RubyGems - unpoly-rails - Versions diffs - 2.2.1 → 2.3.0 - Mend

unpoly-rails 2.2.1 → 2.3.0

Potentially problematic release.

This version of unpoly-rails might be problematic. Click here for more details.

Files changed (11) hide show

checksums.yaml +4 -4
data/README.md +25 -0
data/assets/unpoly/unpoly-migrate.js +39 -14
data/assets/unpoly/unpoly-migrate.min.js +1 -1
data/assets/unpoly/unpoly.es5.js +746 -298
data/assets/unpoly/unpoly.es5.min.js +1 -1
data/assets/unpoly/unpoly.js +738 -309
data/assets/unpoly/unpoly.min.js +1 -1
data/lib/unpoly/rails/change.rb +13 -0
data/lib/unpoly/rails/version.rb +1 -1
metadata +2 -2

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7809f10d4c1b68d409df8b692a4ec180664a84e8bf5f11f5ada7477b908a6c52
-  data.tar.gz: daa269b194e0ae2779ee6a087aeac46d04054c995e713c9905bbb8a67c7e0d13
+  metadata.gz: 91c3f510e29295809e0304db849e1853897d8f14fbe6b363519458dca5c0294a
+  data.tar.gz: 43a927f3a2946f63e02c2676514eeee7d5689750e38de4528d6d140e1be2a47e
 SHA512:
-  metadata.gz: 69401e8930e26d6388502b1e0693929bdc5ba6ba12548326660289ccbe459cf6dc376c5820c914a6634913c352723e01c1cf4f3ecf3bc877fc80828687edeb56
-  data.tar.gz: c4fb6d692762c58efc8a2ce01f632b277184ff9d7691942939da1277aa8021f501c65df5d355d33264a16871ae4f74e29c66da39341830050b252b3913de9060
+  metadata.gz: 501d2a3533c6c3225fd702d6ce4de682c0359d13f9e8063c1390c547ec8782afb0f70597e9b768ce945b69fde2b72c21a1bcc099c13b15d7107207201ebd5300
+  data.tar.gz: 513bbe7a3764942a35696d3ea5d7335fff289b914732a1b17bbe31f5da896ca7979f263e8fa000373641dd939f1a2e1bb2c26cf6b5290325fc24598b2cff8a3a

data/README.md CHANGED Viewed

@@ -242,6 +242,31 @@ Only rendering when needed saves <b>CPU time</b> on your server, which spends mo
 This also reduces the <b>bandwidth cost</b> for a request/response exchange to **~1 KB**.
+### Allowing callbacks with a strict CSP
+When your Content Security Policy disallows `eval()`, Unpoly cannot directly run callbacks HTML attributes. This affects `[up-]` attributes like `[up-on-loaded]` or `[up-on-accepted]`. See [Unpoly's CSP guide](https://unpoly.com/csp) for details.
+The following callback would crash the fragment update with an error like `Uncaught EvalError: call to Function() blocked by CSP`:
+```ruby
+link_to 'Click me', '/path, 'up-follow': true, 'up-on-loaded': "alert()"
+```
+Unpoly lets your work around this by prefixing your callback with your response's [CSP nonce](https://content-security-policy.com/nonce/):
+```ruby
+link_to 'Click me', '/path', 'up-follow': true, 'up-on-loaded': 'nonce-kO52Iphm8BAVrcdGcNYjIA== alert()')
+```
+To keep your callbacks compact, you may use the `up.safe_callback` helper for this:
+```ruby
+link_to 'Click me', '/path, 'up-follow': true, 'up-on-loaded': up.safe_callback("alert()")
+```
+For this to work you must also include the `<meta name="csp-nonce">` tag in the `<head>` of your initial page. Rails has a [`csp_meta_tag`](https://api.rubyonrails.org/classes/ActionView/Helpers/CspHelper.html#method-i-csp_meta_tag) helper for that purpose.
 ### Working with context
 Calling `up.context` will return the [context](https://unpoly.com/up.context) object of the targeted layer.

data/assets/unpoly/unpoly-migrate.js CHANGED Viewed

@@ -253,6 +253,30 @@ up.util.times = function (count, block) {
 /* 3 */
 /***/ (function() {
+up.browser.loadPage = function () {
+    var _a;
+    var args = [];
+    for (var _i = 0; _i < arguments.length; _i++) {
+        args[_i] = arguments[_i];
+    }
+    up.migrate.deprecated('up.browser.loadPage', 'up.network.loadPage');
+    return (_a = up.network).loadPage.apply(_a, args);
+};
+up.browser.isSupported = function () {
+    var _a;
+    var args = [];
+    for (var _i = 0; _i < arguments.length; _i++) {
+        args[_i] = arguments[_i];
+    }
+    up.migrate.deprecated('up.browser.isSupported', 'up.framework.isSupported');
+    return (_a = up.framework).isSupported.apply(_a, args);
+};
+/***/ }),
+/* 4 */
+/***/ (function() {
 /*-
 @module up.element
 */
@@ -294,7 +318,7 @@ up.element.createFromHtml = function () {
 /***/ }),
-/* 4 */
+/* 5 */
 /***/ (function() {
 /*-
@@ -333,7 +357,7 @@ up.event.nobodyPrevents = function () {
 /***/ }),
-/* 5 */
+/* 6 */
 /***/ (function() {
 var u = up.util;
@@ -369,7 +393,7 @@ up.migrate.targetMacro = function (queryAttr, fixedResultAttrs, callback) {
 /***/ }),
-/* 6 */
+/* 7 */
 /***/ (function() {
 /*-
@@ -380,7 +404,7 @@ up.migrate.renamedProperty(up.form.config, 'submitButtons', 'submitButtonSelecto
 /***/ }),
-/* 7 */
+/* 8 */
 /***/ (function() {
 var __assign = (this && this.__assign) || function () {
@@ -550,7 +574,7 @@ up.migrate.preprocessRenderOptions = function (options) {
 /***/ }),
-/* 8 */
+/* 9 */
 /***/ (function() {
 /*-
@@ -577,7 +601,7 @@ up.migrate.renamedEvent('up:history:replaced', 'up:location:changed');
 /***/ }),
-/* 9 */
+/* 10 */
 /***/ (function() {
 /*-
@@ -588,7 +612,7 @@ up.migrate.renamedProperty(up.feedback.config, 'navs', 'navSelectors');
 /***/ }),
-/* 10 */
+/* 11 */
 /***/ (function() {
 /*-
@@ -635,7 +659,7 @@ up.migrate.targetMacro('up-dash', { 'up-preload': '', 'up-instant': '' }, functi
 /***/ }),
-/* 11 */
+/* 12 */
 /***/ (function() {
 /*-
@@ -702,7 +726,7 @@ up.util.getter(up.Layer.prototype, 'historyVisible', function () {
 /***/ }),
-/* 12 */
+/* 13 */
 /***/ (function() {
 /*-
@@ -894,7 +918,7 @@ up.migrate.targetMacro('up-drawer', { 'up-layer': 'new drawer' }, function () {
 /***/ }),
-/* 13 */
+/* 14 */
 /***/ (function() {
 /*-
@@ -1021,7 +1045,7 @@ up.migrate.targetMacro('up-popup', { 'up-layer': 'new popup' }, function () { re
 /***/ }),
-/* 14 */
+/* 15 */
 /***/ (function() {
 /*-
@@ -1040,7 +1064,7 @@ up.macro('[up-tooltip]', function (opener) {
 /***/ }),
-/* 15 */
+/* 16 */
 /***/ (function() {
 var u = up.util;
@@ -1180,7 +1204,7 @@ up.on('up:framework:reset', disableProgressBarIfCustomIndicator);
 /***/ }),
-/* 16 */
+/* 17 */
 /***/ (function() {
 /*-
@@ -1190,7 +1214,7 @@ up.migrate.renamedProperty(up.radio.config, 'hungry', 'hungrySelectors');
 /***/ }),
-/* 17 */
+/* 18 */
 /***/ (function() {
 /*-
@@ -1272,6 +1296,7 @@ __webpack_require__(14);
 __webpack_require__(15);
 __webpack_require__(16);
 __webpack_require__(17);
+__webpack_require__(18);
 up.framework.stopExtension();
 }();

data/assets/unpoly/unpoly-migrate.min.js CHANGED Viewed

	@@ -1 +1 @@
1	- !function(){var e={700:function(){up.element.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.first()","up.element.get()"),(e=up.element).get.apply(e,r)},up.element.createFromHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.createFromHtml","up.element.createFromHTML"),(e=up.element).createFromHTML.apply(e,r)}},394:function(){up.migrate.renamedPackage("bus","event"),up.event.nobodyPrevents=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.event.nobodyPrevents(type)","!up.emit(type).defaultPrevented");var t=up.emit.apply(up,e);return!t.defaultPrevented}},729:function(){up.migrate.renamedPackage("navigation","feedback"),up.migrate.renamedProperty(up.feedback.config,"navs","navSelectors")},305:function(){up.migrate.renamedProperty(up.form.config,"fields","fieldSelectors"),up.migrate.renamedProperty(up.form.config,"submitButtons","submitButtonSelectors")},354:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=up.util;up.migrate.renamedPackage("flow","fragment"),up.migrate.renamedPackage("dom","fragment"),up.migrate.renamedProperty(up.fragment.config,"fallbacks","mainTargets"),up.migrate.handleResponseDocOptions=function(e){return up.migrate.fixKey(e,"html","document")},up.replace=function(r,t,a){return up.migrate.deprecated("up.replace(target, url)","up.navigate(target, { url })"),up.navigate(e(e({},a),{target:r,url:t}))},up.extract=function(r,t,a){return up.migrate.deprecated("up.extract(target, document)","up.navigate(target, { document })"),up.navigate(e(e({},a),{target:r,document:t}))},up.fragment.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.fragment.first()","up.fragment.get()"),(e=up.fragment).get.apply(e,r)},up.first=up.fragment.first,up.migrate.handleScrollOptions=function(e){r.isUndefined(e.scroll)&&(r.isString(e.reveal)?(up.migrate.deprecated("Option { reveal: '"+e.reveal+"' }","{ scroll: '"+e.reveal+"' }"),e.scroll=e.reveal):!0===e.reveal?(up.migrate.deprecated("Option { reveal: true }","{ scroll: 'target' }"),e.scroll="target"):!1===e.reveal&&(up.migrate.deprecated("Option { reveal: false }","{ scroll: false }"),e.scroll=!1),r.isDefined(e.resetScroll)&&(up.migrate.deprecated("Option { resetScroll: true }","{ scroll: 'reset' }"),e.scroll="teset"),r.isDefined(e.restoreScroll)&&(up.migrate.deprecated("Option { restoreScroll: true }","{ scroll: 'restore' }"),e.scroll="restore"))},up.migrate.handleHistoryOption=function(e){r.isString(e.history)&&"auto"!==e.history&&(up.migrate.warn("Passing a URL as { history } option is deprecated. Pass it as { location } instead."),e.location=e.history,e.history="auto")},up.migrate.preprocessRenderOptions=function(e){up.migrate.handleHistoryOption(e);for(var t=0,a=["target","origin"];t<a.length;t++){var n=a[t];r.isJQuery(e[n])&&(up.migrate.warn("Passing a jQuery collection as { %s } is deprecated. Pass it as a native element instead.",n),e[n]=up.element.get(e[n]))}}},869:function(){up.migrate.renamedProperty(up.history.config,"popTargets","restoreTargets"),up.history.url=function(){return up.migrate.deprecated("up.history.url()","up.history.location"),up.history.location},up.migrate.renamedEvent("up:history:push","up:location:changed"),up.migrate.renamedEvent("up:history:pushed","up:location:changed"),up.migrate.renamedEvent("up:history:restore","up:location:changed"),up.migrate.renamedEvent("up:history:restored","up:location:changed"),up.migrate.renamedEvent("up:history:replaced","up:location:changed")},905:function(){up.migrate.handleLayerOptions=function(e){up.migrate.fixKey(e,"flavor","mode"),up.migrate.fixKey(e,"closable","dismissable"),up.migrate.fixKey(e,"closeLabel","dismissLabel");for(var r=0,t=["width","maxWidth","height"];r<t.length;r++){var a=t[r];e[a]&&up.migrate.warn("Layer option { "+a+" } has been removed. Use { size } or { class } instead.")}e.sticky&&up.migrate.warn("Layer option { sticky } has been removed. Give links an [up-peel=false] attribute to prevent layer dismissal on click."),e.template&&up.migrate.warn("Layer option { template } has been removed. Use { class } or modify the layer HTML on up:layer:open."),"page"===e.layer&&(up.migrate.warn("Option { layer: 'page' } has been renamed to { layer: 'root' }."),e.layer="root"),"modal"!==e.layer&&"popup"!==e.layer\|\|(up.migrate.warn("Option { layer: '"+e.layer+"' } has been removed. Did you mean { layer: 'overlay' }?"),e.layer="overlay")},up.migrate.handleTetherOptions=function(e){var r=e.position.split("-"),t=r[0],a=r[1];a&&(up.migrate.warn("The position value %o is deprecated. Use %o instead.",e.position,{position:t,align:a}),e.position=t,e.align=a)},up.migrate.registerLayerCloser=function(e){return e.registerClickCloser("up-close",(function(r,t){up.migrate.deprecated("[up-close]","[up-dismiss]"),e.dismiss(r,t)}))},up.migrate.handleLayerConfig=function(e){return up.migrate.fixKey(e,"historyVisible","history")},up.util.getter(up.Layer.prototype,"historyVisible",(function(){return up.migrate.deprecated("up.Layer#historyVisible","up.Layer#history"),this.history}))},969:function(){up.migrate.parseFollowOptions=function(e){e.string("flavor"),e.string("width"),e.string("height"),e.boolean("closable"),e.booleanOrString("reveal"),e.boolean("resetScroll"),e.boolean("restoreScroll"),e.booleanOrString("historyVisible")},up.migrate.targetMacro("up-dash",{"up-preload":"","up-instant":""},(function(){return up.migrate.deprecated("a[up-dash]","up.link.config.instantSelectors or up.link.config.preloadSelectors")}))},992:function(){var e=this&&this.__spreadArray\|\|function(e,r){for(var t=0,a=r.length,n=e.length;t<a;t++,n++)e[n]=r[t];return e},r=up.util;up.migrate=function(){var t=new up.Config((function(){return{logLevel:"warn"}})),a={};function n(e){var r=a[e];return r?(u("Event "+e+" has been renamed to "+r),r):e}var p={};function u(a){for(var n,u=[],o=1;o<arguments.length;o++)u[o-1]=arguments[o];var i=r.sprintf.apply(r,e([a],u));p[i]\|\|(p[i]=!0,(n=up.log)[t.logLevel].apply(n,e(["unpoly-migrate",a],u)))}return up.on("up:framework:reset",(function(){t.reset()})),{deprecated:function(e,r){u(e+" has been deprecated. Use "+r+" instead.")},renamedPackage:function(e,r){Object.defineProperty(up,e,{get:function(){return u("up."+e+" has been renamed to up."+r),up[r]}})},renamedProperty:function(e,r,t){var a=function(){return u("Property { %s } has been renamed to { %s } (found in %o)",r,t,e)};return Object.defineProperty(e,r,{get:function(){return a(),this[t]},set:function(e){a(),this[t]=e}})},formerlyAsync:function(e){var r=Promise.resolve(),t=r.then;return r.then=function(){return u(e+" is now a sync function"),t.apply(this,arguments)},r},renamedEvent:function(e,r){a[e]=r},fixEventTypes:function(e){return r.uniq(r.map(e,n))},fixKey:function(e,t,a){r.isDefined(e[t])&&(u("Property { %s } has been renamed to { %s } (found in %o)",t,a,e),r.renameKey(e,t,a))},warn:u,loaded:!0,config:t}}()},413:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=new Error("up.modal.flavors has been removed without direct replacement. You may give new layers a { class } or modify layer elements on up:layer:open.");up.modal={visit:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.visit(url)",'up.layer.open({ url, mode: "modal" })'),up.layer.open(e(e({},t),{url:r,mode:"modal"}))},follow:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.follow(link)",'up.follow(link, { layer: "modal" })'),up.follow(r,e(e({},t),{layer:"modal"}))},extract:function(r,t,a){return void 0===a&&(a={}),up.migrate.deprecated("up.modal.extract(target, document)",'up.layer.open({ document, mode: "modal" })'),up.layer.open(e(e({},a),{target:r,html:t,layer:"modal"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.modal.