RubyGems - unpoly-rails - Versions diffs - 2.2.1 → 2.3.0 - Mend

unpoly-rails 2.2.1 → 2.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of unpoly-rails might be problematic. Click here for more details.

Files changed (11) hide show

checksums.yaml +4 -4
data/README.md +25 -0
data/assets/unpoly/unpoly-migrate.js +39 -14
data/assets/unpoly/unpoly-migrate.min.js +1 -1
data/assets/unpoly/unpoly.es5.js +746 -298
data/assets/unpoly/unpoly.es5.min.js +1 -1
data/assets/unpoly/unpoly.js +738 -309
data/assets/unpoly/unpoly.min.js +1 -1
data/lib/unpoly/rails/change.rb +13 -0
data/lib/unpoly/rails/version.rb +1 -1
metadata +2 -2

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7809f10d4c1b68d409df8b692a4ec180664a84e8bf5f11f5ada7477b908a6c52
-  data.tar.gz: daa269b194e0ae2779ee6a087aeac46d04054c995e713c9905bbb8a67c7e0d13
+  metadata.gz: 91c3f510e29295809e0304db849e1853897d8f14fbe6b363519458dca5c0294a
+  data.tar.gz: 43a927f3a2946f63e02c2676514eeee7d5689750e38de4528d6d140e1be2a47e
 SHA512:
-  metadata.gz: 69401e8930e26d6388502b1e0693929bdc5ba6ba12548326660289ccbe459cf6dc376c5820c914a6634913c352723e01c1cf4f3ecf3bc877fc80828687edeb56
-  data.tar.gz: c4fb6d692762c58efc8a2ce01f632b277184ff9d7691942939da1277aa8021f501c65df5d355d33264a16871ae4f74e29c66da39341830050b252b3913de9060
+  metadata.gz: 501d2a3533c6c3225fd702d6ce4de682c0359d13f9e8063c1390c547ec8782afb0f70597e9b768ce945b69fde2b72c21a1bcc099c13b15d7107207201ebd5300
+  data.tar.gz: 513bbe7a3764942a35696d3ea5d7335fff289b914732a1b17bbe31f5da896ca7979f263e8fa000373641dd939f1a2e1bb2c26cf6b5290325fc24598b2cff8a3a

data/README.md CHANGED Viewed

@@ -242,6 +242,31 @@ Only rendering when needed saves <b>CPU time</b> on your server, which spends mo
 This also reduces the <b>bandwidth cost</b> for a request/response exchange to **~1 KB**.
+### Allowing callbacks with a strict CSP
+When your Content Security Policy disallows `eval()`, Unpoly cannot directly run callbacks HTML attributes. This affects `[up-]` attributes like `[up-on-loaded]` or `[up-on-accepted]`. See [Unpoly's CSP guide](https://unpoly.com/csp) for details.
+The following callback would crash the fragment update with an error like `Uncaught EvalError: call to Function() blocked by CSP`:
+```ruby
+link_to 'Click me', '/path, 'up-follow': true, 'up-on-loaded': "alert()"
+```
+Unpoly lets your work around this by prefixing your callback with your response's [CSP nonce](https://content-security-policy.com/nonce/):
+```ruby
+link_to 'Click me', '/path', 'up-follow': true, 'up-on-loaded': 'nonce-kO52Iphm8BAVrcdGcNYjIA== alert()')
+```
+To keep your callbacks compact, you may use the `up.safe_callback` helper for this:
+```ruby
+link_to 'Click me', '/path, 'up-follow': true, 'up-on-loaded': up.safe_callback("alert()")
+```
+For this to work you must also include the `<meta name="csp-nonce">` tag in the `<head>` of your initial page. Rails has a [`csp_meta_tag`](https://api.rubyonrails.org/classes/ActionView/Helpers/CspHelper.html#method-i-csp_meta_tag) helper for that purpose.
 ### Working with context
 Calling `up.context` will return the [context](https://unpoly.com/up.context) object of the targeted layer.

data/assets/unpoly/unpoly-migrate.js CHANGED Viewed

@@ -253,6 +253,30 @@ up.util.times = function (count, block) {
 /* 3 */
 /***/ (function() {
+up.browser.loadPage = function () {
+    var _a;
+    var args = [];
+    for (var _i = 0; _i < arguments.length; _i++) {
+        args[_i] = arguments[_i];
+    }
+    up.migrate.deprecated('up.browser.loadPage', 'up.network.loadPage');
+    return (_a = up.network).loadPage.apply(_a, args);
+};
+up.browser.isSupported = function () {
+    var _a;
+    var args = [];
+    for (var _i = 0; _i < arguments.length; _i++) {
+        args[_i] = arguments[_i];
+    }
+    up.migrate.deprecated('up.browser.isSupported', 'up.framework.isSupported');
+    return (_a = up.framework).isSupported.apply(_a, args);
+};
+/***/ }),
+/* 4 */
+/***/ (function() {
 /*-
 @module up.element
 */
@@ -294,7 +318,7 @@ up.element.createFromHtml = function () {
 /***/ }),
-/* 4 */
+/* 5 */
 /***/ (function() {
 /*-
@@ -333,7 +357,7 @@ up.event.nobodyPrevents = function () {
 /***/ }),
-/* 5 */
+/* 6 */
 /***/ (function() {
 var u = up.util;
@@ -369,7 +393,7 @@ up.migrate.targetMacro = function (queryAttr, fixedResultAttrs, callback) {
 /***/ }),
-/* 6 */
+/* 7 */
 /***/ (function() {
 /*-
@@ -380,7 +404,7 @@ up.migrate.renamedProperty(up.form.config, 'submitButtons', 'submitButtonSelecto
 /***/ }),
-/* 7 */
+/* 8 */
 /***/ (function() {
 var __assign = (this && this.__assign) || function () {
@@ -550,7 +574,7 @@ up.migrate.preprocessRenderOptions = function (options) {
 /***/ }),
-/* 8 */
+/* 9 */
 /***/ (function() {
 /*-
@@ -577,7 +601,7 @@ up.migrate.renamedEvent('up:history:replaced', 'up:location:changed');
 /***/ }),
-/* 9 */
+/* 10 */
 /***/ (function() {
 /*-
@@ -588,7 +612,7 @@ up.migrate.renamedProperty(up.feedback.config, 'navs', 'navSelectors');
 /***/ }),
-/* 10 */
+/* 11 */
 /***/ (function() {
 /*-
@@ -635,7 +659,7 @@ up.migrate.targetMacro('up-dash', { 'up-preload': '', 'up-instant': '' }, functi
 /***/ }),
-/* 11 */
+/* 12 */
 /***/ (function() {
 /*-
@@ -702,7 +726,7 @@ up.util.getter(up.Layer.prototype, 'historyVisible', function () {
 /***/ }),
-/* 12 */
+/* 13 */
 /***/ (function() {
 /*-
@@ -894,7 +918,7 @@ up.migrate.targetMacro('up-drawer', { 'up-layer': 'new drawer' }, function () {
 /***/ }),
-/* 13 */
+/* 14 */
 /***/ (function() {
 /*-
@@ -1021,7 +1045,7 @@ up.migrate.targetMacro('up-popup', { 'up-layer': 'new popup' }, function () { re
 /***/ }),
-/* 14 */
+/* 15 */
 /***/ (function() {
 /*-
@@ -1040,7 +1064,7 @@ up.macro('[up-tooltip]', function (opener) {
 /***/ }),
-/* 15 */
+/* 16 */
 /***/ (function() {
 var u = up.util;
@@ -1180,7 +1204,7 @@ up.on('up:framework:reset', disableProgressBarIfCustomIndicator);
 /***/ }),
-/* 16 */
+/* 17 */
 /***/ (function() {
 /*-
@@ -1190,7 +1214,7 @@ up.migrate.renamedProperty(up.radio.config, 'hungry', 'hungrySelectors');
 /***/ }),
-/* 17 */
+/* 18 */
 /***/ (function() {
 /*-
@@ -1272,6 +1296,7 @@ __webpack_require__(14);
 __webpack_require__(15);
 __webpack_require__(16);
 __webpack_require__(17);
+__webpack_require__(18);
 up.framework.stopExtension();
 }();

data/assets/unpoly/unpoly-migrate.min.js CHANGED Viewed

	@@ -1 +1 @@
1	- !function(){var e={700:function(){up.element.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.first()","up.element.get()"),(e=up.element).get.apply(e,r)},up.element.createFromHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.createFromHtml","up.element.createFromHTML"),(e=up.element).createFromHTML.apply(e,r)}},394:function(){up.migrate.renamedPackage("bus","event"),up.event.nobodyPrevents=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.event.nobodyPrevents(type)","!up.emit(type).defaultPrevented");var t=up.emit.apply(up,e);return!t.defaultPrevented}},729:function(){up.migrate.renamedPackage("navigation","feedback"),up.migrate.renamedProperty(up.feedback.config,"navs","navSelectors")},305:function(){up.migrate.renamedProperty(up.form.config,"fields","fieldSelectors"),up.migrate.renamedProperty(up.form.config,"submitButtons","submitButtonSelectors")},354:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=up.util;up.migrate.renamedPackage("flow","fragment"),up.migrate.renamedPackage("dom","fragment"),up.migrate.renamedProperty(up.fragment.config,"fallbacks","mainTargets"),up.migrate.handleResponseDocOptions=function(e){return up.migrate.fixKey(e,"html","document")},up.replace=function(r,t,a){return up.migrate.deprecated("up.replace(target, url)","up.navigate(target, { url })"),up.navigate(e(e({},a),{target:r,url:t}))},up.extract=function(r,t,a){return up.migrate.deprecated("up.extract(target, document)","up.navigate(target, { document })"),up.navigate(e(e({},a),{target:r,document:t}))},up.fragment.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.fragment.first()","up.fragment.get()"),(e=up.fragment).get.apply(e,r)},up.first=up.fragment.first,up.migrate.handleScrollOptions=function(e){r.isUndefined(e.scroll)&&(r.isString(e.reveal)?(up.migrate.deprecated("Option { reveal: '"+e.reveal+"' }","{ scroll: '"+e.reveal+"' }"),e.scroll=e.reveal):!0===e.reveal?(up.migrate.deprecated("Option { reveal: true }","{ scroll: 'target' }"),e.scroll="target"):!1===e.reveal&&(up.migrate.deprecated("Option { reveal: false }","{ scroll: false }"),e.scroll=!1),r.isDefined(e.resetScroll)&&(up.migrate.deprecated("Option { resetScroll: true }","{ scroll: 'reset' }"),e.scroll="teset"),r.isDefined(e.restoreScroll)&&(up.migrate.deprecated("Option { restoreScroll: true }","{ scroll: 'restore' }"),e.scroll="restore"))},up.migrate.handleHistoryOption=function(e){r.isString(e.history)&&"auto"!==e.history&&(up.migrate.warn("Passing a URL as { history } option is deprecated. Pass it as { location } instead."),e.location=e.history,e.history="auto")},up.migrate.preprocessRenderOptions=function(e){up.migrate.handleHistoryOption(e);for(var t=0,a=["target","origin"];t<a.length;t++){var n=a[t];r.isJQuery(e[n])&&(up.migrate.warn("Passing a jQuery collection as { %s } is deprecated. Pass it as a native element instead.",n),e[n]=up.element.get(e[n]))}}},869:function(){up.migrate.renamedProperty(up.history.config,"popTargets","restoreTargets"),up.history.url=function(){return up.migrate.deprecated("up.history.url()","up.history.location"),up.history.location},up.migrate.renamedEvent("up:history:push","up:location:changed"),up.migrate.renamedEvent("up:history:pushed","up:location:changed"),up.migrate.renamedEvent("up:history:restore","up:location:changed"),up.migrate.renamedEvent("up:history:restored","up:location:changed"),up.migrate.renamedEvent("up:history:replaced","up:location:changed")},905:function(){up.migrate.handleLayerOptions=function(e){up.migrate.fixKey(e,"flavor","mode"),up.migrate.fixKey(e,"closable","dismissable"),up.migrate.fixKey(e,"closeLabel","dismissLabel");for(var r=0,t=["width","maxWidth","height"];r<t.length;r++){var a=t[r];e[a]&&up.migrate.warn("Layer option { "+a+" } has been removed. Use { size } or { class } instead.")}e.sticky&&up.migrate.warn("Layer option { sticky } has been removed. Give links an [up-peel=false] attribute to prevent layer dismissal on click."),e.template&&up.migrate.warn("Layer option { template } has been removed. Use { class } or modify the layer HTML on up:layer:open."),"page"===e.layer&&(up.migrate.warn("Option { layer: 'page' } has been renamed to { layer: 'root' }."),e.layer="root"),"modal"!==e.layer&&"popup"!==e.layer\|\|(up.migrate.warn("Option { layer: '"+e.layer+"' } has been removed. Did you mean { layer: 'overlay' }?"),e.layer="overlay")},up.migrate.handleTetherOptions=function(e){var r=e.position.split("-"),t=r[0],a=r[1];a&&(up.migrate.warn("The position value %o is deprecated. Use %o instead.",e.position,{position:t,align:a}),e.position=t,e.align=a)},up.migrate.registerLayerCloser=function(e){return e.registerClickCloser("up-close",(function(r,t){up.migrate.deprecated("[up-close]","[up-dismiss]"),e.dismiss(r,t)}))},up.migrate.handleLayerConfig=function(e){return up.migrate.fixKey(e,"historyVisible","history")},up.util.getter(up.Layer.prototype,"historyVisible",(function(){return up.migrate.deprecated("up.Layer#historyVisible","up.Layer#history"),this.history}))},969:function(){up.migrate.parseFollowOptions=function(e){e.string("flavor"),e.string("width"),e.string("height"),e.boolean("closable"),e.booleanOrString("reveal"),e.boolean("resetScroll"),e.boolean("restoreScroll"),e.booleanOrString("historyVisible")},up.migrate.targetMacro("up-dash",{"up-preload":"","up-instant":""},(function(){return up.migrate.deprecated("a[up-dash]","up.link.config.instantSelectors or up.link.config.preloadSelectors")}))},992:function(){var e=this&&this.__spreadArray\|\|function(e,r){for(var t=0,a=r.length,n=e.length;t<a;t++,n++)e[n]=r[t];return e},r=up.util;up.migrate=function(){var t=new up.Config((function(){return{logLevel:"warn"}})),a={};function n(e){var r=a[e];return r?(u("Event "+e+" has been renamed to "+r),r):e}var p={};function u(a){for(var n,u=[],o=1;o<arguments.length;o++)u[o-1]=arguments[o];var i=r.sprintf.apply(r,e([a],u));p[i]\|\|(p[i]=!0,(n=up.log)[t.logLevel].apply(n,e(["unpoly-migrate",a],u)))}return up.on("up:framework:reset",(function(){t.reset()})),{deprecated:function(e,r){u(e+" has been deprecated. Use "+r+" instead.")},renamedPackage:function(e,r){Object.defineProperty(up,e,{get:function(){return u("up."+e+" has been renamed to up."+r),up[r]}})},renamedProperty:function(e,r,t){var a=function(){return u("Property { %s } has been renamed to { %s } (found in %o)",r,t,e)};return Object.defineProperty(e,r,{get:function(){return a(),this[t]},set:function(e){a(),this[t]=e}})},formerlyAsync:function(e){var r=Promise.resolve(),t=r.then;return r.then=function(){return u(e+" is now a sync function"),t.apply(this,arguments)},r},renamedEvent:function(e,r){a[e]=r},fixEventTypes:function(e){return r.uniq(r.map(e,n))},fixKey:function(e,t,a){r.isDefined(e[t])&&(u("Property { %s } has been renamed to { %s } (found in %o)",t,a,e),r.renameKey(e,t,a))},warn:u,loaded:!0,config:t}}()},413:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=new Error("up.modal.flavors has been removed without direct replacement. You may give new layers a { class } or modify layer elements on up:layer:open.");up.modal={visit:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.visit(url)",'up.layer.open({ url, mode: "modal" })'),up.layer.open(e(e({},t),{url:r,mode:"modal"}))},follow:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.follow(link)",'up.follow(link, { layer: "modal" })'),up.follow(r,e(e({},t),{layer:"modal"}))},extract:function(r,t,a){return void 0===a&&(a={}),up.migrate.deprecated("up.modal.extract(target, document)",'up.layer.open({ document, mode: "modal" })'),up.layer.open(e(e({},a),{target:r,html:t,layer:"modal"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.modal.