ADR-0087 marker.
- `LOOKUP_TARGET_MISSING` also leaves the ledger. The card names only
`LOOKUP_NOT_PUBLIC`, but the ledger's rule applies to both, and the
deleted handler was the only producer of each.
- The claim's file surface did not name `view-filter-rule-lowering.ts`
(the picker-only helper), `retired-defs/18.ui__FormFieldPublicPicker.ts`
(required by the build's manifest-deletion gate),
`dropped-refinements.baseline.json`,
`engine-double-contract.pinned.json`, `scripts/check-route-envelope.mjs`
(ratchet banking), `metadata-protocol` (a stale comment and a test that
rode the key), or the platform checklist item. Each follows mechanically
from the deletion.
- `migrations/registry.ts`: the generated regions come from
`gen:migration-registry`. The one hand edit is the `STEP18_RATIONALE`
fragment outside the markers, which the retirement skill requires.

---
_Generated by [Claude
Code](https://claude.ai/code/session_017VaLJnYwhPsanVCe9dMCJU)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/21180-retire-public-picker.md

@@ -0,0 +1,41 @@
+---
+'@objectstack/spec': minor
+'@objectstack/rest': minor
+'@objectstack/lint': patch
+---
+
+**BREAKING** — an anonymous public form no longer offers record search. The form field's `publicPicker` block (`view.form.sections[].fields[].publicPicker`: `displayFields`, `maxResults`, `filter`, `object`) is removed, and the anonymous lookup route `GET /api/v1/forms/:slug/lookup/:field` is deleted. A public form's `lookup`, `master_detail` and `user` fields are now always left off its anonymous rendering, whatever the form declares.
+
+Clause-②: yes (narrowing)
+
+Retired immediately (ADR-0087 D2), with no alias window: the maintainer's ruling reverses the earlier one that had declared the key. Mainstream web-to-lead forms do not let an anonymous visitor search records either, and no example, template, plugin or first-party UI declared or called the picker.
+
+## FROM → TO
+
+| you wrote (17.5 and earlier) | write instead |
+| --- | --- |
+| `{ field: 'account', publicPicker: { displayFields: ['name'], maxResults: 10 } }` on a public form | delete the `publicPicker` block — the field is left off the anonymous rendering anyway |
+| a public form whose visitors chose from a short, fixed list of records | a `select` field with static `options` listing the choices |
+| a public form whose visitors had to pick an existing record | the same form behind sign-in (an internal form), where the lookup field searches with the signed-in user's own access |
+| a client calling `GET /api/v1/forms/:slug/lookup/:field` | nothing to call: the path is no longer registered and answers what any unregistered path answers (`404 ENDPOINT_NOT_FOUND`) |
+
+**The one-line fix:** delete the `publicPicker` block; an anonymous public form no longer offers record search. Use a `select` field with static `options`, or put the form behind sign-in.
+
+**What an author who still writes it sees.** `tsc` fails at the authoring site (`FormFieldInput` types the key `never`), and the parse — `defineView()`, `defineStack({ views })`, `os validate`, `PUT /api/v1/meta/view/:name` — refuses it at `…sections[N].fields[N].publicPicker` with the prescription:
+
+> `view.form.sections[].fields[].publicPicker` was removed in @objectstack/spec 17.6.0 (ADR-0087 D2) — an anonymous public form no longer offers record search: lookup, `master_detail` and `user` fields are always left off the anonymous rendering, and the anonymous record-search route (`GET /forms/:slug/lookup/:field`) no longer exists. Delete the key (the whole `publicPicker` block). To let a visitor choose from a fixed list, use a `select` field with static `options`; to let them pick an existing record, put the form behind sign-in. Run `os migrate meta --from 17` to list the mechanical edits for existing sources; apply them by hand.
+
+**What a REST client sees.** The two error codes only that route produced, `LOOKUP_NOT_PUBLIC` and `LOOKUP_TARGET_MISSING`, leave the error-code ledger with it. `GET /api/v1/forms/:slug` and `POST /api/v1/forms/:slug/submit` are unchanged apart from the unconditional strip above.
+
+## The retirement kit
+
+- **A `retiredKey()` tombstone on the form field**, so the parse carries the prescription instead of a bare unknown-key verdict. The block's own schema and its two types go with it: `FormFieldPublicPickerSchema`, `FormFieldPublicPicker` and `FormFieldPublicPickerParsed` are no longer exported, and `ui/FormFieldPublicPicker` is no longer published as a JSON Schema.
+- **The D2 conversion `form-field-public-picker-removed`** (protocol 18, retired from the load path) deletes the key from every form field of every form payload — `sections[]`, `groups[]`, top-level `fields[]` and nested rows. Its D3 record is the semantic entry `form-field-public-picker-retired`, which asks the author how a visitor should now choose.
+- **`@objectstack/rest`:** the lookup route and its filter-lowering helper are deleted, and the resolve route's strip of lookup / `master_detail` / `user` fields no longer has an opt-in.
+- **`@objectstack/lint`:** the preset-comparand rule no longer reads a picker's `filter` (its claiming reader for that position went with the key).
+
+## What an operator with a STORED form sees
+
+A `sys_metadata` view row saved before this release may still carry the key. Nothing breaks at read: the conversion replays on rehydration and strips it, so the view is served canonical and parses, and the field stays off the anonymous rendering either way. `os migrate meta --stored` lists those rows, and `--apply` rewrites them.
+
+<!-- adr-0087: registered form-field-public-picker-removed, form-field-public-picker-retired -->