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.modal.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.modal.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.modal.config","up.layer.config.modal"),up.layer.config.modal},contains:function(e){return up.migrate.deprecated("up.modal.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.modal.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},get flavors(){throw r},flavor:function(){throw r}},up.migrate.renamedEvent("up:modal:open","up:layer:open"),up.migrate.renamedEvent("up:modal:opened","up:layer:opened"),up.migrate.renamedEvent("up:modal:close","up:layer:dismiss"),up.migrate.renamedEvent("up:modal:closed","up:layer:dismissed"),up.migrate.targetMacro("up-modal",{"up-layer":"new modal"},(function(){return up.migrate.deprecated("a[up-modal]",'a[up-layer="new modal"]')})),up.migrate.targetMacro("up-drawer",{"up-layer":"new drawer"},(function(){return up.migrate.deprecated("a[up-drawer]",'a[up-layer="new drawer"]')}))},885:function(){var e=up.util;up.migrate.renamedPackage("proxy","network"),up.migrate.renamedEvent("up:proxy:load","up:request:load"),up.migrate.renamedEvent("up:proxy:received","up:request:loaded"),up.migrate.renamedEvent("up:proxy:loaded","up:request:loaded"),up.migrate.renamedEvent("up:proxy:fatal","up:request:fatal"),up.migrate.renamedEvent("up:proxy:aborted","up:request:aborted"),up.migrate.renamedEvent("up:proxy:slow","up:request:late"),up.migrate.renamedEvent("up:proxy:recover","up:request:recover");var r=function(){return up.migrate.deprecated("up.proxy.config.preloadDelay","up.link.config.preloadDelay")};Object.defineProperty(up.network.config,"preloadDelay",{get:function(){return r(),up.link.config.preloadDelay},set:function(e){r(),up.link.config.preloadDelay=e}}),up.migrate.renamedProperty(up.network.config,"maxRequests","concurrency"),up.migrate.renamedProperty(up.network.config,"slowDelay","badResponseTime"),up.migrate.handleRequestOptions=function(e){return up.migrate.fixKey(e,"data","params")},up.ajax=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.ajax()","up.request()");var t=function(e){return e.text};return up.request.apply(up,e).then(t)},up.network.clear=function(){up.migrate.deprecated("up.proxy.clear()","up.cache.clear()"),up.cache.clear()},up.network.preload=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.proxy.preload(link)","up.link.preload(link)"),(e=up.link).preload.apply(e,r)},up.Request.prototype.navigate=function(){up.migrate.deprecated("up.Request#navigate()","up.Request#loadPage()"),this.loadPage()},up.Response.prototype.isSuccess=function(){return up.migrate.deprecated("up.Response#isSuccess()","up.Response#ok"),this.ok},up.Response.prototype.isError=function(){return up.migrate.deprecated("up.Response#isError()","!up.Response#ok"),!this.ok};var t=up.network.config.progressBar;function a(){up.network.config.progressBar=function(){return r=up.EventListener.allNonDefault(document),e.find(r,(function(e){return"up:request:late"===e.eventType}))?(up.migrate.warn("Disabled the default progress bar as may have built a custom loading indicator with your up:request:late listener. Please set up.network.config.progressBar to true or false."),!1):t;var r}}a(),up.on("up:framework:reset",a)},69:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)};up.popup={attach:function(r,t){return void 0===t&&(t={}),r=up.fragment.get(r),up.migrate.deprecated("up.popup.attach(origin)","up.layer.open({ origin, layer: 'popup' })"),up.layer.open(e(e({},t),{origin:r,layer:"popup"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.popup.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.popup.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.popup.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.popup.config","up.layer.config.popup"),up.layer.config.popup},contains:function(e){return up.migrate.deprecated("up.popup.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.popup.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},sync:function(){return up.migrate.deprecated("up.popup.sync()","up.layer.sync()"),up.layer.sync()}},up.migrate.renamedEvent("up:popup:open","up:layer:open"),up.migrate.renamedEvent("up:popup:opened","up:layer:opened"),up.migrate.renamedEvent("up:popup:close","up:layer:dismiss"),up.migrate.renamedEvent("up:popup:closed","up:layer:dismissed"),up.migrate.targetMacro("up-popup",{"up-layer":"new popup"},(function(){return up.migrate.deprecated("[up-popup]",'[up-layer="new popup"]')}))},228:function(){up.migrate.renamedProperty(up.radio.config,"hungry","hungrySelectors")},629:function(){var e=up.util,r=up.element;up.migrate.postCompile=function(r,t){var a;if(a=t.keep){up.migrate.warn("The { keep: true } option for up.compiler() has been removed. Have the compiler set [up-keep] attribute instead.");for(var n=e.isString(a)?a:"",p=0,u=r;p<u.length;p++)u[p].setAttribute("up-keep",n)}},up.migrate.targetMacro=function(t,a,n){up.macro("["+t+"]",(function(p){var u,o=e.copy(a);(u=p.getAttribute(t))?o["up-target"]=u:o["up-follow"]="",r.setMissingAttrs(p,o),p.removeAttribute(t),null==n\|\|n()}))}},197:function(){up.macro("[up-tooltip]",(function(e){up.migrate.warn("[up-tooltip] has been deprecated. A [title] was set instead."),up.element.setMissingAttr(e,"title",e.getAttribute("up-tooltip"))}))},480:function(){up.util.only=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.only(object, ...keys)","up.util.pick(object, keys)"),up.util.pick(e,r)},up.util.except=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.except(object, ...keys)","up.util.omit(object, keys)"),up.util.omit(e,r)},up.util.parseUrl=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.parseUrl() has been renamed to up.util.parseURL()"),(e=up.util).parseURL.apply(e,r)},up.util.any=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.any() has been renamed to up.util.some()"),(e=up.util).some.apply(e,r)},up.util.all=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.all() has been renamed to up.util.every()"),(e=up.util).every.apply(e,r)},up.util.detect=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.detect() has been renamed to up.util.find()"),(e=up.util).find.apply(e,r)},up.util.select=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.select() has been renamed to up.util.filter()"),(e=up.util).filter.apply(e,r)},up.util.setTimer=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.setTimer() has been renamed to up.util.timer()"),(e=up.util).timer.apply(e,r)},up.util.escapeHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.util.escapeHtml","up.util.escapeHTML"),(e=up.util).escapeHTML.apply(e,r)},up.util.selectorForElement=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.selectorForElement() has been renamed to up.fragment.toTarget()"),(e=up.fragment).toTarget.apply(e,r)},up.util.nextFrame=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.nextFrame() has been renamed to up.util.task()"),(e=up.util).task.apply(e,r)},up.util.times=function(e,r){for(var t=0;t<e;t++)r()}},338:function(){up.migrate.renamedPackage("layout","viewport"),up.migrate.renamedProperty(up.viewport.config,"viewports","viewportSelectors"),up.migrate.renamedProperty(up.viewport.config,"snap","revealSnap"),up.viewport.closest=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.viewport.closest()","up.viewport.get()"),(e=up.viewport).get.apply(e,r)}}},r={};function t(a){var n=r[a];if(void 0!==n)return n.exports;var p=r[a]={exports:{}};return e[a].call(p.exports,p,p.exports,t),p.exports}up.framework.startExtension(),t(992),t(480),t(700),t(394),t(629),t(305),t(354),t(869),t(729),t(969),t(905),t(413),t(69),t(197),t(885),t(228),t(338),up.framework.stopExtension()}();
1	+ !function(){var e={294:function(){up.browser.loadPage=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.browser.loadPage","up.network.loadPage"),(e=up.network).loadPage.apply(e,r)},up.browser.isSupported=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.browser.isSupported","up.framework.isSupported"),(e=up.framework).isSupported.apply(e,r)}},700:function(){up.element.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.first()","up.element.get()"),(e=up.element).get.apply(e,r)},up.element.createFromHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.element.createFromHtml","up.element.createFromHTML"),(e=up.element).createFromHTML.apply(e,r)}},394:function(){up.migrate.renamedPackage("bus","event"),up.event.nobodyPrevents=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.event.nobodyPrevents(type)","!up.emit(type).defaultPrevented");var t=up.emit.apply(up,e);return!t.defaultPrevented}},729:function(){up.migrate.renamedPackage("navigation","feedback"),up.migrate.renamedProperty(up.feedback.config,"navs","navSelectors")},305:function(){up.migrate.renamedProperty(up.form.config,"fields","fieldSelectors"),up.migrate.renamedProperty(up.form.config,"submitButtons","submitButtonSelectors")},354:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=up.util;up.migrate.renamedPackage("flow","fragment"),up.migrate.renamedPackage("dom","fragment"),up.migrate.renamedProperty(up.fragment.config,"fallbacks","mainTargets"),up.migrate.handleResponseDocOptions=function(e){return up.migrate.fixKey(e,"html","document")},up.replace=function(r,t,a){return up.migrate.deprecated("up.replace(target, url)","up.navigate(target, { url })"),up.navigate(e(e({},a),{target:r,url:t}))},up.extract=function(r,t,a){return up.migrate.deprecated("up.extract(target, document)","up.navigate(target, { document })"),up.navigate(e(e({},a),{target:r,document:t}))},up.fragment.first=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.fragment.first()","up.fragment.get()"),(e=up.fragment).get.apply(e,r)},up.first=up.fragment.first,up.migrate.handleScrollOptions=function(e){r.isUndefined(e.scroll)&&(r.isString(e.reveal)?(up.migrate.deprecated("Option { reveal: '"+e.reveal+"' }","{ scroll: '"+e.reveal+"' }"),e.scroll=e.reveal):!0===e.reveal?(up.migrate.deprecated("Option { reveal: true }","{ scroll: 'target' }"),e.scroll="target"):!1===e.reveal&&(up.migrate.deprecated("Option { reveal: false }","{ scroll: false }"),e.scroll=!1),r.isDefined(e.resetScroll)&&(up.migrate.deprecated("Option { resetScroll: true }","{ scroll: 'reset' }"),e.scroll="teset"),r.isDefined(e.restoreScroll)&&(up.migrate.deprecated("Option { restoreScroll: true }","{ scroll: 'restore' }"),e.scroll="restore"))},up.migrate.handleHistoryOption=function(e){r.isString(e.history)&&"auto"!==e.history&&(up.migrate.warn("Passing a URL as { history } option is deprecated. Pass it as { location } instead."),e.location=e.history,e.history="auto")},up.migrate.preprocessRenderOptions=function(e){up.migrate.handleHistoryOption(e);for(var t=0,a=["target","origin"];t<a.length;t++){var n=a[t];r.isJQuery(e[n])&&(up.migrate.warn("Passing a jQuery collection as { %s } is deprecated. Pass it as a native element instead.",n),e[n]=up.element.get(e[n]))}}},869:function(){up.migrate.renamedProperty(up.history.config,"popTargets","restoreTargets"),up.history.url=function(){return up.migrate.deprecated("up.history.url()","up.history.location"),up.history.location},up.migrate.renamedEvent("up:history:push","up:location:changed"),up.migrate.renamedEvent("up:history:pushed","up:location:changed"),up.migrate.renamedEvent("up:history:restore","up:location:changed"),up.migrate.renamedEvent("up:history:restored","up:location:changed"),up.migrate.renamedEvent("up:history:replaced","up:location:changed")},905:function(){up.migrate.handleLayerOptions=function(e){up.migrate.fixKey(e,"flavor","mode"),up.migrate.fixKey(e,"closable","dismissable"),up.migrate.fixKey(e,"closeLabel","dismissLabel");for(var r=0,t=["width","maxWidth","height"];r<t.length;r++){var a=t[r];e[a]&&up.migrate.warn("Layer option { "+a+" } has been removed. Use { size } or { class } instead.")}e.sticky&&up.migrate.warn("Layer option { sticky } has been removed. Give links an [up-peel=false] attribute to prevent layer dismissal on click."),e.template&&up.migrate.warn("Layer option { template } has been removed. Use { class } or modify the layer HTML on up:layer:open."),"page"===e.layer&&(up.migrate.warn("Option { layer: 'page' } has been renamed to { layer: 'root' }."),e.layer="root"),"modal"!==e.layer&&"popup"!==e.layer\|\|(up.migrate.warn("Option { layer: '"+e.layer+"' } has been removed. Did you mean { layer: 'overlay' }?"),e.layer="overlay")},up.migrate.handleTetherOptions=function(e){var r=e.position.split("-"),t=r[0],a=r[1];a&&(up.migrate.warn("The position value %o is deprecated. Use %o instead.",e.position,{position:t,align:a}),e.position=t,e.align=a)},up.migrate.registerLayerCloser=function(e){return e.registerClickCloser("up-close",(function(r,t){up.migrate.deprecated("[up-close]","[up-dismiss]"),e.dismiss(r,t)}))},up.migrate.handleLayerConfig=function(e){return up.migrate.fixKey(e,"historyVisible","history")},up.util.getter(up.Layer.prototype,"historyVisible",(function(){return up.migrate.deprecated("up.Layer#historyVisible","up.Layer#history"),this.history}))},969:function(){up.migrate.parseFollowOptions=function(e){e.string("flavor"),e.string("width"),e.string("height"),e.boolean("closable"),e.booleanOrString("reveal"),e.boolean("resetScroll"),e.boolean("restoreScroll"),e.booleanOrString("historyVisible")},up.migrate.targetMacro("up-dash",{"up-preload":"","up-instant":""},(function(){return up.migrate.deprecated("a[up-dash]","up.link.config.instantSelectors or up.link.config.preloadSelectors")}))},992:function(){var e=this&&this.__spreadArray\|\|function(e,r){for(var t=0,a=r.length,n=e.length;t<a;t++,n++)e[n]=r[t];return e},r=up.util;up.migrate=function(){var t=new up.Config((function(){return{logLevel:"warn"}})),a={};function n(e){var r=a[e];return r?