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.modal.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.modal.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.modal.config","up.layer.config.modal"),up.layer.config.modal},contains:function(e){return up.migrate.deprecated("up.modal.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.modal.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},get flavors(){throw r},flavor:function(){throw r}},up.migrate.renamedEvent("up:modal:open","up:layer:open"),up.migrate.renamedEvent("up:modal:opened","up:layer:opened"),up.migrate.renamedEvent("up:modal:close","up:layer:dismiss"),up.migrate.renamedEvent("up:modal:closed","up:layer:dismissed"),up.migrate.targetMacro("up-modal",{"up-layer":"new modal"},(function(){return up.migrate.deprecated("a[up-modal]",'a[up-layer="new modal"]')})),up.migrate.targetMacro("up-drawer",{"up-layer":"new drawer"},(function(){return up.migrate.deprecated("a[up-drawer]",'a[up-layer="new drawer"]')}))},885:function(){var e=up.util;up.migrate.renamedPackage("proxy","network"),up.migrate.renamedEvent("up:proxy:load","up:request:load"),up.migrate.renamedEvent("up:proxy:received","up:request:loaded"),up.migrate.renamedEvent("up:proxy:loaded","up:request:loaded"),up.migrate.renamedEvent("up:proxy:fatal","up:request:fatal"),up.migrate.renamedEvent("up:proxy:aborted","up:request:aborted"),up.migrate.renamedEvent("up:proxy:slow","up:request:late"),up.migrate.renamedEvent("up:proxy:recover","up:request:recover");var r=function(){return up.migrate.deprecated("up.proxy.config.preloadDelay","up.link.config.preloadDelay")};Object.defineProperty(up.network.config,"preloadDelay",{get:function(){return r(),up.link.config.preloadDelay},set:function(e){r(),up.link.config.preloadDelay=e}}),up.migrate.renamedProperty(up.network.config,"maxRequests","concurrency"),up.migrate.renamedProperty(up.network.config,"slowDelay","badResponseTime"),up.migrate.handleRequestOptions=function(e){return up.migrate.fixKey(e,"data","params")},up.ajax=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.ajax()","up.request()");var t=function(e){return e.text};return up.request.apply(up,e).then(t)},up.network.clear=function(){up.migrate.deprecated("up.proxy.clear()","up.cache.clear()"),up.cache.clear()},up.network.preload=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.proxy.preload(link)","up.link.preload(link)"),(e=up.link).preload.apply(e,r)},up.Request.prototype.navigate=function(){up.migrate.deprecated("up.Request#navigate()","up.Request#loadPage()"),this.loadPage()},up.Response.prototype.isSuccess=function(){return up.migrate.deprecated("up.Response#isSuccess()","up.Response#ok"),this.ok},up.Response.prototype.isError=function(){return up.migrate.deprecated("up.Response#isError()","!up.Response#ok"),!this.ok};var t=up.network.config.progressBar;function a(){up.network.config.progressBar=function(){return r=up.EventListener.allNonDefault(document),e.find(r,(function(e){return"up:request:late"===e.eventType}))?(up.migrate.warn("Disabled the default progress bar as may have built a custom loading indicator with your up:request:late listener. Please set up.network.config.progressBar to true or false."),!1):t;var r}}a(),up.on("up:framework:reset",a)},69:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)};up.popup={attach:function(r,t){return void 0===t&&(t={}),r=up.fragment.get(r),up.migrate.deprecated("up.popup.attach(origin)","up.layer.open({ origin, layer: 'popup' })"),up.layer.open(e(e({},t),{origin:r,layer:"popup"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.popup.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.popup.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.popup.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.popup.config","up.layer.config.popup"),up.layer.config.popup},contains:function(e){return up.migrate.deprecated("up.popup.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.popup.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},sync:function(){return up.migrate.deprecated("up.popup.sync()","up.layer.sync()"),up.layer.sync()}},up.migrate.renamedEvent("up:popup:open","up:layer:open"),up.migrate.renamedEvent("up:popup:opened","up:layer:opened"),up.migrate.renamedEvent("up:popup:close","up:layer:dismiss"),up.migrate.renamedEvent("up:popup:closed","up:layer:dismissed"),up.migrate.targetMacro("up-popup",{"up-layer":"new popup"},(function(){return up.migrate.deprecated("[up-popup]",'[up-layer="new popup"]')}))},228:function(){up.migrate.renamedProperty(up.radio.config,"hungry","hungrySelectors")},629:function(){var e=up.util,r=up.element;up.migrate.postCompile=function(r,t){var a;if(a=t.keep){up.migrate.warn("The { keep: true } option for up.compiler() has been removed. Have the compiler set [up-keep] attribute instead.");for(var n=e.isString(a)?a:"",p=0,u=r;p<u.length;p++)u[p].setAttribute("up-keep",n)}},up.migrate.targetMacro=function(t,a,n){up.macro("["+t+"]",(function(p){var u,o=e.copy(a);(u=p.getAttribute(t))?o["up-target"]=u:o["up-follow"]="",r.setMissingAttrs(p,o),p.removeAttribute(t),null==n\|\|n()}))}},197:function(){up.macro("[up-tooltip]",(function(e){up.migrate.warn("[up-tooltip] has been deprecated. A [title] was set instead."),up.element.setMissingAttr(e,"title",e.getAttribute("up-tooltip"))}))},480:function(){up.util.only=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.only(object, ...keys)","up.util.pick(object, keys)"),up.util.pick(e,r)},up.util.except=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.except(object, ...keys)","up.util.omit(object, keys)"),up.util.omit(e,r)},up.util.parseUrl=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.parseUrl() has been renamed to up.util.parseURL()"),(e=up.util).parseURL.apply(e,r)},up.util.any=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.any() has been renamed to up.util.some()"),(e=up.util).some.apply(e,r)},up.util.all=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.all() has been renamed to up.util.every()"),(e=up.util).every.apply(e,r)},up.util.detect=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.detect() has been renamed to up.util.find()"),(e=up.util).find.apply(e,r)},up.util.select=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.select() has been renamed to up.util.filter()"),(e=up.util).filter.apply(e,r)},up.util.setTimer=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.setTimer() has been renamed to up.util.timer()"),(e=up.util).timer.apply(e,r)},up.util.escapeHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.util.escapeHtml","up.util.escapeHTML"),(e=up.util).escapeHTML.apply(e,r)},up.util.selectorForElement=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.selectorForElement() has been renamed to up.fragment.toTarget()"),(e=up.fragment).toTarget.apply(e,r)},up.util.nextFrame=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.nextFrame() has been renamed to up.util.task()"),(e=up.util).task.apply(e,r)},up.util.times=function(e,r){for(var t=0;t<e;t++)r()}},338:function(){up.migrate.renamedPackage("layout","viewport"),up.migrate.renamedProperty(up.viewport.config,"viewports","viewportSelectors"),up.migrate.renamedProperty(up.viewport.config,"snap","revealSnap"),up.viewport.closest=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.viewport.closest()","up.viewport.get()"),(e=up.viewport).get.apply(e,r)}}},r={};function t(a){var n=r[a];if(void 0!==n)return n.exports;var p=r[a]={exports:{}};return e[a].call(p.exports,p,p.exports,t),p.exports}up.framework.startExtension(),t(992),t(480),t(700),t(394),t(629),t(305),t(354),t(869),t(729),t(969),t(905),t(413),t(69),t(197),t(885),t(228),t(338),up.framework.stopExtension()}();
1	+ !function(){var e={294:function(){up.browser.loadPage=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.browser.loadPage","up.network.loadPage"),(e=up.network).loadPage.apply(e,r)},up.browser.isSupported=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.browser.isSupported","up.framework.isSupported"),(e=up.framework).isSupported.apply(e,r)}},700:function(){up.element.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.first()","up.element.get()"),(e=up.element).get.apply(e,r)},up.element.createFromHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.createFromHtml","up.element.createFromHTML"),(e=up.element).createFromHTML.apply(e,r)}},394:function(){up.migrate.renamedPackage("bus","event"),up.event.nobodyPrevents=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.event.nobodyPrevents(type)","!up.emit(type).defaultPrevented");var t=up.emit.apply(up,e);return!t.defaultPrevented}},729:function(){up.migrate.renamedPackage("navigation","feedback"),up.migrate.renamedProperty(up.feedback.config,"navs","navSelectors")},305:function(){up.migrate.renamedProperty(up.form.config,"fields","fieldSelectors"),up.migrate.renamedProperty(up.form.config,"submitButtons","submitButtonSelectors")},354:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=up.util;up.migrate.renamedPackage("flow","fragment"),up.migrate.renamedPackage("dom","fragment"),up.migrate.renamedProperty(up.fragment.config,"fallbacks","mainTargets"),up.migrate.handleResponseDocOptions=function(e){return up.migrate.fixKey(e,"html","document")},up.replace=function(r,t,a){return up.migrate.deprecated("up.replace(target, url)","up.navigate(target, { url })"),up.navigate(e(e({},a),{target:r,url:t}))},up.extract=function(r,t,a){return up.migrate.deprecated("up.extract(target, document)","up.navigate(target, { document })"),up.navigate(e(e({},a),{target:r,document:t}))},up.fragment.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.fragment.first()","up.fragment.get()"),(e=up.fragment).get.apply(e,r)},up.first=up.fragment.first,up.migrate.handleScrollOptions=function(e){r.isUndefined(e.scroll)&&(r.isString(e.reveal)?(up.migrate.deprecated("Option { reveal: '"+e.reveal+"' }","{ scroll: '"+e.reveal+"' }"),e.scroll=e.reveal):!0===e.reveal?(up.migrate.deprecated("Option { reveal: true }","{ scroll: 'target' }"),e.scroll="target"):!1===e.reveal&&(up.migrate.deprecated("Option { reveal: false }","{ scroll: false }"),e.scroll=!1),r.isDefined(e.resetScroll)&&(up.migrate.deprecated("Option { resetScroll: true }","{ scroll: 'reset' }"),e.scroll="teset"),r.isDefined(e.restoreScroll)&&(up.migrate.deprecated("Option { restoreScroll: true }","{ scroll: 'restore' }"),e.scroll="restore"))},up.migrate.handleHistoryOption=function(e){r.isString(e.history)&&"auto"!==e.history&&(up.migrate.warn("Passing a URL as { history } option is deprecated. Pass it as { location } instead."),e.location=e.history,e.history="auto")},up.migrate.preprocessRenderOptions=function(e){up.migrate.handleHistoryOption(e);for(var t=0,a=["target","origin"];t<a.length;t++){var n=a[t];r.isJQuery(e[n])&&(up.migrate.warn("Passing a jQuery collection as { %s } is deprecated. Pass it as a native element instead.",n),e[n]=up.element.get(e[n]))}}},869:function(){up.migrate.renamedProperty(up.history.config,"popTargets","restoreTargets"),up.history.url=function(){return up.migrate.deprecated("up.history.url()","up.history.location"),up.history.location},up.migrate.renamedEvent("up:history:push","up:location:changed"),up.migrate.renamedEvent("up:history:pushed","up:location:changed"),up.migrate.renamedEvent("up:history:restore","up:location:changed"),up.migrate.renamedEvent("up:history:restored","up:location:changed"),up.migrate.renamedEvent("up:history:replaced","up:location:changed")},905:function(){up.migrate.handleLayerOptions=function(e){up.migrate.fixKey(e,"flavor","mode"),up.migrate.fixKey(e,"closable","dismissable"),up.migrate.fixKey(e,"closeLabel","dismissLabel");for(var r=0,t=["width","maxWidth","height"];r<t.length;r++){var a=t[r];e[a]&&up.migrate.warn("Layer option { "+a+" } has been removed. Use { size } or { class } instead.")}e.sticky&&up.migrate.warn("Layer option { sticky } has been removed. Give links an [up-peel=false] attribute to prevent layer dismissal on click."),e.template&&up.migrate.warn("Layer option { template } has been removed. Use { class } or modify the layer HTML on up:layer:open."),"page"===e.layer&&(up.migrate.warn("Option { layer: 'page' } has been renamed to { layer: 'root' }."),e.layer="root"),"modal"!==e.layer&&"popup"!==e.layer\|\|(up.migrate.warn("Option { layer: '"+e.layer+"' } has been removed. Did you mean { layer: 'overlay' }?"),e.layer="overlay")},up.migrate.handleTetherOptions=function(e){var r=e.position.split("-"),t=r[0],a=r[1];a&&(up.migrate.warn("The position value %o is deprecated. Use %o instead.",e.position,{position:t,align:a}),e.position=t,e.align=a)},up.migrate.registerLayerCloser=function(e){return e.registerClickCloser("up-close",(function(r,t){up.migrate.deprecated("[up-close]","[up-dismiss]"),e.dismiss(r,t)}))},up.migrate.handleLayerConfig=function(e){return up.migrate.fixKey(e,"historyVisible","history")},up.util.getter(up.Layer.prototype,"historyVisible",(function(){return up.migrate.deprecated("up.Layer#historyVisible","up.Layer#history"),this.history}))},969:function(){up.migrate.parseFollowOptions=function(e){e.string("flavor"),e.string("width"),e.string("height"),e.boolean("closable"),e.booleanOrString("reveal"),e.boolean("resetScroll"),e.boolean("restoreScroll"),e.booleanOrString("historyVisible")},up.migrate.targetMacro("up-dash",{"up-preload":"","up-instant":""},(function(){return up.migrate.deprecated("a[up-dash]","up.link.config.instantSelectors or up.link.config.preloadSelectors")}))},992:function(){var e=this&&this.