webpack 5.108.3 → 5.109.0

package/lib/html/syntax.js

@@ -147,6 +147,7 @@ const CC_QUESTION_MARK = 0x3f;
 const CC_LEFT_SQUARE_BRACKET = 0x5b;
 const CC_RIGHT_SQUARE_BRACKET = 0x5d;
 const CC_GRAVE_ACCENT = 0x60;
+const CC_NO_BREAK_SPACE = 0xa0;
 
 const QUOTE_DOUBLE = 1;
 const QUOTE_SINGLE = 2;
@@ -317,7 +318,7 @@ const getContentModeForTag = (name) => {
  * @param {string} lit lowercase ASCII literal
  * @returns {boolean} true if the range equals `lit` ignoring ASCII case
  */
-const rangeEqualsLower = (input, start, end, lit) => {
+const rangeEqualsLowerCase = (input, start, end, lit) => {
 	if (end - start !== lit.length) return false;
 	for (let i = 0; i < lit.length; i++) {
 		let c = input.charCodeAt(start + i);
@@ -339,27 +340,37 @@ const rangeEqualsLower = (input, start, end, lit) => {
 const getContentModeForRange = (input, start, end) => {
 	switch (end - start) {
 		case 3:
-			if (rangeEqualsLower(input, start, end, "xmp")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "xmp")) return STATE_RAWTEXT;
 			return STATE_DATA;
 		case 5:
-			if (rangeEqualsLower(input, start, end, "title")) return STATE_RCDATA;
-			if (rangeEqualsLower(input, start, end, "style")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "title")) return STATE_RCDATA;
+			if (rangeEqualsLowerCase(input, start, end, "style")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 6:
-			if (rangeEqualsLower(input, start, end, "script")) {
+			if (rangeEqualsLowerCase(input, start, end, "script")) {
 				return STATE_SCRIPT_DATA;
 			}
-			if (rangeEqualsLower(input, start, end, "iframe")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "iframe")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 7:
-			if (rangeEqualsLower(input, start, end, "noembed")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "noembed")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 8:
-			if (rangeEqualsLower(input, start, end, "textarea")) return STATE_RCDATA;
-			if (rangeEqualsLower(input, start, end, "noframes")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "textarea")) {
+				return STATE_RCDATA;
+			}
+			if (rangeEqualsLowerCase(input, start, end, "noframes")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 9:
-			if (rangeEqualsLower(input, start, end, "plaintext")) {
+			if (rangeEqualsLowerCase(input, start, end, "plaintext")) {
 				return STATE_PLAINTEXT;
 			}
 			return STATE_DATA;
@@ -374,7 +385,7 @@ const getContentModeForRange = (input, start, end) => {
  * @param {HtmlTokenCallbacks} callbacks callbacks
  * @returns {number} final position
  */
-const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
+const tokenize = (input, pos = 0, callbacks = {}) => {
 	const len = input.length;
 	let state = STATE_DATA;
 	let returnState = STATE_DATA;
@@ -383,9 +394,9 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 	let tagStart = pos;
 	let tagNameStart = -1;
 	let tagNameEnd = -1;
-	let attrNameStart = -1;
-	let attrNameEnd = -1;
-	let attrValueStart = -1;
+	let attributeNameStart = -1;
+	let attributeNameEnd = -1;
+	let attributeValueStart = -1;
 	let attrQuoteType = QUOTE_NONE;
 	let commentStart = pos;
 	let lastOpenTagName = "";
@@ -406,6 +417,18 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 	// Tracks whether the current tag has parsed any attributes — used to
 	// fire the `end-tag-with-attributes` parse error when an end tag emits.
 	let tagHasAttributes = false;
+	// Memoized next occurrence of `<` / `&` / NUL for the text-run
+	// fast-forwards: native `indexOf` beats a per-char JS loop, and `pos` only
+	// moves forward, so each memo is refreshed at most once per occurrence
+	// (`len` = no further occurrence).
+	let nextLt = -1;
+	let nextAmp = -1;
+	let nextNul = -1;
+	// Same memo scheme for the closing quote of quoted attribute values (long
+	// values: data: URIs, srcset, inline style). Memoized so a value with many
+	// `&` references doesn't re-run the quote scan per reference.
+	let nextDQuote = -1;
+	let nextSQuote = -1;
 
 	/**
 	 * Reports a tokenizer parse error to the consumer. The offset range and
@@ -429,7 +452,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 	 * the accumulated `charRefCode`, if any. Used both inline (when the
 	 * reference is terminated by a real next character) and at EOF (when the
 	 * reference runs to the end of input). The scanner only flags the error —
-	 * the spec's U+FFFD / Windows-1252 substitution is done by `decodeHtmlEntities`.
+	 * the spec's U+FFFD / Windows-1252 substitution is done by `decodeEntities`.
 	 * @param {number} endPos offset just past the reference
 	 */
 	const validateNumericReference = (endPos) => {
@@ -526,19 +549,19 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 		// the callback is expected to do the same advance based on the
 		// reported `quoteType`.
 		let nextPos = attrQuoteType === QUOTE_NONE ? endPos : endPos + 1;
-		if (callbacks.attribute !== undefined && attrNameStart !== -1) {
+		if (callbacks.attribute !== undefined && attributeNameStart !== -1) {
 			nextPos = callbacks.attribute(
 				input,
-				attrNameStart,
-				attrNameEnd,
-				attrValueStart,
-				attrValueStart === -1 ? -1 : endPos,
+				attributeNameStart,
+				attributeNameEnd,
+				attributeValueStart,
+				attributeValueStart === -1 ? -1 : endPos,
 				attrQuoteType
 			);
 		}
-		if (attrNameStart !== -1) tagHasAttributes = true;
-		attrNameStart = -1;
-		attrValueStart = -1;
+		if (attributeNameStart !== -1) tagHasAttributes = true;
+		attributeNameStart = -1;
+		attributeValueStart = -1;
 		attrQuoteType = QUOTE_NONE;
 		return nextPos;
 	};
@@ -600,7 +623,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 		// All WHATWG tokenizer states handled. Deliberately omitted parse errors
 		// (need state this offset scanner lacks): duplicate-attribute,
 		// cdata-in-html-content, `*-in-input-stream`. Reference substitution is
-		// left to `decodeHtmlEntities`.
+		// left to `decodeEntities`.
 		switch (state) {
 			// https://html.spec.whatwg.org/multipage/parsing.html#data-state
 			case STATE_DATA:
@@ -625,15 +648,23 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					pos++;
 				} else {
 					// Fast-forward over the run of ordinary text without re-entering
-					// the per-state switch; stop on the next significant code point.
+					// the per-state switch — batches only the data state's "Anything
+					// else — emit the current input character" arc; the stops are
+					// exactly the code points with their own arcs (`<`, `&`, NUL).
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_LESS_THAN || c2 === CC_AMPERSAND || c2 === CC_NULL) {
-							break;
-						}
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
+					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
 					}
+					pos = Math.min(nextLt, nextAmp, nextNul);
 				}
 				break;
 
@@ -806,14 +837,14 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 						pos + 1,
 						"warning"
 					);
-					attrNameStart = pos;
+					attributeNameStart = pos;
 					state = STATE_ATTRIBUTE_NAME;
 					pos++;
 				} else {
 					// Anything else
 					// Start a new attribute in the current tag token. Set that attribute name
 					// and value to the empty string. Reconsume in the attribute name state.
-					attrNameStart = pos;
+					attributeNameStart = pos;
 					state = STATE_ATTRIBUTE_NAME;
 					// Reconsume
 				}
@@ -831,11 +862,11 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				// EOF
 				// Reconsume in the after attribute name state.
 				if (isSpace(cc) || cc === CC_SOLIDUS || cc === CC_GREATER_THAN) {
-					attrNameEnd = pos;
+					attributeNameEnd = pos;
 					state = STATE_AFTER_ATTRIBUTE_NAME;
 					// Reconsume
 				} else if (cc === CC_EQUALS) {
-					attrNameEnd = pos;
+					attributeNameEnd = pos;
 					state = STATE_BEFORE_ATTRIBUTE_VALUE;
 					pos++;
 				} else {
@@ -915,7 +946,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// Anything else
 					// Start a new attribute in the current tag token.
 					emitAttribute(pos);
-					attrNameStart = pos;
+					attributeNameStart = pos;
 					state = STATE_ATTRIBUTE_NAME;
 					// Reconsume
 				}
@@ -934,14 +965,14 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				} else if (cc === CC_QUOTATION_MARK) {
 					// U+0022 QUOTATION MARK (")
 					// Switch to the attribute value (double-quoted) state.
-					attrValueStart = pos + 1;
+					attributeValueStart = pos + 1;
 					attrQuoteType = QUOTE_DOUBLE;
 					state = STATE_ATTRIBUTE_VALUE_DOUBLE_QUOTED;
 					pos++;
 				} else if (cc === CC_APOSTROPHE) {
 					// U+0027 APOSTROPHE (')
 					// Switch to the attribute value (single-quoted) state.
-					attrValueStart = pos + 1;
+					attributeValueStart = pos + 1;
 					attrQuoteType = QUOTE_SINGLE;
 					state = STATE_ATTRIBUTE_VALUE_SINGLE_QUOTED;
 					pos++;
@@ -952,7 +983,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// an empty value range pointing at the `>` so the open-tag offset range
 					// still includes the `>`.
 					reportError("missing-attribute-value", pos, pos + 1, "warning");
-					attrValueStart = pos;
+					attributeValueStart = pos;
 					attrQuoteType = QUOTE_NONE;
 					pos = emitAttribute(pos);
 					if (input.charCodeAt(tagStart + 1) === CC_SOLIDUS) {
@@ -966,7 +997,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				} else {
 					// Anything else
 					// Reconsume in the attribute value (unquoted) state.
-					attrValueStart = pos;
+					attributeValueStart = pos;
 					attrQuoteType = QUOTE_NONE;
 					state = STATE_ATTRIBUTE_VALUE_UNQUOTED;
 					// Reconsume
@@ -993,19 +1024,22 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over the ordinary run of the quoted value.
+					// Fast-forward over the ordinary run of the quoted value with the
+					// same memoized native-scan scheme as the data state.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (
-							c2 === CC_QUOTATION_MARK ||
-							c2 === CC_AMPERSAND ||
-							c2 === CC_NULL
-						) {
-							break;
-						}
-						pos++;
+					if (nextDQuote < pos) {
+						nextDQuote = input.indexOf('"', pos);
+						if (nextDQuote === -1) nextDQuote = len;
+					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
 					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
+					}
+					pos = Math.min(nextDQuote, nextAmp, nextNul);
 				}
 				break;
 
@@ -1029,15 +1063,22 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over the ordinary run of the quoted value.
+					// Fast-forward over the ordinary run of the quoted value with the
+					// same memoized native-scan scheme as the data state.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_APOSTROPHE || c2 === CC_AMPERSAND || c2 === CC_NULL) {
-							break;
-						}
-						pos++;
+					if (nextSQuote < pos) {
+						nextSQuote = input.indexOf("'", pos);
+						if (nextSQuote === -1) nextSQuote = len;
 					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
+					}
+					pos = Math.min(nextSQuote, nextAmp, nextNul);
 				}
 				break;
 
@@ -1301,7 +1342,20 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary comment text without re-entering the
+					// state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (
+							c2 === CC_LESS_THAN ||
+							c2 === CC_HYPHEN_MINUS ||
+							c2 === CC_NULL
+						) {
+							break;
+						}
+						pos++;
+					}
 				}
 				break;
 
@@ -1403,7 +1457,14 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary bogus-comment text without re-entering the
+					// state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (c2 === CC_GREATER_THAN || c2 === CC_NULL) break;
+						pos++;
+					}
 				}
 				break;
 
@@ -2250,7 +2311,10 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				} else {
 					// Anything else
 					// Emit the current input character as a character token.
-					pos++;
+					// Fast-forward to the next `]` (the only code point with its own
+					// arc) in one native scan.
+					pos = input.indexOf("]", pos + 1);
+					if (pos === -1) pos = len;
 				}
 				break;
 
@@ -2319,15 +2383,23 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over ordinary RCDATA text.
+					// Fast-forward over ordinary RCDATA text (same memoized
+					// `indexOf` scheme as the data state) — batches only this
+					// state's "anything else" arc; `&` / `<` / NUL keep their own.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_AMPERSAND || c2 === CC_LESS_THAN || c2 === CC_NULL) {
-							break;
-						}
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
 					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
+					}
+					pos = Math.min(nextLt, nextAmp, nextNul);
 				}
 				break;
 
@@ -2382,7 +2454,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2398,7 +2475,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2414,7 +2496,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -2454,13 +2541,19 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over ordinary RAWTEXT text.
+					// Fast-forward over ordinary RAWTEXT text (same memoized
+					// `indexOf` scheme as the data state) — batches only this
+					// state's "anything else" arc; `<` / NUL keep their own.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_LESS_THAN || c2 === CC_NULL) break;
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
 					}
+					pos = Math.min(nextLt, nextNul);
 				}
 				break;
 
@@ -2514,7 +2607,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2529,7 +2627,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2544,7 +2647,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -2583,13 +2691,19 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over ordinary script-data text.
+					// Fast-forward over ordinary script-data text (same memoized
+					// `indexOf` scheme as the data state) — batches only this
+					// state's "anything else" arc; `<` / NUL keep their own.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_LESS_THAN || c2 === CC_NULL) break;
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
 					}
+					pos = Math.min(nextLt, nextNul);
 				}
 				break;
 
@@ -2649,7 +2763,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2664,7 +2783,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2679,7 +2803,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -2757,7 +2886,20 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary escaped script text without re-entering
+					// the state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (
+							c2 === CC_HYPHEN_MINUS ||
+							c2 === CC_LESS_THAN ||
+							c2 === CC_NULL
+						) {
+							break;
+						}
+						pos++;
+					}
 				}
 				break;
 
@@ -2877,7 +3019,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2892,7 +3039,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2907,7 +3059,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -2989,7 +3146,20 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary double-escaped script text without re-entering
+					// the state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (
+							c2 === CC_HYPHEN_MINUS ||
+							c2 === CC_LESS_THAN ||
+							c2 === CC_NULL
+						) {
+							break;
+						}
+						pos++;
+					}
 				}
 				break;
 
@@ -3175,25 +3345,25 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					pos + runLen < len && input.charCodeAt(pos + runLen) === CC_SEMICOLON;
 				namedEntityConsumed = 0;
 				let matchedWithSemicolon = false;
-				// Slice the candidate run from `input` once; prefixes are taken from
-				// this short string instead of re-slicing the (potentially huge)
-				// input per length.
-				const run = input.slice(pos, pos + runLen);
-				for (let n = runLen; n > 0; n--) {
-					const bare = n === runLen ? run : run.slice(0, n);
-					// Try with trailing `;` first if one is present after the run.
-					if (
-						n === runLen &&
-						hasSemicolon &&
-						HTML_ENTITIES[`${bare};`] !== undefined
-					) {
-						namedEntityConsumed = n + 1;
+				// Try the full run with its trailing `;` first — the overwhelmingly
+				// common case (`&amp;`, `&nbsp;`, …) then needs exactly one slice.
+				if (hasSemicolon && runLen > 0) {
+					const withSemicolon = input.slice(pos, pos + runLen + 1);
+					if (HTML_ENTITIES[withSemicolon] !== undefined) {
+						namedEntityConsumed = runLen + 1;
 						matchedWithSemicolon = true;
-						break;
 					}
-					if (HTML_ENTITIES[bare] !== undefined) {
-						namedEntityConsumed = n;
-						break;
+				}
+				if (namedEntityConsumed === 0) {
+					// Slice the candidate run once; prefixes come from this short
+					// string instead of re-slicing the input per length.
+					const run = input.slice(pos, pos + runLen);
+					for (let n = runLen; n > 0; n--) {
+						const bare = n === runLen ? run : run.slice(0, n);
+						if (HTML_ENTITIES[bare] !== undefined) {
+							namedEntityConsumed = n;
+							break;
+						}
 					}
 				}
 				if (namedEntityConsumed > 0) {
@@ -3208,12 +3378,10 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 							returnState === STATE_ATTRIBUTE_VALUE_DOUBLE_QUOTED ||
 							returnState === STATE_ATTRIBUTE_VALUE_SINGLE_QUOTED ||
 							returnState === STATE_ATTRIBUTE_VALUE_UNQUOTED;
-						if (
-							!(
-								inAttribute &&
-								(next === CC_EQUALS || isAsciiAlphanumeric(next))
-							)
-						) {
+						if (!(
+							inAttribute &&
+							(next === CC_EQUALS || isAsciiAlphanumeric(next))
+						)) {
 							reportError(
 								"missing-semicolon-after-character-reference",
 								pos + namedEntityConsumed,
@@ -3470,11 +3638,11 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 		// dropping the in-progress tag, we emit its offset range up to EOF.
 		reportError("eof-in-tag", len, len, "error");
 		// If we hit EOF mid-attribute-name, the name runs to EOF. Set
-		// attrNameEnd here so the emitted attribute range is valid.
-		if (state === STATE_ATTRIBUTE_NAME && attrNameStart !== -1) {
-			attrNameEnd = len;
+		// attributeNameEnd here so the emitted attribute range is valid.
+		if (state === STATE_ATTRIBUTE_NAME && attributeNameStart !== -1) {
+			attributeNameEnd = len;
 		}
-		if (attrNameStart !== -1) emitAttribute(len);
+		if (attributeNameStart !== -1) emitAttribute(len);
 		// If we hit EOF before the tag-name end was recorded, the name runs
 		// to EOF. `tagNameEnd` may carry over from a previously emitted tag,
 		// so reset it whenever it's missing or stale (less than `tagNameStart`)
@@ -3607,15 +3775,6 @@ const decodeNumericReference = (code) => {
 	return String.fromCodePoint(code);
 };
 
-// Match one of three forms (each with an optional trailing `;`):
-//   `&#x<hex>` - hex numeric reference (requires the `x`/`X`).
-//   `&#<dec>`  - decimal numeric reference (digits only).
-//   `&<name>`  - named reference (letter followed by alphanumerics).
-// The three alternatives are kept separate so a decimal reference like
-// `&#65b` doesn't greedily eat the trailing `b` as if it were hex.
-const CHARACTER_REFERENCE_REGEXP =
-	/&(?:#[xX][0-9a-fA-F]+|#[0-9]+|[a-zA-Z][a-zA-Z0-9]*);?/g;
-
 /**
  * Decode a single matched character reference.
  * @param {string} match the matched reference text
@@ -3623,45 +3782,34 @@ const CHARACTER_REFERENCE_REGEXP =
  * @param {boolean=} isAttribute true when the match came from an attribute value
  * @returns {string} decoded text, or `match` itself when it stays literal
  */
-const decodeOneReference = (match, nextCharCode, isAttribute) => {
-	// Numeric reference: &#65; or &#x41;
-	if (match.charCodeAt(1) === 0x23 /* # */) {
-		const lastChar = match.charAt(match.length - 1);
-		const isHex = match.charCodeAt(2) === 0x78 || match.charCodeAt(2) === 0x58;
-		const body = isHex
-			? lastChar === ";"
-				? match.slice(3, -1)
-				: match.slice(3)
-			: lastChar === ";"
-				? match.slice(2, -1)
-				: match.slice(2);
-		// The regex above guarantees at least one digit in `body`,
-		// so `parseInt` always returns a finite number here.
-		return decodeNumericReference(Number.parseInt(body, isHex ? 16 : 10));
-	}
-
-	// Named reference. Try the full captured name first, then
-	// progressively shorter prefixes - this handles direct matches
-	// like `&amp;` as well as WHATWG longest-prefix semantics where
-	// e.g. `&notpre;` decodes as `&not` (a legacy bare entity)
-	// followed by `pre;` as literal text.
-	const name = match.slice(1);
+/**
+ * Decode a named character reference spanning `[start, end)` of `str` (the
+ * `&` at `start`, the optional `;` included). Slices the name once; WHATWG
+ * longest-prefix and consumed-as-part-of-an-attribute semantics as before.
+ * @param {string} str the raw string
+ * @param {number} start offset of the reference's `&`
+ * @param {number} end offset just past the reference (past the `;` if present)
+ * @param {number} nextCharCode char code following the reference (NaN at the end)
+ * @param {boolean=} isAttribute true when the reference came from an attribute value
+ * @returns {string | undefined} decoded text, or `undefined` when it stays literal
+ */
+const decodeNamedReference = (str, start, end, nextCharCode, isAttribute) => {
+	// Mirrors the old `match.slice(1)`: the name keeps its trailing `;`.
+	const name = str.slice(start + 1, end);
 	const matchEndsWithSemi = name.charCodeAt(name.length - 1) === 0x3b;
 