(u("Event "+e+" has been renamed to "+r),r):e}var p={};function u(a){for(var n,u=[],o=1;o<arguments.length;o++)u[o-1]=arguments[o];var i=r.sprintf.apply(r,e([a],u));p[i]\|\|(p[i]=!0,(n=up.log)[t.logLevel].apply(n,e(["unpoly-migrate",a],u)))}return up.on("up:framework:reset",(function(){t.reset()})),{deprecated:function(e,r){u(e+" has been deprecated. Use "+r+" instead.")},renamedPackage:function(e,r){Object.defineProperty(up,e,{get:function(){return u("up."+e+" has been renamed to up."+r),up[r]}})},renamedProperty:function(e,r,t){var a=function(){return u("Property { %s } has been renamed to { %s } (found in %o)",r,t,e)};return Object.defineProperty(e,r,{get:function(){return a(),this[t]},set:function(e){a(),this[t]=e}})},formerlyAsync:function(e){var r=Promise.resolve(),t=r.then;return r.then=function(){return u(e+" is now a sync function"),t.apply(this,arguments)},r},renamedEvent:function(e,r){a[e]=r},fixEventTypes:function(e){return r.uniq(r.map(e,n))},fixKey:function(e,t,a){r.isDefined(e[t])&&(u("Property { %s } has been renamed to { %s } (found in %o)",t,a,e),r.renameKey(e,t,a))},warn:u,loaded:!0,config:t}}()},413:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)},r=new Error("up.modal.flavors has been removed without direct replacement. You may give new layers a { class } or modify layer elements on up:layer:open.");up.modal={visit:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.visit(url)",'up.layer.open({ url, mode: "modal" })'),up.layer.open(e(e({},t),{url:r,mode:"modal"}))},follow:function(r,t){return void 0===t&&(t={}),up.migrate.deprecated("up.modal.follow(link)",'up.follow(link, { layer: "modal" })'),up.follow(r,e(e({},t),{layer:"modal"}))},extract:function(r,t,a){return void 0===a&&(a={}),up.migrate.deprecated("up.modal.extract(target, document)",'up.layer.open({ document, mode: "modal" })'),up.layer.open(e(e({},a),{target:r,html:t,layer:"modal"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.modal.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.modal.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.modal.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.modal.config","up.layer.config.modal"),up.layer.config.modal},contains:function(e){return up.migrate.deprecated("up.modal.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.modal.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},get flavors(){throw r},flavor:function(){throw r}},up.migrate.renamedEvent("up:modal:open","up:layer:open"),up.migrate.renamedEvent("up:modal:opened","up:layer:opened"),up.migrate.renamedEvent("up:modal:close","up:layer:dismiss"),up.migrate.renamedEvent("up:modal:closed","up:layer:dismissed"),up.migrate.targetMacro("up-modal",{"up-layer":"new modal"},(function(){return up.migrate.deprecated("a[up-modal]",'a[up-layer="new modal"]')})),up.migrate.targetMacro("up-drawer",{"up-layer":"new drawer"},(function(){return up.migrate.deprecated("a[up-drawer]",'a[up-layer="new drawer"]')}))},885:function(){var e=up.util;up.migrate.renamedPackage("proxy","network"),up.migrate.renamedEvent("up:proxy:load","up:request:load"),up.migrate.renamedEvent("up:proxy:received","up:request:loaded"),up.migrate.renamedEvent("up:proxy:loaded","up:request:loaded"),up.migrate.renamedEvent("up:proxy:fatal","up:request:fatal"),up.migrate.renamedEvent("up:proxy:aborted","up:request:aborted"),up.migrate.renamedEvent("up:proxy:slow","up:request:late"),up.migrate.renamedEvent("up:proxy:recover","up:request:recover");var r=function(){return up.migrate.deprecated("up.proxy.config.preloadDelay","up.link.config.preloadDelay")};Object.defineProperty(up.network.config,"preloadDelay",{get:function(){return r(),up.link.config.preloadDelay},set:function(e){r(),up.link.config.preloadDelay=e}}),up.migrate.renamedProperty(up.network.config,"maxRequests","concurrency"),up.migrate.renamedProperty(up.network.config,"slowDelay","badResponseTime"),up.migrate.handleRequestOptions=function(e){return up.migrate.fixKey(e,"data","params")},up.ajax=function(){for(var e=[],r=0;r<arguments.length;r++)e[r]=arguments[r];up.migrate.deprecated("up.ajax()","up.request()");var t=function(e){return e.text};return up.request.apply(up,e).then(t)},up.network.clear=function(){up.migrate.deprecated("up.proxy.clear()","up.cache.clear()"),up.cache.clear()},up.network.preload=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.proxy.preload(link)","up.link.preload(link)"),(e=up.link).preload.apply(e,r)},up.Request.prototype.navigate=function(){up.migrate.deprecated("up.Request#navigate()","up.Request#loadPage()"),this.loadPage()},up.Response.prototype.isSuccess=function(){return up.migrate.deprecated("up.Response#isSuccess()","up.Response#ok"),this.ok},up.Response.prototype.isError=function(){return up.migrate.deprecated("up.Response#isError()","!up.Response#ok"),!this.ok};var t=up.network.config.progressBar;function a(){up.network.config.progressBar=function(){return r=up.EventListener.allNonDefault(document),e.find(r,(function(e){return"up:request:late"===e.eventType}))?(up.migrate.warn("Disabled the default progress bar as may have built a custom loading indicator with your up:request:late listener. Please set up.network.config.progressBar to true or false."),!1):t;var r}}a(),up.on("up:framework:reset",a)},69:function(){var e=this&&this.__assign\|\|function(){return(e=Object.assign\|\|function(e){for(var r,t=1,a=arguments.length;t<a;t++)for(var n in r=arguments[t])Object.prototype.hasOwnProperty.call(r,n)&&(e[n]=r[n]);return e}).apply(this,arguments)};up.popup={attach:function(r,t){return void 0===t&&(t={}),r=up.fragment.get(r),up.migrate.deprecated("up.popup.attach(origin)","up.layer.open({ origin, layer: 'popup' })"),up.layer.open(e(e({},t),{origin:r,layer:"popup"}))},close:function(e){return void 0===e&&(e={}),up.migrate.deprecated("up.popup.close()","up.layer.dismiss()"),up.layer.dismiss(null,e),up.migrate.formerlyAsync("up.layer.dismiss()")},url:function(){return up.migrate.deprecated("up.popup.url()","up.layer.location"),up.layer.location},coveredUrl:function(){var e;return up.migrate.deprecated("up.popup.coveredUrl()","up.layer.parent.location"),null===(e=up.layer.parent)\|\|void 0===e?void 0:e.location},get config(){return up.migrate.deprecated("up.popup.config","up.layer.config.popup"),up.layer.config.popup},contains:function(e){return up.migrate.deprecated("up.popup.contains()","up.layer.contains()"),up.layer.contains(e)},isOpen:function(){return up.migrate.deprecated("up.popup.isOpen()","up.layer.isOverlay()"),up.layer.isOverlay()},sync:function(){return up.migrate.deprecated("up.popup.sync()","up.layer.sync()"),up.layer.sync()}},up.migrate.renamedEvent("up:popup:open","up:layer:open"),up.migrate.renamedEvent("up:popup:opened","up:layer:opened"),up.migrate.renamedEvent("up:popup:close","up:layer:dismiss"),up.migrate.renamedEvent("up:popup:closed","up:layer:dismissed"),up.migrate.targetMacro("up-popup",{"up-layer":"new popup"},(function(){return up.migrate.deprecated("[up-popup]",'[up-layer="new popup"]')}))},228:function(){up.migrate.renamedProperty(up.radio.config,"hungry","hungrySelectors")},629:function(){var e=up.util,r=up.element;up.migrate.postCompile=function(r,t){var a;if(a=t.keep){up.migrate.warn("The { keep: true } option for up.compiler() has been removed. Have the compiler set [up-keep] attribute instead.");for(var n=e.isString(a)?a:"",p=0,u=r;p<u.length;p++)u[p].setAttribute("up-keep",n)}},up.migrate.targetMacro=function(t,a,n){up.macro("["+t+"]",(function(p){var u,o=e.copy(a);(u=p.getAttribute(t))?o["up-target"]=u:o["up-follow"]="",r.setMissingAttrs(p,o),p.removeAttribute(t),null==n\|\|n()}))}},197:function(){up.macro("[up-tooltip]",(function(e){up.migrate.warn("[up-tooltip] has been deprecated. A [title] was set instead."),up.element.setMissingAttr(e,"title",e.getAttribute("up-tooltip"))}))},480:function(){up.util.only=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.only(object, ...keys)","up.util.pick(object, keys)"),up.util.pick(e,r)},up.util.except=function(e){for(var r=[],t=1;t<arguments.length;t++)r[t-1]=arguments[t];return up.migrate.deprecated("up.util.except(object, ...keys)","up.util.omit(object, keys)"),up.util.omit(e,r)},up.util.parseUrl=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.parseUrl() has been renamed to up.util.parseURL()"),(e=up.util).parseURL.apply(e,r)},up.util.any=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.any() has been renamed to up.util.some()"),(e=up.util).some.apply(e,r)},up.util.all=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.all() has been renamed to up.util.every()"),(e=up.util).every.apply(e,r)},up.util.detect=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.detect() has been renamed to up.util.find()"),(e=up.util).find.apply(e,r)},up.util.select=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.select() has been renamed to up.util.filter()"),(e=up.util).filter.apply(e,r)},up.util.setTimer=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.setTimer() has been renamed to up.util.timer()"),(e=up.util).timer.apply(e,r)},up.util.escapeHtml=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.util.escapeHtml","up.util.escapeHTML"),(e=up.util).escapeHTML.apply(e,r)},up.util.selectorForElement=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.selectorForElement() has been renamed to up.fragment.toTarget()"),(e=up.fragment).toTarget.apply(e,r)},up.util.nextFrame=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.warn("up.util.nextFrame() has been renamed to up.util.task()"),(e=up.util).task.apply(e,r)},up.util.times=function(e,r){for(var t=0;t<e;t++)r()}},338:function(){up.migrate.renamedPackage("layout","viewport"),up.migrate.renamedProperty(up.viewport.config,"viewports","viewportSelectors"),up.migrate.renamedProperty(up.viewport.config,"snap","revealSnap"),up.viewport.closest=function(){for(var e,r=[],t=0;t<arguments.length;t++)r[t]=arguments[t];return up.migrate.deprecated("up.viewport.closest()","up.viewport.get()"),(e=up.viewport).get.apply(e,r)}}},r={};function t(a){var n=r[a];if(void 0!==n)return n.exports;var p=r[a]={exports:{}};return e[a].call(p.exports,p,p.exports,t),p.exports}up.framework.startExtension(),t(992),t(480),t(294),t(700),t(394),t(629),t(305),t(354),t(869),t(729),t(969),t(905),t(413),t(69),t(197),t(885),t(228),t(338),up.framework.stopExtension()}();

data/assets/unpoly/unpoly.es5.js CHANGED Viewed

@@ -8,7 +8,7 @@
 @module up
 */
 window.up = {
-    version: '2.2.1'
+    version: '2.3.0'
 };
@@ -1238,7 +1238,7 @@ up.util = (function () {
     @function up.util.pickBy
     @param {Object} object
-    @param {Function<string, string, object>} tester
+    @param {Function(string, string, object): boolean} tester
       A function that will be called with each property.
       The arguments are the property value, key and the entire object.
@@ -2070,7 +2070,7 @@ up.util = (function () {
         renameKeys: renameKeys,
         timestamp: secondsSinceEpoch,
         allSettled: allSettled,
-        negate: negate
+        negate: negate,
     };
 })();
@@ -2155,48 +2155,16 @@ up.migrate = { config: {} };
 /***/ (function() {
 /*-
-Browser support
-===============
-Unpoly supports all modern browsers.
-### Chrome, Firefox, Edge, Safari
-Full support.
-### Internet Explorer 11
-Full support with a `Promise` polyfill like [es6-promise](https://github.com/stefanpenner/es6-promise) (2.4 KB).\
-Support may be removed when Microsoft retires IE11 in [June 2022](https://blogs.windows.com/windowsexperience/2021/05/19/the-future-of-internet-explorer-on-windows-10-is-in-microsoft-edge/).
-### Internet Explorer 10 or lower
+Browser interface
+=================
-Unpoly will not boot or [run compilers](/up.compiler),
-leaving you with a classic server-side application.
+We tunnel some browser APIs through this module for easier mocking in tests.
 @module up.browser
 */
 up.browser = (function () {
     var u = up.util;
     /*-
-    Makes a full-page request, replacing the entire browser environment with a new page from the server response.
-    Also see `up.Request#loadPage()`.
-    @function up.browser.loadPage
-    @param {string} options.url
-      The URL to load.
-    @param {string} [options.method='get']
-      The method for the request.
-      Methods other than GET or POST will be [wrapped](/up.protocol.config#config.methodParam) in a POST request.
-    @param {Object|Array|FormData|string} [options.params]
-    @experimental
-    */
-    function loadPage(requestsAttrs) {
-        new up.Request(requestsAttrs).loadPage();
-    }
-    /*-
     Submits the given form with a full page load.
     For mocking in specs.
@@ -2210,6 +2178,11 @@ up.browser = (function () {
     function isIE11() {
         return 'ActiveXObject' in window; // this is undefined, but the key is set
     }
+    function isEdge18() {
+        // Edge 18: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19582
+        // Edge 92: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.78
+        return u.contains(navigator.userAgent, ' Edge/');
+    }
     /*-
     Returns whether this browser supports manipulation of the current URL
     via [`history.pushState`](https://developer.mozilla.org/en-US/docs/Web/API/History/pushState).
@@ -2259,6 +2232,17 @@ up.browser = (function () {
     function canJQuery() {
         return !!window.jQuery;
     }
+    var canEval = u.memoize(function () {
+        try {
+            // Don't use eval() which would prevent minifiers from compressing local variables.
+            return new Function('return true')();
+        }
+        catch (_a) {
+            // With a strict CSP this will be an error like:
+            // Uncaught EvalError: call to Function() blocked by CSP
+            return false;
+        }
+    });
     // IE11: Use the browser.cookies API instead.
     function popCookie(name) {
         var _a;
@@ -2288,42 +2272,19 @@ up.browser = (function () {
         }
         return true;
     }
-    /*-
-    Returns whether Unpoly supports the current browser.