__spreadArray\|\|function(e,r){for(var t=0,a=r.length,n=e.length;t<a;t++,n++)e[n]=r[t];return e},r=up.util;up.migrate=function(){var t=new up.Config((function(){return{logLevel:"warn"}})),a={};function n(e){var r=a[e];return r?(u("Event "+e+" has been renamed to "+r),r):e}var p={};function u(a){for(var n,u=[],o=1;o<arguments.length;o++)u[o-1]=arguments[o];var i=r.sprintf.apply(r,e([a],u));p[i]\|\|(p[i]=!0,(n=up.log)[t.logLevel].apply(n,e(["unpoly-migrate",a],u)))}return up.on("up:framework:reset",(function(){t.reset()})),{deprecated:function(e,r){u(e+" has been deprecated. Use "+r+" instead.")},renamedPackage:function(e,r){Object.defineProperty(up,e,{get:function(){return u("up."+e+" has been renamed to up."+r),up[r]}})},renamedProperty:function(e,r,t){var a=function(){return u("Property { %s } has been renamed to { %s } (found in %o)",r,t,e)};return Object.defineProperty(e,r,{get:function(){return a(),this[t]},set:function(e){a(),this[t]=e}})},formerlyAsync:function(e){var r=Promise.resolve(),t=r.then;return r.then=function(){return u(e+" is now a sync function"),t.apply(this,arguments)},r},renamedEvent:function(e,r){a[e]=r},fixEventTypes:function(e){return r.uniq(r.map(e,n))},fixKey:function(e,t,a){r.isDefined(e[t])&&(u("Property { %s } has been renamed to { %s } (found in %o)",t,a,e),r.renameKey(e,t,a))},warn:u,loaded:!0,config:t}}()},413:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=new Error("up.modal.flavors has been removed without direct replacement. You may give new layers a { class } or modify layer elements on up:layer:open.");up.modal={visit:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.visit(url)",'up.layer.open({ url, mode: "modal" })'),up.layer.open(e(e({},t),{url:r,mode:"modal"}))},follow:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.follow(link)",'up.follow(link, { layer: "modal" })'),up.follow(r,e(e({},t),{layer:"modal"}))},extract:function(r,t,a){return void 0===a&&(a={}),up.migrate.deprecated("up.modal.extract(target, document)",'up.layer.open({ document, mode: "modal" })'),up.layer.open(e(e({},a),{target:r,html:t,layer:"modal"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.modal.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.modal.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.modal.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.modal.config","up.layer.config.modal"),up.layer.config.modal},contains:function(e){return up.migrate.deprecated("up.modal.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.modal.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},get flavors(){throw r},flavor:function(){throw r}},up.migrate.renamedEvent("up:modal:open","up:layer:open"),up.migrate.renamedEvent("up:modal:opened","up:layer:opened"),up.migrate.renamedEvent("up:modal:close","up:layer:dismiss"),up.migrate.renamedEvent("up:modal:closed","up:layer:dismissed"),up.migrate.targetMacro("up-modal",{"up-layer":"new modal"},(function(){return up.migrate.deprecated("a[up-modal]",'a[up-layer="new modal"]')})),up.migrate.targetMacro("up-drawer",{"up-layer":"new drawer"},(function(){return up.migrate.deprecated("a[up-drawer]",'a[up-layer="new drawer"]')}))},885:function(){var e=up.util;up.migrate.renamedPackage("proxy","network"),up.migrate.renamedEvent("up:proxy:load","up:request:load"),up.migrate.renamedEvent("up:proxy:received","up:request:loaded"),up.migrate.renamedEvent("up:proxy:loaded","up:request:loaded"),up.migrate.renamedEvent("up:proxy:fatal","up:request:fatal"),up.migrate.renamedEvent("up:proxy:aborted","up:request:aborted"),up.migrate.renamedEvent("up:proxy:slow","up:request:late"),up.migrate.renamedEvent("up:proxy:recover","up:request:recover");var r=function(){return up.migrate.deprecated("up.proxy.config.preloadDelay","up.link.config.preloadDelay")};Object.defineProperty(up.network.config,"preloadDelay",{get:function(){return r(),up.link.config.preloadDelay},set:function(e){r(),up.link.config.preloadDelay=e}}),up.migrate.renamedProperty(up.network.config,"maxRequests","concurrency"),up.migrate.renamedProperty(up.network.config,"slowDelay","badResponseTime"),up.migrate.handleRequestOptions=function(e){return up.migrate.fixKey(e,"data","params")},up.ajax=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.ajax()","up.request()");var t=function(e){return e.text};return up.request.apply(up,e).then(t)},up.network.clear=function(){up.migrate.deprecated("up.proxy.clear()","up.cache.clear()"),up.cache.clear()},up.network.preload=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.proxy.preload(link)","up.link.preload(link)"),(e=up.link).preload.apply(e,r)},up.Request.prototype.navigate=function(){up.migrate.deprecated("up.Request#navigate()","up.Request#loadPage()"),this.loadPage()},up.Response.prototype.isSuccess=function(){return up.migrate.deprecated("up.Response#isSuccess()","up.Response#ok"),this.ok},up.Response.prototype.isError=function(){return up.migrate.deprecated("up.Response#isError()","!up.Response#ok"),!this.ok};var t=up.network.config.progressBar;function a(){up.network.config.progressBar=function(){return r=up.EventListener.allNonDefault(document),e.find(r,(function(e){return"up:request:late"===e.eventType}))?(up.migrate.warn("Disabled the default progress bar as may have built a custom loading indicator with your up:request:late listener. Please set up.network.config.progressBar to true or false."),!1):t;var r}}a(),up.on("up:framework:reset",a)},69:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)};up.popup={attach:function(r,t){return void 0===t&&(t={}),r=up.fragment.get(r),up.migrate.deprecated("up.popup.attach(origin)","up.layer.open({ origin, layer: 'popup' })"),up.layer.open(e(e({},t),{origin:r,layer:"popup"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.popup.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.popup.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.popup.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.popup.config","up.layer.config.popup"),up.layer.config.popup},contains:function(e){return up.migrate.deprecated("up.popup.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.popup.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},sync:function(){return up.migrate.deprecated("up.popup.sync()","up.layer.sync()"),up.layer.sync()}},up.migrate.renamedEvent("up:popup:open","up:layer:open"),up.migrate.renamedEvent("up:popup:opened","up:layer:opened"),up.migrate.renamedEvent("up:popup:close","up:layer:dismiss"),up.migrate.renamedEvent("up:popup:closed","up:layer:dismissed"),up.migrate.targetMacro("up-popup",{"up-layer":"new popup"},(function(){return up.migrate.deprecated("[up-popup]",'[up-layer="new popup"]')}))},228:function(){up.migrate.renamedProperty(up.radio.config,"hungry","hungrySelectors")},629:function(){var e=up.util,r=up.element;up.migrate.postCompile=function(r,t){var a;if(a=t.keep){up.migrate.warn("The { keep: true } option for up.compiler() has been removed. Have the compiler set [up-keep] attribute instead.");for(var n=e.isString(a)?a:"",p=0,u=r;p<u.length;p++)u[p].setAttribute("up-keep",n)}},up.migrate.targetMacro=function(t,a,n){up.macro("["+t+"]",(function(p){var u,o=e.copy(a);(u=p.getAttribute(t))?o["up-target"]=u:o["up-follow"]="",r.setMissingAttrs(p,o),p.removeAttribute(t),null==n\|\|n()}))}},197:function(){up.macro("[up-tooltip]",(function(e){up.migrate.warn("[up-tooltip] has been deprecated. A [title] was set instead."),up.element.setMissingAttr(e,"title",e.getAttribute("up-tooltip"))}))},480:function(){up.util.only=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.only(object, ...keys)","up.util.pick(object, keys)"),up.util.pick(e,r)},up.util.except=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.except(object, ...keys)","up.util.omit(object, keys)"),up.util.omit(e,r)},up.util.parseUrl=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.parseUrl() has been renamed to up.util.parseURL()"),(e=up.util).parseURL.apply(e,r)},up.util.any=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.any() has been renamed to up.util.some()"),(e=up.util).some.apply(e,r)},up.util.all=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.all() has been renamed to up.util.every()"),(e=up.util).every.apply(e,r)},up.util.detect=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.detect() has been renamed to up.util.find()"),(e=up.util).find.apply(e,r)},up.util.select=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.select() has been renamed to up.util.filter()"),(e=up.util).filter.apply(e,r)},up.util.setTimer=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.setTimer() has been renamed to up.util.timer()"),(e=up.util).timer.apply(e,r)},up.util.escapeHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.util.escapeHtml","up.util.escapeHTML"),(e=up.util).escapeHTML.apply(e,r)},up.util.selectorForElement=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.selectorForElement() has been renamed to up.fragment.toTarget()"),(e=up.fragment).toTarget.apply(e,r)},up.util.nextFrame=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.nextFrame() has been renamed to up.util.task()"),(e=up.util).task.apply(e,r)},up.util.times=function(e,r){for(var t=0;t<e;t++)r()}},338:function(){up.migrate.renamedPackage("layout","viewport"),up.migrate.renamedProperty(up.viewport.config,"viewports","viewportSelectors"),up.migrate.renamedProperty(up.viewport.config,"snap","revealSnap"),up.viewport.closest=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.viewport.closest()","up.viewport.get()"),(e=up.viewport).get.apply(e,r)}}},r={};function t(a){var n=r[a];if(void 0!==n)return n.exports;var p=r[a]={exports:{}};return e[a].call(p.exports,p,p.exports,t),p.exports}up.framework.startExtension(),t(992),t(480),t(294),t(700),t(394),t(629),t(305),t(354),t(869),t(729),t(969),t(905),t(413),t(69),t(197),t(885),t(228),t(338),up.framework.stopExtension()}();

data/assets/unpoly/unpoly.es5.js CHANGED Viewed

@@ -8,7 +8,7 @@
 @module up
 */
 window.up = {
-    version: '2.2.1'
+    version: '2.3.0'
 };
@@ -1238,7 +1238,7 @@ up.util = (function () {
     @function up.util.pickBy
     @param {Object} object
-    @param {Function<string, string, object>} tester
+    @param {Function(string, string, object): boolean} tester
       A function that will be called with each property.
       The arguments are the property value, key and the entire object.
@@ -2070,7 +2070,7 @@ up.util = (function () {
         renameKeys: renameKeys,
         timestamp: secondsSinceEpoch,
         allSettled: allSettled,
-        negate: negate
+        negate: negate,
     };
 })();
@@ -2155,48 +2155,16 @@ up.migrate = { config: {} };
 /***/ (function() {
 /*-
-Browser support
-===============
-Unpoly supports all modern browsers.
-### Chrome, Firefox, Edge, Safari
-Full support.
-### Internet Explorer 11
-Full support with a `Promise` polyfill like [es6-promise](https://github.com/stefanpenner/es6-promise) (2.4 KB).\
-Support may be removed when Microsoft retires IE11 in [June 2022](https://blogs.windows.com/windowsexperience/2021/05/19/the-future-of-internet-explorer-on-windows-10-is-in-microsoft-edge/).
-### Internet Explorer 10 or lower
+Browser interface
+=================
-Unpoly will not boot or [run compilers](/up.compiler),
-leaving you with a classic server-side application.
+We tunnel some browser APIs through this module for easier mocking in tests.
 @module up.browser
 */
 up.browser = (function () {
     var u = up.util;
     /*-
-    Makes a full-page request, replacing the entire browser environment with a new page from the server response.
-    Also see `up.Request#loadPage()`.
-    @function up.browser.loadPage
-    @param {string} options.url
-      The URL to load.
-    @param {string} [options.method='get']
-      The method for the request.
-      Methods other than GET or POST will be [wrapped](/up.protocol.config#config.methodParam) in a POST request.
-    @param {Object|Array|FormData|string} [options.params]
-    @experimental
-    */
-    function loadPage(requestsAttrs) {
-        new up.Request(requestsAttrs).loadPage();
-    }
-    /*-
     Submits the given form with a full page load.
     For mocking in specs.
@@ -2210,6 +2178,11 @@ up.browser = (function () {
     function isIE11() {
         return 'ActiveXObject' in window; // this is undefined, but the key is set
     }
+    function isEdge18() {
+        // Edge 18: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19582
+        // Edge 92: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.78
+        return u.contains(navigator.userAgent, ' Edge/');
+    }
     /*-
     Returns whether this browser supports manipulation of the current URL
     via [`history.pushState`](https://developer.mozilla.org/en-US/docs/Web/API/History/pushState).
@@ -2259,6 +2232,17 @@ up.browser = (function () {
     function canJQuery() {
         return !!window.jQuery;
     }
+    var canEval = u.memoize(function () {
+        try {
+            // Don't use eval() which would prevent minifiers from compressing local variables.
+            return new Function('return true')();
+        }
+        catch (_a) {
+            // With a strict CSP this will be an error like:
+            // Uncaught EvalError: call to Function() blocked by CSP
+            return false;
+        }
+    });
     // IE11: Use the browser.cookies API instead.
     function popCookie(name) {
         var _a;
@@ -2288,42 +2272,19 @@ up.browser = (function () {
         }
         return true;
     }
-    /*-
-    Returns whether Unpoly supports the current browser.
-    If this returns `false` Unpoly will prevent itself from booting
-    and ignores all registered [event handlers](/up.on) and [compilers](/up.compiler).
-    This leaves you with a classic server-side application.
-    This is usually a better fallback than loading incompatible Javascript and causing
-    many errors on load.