content/docs/references/api/contract.mdx

@@ -28,7 +28,7 @@ const result = ApiErrorSchema.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +322 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +320 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
 | **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
 | **message** | `string` | ✅ | Readable error message |
 | **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
@@ -218,8 +218,6 @@ const result = ApiErrorSchema.parse(data);
 * `IP_NOT_ALLOWED`
 * `ITEM_LOCKED`
 * `LAST_LOCAL_CREDENTIAL`
-* `LOOKUP_NOT_PUBLIC`
-* `LOOKUP_TARGET_MISSING`
 * `MANIFEST_CONFLICT`
 * `MAPPING_FORMAT_MISMATCH`
 * `MAPPING_FORMAT_UNSUPPORTED`

content/docs/references/api/error-code-ledger.mdx

@@ -385,8 +385,6 @@ const result = ErrorCode.parse(data);
 * `IP_NOT_ALLOWED`
 * `ITEM_LOCKED`
 * `LAST_LOCAL_CREDENTIAL`
-* `LOOKUP_NOT_PUBLIC`
-* `LOOKUP_TARGET_MISSING`
 * `MANIFEST_CONFLICT`
 * `MAPPING_FORMAT_MISMATCH`
 * `MAPPING_FORMAT_UNSUPPORTED`

content/docs/references/index.mdx

@@ -1,7 +1,7 @@
 ---
 title: Protocol reference — every schema by module
 navTitle: Protocol Reference
-description: Every schema published by @objectstack/spec — 1522 schemas across 14 protocol modules
+description: Every schema published by @objectstack/spec — 1521 schemas across 14 protocol modules
 ---
 
 {/* ⚠️  AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs live in the module folders under content/docs/. */}
@@ -33,8 +33,8 @@ counts are sums of the rows they head. Regenerate with
 | [Shared Protocol](/docs/references/shared) | 10 | 31 | Primitives used across every protocol — identifiers, HTTP, expressions, error maps, enums. |
 | [Studio Protocol](/docs/references/studio) | 3 | 35 | Studio designer metadata — the authoring surfaces for the protocols above. |
 | [System Protocol](/docs/references/system) | 34 | 275 | The runtime environment — logging, jobs, cache, metrics, notifications, i18n and compliance. |
-| [UI Protocol](/docs/references/ui) | 16 | 166 | Apps, pages, views, dashboards, reports, actions and themes — the ObjectUI layer. |
-| **Total** | **197** | **1522** | 14 protocol modules |
+| [UI Protocol](/docs/references/ui) | 16 | 165 | Apps, pages, views, dashboards, reports, actions and themes — the ObjectUI layer. |
+| **Total** | **197** | **1521** | 14 protocol modules |
 