-    If this returns `false` Unpoly will prevent itself from booting
-    and ignores all registered [event handlers](/up.on) and [compilers](/up.compiler).
-    This leaves you with a classic server-side application.
-    This is usually a better fallback than loading incompatible Javascript and causing
-    many errors on load.
-    @function up.browser.isSupported
-    @stable
-    */
-    function isSupported() {
-        return !supportIssue();
-    }
-    function supportIssue() {
-        if (!canPromise()) {
-            return "Browser doesn't support promises";
-        }
-        if (document.compatMode === 'BackCompat') {
-            return 'Browser is in quirks mode (missing DOCTYPE?)';
-        }
-    }
     return {
-        loadPage: loadPage,
         submitForm: submitForm,
         canPushState: canPushState,
         canFormatLog: canFormatLog,
         canPassiveEventListener: canPassiveEventListener,
         canJQuery: canJQuery,
+        canPromise: canPromise,
+        canEval: canEval,
         assertConfirmed: assertConfirmed,
-        isSupported: isSupported,
-        supportIssue: supportIssue,
         popCookie: popCookie,
         get jQuery() { return getJQuery(); },
-        isIE11: isIE11
+        isIE11: isIE11,
+        isEdge18: isEdge18,
     };
 })();
@@ -3323,11 +3284,12 @@ up.element = (function () {
         }
     }
     function callbackAttr(link, attr, exposedKeys) {
+        var _a;
         if (exposedKeys === void 0) { exposedKeys = []; }
         var code = link.getAttribute(attr);
         if (code) {
             // Allow callbacks to refer to an exposed property directly instead of through `event.value`.
-            var callback_1 = new (Function.bind.apply(Function, __spreadArray(__spreadArray([void 0, 'event'], exposedKeys), [code])))();
+            var callback_1 = (_a = up.NonceableCallback.fromString(code)).toFunction.apply(_a, __spreadArray(['event'], exposedKeys));
             // Emulate the behavior of the `onclick` attribute,
             // where `this` refers to the clicked element.
             return function (event) {
@@ -4299,7 +4261,7 @@ up.Change.OpenLayer = /** @class */ (function (_super) {
         // We assume that the server will respond with our target.
         return this.target;
     };
-    OpenLayer.prototype.execute = function (responseDoc) {
+    OpenLayer.prototype.execute = function (responseDoc, onApplicable) {
         var _this = this;
         if (this.target === ':none') {
             this.content = document.createElement('up-none');
@@ -4310,6 +4272,7 @@ up.Change.OpenLayer = /** @class */ (function (_super) {
         if (!this.content || this.baseLayer.isClosed()) {
             throw this.notApplicable();
         }
+        onApplicable();
         up.puts('up.render()', "Opening element \"" + this.target + "\" in new overlay");
         this.options.title = this.improveHistoryValue(this.options.title, responseDoc.getTitle());
         if (this.emitOpenEvent().defaultPrevented) {
@@ -4533,12 +4496,13 @@ up.Change.UpdateLayer = /** @class */ (function (_super) {
         this.matchPreflight();
         return u.map(this.steps, 'selector').join(', ') || ':none';
     };
-    UpdateLayer.prototype.execute = function (responseDoc) {
+    UpdateLayer.prototype.execute = function (responseDoc, onApplicable) {
         var _this = this;
         this.responseDoc = responseDoc;
         // For each step, find a step.alternative that matches in both the current page
         // and the response document.
         this.matchPostflight();
+        onApplicable();
         // Don't log @target since that does not include hungry elements
         up.puts('up.render()', "Updating \"" + this.bestPreflightSelector() + "\" in " + this.layer);
         this.options.title = this.improveHistoryValue(this.options.title, this.responseDoc.getTitle());
@@ -4961,7 +4925,7 @@ up.Change.CloseLayer = /** @class */ (function (_super) {
         // because the layer is detached. We do not want to emit it on the parent layer where users
         // might confuse it with an event for the parent layer itself. Since @layer.element
         // is now detached, the event will no longer bubble up to the document where global
-        // event listeners can receive it. So we explicitely emit the event a second time
+        // event listeners can receive it. So we explicitly emit the event a second time
         // on the document.
         return this.layer.emit(this.buildEvent("up:layer:" + verbPast), {
             // Set up.layer.current to the parent of the closed layer, which is now likely
@@ -5087,18 +5051,25 @@ up.Change.FromContent = /** @class */ (function (_super) {
         return up.fragment.expandTargets(targets, { layer: layer, mode: this.mode, origin: this.origin });
     };
     FromContent.prototype.execute = function () {
-        var _this = this;
         // Preloading from local content is a no-op.
         if (this.options.preload) {
             return Promise.resolve();
         }
-        var executePlan = function (plan) { return plan.execute(_this.getResponseDoc()); };
-        return this.seekPlan(executePlan) || this.postflightTargetNotApplicable();
+        return this.seekPlan(this.executePlan.bind(this)) || this.postflightTargetNotApplicable();
+    };
+    FromContent.prototype.executePlan = function (matchedPlan) {
+        return matchedPlan.execute(this.getResponseDoc(), this.onPlanApplicable.bind(this, matchedPlan));
+    };
+    FromContent.prototype.onPlanApplicable = function (plan) {
+        var primaryPlan = this.getPlans()[0];
+        if (plan !== primaryPlan) {
+            up.puts('up.render()', 'Could not match primary target (%s). Updating a fallback target (%s).', primaryPlan.target, plan.target);
+        }
     };
     FromContent.prototype.getResponseDoc = function () {
         var _a, _b;
         if (!this.preview && !this.responseDoc) {
-            var docOptions = u.pick(this.options, ['target', 'content', 'fragment', 'document', 'html']);
+            var docOptions = u.pick(this.options, ['target', 'content', 'fragment', 'document', 'html', 'cspNonces']);
             (_b = (_a = up.migrate).handleResponseDocOptions) === null || _b === void 0 ? void 0 : _b.call(_a, docOptions);
             // If neither { document } nor { fragment } source is given, we assume { content }.
             if (this.defaultPlacement() === 'content') {
@@ -5220,7 +5191,7 @@ up.Change.FromURL = /** @class */ (function (_super) {
         var newPageReason = this.newPageReason();
         if (newPageReason) {
             up.puts('up.render()', newPageReason);
-            up.browser.loadPage(this.options);
+            up.network.loadPage(this.options);
             // Prevent our caller from executing any further code, since we're already
             // navigating away from this JavaScript environment.
             return u.unresolvablePromise();
@@ -5287,17 +5258,21 @@ up.Change.FromURL = /** @class */ (function (_super) {
     FromURL.prototype.isSuccessfulResponse = function () {
         return (this.successOptions.fail === false) || this.response.ok;
     };
-    FromURL.prototype.buildEvent = function (type, props) {
-        var defaultProps = { request: this.request, response: this.response, renderOptions: this.options };
-        return up.event.build(type, u.merge(defaultProps, props));
-    };
+    // buildEvent(type, props) {
+    //   const defaultProps = { request: this.request, response: this.response, renderOptions: this.options }
+    //   return up.event.build(type, u.merge(defaultProps, props))
+    // }
     FromURL.prototype.updateContentFromResponse = function (log, renderOptions) {
         // Allow listeners to inspect the response and either prevent the fragment change
         // or manipulate change options. An example for when this is useful is a maintenance
         // page with its own layout, that cannot be loaded as a fragment and must be loaded
         // with a full page load.
-        var event = this.buildEvent('up:fragment:loaded', { renderOptions: renderOptions });
-        this.request.assertEmitted(event, { log: log, callback: this.options.onLoaded });
+        this.request.assertEmitted('up:fragment:loaded', {
+            callback: this.options.onLoaded,
+            response: this.response,
+            log: log,
+            renderOptions: renderOptions,
+        });
         // The response might carry some updates for our change options,
         // like a server-set location, or server-sent events.
         this.augmentOptionsFromResponse(renderOptions);
@@ -5341,6 +5316,7 @@ up.Change.FromURL = /** @class */ (function (_super) {
         // If the server has provided an update to our context via the X-Up-Context
         // response header, merge it into our existing { context } option.
         renderOptions.context = u.merge(renderOptions.context, this.response.context);
+        renderOptions.cspNonces = this.response.cspNonces;
     };
     return FromURL;
 }(up.Change));
@@ -5858,9 +5834,16 @@ var e = up.element;
 up.EventListener = /** @class */ (function (_super) {
     __extends(EventListener, _super);
     function EventListener(attributes) {
+        var _a;
         var _this = _super.call(this, attributes) || this;
         _this.key = _this.constructor.buildKey(attributes);
-        _this.isDefault = up.framework.booting;
+        _this.isDefault = up.framework.evaling;
+        // We don't usually run up.on() listeners before Unpoly has booted.
+        // This is done so incompatible code is not called on browsers that don't support Unpoly.
+        // Listeners that do need to run before Unpoly boots can pass { beforeBoot: true } to override.
+        // We also default to { beforeBoot: true } for framework events that are emitted
+        // before booting.
+        (_a = _this.beforeBoot) !== null && _a !== void 0 ? _a : (_this.beforeBoot = _this.eventType.indexOf('up:framework:') === 0);
         // Need to store the bound nativeCallback function because addEventListener()
         // and removeEventListener() need to see the exact same reference.
         _this.nativeCallback = _this.nativeCallback.bind(_this);
@@ -5876,7 +5859,8 @@ up.EventListener = /** @class */ (function (_super) {
             'guard',
             'baseLayer',
             'passive',
-            'once'
+            'once',
+            'beforeBoot',
         ];
     };
     EventListener.prototype.bind = function () {
@@ -5906,6 +5890,9 @@ up.EventListener = /** @class */ (function (_super) {
     };
     EventListener.prototype.nativeCallback = function (event) {
         var _a;
+        if (up.framework.beforeBoot && !this.beforeBoot) {
+            return;
+        }
         // Once we drop IE11 support we can forward the { once } option
         // to Element#addEventListener().
         if (this.once) {
@@ -6023,7 +6010,8 @@ up.EventListenerGroup = /** @class */ (function (_super) {
             'guard',
             'baseLayer',
             'passive',
-            'once'
+            'once',
+            'beforeBoot',
         ];
     };
     EventListenerGroup.prototype.bind = function () {
@@ -8884,6 +8872,133 @@ up.MotionController = /** @class */ (function () {
 /* 49 */
 /***/ (function() {
+var __spreadArray = (this && this.__spreadArray) || function (to, from) {
+    for (var i = 0, il = from.length, j = to.length; i < il; i++, j++)
+        to[j] = from[i];
+    return to;
+};
+var u = up.util;
+var e = up.element;
+up.NonceableCallback = /** @class */ (function () {
+    function NonceableCallback(script, nonce) {
+        this.script = script;
+        this.nonce = nonce;
+    }
+    NonceableCallback.fromString = function (string) {
+        var match = string.match(/^(nonce-([^\s]+)\s)?(.*)$/);
+        return new this(match[3], match[2]);
+    };
+    /*-
+    Replacement for `new Function()` that can take a nonce to work with a strict Content Security Policy.
+    It also prints an error when a strict CSP is active, but user supplies no nonce.
+    ### Examples
+    ```js
+    new up.NonceableCallback('1 + 2', 'secret').toFunction()
+    ```
+    @function up.NonceableCallback#toFunction
+    @internal
+    */
+    NonceableCallback.prototype.toFunction = function () {
+        var argNames = [];
+        for (var _i = 0; _i < arguments.length; _i++) {
+            argNames[_i] = arguments[_i];
+        }
+        if (up.browser.canEval()) {
+            return new (Function.bind.apply(Function, __spreadArray(__spreadArray([void 0], argNames), [this.script])))();
+        }
+        else if (this.nonce) {
+            // Don't return a bound function so callers can re-bind to a different this.
+            var callbackThis_1 = this;
+            return function () {
+                var args = [];
+                for (var _i = 0; _i < arguments.length; _i++) {
+                    args[_i] = arguments[_i];
+                }
+                return callbackThis_1.runAsNoncedFunction(this, argNames, args);
+            };
+        }
+        else {
+            return this.cannotRun.bind(this);
+        }
+    };
+    NonceableCallback.prototype.toString = function () {
+        return "nonce-" + this.nonce + " " + this.script;
+    };
+    NonceableCallback.prototype.cannotRun = function () {
+        throw new Error("Your Content Security Policy disallows inline JavaScript (" + this.script + "). See https://unpoly.com/csp for solutions.");
+    };
+    NonceableCallback.prototype.runAsNoncedFunction = function (thisArg, argNames, args) {
+        var wrappedScript = "\n      try {\n        up.noncedEval.value = (function(" + argNames.join(',') + ") {\n          " + this.script + "\n        }).apply(up.noncedEval.thisArg, up.noncedEval.args)\n      } catch (error) {\n        up.noncedEval.error = error\n      }\n    ";
+        var script;
+        try {
+            up.noncedEval = { args: args, thisArg: thisArg };
+            script = up.element.affix(document.body, 'script', { nonce: this.nonce, text: wrappedScript });
+            if (up.noncedEval.error) {
+                throw up.noncedEval.error;
+            }
+            else {
+                return up.noncedEval.value;
+            }
+        }
+        finally {
+            up.noncedEval = undefined;
+            if (script) {
+                up.element.remove(script);
+            }
+        }
+    };
+    NonceableCallback.prototype.allowedBy = function (allowedNonces) {
+        return this.nonce && u.contains(allowedNonces, this.nonce);
+    };
+    NonceableCallback.adoptNonces = function (element, allowedNonces) {
+        var _this = this;
+        if (!(allowedNonces === null || allowedNonces === void 0 ? void 0 : allowedNonces.length)) {
+            return;
+        }
+        // Looking up a nonce requires a DOM query.
+        // For performance reasons we only do this when we're actually rewriting
+        // a nonce, and only once per response.
+        var getPageNonce = u.memoize(up.protocol.cspNonce);
+        u.each(up.protocol.config.nonceableAttributes, function (attribute) {
+            var matches = e.subtree(element, "[" + attribute + "^=\"nonce-\"]");
+            u.each(matches, function (match) {
+                var attributeValue = match.getAttribute(attribute);
+                var callback = _this.fromString(attributeValue);
+                var warn = function (message) {
+                    var _a;
+                    var args = [];
+                    for (var _i = 1; _i < arguments.length; _i++) {
+                        args[_i - 1] = arguments[_i];
+                    }
+                    return (_a = up.log).warn.apply(_a, __spreadArray(['up.render()', "Cannot use callback [" + attribute + "=\"" + attributeValue + "\"]: " + message], args));
+                };
+                if (!callback.allowedBy(allowedNonces)) {
+                    // Don't rewrite a nonce that the browser would have rejected.