 	// Attribute-context guard: if the entity match didn't end with `;`
 	// and the next character in the source is `=` or ASCII
 	// alphanumeric, the WHATWG spec says to flush the literal text
-	// rather than decode. The greedy regex already absorbed any
+	// rather than decode. The greedy scan already absorbed any
 	// trailing alphanumerics, so the only candidate "next char" here
 	// is `=` (or any non-alphanumeric).
 	if (isAttribute && !matchEndsWithSemi && nextCharCode === 0x3d /* = */) {
-		return match;
+		return undefined;
 	}
 
-	// Fast path: the regex usually captures exactly one entity (`&amp;`,
-	// `&lt;`, `&nbsp;`, …), so the whole `name` is the match — avoid the
-	// full-length `name.slice(0, name.length)` the loop's first iteration
-	// would allocate. No leftover, so the attribute guard never applies.
+	// Fast path: the scan usually captures exactly one entity (`&amp;`,
+	// `&lt;`, `&nbsp;`, ...), so the whole `name` is the match.
 	if (name.length <= MAX_ENTITY_NAME_LEN) {
 		const full = HTML_ENTITIES[name];
 		if (full !== undefined) return full;
@@ -3680,23 +3828,21 @@ const decodeOneReference = (match, nextCharCode, isAttribute) => {
 			// Attribute-context longest-prefix guard: if the matched
 			// prefix doesn't end with `;` and the leftover starts with
 			// an alphanumeric character, leave literal per WHATWG.
-			// (The regex greedy-consumes alphanumerics, so any leftover
-			// within `name` is itself alphanumeric — we only need to
-			// check non-empty leftover here; the `=` case is handled
-			// above against the source character after the match.)
 			if (
 				isAttribute &&
 				i < name.length &&
 				prefix.charCodeAt(prefix.length - 1) !== 0x3b
 			) {
-				return match;
+				return undefined;
 			}
 			return HTML_ENTITIES[prefix] + name.slice(i);
 		}
 	}
-	return match;
+	return undefined;
 };
 
+/** @typedef {{ text: string, map: number[] | undefined }} DecodedEntitiesWithMap */
+
 /**
  * Decode HTML character references in a string. Handles all numeric
  * references (with WHATWG remap of 0x00, surrogates, out-of-range, and the
@@ -3708,70 +3854,246 @@ const decodeOneReference = (match, nextCharCode, isAttribute) => {
  * trailing `;` whose next character is `=` or ASCII alphanumeric is left
  * undecoded, so e.g. `&amp=foo` stays literal in an attribute value but
  * decodes to `&=foo` in text.
+ *
+ * With `withMap` the result also carries a boundary map from the decoded
+ * string back to raw offsets, so spans computed on the decoded text (e.g.
+ * srcset candidate URLs) can be translated to source ranges. `map[i]` is the
+ * raw offset of decoded boundary `i` (`0..text.length`); boundaries inside a
+ * reference's decoded text map to the reference start. `map` is `undefined`
+ * when nothing was decoded (then `text === str`).
+ * @overload
  * @param {string} str the raw string from the token slice
  * @param {boolean=} isAttribute true if `str` came from an attribute value
  * @returns {string} decoded string
  */
-const decodeHtmlEntities = (str, isAttribute) => {
-	if (!str.includes("&")) return str;
-
-	return str.replace(CHARACTER_REFERENCE_REGEXP, (match, offset, source) =>
-		decodeOneReference(
-			match,
-			source.charCodeAt(offset + match.length),
-			isAttribute
-		)
-	);
-};
-
 /**
- * Like `decodeHtmlEntities`, but also returns a boundary map from the
- * decoded string back to raw offsets, so spans computed on the decoded
- * text (e.g. srcset candidate URLs) can be translated to source ranges.
- * `map[i]` is the raw offset of decoded boundary `i` (`0..text.length`);
- * boundaries inside a reference's decoded text map to the reference start.
- * `map` is `undefined` when nothing was decoded (then `text === str`).
+ * @overload
+ * @param {string} str the raw string from the token slice
+ * @param {boolean | undefined} isAttribute true if `str` came from an attribute value
+ * @param {true} withMap also build the decoded-to-raw boundary map
+ * @returns {DecodedEntitiesWithMap} decoded text and offset map
+ */
+/**
  * @param {string} str the raw string from the token slice
  * @param {boolean=} isAttribute true if `str` came from an attribute value
- * @returns {{ text: string, map: number[] | undefined }} decoded text and offset map
+ * @param {boolean=} withMap also build the decoded-to-raw boundary map
+ * @returns {string | DecodedEntitiesWithMap} decoded string (with map when `withMap`)
  */
-const decodeHtmlEntitiesWithMap = (str, isAttribute) => {
+const decodeEntities = (str, isAttribute, withMap) => {
+	// Hand-rolled scan of one of three reference forms, each with an optional
+	// trailing `;` — `&#x<hex>+` / `&#<dec>+` / `&<alpha><alnum>*` (kept separate
+	// so `&#65b` doesn't eat the `b` as hex): entity-dense text pays no regex
+	// machinery or per-match object, and a string whose references all stay
+	// literal is returned unchanged without rebuilding. Map bookkeeping is
+	// gated on `withMap` at the rare per-decoded-reference points, so the
+	// dominant no-map mode pays nothing for the unified implementation.
+	let amp = str.indexOf("&");
+	if (amp === -1) return withMap ? { text: str, map: undefined } : str;
+	let out = "";
+	let last = 0;
 	/** @type {number[] | undefined} */
 	let map;
-	if (str.includes("&")) {
-		CHARACTER_REFERENCE_REGEXP.lastIndex = 0;
-		let text = "";
-		let last = 0;
-		/** @type {RegExpExecArray | null} */
-		let m;
-		while ((m = CHARACTER_REFERENCE_REGEXP.exec(str)) !== null) {
-			const match = m[0];
-			const decoded = decodeOneReference(
-				match,
-				str.charCodeAt(m.index + match.length),
-				isAttribute
-			);
-			if (decoded === match) continue;
-			if (map === undefined) map = [];
-			for (let r = last; r < m.index; r++) map.push(r);
-			text += str.slice(last, m.index);
-			for (let i = 0; i < decoded.length; i++) map.push(m.index);
-			text += decoded;
-			last = m.index + match.length;
-		}
-		if (map !== undefined) {
-			for (let r = last; r < str.length; r++) map.push(r);
-			map.push(str.length);
-			return { text: text + str.slice(last), map };
+	do {
+		// `end` stays 0 when the `&` doesn't start a well-formed reference; a
+		// numeric reference's code point accumulates during the digit scan
+		// (saturating above the code-point range — every overflow decodes the
+		// same replacement) so it needs no slice at all.
+		let end = 0;
+		let code = -1;
+		let cc = str.charCodeAt(amp + 1);
+		if (cc === 0x23 /* # */) {
+			cc = str.charCodeAt(amp + 2);
+			let p;
+			if (cc === 0x78 /* x */ || cc === 0x58 /* X */) {
+				code = 0;
+				p = amp + 3;
+				while (isAsciiHexDigit((cc = str.charCodeAt(p)))) {
+					code = code * 16 + (cc <= 0x39 ? cc - 0x30 : (cc | 0x20) - 0x57);
+					if (code > 0x10ffff) code = 0x110000;
+					p++;
+				}
+				if (p > amp + 3) end = p;
+			} else {
+				code = 0;
+				p = amp + 2;
+				while (isAsciiDigit((cc = str.charCodeAt(p)))) {
+					code = code * 10 + (cc - 0x30);
+					if (code > 0x10ffff) code = 0x110000;
+					p++;
+				}
+				if (p > amp + 2) end = p;
+			}
+		} else if (isAsciiAlpha(cc)) {
+			code = -1;
+			let p = amp + 2;
+			while (isAsciiAlphanumeric(str.charCodeAt(p))) p++;
+			end = p;
+		}
+		if (end !== 0) {
+			if (str.charCodeAt(end) === 0x3b /* ; */) end++;
+			// Numeric references always decode; named ones may stay literal.
+			const decoded =
+				code >= 0
+					? decodeNumericReference(code)
+					: decodeNamedReference(
+							str,
+							amp,
+							end,
+							str.charCodeAt(end),
+							isAttribute
+						);
+			if (decoded !== undefined) {
+				if (withMap) map = _mapReference(map, last, amp, decoded.length);
+				out += str.slice(last, amp);
+				out += decoded;
+				last = end;
+			}
+			amp = str.indexOf("&", end);
+		} else {
+			amp = str.indexOf("&", amp + 1);
+		}
+	} while (amp !== -1);
+	if (last === 0) return withMap ? { text: str, map: undefined } : str;
+	const text = out + str.slice(last);
+	return withMap
+		? _finishMap(text, /** @type {number[]} */ (map), last, str.length)
+		: text;
+};
+
+// Map-mode bookkeeping for `decodeEntities`, kept out of the scanner body so
+// the dominant no-map mode stays small enough to inline.
+/**
+ * @param {number[] | undefined} map boundary map so far
+ * @param {number} last raw offset the literal run starts at
+ * @param {number} amp raw offset of the decoded reference
+ * @param {number} decodedLength length of the decoded text
+ * @returns {number[]} the map, with the literal run's and reference's boundaries appended
+ */
+const _mapReference = (map, last, amp, decodedLength) => {
+	if (map === undefined) map = [];
+	for (let r = last; r < amp; r++) map.push(r);
+	for (let i = 0; i < decodedLength; i++) map.push(amp);
+	return map;
+};
+
+/**
+ * @param {string} text decoded text
+ * @param {number[]} map boundary map so far
+ * @param {number} last raw offset of the trailing literal run
+ * @param {number} rawLength raw string length
+ * @returns {DecodedEntitiesWithMap} the finished result
+ */
+const _finishMap = (text, map, last, rawLength) => {
+	for (let r = last; r < rawLength; r++) map.push(r);
+	map.push(rawLength);
+	return { text, map };
+};
+
+/**
+ * Escape a string per the WHATWG "escape a string" algorithm
+ * (https://html.spec.whatwg.org/multipage/parsing.html#escapingString) in
+ * attribute mode: `&`, U+00A0 and `"`. CR/LF are additionally encoded as
+ * numeric references so the result stays single-line (usable in a `data:`
+ * URI). Single pass, returns the input unchanged when nothing needs escaping.
+ * @param {string} s string to escape
+ * @returns {string} HTML attribute-safe string
+ */
+const escapeAttribute = (s) => {
+	// fast path: native indexOf scans beat any per-character loop
+	if (
+		!s.includes("&") &&
+		!s.includes('"') &&
+		!s.includes("\u00A0") &&
+		!s.includes("\n") &&
+		!s.includes("\r")
+	) {
+		return s;
+	}
+	let out = "";
+	let last = 0;
+	for (let i = 0; i < s.length; i++) {
+		let rep;
+		switch (s.charCodeAt(i)) {
+			case CC_AMPERSAND:
+				rep = "&amp;";
+				break;
+			case CC_QUOTATION_MARK:
+				rep = "&quot;";
+				break;
+			case CC_NO_BREAK_SPACE:
+				rep = "&nbsp;";
+				break;
+			case CC_LF:
+				rep = "&#10;";
+				break;
+			case CC_CR:
+				rep = "&#13;";
+				break;
+			default:
+				continue;
 		}
+		out += s.slice(last, i) + rep;
+		last = i + 1;
 	}
-	return { text: str, map };
+	return out + s.slice(last);
+};
+
+/**
+ * Escape a string per the WHATWG "escape a string" algorithm in text mode:
+ * `&`, U+00A0, `<` and `>`. CR/LF are additionally encoded as numeric
+ * references so the result stays single-line (usable in a `data:` URI).
+ * Single pass, returns the input unchanged when nothing needs escaping.
+ * @param {string} s string to escape
+ * @returns {string} HTML text-content-safe string
+ */
+const escapeText = (s) => {
+	// fast path: native indexOf scans beat any per-character loop
+	if (
+		!s.includes("&") &&
+		!s.includes("<") &&
+		!s.includes(">") &&
+		!s.includes("\u00A0") &&
+		!s.includes("\n") &&
+		!s.includes("\r")
+	) {
+		return s;
+	}
+	let out = "";
+	let last = 0;
+	for (let i = 0; i < s.length; i++) {
+		let rep;
+		switch (s.charCodeAt(i)) {
+			case CC_AMPERSAND:
+				rep = "&amp;";
+				break;
+			case CC_LESS_THAN:
+				rep = "&lt;";
+				break;
+			case CC_GREATER_THAN:
+				rep = "&gt;";
+				break;
+			case CC_NO_BREAK_SPACE:
+				rep = "&nbsp;";
+				break;
+			case CC_LF:
+				rep = "&#10;";
+				break;
+			case CC_CR:
+				rep = "&#13;";
+				break;
+			default:
+				continue;
+		}
+		out += s.slice(last, i) + rep;
+		last = i + 1;
+	}
+	return out + s.slice(last);
 };
 
 // cspell:ignore advasoft altglyph altglyphdef altglyphitem animatecolor animatemotion animatetransform arcrole aswedit attributename attributetype basefrequency baseprofile bgsound calcmode clippathunits definitionurl diffuseconstant fedropshadow filterunits glyphref gradienttransform gradientunits hotjava hotmetal kernelmatrix kernelunitlength keypoints keysplines keytimes limitingconeangle malignmark markerheight markerwidth maskcontentunits maskunits metrius mglyph mtext numoctaves pathlength patterncontentunits patterntransform patternunits pointsatx pointsaty pointsatz preservealpha primitiveunits refx refy repeatcount repeatdur requiredextensions requiredfeatures selectedcontent silmaril softquad specularconstant specularexponent startoffset stddeviation stitchtiles surfacescale systemlanguage tablevalues targetx targety textlength viewbox viewtarget webtechs xchannelselector ychannelselector megamorphic attributeless rowspan imagesizes novalidate maxlength
 
 // WHATWG HTML tree construction (https://html.spec.whatwg.org/multipage/parsing.html#tree-construction)
-// on top of walkHtmlTokens. Scripting is always disabled (webpack is a build tool).
+// on top of tokenize. Scripting is always disabled (webpack is a build tool).
 
 // Namespaces (mirrors swc_html_ast::Namespace)
 const NS_HTML = 0;
@@ -3779,6 +4101,389 @@ const NS_MATHML = 1;
 const NS_SVG = 2;
 