 ---
 
@@ -364,7 +364,7 @@ The runtime environment — logging, jobs, cache, metrics, notifications, i18n a
 
 ## UI Protocol
 
-**Source:** `packages/spec/src/ui/` · **Import:** `@objectstack/spec/ui` · **16 pages, 166 schemas**
+**Source:** `packages/spec/src/ui/` · **Import:** `@objectstack/spec/ui` · **16 pages, 165 schemas**
 
 Apps, pages, views, dashboards, reports, actions and themes — the ObjectUI layer.
 
@@ -385,7 +385,7 @@ Apps, pages, views, dashboards, reports, actions and themes — the ObjectUI lay
 | [`report.zod.ts`](/docs/references/ui/report) | `JoinedReportBlock`, `Report`, `ReportChart`, `ReportSort`, `ReportType` |
 | [`responsive.zod.ts`](/docs/references/ui/responsive) | `ResponsiveStyles`, `StyleMap` |
 | [`sharing.zod.ts`](/docs/references/ui/sharing) | `SharingConfig` |
-| [`view.zod.ts`](/docs/references/ui/view) | `AddRecordConfig`, `AppearanceConfig`, `CalendarConfig`, `ColumnPrefix`, `ColumnSummary`, `ColumnSummaryConfig`, `EmptyState`, `FormButtonConfig`, `FormField`, `FormFieldPublicPicker`, `FormSection`, `FormSelectOption`, `FormView`, `GalleryConfig`, `GanttConfig`, `GanttQuickFilter`, `GroupingConfig`, `GroupingField`, `HttpMethodSubset`, `HttpRequest`, `KanbanConfig`, `ListChartConfig`, `ListColumn`, `ListMapConfig`, `ListView`, `NavigationConfig`, `NavigationMode`, `ObjectListView`, `ObjectUserFilters`, `PaginationConfig`, `RowColorConfig`, `RowHeight`, `SelectionConfig`, `TimelineConfig`, `TreeConfig`, `UserActionsConfig`, `UserFilterField`, `UserFilters`, `View`, `ViewData`, `ViewFilterRule`, `ViewItem`, `ViewItemName`, `ViewItemWire`, `ViewKind`, `ViewScope`, `ViewSharing`, `ViewTab`, `VisualizationType` |
+| [`view.zod.ts`](/docs/references/ui/view) | `AddRecordConfig`, `AppearanceConfig`, `CalendarConfig`, `ColumnPrefix`, `ColumnSummary`, `ColumnSummaryConfig`, `EmptyState`, `FormButtonConfig`, `FormField`, `FormSection`, `FormSelectOption`, `FormView`, `GalleryConfig`, `GanttConfig`, `GanttQuickFilter`, `GroupingConfig`, `GroupingField`, `HttpMethodSubset`, `HttpRequest`, `KanbanConfig`, `ListChartConfig`, `ListColumn`, `ListMapConfig`, `ListView`, `NavigationConfig`, `NavigationMode`, `ObjectListView`, `ObjectUserFilters`, `PaginationConfig`, `RowColorConfig`, `RowHeight`, `SelectionConfig`, `TimelineConfig`, `TreeConfig`, `UserActionsConfig`, `UserFilterField`, `UserFilters`, `View`, `ViewData`, `ViewFilterRule`, `ViewItem`, `ViewItemName`, `ViewItemWire`, `ViewKind`, `ViewScope`, `ViewSharing`, `ViewTab`, `VisualizationType` |
 
 ---