+                    return warn("Callback's CSP nonce (%o) does not match response header (%o)", callback.nonce, allowedNonces);
+                }
+                // Replace the nonce with that of the current page.
+                // This will allow the handler to run via #toFunction().
+                var pageNonce = getPageNonce();
+                if (!pageNonce) {
+                    return warn("Current page's CSP nonce is unknown");
+                }
+                callback.nonce = pageNonce;
+                match.setAttribute(attribute, callback.toString());
+            });
+        });
+    };
+    return NonceableCallback;
+}());
+/***/ }),
+/* 50 */
+/***/ (function() {
 var __assign = (this && this.__assign) || function () {
     __assign = Object.assign || function(t) {
         for (var s, i = 1, n = arguments.length; i < n; i++) {
@@ -8959,7 +9074,7 @@ up.OptionsParser = /** @class */ (function () {
 /***/ }),
-/* 50 */
+/* 51 */
 /***/ (function() {
 var e = up.element;
@@ -9053,7 +9168,7 @@ up.OverlayFocus = /** @class */ (function () {
 /***/ }),
-/* 51 */
+/* 52 */
 /***/ (function() {
 var u = up.util;
@@ -9650,7 +9765,7 @@ up.Params = /** @class */ (function () {
 /***/ }),
-/* 52 */
+/* 53 */
 /***/ (function() {
 var e = up.element;
@@ -9708,7 +9823,7 @@ up.ProgressBar = /** @class */ (function () {
 /***/ }),
-/* 53 */
+/* 54 */
 /***/ (function() {
 var u = up.util;
@@ -9847,7 +9962,7 @@ up.RenderOptions = (function () {
 /***/ }),
-/* 54 */
+/* 55 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -9908,7 +10023,7 @@ up.RenderResult = /** @class */ (function (_super) {
 /***/ }),
-/* 55 */
+/* 56 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -10481,7 +10596,11 @@ up.Request = /** @class */ (function (_super) {
         // This way listeners can observe event-related events on a given layer.
         // This request has an optional { layer } attribute, which is used by
         // EventEmitter.
-        return up.EventEmitter.fromEmitArgs(args, { request: this, layer: this.layer });
+        return up.EventEmitter.fromEmitArgs(args, {
+            layer: this.layer,
+            request: this,
+            origin: this.origin
+        });
     };
     Request.prototype.emit = function () {
         var args = [];
@@ -10506,11 +10625,27 @@ up.Request = /** @class */ (function (_super) {
     });
     return Request;
 }(up.Record));
+// A request is also a promise ("thenable") for its response.
 u.delegate(up.Request.prototype, ['then', 'catch', 'finally'], function () { return this.deferred; });
+up.Request.tester = function (condition) {
+    if (u.isFunction(condition)) {
+        return condition;
+    }
+    else if (condition instanceof this) {
+        return function (request) { return condition === request; };
+    }
+    else if (u.isString(condition)) {
+        var pattern_1 = new up.URLPattern(condition);
+        return function (request) { return pattern_1.test(request.url); };
+    }
+    else { // boolean, truthy/falsy values
+        return function (_request) { return condition; };
+    }
+};
 /***/ }),
-/* 56 */
+/* 57 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -10560,26 +10695,24 @@ up.Request.Cache = /** @class */ (function (_super) {
     //        candidates.push(request.variant(target: 'body'))
     //
     //    u.findResult candidates, (candidate) => super(candidate)
-    Cache.prototype.clear = function (pattern) {
+    Cache.prototype.clear = function (condition) {
         var _this = this;
-        if (pattern && (pattern !== '*') && (pattern !== true)) {
-            pattern = new up.URLPattern(pattern);
-            return this.each(function (key, request) {
-                if (pattern.test(request.url)) {
-                    _this.store.remove(key);
-                }
-            });
-        }
-        else {
-            _super.prototype.clear.call(this);
-        }
+        if (condition === void 0) { condition = true; }
+        var tester = up.Request.tester(condition);
+        this.each(function (key, request) {
+            if (tester(request)) {
+                // It is generally not a great idea to manipulate the list we're iterating over,
+                // but the implementation of up.Cache#each copies keys before iterating.
+                _this.store.remove(key);
+            }
+        });
     };
     return Cache;
 }(up.Cache));
 /***/ }),
-/* 57 */
+/* 58 */
 /***/ (function() {
 var u = up.util;
@@ -10685,13 +10818,14 @@ up.Request.Queue = /** @class */ (function () {
     };
     // Aborting a request will cause its promise to reject, which will also uncache it
     Queue.prototype.abort = function (conditions) {
-        var _this = this;
         if (conditions === void 0) { conditions = true; }
+        var tester = up.Request.tester(conditions);
         var _loop_1 = function (list) {
-            var matches = u.filter(list, function (request) { return _this.requestMatches(request, conditions); });
-            matches.forEach(function (match) {
-                match.abort();
-                u.remove(list, match);
+            var abortableRequests = u.filter(list, tester);
+            abortableRequests.forEach(function (abortableRequest) {
+                abortableRequest.abort();
+                // Avoid changing the list we're iterating over.
+                u.remove(list, abortableRequest);
             });
         };
         for (var _i = 0, _a = [this.currentRequests, this.queuedRequests]; _i < _a.length; _i++) {
@@ -10704,9 +10838,6 @@ up.Request.Queue = /** @class */ (function () {
         var excusedCacheKey = excusedRequest.cacheKey();
         this.abort(function (queuedRequest) { return (queuedRequest.cacheKey() !== excusedCacheKey) && u.evalOption(additionalConditions, queuedRequest); });
     };
-    Queue.prototype.requestMatches = function (request, conditions) {
-        return (request === conditions) || u.evalOption(conditions, request);
-    };
     Queue.prototype.checkSlow = function () {
         var currentSlow = this.isSlow();
         if (this.emittedSlow !== currentSlow) {
@@ -10735,7 +10866,7 @@ up.Request.Queue = /** @class */ (function () {
 /***/ }),
-/* 58 */
+/* 59 */
 /***/ (function() {
 var u = up.util;
@@ -10763,7 +10894,7 @@ up.Request.FormRenderer = /** @class */ (function () {
             method = up.protocol.wrapMethod(method, this.params);
         }
         this.form = e.affix(document.body, 'form.up-request-loader', { method: method, action: action });
-        // We only need an [enctype] attribute if the user has explicitely
+        // We only need an [enctype] attribute if the user has explicitly
         // requested one. If none is given, we can use the browser's default
         // [enctype]. Binary values cannot be sent by this renderer anyway, so
         // we don't need to default to multipart/form-data in this case.
@@ -10788,7 +10919,7 @@ up.Request.FormRenderer = /** @class */ (function () {
 /***/ }),
-/* 59 */
+/* 60 */
 /***/ (function() {
 var CONTENT_TYPE_URL_ENCODED = 'application/x-www-form-urlencoded';
@@ -10896,7 +11027,7 @@ up.Request.XHRRenderer = /** @class */ (function () {
 /***/ }),
-/* 60 */
+/* 61 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -11080,6 +11211,13 @@ up.Response = /** @class */ (function (_super) {
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(Response.prototype, "cspNonces", {
+        get: function () {
+            return up.protocol.cspNoncesFromHeader(this.getHeader('Content-Security-Policy'));
+        },
+        enumerable: false,
+        configurable: true
+    });
     Object.defineProperty(Response.prototype, "json", {
         /*-
         The response body parsed as a JSON string.
@@ -11107,7 +11245,7 @@ up.Response = /** @class */ (function (_super) {
 /***/ }),
-/* 61 */
+/* 62 */
 /***/ (function() {
 var u = up.util;
@@ -11137,6 +11275,7 @@ up.ResponseDoc = /** @class */ (function () {
             this.parseDocument(options) ||
                 this.parseFragment(options) ||
                 this.parseContent(options);
+        this.cspNonces = options.cspNonces;
     }
     ResponseDoc.prototype.parseDocument = function (options) {
         return this.parse(options.document, e.createDocumentFromHTML);
@@ -11205,6 +11344,8 @@ up.ResponseDoc = /** @class */ (function () {
     ResponseDoc.prototype.finalizeElement = function (element) {
         // Restore <noscript> tags so they become available to compilers.
         this.noscriptWrapper.unwrap(element);
+        // Rewrite per-request CSP nonces to match that of the current page.
+        up.NonceableCallback.adoptNonces(element, this.cspNonces);
         // Restore <script> so they will run.
         this.scriptWrapper.unwrap(element);
     };
@@ -11213,7 +11354,7 @@ up.ResponseDoc = /** @class */ (function () {
 /***/ }),
-/* 62 */
+/* 63 */
 /***/ (function() {
 var e = up.element;
@@ -11251,7 +11392,7 @@ up.RevealMotion = /** @class */ (function () {
         var newScrollTop = originalScrollTop;
         if (this.top || (elementRect.height > viewportRect.height)) {
             // Element is either larger than the viewport,
-            // or the user has explicitely requested for the element to align at top
+            // or the user has explicitly requested for the element to align at top
             // => Scroll the viewport so the first element row is the first viewport row
             var diff = elementRect.top - viewportRect.top;
             newScrollTop += diff;
@@ -11335,7 +11476,7 @@ up.RevealMotion = /** @class */ (function () {
 /***/ }),
-/* 63 */
+/* 64 */
 /***/ (function() {
 var u = up.util;
@@ -11420,7 +11561,7 @@ up.ScrollMotion = /** @class */ (function () {
 /***/ }),
-/* 64 */
+/* 65 */
 /***/ (function() {
 var e = up.element;
@@ -11474,7 +11615,7 @@ up.Selector = /** @class */ (function () {
 /***/ }),
-/* 65 */
+/* 66 */
 /***/ (function() {
 var u = up.util;
@@ -11509,7 +11650,7 @@ up.store.Memory = /** @class */ (function () {
 /***/ }),
-/* 66 */
+/* 67 */
 /***/ (function() {
 var __extends = (this && this.__extends) || (function () {
@@ -11597,7 +11738,7 @@ up.store.Session = /** @class */ (function (_super) {
 /***/ }),
-/* 67 */
+/* 68 */
 /***/ (function() {
 var u = up.util;
@@ -11759,7 +11900,7 @@ up.Tether = /** @class */ (function () {
 /***/ }),
-/* 68 */
+/* 69 */
 /***/ (function() {
 var u = up.util;
@@ -11787,7 +11928,17 @@ up.URLPattern = /** @class */ (function () {
         if (!list.length) {
             return;
         }
-        var reCode = list.map(this.normalizeURL).map(u.escapeRegExp).join('|');
+        list = list.map(function (url) {
+            // If the current browser location is multiple directories deep (e.g. /foo/bar),
+            // a leading asterisk would be normalized to /foo/*. So we prepend a slash.
+            if (url[0] === '*') {
+                url = '/' + url;
+            }
+            url = _this.normalizeURL(url);
+            url = u.escapeRegExp(url);
+            return url;
+        });
+        var reCode = list.join('|');
         reCode = reCode.replace(/\\\*/g, '.*?');
         reCode = reCode.replace(/(:|\\\$)([a-z][\w-]*)/ig, function (match, type, name) {
             // It's \\$ instead of $ because we do u.escapeRegExp above
@@ -11843,14 +11994,32 @@ up.URLPattern = /** @class */ (function () {
 /***/ }),
-/* 69 */
+/* 70 */
 /***/ (function() {
 /*-
+Framework initialization
+========================
+The `up.framework` module lets you customize Unpoly's [initialization sequence](/install#initialization).
+@see up.boot
+@see script[up-boot=manual]
+@see up.framework.isSupported
 @module up.framework
 */
 up.framework = (function () {
-    var booting = true;
+    // Event                          up.framework.readyState   document.readyState
+    // ------------------------------------------------------------------------------------------------------
+    // Browser starts parsing HTML    -                         loading
+    // Unpoly script is running       evaling                   loading (if sync) or interactive (if defered)
+    // ... submodules are running     evaling                   loading (if sync) or interactive (if defered)
+    // User scripts are running       configuring               loading (if sync) or interactive (if defered)
+    // DOMContentLoaded               configuring => booting    interactive
+    // Initial page is compiling      booting                   interactive
+    // Document resources loaded      booted                    complete
+    var readyState = 'evaling'; // evaling => configuring => booting => booted
     /*-
     Resets Unpoly to the state when it was booted.
     All custom event handlers, animations, etc. that have been registered
@@ -11871,64 +12040,172 @@ up.framework = (function () {
     @internal
     */
     /*-
-    Boots the Unpoly framework.
+    Manually boots the Unpoly framework.
+    It is not usually necessary to call `up.boot()` yourself. When you load [Unpoly's JavaScript file](/install),
+    Unpoly will automatically boot on [`DOMContentLoaded`](https://developer.mozilla.org/en-US/docs/Web/API/Window/DOMContentLoaded_event).
+    There are only two cases when you would boot manually:
+    - When you load Unpoly with `<script async>`
+    - When you explicitly ask to manually boot by loading Unpoly with [`<script up-boot="manual">`](/script-up-boot-manual).
-    **This is called automatically** by including the Unpoly JavaScript files.
+    Before you manually boot, Unpoly should be configured and compilers should be registered.
+    Booting will cause Unpoly to [compile](/up.hello) the initial page.
-    Unpoly will not boot if the current browser is [not supported](/up.browser.isSupported).
+    Unpoly will refuse to boot if the current browser is [not supported](/up.framework.isSupported).
     This leaves you with a classic server-side application on legacy browsers.
     @function up.boot
-    @internal
+    @experimental
     */
     function boot() {
+        if (readyState !== 'configuring') {
+            // In an app with a lot of async script the user may attempt to boot us twice.
+            console.error('Unpoly has already booted');
+            return;
+        }
         // This is called synchronously after all Unpoly modules have been parsed
         // and executed. We cannot delay booting until the DOM is ready, since by then
         // all user-defined event listeners and compilers will have registered.
         // Note that any non-async scripts after us will delay DOMContentLoaded.
-        var supportIssue = up.browser.supportIssue();
+        var supportIssue = up.framework.supportIssue();
         if (!supportIssue) {
-            // Some Unpoly modules will use the up:framework:boot event to:
-            //
-            // - Snapshot their state before user-defined compilers, handlers, etc. have
-            //   been registered. We need to know this state for when we up.reset() later.
-            // - Run delayed initialization that could not run at load time due to
-            //   circular dependencies.
+            // Change the state in case any user-provided compiler calls up.boot().
+            // up.boot() is a no-op unless readyState === 'configuring'.
+            readyState = 'booting';
             up.emit('up:framework:boot', { log: false });
-            booting = false;
-            // From here on, all event handlers (both Unpoly's and user code) want to
-            // work with the DOM, so wait for the DOM to be ready.