 /**
+ * AST node `type` discriminators. Numeric for the same reason as the CSS
+ * `NodeType`: compact integer `===` dispatch on the tree-construction and
+ * visitor-walk hot paths.
+ * @type {{ Document: 1, DocumentFragment: 2, Element: 3, Text: 4, Comment: 5, Doctype: 6 }}
+ */
+const NodeType = {
+	Document: 1,
+	DocumentFragment: 2,
+	Element: 3,
+	Text: 4,
+	Comment: 5,
+	Doctype: 6
+};
+
+/**
+ * A contiguous run of attribute ids in the attribute columns — how a start-tag
+ * token and an element refer to their attributes. `start` is the first id
+ * (`count` 0 = none).
+ * @typedef {{ start: number, count: number }} AttributeRun
+ */
+
+// Shared frozen empty run for attributeless elements and synthesized tags.
+const EMPTY_ATTRS = /** @type {AttributeRun} */ (
+	Object.freeze({ start: 0, count: 0 })
+);
+
+// === Struct-of-arrays AST backend ===
+// One AST node = one integer id (`HtmlNodeRef`) indexing the parallel columns
+// below — no per-node object and no per-parent children array. Tree shape
+// lives in the four link columns (parent / firstChild / lastChild /
+// nextSibling); the only heap references are the string payload / attribute
+// name-and-value side arrays. Columns are module-level and reused
+// across parses (grown, shrunk on release only past `_COLUMN_SHRINK_CAPACITY` —
+// the CSS parser's `_soa*` strategy), so a steady-state parse allocates almost
+// nothing per node; consumers must fully read a tree before the next
+// `parseHtml` call. Id 0 is reserved as "no node" so the link columns can use
+// 0 as null.
+let _nodeCapacity = 0;
+let _nodeCount = 0;
+/** `NodeType` per node */
+let _nodeTypes = new Uint8Array(0);
+/** bits 0-1 namespace (`NS_*`), bit 2 self-closing (void element) */
+let _nodeFlags = new Uint8Array(0);
+let _nodeStarts = new Int32Array(0);
+let _nodeEnds = new Int32Array(0);
+/** end offset of an element's opening tag (after `>`) */
+let _nodeTagEnds = new Int32Array(0);
+/** end offset of an element's tag name */
+let _nodeNameEnds = new Int32Array(0);
+/** under `skip.text`, end offset of a raw-text element's body (`HtmlAstSkip`) */
+let _nodeContentEnds = new Int32Array(0);
+/** a `<template>`'s content DocumentFragment (0 = none) */
+let _nodeTemplateContents = new Int32Array(0);
+let _nodeParents = new Int32Array(0);
+let _nodeFirstChildren = new Int32Array(0);
+let _nodeLastChildren = new Int32Array(0);
+let _nodeNextSiblings = new Int32Array(0);
+/** @type {string[]} tag name / text data / comment data / doctype name */
+const _nodeStrings = [];
+/** first attribute id of an element's contiguous run */
+let _nodeAttrStarts = new Int32Array(0);
+/** attribute count of an element's run */
+let _nodeAttrCounts = new Int32Array(0);
+// The single doctype node's public/system ids (a document inserts at most one
+// doctype node — later doctype tokens are ignored — so no column is needed).
+/** @type {string | null} */
+let _doctypePublicId = null;
+/** @type {string | null} */
+let _doctypeSystemId = null;
+
+const NS_MASK = 3;
+const FLAG_SELF_CLOSING = 4;
+
+/** @type {(el: HtmlNodeRef) => string} */
+const _tagNameOf = (el) => _nodeStrings[el];
+/** @type {(el: HtmlNodeRef) => number} */
+const _namespaceOf = (el) => _nodeFlags[el] & NS_MASK;
+
+// === Attribute columns ===
+// One attribute = one integer id into these columns; an element (and a
+// start-tag token) holds a contiguous run. The value string is derived from
+// the source by offset on read — `_attrValues` carries an override only for
+// valueless attributes (`""`) and offset-less adoption-agency clones — and the
+// html5lib serializer name is derived from the adjusted name plus one flag
+// bit, so per attribute only the interned name pointer is retained.
+let _attrCapacity = 0;
+let _attrCount = 0;
+let _attrNameStarts = new Int32Array(0);
+let _attrNameEnds = new Int32Array(0);
+let _attrValueStarts = new Int32Array(0);
+let _attrValueEnds = new Int32Array(0);
+/** bit 0: name has a `FOREIGN_ATTR_NS` serializer name (set on foreign adjust) */
+let _attrFlags = new Uint8Array(0);
+/** @type {string[]} lowercased (foreign-content: adjusted) attribute name */
+const _attrNames = [];
+/** @type {(string | null)[]} value override (null = slice the source by offset) */
+const _attrValues = [];
+/** source of the current parse, for by-offset attribute values */
+let _htmlSource = "";
+
+/** @param {number} need minimum capacity */
+const _growAttrColumns = (need) => {
+	let cap = _attrCapacity || 4096;
+	while (cap < need) cap *= 2;
+	const nameStart = new Int32Array(cap);
+	nameStart.set(_attrNameStarts);
+	_attrNameStarts = nameStart;
+	const nameEnd = new Int32Array(cap);
+	nameEnd.set(_attrNameEnds);
+	_attrNameEnds = nameEnd;
+	const valStart = new Int32Array(cap);
+	valStart.set(_attrValueStarts);
+	_attrValueStarts = valStart;
+	const valEnd = new Int32Array(cap);
+	valEnd.set(_attrValueEnds);
+	_attrValueEnds = valEnd;
+	const fl = new Uint8Array(cap);
+	fl.set(_attrFlags);
+	_attrFlags = fl;
+	_attrCapacity = cap;
+};
+
+/** @type {(name: string, value: string | null, nameStart: number, nameEnd: number, valueStart: number, valueEnd: number) => number} */
+const _allocAttr = (name, value, nameStart, nameEnd, valueStart, valueEnd) => {
+	const i = ++_attrCount;
+	if (i >= _attrCapacity) _growAttrColumns(i + 1);
+	_attrNameStarts[i] = nameStart;
+	_attrNameEnds[i] = nameEnd;
+	_attrValueStarts[i] = valueStart;
+	_attrValueEnds[i] = valueEnd;
+	_attrFlags[i] = 0;
+	// Ids are sequential, so these indexed writes append (arrays stay packed).
+	_attrNames[i] = name;
+	_attrValues[i] = value;
+	return i;
+};
+
+/** @type {(i: number) => string} */
+const _attrValueOf = (i) => {
+	const v = _attrValues[i];
+	return v !== null
+		? v
+		: _htmlSource.slice(_attrValueStarts[i], _attrValueEnds[i]);
+};
+
+// Linear name lookup in a run — attribute lists are short, a loop beats a Map.
+/** @type {(start: number, count: number, name: string) => number} */
+const _findAttr = (start, count, name) => {
+	for (let i = start; i < start + count; i++) {
+		if (_attrNames[i] === name) return i;
+	}
+	return 0;
+};
+
+/** @type {(i: number) => number} exact copy of an attribute into a new id */
+const _copyAttr = (i) => {
+	const c = _allocAttr(
+		_attrNames[i],
+		_attrValues[i],
+		_attrNameStarts[i],
+		_attrNameEnds[i],
+		_attrValueStarts[i],
+		_attrValueEnds[i]
+	);
+	_attrFlags[c] = _attrFlags[i];
+	return c;
+};
+
+// html5lib serializer name, derived: a `FOREIGN_ATTR_NS`-adjusted attribute is
+// flagged (its name is the table key), and a camelCase-adjusted name contains
+// an uppercase letter (unadjusted names are always lowercased), serializing as
+// itself. Everything else serializes as the plain name (undefined here).
+/** @type {(i: number) => string | undefined} */
+const _attrSerializedName = (i) => {
+	if ((_attrFlags[i] & 1) !== 0) return FOREIGN_ATTR_NS[_attrNames[i]];
+	const name = _attrNames[i];
+	return /[A-Z]/.test(name) ? name : undefined;
+};
+
+/** @param {number} need minimum capacity */
+const _growNodeColumns = (need) => {
+	let cap = _nodeCapacity || 4096;
+	while (cap < need) cap *= 2;
+	const ty = new Uint8Array(cap);
+	ty.set(_nodeTypes);
+	_nodeTypes = ty;
+	const fl = new Uint8Array(cap);
+	fl.set(_nodeFlags);
+	_nodeFlags = fl;
+	const st = new Int32Array(cap);
+	st.set(_nodeStarts);
+	_nodeStarts = st;
+	const en = new Int32Array(cap);
+	en.set(_nodeEnds);
+	_nodeEnds = en;
+	const tagEnd = new Int32Array(cap);
+	tagEnd.set(_nodeTagEnds);
+	_nodeTagEnds = tagEnd;
+	const nameEnd = new Int32Array(cap);
+	nameEnd.set(_nodeNameEnds);
+	_nodeNameEnds = nameEnd;
+	const cEnd = new Int32Array(cap);
+	cEnd.set(_nodeContentEnds);
+	_nodeContentEnds = cEnd;
+	const tc = new Int32Array(cap);
+	tc.set(_nodeTemplateContents);
+	_nodeTemplateContents = tc;
+	const parent = new Int32Array(cap);
+	parent.set(_nodeParents);
+	_nodeParents = parent;
+	const first = new Int32Array(cap);
+	first.set(_nodeFirstChildren);
+	_nodeFirstChildren = first;
+	const last = new Int32Array(cap);
+	last.set(_nodeLastChildren);
+	_nodeLastChildren = last;
+	const next = new Int32Array(cap);
+	next.set(_nodeNextSiblings);
+	_nodeNextSiblings = next;
+	const aStart = new Int32Array(cap);
+	aStart.set(_nodeAttrStarts);
+	_nodeAttrStarts = aStart;
+	const aCount = new Int32Array(cap);
+	aCount.set(_nodeAttrCounts);
+	_nodeAttrCounts = aCount;
+	_nodeCapacity = cap;
+};
+
+/** Start a new parse: invalidate all prior refs, release prior heap refs. */
+const _resetAstColumns = () => {
+	_nodeCount = 0;
+	_attrCount = 0;
+	_nodeStrings.length = 0;
+	_attrNames.length = 0;
+	_attrValues.length = 0;
+	// Keep id 0 ("no node" / "no attribute") occupied so writes stay packed.
+	_nodeStrings.push("");
+	_attrNames.push("");
+	_attrValues.push(null);
+	_doctypePublicId = null;
+	_doctypeSystemId = null;
+};
+
+// The typed-array columns grow to the largest document ever parsed; above this
+// capacity they are re-shrunk on release so one pathological file can't pin
+// tens of MB at module level for the process lifetime (~50 bytes/node,
+// ~17 bytes/attribute of capacity across the columns).
+const _COLUMN_SHRINK_CAPACITY = 65536;
+
+// Release the side arrays' heap references (strings, attribute names/values)
+// once a walk has consumed the tree, so the retained columns don't pin the
+// parsed source until the next parse.
+const _releaseAstColumns = () => {
+	_nodeCount = 0;
+	_attrCount = 0;
+	_nodeStrings.length = 0;
+	_attrNames.length = 0;
+	_attrValues.length = 0;
+	_htmlSource = "";
+	_doctypePublicId = null;
+	_doctypeSystemId = null;
+	if (_nodeCapacity > _COLUMN_SHRINK_CAPACITY) {
+		_nodeCapacity = 0;
+		_nodeTypes = new Uint8Array(0);
+		_nodeFlags = new Uint8Array(0);
+		_nodeStarts = new Int32Array(0);
+		_nodeEnds = new Int32Array(0);
+		_nodeTagEnds = new Int32Array(0);
+		_nodeNameEnds = new Int32Array(0);
+		_nodeContentEnds = new Int32Array(0);
+		_nodeTemplateContents = new Int32Array(0);
+		_nodeParents = new Int32Array(0);
+		_nodeFirstChildren = new Int32Array(0);
+		_nodeLastChildren = new Int32Array(0);
+		_nodeNextSiblings = new Int32Array(0);
+		_nodeAttrStarts = new Int32Array(0);
+		_nodeAttrCounts = new Int32Array(0);
+	}
+	if (_attrCapacity > _COLUMN_SHRINK_CAPACITY) {
+		_attrCapacity = 0;
+		_attrNameStarts = new Int32Array(0);
+		_attrNameEnds = new Int32Array(0);
+		_attrValueStarts = new Int32Array(0);
+		_attrValueEnds = new Int32Array(0);
+		_attrFlags = new Uint8Array(0);
+	}
+};
+
+/** @type {(type: number, start: number, end: number) => HtmlNodeRef} */
+const _allocNode = (type, start, end) => {
+	const i = ++_nodeCount;
+	if (i >= _nodeCapacity) _growNodeColumns(i + 1);
+	_nodeTypes[i] = type;
+	_nodeFlags[i] = 0;
+	_nodeStarts[i] = start;
+	_nodeEnds[i] = end;
+	_nodeTagEnds[i] = 0;
+	_nodeNameEnds[i] = 0;
+	_nodeContentEnds[i] = 0;
+	_nodeTemplateContents[i] = 0;
+	_nodeParents[i] = 0;
+	_nodeFirstChildren[i] = 0;
+	_nodeLastChildren[i] = 0;
+	_nodeNextSiblings[i] = 0;
+	_nodeAttrStarts[i] = 0;
+	_nodeAttrCounts[i] = 0;
+	// `_nodeStrings[i]` is written by every caller right after this returns
+	// (tag name / text / comment data; "" at the few string-less sites), as a
+	// packed sequential append — no placeholder double-write here.
+	return i;
+};
+
+// Raw child append — no text merging, no `<template>` content redirect (the
+// tree builder layers those on top). `node` must be detached (`next` = 0).
+/** @type {(parent: HtmlNodeRef, node: HtmlNodeRef) => void} */
+const _appendChild = (parent, node) => {
+	_nodeParents[node] = parent;
+	const last = _nodeLastChildren[parent];
+	if (last === 0) _nodeFirstChildren[parent] = node;
+	else _nodeNextSiblings[last] = node;
+	_nodeLastChildren[parent] = node;
+};
+
+/** @type {(data: string, start: number, end: number) => HtmlNodeRef} */
+const _makeTextNode = (data, start, end) => {
+	const i = _allocNode(NodeType.Text, start, end);
+	_nodeStrings[i] = data;
+	return i;
+};
+
+/** @type {(data: string, start: number, end: number) => HtmlNodeRef} */
+const _makeCommentNode = (data, start, end) => {
+	const i = _allocNode(NodeType.Comment, start, end);
+	_nodeStrings[i] = data;
+	return i;
+};
+
+// Marker entry in the active-formatting-elements list (never a valid ref).
+const AFE_MARKER = -1;
+
+// Clone of an element's attribute run: keep name/value (and the serializer
+// name flag) but drop source offsets so the consumer doesn't emit a duplicate
+// dependency for the reopened element's spans. Values are materialized since
+// the offsets are gone.
+const cloneAttrs = (/** @type {HtmlElement} */ el) => {
+	const start = _nodeAttrStarts[el];
+	const count = _nodeAttrCounts[el];
+	const newStart = _attrCount + 1;
+	for (let i = start; i < start + count; i++) {
+		const c = _allocAttr(_attrNames[i], _attrValueOf(i), -1, -1, -1, -1);
+		_attrFlags[c] = _attrFlags[i];
+	}
+	return { start: newStart, count };
+};
+
+// Merge a repeated `<html>`/`<body>` tag's attributes into the element: only
+// names not already present are added (in source order after the existing
+// ones). Runs are contiguous, so any addition re-allocates the whole run; the
+// old slots are orphaned (at most once per repeated tag, rare).
+const mergeAttrs = (
+	/** @type {HtmlElement} */ el,
+	/** @type {AttributeRun} */ run
+) => {
+	const start = _nodeAttrStarts[el];
+	const count = _nodeAttrCounts[el];
+	let extra = 0;
+	for (let i = run.start; i < run.start + run.count; i++) {
+		if (_findAttr(start, count, _attrNames[i]) === 0) extra++;
+	}
+	if (extra === 0) return;
+	const newStart = _attrCount + 1;
+	for (let i = start; i < start + count; i++) _copyAttr(i);
+	for (let i = run.start; i < run.start + run.count; i++) {
+		if (_findAttr(start, count, _attrNames[i]) === 0) _copyAttr(i);
+	}
+	_nodeAttrStarts[el] = newStart;
+	_nodeAttrCounts[el] = count + extra;
+};
+
+/**
+ * A materialized attribute as returned by `A.attributes` (tests/tooling) —
+ * the parser-facing representation is an id into the attribute columns, read
+ * through the scalar `A.attr*` accessors.
  * @typedef {object} HtmlAttribute
  * @property {string} name lowercased (and, in foreign content, adjusted) attribute name
  * @property {string} value
@@ -3790,60 +4495,27 @@ const NS_SVG = 2;
  */
 
 /**
- * @typedef {object} HtmlElement
- * @property {typeof NodeType.Element} type
- * @property {string} tagName
- * @property {number} namespace
- * @property {HtmlAttribute[]} attributes
- * @property {HtmlNode[]} children
- * @property {boolean} selfClosing
- * @property {number} start
- * @property {number} end
- * @property {number} tagEnd end offset of the opening tag (after `>`)
- * @property {number} nameEnd end offset of the tag name
- * @property {HtmlDocumentFragment=} templateContent `<template>` content fragment
- */
-
-/**
- * @typedef {object} HtmlText
- * @property {typeof NodeType.Text} type
- * @property {string} data
- * @property {number} start
- * @property {number} end
+ * A node reference into the struct-of-arrays AST: an integer id indexing the
+ * parallel `_h*` columns. Read fields through the exported accessor `A`. Refs
+ * are only valid until the next `parseHtml` call — the columns are reused
+ * across parses — so consume a tree fully before parsing again.
+ * @typedef {number} HtmlNodeRef
  */
 
-/**
- * @typedef {object} HtmlComment
- * @property {typeof NodeType.Comment} type
- * @property {string} data
- * @property {number} start
- * @property {number} end
- */
-
-/**
- * @typedef {object} HtmlDoctype
- * @property {typeof NodeType.Doctype} type
- * @property {string} name
- * @property {string | null} publicId
- * @property {string | null} systemId
- * @property {number} start
- * @property {number} end
- */
-
-/**
- * @typedef {object} HtmlDocument
- * @property {typeof NodeType.Document} type
- * @property {HtmlNode[]} children
- */
+/** @typedef {HtmlNodeRef} HtmlElement ref to an Element node */
+/** @typedef {HtmlNodeRef} HtmlText ref to a Text node */
+/** @typedef {HtmlNodeRef} HtmlComment ref to a Comment node */
+/** @typedef {HtmlNodeRef} HtmlDoctype ref to a Doctype node */
+/** @typedef {HtmlNodeRef} HtmlDocument ref to the Document node */
+/** @typedef {HtmlNodeRef} HtmlDocumentFragment ref to a DocumentFragment node */
+/** @typedef {HtmlNodeRef} HtmlNode */
 
 /**
- * @typedef {object} HtmlDocumentFragment
- * @property {typeof NodeType.DocumentFragment} type
- * @property {HtmlNode[]} children
+ * An attribute reference: an integer id into the attribute columns, read
+ * through the `A.attr*` accessors. Same validity contract as `HtmlNodeRef`.
+ * @typedef {number} HtmlAttributeRef
  */
 
-/** @typedef {HtmlElement | HtmlText | HtmlComment | HtmlDoctype} HtmlNode */
-
 /** @typedef {{ start: number, end: number, tagEnd: number, nameEnd: number }} TagPos */
 
 // Tree-construction token `type` discriminators. Numeric for the same reason
@@ -3859,7 +4531,7 @@ const TOKEN_EOF = 6;
 /** @typedef {{ type: typeof TOKEN_CHAR, data: string, start: number, end: number }} CharToken */
 /** @typedef {{ type: typeof TOKEN_COMMENT, data: string, start: number, end: number }} CommentToken */
 /** @typedef {{ type: typeof TOKEN_DOCTYPE, name: string, publicId: (string | null), systemId: (string | null), start: number, end: number }} DoctypeToken */
-/** @typedef {{ type: typeof TOKEN_START_TAG, name: string, attrs: HtmlAttribute[], selfClosing: boolean, pos: TagPos, swallowNewline?: boolean }} StartTagToken */
+/** @typedef {{ type: typeof TOKEN_START_TAG, name: string, attrs: AttributeRun, selfClosing: boolean, pos: TagPos, swallowNewline?: boolean }} StartTagToken */
 /** @typedef {{ type: typeof TOKEN_END_TAG, name: string, pos: TagPos }} EndTagToken */
 /** @typedef {{ type: typeof TOKEN_EOF }} EofToken */
 
@@ -3876,10 +4548,10 @@ const TOKEN_EOF = 6;
  * stale values that those handlers never read. Tokens that must outlive the
  * current callback (buffered table characters, synthesized re-dispatches) are
  * copied into fresh plain objects instead.
- * @typedef {{ type: number, name: string, data: string, attrs: HtmlAttribute[], selfClosing: boolean, start: number, end: number, publicId: (string | null), systemId: (string | null), swallowNewline: boolean, pos: TagPos }} MutableToken
+ * @typedef {{ type: number, name: string, data: string, attrs: AttributeRun, selfClosing: boolean, start: number, end: number, publicId: (string | null), systemId: (string | null), swallowNewline: boolean, pos: TagPos }} MutableToken
  */
 
-/** @typedef {{ parent: HtmlElement | HtmlDocument | HtmlDocumentFragment, beforeNode: (HtmlNode | null) }} InsertionPlace */
+/** @typedef {{ parent: HtmlNodeRef, beforeNode: HtmlNodeRef }} InsertionPlace `beforeNode` 0 = plain append */
 
 // Insertion modes (§13.2.4.1). Numeric for the same reason as the token and
 // `NodeType` enums: `runMode` dispatches on `mode` once per token.
@@ -4043,9 +4715,11 @@ const FORMATTING = new Set([
 const HEADING = new Set(["h1", "h2", "h3", "h4", "h5", "h6"]);
 
 const isSpecial = (/** @type {HtmlElement} */ el) => {
-	if (el.namespace === NS_HTML) return SPECIAL.has(el.tagName);
-	if (el.namespace === NS_MATHML) return MATHML_SPECIAL.has(el.tagName);
-	if (el.namespace === NS_SVG) return SVG_SPECIAL.has(el.tagName.toLowerCase());
+	const ns = _namespaceOf(el);
+	const tag = _tagNameOf(el);
+	if (ns === NS_HTML) return SPECIAL.has(tag);
+	if (ns === NS_MATHML) return MATHML_SPECIAL.has(tag);
+	if (ns === NS_SVG) return SVG_SPECIAL.has(tag.toLowerCase());
 	return false;
 };
 
@@ -4493,14 +5167,13 @@ const FOREIGN_BREAKOUT = new Set([
 ]);
 const FONT_BREAKOUT_ATTRS = new Set(["color", "face", "size"]);
 
-// Shared frozen empty attribute list for attributeless elements (the common
-// case). Only `<html>`/`<body>` ever receive merged attributes and are always
-// built with their own mutable array, so sharing this everywhere else is safe
-// and avoids an empty array per element. Frozen so an accidental mutation
-// throws instead of corrupting other elements.
-const EMPTY_ATTRS = /** @type {HtmlAttribute[]} */ (
-	/** @type {unknown} */ (Object.freeze([]))
-);
+// `<font color|face|size>` breaks out of foreign content (§13.2.6.5).
+const hasFontBreakoutAttr = (/** @type {AttributeRun} */ run) => {
+	for (let i = run.start; i < run.start + run.count; i++) {
+		if (FONT_BREAKOUT_ATTRS.has(_attrNames[i])) return true;
+	}
+	return false;
+};
 
 /**
  * Hash of the ASCII-lowercased `name` for the intern tables below; must stay
@@ -4518,33 +5191,58 @@ const hashLowerName = (name) => {
 	return h;
 };
 
+// Text-run scan classes for the `skip.text` fast path: 2 = stop the fast
+// path (& / NUL / CR), 1 = ASCII whitespace, 0 = ordinary text.
+const _TEXT_SCAN_CLASS = new Uint8Array(128);
+_TEXT_SCAN_CLASS[0x09] = 1;
+_TEXT_SCAN_CLASS[0x0a] = 1;
+_TEXT_SCAN_CLASS[0x0c] = 1;
+_TEXT_SCAN_CLASS[0x20] = 1;
+_TEXT_SCAN_CLASS[0x26] = 2;
+_TEXT_SCAN_CLASS[0x00] = 2;
+_TEXT_SCAN_CLASS[0x0d] = 2;
+
 /**
  * @param {Iterable<string>} names lowercase names to intern
- * @returns {Map<number, string | string[]>} hash → name(s)
+ * @returns {{ mask: number, hashes: Int32Array, values: (string | string[] | undefined)[] }} open-addressed intern table
  */
 const buildNameInternTable = (names) => {
-	/** @type {Map<number, string | string[]>} */
-	const table = new Map();
-	for (const name of names) {
+	// Open-addressed table (~25% load): the per-name probe is one or two array
+	// reads instead of a `Map#get`, and the tables are built once at startup.
+	const unique = [...new Set(names)];
+	let size = 8;
+	while (size < unique.length * 4) size <<= 1;
+	const mask = size - 1;
+	const hashes = new Int32Array(size);
+	/** @type {(string | string[] | undefined)[]} */
+	const values = Array.from({ length: size });
+	for (const name of unique) {
 		const h = hashLowerName(name);
-		const cur = table.get(h);
+		let slot = h & mask;
+		while (values[slot] !== undefined && hashes[slot] !== h) {
+			slot = (slot + 1) & mask;
+		}
+		const cur = values[slot];
 		if (cur === undefined) {
-			table.set(h, name);
+			hashes[slot] = h;
+			values[slot] = name;
 		} else if (typeof cur === "string") {
-			if (cur !== name) table.set(h, [cur, name]);
-		} else if (!cur.includes(name)) {
+			values[slot] = [cur, name];
+		} else {
 			cur.push(name);
 		}
 	}
-	return table;
+	return { mask, hashes, values };
 };
 