-    @function up.browser.isSupported
-    @stable
-    */
-    function isSupported() {
-        return !supportIssue();
-    }
-    function supportIssue() {
-        if (!canPromise()) {
-            return "Browser doesn't support promises";
-        }
-        if (document.compatMode === 'BackCompat') {
-            return 'Browser is in quirks mode (missing DOCTYPE?)';
-        }
-    }
     return {
-        loadPage: loadPage,
         submitForm: submitForm,
         canPushState: canPushState,
         canFormatLog: canFormatLog,
         canPassiveEventListener: canPassiveEventListener,
         canJQuery: canJQuery,
+        canPromise: canPromise,
+        canEval: canEval,
         assertConfirmed: assertConfirmed,
-        isSupported: isSupported,
-        supportIssue: supportIssue,
         popCookie: popCookie,
         get jQuery() { return getJQuery(); },
-        isIE11: isIE11
+        isIE11: isIE11,
+        isEdge18: isEdge18,
     };
 })();
@@ -3323,11 +3284,12 @@ up.element = (function () {
         }
     }
     function callbackAttr(link, attr, exposedKeys) {
+        var _a;
         if (exposedKeys === void 0) { exposedKeys = []; }
         var code = link.getAttribute(attr);
         if (code) {
             // Allow callbacks to refer to an exposed property directly instead of through `event.value`.
-            var callback_1 = new (Function.bind.apply(Function, __spreadArray(__spreadArray([void 0, 'event'], exposedKeys), [code])))();
+            var callback_1 = (_a = up.NonceableCallback.fromString(code)).toFunction.apply(_a, __spreadArray(['event'], exposedKeys));
             // Emulate the behavior of the `onclick` attribute,
             // where `this` refers to the clicked element.
             return function (event) {
@@ -4299,7 +4261,7 @@ up.Change.OpenLayer = /** @class */ (function (_super) {
         // We assume that the server will respond with our target.
         return this.target;
     };
-    OpenLayer.prototype.execute = function (responseDoc) {
+    OpenLayer.prototype.execute = function (responseDoc, onApplicable) {
         var _this = this;
         if (this.target === ':none') {
             this.content = document.createElement('up-none');
@@ -4310,6 +4272,7 @@ up.Change.OpenLayer = /** @class */ (function (_super) {
         if (!this.content || this.baseLayer.isClosed()) {
             throw this.notApplicable();
         }
+        onApplicable();
         up.puts('up.render()', "Opening element \"" + this.target + "\" in new overlay");
         this.options.title = this.improveHistoryValue(this.options.title, responseDoc.getTitle());
         if (this.emitOpenEvent().defaultPrevented) {
@@ -4533,12 +4496,13 @@ up.Change.UpdateLayer = /** @class */ (function (_super) {
         this.matchPreflight();
         return u.map(this.steps, 'selector').join(', ') || ':none';
     };
-    UpdateLayer.prototype.execute = function (responseDoc) {
+    UpdateLayer.prototype.execute = function (responseDoc, onApplicable) {
         var _this = this;
         this.responseDoc = responseDoc;
         // For each step, find a step.alternative that matches in both the current page
         // and the response document.
         this.matchPostflight();
+        onApplicable();
         // Don't log @target since that does not include hungry elements
         up.puts('up.render()', "Updating \"" + this.bestPreflightSelector() + "\" in " + this.layer);
         this.options.title = this.improveHistoryValue(this.options.title, this.responseDoc.getTitle());
@@ -4961,7 +4925,7 @@ up.Change.CloseLayer = /** @class */ (function (_super) {
         // because the layer is detached. We do not want to emit it on the parent layer where users
         // might confuse it with an event for the parent layer itself. Since @layer.element
         // is now detached, the event will no longer bubble up to the document where global
-        // event listeners can receive it. So we explicitely emit the event a second time
+        // event listeners can receive it. So we explicitly emit the event a second time
         // on the document.
         return this.layer.emit(this.buildEvent("up:layer:" + verbPast), {
             // Set up.layer.current to the parent of the closed layer, which is now likely
@@ -5087,18 +5051,25 @@ up.Change.FromContent = /** @class */ (function (_super) {
         return up.fragment.expandTargets(targets, { layer: layer, mode: this.mode, origin: this.origin });
     };
     FromContent.prototype.execute = function () {
-        var _this = this;
         // Preloading from local content is a no-op.
         if (this.options.preload) {
             return Promise.resolve();
         }
-        var executePlan = function (plan) { return plan.execute(_this.getResponseDoc()); };
-        return this.seekPlan(executePlan) || this.postflightTargetNotApplicable();
+        return this.seekPlan(this.executePlan.bind(this)) || this.postflightTargetNotApplicable();
+    };
+    FromContent.prototype.executePlan = function (matchedPlan) {
+        return matchedPlan.execute(this.getResponseDoc(), this.onPlanApplicable.bind(this, matchedPlan));
+    };
+    FromContent.prototype.onPlanApplicable = function (plan) {
+        var primaryPlan = this.getPlans()[0];
+        if (plan !== primaryPlan) {
+            up.puts('up.render()', 'Could not match primary target (%s). Updating a fallback target (%s).', primaryPlan.target, plan.target);
+        }
     };
     FromContent.prototype.getResponseDoc = function () {
         var _a, _b;
         if (!this.preview && !this.responseDoc) {
-            var docOptions = u.pick(this.options, ['target', 'content', 'fragment', 'document', 'html']);
+            var docOptions = u.pick(this.options, ['target', 'content', 'fragment', 'document', 'html', 'cspNonces']);
             (_b = (_a = up.migrate).handleResponseDocOptions) === null || _b === void 0 ? void 0 : _b.call(_a, docOptions);
             // If neither { document } nor { fragment } source is given, we assume { content }.
             if (this.defaultPlacement() === 'content') {
@@ -5220,7 +5191,7 @@ up.Change.FromURL = /** @class */ (function (_super) {
         var newPageReason = this.newPageReason();
         if (newPageReason) {
             up.puts('up.render()', newPageReason);
-            up.browser.loadPage(this.options);
+            up.network.loadPage(this.options);
             // Prevent our caller from executing any further code, since we're already
             // navigating away from this JavaScript environment.
             return u.unresolvablePromise();
@@ -5287,17 +5258,21 @@ up.Change.FromURL = /** @class */ (function (_super) {
     FromURL.prototype.isSuccessfulResponse = function () {
         return (this.successOptions.fail === false) || this.response.ok;
     };
-    FromURL.prototype.buildEvent = function (type, props) {
-        var defaultProps = { request: this.request, response: this.response, renderOptions: this.options };
-        return up.event.build(type, u.merge(defaultProps, props));
-    };
+    // buildEvent(type, props) {
+    //   const defaultProps = { request: this.request, response: this.response, renderOptions: this.options }
+    //   return up.event.build(type, u.merge(defaultProps, props))
+    // }
     FromURL.prototype.updateContentFromResponse = function (log, renderOptions) {
         // Allow listeners to inspect the response and either prevent the fragment change
         // or manipulate change options. An example for when this is useful is a maintenance
         // page with its own layout, that cannot be loaded as a fragment and must be loaded
         // with a full page load.
-        var event = this.buildEvent('up:fragment:loaded', { renderOptions: renderOptions });
-        this.request.assertEmitted(event, { log: log, callback: this.options.onLoaded });
+        this.request.assertEmitted('up:fragment:loaded', {
+            callback: this.options.onLoaded,
+            response: this.response,
+            log: log,
+            renderOptions: renderOptions,
+        });
         // The response might carry some updates for our change options,
         // like a server-set location, or server-sent events.
         this.augmentOptionsFromResponse(renderOptions);
@@ -5341,6 +5316,7 @@ up.Change.FromURL = /** @class */ (function (_super) {
         // If the server has provided an update to our context via the X-Up-Context
         // response header, merge it into our existing { context } option.
         renderOptions.context = u.merge(renderOptions.context, this.response.context);
+        renderOptions.cspNonces = this.response.cspNonces;
     };
     return FromURL;
 }(up.Change));
@@ -5858,9 +5834,16 @@ var e = up.element;
 up.EventListener = /** @class */ (function (_super) {
     __extends(EventListener, _super);
     function EventListener(attributes) {
+        var _a;
         var _this = _super.call(this, attributes) || this;
         _this.key = _this.constructor.buildKey(attributes);
-        _this.isDefault = up.framework.booting;
+        _this.isDefault = up.framework.evaling;
+        // We don't usually run up.on() listeners before Unpoly has booted.
+        // This is done so incompatible code is not called on browsers that don't support Unpoly.
+        // Listeners that do need to run before Unpoly boots can pass { beforeBoot: true } to override.
+        // We also default to { beforeBoot: true } for framework events that are emitted
+        // before booting.
+        (_a = _this.beforeBoot) !== null && _a !== void 0 ? _a : (_this.beforeBoot = _this.eventType.indexOf('up:framework:') === 0);
         // Need to store the bound nativeCallback function because addEventListener()
         // and removeEventListener() need to see the exact same reference.
         _this.nativeCallback = _this.nativeCallback.bind(_this);
@@ -5876,7 +5859,8 @@ up.EventListener = /** @class */ (function (_super) {
             'guard',
             'baseLayer',
             'passive',
-            'once'
+            'once',
+            'beforeBoot',
         ];
     };
     EventListener.prototype.bind = function () {
@@ -5906,6 +5890,9 @@ up.EventListener = /** @class */ (function (_super) {
     };
     EventListener.prototype.nativeCallback = function (event) {
         var _a;
+        if (up.framework.beforeBoot && !this.beforeBoot) {
+            return;
+        }
         // Once we drop IE11 support we can forward the { once } option
         // to Element#addEventListener().
         if (this.once) {
@@ -6023,7 +6010,8 @@ up.EventListenerGroup = /** @class */ (function (_super) {
             'guard',
             'baseLayer',
             'passive',
-            'once'
+            'once',
+            'beforeBoot',
         ];
     };
     EventListenerGroup.prototype.bind = function () {
@@ -8884,6 +8872,133 @@ up.MotionController = /** @class */ (function () {
 /* 49 */
 /***/ (function() {
+var __spreadArray = (this && this.__spreadArray) || function (to, from) {
+    for (var i = 0, il = from.length, j = to.length; i < il; i++, j++)
+        to[j] = from[i];
+    return to;
+};
+var u = up.util;
+var e = up.element;
+up.NonceableCallback = /** @class */ (function () {
+    function NonceableCallback(script, nonce) {
+        this.script = script;
+        this.nonce = nonce;
+    }
+    NonceableCallback.fromString = function (string) {
+        var match = string.match(/^(nonce-([^\s]+)\s)?(.*)$/);
+        return new this(match[3], match[2]);
+    };
+    /*-
+    Replacement for `new Function()` that can take a nonce to work with a strict Content Security Policy.
+    It also prints an error when a strict CSP is active, but user supplies no nonce.
+    ### Examples
+    ```js
+    new up.NonceableCallback('1 + 2', 'secret').toFunction()
+    ```
+    @function up.NonceableCallback#toFunction
+    @internal
+    */
+    NonceableCallback.prototype.toFunction = function () {
+        var argNames = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+            argNames[_i] = arguments[_i];
+        }
+        if (up.browser.canEval()) {
+            return new (Function.bind.apply(Function, __spreadArray(__spreadArray([void 0], argNames), [this.script])))();
+        }
+        else if (this.nonce) {
+            // Don't return a bound function so callers can re-bind to a different this.
+            var callbackThis_1 = this;
+            return function () {
+                var args = [];
+                for (var _i = 0; _i < arguments.length; _i++) {
+                    args[_i] = arguments[_i];
+                }
+                return callbackThis_1.runAsNoncedFunction(this, argNames, args);
+            };
+        }
+        else {
+            return this.cannotRun.bind(this);
+        }
+    };
+    NonceableCallback.prototype.toString = function () {
+        return "nonce-" + this.nonce + " " + this.script;
+    };
+    NonceableCallback.prototype.cannotRun = function () {
+        throw new Error("Your Content Security Policy disallows inline JavaScript (" + this.script + "). See https://unpoly.com/csp for solutions.");
+    };
+    NonceableCallback.prototype.runAsNoncedFunction = function (thisArg, argNames, args) {
+        var wrappedScript = "\n      try {\n        up.noncedEval.value = (function(" + argNames.join(',') + ") {\n          " + this.script + "\n        }).apply(up.noncedEval.thisArg, up.noncedEval.args)\n      } catch (error) {\n        up.noncedEval.error = error\n      }\n    ";
+        var script;
+        try {
+            up.noncedEval = { args: args, thisArg: thisArg };
+            script = up.element.affix(document.body, 'script', { nonce: this.nonce, text: wrappedScript });
+            if (up.noncedEval.error) {
+                throw up.noncedEval.error;
+            }
+            else {
+                return up.noncedEval.value;
+            }
+        }
+        finally {
+            up.noncedEval = undefined;
+            if (script) {
+                up.element.remove(script);
+            }
+        }
+    };
+    NonceableCallback.prototype.allowedBy = function (allowedNonces) {
+        return this.nonce && u.contains(allowedNonces, this.nonce);
+    };
+    NonceableCallback.adoptNonces = function (element, allowedNonces) {
+        var _this = this;
+        if (!(allowedNonces === null || allowedNonces === void 0 ? void 0 : allowedNonces.length)) {
+            return;
+        }
+        // Looking up a nonce requires a DOM query.
+        // For performance reasons we only do this when we're actually rewriting
+        // a nonce, and only once per response.
+        var getPageNonce = u.memoize(up.protocol.cspNonce);
+        u.each(up.protocol.config.nonceableAttributes, function (attribute) {
+            var matches = e.subtree(element, "[" + attribute + "^=\"nonce-\"]");
+            u.each(matches, function (match) {
+                var attributeValue = match.getAttribute(attribute);
+                var callback = _this.fromString(attributeValue);
+                var warn = function (message) {
+                    var _a;
+                    var args = [];
+                    for (var _i = 1; _i < arguments.length; _i++) {
+                        args[_i - 1] = arguments[_i];
+                    }
+                    return (_a = up.log).warn.apply(_a, __spreadArray(['up.render()', "Cannot use callback [" + attribute + "=\"" + attributeValue + "\"]: " + message], args));
+                };
+                if (!callback.allowedBy(allowedNonces)) {
+                    // Don't rewrite a nonce that the browser would have rejected.
+                    return warn("Callback's CSP nonce (%o) does not match response header (%o)", callback.nonce, allowedNonces);
+                }
+                // Replace the nonce with that of the current page.
+                // This will allow the handler to run via #toFunction().