-            up.event.onReady(function () {
-                // By now all non-sync <script> tags have been loaded and called, including
-                // those after us. All user-provided compilers, event handlers, etc. have
-                // been registered.
-                //
-                // The following event will cause Unpoly to compile the <body>.
-                up.emit('up:app:boot', { log: 'Booting user application' });
-            });
+            readyState = 'booted';
+        }
+        else {
+            console.error("Unpoly cannot boot: %s", supportIssue);
+        }
+    }
+    function mustBootManually() {
+        var unpolyScript = document.currentScript;
+        // If we're is loaded via <script async>, there are no guarantees
+        // when we're called or when subsequent scripts that configure Unpoly
+        // have executed
+        if (unpolyScript === null || unpolyScript === void 0 ? void 0 : unpolyScript.async) {
+            return true;
+        }
+        // If we're loaded with <script up-boot="manual"> the user explicitly
+        // requested to boot Unpoly manually.
+        if ((unpolyScript === null || unpolyScript === void 0 ? void 0 : unpolyScript.getAttribute('up-boot')) === 'manual') {
+            return true;
+        }
+        // If we're loaded this late, someone loads us dynamically.
+        // We don't know when subsequent scripts that configure Unpoly
+        // have executed.
+        if (document.readyState === 'complete') {
+            return true;
+        }
+    }
+    /*-
+    Prevent Unpoly from booting automatically.
+    By default Unpoly [automatically boots](/install#initialization)
+    on [`DOMContentLoaded`](https://developer.mozilla.org/en-US/docs/Web/API/Window/DOMContentLoaded_event).
+    To prevent this, add an `[up-boot="manual"]` attribute to the `<script>` element
+    that loads Unpoly:
+    ```html
+    <script src="unpoly.js" up-boot="manual"></script>
+    ```
+    You may then call `up.boot()` to manually boot Unpoly at a later time.
+    ### Browser support
+    To use this feature in Internet Explorer 11 you need a polyfill for `document.currentScript`.
+    @selector script[up-boot=manual]
+    @experimental
+    */
+    function onEvaled() {
+        up.emit('up:framework:evaled', { log: false });
+        if (mustBootManually()) {
+            console.debug('Call up.boot() after you have configured Unpoly');
         }
         else {
-            console.error("Unpoly cannot load: %s", supportIssue);
+            // (1) On DOMContentLoaded we know that all non-[async] scripts have executed.
+            // (2) Deferred scripts execute after the DOM was parsed (document.readyState === 'interactive'),
+            //     but before DOMContentLoaded. That's why we must *not* boot synchonously when
+            //     document.readyState === 'interactive'. We must wait until DOMContentLoaded, when we know that
+            //     subsequent users scripts have executed and (possibly) configured Unpoly.
+            // (3) There are no guarantees when [async] scripts execute. These must boot Unpoly manually.
+            document.addEventListener('DOMContentLoaded', boot);
         }
+        // After this line user scripts may run and configure Unpoly, add compilers, etc.
+        readyState = 'configuring';
     }
     function startExtension() {
-        booting = true;
+        if (readyState !== 'configuring') {
+            throw new Error('Unpoly extensions must be loaded before booting');
+        }
+        readyState = 'evaling';
     }
     function stopExtension() {
-        booting = false;
+        readyState = 'configuring';
+    }
+    /*-
+    Returns whether Unpoly can boot in the current browser.
+    If this returns `false` Unpoly will prevent itself from [booting](/up.boot)
+    and will not [compile](/up.compiler) the initial page.
+    This leaves you with a classic server-side application.
+    ### Browser support
+    Unpoly aims to supports all modern browsers.
+    #### Chrome, Firefox, Edge, Safari
+    Full support.
+    #### Internet Explorer 11
+    Full support with a `Promise` polyfill like [es6-promise](https://github.com/stefanpenner/es6-promise) (2.4 KB).\
+    Support may be removed when Microsoft retires IE11 in [June 2022](https://blogs.windows.com/windowsexperience/2021/05/19/the-future-of-internet-explorer-on-windows-10-is-in-microsoft-edge/).
+    #### Internet Explorer 10 or lower
+    Unpoly will not boot or [run compilers](/up.compiler),
+    leaving you with a classic server-side application.
+    @function up.framework.isSupported
+    @stable
+    */
+    function isSupported() {
+        return !supportIssue();
+    }
+    function supportIssue() {
+        if (!up.browser.canPromise()) {
+            return "Browser doesn't support promises";
+        }
+        if (document.compatMode === 'BackCompat') {
+            return 'Browser is in quirks mode (missing DOCTYPE?)';
+        }
+        if (up.browser.isEdge18()) {
+            return 'Edge 18 or lower is unsupported';
+        }
     }
     return {
+        onEvaled: onEvaled,
         boot: boot,
         startExtension: startExtension,
         stopExtension: stopExtension,
         reset: emitReset,
-        get booting() { return booting; }
+        get evaling() { return readyState === 'evaling'; },
+        get booted() { return readyState === 'booted'; },
+        get beforeBoot() { return readyState !== 'booting' && readyState !== 'booted'; },
+        isSupported: isSupported,
+        supportIssue: supportIssue,
     };
 })();
+up.boot = up.framework.boot;
 /***/ }),
-/* 70 */
+/* 71 */
 /***/ (function() {
 /*-
@@ -11940,7 +12217,7 @@ This module contains functions to [emit](/up.emit) and [observe](/up.on) DOM eve
 While the browser also has built-in functions to work with events,
 you will find Unpoly's functions to be very concise and feature-rich.
-*# Events emitted by Unpoly
+### Events emitted by Unpoly
 Most Unpoly features emit events that are prefixed with `up:`.
@@ -11981,6 +12258,7 @@ up.event = (function () {
     - You may pass a selector for [event delegation](https://davidwalsh.name/event-delegate).
     - The event target is automatically passed as a second argument.
+    - Your event listener will not be called when Unpoly has not [booted](/up.boot) in an unsupported browser
     - You may register a listener to multiple events by passing a space-separated list of event name (e.g. `"click mousedown"`)
     - You may register a listener to multiple elements in a single `up.on()` call, by passing a [list](/up.util.isList) of elements.
     - You use an [`[up-data]`](/up-data) attribute to [attach structured data](/up.on#attaching-structured-data)
@@ -12422,30 +12700,6 @@ up.event = (function () {
         event.stopImmediatePropagation();
         event.preventDefault();
     }
-    /*-
-    Runs the given callback when the the initial HTML document has been completely loaded.
-    The callback is guaranteed to see the fully parsed DOM tree.
-    This function does not wait for stylesheets, images or frames to finish loading.
-    If `up.event.onReady()` is called after the initial document was loaded,
-    the given callback is run immediately.
-    @function up.event.onReady
-    @param {Function} callback
-      The function to call then the DOM tree is acessible.
-    @experimental
-    */
-    function onReady(callback) {
-        // Values are "loading", "interactive" and "completed".
-        // https://developer.mozilla.org/en-US/docs/Web/API/Document/readyState
-        if (document.readyState !== 'loading') {
-            callback();
-        }
-        else {
-            document.addEventListener('DOMContentLoaded', callback);
-        }
-    }
     var keyModifiers = ['metaKey', 'shiftKey', 'ctrlKey', 'altKey'];
     /*-
     @function up.event.isUnmodified
@@ -12531,7 +12785,6 @@ up.event = (function () {
         assertEmitted: assertEmitted,
         onEscape: onEscape,
         halt: halt,
-        onReady: onReady,
         isUnmodified: isUnmodified,
         fork: fork,
         keyModifiers: keyModifiers
@@ -12545,7 +12798,7 @@ up.emit = up.event.emit;
 /***/ }),
-/* 71 */
+/* 72 */
 /***/ (function() {
 /*-
@@ -12564,7 +12817,7 @@ While the protocol can help you optimize performance and handle some edge cases,
 implementing it is **entirely optional**. For instance, `unpoly.com` itself is a static site
 that uses Unpoly on the frontend and doesn't even have an active server component.
-*# Existing implementations
+### Existing implementations
 You should be able to implement the protocol in a very short time.
@@ -12763,23 +13016,39 @@ up.protocol = (function () {
         return extractHeader(xhr, 'clearCache', parseClearCacheValue);
     }
     /*-
-    The server may send this optional response header with the value `clear` to [clear the cache](/up.cache.clear).
+    The server may send this optional response header to control which previously cached responses should be [uncached](/up.cache.clear) after this response.
-    ### Example
+    The value of this header is a [URL pattern](/url-patterns) matching responses that should be uncached.
+    For example, to uncache all responses to URLs starting with `/notes/`:
     ```http
-    X-Up-Cache: clear
+    X-Up-Clear-Cache: /notes/*
     ```
-    @header X-Up-Cache
-    @param value
-      The string `"clear"`.
+    ### Overriding the client-side default
+    If the server does not send an `X-Up-Clear-Cache` header, Unpoly will [clear the entire cache](/up.network.config#config.clearCache) after a non-GET request.
+    You may force Unpoly to *keep* the cache after a non-GET request:
+    ```http
+    X-Up-Clear-Cache: false
+    ```
+    You may also force Unpoly to *clear* the cache after a GET request:
+    ```http
+    X-Up-Clear-Cache: *
+    ```
+    @header X-Up-Clear-Cache
     @stable
     */
     /*-
     This request header contains a timestamp of an existing fragment that is being [reloaded](/up.reload).
-    The timestamp must be explicitely set by the user as an `[up-time]` attribute on the fragment.
+    The timestamp must be explicitly set by the user as an `[up-time]` attribute on the fragment.
     It should indicate the time when the fragment's underlying data was last changed.
     See `[up-time]` for a detailed example.
@@ -13093,7 +13362,7 @@ up.protocol = (function () {
     ### Rendering content
     The response may contain `text/html` content. If the root layer is targeted,
-    the `X-Up-Accept-Layer` header is ignored and the fragment is updated with
+    the `X-Up-Dismiss-Layer` header is ignored and the fragment is updated with
     the response's HTML content.
     If you know that an overlay will be closed don't want to render HTML,
@@ -13102,7 +13371,7 @@ up.protocol = (function () {
     ```http
     HTTP/1.1 200 OK
     Content-Type: text/html
-    X-Up-Accept-Layer: {"user_id": 1012}
+    X-Up-Dismiss-Layer: {"user_id": 1012}
     X-Up-Target: :none
     ```
@@ -13224,11 +13493,27 @@ up.protocol = (function () {
       <meta name='csrf-token' content='secret12345'>
       ```
+    @param {string|Function(): string} [config.cspNonce]
+      A [CSP script nonce](https://content-security-policy.com/nonce/)
+      for the initial page that [booted](/up.boot) Unpoly.
+      The nonce let Unpoly run JavaScript in HTML attributes like
+      [`[up-on-loaded]`](/a-up-follow#up-on-loaded) or [`[up-on-accepted]`](/a-up-layer-new#up-on-accepted).
+      See [Working with a strict Content Security Policy](/csp).
+      The nonce can either be configured as a string or as function that returns the nonce.
+      Defaults to the `content` attribute of a `<meta>` tag named `csp-nonce`:
+      ```
+      <meta name='csrf-token' content='secret98765'>
+      ```
     @param {string} [config.methodParam='_method']
       The name of request parameter containing the original request method when Unpoly needs to wrap
       the method.
-      Methods must be wrapped when making a [full page request](/up.browser.loadPage) with a methods other
+      Methods must be wrapped when making a [full page request](/up.network.loadPage) with a methods other
       than GET or POST. In this case Unpoly will make a POST request with the original request method
       in a form parameter named `_method`:
@@ -13246,7 +13531,9 @@ up.protocol = (function () {
         methodParam: '_method',
         csrfParam: function () { return e.metaContent('csrf-param'); },
         csrfToken: function () { return e.metaContent('csrf-token'); },
-        csrfHeader: 'X-CSRF-Token' // Used by Rails. Other frameworks use different headers.
+        cspNonce: function () { return e.metaContent('csp-nonce'); },
+        csrfHeader: 'X-CSRF-Token',
+        nonceableAttributes: ['up-observe', 'up-on-accepted', 'up-on-dismissed', 'up-on-loaded', 'up-on-finished', 'up-observe'],
     }); });
     function csrfHeader() {
         return u.evalOption(config.csrfHeader);
@@ -13257,6 +13544,26 @@ up.protocol = (function () {
     function csrfToken() {
         return u.evalOption(config.csrfToken);
     }
+    function cspNonce() {
+        return u.evalOption(config.cspNonce);
+    }
+    function cspNoncesFromHeader(cspHeader) {
+        var nonces = [];
+        if (cspHeader) {
+            var parts = cspHeader.split(/\s*;\s*/);
+            for (var _i = 0, parts_1 = parts; _i < parts_1.length; _i++) {
+                var part = parts_1[_i];
+                if (part.indexOf('script-src') === 0) {
+                    var noncePattern = /'nonce-([^']+)'/g;
+                    var match = void 0;
+                    while (match = noncePattern.exec(part)) {
+                        nonces.push(match[1]);
+                    }
+                }
+            }
+        }
+        return nonces;
+    }
     function wrapMethod(method, params) {
         params.add(config.methodParam, method);
         return 'POST';
@@ -13280,15 +13587,17 @@ up.protocol = (function () {
         csrfHeader: csrfHeader,
         csrfParam: csrfParam,
         csrfToken: csrfToken,
+        cspNonce: cspNonce,
         initialRequestMethod: initialRequestMethod,
         headerize: headerize,
-        wrapMethod: wrapMethod
+        wrapMethod: wrapMethod,
+        cspNoncesFromHeader: cspNoncesFromHeader,
     };
 })();
 /***/ }),
-/* 72 */
+/* 73 */
 /***/ (function() {
 var __spreadArray = (this && this.__spreadArray) || function (to, from) {
@@ -13317,13 +13626,13 @@ up.log = (function () {
     Configures the logging output on the developer console.
     @property up.log.config
-    @param {boolean} [options.enabled=false]
+    @param {boolean} [config.enabled=false]
       Whether Unpoly will print debugging information to the developer console.
       Debugging information includes which elements are being [compiled](/up.syntax)
       and which [events](/up.event) are being emitted.
       Note that errors will always be printed, regardless of this setting.
-    @param {boolean} [options.banner=true]
+    @param {boolean} [config.banner=true]
       Print the Unpoly banner to the developer console.