+/** @typedef {ReturnType<typeof buildNameInternTable>} NameInternTable */
+
 /**
  * The lowercased name for `input[start..end)`, returning the shared interned
  * string for known names — skipping the per-tag `slice().toLowerCase()`
  * allocation, and making the tree builder's many Set/Map lookups and `===`
  * comparisons on the name hit one string instance with a cached hash.
- * @param {Map<number, string | string[]>} table intern table
+ * @param {NameInternTable} table intern table
  * @param {string} input source text
  * @param {number} start name start
  * @param {number} end name end
@@ -4557,15 +5255,22 @@ const internLowerName = (table, input, start, end) => {
 		if (c >= 0x41 && c <= 0x5a) c += 0x20;
 		h = ((h << 5) - h + c) | 0;
 	}
-	const hit = table.get(h);
-	if (hit !== undefined) {
-		if (typeof hit === "string") {
-			if (rangeEqualsLower(input, start, end, hit)) return hit;
-		} else {
-			for (let i = 0; i < hit.length; i++) {
-				if (rangeEqualsLower(input, start, end, hit[i])) return hit[i];
+	const { mask, hashes, values } = table;
+	let slot = h & mask;
+	for (;;) {
+		const hit = values[slot];
+		if (hit === undefined) break;
+		if (hashes[slot] === h) {
+			if (typeof hit === "string") {
+				if (rangeEqualsLowerCase(input, start, end, hit)) return hit;
+			} else {
+				for (let i = 0; i < hit.length; i++) {
+					if (rangeEqualsLowerCase(input, start, end, hit[i])) return hit[i];
+				}
 			}
+			break;
 		}
+		slot = (slot + 1) & mask;
 	}
 	// Unknown name (custom element, data-* attribute, non-ASCII, …).
 	return input.slice(start, end).toLowerCase();
@@ -4604,50 +5309,96 @@ const ATTR_NAME_INTERN = buildNameInternTable(
 // Hoisted so the many `open.some(...)` "is there an open HTML <template>?"
 // checks reuse one predicate instead of allocating an arrow per call.
 const isHtmlTemplateEl = (/** @type {HtmlElement} */ e) =>
-	e.tagName === "template" && e.namespace === NS_HTML;
+	_tagNameOf(e) === "template" && _namespaceOf(e) === NS_HTML;
 
-// Linear attribute lookup by name — avoids the per-call arrow `Array#find`
-// would allocate (attribute lists are short, so a plain loop is faster too).
-const findAttr = (
-	/** @type {HtmlAttribute[]} */ attrs,
-	/** @type {string} */ name
-) => {
-	for (let i = 0; i < attrs.length; i++) {
-		if (attrs[i].name === name) return attrs[i];
-	}
-	return undefined;
-};
+// Raw text / escapable raw text elements (WHATWG §13.1.2) plus the other
+// RAWTEXT/RCDATA/PLAINTEXT-tokenized elements. Under `skip.text` their body's
+// end offset is recorded on the element (see `insertCharacters`) so a consumer
+// can read the raw content span without a `Text` node.
+const RAW_TEXT_ELEMENTS = new Set([
+	"script",
+	"style",
+	"textarea",
+	"title",
+	"xmp",
+	"iframe",
+	"noembed",
+	"noframes",
+	"noscript",
+	"plaintext"
+]);
+
+/**
+ * Shared empty skip set so the common (no-skip) call allocates nothing.
+ * @type {HtmlAstSkip}
+ */
+const EMPTY_SKIP = Object.freeze({});
+
+/**
+ * Optional node kinds a consumer can drop from the AST for speed/memory. Each
+ * is a pure output reduction — tree construction (and quirks detection) runs
+ * unchanged, so element structure and offsets are identical either way.
+ * @typedef {object} HtmlAstSkip
+ * @property {boolean=} text drop every `Text` node. Raw-text element bodies (`<script>`/`<style>`/…) aren't emitted either — their content span is recorded as the element's `contentEnd` (see `RAW_TEXT_ELEMENTS`) so a consumer can read `[tagEnd, contentEnd]` by offset. For consumers that read text by offset (e.g. `HtmlParser`), never the html5lib serializer.
+ * @property {boolean=} comments drop comment nodes entirely. Not for consumers that read comments (e.g. webpack magic comments).
+ * @property {boolean=} doctype drop the doctype node; quirks-mode detection is unaffected.
+ */
 
 /**
- * @param {string} source HTML source
- * @param {string=} fragmentContext context element name for fragment parsing (e.g. `td`, `svg path`); omit for a full document
- * @returns {HtmlDocument} document AST
+ * @typedef {object} HtmlParseOptions
+ * @property {string=} fragmentContext context element name for fragment parsing (e.g. `td`, `svg path`); omit for a full document
+ * @property {HtmlAstSkip=} skip node kinds to omit from the AST (see `HtmlAstSkip`); omit to build the full tree
  */
-const buildHtmlAst = (source, fragmentContext) => {
-	/** @type {HtmlDocument} */
-	const doc = { type: NodeType.Document, children: [] };
+
+/**
+ * @param {string} input HTML source
+ * @param {number=} pos start byte offset (string input only; default `0`)
+ * @param {HtmlParseOptions=} options parse options (fragment context, AST skips)
+ * @returns {HtmlDocument} ref to the document node — read through `A`; valid until the next parse
+ */
+const parseHtml = (input, pos = 0, options = {}) => {
+	const source = input;
+	const { fragmentContext, skip = EMPTY_SKIP } = options;
+	const skipText = skip.text === true;
+	const skipComments = skip.comments === true;
+	const skipDoctype = skip.doctype === true;
+	_resetAstColumns();
+	// Pre-size the columns from the input length: a document big enough to
+	// exceed `_COLUMN_SHRINK_CAPACITY` re-enters with released (empty) columns,
+	// and growing through the doubling cascade re-allocates and copies every
+	// column several times per parse. ~12 bytes/node and ~50 bytes/attribute
+	// are the densest realistic HTML, so `len/12` (`len/48`) reaches the final
+	// capacity in one allocation; a sparser document over-allocates bounded
+	// scratch that the post-walk release frees, and the doubling growth remains
+	// as the safety net when the estimate is short.
+	const _sizeEstimate = (input.length / 12) | 0;
+	if (_sizeEstimate > _nodeCapacity) _growNodeColumns(_sizeEstimate);
+	if (_sizeEstimate > _attrCapacity << 2) {
+		_growAttrColumns(_sizeEstimate >> 2);
+	}
+	_htmlSource = source;
+	const doc = _allocNode(NodeType.Document, 0, 0);
+	_nodeStrings[doc] = "";
 	let mode = MODE_INITIAL;
 	// Mode to return to after MODE_TEXT / MODE_IN_TABLE_TEXT (0 = unset).
 	let originalMode = 0;
 	/** @type {HtmlElement[]} stack of open elements (bottom .. top) */
 	const open = [];
-	/** @type {{ element?: HtmlElement, marker?: boolean }[]} active formatting elements */
+	/** @type {HtmlNodeRef[]} active formatting elements (AFE_MARKER = marker) */
 	const afe = [];
-	const afeEl = (/** @type {{ element?: HtmlElement }} */ e) =>
-		/** @type {HtmlElement} */ (e.element);
-	/** @type {HtmlElement | null} */
-	let head = null;
-	/** @type {HtmlElement | null} */
-	let form = null;
+	/** @type {HtmlElement} 0 = none */
+	let head = 0;
+	/** @type {HtmlElement} 0 = none */
+	let form = 0;
 	let framesetOk = true;
-	/** @type {HtmlAttribute[]} */
-	let pendingAttrs = [];
+	// First attribute id of the tag currently being tokenized (0 = none).
+	let pendAttrStart = 0;
 	let fosterParenting = false;
 	/** @type {number[]} */
 	const templateModes = [];
 	let quirks = false;
-	/** @type {HtmlElement | null} */
-	let fragment = null;
+	/** @type {HtmlElement} fragment context element (0 = document parse) */
+	let fragment = 0;
 	// End offset of the token currently being processed (for element `.end`).
 	let tokenEnd = 0;
 
@@ -4660,70 +5411,68 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const mkEl = (
 		/** @type {string} */ tagName,
 		/** @type {number} */ ns,
-		/** @type {HtmlAttribute[] | undefined} */ attributes,
+		/** @type {AttributeRun} */ attrs,
 		/** @type {TagPos | null | undefined} */ pos
-	) =>
-		/** @type {HtmlElement} */ ({
-			type: NodeType.Element,
-			tagName,
-			namespace: ns,
-			attributes: attributes || EMPTY_ATTRS,
-			children: [],
-			selfClosing: ns === NS_HTML && VOID.has(tagName),
-			start: pos ? pos.start : 0,
-			end: pos ? pos.end : 0,
-			tagEnd: pos ? pos.tagEnd : 0,
-			nameEnd: pos ? pos.nameEnd : 0,
-			// Present from creation (only `<template>` fills it) so every element
-			// keeps one monomorphic hidden class for the open-stack/scope loops.
-			templateContent: undefined
-		});
-
-	// Clone of a formatting element's attributes: keep name/value (and the
-	// serializer name) but drop source offsets so the consumer doesn't emit a
-	// duplicate dependency for the reopened element's spans.
-	const cloneAttrs = (/** @type {HtmlAttribute[]} */ attributes) =>
-		attributes.map((a) => ({
-			name: a.name,
-			value: a.value,
-			serializedName: a.serializedName,
-			nameStart: -1,
-			nameEnd: -1,
-			valueStart: -1,
-			valueEnd: -1
-		}));
+	) => {
+		const el = _allocNode(
+			NodeType.Element,
+			pos ? pos.start : 0,
+			pos ? pos.end : 0
+		);
+		// Void HTML elements are marked self-closing and never receive children.
+		_nodeFlags[el] =
+			ns === NS_HTML && VOID.has(tagName) ? ns | FLAG_SELF_CLOSING : ns;
+		_nodeStrings[el] = tagName;
+		_nodeAttrStarts[el] = attrs.start;
+		_nodeAttrCounts[el] = attrs.count;
+		if (pos) {
+			_nodeTagEnds[el] = pos.tagEnd;
+			_nodeNameEnds[el] = pos.nameEnd;
+			// End of a raw-text element's body under `skip.text` (defaults to the
+			// body start, i.e. empty); lets consumers read `<script>`/`<style>`
+			// content as [`tagEnd`, `contentEnd`] without a `Text` node.
+			_nodeContentEnds[el] = pos.tagEnd;
+		}
+		return el;
+	};
 
 	/**
-	 * @param {HtmlElement | HtmlDocument | HtmlDocumentFragment} parent container
-	 * @returns {HtmlNode[]} children array to insert into
+	 * A `<template>`'s children live in its content fragment; inserting into a
+	 * template really inserts there (the spec's "template contents" redirect).
+	 * @param {HtmlNodeRef} parent container
+	 * @returns {HtmlNodeRef} effective container to link children into
 	 */
-	const childrenOf = (parent) =>
-		parent.type === NodeType.Element && parent.templateContent
-			? parent.templateContent.children
-			: parent.children;
+	const effParent = (parent) => {
+		const tc = _nodeTemplateContents[parent];
+		return tc !== 0 ? tc : parent;
+	};
 
 	const appendTo = (
-		/** @type {HtmlElement | HtmlDocument | HtmlDocumentFragment} */ parent,
-		/** @type {HtmlNode} */ node
+		/** @type {HtmlNodeRef} */ parent,
+		/** @type {HtmlNodeRef} */ node
 	) => {
-		const arr = childrenOf(parent);
-		const last = arr[arr.length - 1];
-		if (node.type === NodeType.Text && last && last.type === NodeType.Text) {
-			last.data += node.data;
-			if (node.end !== undefined) last.end = node.end;
+		const p = effParent(parent);
+		const last = _nodeLastChildren[p];
+		if (
+			_nodeTypes[node] === NodeType.Text &&
+			last !== 0 &&
+			_nodeTypes[last] === NodeType.Text
+		) {
+			_nodeStrings[last] += _nodeStrings[node];
+			_nodeEnds[last] = _nodeEnds[node];
 			return;
 		}
-		arr.push(node);
+		_appendChild(p, node);
 	};
 
 	// Reused result of `appropriatePlace` — consumed synchronously by
 	// `insertAtPlace` and never retained, so one shared object avoids an
 	// allocation per inserted node.
 	/** @type {InsertionPlace} */
-	const sharedPlace = { parent: doc, beforeNode: null };
+	const sharedPlace = { parent: doc, beforeNode: 0 };
 	const placeAt = (
-		/** @type {HtmlElement | HtmlDocument | HtmlDocumentFragment} */ parent,
-		/** @type {HtmlNode | null} */ beforeNode
+		/** @type {HtmlNodeRef} */ parent,
+		/** @type {HtmlNodeRef} */ beforeNode
 	) => {
 		sharedPlace.parent = parent;
 		sharedPlace.beforeNode = beforeNode;
@@ -4735,23 +5484,23 @@ const buildHtmlAst = (source, fragmentContext) => {
 		const target = cur();
 		if (
 			fosterParenting &&
-			TABLE_CONTEXT.has(target.tagName) &&
-			target.namespace === NS_HTML
+			TABLE_CONTEXT.has(_tagNameOf(target)) &&
+			_namespaceOf(target) === NS_HTML
 		) {
 			// find last template / last table
 			let lastTemplate = -1;
 			let lastTable = -1;
 			for (let i = open.length - 1; i >= 0; i--) {
 				if (
-					open[i].tagName === "template" &&
-					open[i].namespace === NS_HTML &&
+					_tagNameOf(open[i]) === "template" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTemplate === -1
 				) {
 					lastTemplate = i;
 				}
 				if (
-					open[i].tagName === "table" &&
-					open[i].namespace === NS_HTML &&
+					_tagNameOf(open[i]) === "table" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTable === -1
 				) {
 					lastTable = i;
@@ -4761,53 +5510,52 @@ const buildHtmlAst = (source, fragmentContext) => {
 				lastTemplate !== -1 &&
 				(lastTable === -1 || lastTemplate > lastTable)
 			) {
-				return placeAt(open[lastTemplate], null);
+				return placeAt(open[lastTemplate], 0);
 			}
 			if (lastTable === -1) {
-				return placeAt(open[0], null);
+				return placeAt(open[0], 0);
 			}
 			const table = open[lastTable];
-			// find table's parent in tree
-			const tp = findParent(table);
-			if (tp) return placeAt(tp, table);
-			return placeAt(open[lastTable - 1], null);
+			const tp = _nodeParents[table];
+			if (tp !== 0) return placeAt(tp, table);
+			return placeAt(open[lastTable - 1], 0);
 		}
-		return placeAt(target, null);
-	};
-
-	const findParent = (/** @type {HtmlNode} */ node) => {
-		// search the whole document tree for the parent of node
-		/** @type {(HtmlElement | HtmlDocument | HtmlDocumentFragment)[]} */
-		const stack = [doc];
-		while (stack.length) {
-			const x =
-				/** @type {HtmlElement | HtmlDocument | HtmlDocumentFragment} */ (
-					stack.pop()
-				);
-			for (const k of childrenOf(x)) {
-				if (k === node) return x;
-				if (k.type === NodeType.Element) stack.push(k);
-			}
-		}
-		return null;
+		return placeAt(target, 0);
 	};
 
 	const insertAtPlace = (
 		/** @type {InsertionPlace} */ place,
-		/** @type {HtmlNode} */ node
+		/** @type {HtmlNodeRef} */ node
 	) => {
-		if (place.beforeNode) {
-			const arr = childrenOf(place.parent);
-			const idx = arr.indexOf(place.beforeNode);
+		const before = place.beforeNode;
+		if (before !== 0) {
+			const p = effParent(place.parent);
+			// Find `before`'s previous sibling (insert-before is a rare foster/
+			// adoption path, so the sibling scan stays off the hot path).
+			let prev = 0;
+			let c = _nodeFirstChildren[p];
+			while (c !== 0 && c !== before) {
+				prev = c;
+				c = _nodeNextSiblings[c];
+			}
+			if (c === 0) {
+				// `before` not under `parent` (not reachable from the spec paths).
+				appendTo(place.parent, node);
+				return;
+			}
 			if (
-				node.type === NodeType.Text &&
-				idx > 0 &&
-				arr[idx - 1].type === NodeType.Text
+				_nodeTypes[node] === NodeType.Text &&
+				prev !== 0 &&
+				_nodeTypes[prev] === NodeType.Text
 			) {
-				/** @type {HtmlText} */ (arr[idx - 1]).data += node.data;
+				// Before-node merge deliberately does not bump the sibling's `end`.
+				_nodeStrings[prev] += _nodeStrings[node];
 				return;
 			}
-			arr.splice(idx, 0, node);
+			_nodeParents[node] = p;
+			_nodeNextSiblings[node] = before;
+			if (prev === 0) _nodeFirstChildren[p] = node;
+			else _nodeNextSiblings[prev] = node;
 		} else {
 			appendTo(place.parent, node);
 		}
@@ -4819,28 +5567,58 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {number} */ end
 	) => {
 		const place = appropriatePlace();
-		if (place.parent.type === NodeType.Document) return; // never insert text into document
+		if (_nodeTypes[place.parent] === NodeType.Document) return; // never insert text into document
+		// `skip.text`: drop every `Text` node — construction already used the
+		// decoded token, so removing the node never affects element structure.
+		// For a raw-text element record the body end so a consumer reads the span
+		// [`tagEnd`, `contentEnd`] without a `Text` node (see `HtmlParser`).
+		// Namespace-agnostic: `HtmlParser` extracts `<script>`/`<style>` bodies in
+		// foreign content (e.g. SVG `<style>`) too.
+		if (skipText) {
+			const p = place.parent;
+			if (
+				_nodeTypes[p] === NodeType.Element &&
+				RAW_TEXT_ELEMENTS.has(_tagNameOf(p))
+			) {
+				_nodeContentEnds[p] = end;
+			}
+			return;
+		}
 		// Inlined text insert: when the run merges into the adjacent text sibling
 		// (common with inline formatting) only the string is appended — no
 		// throwaway text node is allocated. Mirrors `insertAtPlace`/`appendTo`,
 		// including that the before-node merge does not bump `end`.
-		const arr = childrenOf(place.parent);
-		if (place.beforeNode) {
-			const idx = arr.indexOf(place.beforeNode);
-			const prev = idx > 0 ? arr[idx - 1] : undefined;
-			if (prev && prev.type === NodeType.Text) {
-				prev.data += data;
+		const p = effParent(place.parent);
+		const before = place.beforeNode;
+		if (before !== 0) {
+			let prev = 0;
+			let c = _nodeFirstChildren[p];
+			while (c !== 0 && c !== before) {
+				prev = c;
+				c = _nodeNextSiblings[c];
+			}
+			if (c === 0) {
+				// `before` not under `parent` (not reachable from the spec paths).
+				_appendChild(p, _makeTextNode(data, start, end));
 				return;
 			}
-			arr.splice(idx, 0, { type: NodeType.Text, data, start, end });
+			if (prev !== 0 && _nodeTypes[prev] === NodeType.Text) {
+				_nodeStrings[prev] += data;
+				return;
+			}
+			const node = _makeTextNode(data, start, end);
+			_nodeParents[node] = p;
+			_nodeNextSiblings[node] = before;
+			if (prev === 0) _nodeFirstChildren[p] = node;
+			else _nodeNextSiblings[prev] = node;
 		} else {
-			const last = arr[arr.length - 1];
-			if (last && last.type === NodeType.Text) {
-				last.data += data;
-				last.end = end;
+			const last = _nodeLastChildren[p];
+			if (last !== 0 && _nodeTypes[last] === NodeType.Text) {
+				_nodeStrings[last] += data;
+				_nodeEnds[last] = end;
 				return;
 			}
-			arr.push({ type: NodeType.Text, data, start, end });
+			_appendChild(p, _makeTextNode(data, start, end));
 		}
 	};
 