+                var pageNonce = getPageNonce();
+                if (!pageNonce) {
+                    return warn("Current page's CSP nonce is unknown");
+                }
+                callback.nonce = pageNonce;
+                match.setAttribute(attribute, callback.toString());
+            });
+        });
+    };
+    return NonceableCallback;
+}());
+/***/ }),
+/* 50 */
+/***/ (function() {
 var __assign = (this && this.__assign) || function () {
     __assign = Object.assign || function(t) {
         for (var s, i = 1, n = arguments.length; i < n; i++) {
@@ -8959,7 +9074,7 @@ up.OptionsParser = /** @class */ (function () {
 /***/ }),
-/* 50 */
+/* 51 */
 /***/ (function() {
 var e = up.element;
@@ -9053,7 +9168,7 @@ up.OverlayFocus = /** @class */ (function () {
 /***/ }),
-/* 51 */
+/* 52 */
 /***/ (function() {
 var u = up.util;
@@ -9650,7 +9765,7 @@ up.Params = /** @class */ (function () {
 /***/ }),
-/* 52 */
+/* 53 */
 /***/ (function() {
 var e = up.element;
@@ -9708,7 +9823,7 @@ up.ProgressBar = /** @class */ (function () {
 /***/ }),
-/* 53 */
+/* 54 */
 /***/ (function() {
 var u = up.util;
@@ -9847,7 +9962,7 @@ up.RenderOptions = (function () {
 /***/ }),
-/* 54 */
+/* 55 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -9908,7 +10023,7 @@ up.RenderResult = /** @class */ (function (_super) {
 /***/ }),
-/* 55 */
+/* 56 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -10481,7 +10596,11 @@ up.Request = /** @class */ (function (_super) {
         // This way listeners can observe event-related events on a given layer.
         // This request has an optional { layer } attribute, which is used by
         // EventEmitter.
-        return up.EventEmitter.fromEmitArgs(args, { request: this, layer: this.layer });
+        return up.EventEmitter.fromEmitArgs(args, {
+            layer: this.layer,
+            request: this,
+            origin: this.origin
+        });
     };
     Request.prototype.emit = function () {
         var args = [];
@@ -10506,11 +10625,27 @@ up.Request = /** @class */ (function (_super) {
     });
     return Request;
 }(up.Record));
+// A request is also a promise ("thenable") for its response.
 u.delegate(up.Request.prototype, ['then', 'catch', 'finally'], function () { return this.deferred; });
+up.Request.tester = function (condition) {
+    if (u.isFunction(condition)) {
+        return condition;
+    }
+    else if (condition instanceof this) {
+        return function (request) { return condition === request; };
+    }
+    else if (u.isString(condition)) {
+        var pattern_1 = new up.URLPattern(condition);
+        return function (request) { return pattern_1.test(request.url); };
+    }
+    else { // boolean, truthy/falsy values
+        return function (_request) { return condition; };
+    }
+};
 /***/ }),
-/* 56 */
+/* 57 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -10560,26 +10695,24 @@ up.Request.Cache = /** @class */ (function (_super) {
     //        candidates.push(request.variant(target: 'body'))
     //
     //    u.findResult candidates, (candidate) => super(candidate)
-    Cache.prototype.clear = function (pattern) {
+    Cache.prototype.clear = function (condition) {
         var _this = this;
-        if (pattern && (pattern !== '*') && (pattern !== true)) {
-            pattern = new up.URLPattern(pattern);
-            return this.each(function (key, request) {
-                if (pattern.test(request.url)) {
-                    _this.store.remove(key);
-                }
-            });
-        }
-        else {
-            _super.prototype.clear.call(this);
-        }
+        if (condition === void 0) { condition = true; }
+        var tester = up.Request.tester(condition);
+        this.each(function (key, request) {
+            if (tester(request)) {
+                // It is generally not a great idea to manipulate the list we're iterating over,
+                // but the implementation of up.Cache#each copies keys before iterating.
+                _this.store.remove(key);
+            }
+        });
     };
     return Cache;
 }(up.Cache));
 /***/ }),
-/* 57 */
+/* 58 */
 /***/ (function() {
 var u = up.util;
@@ -10685,13 +10818,14 @@ up.Request.Queue = /** @class */ (function () {
     };
     // Aborting a request will cause its promise to reject, which will also uncache it
     Queue.prototype.abort = function (conditions) {
-        var _this = this;
         if (conditions === void 0) { conditions = true; }
+        var tester = up.Request.tester(conditions);
         var _loop_1 = function (list) {
-            var matches = u.filter(list, function (request) { return _this.requestMatches(request, conditions); });
-            matches.forEach(function (match) {
-                match.abort();
-                u.remove(list, match);
+            var abortableRequests = u.filter(list, tester);
+            abortableRequests.forEach(function (abortableRequest) {
+                abortableRequest.abort();
+                // Avoid changing the list we're iterating over.
+                u.remove(list, abortableRequest);
             });
         };
         for (var _i = 0, _a = [this.currentRequests, this.queuedRequests]; _i < _a.length; _i++) {
@@ -10704,9 +10838,6 @@ up.Request.Queue = /** @class */ (function () {
         var excusedCacheKey = excusedRequest.cacheKey();
         this.abort(function (queuedRequest) { return (queuedRequest.cacheKey() !== excusedCacheKey) && u.evalOption(additionalConditions, queuedRequest); });
     };
-    Queue.prototype.requestMatches = function (request, conditions) {
-        return (request === conditions) || u.evalOption(conditions, request);
-    };
     Queue.prototype.checkSlow = function () {
         var currentSlow = this.isSlow();
         if (this.emittedSlow !== currentSlow) {
@@ -10735,7 +10866,7 @@ up.Request.Queue = /** @class */ (function () {
 /***/ }),
-/* 58 */
+/* 59 */
 /***/ (function() {
 var u = up.util;
@@ -10763,7 +10894,7 @@ up.Request.FormRenderer = /** @class */ (function () {
             method = up.protocol.wrapMethod(method, this.params);
         }
         this.form = e.affix(document.body, 'form.up-request-loader', { method: method, action: action });
-        // We only need an [enctype] attribute if the user has explicitely
+        // We only need an [enctype] attribute if the user has explicitly
         // requested one. If none is given, we can use the browser's default
         // [enctype]. Binary values cannot be sent by this renderer anyway, so
         // we don't need to default to multipart/form-data in this case.
@@ -10788,7 +10919,7 @@ up.Request.FormRenderer = /** @class */ (function () {
 /***/ }),
-/* 59 */
+/* 60 */
 /***/ (function() {
 var CONTENT_TYPE_URL_ENCODED = 'application/x-www-form-urlencoded';
@@ -10896,7 +11027,7 @@ up.Request.XHRRenderer = /** @class */ (function () {
 /***/ }),
-/* 60 */
+/* 61 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -11080,6 +11211,13 @@ up.Response = /** @class */ (function (_super) {
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(Response.prototype, "cspNonces", {
+        get: function () {
+            return up.protocol.cspNoncesFromHeader(this.getHeader('Content-Security-Policy'));
+        },
+        enumerable: false,
+        configurable: true
+    });
     Object.defineProperty(Response.prototype, "json", {
         /*-
         The response body parsed as a JSON string.
@@ -11107,7 +11245,7 @@ up.Response = /** @class */ (function (_super) {
 /***/ }),
-/* 61 */
+/* 62 */
 /***/ (function() {
 var u = up.util;
@@ -11137,6 +11275,7 @@ up.ResponseDoc = /** @class */ (function () {
             this.parseDocument(options) ||
                 this.parseFragment(options) ||
                 this.parseContent(options);
+        this.cspNonces = options.cspNonces;
     }
     ResponseDoc.prototype.parseDocument = function (options) {
         return this.parse(options.document, e.createDocumentFromHTML);
@@ -11205,6 +11344,8 @@ up.ResponseDoc = /** @class */ (function () {
     ResponseDoc.prototype.finalizeElement = function (element) {
         // Restore <noscript> tags so they become available to compilers.
         this.noscriptWrapper.unwrap(element);
+        // Rewrite per-request CSP nonces to match that of the current page.
+        up.NonceableCallback.adoptNonces(element, this.cspNonces);
         // Restore <script> so they will run.
         this.scriptWrapper.unwrap(element);
     };
@@ -11213,7 +11354,7 @@ up.ResponseDoc = /** @class */ (function () {
 /***/ }),
-/* 62 */
+/* 63 */
 /***/ (function() {
 var e = up.element;
@@ -11251,7 +11392,7 @@ up.RevealMotion = /** @class */ (function () {
         var newScrollTop = originalScrollTop;
         if (this.top || (elementRect.height > viewportRect.height)) {
             // Element is either larger than the viewport,
-            // or the user has explicitely requested for the element to align at top
+            // or the user has explicitly requested for the element to align at top
             // => Scroll the viewport so the first element row is the first viewport row
             var diff = elementRect.top - viewportRect.top;
             newScrollTop += diff;
@@ -11335,7 +11476,7 @@ up.RevealMotion = /** @class */ (function () {
 /***/ }),
-/* 63 */
+/* 64 */
 /***/ (function() {
 var u = up.util;
@@ -11420,7 +11561,7 @@ up.ScrollMotion = /** @class */ (function () {
 /***/ }),
-/* 64 */
+/* 65 */
 /***/ (function() {
 var e = up.element;
@@ -11474,7 +11615,7 @@ up.Selector = /** @class */ (function () {
 /***/ }),
-/* 65 */
+/* 66 */
 /***/ (function() {
 var u = up.util;
@@ -11509,7 +11650,7 @@ up.store.Memory = /** @class */ (function () {
 /***/ }),
-/* 66 */
+/* 67 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -11597,7 +11738,7 @@ up.store.Session = /** @class */ (function (_super) {
 /***/ }),
-/* 67 */
+/* 68 */
 /***/ (function() {
 var u = up.util;
@@ -11759,7 +11900,7 @@ up.Tether = /** @class */ (function () {
 /***/ }),
-/* 68 */
+/* 69 */
 /***/ (function() {
 var u = up.util;
@@ -11787,7 +11928,17 @@ up.URLPattern = /** @class */ (function () {
         if (!list.length) {
             return;
         }
-        var reCode = list.map(this.normalizeURL).map(u.escapeRegExp).join('|');
+        list = list.map(function (url) {
+            // If the current browser location is multiple directories deep (e.g. /foo/bar),
+            // a leading asterisk would be normalized to /foo/*. So we prepend a slash.
+            if (url[0] === '*') {
+                url = '/' + url;
+            }
+            url = _this.normalizeURL(url);
+            url = u.escapeRegExp(url);
+            return url;
+        });
+        var reCode = list.join('|');
         reCode = reCode.replace(/\\\*/g, '.*?');
         reCode = reCode.replace(/(:|\\\$)([a-z][\w-]*)/ig, function (match, type, name) {
             // It's \\$ instead of $ because we do u.escapeRegExp above
@@ -11843,14 +11994,32 @@ up.URLPattern = /** @class */ (function () {
 /***/ }),
-/* 69 */
+/* 70 */
 /***/ (function() {
 /*-
+Framework initialization
+========================
+The `up.framework` module lets you customize Unpoly's [initialization sequence](/install#initialization).
+@see up.boot
+@see script[up-boot=manual]
+@see up.framework.isSupported
 @module up.framework
 */
 up.framework = (function () {
-    var booting = true;
+    // Event                          up.framework.readyState   document.readyState
+    // ------------------------------------------------------------------------------------------------------
+    // Browser starts parsing HTML    -                         loading
+    // Unpoly script is running       evaling                   loading (if sync) or interactive (if defered)
+    // ... submodules are running     evaling                   loading (if sync) or interactive (if defered)
+    // User scripts are running       configuring               loading (if sync) or interactive (if defered)
+    // DOMContentLoaded               configuring => booting    interactive
+    // Initial page is compiling      booting                   interactive
+    // Document resources loaded      booted                    complete
+    var readyState = 'evaling'; // evaling => configuring => booting => booted
     /*-
     Resets Unpoly to the state when it was booted.
     All custom event handlers, animations, etc. that have been registered
@@ -11871,64 +12040,172 @@ up.framework = (function () {
     @internal
     */
     /*-
-    Boots the Unpoly framework.
+    Manually boots the Unpoly framework.
+    It is not usually necessary to call `up.boot()` yourself. When you load [Unpoly's JavaScript file](/install),
+    Unpoly will automatically boot on [`DOMContentLoaded`](https://developer.mozilla.org/en-US/docs/Web/API/Window/DOMContentLoaded_event).
+    There are only two cases when you would boot manually:
+    - When you load Unpoly with `<script async>`
+    - When you explicitly ask to manually boot by loading Unpoly with [`<script up-boot="manual">`](/script-up-boot-manual).
-    **This is called automatically** by including the Unpoly JavaScript files.
+    Before you manually boot, Unpoly should be configured and compilers should be registered.
+    Booting will cause Unpoly to [compile](/up.hello) the initial page.
-    Unpoly will not boot if the current browser is [not supported](/up.browser.isSupported).
+    Unpoly will refuse to boot if the current browser is [not supported](/up.framework.isSupported).
     This leaves you with a classic server-side application on legacy browsers.
     @function up.boot
-    @internal
+    @experimental
     */
     function boot() {
+        if (readyState !== 'configuring') {
+            // In an app with a lot of async script the user may attempt to boot us twice.
+            console.error('Unpoly has already booted');
+            return;
+        }
         // This is called synchronously after all Unpoly modules have been parsed
         // and executed. We cannot delay booting until the DOM is ready, since by then
         // all user-defined event listeners and compilers will have registered.
         // Note that any non-async scripts after us will delay DOMContentLoaded.
-        var supportIssue = up.browser.supportIssue();
+        var supportIssue = up.framework.supportIssue();
         if (!supportIssue) {
-            // Some Unpoly modules will use the up:framework:boot event to:
-            //
-            // - Snapshot their state before user-defined compilers, handlers, etc. have
-            //   been registered. We need to know this state for when we up.reset() later.
-            // - Run delayed initialization that could not run at load time due to
-            //   circular dependencies.
+            // Change the state in case any user-provided compiler calls up.boot().
+            // up.boot() is a no-op unless readyState === 'configuring'.
+            readyState = 'booting';
             up.emit('up:framework:boot', { log: false });
-            booting = false;
-            // From here on, all event handlers (both Unpoly's and user code) want to
-            // work with the DOM, so wait for the DOM to be ready.
-            up.event.onReady(function () {
-                // By now all non-sync <script> tags have been loaded and called, including
-                // those after us. All user-provided compilers, event handlers, etc. have
-                // been registered.
-                //
-                // The following event will cause Unpoly to compile the <body>.