     @stable
     */
@@ -13401,7 +13710,7 @@ up.log = (function () {
             console[stream].apply(console, __spreadArray([message], args));
         }
     }
-    var printBanner = function () {
+    function printBanner() {
         if (!config.banner) {
             return;
         }
@@ -13427,8 +13736,8 @@ up.log = (function () {
         else {
             console.log(logo + text);
         }
-    };
-    up.on('up:app:boot', printBanner);
+    }
+    up.on('up:framework:boot', printBanner);
     up.on('up:framework:reset', reset);
     function setEnabled(value) {
         sessionStore.set('enabled', value);
@@ -13528,7 +13837,7 @@ up.log = (function () {
         disable: disable,
         fail: fail,
         muteUncriticalRejection: muteUncriticalRejection,
-        isEnabled: function () { return config.enabled; }
+        isEnabled: function () { return config.enabled; },
     };
 })();
 up.puts = up.log.puts;
@@ -13537,7 +13846,7 @@ up.fail = up.log.fail;
 /***/ }),
-/* 73 */
+/* 74 */
 /***/ (function() {
 /*-
@@ -13795,7 +14104,7 @@ up.syntax = (function () {
             args[_i] = arguments[_i];
         }
         var macro = buildCompiler(args);
-        if (up.framework.booting) {
+        if (up.framework.evaling) {
             macro.priority = detectSystemMacroPriority(macro.selector) ||
                 up.fail('Unregistered priority for system macro %o', macro.selector);
         }
@@ -13860,7 +14169,7 @@ up.syntax = (function () {
         var _a = parseCompilerArgs(args), selector = _a[0], options = _a[1], callback = _a[2];
         options = u.options(options, {
             selector: selector,
-            isDefault: up.framework.booting,
+            isDefault: up.framework.evaling,
             priority: 0,
             batch: false,
             keep: false,
@@ -13869,6 +14178,9 @@ up.syntax = (function () {
         return u.assign(callback, options);
     }
     function insertCompiler(queue, newCompiler) {
+        if (up.framework.booted) {
+            up.puts('up.compiler()', 'Compiler %s was registered after booting Unpoly. Compiler will run for future fragments.', newCompiler.selector);
+        }
         var existingCompiler;
         var index = 0;
         while ((existingCompiler = queue[index]) && (existingCompiler.priority >= newCompiler.priority)) {
@@ -14056,7 +14368,7 @@ up.data = up.syntax.data;
 /***/ }),
-/* 74 */
+/* 75 */
 /***/ (function() {
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
@@ -14335,7 +14647,7 @@ up.history = (function () {
             replace(currentLocation(), { event: false });
         }
     }
-    up.on('up:app:boot', function () {
+    up.on('up:framework:boot', function () {
         if ('jasmine' in window) {
             // Can't delay this in tests.
             register();
@@ -14400,7 +14712,7 @@ up.history = (function () {
 /***/ }),
-/* 75 */
+/* 76 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __assign = (this && this.__assign) || function () {
@@ -14414,7 +14726,7 @@ var __assign = (this && this.__assign) || function () {
     };
     return __assign.apply(this, arguments);
 };
-__webpack_require__(76);
+__webpack_require__(77);
 var u = up.util;
 var e = up.element;
 /*-
@@ -14815,7 +15127,7 @@ up.fragment = (function () {
       for the fragment.
     @param {string|Element} [options.fragment]
-      A string of HTML comprising *only* the new fragment.
+      A string of HTML comprising *only* the new fragment's [outer HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/outerHTML).
       The `{ target }` selector will be derived from the root element in the given
       HTML:
@@ -14915,11 +15227,17 @@ up.fragment = (function () {
     @param {boolean|string} [options.clearCache]
       Whether existing [cache](/up.request#caching) entries will be [cleared](/up.cache.clear) with this request.
-      You may also pass a [URL pattern](/url-patterns) to only clear matching requests.
+      Defaults to the result of `up.network.config.clearCache`, which
+      defaults to clearing the entire cache after a non-GET request.
-      By default a non-GET request will clear the entire cache.
+      To only uncache some requests, pass an [URL pattern](/url-patterns) that matches requests to uncache.
+      You may also pass a function that accepts an existing `up.Request` and returns a boolean value.
-      Also see [`up.request({ clearCache })`](/up.request#options.clearCache) and `up.network.config.clearCache`.
+    @param {boolean|string|Function(request): boolean} [options.solo]
+      With `{ solo: true }` Unpoly will [abort](/up.network.abort) all other requests before laoding the new fragment.
+      To only abort some requests, pass an [URL pattern](/url-patterns) that matches requests to abort.
+      You may also pass a function that accepts an existing `up.Request` and returns a boolean value.
     @param {Element|jQuery} [options.origin]
       The element that triggered the change.
@@ -15106,12 +15424,19 @@ up.fragment = (function () {
     to mutate options to the `up.render()` call that will process the server response.
     @event up:fragment:loaded
     @param event.preventDefault()
       Event listeners may call this method to prevent the fragment change.
     @param {up.Request} event.request
       The original request to the server.
     @param {up.Response} event.response
       The server response.
+    @param {Element} [event.origin]
+      The link or form element that caused the fragment update.
     @param {Object} event.renderOptions
       Options for the `up.render()` call that will process the server response.
     @stable
@@ -15218,14 +15543,16 @@ up.fragment = (function () {
     @stable
     */
     /*-
-    Compiles a page fragment that has been inserted into the DOM
+    Manually compiles a page fragment that has been inserted into the DOM
     by external code.
+    All registered [compilers](/up.compiler) and [macros](/up.macro) will be called
+    with matches in the given `element`.
     **As long as you manipulate the DOM using Unpoly, you will never
-    need to call this method.** You only need to use `up.hello()` if the
+    need to call `up.hello()`.** You only need to use `up.hello()` if the
     DOM is manipulated without Unpoly' involvement, e.g. by setting
-    the `innerHTML` property or calling jQuery methods like
-    `html`, `insertAfter` or `appendTo`:
+    the `innerHTML` property:
     ```html
     element = document.createElement('div')
@@ -15237,7 +15564,7 @@ up.fragment = (function () {
     event.
     @function up.hello
-    @param {Element|jQuery} target
+    @param {Element|jQuery} element
     @param {Element|jQuery} [options.origin]
     @return {Element}
       The compiled element
@@ -16178,7 +16505,7 @@ up.fragment = (function () {
         selector = parseSelector(selector, element, options);
         return selector.matches(element);
     }
-    up.on('up:app:boot', function () {
+    up.on('up:framework:boot', function () {
         var body = document.body;
         body.setAttribute('up-source', up.history.location);
         hello(body);
@@ -16237,13 +16564,13 @@ u.delegate(up, 'context', function () { return up.layer.current; });
 /***/ }),
-/* 76 */
+/* 77 */
 /***/ (function() {
 /***/ }),
-/* 77 */
+/* 78 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __spreadArray = (this && this.__spreadArray) || function (to, from) {
@@ -16251,7 +16578,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from) {
         to[j] = from[i];
     return to;
 };
-__webpack_require__(78);
+__webpack_require__(79);
 /*-
 Scrolling viewports
 ===================
@@ -16748,23 +17075,6 @@ up.viewport = (function () {
         return up.fragment.toTarget(viewport);
     }
     /*-
-    Returns a hash with scroll positions.
-    Each key in the hash is a viewport selector. The corresponding
-    value is the viewport's top scroll position:
-        up.viewport.scrollTops()
-        => { '.main': 0, '.sidebar': 73 }
-    @function up.viewport.scrollTops
-    @return Object<string, number>
-    @internal
-    */
-    function scrollTops(options) {
-        if (options === void 0) { options = {}; }
-        return u.mapObject(getAll(options), function (viewport) { return [scrollTopKey(viewport), viewport.scrollTop]; });
-    }
-    /*-
     @function up.viewport.fixedElements
     @internal
     */
@@ -16808,6 +17118,19 @@ up.viewport = (function () {
             options.layer.lastScrollTops.set(url, tops);
         }
     }
+    /*-
+    Returns a hash with scroll positions.
+    Each key in the hash is a viewport selector. The corresponding
+    value is the viewport's top scroll position:
+        getScrollTops()
+        => { '.main': 0, '.sidebar': 73 }
+    @function up.viewport.getScrollTops
+    @return Object<string, number>
+    @internal
+    */
     function getScrollTops(viewports) {
         return u.mapObject(viewports, function (viewport) { return [scrollTopKey(viewport), viewport.scrollTop]; });
     }
@@ -17080,8 +17403,9 @@ up.viewport = (function () {
         return value === null || value === void 0 ? void 0 : value.replace(/^#/, '');
     }
     var userScrolled = false;
-    up.on('scroll', { once: true }, function () { return userScrolled = true; });
-    up.on('up:app:boot', function () {
+    up.on('scroll', { once: true, beforeBoot: true }, function () { return userScrolled = true; });
+    up.on('up:framework:boot', function () {
+        // When the initial URL contains an #anchor link, the browser will automatically
         // reveal a matching fragment. We want to override that behavior with our own,
         // so we can honor configured obstructions. Since we cannot disable the automatic
         // browser behavior we need to ensure our code runs after it.
@@ -17089,7 +17413,7 @@ up.viewport = (function () {
         // In Chrome, when reloading, the browser behavior happens before DOMContentLoaded.
         // However, when we follow a link with an #anchor URL, the browser
         // behavior happens *after* DOMContentLoaded. Hence we wait one more task.
-        return u.task(function () {
+        u.task(function () {
             // If the user has scrolled while the page was loading, we will
             // not reset their scroll position by revealing the #anchor fragment.
             if (!userScrolled) {
@@ -17117,16 +17441,14 @@ up.viewport = (function () {
         rootOverflowElement: rootOverflowElement,
         isRoot: isRoot,
         scrollbarWidth: scrollbarWidth,
-        scrollTops: scrollTops,
         saveScroll: saveScroll,
         restoreScroll: restoreScroll,
         resetScroll: resetScroll,
         anchoredRight: anchoredRight,
-        fixedElements: fixedElements,
         absolutize: absolutize,
         focus: doFocus,
         tryFocus: tryFocus,
-        makeFocusable: makeFocusable
+        makeFocusable: makeFocusable,
     };
 })();
 up.focus = up.viewport.focus;
@@ -17135,13 +17457,13 @@ up.reveal = up.viewport.reveal;
 /***/ }),
-/* 78 */
+/* 79 */
 /***/ (function() {
 /***/ }),
-/* 79 */
+/* 80 */
 /***/ (function() {
 var __assign = (this && this.__assign) || function () {
@@ -17709,7 +18031,7 @@ up.motion = (function () {
     */
     function registerTransition(name, transition) {
         var fn = findTransitionFn(transition);
-        fn.isDefault = up.framework.booting;
+        fn.isDefault = up.framework.evaling;
         namedTransitions[name] = fn;
     }
     /*-
@@ -17748,16 +18070,16 @@ up.motion = (function () {
     */
     function registerAnimation(name, animation) {
         var fn = findAnimationFn(animation);
-        fn.isDefault = up.framework.booting;
+        fn.isDefault = up.framework.evaling;
         namedAnimations[name] = fn;
     }
-    function warnIfDisabled() {
+    up.on('up:framework:boot', function () {
         // Explain to the user why animations aren't working.
         // E.g. the user might have disabled animations in her OS.
         if (!isEnabled()) {
             up.puts('up.motion', 'Animations are disabled');
         }
-    }
+    });
     /*-
     Returns whether the given animation option will cause the animation
     to be skipped.
@@ -17874,7 +18196,6 @@ up.motion = (function () {
       @see server-errors
     @stable
     */
-    up.on('up:framework:boot', warnIfDisabled);
     up.on('up:framework:reset', reset);
     return {
         morph: morph,
@@ -17897,10 +18218,10 @@ up.animate = up.motion.animate;
 /***/ }),
-/* 80 */
+/* 81 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
-__webpack_require__(81);
+__webpack_require__(82);
 var u = up.util;
 /*-
 Network requests
@@ -18126,7 +18447,7 @@ up.network = (function () {
     By default Unpoly automatically clears the entire cache whenever it processes
     a request with an non-GET HTTP method. To customize this rule, use `up.network.config.clearCache`.
-    The server may also clear the cache by sending an [`X-Up-Cache: clear`](/X-Up-Cache) header.
+    The server may also clear the cache by sending an [`X-Up-Clear-Cache`](/X-Up-Clear-Cache) header.
     @function up.cache.clear
     @param {string} [pattern]
@@ -18272,11 +18593,17 @@ up.network = (function () {
     @param {boolean|string} [options.clearCache]
       Whether to [clear](/up.cache.clear) the [cache](/up.cache.get) after this request.
-      You may also pass a [URL pattern](/url-patterns) to only clear matching requests.
       Defaults to the result of `up.network.config.clearCache`, which
       defaults to clearing the entire cache after a non-GET request.
+      You may also pass a [URL pattern](/url-patterns) to only uncache matching responses.
+    @param {boolean|string|Function} [options.solo]
+      With `{ solo: true }` Unpoly will [abort](/up.network.abort) all other requests before making this new request.
+      To only abort some requests, pass an [URL pattern](/url-patterns) that matches requests to abort.
+      You may also pass a function that accepts an existing `up.Request` and returns a boolean value.
     @param {Object} [options.headers={}]
       An object of additional HTTP headers.
@@ -18306,6 +18633,11 @@ up.network = (function () {
     @param {string} [options.layer='current']
       The [layer](/up.layer) this request is associated with.
+      If this request is intended to update an existing fragment, this is that fragment's layer.
+      If this request is intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
     @param {string} [options.failLayer='current']
       The [layer](/up.layer) this request is associated with if the server [sends a HTTP status code](/server-errors).
@@ -18462,6 +18794,24 @@ up.network = (function () {
      */
     var isIdle = u.negate(isBusy);
     /*-
+    Makes a full-page request, replacing the entire browser environment with a new page from the server response.
+    Also see `up.Request#loadPage()`.
+    @function up.network.loadPage
+    @param {string} options.url
+      The URL to load.
+    @param {string} [options.method='get']
+      The method for the request.
+      Methods other than GET or POST will be [wrapped](/up.protocol.config#config.methodParam) in a POST request.
+    @param {Object|Array|FormData|string} [options.params]
+    @experimental
+    */
+    function loadPage(requestsAttrs) {
+        new up.Request(requestsAttrs).loadPage();
+    }
+    /*-
     Returns whether optional requests should be avoided where possible.
     We assume the user wants to avoid requests if either of following applies:
@@ -18548,11 +18898,23 @@ up.network = (function () {
     The event is emitted on the layer that caused the request.
     @event up:request:aborted
     @param {up.Request} event.request
       The aborted request.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request was intended to update an existing fragment, this is that fragment's layer.
+      If this request was intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @param event.preventDefault()
     @experimental
     */
     /*-
@@ -18631,7 +18993,14 @@ up.network = (function () {
     @param {up.Request} event.request
       The request to be sent.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request is intended to update an existing fragment, this is that fragment's layer.
+      If this request is intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @param event.preventDefault()
       Event listeners may call this method to prevent the request from being sent.
     @stable
@@ -18657,12 +19026,24 @@ up.network = (function () {
     The event is emitted on the layer that caused the request.
     @event up:request:loaded
     @param {up.Request} event.request
       The request.
     @param {up.Response} event.response
       The response that was received from the server.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request is intended to update an existing fragment, this is that fragment's layer.