@@ -4851,16 +5629,17 @@ const buildHtmlAst = (source, fragmentContext) => {
 	 * @param {InsertionPlace=} place explicit insertion place
 	 */
 	const insertComment = (data, start, end, place) => {
+		if (skipComments) return;
 		const p = place || appropriatePlace();
-		insertAtPlace(p, { type: NodeType.Comment, data, start, end });
+		insertAtPlace(p, _makeCommentNode(data, start, end));
 	};
 
 	const insertHtmlElement = (
 		/** @type {string} */ tagName,
-		/** @type {HtmlAttribute[]} */ attributes,
+		/** @type {AttributeRun} */ attrs,
 		/** @type {TagPos | null} */ pos
 	) => {
-		const el = mkEl(tagName, NS_HTML, attributes, pos);
+		const el = mkEl(tagName, NS_HTML, attrs, pos);
 		const place = appropriatePlace();
 		insertAtPlace(place, el);
 		open.push(el);
@@ -4870,10 +5649,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const insertForeignElement = (
 		/** @type {string} */ tagName,
 		/** @type {number} */ ns,
-		/** @type {HtmlAttribute[]} */ attributes,
+		/** @type {AttributeRun} */ attrs,
 		/** @type {TagPos | null} */ pos
 	) => {
-		const el = mkEl(tagName, ns, attributes, pos);
+		const el = mkEl(tagName, ns, attrs, pos);
 		const place = appropriatePlace();
 		insertAtPlace(place, el);
 		open.push(el);
@@ -4882,10 +5661,12 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	// ---- scopes ----
 	const isScopeBoundary = (/** @type {HtmlElement} */ el) => {
-		if (el.namespace === NS_HTML) return HTML_SCOPE.has(el.tagName);
-		if (el.namespace === NS_MATHML) return MATHML_SPECIAL.has(el.tagName);
-		if (el.namespace === NS_SVG) {
-			return SVG_SPECIAL.has(el.tagName.toLowerCase());
+		if (_namespaceOf(el) === NS_HTML) return HTML_SCOPE.has(_tagNameOf(el));
+		if (_namespaceOf(el) === NS_MATHML) {
+			return MATHML_SPECIAL.has(_tagNameOf(el));
+		}
+		if (_namespaceOf(el) === NS_SVG) {
+			return SVG_SPECIAL.has(_tagNameOf(el).toLowerCase());
 		}
 		return false;
 	};
@@ -4900,10 +5681,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {number} */ kind
 	) => {
 		if (isScopeBoundary(el)) return true;
-		if (el.namespace !== NS_HTML) return false;
-		if (kind === SCOPE_BUTTON) return el.tagName === "button";
+		if (_namespaceOf(el) !== NS_HTML) return false;
+		if (kind === SCOPE_BUTTON) return _tagNameOf(el) === "button";
 		if (kind === SCOPE_LIST_ITEM) {
-			return el.tagName === "ol" || el.tagName === "ul";
+			return _tagNameOf(el) === "ol" || _tagNameOf(el) === "ul";
 		}
 		return false;
 	};
@@ -4915,7 +5696,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 	) => {
 		for (let i = open.length - 1; i >= 0; i--) {
 			const el = open[i];
-			if (el.namespace === NS_HTML && el.tagName === tagName) return true;
+			if (_namespaceOf(el) === NS_HTML && _tagNameOf(el) === tagName) {
+				return true;
+			}
 			if (isBoundaryForKind(el, kind)) return false;
 		}
 		return false;
@@ -4939,9 +5722,11 @@ const buildHtmlAst = (source, fragmentContext) => {
 		const set = typeof target === "string" ? null : target;
 		for (let i = open.length - 1; i >= 0; i--) {
 			const el = open[i];
-			if (el.namespace === NS_HTML) {
-				if (set ? set.has(el.tagName) : el.tagName === target) return true;
-				if (TABLE_SCOPE_STOP.has(el.tagName)) return false;
+			if (_namespaceOf(el) === NS_HTML) {
+				if (set ? set.has(_tagNameOf(el)) : _tagNameOf(el) === target) {
+					return true;
+				}
+				if (TABLE_SCOPE_STOP.has(_tagNameOf(el))) return false;
 			}
 		}
 		return false;
@@ -4950,9 +5735,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 		while (open.length) {
 			const el = cur();
 			if (
-				el.namespace === NS_HTML &&
-				IMPLIED.has(el.tagName) &&
-				el.tagName !== except
+				_namespaceOf(el) === NS_HTML &&
+				IMPLIED.has(_tagNameOf(el)) &&
+				_tagNameOf(el) !== except
 			) {
 				open.pop();
 			} else {
@@ -4963,7 +5748,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const generateImpliedEndTagsThorough = () => {
 		while (open.length) {
 			const el = cur();
-			if (el.namespace === NS_HTML && IMPLIED_THOROUGH.has(el.tagName)) {
+			if (
+				_namespaceOf(el) === NS_HTML &&
+				IMPLIED_THOROUGH.has(_tagNameOf(el))
+			) {
 				open.pop();
 			} else {
 				break;
@@ -4976,11 +5764,11 @@ const buildHtmlAst = (source, fragmentContext) => {
 		let count = 0;
 		for (let i = afe.length - 1; i >= 0; i--) {
 			const e = afe[i];
-			if (e.marker) break;
+			if (e === AFE_MARKER) break;
 			if (
-				afeEl(e).tagName === el.tagName &&
-				afeEl(e).namespace === el.namespace &&
-				sameAttrs(afeEl(e), el)
+				_tagNameOf(e) === _tagNameOf(el) &&
+				_namespaceOf(e) === _namespaceOf(el) &&
+				sameAttrs(e, el)
 			) {
 				count++;
 				if (count === 3) {
@@ -4989,60 +5777,49 @@ const buildHtmlAst = (source, fragmentContext) => {
 				}
 			}
 		}
-		afe.push({ element: el });
+		afe.push(el);
 	};
 	const sameAttrs = (
 		/** @type {HtmlElement} */ a,
 		/** @type {HtmlElement} */ b
 	) => {
-		const aa = a.attributes;
-		const ba = b.attributes;
-		if (aa.length !== ba.length) return false;
+		const aStart = _nodeAttrStarts[a];
+		const aCount = _nodeAttrCounts[a];
+		const bStart = _nodeAttrStarts[b];
+		const bCount = _nodeAttrCounts[b];
+		if (aCount !== bCount) return false;
 		// Names are unique (deduped), counts tiny — a nested scan beats a Map
-		// here and allocates nothing on this formatting-element hot path.
-		for (let i = 0; i < ba.length; i++) {
-			const x = ba[i];
-			let ok = false;
-			for (let j = 0; j < aa.length; j++) {
-				if (aa[j].name === x.name) {
-					ok = aa[j].value === x.value;
-					break;
-				}
-			}
-			if (!ok) return false;
+		// here on this formatting-element hot path.
+		for (let i = bStart; i < bStart + bCount; i++) {
+			const j = _findAttr(aStart, aCount, _attrNames[i]);
+			if (j === 0 || _attrValueOf(j) !== _attrValueOf(i)) return false;
 		}
 		return true;
 	};
-	const insertMarker = () => afe.push({ marker: true });
+	const insertMarker = () => afe.push(AFE_MARKER);
 	const clearAfeToMarker = () => {
 		while (afe.length) {
-			const e = /** @type {{ marker?: boolean }} */ (afe.pop());
-			if (e.marker) break;
+			if (afe.pop() === AFE_MARKER) break;
 		}
 	};
 	const reconstructAfe = () => {
 		if (afe.length === 0) return;
 		let i = afe.length - 1;
-		if (afe[i].marker || open.includes(afeEl(afe[i]))) return;
+		if (afe[i] === AFE_MARKER || open.includes(afe[i])) return;
 		while (i > 0) {
 			i--;
-			if (afe[i].marker || open.includes(afeEl(afe[i]))) {
+			if (afe[i] === AFE_MARKER || open.includes(afe[i])) {
 				i++;
 				break;
 			}
 		}
 		for (; i < afe.length; i++) {
 			const e = afe[i];
-			const el = mkEl(
-				afeEl(e).tagName,
-				afeEl(e).namespace,
-				cloneAttrs(afeEl(e).attributes),
-				null
-			);
+			const el = mkEl(_tagNameOf(e), _namespaceOf(e), cloneAttrs(e), null);
 			const place = appropriatePlace();
 			insertAtPlace(place, el);
 			open.push(el);
-			afe[i] = { element: el };
+			afe[i] = el;
 		}
 	};
 
@@ -5052,23 +5829,23 @@ const buildHtmlAst = (source, fragmentContext) => {
 		// pop until a p has been popped
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			el.end = tokenEnd;
-			if (el.namespace === NS_HTML && el.tagName === "p") break;
+			_nodeEnds[el] = tokenEnd;
+			if (_namespaceOf(el) === NS_HTML && _tagNameOf(el) === "p") break;
 		}
 	};
 
 	const popUntil = (/** @type {string} */ tagName) => {
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			el.end = tokenEnd;
-			if (el.namespace === NS_HTML && el.tagName === tagName) break;
+			_nodeEnds[el] = tokenEnd;
+			if (_namespaceOf(el) === NS_HTML && _tagNameOf(el) === tagName) break;
 		}
 	};
 	const popUntilOneOf = (/** @type {Set<string>} */ set) => {
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			el.end = tokenEnd;
-			if (el.namespace === NS_HTML && set.has(el.tagName)) break;
+			_nodeEnds[el] = tokenEnd;
+			if (_namespaceOf(el) === NS_HTML && set.has(_tagNameOf(el))) break;
 		}
 	};
 
@@ -5081,8 +5858,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 				last = true;
 				if (fragment) node = fragment;
 			}
-			const tn = node.tagName;
-			if (node.namespace === NS_HTML) {
+			const tn = _tagNameOf(node);
+			if (_namespaceOf(node) === NS_HTML) {
 				if ((tn === "td" || tn === "th") && !last) {
 					mode = MODE_IN_CELL;
 					return;
@@ -5175,7 +5952,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		const useForeign =
 			open.length > 0 &&
 			ac &&
-			ac.namespace !== NS_HTML &&
+			_namespaceOf(ac) !== NS_HTML &&
 			ty !== TOKEN_EOF &&
 			shouldUseForeignRules(ac, t);
 		if (useForeign) {
@@ -5189,7 +5966,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {HtmlElement} */ ac,
 		/** @type {Token} */ t
 	) => {
-		if (ac.namespace === NS_HTML) return false;
+		if (_namespaceOf(ac) === NS_HTML) return false;
 		if (t.type === TOKEN_START_TAG) {
 			if (
 				mathmlTextIntegrationPoint(ac) &&
@@ -5199,8 +5976,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 				return false;
 			}
 			if (
-				ac.namespace === NS_MATHML &&
-				ac.tagName === "annotation-xml" &&
+				_namespaceOf(ac) === NS_MATHML &&
+				_tagNameOf(ac) === "annotation-xml" &&
 				t.name === "svg"
 			) {
 				return false;
@@ -5219,20 +5996,27 @@ const buildHtmlAst = (source, fragmentContext) => {
 	};
 
 	const mathmlTextIntegrationPoint = (/** @type {HtmlElement} */ el) =>
-		el.namespace === NS_MATHML && MATHML_TEXT_INTEGRATION.has(el.tagName);
+		_namespaceOf(el) === NS_MATHML &&
+		MATHML_TEXT_INTEGRATION.has(_tagNameOf(el));
 	const htmlIntegrationPoint = (/** @type {HtmlElement} */ el) => {
-		if (el.namespace === NS_MATHML && el.tagName === "annotation-xml") {
-			const enc = findAttr(el.attributes, "encoding");
-			if (
-				enc &&
-				(enc.value.toLowerCase() === "text/html" ||
-					enc.value.toLowerCase() === "application/xhtml+xml")
-			) {
-				return true;
+		if (_namespaceOf(el) === NS_MATHML && _tagNameOf(el) === "annotation-xml") {
+			const enc = _findAttr(
+				_nodeAttrStarts[el],
+				_nodeAttrCounts[el],
+				"encoding"
+			);
+			if (enc !== 0) {
+				const value = _attrValueOf(enc).toLowerCase();
+				if (value === "text/html" || value === "application/xhtml+xml") {
+					return true;
+				}
 			}
 			return false;
 		}
-		if (el.namespace === NS_SVG && SVG_SPECIAL.has(el.tagName.toLowerCase())) {
+		if (
+			_namespaceOf(el) === NS_SVG &&
+			SVG_SPECIAL.has(_tagNameOf(el).toLowerCase())
+		) {
 			return true;
 		}
 		return false;
@@ -5240,37 +6024,28 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	const adjustSvgTag = (/** @type {string} */ name) =>
 		/** @type {Record<string, string>} */ (SVG_TAG_ADJUST)[name] || name;
+	// Adjust a foreign start tag's attribute run in place (the run is consumed
+	// only by this tag's element): SVG camelCase names are rewritten, and
+	// namespaced names get the serializer-name flag (see `_attrSerializedName`).
 	const adjustForeignAttrs = (
-		/** @type {HtmlAttribute[]} */ attrs,
+		/** @type {AttributeRun} */ run,
 		/** @type {number} */ ns
 	) => {
-		// Reuse the original array/objects until an attribute actually needs
-		// adjusting; unchanged attributes keep serializedName === undefined and
-		// the serializer falls back to `name`. Avoids a new array + object per
-		// attribute on every foreign element.
-		let out = attrs;
-		for (let i = 0; i < attrs.length; i++) {
-			const a = attrs[i];
-			let name = a.name;
-			/** @type {string | undefined} */
-			let serializedName;
+		for (let i = run.start; i < run.start + run.count; i++) {
+			const name = _attrNames[i];
 			if (
 				ns === NS_SVG &&
 				/** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[name]
 			) {
-				name = /** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[name];
-				serializedName = name;
+				_attrNames[i] = /** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[
+					name
+				];
 			}
-			if (/** @type {Record<string, string>} */ (FOREIGN_ATTR_NS)[a.name]) {
-				serializedName = /** @type {Record<string, string>} */ (
-					FOREIGN_ATTR_NS
-				)[a.name];
+			if (/** @type {Record<string, string>} */ (FOREIGN_ATTR_NS)[name]) {
+				_attrFlags[i] |= 1;
 			}
-			if (name === a.name && serializedName === undefined) continue;
-			if (out === attrs) out = [...attrs];
-			out[i] = { ...a, name, serializedName };
 		}
-		return out;
+		return run;
 	};
 
 	const foreignContent = (/** @type {Token} */ t) => {
@@ -5287,17 +6062,16 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (t.type === TOKEN_DOCTYPE) return;
 		if (t.type === TOKEN_START_TAG) {
-			const acn = adjustedCurrent().namespace;
+			const acn = _namespaceOf(adjustedCurrent());
 			if (
 				FOREIGN_BREAKOUT.has(t.name) ||
-				(t.name === "font" &&
-					t.attrs.some((a) => FONT_BREAKOUT_ATTRS.has(a.name)))
+				(t.name === "font" && hasFontBreakoutAttr(t.attrs))
 			) {
 				// parse error; pop until integration point / html / mathml-text-integration
 				while (open.length > 1) {
 					const c = cur();
 					if (
-						c.namespace === NS_HTML ||
+						_namespaceOf(c) === NS_HTML ||
 						mathmlTextIntegrationPoint(c) ||
 						htmlIntegrationPoint(c)
 					) {
@@ -5327,8 +6101,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_END_TAG) {
 			if (
 				t.name === "script" &&
-				cur().tagName === "script" &&
-				cur().namespace === NS_SVG
+				_tagNameOf(cur()) === "script" &&
+				_namespaceOf(cur()) === NS_SVG
 			) {
 				open.pop();
 				return;
@@ -5338,7 +6112,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			if (t.name === "p" || t.name === "br") {
 				while (
 					open.length > 1 &&
-					cur().namespace !== NS_HTML &&
+					_namespaceOf(cur()) !== NS_HTML &&
 					!mathmlTextIntegrationPoint(cur()) &&
 					!htmlIntegrationPoint(cur())
 				) {
@@ -5350,21 +6124,21 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// any other end tag
 			let i = open.length - 1;
 			let node = open[i];
-			if (node.tagName.toLowerCase() !== t.name) {
+			if (_tagNameOf(node).toLowerCase() !== t.name) {
 				/* parse error */
 			}
 			while (i >= 0) {
 				node = open[i];
 				if (i === 0) return;
 				if (
-					node.namespace !== NS_HTML &&
-					node.tagName.toLowerCase() === t.name
+					_namespaceOf(node) !== NS_HTML &&
+					_tagNameOf(node).toLowerCase() === t.name
 				) {
 					while (open.length > i) open.pop();
 					return;
 				}
 				i--;
-				if (open[i] && open[i].namespace === NS_HTML) {
+				if (open[i] && _namespaceOf(open[i]) === NS_HTML) {
 					runMode(t);
 					return;
 				}
@@ -5380,9 +6154,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 		// step 1
 		const c = cur();
 		if (
-			c.namespace === NS_HTML &&
-			c.tagName === subject &&
-			!afe.some((e) => !e.marker && e.element === c)
+			_namespaceOf(c) === NS_HTML &&
+			_tagNameOf(c) === subject &&
+			!afe.includes(c)
 		) {
 			open.pop();
 			return true;
@@ -5393,17 +6167,17 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// find formatting element
 			let fmtIdx = -1;
 			for (let i = afe.length - 1; i >= 0; i--) {
-				if (afe[i].marker) break;
+				if (afe[i] === AFE_MARKER) break;
 				if (
-					afeEl(afe[i]).tagName === subject &&
-					afeEl(afe[i]).namespace === NS_HTML
+					_tagNameOf(afe[i]) === subject &&
+					_namespaceOf(afe[i]) === NS_HTML
 				) {
 					fmtIdx = i;
 					break;
 				}
 			}
 			if (fmtIdx === -1) return false; // act as any other end tag
-			const fmt = afeEl(afe[fmtIdx]);
+			const fmt = afe[fmtIdx];
 			const openIdx = open.indexOf(fmt);
 			if (openIdx === -1) {
 				afe.splice(fmtIdx, 1);
@@ -5435,10 +6209,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 				nodeIdx--;
 				node = open[nodeIdx];
 				if (node === fmt) break;
-				const nodeRef = node;
-				let nodeAfeIdx = afe.findIndex(
-					(e) => !e.marker && e.element === nodeRef
-				);
+				let nodeAfeIdx = afe.indexOf(node);
 				if (inner > 3 && nodeAfeIdx !== -1) {
 					afe.splice(nodeAfeIdx, 1);
 					if (nodeAfeIdx < bookmark) bookmark--;
@@ -5450,12 +6221,12 @@ const buildHtmlAst = (source, fragmentContext) => {
 				}
 				// create clone
 				const clone = mkEl(
-					node.tagName,
-					node.namespace,
-					cloneAttrs(node.attributes),
+					_tagNameOf(node),
+					_namespaceOf(node),
+					cloneAttrs(node),
 					null
 				);
-				afe[nodeAfeIdx] = { element: clone };
+				afe[nodeAfeIdx] = clone;
 				open[nodeIdx] = clone;
 				node = clone;
 				if (lastNode === furthest) bookmark = nodeAfeIdx + 1;
@@ -5470,22 +6241,31 @@ const buildHtmlAst = (source, fragmentContext) => {
 			insertAtPlace(place, lastNode);
 			// create element for fmt token, take children of furthest
 			const cloneFmt = mkEl(
-				fmt.tagName,
-				fmt.namespace,
-				cloneAttrs(fmt.attributes),
+				_tagNameOf(fmt),
+				_namespaceOf(fmt),
+				cloneAttrs(fmt),
 				null
 			);
-			const kids = [...furthest.children];
-			furthest.children.length = 0;
-			for (const k of kids) appendTo(cloneFmt, k);
+			// Take all direct children of `furthest` (a template's content fragment
+			// deliberately stays put — mirrors childrenOf-less spec behavior here).
+			let k = _nodeFirstChildren[furthest];
+			_nodeFirstChildren[furthest] = 0;
+			_nodeLastChildren[furthest] = 0;
+			while (k !== 0) {
+				const next = _nodeNextSiblings[k];
+				_nodeNextSiblings[k] = 0;
+				_nodeParents[k] = 0;
+				appendTo(cloneFmt, k);
+				k = next;
+			}
 			appendTo(furthest, cloneFmt);
 			// remove fmt from afe, insert clone at bookmark
-			const curFmtIdx = afe.findIndex((e) => !e.marker && e.element === fmt);
+			const curFmtIdx = afe.indexOf(fmt);
 			if (curFmtIdx !== -1) {
 				afe.splice(curFmtIdx, 1);
 				if (curFmtIdx < bookmark) bookmark--;
 			}
-			afe.splice(bookmark, 0, { element: cloneFmt });
+			afe.splice(bookmark, 0, cloneFmt);
 			// remove fmt from open, insert clone below furthest
 			const ofi = open.indexOf(fmt);
 			if (ofi !== -1) open.splice(ofi, 1);
@@ -5499,8 +6279,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		/** @type {HtmlElement} */ commonAncestor
 	) => {
 		if (
-			TABLE_CONTEXT.has(commonAncestor.tagName) &&
-			commonAncestor.namespace === NS_HTML
+			TABLE_CONTEXT.has(_tagNameOf(commonAncestor)) &&
+			_namespaceOf(commonAncestor) === NS_HTML
 		) {
 			// foster
 			// reuse appropriatePlace logic but rooted differently: emulate
@@ -5508,15 +6288,15 @@ const buildHtmlAst = (source, fragmentContext) => {
 			let lastTable = -1;
 			for (let i = open.length - 1; i >= 0; i--) {
 				if (
-					open[i].tagName === "template" &&
-					open[i].namespace === NS_HTML &&
+					_tagNameOf(open[i]) === "template" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTemplate === -1
 				) {
 					lastTemplate = i;
 				}
 				if (
-					open[i].tagName === "table" &&
-					open[i].namespace === NS_HTML &&
+					_tagNameOf(open[i]) === "table" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTable === -1
 				) {
 					lastTable = i;
@@ -5526,23 +6306,32 @@ const buildHtmlAst = (source, fragmentContext) => {
 				lastTemplate !== -1 &&
 				(lastTable === -1 || lastTemplate > lastTable)
 			) {
-				return { parent: open[lastTemplate], beforeNode: null };
+				return { parent: open[lastTemplate], beforeNode: 0 };
 			}
-			if (lastTable === -1) return { parent: open[0], beforeNode: null };
+			if (lastTable === -1) return { parent: open[0], beforeNode: 0 };
 			const table = open[lastTable];
-			const tp = findParent(table);
-			if (tp) return { parent: tp, beforeNode: table };
-			return { parent: open[lastTable - 1], beforeNode: null };
+			const tp = _nodeParents[table];
+			if (tp !== 0) return { parent: tp, beforeNode: table };
+			return { parent: open[lastTable - 1], beforeNode: 0 };
 		}
-		return { parent: commonAncestor, beforeNode: null };
+		return { parent: commonAncestor, beforeNode: 0 };
 	};
 