-                up.emit('up:app:boot', { log: 'Booting user application' });
-            });
+            readyState = 'booted';
+        }
+        else {
+            console.error("Unpoly cannot boot: %s", supportIssue);
+        }
+    }
+    function mustBootManually() {
+        var unpolyScript = document.currentScript;
+        // If we're is loaded via <script async>, there are no guarantees
+        // when we're called or when subsequent scripts that configure Unpoly
+        // have executed
+        if (unpolyScript === null || unpolyScript === void 0 ? void 0 : unpolyScript.async) {
+            return true;
+        }
+        // If we're loaded with <script up-boot="manual"> the user explicitly
+        // requested to boot Unpoly manually.
+        if ((unpolyScript === null || unpolyScript === void 0 ? void 0 : unpolyScript.getAttribute('up-boot')) === 'manual') {
+            return true;
+        }
+        // If we're loaded this late, someone loads us dynamically.
+        // We don't know when subsequent scripts that configure Unpoly
+        // have executed.
+        if (document.readyState === 'complete') {
+            return true;
+        }
+    }
+    /*-
+    Prevent Unpoly from booting automatically.
+    By default Unpoly [automatically boots](/install#initialization)
+    on [`DOMContentLoaded`](https://developer.mozilla.org/en-US/docs/Web/API/Window/DOMContentLoaded_event).
+    To prevent this, add an `[up-boot="manual"]` attribute to the `<script>` element
+    that loads Unpoly:
+    ```html
+    <script src="unpoly.js" up-boot="manual"></script>
+    ```
+    You may then call `up.boot()` to manually boot Unpoly at a later time.
+    ### Browser support
+    To use this feature in Internet Explorer 11 you need a polyfill for `document.currentScript`.
+    @selector script[up-boot=manual]
+    @experimental
+    */
+    function onEvaled() {
+        up.emit('up:framework:evaled', { log: false });
+        if (mustBootManually()) {
+            console.debug('Call up.boot() after you have configured Unpoly');
         }
         else {
-            console.error("Unpoly cannot load: %s", supportIssue);
+            // (1) On DOMContentLoaded we know that all non-[async] scripts have executed.
+            // (2) Deferred scripts execute after the DOM was parsed (document.readyState === 'interactive'),
+            //     but before DOMContentLoaded. That's why we must *not* boot synchonously when
+            //     document.readyState === 'interactive'. We must wait until DOMContentLoaded, when we know that
+            //     subsequent users scripts have executed and (possibly) configured Unpoly.
+            // (3) There are no guarantees when [async] scripts execute. These must boot Unpoly manually.
+            document.addEventListener('DOMContentLoaded', boot);
         }
+        // After this line user scripts may run and configure Unpoly, add compilers, etc.
+        readyState = 'configuring';
     }
     function startExtension() {
-        booting = true;
+        if (readyState !== 'configuring') {
+            throw new Error('Unpoly extensions must be loaded before booting');
+        }
+        readyState = 'evaling';
     }
     function stopExtension() {
-        booting = false;
+        readyState = 'configuring';
+    }
+    /*-
+    Returns whether Unpoly can boot in the current browser.
+    If this returns `false` Unpoly will prevent itself from [booting](/up.boot)
+    and will not [compile](/up.compiler) the initial page.
+    This leaves you with a classic server-side application.
+    ### Browser support
+    Unpoly aims to supports all modern browsers.
+    #### Chrome, Firefox, Edge, Safari
+    Full support.
+    #### Internet Explorer 11
+    Full support with a `Promise` polyfill like [es6-promise](https://github.com/stefanpenner/es6-promise) (2.4 KB).\
+    Support may be removed when Microsoft retires IE11 in [June 2022](https://blogs.windows.com/windowsexperience/2021/05/19/the-future-of-internet-explorer-on-windows-10-is-in-microsoft-edge/).
+    #### Internet Explorer 10 or lower
+    Unpoly will not boot or [run compilers](/up.compiler),
+    leaving you with a classic server-side application.
+    @function up.framework.isSupported
+    @stable
+    */
+    function isSupported() {
+        return !supportIssue();
+    }
+    function supportIssue() {
+        if (!up.browser.canPromise()) {
+            return "Browser doesn't support promises";
+        }
+        if (document.compatMode === 'BackCompat') {
+            return 'Browser is in quirks mode (missing DOCTYPE?)';
+        }
+        if (up.browser.isEdge18()) {
+            return 'Edge 18 or lower is unsupported';
+        }
     }
     return {
+        onEvaled: onEvaled,
         boot: boot,
         startExtension: startExtension,
         stopExtension: stopExtension,
         reset: emitReset,
-        get booting() { return booting; }
+        get evaling() { return readyState === 'evaling'; },
+        get booted() { return readyState === 'booted'; },
+        get beforeBoot() { return readyState !== 'booting' && readyState !== 'booted'; },
+        isSupported: isSupported,
+        supportIssue: supportIssue,
     };
 })();
+up.boot = up.framework.boot;
 /***/ }),
-/* 70 */
+/* 71 */
 /***/ (function() {
 /*-
@@ -11940,7 +12217,7 @@ This module contains functions to [emit](/up.emit) and [observe](/up.on) DOM eve
 While the browser also has built-in functions to work with events,
 you will find Unpoly's functions to be very concise and feature-rich.
-*# Events emitted by Unpoly
+### Events emitted by Unpoly
 Most Unpoly features emit events that are prefixed with `up:`.
@@ -11981,6 +12258,7 @@ up.event = (function () {
     - You may pass a selector for [event delegation](https://davidwalsh.name/event-delegate).
     - The event target is automatically passed as a second argument.
+    - Your event listener will not be called when Unpoly has not [booted](/up.boot) in an unsupported browser
     - You may register a listener to multiple events by passing a space-separated list of event name (e.g. `"click mousedown"`)
     - You may register a listener to multiple elements in a single `up.on()` call, by passing a [list](/up.util.isList) of elements.
     - You use an [`[up-data]`](/up-data) attribute to [attach structured data](/up.on#attaching-structured-data)
@@ -12422,30 +12700,6 @@ up.event = (function () {
         event.stopImmediatePropagation();
         event.preventDefault();
     }
-    /*-
-    Runs the given callback when the the initial HTML document has been completely loaded.
-    The callback is guaranteed to see the fully parsed DOM tree.
-    This function does not wait for stylesheets, images or frames to finish loading.
-    If `up.event.onReady()` is called after the initial document was loaded,
-    the given callback is run immediately.
-    @function up.event.onReady
-    @param {Function} callback
-      The function to call then the DOM tree is acessible.
-    @experimental
-    */
-    function onReady(callback) {
-        // Values are "loading", "interactive" and "completed".
-        // https://developer.mozilla.org/en-US/docs/Web/API/Document/readyState
-        if (document.readyState !== 'loading') {
-            callback();
-        }
-        else {
-            document.addEventListener('DOMContentLoaded', callback);
-        }
-    }
     var keyModifiers = ['metaKey', 'shiftKey', 'ctrlKey', 'altKey'];
     /*-
     @function up.event.isUnmodified
@@ -12531,7 +12785,6 @@ up.event = (function () {
         assertEmitted: assertEmitted,
         onEscape: onEscape,
         halt: halt,
-        onReady: onReady,
         isUnmodified: isUnmodified,
         fork: fork,
         keyModifiers: keyModifiers
@@ -12545,7 +12798,7 @@ up.emit = up.event.emit;
 /***/ }),
-/* 71 */
+/* 72 */
 /***/ (function() {
 /*-
@@ -12564,7 +12817,7 @@ While the protocol can help you optimize performance and handle some edge cases,
 implementing it is **entirely optional**. For instance, `unpoly.com` itself is a static site
 that uses Unpoly on the frontend and doesn't even have an active server component.
-*# Existing implementations
+### Existing implementations
 You should be able to implement the protocol in a very short time.
@@ -12763,23 +13016,39 @@ up.protocol = (function () {
         return extractHeader(xhr, 'clearCache', parseClearCacheValue);
     }
     /*-
-    The server may send this optional response header with the value `clear` to [clear the cache](/up.cache.clear).
+    The server may send this optional response header to control which previously cached responses should be [uncached](/up.cache.clear) after this response.
-    ### Example
+    The value of this header is a [URL pattern](/url-patterns) matching responses that should be uncached.
+    For example, to uncache all responses to URLs starting with `/notes/`:
     ```http
-    X-Up-Cache: clear
+    X-Up-Clear-Cache: /notes/*
     ```
-    @header X-Up-Cache
-    @param value
-      The string `"clear"`.
+    ### Overriding the client-side default
+    If the server does not send an `X-Up-Clear-Cache` header, Unpoly will [clear the entire cache](/up.network.config#config.clearCache) after a non-GET request.
+    You may force Unpoly to *keep* the cache after a non-GET request:
+    ```http
+    X-Up-Clear-Cache: false
+    ```
+    You may also force Unpoly to *clear* the cache after a GET request:
+    ```http
+    X-Up-Clear-Cache: *
+    ```
+    @header X-Up-Clear-Cache
     @stable
     */
     /*-
     This request header contains a timestamp of an existing fragment that is being [reloaded](/up.reload).
-    The timestamp must be explicitely set by the user as an `[up-time]` attribute on the fragment.
+    The timestamp must be explicitly set by the user as an `[up-time]` attribute on the fragment.
     It should indicate the time when the fragment's underlying data was last changed.
     See `[up-time]` for a detailed example.
@@ -13093,7 +13362,7 @@ up.protocol = (function () {
     ### Rendering content
     The response may contain `text/html` content. If the root layer is targeted,
-    the `X-Up-Accept-Layer` header is ignored and the fragment is updated with
+    the `X-Up-Dismiss-Layer` header is ignored and the fragment is updated with
     the response's HTML content.
     If you know that an overlay will be closed don't want to render HTML,
@@ -13102,7 +13371,7 @@ up.protocol = (function () {
     ```http
     HTTP/1.1 200 OK
     Content-Type: text/html
-    X-Up-Accept-Layer: {"user_id": 1012}
+    X-Up-Dismiss-Layer: {"user_id": 1012}
     X-Up-Target: :none
     ```
@@ -13224,11 +13493,27 @@ up.protocol = (function () {
       <meta name='csrf-token' content='secret12345'>
       ```
+    @param {string|Function(): string} [config.cspNonce]
+      A [CSP script nonce](https://content-security-policy.com/nonce/)
+      for the initial page that [booted](/up.boot) Unpoly.
+      The nonce let Unpoly run JavaScript in HTML attributes like
+      [`[up-on-loaded]`](/a-up-follow#up-on-loaded) or [`[up-on-accepted]`](/a-up-layer-new#up-on-accepted).
+      See [Working with a strict Content Security Policy](/csp).
+      The nonce can either be configured as a string or as function that returns the nonce.
+      Defaults to the `content` attribute of a `<meta>` tag named `csp-nonce`:
+      ```
+      <meta name='csrf-token' content='secret98765'>
+      ```
     @param {string} [config.methodParam='_method']
       The name of request parameter containing the original request method when Unpoly needs to wrap
       the method.
-      Methods must be wrapped when making a [full page request](/up.browser.loadPage) with a methods other
+      Methods must be wrapped when making a [full page request](/up.network.loadPage) with a methods other
       than GET or POST. In this case Unpoly will make a POST request with the original request method
       in a form parameter named `_method`:
@@ -13246,7 +13531,9 @@ up.protocol = (function () {
         methodParam: '_method',
         csrfParam: function () { return e.metaContent('csrf-param'); },
         csrfToken: function () { return e.metaContent('csrf-token'); },
-        csrfHeader: 'X-CSRF-Token' // Used by Rails. Other frameworks use different headers.
+        cspNonce: function () { return e.metaContent('csp-nonce'); },
+        csrfHeader: 'X-CSRF-Token',
+        nonceableAttributes: ['up-observe', 'up-on-accepted', 'up-on-dismissed', 'up-on-loaded', 'up-on-finished', 'up-observe'],
     }); });
     function csrfHeader() {
         return u.evalOption(config.csrfHeader);
@@ -13257,6 +13544,26 @@ up.protocol = (function () {
     function csrfToken() {
         return u.evalOption(config.csrfToken);
     }
+    function cspNonce() {
+        return u.evalOption(config.cspNonce);
+    }
+    function cspNoncesFromHeader(cspHeader) {
+        var nonces = [];
+        if (cspHeader) {
+            var parts = cspHeader.split(/\s*;\s*/);
+            for (var _i = 0, parts_1 = parts; _i < parts_1.length; _i++) {
+                var part = parts_1[_i];
+                if (part.indexOf('script-src') === 0) {
+                    var noncePattern = /'nonce-([^']+)'/g;
+                    var match = void 0;
+                    while (match = noncePattern.exec(part)) {
+                        nonces.push(match[1]);
+                    }
+                }
+            }
+        }
+        return nonces;
+    }
     function wrapMethod(method, params) {
         params.add(config.methodParam, method);
         return 'POST';
@@ -13280,15 +13587,17 @@ up.protocol = (function () {
         csrfHeader: csrfHeader,
         csrfParam: csrfParam,
         csrfToken: csrfToken,
+        cspNonce: cspNonce,
         initialRequestMethod: initialRequestMethod,
         headerize: headerize,
-        wrapMethod: wrapMethod
+        wrapMethod: wrapMethod,
+        cspNoncesFromHeader: cspNoncesFromHeader,
     };
 })();
 /***/ }),
-/* 72 */
+/* 73 */
 /***/ (function() {
 var __spreadArray = (this && this.__spreadArray) || function (to, from) {
@@ -13317,13 +13626,13 @@ up.log = (function () {
     Configures the logging output on the developer console.
     @property up.log.config
-    @param {boolean} [options.enabled=false]
+    @param {boolean} [config.enabled=false]
       Whether Unpoly will print debugging information to the developer console.
       Debugging information includes which elements are being [compiled](/up.syntax)
       and which [events](/up.event) are being emitted.
       Note that errors will always be printed, regardless of this setting.
-    @param {boolean} [options.banner=true]
+    @param {boolean} [config.banner=true]
       Print the Unpoly banner to the developer console.