+      If this request is intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @stable
     */
     /*-
@@ -18676,10 +19057,21 @@ up.network = (function () {
     The event is emitted on the layer that caused the request.
     @event up:request:fatal
     @param {up.Request} event.request
-      The request.
+      The failed request.
     @param {up.Layer} [event.layer]
-      The [layer](/up.layer) that caused the request.
+      The [layer](/up.layer) this request is associated with.
+      If this request was intended to update an existing fragment, this is that fragment's layer.
+      If this request was intended to [open an overlay](/opening-overlays),
+      the associated layer is the future overlay's parent layer.
+    @param {Element} [event.origin]
+      The link or form element that caused the request.
     @stable
     */
     function isSafeMethod(method) {
@@ -18707,7 +19099,8 @@ up.network = (function () {
         registerAliasForRedirect: registerAliasForRedirect,
         queue: queue,
         shouldReduceRequests: shouldReduceRequests,
-        mimicLocalRequest: mimicLocalRequest
+        mimicLocalRequest: mimicLocalRequest,
+        loadPage: loadPage,
     };
 })();
 up.request = up.network.request;
@@ -18715,13 +19108,13 @@ up.cache = up.network.cache;
 /***/ }),
-/* 81 */
+/* 82 */
 /***/ (function() {
 /***/ }),
-/* 82 */
+/* 83 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __assign = (this && this.__assign) || function () {
@@ -18776,7 +19169,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from) {
         to[j] = from[i];
     return to;
 };
-__webpack_require__(83);
+__webpack_require__(84);
 var u = up.util;
 var e = up.element;
 /*-
@@ -19478,6 +19871,8 @@ up.layer = (function () {
       | `value`    | The overlay's [acceptance value](/closing-overlays#overlay-result-values) |
       | `event`    | An `up:layer:accepted` event                  |
+      With a strict Content Security Policy [additional rules apply](/csp).
     @param [up-on-dismissed]
       A JavaScript snippet that is called when the overlay was [dismissed](/closing-overlays).
@@ -19490,6 +19885,8 @@ up.layer = (function () {
       | `value`    | The overlay's [dismissal value](/closing-overlays#overlay-result-values) |
       | `event`    | An `up:layer:dismissed` event                   |
+      With a strict Content Security Policy [additional rules apply](/csp).
     @param [up-accept-event]
       One or more space-separated event types that will cause this overlay to automatically be
       [accepted](/closing-overlays) when a matching event occurs within the overlay.
@@ -19615,7 +20012,10 @@ up.layer = (function () {
     up.on('up:fragment:destroyed', function () {
         stack.sync();
     });
-    up.on('up:framework:boot', function () {
+    up.on('up:framework:evaled', function () {
+        // Due to circular dependencies we must delay initialization of the stack until all of
+        // Unpoly's submodules have been evaled. We cannot delay initialization until up:framework:boot,
+        // since by then user scripts have run and event listeners will no longer register as "default".
         stack = new up.LayerStack();
     });
     up.on('up:framework:reset', reset);
@@ -19982,13 +20382,13 @@ up.layer = (function () {
 /***/ }),
-/* 83 */
+/* 84 */
 /***/ (function() {
 /***/ }),
-/* 84 */
+/* 85 */
 /***/ (function(__unused_webpack_module, __unused_webpack_exports, __webpack_require__) {
 var __assign = (this && this.__assign) || function () {
@@ -20007,7 +20407,7 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from) {
         to[j] = from[i];
     return to;
 };
-__webpack_require__(85);
+__webpack_require__(86);
 /*-
 Linking to fragments
 ====================
@@ -20242,7 +20642,7 @@ up.link = (function () {
             if (options.cache == null) {
                 options.cache = 'auto';
             }
-            options.basic = true; //
+            options.basic = true;
             var request = new up.Request(options);
             return request.willCache();
         }
@@ -20297,6 +20697,13 @@ up.link = (function () {
       You may pass this additional `options` object to supplement or override
       options parsed from the link attributes.
+    @param {boolean} [options.navigate=true]
+      Whether this fragment update is considered [navigation](/navigation).
+      Setting this to `false` will disable most defaults, causing
+      Unpoly to render a fragment without side-effects like updating history
+      or scrolling.
     @return {Promise<up.RenderResult>}
       A promise that will be fulfilled when the link destination
       has been loaded and rendered.
@@ -20315,7 +20722,7 @@ up.link = (function () {
         parser.json('params');
         parser.booleanOrString('cache');
         parser.booleanOrString('clearCache');
-        parser.boolean('solo');
+        parser.booleanOrString('solo');
         parser.string('contentType', { attr: ['enctype', 'up-content-type'] });
         return options;
     }
@@ -20508,7 +20915,7 @@ up.link = (function () {
     }
     function followURL(link, options) {
         if (options === void 0) { options = {}; }
-        var url = options.url || link.getAttribute('href') || link.getAttribute('up-href');
+        var url = options.url || link.getAttribute('up-href') || link.getAttribute('href');
         // Developers sometimes make a <a href="#"> to give a JavaScript interaction standard
         // link behavior (like keyboard navigation or default styles). However, we don't want to
         // consider this  a link with remote content, and rather honor [up-content], [up-document]
@@ -20773,6 +21180,13 @@ up.link = (function () {
     @selector a[up-follow]
+    @param [up-navigate='true']
+      Whether this fragment update is considered [navigation](/navigation).
+      Setting this to `false` will disable most defaults documented below,
+      causing Unpoly to render a fragment without side-effects like updating history
+      or scrolling.
     @param [href]
       The URL to fetch from the server.
@@ -20784,7 +21198,7 @@ up.link = (function () {
       If omitted a [main target](/up-main) will be rendered.
-    @param [up-fallback]
+    @param [up-fallback='true']
       Specifies behavior if the [target selector](/up.render#options.target) is missing from the current page or the server response.
       If set to a CSS selector, Unpoly will attempt to replace that selector instead.
@@ -20793,9 +21207,6 @@ up.link = (function () {
       If set to `false` Unpoly will immediately reject the render promise.
-    @param [up-navigate='true']
-      Whether this fragment update is considered [navigation](/navigation).
     @param [up-method='get']
       The HTTP method to use for the request.
@@ -20820,8 +21231,15 @@ up.link = (function () {
       E.g. the `X-Up-Target` header includes the targeted CSS selector.
       See `up.protocol` and `up.network.config.requestMetaKeys` for details.
+    @param [up-content]
+      A string for the fragment's new [inner HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML).
+      If your HTML string also contains the fragment's [outer HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/outerHTML),
+      consider the `[up-fragment]` attribute instead.
     @param [up-fragment]
-      A string of HTML comprising *only* the new fragment. No server request will be sent.
+      A string of HTML comprising *only* the new fragment's
+      [outer HTML](https://developer.mozilla.org/en-US/docs/Web/API/Element/outerHTML).
       The `[up-target]` selector will be derived from the root element in the given
       HTML:
@@ -20858,7 +21276,7 @@ up.link = (function () {
       See [handling server errors](/server-errors) for details.
-    @param [up-history]
+    @param [up-history='auto']
       Whether the browser URL and window title will be updated.
       If set to `true`, the history will always be updated, using the title and URL from
@@ -20909,7 +21327,7 @@ up.link = (function () {
       See [MDN documentation](https://developer.mozilla.org/en-US/docs/Web/CSS/transition-timing-function)
       for a list of available timing functions.
-    @param [up-cache]
+    @param [up-cache='auto']
       Whether to read from and write to the [cache](/up.request#caching).
       With `[up-cache=true]` Unpoly will try to re-use a cached response before connecting
@@ -20919,6 +21337,8 @@ up.link = (function () {
       With `[up-cache=auto]` Unpoly will use the cache only if `up.network.config.autoCache`
       returns `true` for the request.
+      With `[up-cache=false]` Unpoly will always make a network request.
       Also see [`up.request({ cache })`](/up.request#options.cache).
     @param [up-clear-cache]
@@ -20929,6 +21349,11 @@ up.link = (function () {
       Also see [`up.request({ clearCache })`](/up.request#options.clearCache) and `up.network.config.clearCache`.
+    @param [up-solo='true']
+      With `[up-solo=true]` Unpoly will [abort](/up.network.abort) all other requests before laoding the new fragment.
+      To only abort some requests, pass an [URL pattern](/url-patterns) that matches requests to abort.
     @param [up-layer='origin current']
       The [layer](/up.layer) in which to match and render the fragment.
@@ -20937,7 +21362,7 @@ up.link = (function () {
       To [open the fragment in a new overlay](/opening-overlays), pass `[up-layer=new]`.
       In this case attributes for `a[up-layer=new]` may also be used.
-    @param [up-peel]
+    @param [up-peel='true']
       Whether to close overlays obstructing the updated layer when the fragment is updated.
       This is only relevant when updating a layer that is not the [frontmost layer](/up.layer.front).
@@ -20952,7 +21377,7 @@ up.link = (function () {
     @param [up-hungry='true']
       Whether [`[up-hungry]`](/up-hungry) elements outside the updated fragment will also be updated.
-    @param [up-scroll]
+    @param [up-scroll='auto']
       How to scroll after the new fragment was rendered.
       See [scroll option](/scroll-option) for a list of allowed values.
@@ -20962,7 +21387,7 @@ up.link = (function () {
       Saved scroll positions can later be restored with [`[up-scroll=restore]`](/scroll-option#restoring-scroll-positions).
-    @param [up-focus]
+    @param [up-focus='auto']
       What to focus after the new fragment was rendered.
       See [focus option](/focus-option) for a list of allowed values.
@@ -20974,7 +21399,7 @@ up.link = (function () {
       If the user does not confirm the render promise will reject and no fragments will be updated.
-    @param [up-feedback]
+    @param [up-feedback='true']
       Whether to give the link an `.up-active` class
       while loading and rendering content.
@@ -20984,10 +21409,14 @@ up.link = (function () {
       The callback argument is a preventable `up:fragment:loaded` event.
+      With a strict Content Security Policy [additional rules apply](/csp).
     @param [up-on-finished]
       A JavaScript snippet that is called when all animations have concluded and
       elements were removed from the DOM tree.
+      With a strict Content Security Policy [additional rules apply](/csp).
     @stable
     */
     up.on('up:click', fullFollowSelector, function (event, link) {
@@ -21118,13 +21547,13 @@ up.follow = up.link.follow;
 /***/ }),
-/* 85 */
+/* 86 */
 /***/ (function() {
 /***/ }),
-/* 86 */
+/* 87 */
 /***/ (function() {
 var __assign = (this && this.__assign) || function () {
@@ -21171,7 +21600,7 @@ up.form = (function () {
       You can configure Unpoly to handle *all* forms on a page without requiring an `[up-submit]` attribute:
       ```js
-      up.form.config.submitSelectors.push('form']
+      up.form.config.submitSelectors.push('form')
       ```
       Individual forms may opt out with an `[up-submit=follow]` attribute.
@@ -21314,6 +21743,11 @@ up.form = (function () {
       You may pass this additional `options` object to supplement or override
       options parsed from the form attributes.
+    @param {boolean} [options.navigate=true]
+      Whether this fragment update is considered [navigation](/navigation).
+      Setting this to `false` will disable most defaults.
     @return {Promise<up.RenderResult>}
       A promise that will be fulfilled when the server response was rendered.
@@ -21512,6 +21946,15 @@ up.form = (function () {
         }
         elements = e.list(elements);
         var fields = u.flatMap(elements, findFields);
+        var unnamedFields = u.reject(fields, 'name');
+        if (unnamedFields.length) {
+            // (1) We do not need to exclude the unnamed fields for up.FieldObserver, since that
+            //     parses values with up.Params.fromFields(), and that ignores unnamed fields.
+            // (2) Only warn, don't crash. There are some legitimate cases for having unnamed
+            //     a mix of named and unnamed fields in a form, and we don't want to prevent
+            //     <form up-observe> in that case.
+            up.warn('up.observe()', 'Will not observe fields without a [name]: %o', unnamedFields);
+        }
         var callback = u.extractCallback(args) || observeCallbackFromElement(elements[0]) || up.fail('up.observe: No change callback given');
         var options = u.extractOptions(args);
         options.delay = (_b = (_a = options.delay) !== null && _a !== void 0 ? _a : e.numberAttr(elements[0], 'up-delay')) !== null && _b !== void 0 ? _b : config.observeDelay;
@@ -21522,7 +21965,7 @@ up.form = (function () {
     function observeCallbackFromElement(element) {
         var rawCallback = element.getAttribute('up-observe');
         if (rawCallback) {
-            return new Function('value', 'name', rawCallback);
+            return up.NonceableCallback.fromString(rawCallback).toFunction('value', 'name');
         }
     }
     /*-
@@ -21867,7 +22310,7 @@ up.form = (function () {
     @selector form[up-submit]
     @params-note
-      All attributes for `a[up-follow]` may also be used.
+      All attributes for `a[up-follow]` may be used.
     @stable
     */
@@ -22198,6 +22641,8 @@ up.form = (function () {
     This is useful for observing text fields while the user is typing.
     If you want to submit the form after a change see [`input[up-autosubmit]`](/input-up-autosubmit).
+    With a strict Content Security Policy [additional rules apply](/csp).
     The programmatic variant of this is the [`up.observe()`](/up.observe) function.
     ### Example
@@ -22259,6 +22704,8 @@ up.form = (function () {
     This is useful for observing text fields while the user is typing.
     If you want to submit the form after a change see [`input[up-autosubmit]`](/input-up-autosubmit).
+    With a strict Content Security Policy [additional rules apply](/csp).
     The programmatic variant of this is the [`up.observe()`](/up.observe) function.
     ### Example
@@ -22378,7 +22825,7 @@ up.validate = up.form.validate;
 /***/ }),
-/* 87 */
+/* 88 */
 /***/ (function() {
 /*-
@@ -22817,7 +23264,7 @@ up.feedback = (function () {
 /***/ }),
-/* 88 */
+/* 89 */
 /***/ (function() {
 /*-
@@ -23034,7 +23481,7 @@ up.radio = (function () {
 /***/ }),
-/* 89 */
+/* 90 */
 /***/ (function() {
 /*
@@ -23173,16 +23620,17 @@ __webpack_require__(72);
 __webpack_require__(73);
 __webpack_require__(74);
 __webpack_require__(75);
-__webpack_require__(77);
-__webpack_require__(79);
+__webpack_require__(76);
+__webpack_require__(78);
 __webpack_require__(80);
-__webpack_require__(82);
-__webpack_require__(84);
-__webpack_require__(86);
+__webpack_require__(81);
+__webpack_require__(83);
+__webpack_require__(85);
 __webpack_require__(87);
 __webpack_require__(88);
 __webpack_require__(89);
-up.framework.boot();
+__webpack_require__(90);
+up.framework.onEvaled();
 }();
 /******/ })()