-	const detach = (/** @type {HtmlNode} */ node) => {
-		const p = findParent(node);
-		if (!p) return;
-		const arr = childrenOf(p);
-		const idx = arr.indexOf(node);
-		if (idx !== -1) arr.splice(idx, 1);
+	const detach = (/** @type {HtmlNodeRef} */ node) => {
+		const p = _nodeParents[node];
+		if (p === 0) return;
+		let prev = 0;
+		let c = _nodeFirstChildren[p];
+		while (c !== 0 && c !== node) {
+			prev = c;
+			c = _nodeNextSiblings[c];
+		}
+		if (c === 0) return;
+		if (prev === 0) _nodeFirstChildren[p] = _nodeNextSiblings[node];
+		else _nodeNextSiblings[prev] = _nodeNextSiblings[node];
+		if (_nodeLastChildren[p] === node) _nodeLastChildren[p] = prev;
+		_nodeNextSiblings[node] = 0;
+		_nodeParents[node] = 0;
 	};
 
 	// ---------- insertion modes ----------
@@ -5700,18 +6489,20 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_DOCTYPE) {
-			doc.children.push({
-				type: NodeType.Doctype,
-				name: t.name,
-				publicId: t.publicId,
-				systemId: t.systemId,
-				start: t.start,
-				end: t.end
-			});
+			// `skip.doctype` drops the node only; quirks detection below is unaffected.
+			if (!skipDoctype) {
+				const dt = _allocNode(NodeType.Doctype, t.start, t.end);
+				_nodeStrings[dt] = t.name;
+				// At most one doctype node is ever inserted (later doctype tokens
+				// are ignored), so its ids live in two per-parse scalars.
+				_doctypePublicId = t.publicId;
+				_doctypeSystemId = t.systemId;
+				_appendChild(doc, dt);
+			}
 			quirks = isQuirky(t.name, t.publicId, t.systemId);
 			mode = MODE_BEFORE_HTML;
 			return;
@@ -5724,7 +6515,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	modes.beforeHtml = (t) => {
 		if (t.type === TOKEN_DOCTYPE) return;
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_CHAR) {
@@ -5734,7 +6525,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (t.type === TOKEN_START_TAG && t.name === "html") {
 			const el = mkEl("html", NS_HTML, t.attrs, t.pos);
-			doc.children.push(el);
+			_appendChild(doc, el);
 			open.push(el);
 			mode = MODE_BEFORE_HEAD;
 			return;
@@ -5742,8 +6533,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_END_TAG && !HEAD_BODY_HTML_BR.has(t.name)) {
 			return;
 		}
-		const el = mkEl("html", NS_HTML, [], null);
-		doc.children.push(el);
+		const el = mkEl("html", NS_HTML, EMPTY_ATTRS, null);
+		_appendChild(doc, el);
 		open.push(el);
 		mode = MODE_BEFORE_HEAD;
 		process(t);
@@ -5819,7 +6610,11 @@ const buildHtmlAst = (source, fragmentContext) => {
 				mode = MODE_IN_TEMPLATE;
 				templateModes.push(MODE_IN_TEMPLATE);
 				const el = cur();
-				el.templateContent = { type: NodeType.DocumentFragment, children: [] };
+				const fragment = _allocNode(NodeType.DocumentFragment, 0, 0);
+				_nodeStrings[fragment] = "";
+				// Parent link so the iterative walk can ascend out of the content.
+				_nodeParents[fragment] = el;
+				_nodeTemplateContents[el] = fragment;
 				return;
 			}
 			if (t.name === "head") return;
@@ -5887,7 +6682,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_CHAR) {
 			const r = leadingWs(t, true);
 			if (!r) return;
-			insertHtmlElement("body", [], null);
+			insertHtmlElement("body", EMPTY_ATTRS, null);
 			mode = MODE_IN_BODY;
 			process(r);
 			return;
@@ -5924,7 +6719,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			if (t.name === "template") return modes.inHead(t);
 			if (!BODY_HTML_BR.has(t.name)) return;
 		}
-		insertHtmlElement("body", [], null);
+		insertHtmlElement("body", EMPTY_ATTRS, null);
 		mode = MODE_IN_BODY;
 		process(t);
 	};
@@ -5962,10 +6757,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const anyOtherEndTag = (/** @type {string} */ name) => {
 		for (let i = open.length - 1; i >= 0; i--) {
 			const node = open[i];
-			if (node.namespace === NS_HTML && node.tagName === name) {
+			if (_namespaceOf(node) === NS_HTML && _tagNameOf(node) === name) {
 				generateImpliedEndTags(name);
 				while (open.length > i) {
-					open[open.length - 1].end = tokenEnd;
+					_nodeEnds[open[open.length - 1]] = tokenEnd;
 					open.pop();
 				}
 				return;
@@ -5980,12 +6775,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			if (open.some(isHtmlTemplateEl)) {
 				return;
 			}
-			const htmlEl = open[0];
-			for (const a of t.attrs) {
-				if (!htmlEl.attributes.some((x) => x.name === a.name)) {
-					htmlEl.attributes.push(a);
-				}
-			}
+			mergeAttrs(open[0], t.attrs);
 			return;
 		}
 		if (HEAD_ELEMENTS.has(name)) {
@@ -5993,20 +6783,20 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (name === "body") {
 			const second = open[1];
-			if (!second || second.tagName !== "body" || open.some(isHtmlTemplateEl)) {
+			if (
+				!second ||
+				_tagNameOf(second) !== "body" ||
+				open.some(isHtmlTemplateEl)
+			) {
 				return;
 			}
 			framesetOk = false;
-			for (const a of t.attrs) {
-				if (!second.attributes.some((x) => x.name === a.name)) {
-					second.attributes.push(a);
-				}
-			}
+			mergeAttrs(second, t.attrs);
 			return;
 		}
 		if (name === "frameset") {
 			const second = open[1];
-			if (!second || second.tagName !== "body") return;
+			if (!second || _tagNameOf(second) !== "body") return;
 			if (!framesetOk) return;
 			detach(second);
 			while (open.length > 1) open.pop();
@@ -6021,7 +6811,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 		}
 		if (HEADING.has(name)) {
 			closeIfPInButtonScope();
-			if (cur().namespace === NS_HTML && HEADING.has(cur().tagName)) open.pop();
+			if (_namespaceOf(cur()) === NS_HTML && HEADING.has(_tagNameOf(cur()))) {
+				open.pop();
+			}
 			insertHtmlElement(name, t.attrs, t.pos);
 			return;
 		}
@@ -6047,14 +6839,17 @@ const buildHtmlAst = (source, fragmentContext) => {
 			framesetOk = false;
 			for (let i = open.length - 1; i >= 0; i--) {
 				const node = open[i];
-				if (node.namespace === NS_HTML && node.tagName === "li") {
+				if (_namespaceOf(node) === NS_HTML && _tagNameOf(node) === "li") {
 					generateImpliedEndTags("li");
 					popUntil("li");
 					break;
 				}
 				if (
 					isSpecial(node) &&
-					!(node.namespace === NS_HTML && ADDRESS_DIV_P.has(node.tagName))
+					!(
+						_namespaceOf(node) === NS_HTML &&
+						ADDRESS_DIV_P.has(_tagNameOf(node))
+					)
 				) {
 					break;
 				}
@@ -6068,16 +6863,19 @@ const buildHtmlAst = (source, fragmentContext) => {
 			for (let i = open.length - 1; i >= 0; i--) {
 				const node = open[i];
 				if (
-					node.namespace === NS_HTML &&
-					(node.tagName === "dd" || node.tagName === "dt")
+					_namespaceOf(node) === NS_HTML &&
+					(_tagNameOf(node) === "dd" || _tagNameOf(node) === "dt")
 				) {
-					generateImpliedEndTags(node.tagName);
-					popUntil(node.tagName);
+					generateImpliedEndTags(_tagNameOf(node));
+					popUntil(_tagNameOf(node));
 					break;
 				}
 				if (
 					isSpecial(node) &&
-					!(node.namespace === NS_HTML && ADDRESS_DIV_P.has(node.tagName))
+					!(
+						_namespaceOf(node) === NS_HTML &&
+						ADDRESS_DIV_P.has(_tagNameOf(node))
+					)
 				) {
 					break;
 				}
@@ -6104,14 +6902,14 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (name === "a") {
 			// if there's an <a> in afe after last marker
 			for (let i = afe.length - 1; i >= 0; i--) {
-				if (afe[i].marker) break;
-				if (afeEl(afe[i]).tagName === "a") {
+				if (afe[i] === AFE_MARKER) break;
+				if (_tagNameOf(afe[i]) === "a") {
 					adoptionAgency("a", t.pos);
 					const idx = afe.findIndex(
-						(e) => !e.marker && afeEl(e).tagName === "a"
+						(e) => e !== AFE_MARKER && _tagNameOf(e) === "a"
 					);
 					if (idx !== -1) {
-						const el = afeEl(afe[idx]);
+						const el = afe[idx];
 						afe.splice(idx, 1);
 						const oi = open.indexOf(el);
 						if (oi !== -1) open.splice(oi, 1);
@@ -6171,16 +6969,18 @@ const buildHtmlAst = (source, fragmentContext) => {
 				resetInsertionMode();
 			} else if (
 				fragment &&
-				fragment.namespace === NS_HTML &&
-				fragment.tagName === "select"
+				_namespaceOf(fragment) === NS_HTML &&
+				_tagNameOf(fragment) === "select"
 			) {
 				return;
 			}
 			reconstructAfe();
 			insertHtmlElement("input", t.attrs, t.pos);
 			open.pop();
-			const ty = findAttr(t.attrs, "type");
-			if (!ty || ty.value.toLowerCase() !== "hidden") framesetOk = false;
+			const ty = _findAttr(t.attrs.start, t.attrs.count, "type");
+			if (ty === 0 || _attrValueOf(ty).toLowerCase() !== "hidden") {
+				framesetOk = false;
+			}
 			return;
 		}
 		if (PARAM_SOURCE_TRACK.has(name)) {
@@ -6189,8 +6989,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (name === "hr") {
-			if (cur().namespace === NS_HTML && cur().tagName === "option") open.pop();
-			if (cur().namespace === NS_HTML && cur().tagName === "optgroup") {
+			if (_namespaceOf(cur()) === NS_HTML && _tagNameOf(cur()) === "option") {
+				open.pop();
+			}
+			if (_namespaceOf(cur()) === NS_HTML && _tagNameOf(cur()) === "optgroup") {
 				open.pop();
 			}
 			closeIfPInButtonScope();
@@ -6239,11 +7041,13 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (name === "optgroup" || name === "option") {
-			if (cur().namespace === NS_HTML && cur().tagName === "option") open.pop();
+			if (_namespaceOf(cur()) === NS_HTML && _tagNameOf(cur()) === "option") {
+				open.pop();
+			}
 			if (
 				name === "optgroup" &&
-				cur().namespace === NS_HTML &&
-				cur().tagName === "optgroup"
+				_namespaceOf(cur()) === NS_HTML &&
+				_tagNameOf(cur()) === "optgroup"
 			) {
 				open.pop();
 			}
@@ -6283,20 +7087,13 @@ const buildHtmlAst = (source, fragmentContext) => {
 		insertHtmlElement(name, t.attrs, t.pos);
 	};
 
-	const adjustMathmlAttrs = (/** @type {HtmlAttribute[]} */ attrs) => {
-		// Only `definitionurl` is rewritten; reuse the original array otherwise.
-		let out = attrs;
-		for (let i = 0; i < attrs.length; i++) {
-			if (attrs[i].name === "definitionurl") {
-				if (out === attrs) out = [...attrs];
-				out[i] = {
-					...attrs[i],
-					name: "definitionURL",
-					serializedName: "definitionURL"
-				};
-			}
+	// Only `definitionurl` is rewritten (in place — the run is consumed only by
+	// this tag's element); the camelCase name serializes as itself.
+	const adjustMathmlAttrs = (/** @type {AttributeRun} */ run) => {
+		for (let i = run.start; i < run.start + run.count; i++) {
+			if (_attrNames[i] === "definitionurl") _attrNames[i] = "definitionURL";
 		}
-		return out;
+		return run;
 	};
 
 	const endTagInBody = (/** @type {EndTagToken} */ t) => {
@@ -6323,7 +7120,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (name === "form") {
 			if (!open.some(isHtmlTemplateEl)) {
 				const node = form;
-				form = null;
+				form = 0;
 				if (!node || !inScopeEl(node)) return;
 				generateImpliedEndTags();
 				const idx = open.indexOf(node);
@@ -6420,7 +7217,10 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// current element: a non-matching name (e.g. a fragment context), or
 			// a name that ran straight to EOF with no delimiter (`</script` at
 			// EOF — the tokenizer still emits a partial tag there).
-			if (cur() && (t.name !== cur().tagName || t.pos.end === t.pos.nameEnd)) {
+			if (
+				cur() &&
+				(t.name !== _tagNameOf(cur()) || t.pos.end === t.pos.nameEnd)
+			) {
 				insertCharacters(
 					source.slice(t.pos.start, t.pos.end),
 					t.pos.start,
@@ -6428,7 +7228,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 				);
 				return;
 			}
-			open.pop();
+			// span the close tag, like every other explicit-close pop
+			_nodeEnds[/** @type {HtmlElement} */ (open.pop())] = tokenEnd;
 			mode = originalMode;
 		}
 	};
@@ -6440,7 +7241,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	modes.inTable = (t) => {
 		if (t.type === TOKEN_CHAR) {
 			const c = cur();
-			if (TABLE_CONTEXT.has(c.tagName) && c.namespace === NS_HTML) {
+			if (TABLE_CONTEXT.has(_tagNameOf(c)) && _namespaceOf(c) === NS_HTML) {
 				pendingTableChars = { list: [], hasNonWs: false };
 				originalMode = mode;
 				mode = MODE_IN_TABLE_TEXT;
@@ -6495,8 +7296,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 				return modes.inHead(t);
 			}
 			if (name === "input") {
-				const ty = findAttr(t.attrs, "type");
-				if (ty && ty.value.toLowerCase() === "hidden") {
+				const ty = _findAttr(t.attrs.start, t.attrs.count, "type");
+				if (ty !== 0 && _attrValueOf(ty).toLowerCase() === "hidden") {
 					insertHtmlElement("input", t.attrs, t.pos);
 					open.pop();
 					return;
@@ -6566,7 +7367,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const clearStackToTableContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (c.namespace === NS_HTML && CLEAR_TABLE.has(c.tagName)) {
+			if (_namespaceOf(c) === NS_HTML && CLEAR_TABLE.has(_tagNameOf(c))) {
 				break;
 			}
 			open.pop();
@@ -6575,7 +7376,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const clearStackToTableBodyContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (c.namespace === NS_HTML && CLEAR_TABLE_BODY.has(c.tagName)) {
+			if (_namespaceOf(c) === NS_HTML && CLEAR_TABLE_BODY.has(_tagNameOf(c))) {
 				break;
 			}
 			open.pop();
@@ -6584,7 +7385,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const clearStackToTableRowContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (c.namespace === NS_HTML && CLEAR_TABLE_ROW.has(c.tagName)) {
+			if (_namespaceOf(c) === NS_HTML && CLEAR_TABLE_ROW.has(_tagNameOf(c))) {
 				break;
 			}
 			open.pop();
@@ -6617,7 +7418,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_CHAR) {
 			const r = leadingWs(t, true);
 			if (!r) return;
-			if (cur().tagName !== "colgroup") return;
+			if (_tagNameOf(cur()) !== "colgroup") return;
 			open.pop();
 			mode = MODE_IN_TABLE;
 			process(r);
@@ -6635,7 +7436,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (t.type === TOKEN_END_TAG && t.name === "colgroup") {
-			if (cur().tagName !== "colgroup") return;
+			if (_tagNameOf(cur()) !== "colgroup") return;
 			open.pop();
 			mode = MODE_IN_TABLE;
 			return;
@@ -6648,7 +7449,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return modes.inHead(t);
 		}
 		if (t.type === TOKEN_EOF) return modes.inBody(t);
-		if (cur().tagName !== "colgroup") return;
+		if (_tagNameOf(cur()) !== "colgroup") return;
 		open.pop();
 		mode = MODE_IN_TABLE;
 		process(t);
@@ -6798,7 +7599,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		if (t.type === TOKEN_COMMENT) {
 			insertComment(t.data, t.start, t.end, {
 				parent: open[0],
-				beforeNode: null
+				beforeNode: 0
 			});
 			return;
 		}
@@ -6831,9 +7632,11 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return;
 		}
 		if (t.type === TOKEN_END_TAG && t.name === "frameset") {
-			if (cur().tagName === "html") return;
+			if (_tagNameOf(cur()) === "html") return;
 			open.pop();
-			if (!fragment && cur().tagName !== "frameset") mode = MODE_AFTER_FRAMESET;
+			if (!fragment && _tagNameOf(cur()) !== "frameset") {
+				mode = MODE_AFTER_FRAMESET;
+			}
 			return;
 		}
 		if (t.type === TOKEN_START_TAG && t.name === "frame") {
@@ -6869,7 +7672,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	modes.afterAfterBody = (t) => {
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_DOCTYPE) return modes.inBody(t);
@@ -6882,7 +7685,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 
 	modes.afterAfterFrameset = (t) => {
 		if (t.type === TOKEN_COMMENT) {
-			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: null });
+			insertComment(t.data, t.start, t.end, { parent: doc, beforeNode: 0 });
 			return;
 		}
 		if (t.type === TOKEN_DOCTYPE) return modes.inBody(t);
@@ -6904,9 +7707,9 @@ const buildHtmlAst = (source, fragmentContext) => {
 			ctxNs = NS_MATHML;
 			ctxName = ctxName.slice(5);
 		}
-		fragment = mkEl(ctxName, ctxNs, [], null);
-		const htmlEl = mkEl("html", NS_HTML, [], null);
-		doc.children.push(htmlEl);
+		fragment = mkEl(ctxName, ctxNs, EMPTY_ATTRS, null);
+		const htmlEl = mkEl("html", NS_HTML, EMPTY_ATTRS, null);
+		_appendChild(doc, htmlEl);
 		open.push(htmlEl);
 		if (ctxNs !== NS_HTML) {
 			mode = MODE_IN_BODY;
@@ -6932,7 +7735,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 	}
 