     @stable
     */
@@ -13401,7 +13710,7 @@ up.log = (function () {
             console[stream].apply(console, __spreadArray([message], args));
         }
     }
-    var printBanner = function () {
+    function printBanner() {
         if (!config.banner) {
             return;
         }
@@ -13427,8 +13736,8 @@ up.log = (function () {
         else {
             console.log(logo + text);
         }
-    };
-    up.on('up:app:boot', printBanner);
+    }
+    up.on('up:framework:boot', printBanner);
     up.on('up:framework:reset', reset);
     function setEnabled(value) {
         sessionStore.set('enabled', value);
@@ -13528,7 +13837,7 @@ up.log = (function () {
         disable: disable,
         fail: fail,
         muteUncriticalRejection: muteUncriticalRejection,
-        isEnabled: function () { return config.enabled; }
+        isEnabled: function () { return config.enabled; },
     };
 })();
 up.puts = up.log.puts;
@@ -13537,7 +13846,7 @@ up.fail = up.log.fail;
 /***/ }),
-/* 73 */
+/* 74 */
 /***/ (function() {
 /*-
@@ -13795,7 +14104,7 @@ up.syntax = (function () {
             args[_i] = arguments[_i];
         }
         var macro = buildCompiler(args);
-        if (up.framework.booting) {
+        if (up.framework.evaling) {
             macro.priority = detectSystemMacroPriority(macro.selector) ||
                 up.fail('Unregistered priority for system macro %o', macro.selector);
         }
@@ -13860,7 +14169,7 @@ up.syntax = (function () {
         var _a = parseCompilerArgs(args), selector = _a[0], options = _a[1], callback = _a[2];
         options = u.options(options, {
             selector: selector,
-            isDefault: up.framework.booting,
+            isDefault: up.framework.evaling,
             priority: 0,
             batch: false,
             keep: false,
@@ -13869,6 +14178,9 @@ up.syntax = (function () {
         return u.assign(callback, options);
     }
     function insertCompiler(queue, newCompiler) {
+        if (up.framework.booted) {
+            up.puts('up.compiler()', 'Compiler %s was registered after booting Unpoly. Compiler will run for future fragments.', newCompiler.selector);
+        }
         var existingCompiler;
         var index = 0;
         while ((existingCompiler = queue[index]) && (existingCompiler.priority >= newCompiler.priority)) {
@@ -14056,7 +14368,7 @@ up.data = up.syntax.data;
 /***/ }),
-/* 74 */
+/* 75 */
 /***/ (function() {
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
@@ -14335,7 +14647,7 @@ up.history = (function () {
             replace(currentLocation(), { event: false });
         }
     }
-    up.on('up:app:boot', function () {
+    up.on('up:framework:boot', function () {
         if ('jasmine' in window) {
             // Can't delay this in tests.
             register();
@@ -14400,7 +14712,7 @@ up.history = (function () {
 /***/ }),
-/* 75 */
+/* 76 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __assign = (this && this.__assign) || function () {
@@ -14414,7 +14726,7 @@ var __assign = (this && this.__assign) || function () {
     };
     return __assign.apply(this, arguments);
 };
-__webpack_require__(76);
+__webpack_require__(77);
 var u = up.util;
 var e = up.element;
 /*-
@@ -14815,7 +15127,7 @@ up.fragment = (function () {
       for the fragment.
     @param {string|Element} [options.fragment]
-      A string of HTML comprising *only* the new fragment.
+      A string of HTML comprising *only* the new fragment's [outer HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/outerHTML).
       The `{ target }` selector will be derived from the root element in the given
       HTML:
@@ -14915,11 +15227,17 @@ up.fragment = (function () {
     @param {boolean|string} [options.clearCache]
       Whether existing [cache](/up.request#caching) entries will be [cleared](/up.cache.clear) with this request.
-      You may also pass a [URL pattern](/url-patterns) to only clear matching requests.
+      Defaults to the result of `up.network.config.clearCache`, which
+      defaults to clearing the entire cache after a non-GET request.
-      By default a non-GET request will clear the entire cache.
+      To only uncache some requests, pass an [URL pattern](/url-patterns) that matches requests to uncache.
+      You may also pass a function that accepts an existing `up.Request` and returns a boolean value.
-      Also see [`up.request({ clearCache })`](/up.request#options.clearCache) and `up.network.config.clearCache`.
+    @param {boolean|string|Function(request): boolean} [options.solo]
+      With `{ solo: true }` Unpoly will [abort](/up.network.abort) all other requests before laoding the new fragment.
+      To only abort some requests, pass an [URL pattern](/url-patterns) that matches requests to abort.
+      You may also pass a function that accepts an existing `up.Request` and returns a boolean value.
     @param {Element|jQuery} [options.origin]
       The element that triggered the change.
@@ -15106,12 +15424,19 @@ up.fragment = (function () {
     to mutate options to the `up.render()` call that will process the server response.
     @event up:fragment:loaded
     @param event.preventDefault()
       Event listeners may call this method to prevent the fragment change.
     @param {up.Request} event.request
       The original request to the server.
     @param {up.Response} event.response
       The server response.
+    @param {Element} [event.origin]
+      The link or form element that caused the fragment update.
     @param {Object} event.renderOptions
       Options for the `up.render()` call that will process the server response.
     @stable
@@ -15218,14 +15543,16 @@ up.fragment = (function () {
     @stable
     */
     /*-
-    Compiles a page fragment that has been inserted into the DOM
+    Manually compiles a page fragment that has been inserted into the DOM
     by external code.
+    All registered [compilers](/up.compiler) and [macros](/up.macro) will be called
+    with matches in the given `element`.
     **As long as you manipulate the DOM using Unpoly, you will never
-    need to call this method.** You only need to use `up.hello()` if the
+    need to call `up.hello()`.** You only need to use `up.hello()` if the
     DOM is manipulated without Unpoly' involvement, e.g. by setting
-    the `innerHTML` property or calling jQuery methods like
-    `html`, `insertAfter` or `appendTo`:
+    the `innerHTML` property:
     ```html
     element = document.createElement('div')
@@ -15237,7 +15564,7 @@ up.fragment = (function () {
     event.
     @function up.hello
-    @param {Element|jQuery} target
+    @param {Element|jQuery} element
     @param {Element|jQuery} [options.origin]
     @return {Element}
       The compiled element
@@ -16178,7 +16505,7 @@ up.fragment = (function () {
         selector = parseSelector(selector, element, options);
         return selector.matches(element);
     }
-    up.on('up:app:boot', function () {
+    up.on('up:framework:boot', function () {
         var body = document.body;
         body.setAttribute('up-source', up.history.location);
         hello(body);
@@ -16237,13 +16564,13 @@ u.delegate(up, 'context', function () { return up.layer.current; });
 /***/ }),
-/* 76 */
+/* 77 */
 /***/ (function() {
 /***/ }),
-/* 77 */
+/* 78 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __spreadArray = (this && this.__spreadArray) || function (to, from) {
@@ -16251,7 +16578,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from) {
         to[j] = from[i];
     return to;
 };
-__webpack_require__(78);
+__webpack_require__(79);
 /*-
 Scrolling viewports
 ===================
@@ -16748,23 +17075,6 @@ up.viewport = (function () {
         return up.fragment.toTarget(viewport);
     }
     /*-
-    Returns a hash with scroll positions.
-    Each key in the hash is a viewport selector. The corresponding
-    value is the viewport's top scroll position:
-        up.viewport.scrollTops()
-        => { '.main': 0, '.sidebar': 73 }
-    @function up.viewport.scrollTops
-    @return Object<string, number>
-    @internal
-    */
-    function scrollTops(options) {
-        if (options === void 0) { options = {}; }
-        return u.mapObject(getAll(options), function (viewport) { return [scrollTopKey(viewport), viewport.scrollTop]; });
-    }
-    /*-
     @function up.viewport.fixedElements
     @internal
     */
@@ -16808,6 +17118,19 @@ up.viewport = (function () {
             options.layer.lastScrollTops.set(url, tops);
         }
     }
+    /*-
+    Returns a hash with scroll positions.
+    Each key in the hash is a viewport selector. The corresponding
+    value is the viewport's top scroll position:
+        getScrollTops()
+        => { '.main': 0, '.sidebar': 73 }
+    @function up.viewport.getScrollTops
+    @return Object<string, number>
+    @internal
+    */
     function getScrollTops(viewports) {
         return u.mapObject(viewports, function (viewport) { return [scrollTopKey(viewport), viewport.scrollTop]; });
     }
@@ -17080,8 +17403,9 @@ up.viewport = (function () {
         return value === null || value === void 0 ? void 0 : value.replace(/^#/, '');
     }
     var userScrolled = false;
-    up.on('scroll', { once: true }, function () { return userScrolled = true; });
-    up.on('up:app:boot', function () {
+    up.on('scroll', { once: true, beforeBoot: true }, function () { return userScrolled = true; });
+    up.on('up:framework:boot', function () {
+        // When the initial URL contains an #anchor link, the browser will automatically
         // reveal a matching fragment. We want to override that behavior with our own,
         // so we can honor configured obstructions. Since we cannot disable the automatic
         // browser behavior we need to ensure our code runs after it.
@@ -17089,7 +17413,7 @@ up.viewport = (function () {
         // In Chrome, when reloading, the browser behavior happens before DOMContentLoaded.
         // However, when we follow a link with an #anchor URL, the browser
         // behavior happens *after* DOMContentLoaded. Hence we wait one more task.
-        return u.task(function () {
+        u.task(function () {
             // If the user has scrolled while the page was loading, we will
             // not reset their scroll position by revealing the #anchor fragment.
             if (!userScrolled) {
@@ -17117,16 +17441,14 @@ up.viewport = (function () {
         rootOverflowElement: rootOverflowElement,
         isRoot: isRoot,
         scrollbarWidth: scrollbarWidth,
-        scrollTops: scrollTops,
         saveScroll: saveScroll,
         restoreScroll: restoreScroll,
         resetScroll: resetScroll,
         anchoredRight: anchoredRight,
-        fixedElements: fixedElements,
         absolutize: absolutize,
         focus: doFocus,
         tryFocus: tryFocus,
-        makeFocusable: makeFocusable
+        makeFocusable: makeFocusable,
     };
 })();
 up.focus = up.viewport.focus;
@@ -17135,13 +17457,13 @@ up.reveal = up.viewport.reveal;
 /***/ }),
-/* 78 */
+/* 79 */
 /***/ (function() {
 /***/ }),
-/* 79 */
+/* 80 */
 /***/ (function() {
 var __assign = (this && this.__assign) || function () {
@@ -17709,7 +18031,7 @@ up.motion = (function () {
     */
     function registerTransition(name, transition) {
         var fn = findTransitionFn(transition);
-        fn.isDefault = up.framework.booting;
+        fn.isDefault = up.framework.evaling;
         namedTransitions[name] = fn;
     }
     /*-
@@ -17748,16 +18070,16 @@ up.motion = (function () {
     */
     function registerAnimation(name, animation) {
         var fn = findAnimationFn(animation);
-        fn.isDefault = up.framework.booting;
+        fn.isDefault = up.framework.evaling;
         namedAnimations[name] = fn;
     }
-    function warnIfDisabled() {
+    up.on('up:framework:boot', function () {
         // Explain to the user why animations aren't working.
         // E.g. the user might have disabled animations in her OS.
         if (!isEnabled()) {
             up.puts('up.motion', 'Animations are disabled');
         }
-    }
+    });
     /*-
     Returns whether the given animation option will cause the animation
     to be skipped.
@@ -17874,7 +18196,6 @@ up.motion = (function () {
       @see server-errors
     @stable
     */
-    up.on('up:framework:boot', warnIfDisabled);
     up.on('up:framework:reset', reset);
     return {
         morph: morph,
@@ -17897,10 +18218,10 @@ up.animate = up.motion.animate;
 /***/ }),
-/* 80 */
+/* 81 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
-__webpack_require__(81);
+__webpack_require__(82);
 var u = up.util;
 /*-
 Network requests
@@ -18126,7 +18447,7 @@ up.network = (function () {
     By default Unpoly automatically clears the entire cache whenever it processes
     a request with an non-GET HTTP method. To customize this rule, use `up.network.config.clearCache`.
-    The server may also clear the cache by sending an [`X-Up-Cache: clear`](/X-Up-Cache) header.
+    The server may also clear the cache by sending an [`X-Up-Clear-Cache`](/X-Up-Clear-Cache) header.
     @function up.cache.clear
     @param {string} [pattern]
@@ -18272,11 +18593,17 @@ up.network = (function () {
     @param {boolean|string} [options.clearCache]
       Whether to [clear](/up.cache.clear) the [cache](/up.cache.get) after this request.
-      You may also pass a [URL pattern](/url-patterns) to only clear matching requests.
       Defaults to the result of `up.network.config.clearCache`, which
       defaults to clearing the entire cache after a non-GET request.
+      You may also pass a [URL pattern](/url-patterns) to only uncache matching responses.
+    @param {boolean|string|Function} [options.solo]
+      With `{ solo: true }` Unpoly will [abort](/up.network.abort) all other requests before making this new request.
+      To only abort some requests, pass an [URL pattern](/url-patterns) that matches requests to abort.
+      You may also pass a function that accepts an existing `up.Request` and returns a boolean value.
     @param {Object} [options.headers={}]
       An object of additional HTTP headers.
@@ -18306,6 +18633,11 @@ up.network = (function () {
     @param {string} [options.layer='current']
       The [layer](/up.layer) this request is associated with.
+      If this request is intended to update an existing fragment, this is that fragment's layer.
+      If this request is intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
     @param {string} [options.failLayer='current']
       The [layer](/up.layer) this request is associated with if the server [sends a HTTP status code](/server-errors).
@@ -18462,6 +18794,24 @@ up.network = (function () {
      */
     var isIdle = u.negate(isBusy);
     /*-
+    Makes a full-page request, replacing the entire browser environment with a new page from the server response.
+    Also see `up.Request#loadPage()`.
+    @function up.network.loadPage
+    @param {string} options.url
+      The URL to load.
+    @param {string} [options.method='get']
+      The method for the request.
+      Methods other than GET or POST will be [wrapped](/up.protocol.config#config.methodParam) in a POST request.
+    @param {Object|Array|FormData|string} [options.params]
+    @experimental
+    */
+    function loadPage(requestsAttrs) {
+        new up.Request(requestsAttrs).loadPage();
+    }
+    /*-
     Returns whether optional requests should be avoided where possible.
     We assume the user wants to avoid requests if either of following applies:
@@ -18548,11 +18898,23 @@ up.network = (function () {
     The event is emitted on the layer that caused the request.
     @event up:request:aborted
     @param {up.Request} event.request
       The aborted request.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request was intended to update an existing fragment, this is that fragment's layer.
+      If this request was intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @param event.preventDefault()
     @experimental
     */
     /*-
@@ -18631,7 +18993,14 @@ up.network = (function () {
     @param {up.Request} event.request
       The request to be sent.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request is intended to update an existing fragment, this is that fragment's layer.
+      If this request is intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @param event.preventDefault()
       Event listeners may call this method to prevent the request from being sent.