 	// ---------- tokenizer callbacks ----------
-	const decode = decodeHtmlEntities;
+	const decode = decodeEntities;
 
 	let swallowNextNewline = false;
 	// Set by the tokenizer when it hits EOF mid-tag; such a partial tag is
@@ -6949,7 +7752,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 		type: TOKEN_EOF,
 		name: "",
 		data: "",
-		attrs: [],
+		attrs: { start: 0, count: 0 },
 		selfClosing: false,
 		start: 0,
 		end: 0,
@@ -6961,12 +7764,12 @@ const buildHtmlAst = (source, fragmentContext) => {
 	const dispatch = () =>
 		process(/** @type {Token} */ (/** @type {unknown} */ (tok)));
 
-	walkHtmlTokens(source, 0, {
+	tokenize(source, pos, {
 		isForeign: () => {
 			const ac = adjustedCurrent();
-			return open.length > 0 && ac && ac.namespace !== NS_HTML;
+			return open.length > 0 && ac !== 0 && _namespaceOf(ac) !== NS_HTML;
 		},
-		fragmentContext: fragment ? fragment.tagName : undefined,
+		fragmentContext: fragment ? _tagNameOf(fragment) : undefined,
 		parseError: (input, code) => {
 			if (code === "eof-in-tag") eofInTag = true;
 		},
@@ -6988,7 +7791,7 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// The tokenizer emits CDATA sections through this callback too.
 			if (input.startsWith("<![CDATA[", start)) {
 				const ac = adjustedCurrent();
-				if (open.length > 0 && ac && ac.namespace !== NS_HTML) {
+				if (open.length > 0 && ac && _namespaceOf(ac) !== NS_HTML) {
 					const innerEnd = input.endsWith("]]>", end) ? end - 3 : end;
 					const data = input.slice(start + 9, innerEnd).replace(/\r\n?/g, "\n");
 					if (data !== "") {
@@ -7030,17 +7833,42 @@ const buildHtmlAst = (source, fragmentContext) => {
 			return end;
 		},
 		text: (input, start, end) => {
+			// `skip.text` fast path: node dropped, so only whitespace-ness matters.
+			// With no `&`/`\0`/`\r` (and no pending newline-swallow) the decoded value
+			// equals the raw range — dispatch a canonical marker (`" "`/`"x"`) without
+			// the slice + entity decode; anything trickier falls through.
+			if (skipText && !swallowNextNewline) {
+				let hasNonWs = false;
+				let i = start;
+				for (; i < end; i++) {
+					const c = input.charCodeAt(i);
+					// 2 = break (& / NUL / CR), 1 = whitespace, 0 = other.
+					const cls = c < 128 ? _TEXT_SCAN_CLASS[c] : 0;
+					if (cls === 2) break;
+					if (cls === 0) hasNonWs = true;
+				}
+				if (i === end) {
+					tok.type = TOKEN_CHAR;
+					tok.data = hasNonWs ? "x" : " ";
+					tok.start = start;
+					tok.end = end;
+					dispatch();
+					return end;
+				}
+			}
 			const raw = input.slice(start, end);
 			// CR normalization only when a CR is actually present (common case has none).
 			const s = !raw.includes("\r") ? raw : raw.replace(/\r\n?/g, "\n");
 			const top = adjustedCurrent();
 			const rawMode =
 				mode === MODE_TEXT ||
-				(top && top.namespace === NS_HTML && top.tagName === "plaintext");
+				(top &&
+					_namespaceOf(top) === NS_HTML &&
+					_tagNameOf(top) === "plaintext");
 			const noDecode =
 				top &&
-				top.namespace === NS_HTML &&
-				NO_DECODE_TEXT.has(top.tagName) &&
+				_namespaceOf(top) === NS_HTML &&
+				NO_DECODE_TEXT.has(_tagNameOf(top)) &&
 				(mode === MODE_TEXT || mode === MODE_IN_BODY);
 			let data = noDecode ? s : decode(s, false);
 			// In RAWTEXT/RCDATA/script/PLAINTEXT, NULL becomes U+FFFD (tokenizer
@@ -7061,32 +7889,29 @@ const buildHtmlAst = (source, fragmentContext) => {
 		},
 		attribute: (input, nameStart, nameEnd, valueStart, valueEnd, quoteType) => {
 			const name = internLowerName(ATTR_NAME_INTERN, input, nameStart, nameEnd);
-			// Raw (undecoded) value: consumers re-resolve requests from it and the
-			// offsets must stay aligned with the source. Entity decoding for the
-			// html5lib serializer happens there, not here.
-			const value = valueStart !== -1 ? input.slice(valueStart, valueEnd) : "";
+			if (pendAttrStart === 0) pendAttrStart = _attrCount + 1;
 			// Drop duplicate attribute names (per spec). Plain loop avoids a
 			// per-attribute closure allocation on this hot path.
 			let dup = false;
-			for (let i = 0; i < pendingAttrs.length; i++) {
-				if (pendingAttrs[i].name === name) {
+			for (let i = pendAttrStart; i <= _attrCount; i++) {
+				if (_attrNames[i] === name) {
 					dup = true;
 					break;
 				}
 			}
 			if (!dup) {
-				// Field order/shape matches `cloneAttrs` / `adjustForeignAttrs` output
-				// (serializedName present from creation) so all attribute objects
-				// share one hidden class.
-				pendingAttrs.push({
+				// The raw (undecoded) value is read from the source by offset on
+				// demand: consumers re-resolve requests from it and the offsets must
+				// stay aligned with the source. Only a valueless attribute stores an
+				// override ("").
+				_allocAttr(
 					name,
-					value,
-					serializedName: undefined,
+					valueStart !== -1 ? null : "",
 					nameStart,
 					nameEnd,
 					valueStart,
 					valueEnd
-				});
+				);
 			}
 			if (valueStart === -1) return nameEnd;
 			return quoteType !== QUOTE_NONE ? valueEnd + 1 : valueEnd;
@@ -7095,25 +7920,20 @@ const buildHtmlAst = (source, fragmentContext) => {
 			// A start tag the tokenizer only emitted because it hit EOF mid-tag
 			// is dropped, matching the spec's eof-in-tag handling.
 			if (eofInTag) {
-				if (pendingAttrs.length !== 0) pendingAttrs = [];
+				// Any attribute slots already allocated for it are orphaned.
+				pendAttrStart = 0;
 				return end;
 			}
 			const name = internLowerName(TAG_NAME_INTERN, input, nameStart, nameEnd);
 			if (name === "selectedcontent") sawSelectedContent = true;
-			// Attributeless elements share the frozen EMPTY_ATTRS (no allocation);
-			// the empty pendingAttrs buffer is reused for the next tag. `<html>`
-			// and `<body>` keep their own mutable array since later duplicate tags
-			// merge attributes into it.
-			let attrs;
-			if (pendingAttrs.length === 0 && name !== "html" && name !== "body") {
-				attrs = EMPTY_ATTRS;
-			} else {
-				attrs = pendingAttrs;
-				pendingAttrs = [];
-			}
 			tok.type = TOKEN_START_TAG;
 			tok.name = name;
-			tok.attrs = attrs;
+			// The reused token carries the tag's attribute run; every consumer of
+			// `t.attrs` runs synchronously within this dispatch.
+			tok.attrs.start = pendAttrStart;
+			tok.attrs.count =
+				pendAttrStart === 0 ? 0 : _attrCount + 1 - pendAttrStart;
+			pendAttrStart = 0;
 			tok.selfClosing = selfClosing;
 			tok.swallowNewline = false;
 			tok.pos.start = start;
@@ -7126,8 +7946,8 @@ const buildHtmlAst = (source, fragmentContext) => {
 		},
 		closeTag: (input, start, end, nameStart, nameEnd) => {
 			const name = internLowerName(TAG_NAME_INTERN, input, nameStart, nameEnd);
-			// End tags drop any parsed attributes; only reallocate if non-empty.
-			if (pendingAttrs.length !== 0) pendingAttrs = [];
+			// End tags drop any parsed attributes (the slots are orphaned).
+			pendAttrStart = 0;
 			tok.type = TOKEN_END_TAG;
 			tok.name = name;
 			tok.pos.start = start;
@@ -7141,63 +7961,73 @@ const buildHtmlAst = (source, fragmentContext) => {
 	tok.type = TOKEN_EOF;
 	dispatch();
 
-	if (sawSelectedContent) mirrorSelectedContent(doc, null);
+	if (sawSelectedContent) mirrorSelectedContent(doc, 0);
 
 	return doc;
 };
 
 /**
- * Deep-clone a node, dropping source offsets so cloned content does not
- * re-emit dependencies.
- * @param {HtmlNode} node node
- * @returns {HtmlNode} clone
+ * Deep-clone a node into fresh ids, dropping attribute source offsets and the
+ * raw-text body span so cloned content does not re-emit dependencies.
+ * @param {HtmlNodeRef} node node
+ * @returns {HtmlNodeRef} clone
  */
 const cloneSubtree = (node) => {
-	if (node.type !== NodeType.Element) return { ...node };
-	return {
-		type: NodeType.Element,
-		tagName: node.tagName,
-		namespace: node.namespace,
-		attributes: node.attributes.map((a) => ({
-			name: a.name,
-			value: a.value,
-			serializedName: a.serializedName,
-			nameStart: -1,
-			nameEnd: -1,
-			valueStart: -1,
-			valueEnd: -1
-		})),
-		children: node.children.map(cloneSubtree),
-		selfClosing: node.selfClosing,
-		start: node.start,
-		end: node.end,
-		tagEnd: node.tagEnd,
-		nameEnd: node.nameEnd
-	};
+	const ty = _nodeTypes[node];
+	const clone = _allocNode(ty, _nodeStarts[node], _nodeEnds[node]);
+	_nodeStrings[clone] = _nodeStrings[node];
+	if (ty !== NodeType.Element) return clone;
+	_nodeFlags[clone] = _nodeFlags[node];
+	const attrs = cloneAttrs(node);
+	_nodeAttrStarts[clone] = attrs.start;
+	_nodeAttrCounts[clone] = attrs.count;
+	_nodeTagEnds[clone] = _nodeTagEnds[node];
+	_nodeNameEnds[clone] = _nodeNameEnds[node];
+	// Empty body span: the clone re-emits no raw-text dependency.
+	_nodeContentEnds[clone] = _nodeTagEnds[node];
+	for (let k = _nodeFirstChildren[node]; k !== 0; k = _nodeNextSiblings[k]) {
+		_appendChild(clone, cloneSubtree(k));
+	}
+	// Clone `<template>` content into the clone's own fragment.
+	const tc = _nodeTemplateContents[node];
+	if (tc !== 0) {
+		const fragment = _allocNode(NodeType.DocumentFragment, 0, 0);
+		_nodeStrings[fragment] = "";
+		// Parent link so the iterative walk can ascend out of the content.
+		_nodeParents[fragment] = clone;
+		_nodeTemplateContents[clone] = fragment;
+		for (let k = _nodeFirstChildren[tc]; k !== 0; k = _nodeNextSiblings[k]) {
+			_appendChild(fragment, cloneSubtree(k));
+		}
+	}
+	return clone;
 };
 
 /**
  * The selected option of a select: the last `<option selected>`, else the
  * first option (scanning direct children and `<optgroup>` children).
  * @param {HtmlElement} select select element
- * @returns {HtmlElement | null} selected option
+ * @returns {HtmlElement} selected option (0 = none)
  */
 const selectedOption = (select) => {
 	/** @type {HtmlElement[]} */
 	const options = [];
 	/** @param {HtmlElement} el element */
 	const collect = (el) => {
-		for (const c of el.children) {
-			if (c.type !== NodeType.Element || c.namespace !== NS_HTML) continue;
-			if (c.tagName === "option") options.push(c);
-			else if (c.tagName === "optgroup") collect(c);
+		for (let c = _nodeFirstChildren[el]; c !== 0; c = _nodeNextSiblings[c]) {
+			if (_nodeTypes[c] !== NodeType.Element || _namespaceOf(c) !== NS_HTML) {
+				continue;
+			}
+			if (_nodeStrings[c] === "option") options.push(c);
+			else if (_nodeStrings[c] === "optgroup") collect(c);
 		}
 	};
 	collect(select);
-	if (options.length === 0) return null;
+	if (options.length === 0) return 0;
 	for (let i = options.length - 1; i >= 0; i--) {
-		if (options[i].attributes.some((a) => a.name === "selected")) {
-			return options[i];
+		const el = options[i];
+		if (_findAttr(_nodeAttrStarts[el], _nodeAttrCounts[el], "selected") !== 0) {
+			return el;
 		}
 	}
 	return options[0];
@@ -7206,25 +8036,39 @@ const selectedOption = (select) => {
 /**
  * Fill each `<selectedcontent>` with a clone of its `<select>`'s selected
  * option subtree (the customizable-select mirroring behavior).
- * @param {HtmlElement | HtmlDocument | HtmlDocumentFragment} node node
- * @param {HtmlElement | null} select nearest ancestor select
+ * @param {HtmlNodeRef} node node
+ * @param {HtmlElement} select nearest ancestor select (0 = none)
  */
 const mirrorSelectedContent = (node, select) => {
-	const children =
-		node.type === NodeType.Element && node.templateContent
-			? node.templateContent.children
-			: node.children;
-	for (const child of children) {
-		if (child.type !== NodeType.Element) continue;
-		if (child.namespace === NS_HTML && child.tagName === "select") {
+	// A `<template>`'s children live in its content fragment.
+	const tc = _nodeTemplateContents[node];
+	const container = tc !== 0 ? tc : node;
+	for (
+		let child = _nodeFirstChildren[container];
+		child !== 0;
+		child = _nodeNextSiblings[child]
+	) {
+		if (_nodeTypes[child] !== NodeType.Element) continue;
+		if (_namespaceOf(child) === NS_HTML && _nodeStrings[child] === "select") {
 			mirrorSelectedContent(child, child);
 		} else if (
-			select &&
-			child.namespace === NS_HTML &&
-			child.tagName === "selectedcontent"
+			select !== 0 &&
+			_namespaceOf(child) === NS_HTML &&
+			_nodeStrings[child] === "selectedcontent"
 		) {
 			const option = selectedOption(select);
-			if (option) child.children = option.children.map(cloneSubtree);
+			if (option !== 0) {
+				// Replace the children with clones of the option's subtree.
+				_nodeFirstChildren[child] = 0;
+				_nodeLastChildren[child] = 0;
+				for (
+					let k = _nodeFirstChildren[option];
+					k !== 0;
+					k = _nodeNextSiblings[k]
+				) {
+					_appendChild(child, cloneSubtree(k));
+				}
+			}
 		} else {
 			mirrorSelectedContent(child, select);
 		}
@@ -7257,37 +8101,20 @@ const parseDoctype = (/** @type {string} */ raw) => {
 	return { name, publicId, systemId };
 };
 
-/**
- * AST node `type` discriminators. Numeric for the same reason as the CSS
- * `NodeType`: compact integer `===` dispatch on the tree-construction and
- * visitor-walk hot paths. Members are literal-typed so `node.type ===
- * NodeType.X` still narrows the `HtmlNode` union.
- * @type {{ Document: 1, DocumentFragment: 2, Element: 3, Text: 4, Comment: 5, Doctype: 6 }}
- */
-const NodeType = {
-	Document: 1,
-	DocumentFragment: 2,
-	Element: 3,
-	Text: 4,
-	Comment: 5,
-	Doctype: 6
-};
-
 /** @typedef {HtmlNode | HtmlDocument | HtmlDocumentFragment} HtmlVisitableNode */
 
 // HTML-typed views over the generic visitor machinery (`util/SourceProcessor`).
 /**
- * @typedef {import("../util/SourceProcessor").VisitorContext} VisitorContext
- * @typedef {import("../util/SourceProcessor").VisitorFn<HtmlVisitableNode>} VisitorFn
- * @typedef {import("../util/SourceProcessor").VisitorBucket<HtmlVisitableNode>} VisitorBucket
- * @typedef {import("../util/SourceProcessor").VisitorMap<HtmlVisitableNode>} VisitorMap
- * @typedef {import("../util/SourceProcessor").CompiledVisitorMap<HtmlVisitableNode>} CompiledVisitorMap
+ * @typedef {import("../util/SourceProcessor").VisitorFn<HtmlPath>} VisitorFn
+ * @typedef {import("../util/SourceProcessor").VisitorBucket<HtmlPath>} VisitorBucket
+ * @typedef {import("../util/SourceProcessor").VisitorMap<HtmlPath>} VisitorMap
+ * @typedef {import("../util/SourceProcessor").CompiledVisitorMap<HtmlPath>} CompiledVisitorMap
  */
 
 /**
  * @typedef {object} HtmlProcessOptions
- * @property {string=} fragmentContext context element tag name for fragment parsing (see `buildHtmlAst`)
- * @property {(HtmlDocument | HtmlDocumentFragment)=} ast walk this pre-built AST instead of parsing the input
+ * @property {string=} fragmentContext context element tag name for fragment parsing (see `parseHtml`); the HTML analog of the CSS parser's `as` parse-mode option
+ * @property {HtmlAstSkip=} skip node kinds to omit from the AST for speed/memory (see `HtmlAstSkip`)
  */
 