     @stable
@@ -18657,12 +19026,24 @@ up.network = (function () {
     The event is emitted on the layer that caused the request.
     @event up:request:loaded
     @param {up.Request} event.request
       The request.
     @param {up.Response} event.response
       The response that was received from the server.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request is intended to update an existing fragment, this is that fragment's layer.
+      If this request is intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @stable
     */
     /*-
@@ -18676,10 +19057,21 @@ up.network = (function () {
     The event is emitted on the layer that caused the request.
     @event up:request:fatal
     @param {up.Request} event.request
-      The request.
+      The failed request.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request was intended to update an existing fragment, this is that fragment's layer.
+      If this request was intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @stable
     */
     function isSafeMethod(method) {
@@ -18707,7 +19099,8 @@ up.network = (function () {
         registerAliasForRedirect: registerAliasForRedirect,
         queue: queue,
         shouldReduceRequests: shouldReduceRequests,
-        mimicLocalRequest: mimicLocalRequest
+        mimicLocalRequest: mimicLocalRequest,
+        loadPage: loadPage,
     };
 })();
 up.request = up.network.request;
@@ -18715,13 +19108,13 @@ up.cache = up.network.cache;
 /***/ }),
-/* 81 */
+/* 82 */
 /***/ (function() {
 /***/ }),
-/* 82 */
+/* 83 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __assign = (this && this.__assign) || function () {
@@ -18776,7 +19169,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from) {
         to[j] = from[i];
     return to;
 };
-__webpack_require__(83);
+__webpack_require__(84);
 var u = up.util;
 var e = up.element;
 /*-
@@ -19478,6 +19871,8 @@ up.layer = (function () {
       | `value`    | The overlay's [acceptance value](/closing-overlays#overlay-result-values) |
       | `event`    | An `up:layer:accepted` event                  |
+      With a strict Content Security Policy [additional rules apply](/csp).
     @param [up-on-dismissed]
       A JavaScript snippet that is called when the overlay was [dismissed](/closing-overlays).
@@ -19490,6 +19885,8 @@ up.layer = (function () {
       | `value`    | The overlay's [dismissal value](/closing-overlays#overlay-result-values) |
       | `event`    | An `up:layer:dismissed` event                   |
+      With a strict Content Security Policy [additional rules apply](/csp).
     @param [up-accept-event]
       One or more space-separated event types that will cause this overlay to automatically be
       [accepted](/closing-overlays) when a matching event occurs within the overlay.
@@ -19615,7 +20012,10 @@ up.layer = (function () {
     up.on('up:fragment:destroyed', function () {
         stack.sync();
     });
-    up.on('up:framework:boot', function () {
+    up.on('up:framework:evaled', function () {
+        // Due to circular dependencies we must delay initialization of the stack until all of
+        // Unpoly's submodules have been evaled. We cannot delay initialization until up:framework:boot,
+        // since by then user scripts have run and event listeners will no longer register as "default".
         stack = new up.LayerStack();
     });
     up.on('up:framework:reset', reset);
@@ -19982,13 +20382,13 @@ up.layer = (function () {
 /***/ }),
-/* 83 */
+/* 84 */
 /***/ (function() {
 /***/ }),
-/* 84 */
+/* 85 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __assign = (this && this.__assign) || function () {
@@ -20007,7 +20407,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from) {
         to[j] = from[i];
     return to;
 };
-__webpack_require__(85);
+__webpack_require__(86);
 /*-
 Linking to fragments
 ====================
@@ -20242,7 +20642,7 @@ up.link = (function () {
             if (options.cache == null) {
                 options.cache = 'auto';
             }
-            options.basic = true; //
+            options.basic = true;
             var request = new up.Request(options);
             return request.willCache();
         }
@@ -20297,6 +20697,13 @@ up.link = (function () {
       You may pass this additional `options` object to supplement or override
       options parsed from the link attributes.
+    @param {boolean} [options.navigate=true]
+      Whether this fragment update is considered [navigation](/navigation).
+      Setting this to `false` will disable most defaults, causing
+      Unpoly to render a fragment without side-effects like updating history
+      or scrolling.
     @return {Promise<up.RenderResult>}
       A promise that will be fulfilled when the link destination
       has been loaded and rendered.
@@ -20315,7 +20722,7 @@ up.link = (function () {
         parser.json('params');
         parser.booleanOrString('cache');
         parser.booleanOrString('clearCache');
-        parser.boolean('solo');
+        parser.booleanOrString('solo');
         parser.string('contentType', { attr: ['enctype', 'up-content-type'] });
         return options;
     }
@@ -20508,7 +20915,7 @@ up.link = (function () {
     }
     function followURL(link, options) {
         if (options === void 0) { options = {}; }
-        var url = options.url || link.getAttribute('href') || link.getAttribute('up-href');
+        var url = options.url || link.getAttribute('up-href') || link.getAttribute('href');
         // Developers sometimes make a <a href="#"> to give a JavaScript interaction standard
         // link behavior (like keyboard navigation or default styles). However, we don't want to
         // consider this  a link with remote content, and rather honor [up-content], [up-document]
@@ -20773,6 +21180,13 @@ up.link = (function () {
     @selector a[up-follow]
+    @param [up-navigate='true']
+      Whether this fragment update is considered [navigation](/navigation).
+      Setting this to `false` will disable most defaults documented below,
+      causing Unpoly to render a fragment without side-effects like updating history
+      or scrolling.
     @param [href]
       The URL to fetch from the server.
@@ -20784,7 +21198,7 @@ up.link = (function () {
       If omitted a [main target](/up-main) will be rendered.
-    @param [up-fallback]
+    @param [up-fallback='true']
       Specifies behavior if the [target selector](/up.render#options.target) is missing from the current page or the server response.
       If set to a CSS selector, Unpoly will attempt to replace that selector instead.
@@ -20793,9 +21207,6 @@ up.link = (function () {
       If set to `false` Unpoly will immediately reject the render promise.
-    @param [up-navigate='true']
-      Whether this fragment update is considered [navigation](/navigation).
     @param [up-method='get']
       The HTTP method to use for the request.
@@ -20820,8 +21231,15 @@ up.link = (function () {
       E.g. the `X-Up-Target` header includes the targeted CSS selector.
       See `up.protocol` and `up.network.config.requestMetaKeys` for details.
+    @param [up-content]
+      A string for the fragment's new [inner HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML).
+      If your HTML string also contains the fragment's [outer HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/outerHTML),
+      consider the `[up-fragment]` attribute instead.
     @param [up-fragment]
-      A string of HTML comprising *only* the new fragment. No server request will be sent.
+      A string of HTML comprising *only* the new fragment's
+      [outer HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/outerHTML).
       The `[up-target]` selector will be derived from the root element in the given
       HTML:
@@ -20858,7 +21276,7 @@ up.link = (function () {
       See [handling server errors](/server-errors) for details.
-    @param [up-history]
+    @param [up-history='auto']
       Whether the browser URL and window title will be updated.
       If set to `true`, the history will always be updated, using the title and URL from
@@ -20909,7 +21327,7 @@ up.link = (function () {
       See [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/CSS/transition-timing-function)
       for a list of available timing functions.
-    @param [up-cache]
+    @param [up-cache='auto']
       Whether to read from and write to the [cache](/up.request#caching).
       With `[up-cache=true]` Unpoly will try to re-use a cached response before connecting
@@ -20919,6 +21337,8 @@ up.link = (function () {
       With `[up-cache=auto]` Unpoly will use the cache only if `up.network.config.autoCache`
       returns `true` for the request.
+      With `[up-cache=false]` Unpoly will always make a network request.
       Also see [`up.request({ cache })`](/up.request#options.cache).
     @param [up-clear-cache]
@@ -20929,6 +21349,11 @@ up.link = (function () {
       Also see [`up.request({ clearCache })`](/up.request#options.clearCache) and `up.network.config.clearCache`.
+    @param [up-solo='true']
+      With `[up-solo=true]` Unpoly will [abort](/up.network.abort) all other requests before laoding the new fragment.
+      To only abort some requests, pass an [URL pattern](/url-patterns) that matches requests to abort.
     @param [up-layer='origin current']
       The [layer](/up.layer) in which to match and render the fragment.
@@ -20937,7 +21362,7 @@ up.link = (function () {
       To [open the fragment in a new overlay](/opening-overlays), pass `[up-layer=new]`.
       In this case attributes for `a[up-layer=new]` may also be used.
-    @param [up-peel]
+    @param [up-peel='true']
       Whether to close overlays obstructing the updated layer when the fragment is updated.
       This is only relevant when updating a layer that is not the [frontmost layer](/up.layer.front).
@@ -20952,7 +21377,7 @@ up.link = (function () {
     @param [up-hungry='true']
       Whether [`[up-hungry]`](/up-hungry) elements outside the updated fragment will also be updated.
-    @param [up-scroll]
+    @param [up-scroll='auto']
       How to scroll after the new fragment was rendered.
       See [scroll option](/scroll-option) for a list of allowed values.
@@ -20962,7 +21387,7 @@ up.link = (function () {
       Saved scroll positions can later be restored with [`[up-scroll=restore]`](/scroll-option#restoring-scroll-positions).
-    @param [up-focus]
+    @param [up-focus='auto']
       What to focus after the new fragment was rendered.
       See [focus option](/focus-option) for a list of allowed values.
@@ -20974,7 +21399,7 @@ up.link = (function () {
       If the user does not confirm the render promise will reject and no fragments will be updated.
-    @param [up-feedback]
+    @param [up-feedback='true']
       Whether to give the link an `.up-active` class
       while loading and rendering content.
@@ -20984,10 +21409,14 @@ up.link = (function () {
       The callback argument is a preventable `up:fragment:loaded` event.
+      With a strict Content Security Policy [additional rules apply](/csp).
     @param [up-on-finished]
       A JavaScript snippet that is called when all animations have concluded and
       elements were removed from the DOM tree.
+      With a strict Content Security Policy [additional rules apply](/csp).
     @stable
     */
     up.on('up:click', fullFollowSelector, function (event, link) {
@@ -21118,13 +21547,13 @@ up.follow = up.link.follow;
 /***/ }),
-/* 85 */
+/* 86 */
 /***/ (function() {
 /***/ }),
-/* 86 */
+/* 87 */
 /***/ (function() {
 var __assign = (this && this.__assign) || function () {
@@ -21171,7 +21600,7 @@ up.form = (function () {
       You can configure Unpoly to handle *all* forms on a page without requiring an `[up-submit]` attribute:
       ```js
-      up.form.config.submitSelectors.push('form']
+      up.form.config.submitSelectors.push('form')
       ```
       Individual forms may opt out with an `[up-submit=follow]` attribute.
@@ -21314,6 +21743,11 @@ up.form = (function () {
       You may pass this additional `options` object to supplement or override
       options parsed from the form attributes.
+    @param {boolean} [options.navigate=true]
+      Whether this fragment update is considered [navigation](/navigation).
+      Setting this to `false` will disable most defaults.
     @return {Promise<up.RenderResult>}
       A promise that will be fulfilled when the server response was rendered.
@@ -21512,6 +21946,15 @@ up.form = (function () {
         }
         elements = e.list(elements);
         var fields = u.flatMap(elements, findFields);
+        var unnamedFields = u.reject(fields, 'name');
+        if (unnamedFields.length) {
+            // (1) We do not need to exclude the unnamed fields for up.FieldObserver, since that
+            //     parses values with up.Params.fromFields(), and that ignores unnamed fields.
+            // (2) Only warn, don't crash. There are some legitimate cases for having unnamed
+            //     a mix of named and unnamed fields in a form, and we don't want to prevent
+            //     <form up-observe> in that case.
+            up.warn('up.observe()', 'Will not observe fields without a [name]: %o', unnamedFields);
+        }
         var callback = u.extractCallback(args) || observeCallbackFromElement(elements[0]) || up.fail('up.observe: No change callback given');
         var options = u.extractOptions(args);
         options.delay = (_b = (_a = options.delay) !== null && _a !== void 0 ? _a : e.numberAttr(elements[0], 'up-delay')) !== null && _b !== void 0 ? _b : config.observeDelay;
@@ -21522,7 +21965,7 @@ up.form = (function () {
     function observeCallbackFromElement(element) {
         var rawCallback = element.getAttribute('up-observe');
         if (rawCallback) {
-            return new Function('value', 'name', rawCallback);
+            return up.NonceableCallback.fromString(rawCallback).toFunction('value', 'name');
         }
     }
     /*-
@@ -21867,7 +22310,7 @@ up.form = (function () {
     @selector form[up-submit]
     @params-note
-      All attributes for `a[up-follow]` may also be used.
+      All attributes for `a[up-follow]` may be used.
     @stable
     */
@@ -22198,6 +22641,8 @@ up.form = (function () {
     This is useful for observing text fields while the user is typing.
     If you want to submit the form after a change see [`input[up-autosubmit]`](/input-up-autosubmit).
+    With a strict Content Security Policy [additional rules apply](/csp).
     The programmatic variant of this is the [`up.observe()`](/up.observe) function.
     ### Example
@@ -22259,6 +22704,8 @@ up.form = (function () {
     This is useful for observing text fields while the user is typing.
     If you want to submit the form after a change see [`input[up-autosubmit]`](/input-up-autosubmit).
+    With a strict Content Security Policy [additional rules apply](/csp).
     The programmatic variant of this is the [`up.observe()`](/up.observe) function.
     ### Example
@@ -22378,7 +22825,7 @@ up.validate = up.form.validate;
 /***/ }),
-/* 87 */
+/* 88 */
 /***/ (function() {
 /*-
@@ -22817,7 +23264,7 @@ up.feedback = (function () {
 /***/ }),
-/* 88 */
+/* 89 */
 /***/ (function() {
 /*-
@@ -23034,7 +23481,7 @@ up.radio = (function () {
 /***/ }),
-/* 89 */
+/* 90 */
 /***/ (function() {
 /*
@@ -23173,16 +23620,17 @@ __webpack_require__(72);
 __webpack_require__(73);
 __webpack_require__(74);
 __webpack_require__(75);
-__webpack_require__(77);
-__webpack_require__(79);
+__webpack_require__(76);
+__webpack_require__(78);
 __webpack_require__(80);
-__webpack_require__(82);
-__webpack_require__(84);
-__webpack_require__(86);
+__webpack_require__(81);
+__webpack_require__(83);
+__webpack_require__(85);
 __webpack_require__(87);
 __webpack_require__(88);
 __webpack_require__(89);
-up.framework.boot();
+__webpack_require__(90);
+up.framework.onEvaled();
 }();
 /******/ })()