 /**
@@ -7299,54 +8126,97 @@ const NodeType = {
  * @param {HtmlProcessOptions} options process options
  */
 const grammar = (input, visitors, options) => {
-	// Babel's `path.skip()`, children-only. Reset per `enter` dispatch.
-	let skipFlag = false;
-	const visitorCtx = {
-		skipChildren() {
-			skipFlag = true;
-		}
+	const root = parseHtml(input, 0, options);
+
+	// Iterative depth-first walk over the link columns: `firstChild`
+	// / `nextSibling` descend, the `parent` column ascends, so arbitrarily deep
+	// markup can't overflow the call stack (the old recursive walk died at
+	// ~10⁵ nesting). A `<template>`'s content fragment is visited before the
+	// element's children; ascending out of it continues with those children
+	// (the fragment is never in a sibling chain, `_nodeNextSiblings` = 0).
+	/**
+	 * Fire a node's `enter` visitors; true when the walk may descend.
+	 * @param {HtmlNodeRef} node node
+	 * @returns {boolean} false when a visitor called `skipChildren()`
+	 */
+	const enter = (node) => {
+		const b = visitors[_nodeTypes[node]];
+		if (b === undefined || b.enter.length === 0) return true;
+		_walkSkip = false;
+		_currentNode = node;
+		const p = _nodeParents[node];
+		_currentParent = p === 0 ? null : p;
+		const e = b.enter;
+		for (let i = 0; i < e.length; i++) e[i](A);
+		const skip = _walkSkip;
+		_walkSkip = false;
+		return !skip;
 	};
-
 	/**
-	 * Fetches the node's visitor bucket once (reused for enter + exit) and uses
-	 * index loops — `for…of` would allocate an iterator per node on this hot path.
-	 * @param {HtmlVisitableNode} node subtree root
-	 * @param {HtmlVisitableNode | null} parent enclosing node
+	 * Fire a node's `exit` visitors.
+	 * @param {HtmlNodeRef} node node
 	 */
-	const walk = (node, parent) => {
-		const b = visitors[node.type];
-		let skip = false;
-		if (b !== undefined && b.enter.length !== 0) {
-			skipFlag = false;
-			const e = b.enter;
-			for (let i = 0; i < e.length; i++) e[i](node, parent, visitorCtx);
-			skip = skipFlag;
-			skipFlag = false;
-		}
-		if (!skip) {
-			if (node.type === NodeType.Element) {
-				// `<template>` children live in a separate content fragment, not in
-				// `children` — walk it first so template content is not skipped.
-				const tc = node.templateContent;
-				if (tc !== undefined) walk(tc, node);
-				const c = node.children;
-				for (let i = 0; i < c.length; i++) walk(c[i], node);
-			} else if (
-				node.type === NodeType.Document ||
-				node.type === NodeType.DocumentFragment
-			) {
-				const c = node.children;
-				for (let i = 0; i < c.length; i++) walk(c[i], node);
-			}
-			// All other types are leaves.
+	const exit = (node) => {
+		const b = visitors[_nodeTypes[node]];
+		if (b === undefined) return;
+		_currentNode = node;
+		const p = _nodeParents[node];
+		_currentParent = p === 0 ? null : p;
+		const x = b.exit;
+		for (let i = 0; i < x.length; i++) x[i](A);
+	};
+	/**
+	 * First node to visit inside `node` (template content before children).
+	 * @param {HtmlNodeRef} node node
+	 * @returns {HtmlNodeRef} first inner node (0 = leaf)
+	 */
+	const firstInner = (node) => {
+		const ty = _nodeTypes[node];
+		if (ty === NodeType.Element) {
+			const tc = _nodeTemplateContents[node];
+			return tc !== 0 ? tc : _nodeFirstChildren[node];
 		}
-		if (b !== undefined) {
-			const x = b.exit;
-			for (let i = 0; i < x.length; i++) x[i](node, parent, visitorCtx);
+		if (ty === NodeType.Document || ty === NodeType.DocumentFragment) {
+			return _nodeFirstChildren[node];
 		}
+		return 0;
 	};
 
-	walk(options.ast || buildHtmlAst(input, options.fragmentContext), null);
+	let node = root;
+	descend: for (;;) {
+		if (enter(node)) {
+			const inner = firstInner(node);
+			if (inner !== 0) {
+				node = inner;
+				continue;
+			}
+		}
+		// Leaf (or skipped): exit and move sideways / upwards.
+		for (;;) {
+			exit(node);
+			if (node === root) break descend;
+			const parent = _nodeParents[node];
+			// Out of a template's content fragment: the element's children follow.
+			if (_nodeTemplateContents[parent] === node) {
+				const first = _nodeFirstChildren[parent];
+				if (first !== 0) {
+					node = first;
+					continue descend;
+				}
+			} else {
+				const sibling = _nodeNextSiblings[node];
+				if (sibling !== 0) {
+					node = sibling;
+					continue descend;
+				}
+			}
+			node = parent;
+		}
+	}
+
+	// The walk consumed the tree: release the side arrays' heap references so
+	// the reused columns don't pin this parse's strings until the next parse.
+	_releaseAstColumns();
 };
 
 /**
@@ -7354,14 +8224,16 @@ const grammar = (input, visitors, options) => {
  * `grammar`. Babel-style usage:
  *
  * ```
- * processor.use({ [NodeType.Element]: (el) => {}, [NodeType.Comment]: { enter, exit } });
- * processor.process(source);
+ * new SourceProcessor({ skip }).use({ [NodeType.Element]: (path) => {}, [NodeType.Comment]: { enter, exit } }).process(source);
  * ```
- * @extends {GenericSourceProcessor<HtmlVisitableNode, HtmlProcessOptions>}
+ * @extends {GenericSourceProcessor<HtmlPath, HtmlProcessOptions>}
  */
 class SourceProcessor extends GenericSourceProcessor {
-	constructor() {
-		super(grammar);
+	/**
+	 * @param {HtmlProcessOptions=} options default process options (`skip`, `fragmentContext`) merged under each `process` call's own options
+	 */
+	constructor(options) {
+		super(grammar, options);
 	}
 }
 
@@ -7377,12 +8249,14 @@ const SMALL_LETTER_W = "w".charCodeAt(0);
 const SMALL_LETTER_X = "x".charCodeAt(0);
 const SMALL_LETTER_H = "h".charCodeAt(0);
 // (Don't use \s, to avoid matching non-breaking space)
+// Sticky so `collectCharacters` matches at an offset without slicing the
+// whole remaining input per call (which made srcset parsing quadratic).
 // eslint-disable-next-line no-control-regex
-const LEADING_SPACES_REGEXP = /^[ \t\n\r\u000C]+/;
+const LEADING_SPACES_REGEXP = /[ \t\n\r\u000C]+/y;
 // eslint-disable-next-line no-control-regex
-const LEADING_COMMAS_OR_SPACES_REGEXP = /^[, \t\n\r\u000C]+/;
+const LEADING_COMMAS_OR_SPACES_REGEXP = /[, \t\n\r\u000C]+/y;
 // eslint-disable-next-line no-control-regex
-const LEADING_NOT_SPACES = /^[^ \t\n\r\u000C]+/;
+const LEADING_NOT_SPACES = /[^ \t\n\r\u000C]+/y;
 const TRAILING_COMMAS_REGEXP = /[,]+$/;
 const NON_NEGATIVE_INTEGER_REGEXP = /^\d+$/;
 // ( Positive or negative or unsigned integers or decimals, without or without exponents.
@@ -7405,8 +8279,8 @@ const parseSrcset = (input) => {
 	let url;
 	/** @type {string[]} */
 	let descriptors;
-	/** @type {string} */
-	let currentDescriptor;
+	/** @type {number} */
+	let descriptorStart;
 	/** @type {string} */
 	let state;
 	/** @type {number} */
@@ -7420,16 +8294,15 @@ const parseSrcset = (input) => {
 	const candidates = [];
 
 	/**
-	 * @param {RegExp} regExp reg exp to collect characters
+	 * @param {RegExp} regExp sticky reg exp to collect characters
 	 * @returns {string | undefined} characters
 	 */
 	function collectCharacters(regExp) {
-		/** @type {string} */
-		let chars;
-		const match = regExp.exec(input.slice(Math.max(0, position)));
+		regExp.lastIndex = Math.max(0, position);
+		const match = regExp.exec(input);
 
 		if (match) {
-			[chars] = match;
+			const [chars] = match;
 			position += chars.length;
 
 			return chars;
@@ -7555,12 +8428,13 @@ const parseSrcset = (input) => {
 	/**
 	 * @returns {void}
 	 */
-	function tokenize() {
+	function tokenizeDescriptor() {
 		// 8.1. Descriptor tokenizer: Skip whitespace
 		collectCharacters(LEADING_SPACES_REGEXP);
 
 		// 8.2. Let current descriptor be the empty string.
-		currentDescriptor = "";
+		// (Tracked as a start offset, `-1` = empty; sliced once per descriptor.)
+		descriptorStart = -1;
 
 		// 8.3. Let state be in descriptor.
 		state = "in descriptor";
@@ -7582,9 +8456,9 @@ const parseSrcset = (input) => {
 				// descriptors and let current descriptor be the empty string.
 				// Set state to after descriptor.
 				if (isSpace(charCode)) {
-					if (currentDescriptor) {
-						descriptors.push(currentDescriptor);
-						currentDescriptor = "";
+					if (descriptorStart !== -1) {
+						descriptors.push(input.slice(descriptorStart, position));
+						descriptorStart = -1;
 						state = "after descriptor";
 					}
 				}
@@ -7595,8 +8469,8 @@ const parseSrcset = (input) => {
 				else if (charCode === COMMA) {
 					position += 1;
 
-					if (currentDescriptor) {
-						descriptors.push(currentDescriptor);
+					if (descriptorStart !== -1) {
+						descriptors.push(input.slice(descriptorStart, position - 1));
 					}
 
 					parseDescriptors();
@@ -7606,15 +8480,15 @@ const parseSrcset = (input) => {
 				// U+0028 LEFT PARENTHESIS (()
 				// Append charCode to current descriptor. Set state to in parens.
 				else if (charCode === LEFT_PARENTHESIS) {
-					currentDescriptor += input.charAt(position);
+					if (descriptorStart === -1) descriptorStart = position;
 					state = "in parens";
 				}
 				// EOF
 				// If current descriptor is not empty, append current descriptor to
 				// descriptors. Jump to the step labeled descriptor parser.
 				else if (Number.isNaN(charCode)) {
-					if (currentDescriptor) {
-						descriptors.push(currentDescriptor);
+					if (descriptorStart !== -1) {
+						descriptors.push(input.slice(descriptorStart, position));
 					}
 
 					parseDescriptors();
@@ -7623,8 +8497,8 @@ const parseSrcset = (input) => {
 
 					// Anything else
 					// Append charCode to current descriptor.
-				} else {
-					currentDescriptor += input.charAt(position);
+				} else if (descriptorStart === -1) {
+					descriptorStart = position;
 				}
 			}
 			// In parens
@@ -7632,22 +8506,18 @@ const parseSrcset = (input) => {
 				// U+0029 RIGHT PARENTHESIS ())
 				// Append charCode to current descriptor. Set state to in descriptor.
 				if (charCode === RIGHT_PARENTHESIS) {
-					currentDescriptor += input.charAt(position);
 					state = "in descriptor";
 				}
 				// EOF
 				// Append current descriptor to descriptors. Jump to the step labeled
 				// descriptor parser.
 				else if (Number.isNaN(charCode)) {
-					descriptors.push(currentDescriptor);
+					descriptors.push(input.slice(descriptorStart, position));
 					parseDescriptors();
 					return;
 				}
 				// Anything else
-				// Append charCode to current descriptor.
-				else {
-					currentDescriptor += input.charAt(position);
-				}
+				// Append charCode to current descriptor. (Covered by the tracked range.)
 			}
 			// After descriptor
 			else if (state === "after descriptor") {
@@ -7712,13 +8582,419 @@ const parseSrcset = (input) => {
 		}
 		//	Otherwise, follow these sub steps:
 		else {
-			tokenize();
+			tokenizeDescriptor();
 		}
 
 		// 16. Return to the step labeled splitting loop.
 	}
 };
 
+// The spec's "URL-potentially-surrounded-by-spaces" cleanup: C0 controls,
+// DEL..C1 and U+00A0 are stripped from the value after the whitespace trim.
+// eslint-disable-next-line no-control-regex
+const IGNORE_CHARS_REGEXP = /[\u0000-\u001F\u007F-\u009F\u00A0]/g;
+
+/**
+ * Parse a `src`-like URL attribute value: trim ASCII whitespace / U+00A0 from
+ * both ends (offsets preserved for source rewriting), then strip ignorable
+ * control characters. Throws when nothing remains.
+ * @param {string} input attribute value
+ * @returns {ParsedSource[]} parsed src
+ */
+const parseSrc = (input) => {
+	const len = input.length;
+	if (len === 0) throw new Error("Must be non-empty");
+
+	let start = 0;
+	let end = len;
+
+	while (start < end) {
+		const code = input.charCodeAt(start);
+		if (code > 32 && code !== 160) break;
+		start++;
+	}
+
+	if (start === end) throw new Error("Must be non-empty");
+
+	while (end > start) {
+		const code = input.charCodeAt(end - 1);
+		if (code > 32 && code !== 160) break;
+		end--;
+	}
+
+	let value = input.slice(start, end);
+
+	if (IGNORE_CHARS_REGEXP.test(value)) {
+		value = value.replace(IGNORE_CHARS_REGEXP, "");
+		if (value.length === 0) throw new Error("Must be non-empty");
+	}
+
+	return [[value, start, end]];
+};
+
+/**
+ * Extracts the `icon-uri` value of an `msapplication-task` meta content
+ * (`name=…;action-uri=…;icon-uri=…`) — the other parts are page URLs, not assets.
+ * @param {string} input input
+ * @returns {ParsedSource[]} parsed icon-uri
+ */
+const parseMsapplicationTask = (input) => {
+	const len = input.length;
+	let pos = 0;
+	while (pos < len) {
+		let sep = input.indexOf(";", pos);
+		if (sep === -1) sep = len;
+		const eq = input.indexOf("=", pos);
+		if (eq !== -1 && eq < sep) {
+			const key = input.slice(pos, eq).trim().toLowerCase();
+			if (key === "icon-uri") {
+				let start = eq + 1;
+				let end = sep;
+				while (start < end && isSpace(input.charCodeAt(start))) {
+					start++;
+				}
+				while (end > start && isSpace(input.charCodeAt(end - 1))) {
+					end--;
+				}
+				if (start === end) return [];
+				return [[input.slice(start, end), start, end]];
+			}
+		}
+		pos = sep + 1;
+	}
+	return [];
+};
+
+// CSS syntax is loaded on first `parseCssUrls` call, not at module load —
+// `HtmlGenerator` deliberately defers it the same way, and most documents
+// never carry a URL-bearing SVG presentation attribute.
+/** @type {typeof import("../css/syntax") | undefined} */
+let _cssSyntax;
+
+/**
+ * Extracts `url(...)` references from a CSS value (an SVG presentation
+ * attribute). Reuses webpack's CSS lexer so quoting/escaping match the CSS
+ * spec; returns the `parseSrc` shape so the shared emit path maps and rewrites
+ * the spans. Unquoted `url(path)` rewrites the content span; quoted
+ * `url("path")` rewrites the inner string span (quotes preserved).
+ * @param {string} input attribute value (a CSS component-value list)
+ * @returns {ParsedSource[]} url references
+ */
+const parseCssUrls = (input) => {
+	const {
+		TT_EOF,
+		TT_FUNCTION,
+		TT_STRING,
+		TT_URL,
+		TT_WHITESPACE,
+		TokenStream,
+		equalsLowerCase
+	} = _cssSyntax || (_cssSyntax = require("../css/syntax"));
+	const ts = new TokenStream(input);
+	/** @type {ParsedSource[]} */
+	const result = [];
+	for (;;) {
+		const t = ts.consume();
+		if (t.type === TT_EOF) break;
+		if (t.type === TT_URL) {
+			if (t.contentEnd > t.contentStart) {
+				result.push([
+					input.slice(t.contentStart, t.contentEnd),
+					t.contentStart,
+					t.contentEnd
+				]);
+			}
+		} else if (
+			t.type === TT_FUNCTION &&
+			equalsLowerCase(input.slice(t.start, t.end - 1), "url")
+		) {
+			let s = ts.consume();
+			while (s.type === TT_WHITESPACE) s = ts.consume();
+			if (s.type === TT_STRING) {
+				const quote = input.charCodeAt(s.start);
+				const innerStart = s.start + 1;
+				// Drop the closing quote, unless the string is unterminated at EOF.
+				const innerEnd =
+					input.charCodeAt(s.end - 1) === quote ? s.end - 1 : s.end;
+				if (innerEnd > innerStart) {
+					result.push([
+						input.slice(innerStart, innerEnd),
+						innerStart,
+						innerEnd
+					]);
+				}
+			}
+		}
+	}
+	return result;
+};
+
+// Babel's `path.skip()`, children-only: set by `A.skipChildren()` during an
+// `enter` dispatch, consumed by the walk.
+let _walkSkip = false;
+// The walk's current position (`A.node` / `A.parent` read these; module-level
+// so the accessor methods' defaults avoid self-referential `this` typing).
+/** @type {HtmlNodeRef} */
+let _currentNode = 0;
+/** @type {HtmlNodeRef | null} */
+let _currentParent = null;
+
+/* eslint-disable jsdoc/require-template -- `A` below is the accessor const, not a type parameter */
+/**
+ * The HTML path (Babel's `path` shape): the AST accessor with the walk's
+ * current position on it — the single argument every visitor receives.
+ * @typedef {typeof A} HtmlPath
+ */
+/* eslint-enable jsdoc/require-template */
+
+// AST field-access seam (mirrors the CSS parser's `A`): every AST field a
+// consumer reads goes through one of these accessors, so the node
+// representation can change underneath without touching consumers. `n` is an
+// `HtmlNodeRef`; results are valid until the next `parseHtml` call.
+const A = {
+	// === path position (rebound by the walk before every visitor call) ===
+	/**
+	 * @returns {HtmlNodeRef} current node — only valid during a visitor callback
+	 */
+	get node() {
+		return _currentNode;
+	},
+	/**
+	 * @returns {HtmlNodeRef | null} enclosing node (null = the document root)
+	 */
+	get parent() {
+		return _currentParent;
+	},
+	/** Stop the walk descending into the current node (enter only). */
+	skipChildren() {
+		_walkSkip = true;
+	},
+	// === field reads — `n` defaults to the current node ===
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {number} `NodeType`
+	 */
+	type(n = _currentNode) {
+		return _nodeTypes[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {number} start offset
+	 */
+	start(n = _currentNode) {
+		return _nodeStarts[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {number} end offset
+	 */
+	end(n = _currentNode) {
+		return _nodeEnds[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {string} lowercased (foreign-content: adjusted) tag name
+	 */
+	tagName(n = _currentNode) {
+		return _nodeStrings[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} `NS_*` namespace
+	 */
+	namespace(n = _currentNode) {
+		return _nodeFlags[n] & NS_MASK;
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {boolean} true for void elements
+	 */
+	selfClosing(n = _currentNode) {
+		return (_nodeFlags[n] & FLAG_SELF_CLOSING) !== 0;
+	},
+	// materialized attribute list — test/tooling convenience, allocates; the
+	// parser reads attributes through the scalar accessors below
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlAttribute[]} materialized attributes
+	 */
+	attributes(n = _currentNode) {
+		const out = [];
+		const start = _nodeAttrStarts[n];
+		for (let i = start; i < start + _nodeAttrCounts[n]; i++) {
+			out.push({
+				name: _attrNames[i],
+				value: _attrValueOf(i),
+				serializedName: _attrSerializedName(i),
+				nameStart: _attrNameStarts[i],
+				nameEnd: _attrNameEnds[i],
+				valueStart: _attrValueStarts[i],
+				valueEnd: _attrValueEnds[i]
+			});
+		}
+		return out;
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} attribute count
+	 */
+	attributeCount(n = _currentNode) {
+		return _nodeAttrCounts[n];
+	},
+	/**
+	 * The i-th attribute of an element, as an id for the `attribute*` reads.
+	 * @param {number} i attribute index
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlAttributeRef} attribute ref
+	 */
+	attributeAt(i, n = _currentNode) {
+		return _nodeAttrStarts[n] + i;
+	},
+	/**
+	 * Linear lookup by (lowercased) name.
+	 * @param {string} name attribute name
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlAttributeRef} attribute ref (0 = not present)
+	 */
+	findAttribute(name, n = _currentNode) {
+		return _findAttr(_nodeAttrStarts[n], _nodeAttrCounts[n], name);
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {string} lowercased (foreign-content: adjusted) attribute name
+	 */
+	attributeName(a) {
+		return _attrNames[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {string} raw (undecoded) attribute value ("" when valueless)
+	 */
+	attributeValue(a) {
+		return _attrValueOf(a);
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} name start offset
+	 */
+	attributeNameStart(a) {
+		return _attrNameStarts[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} name end offset
+	 */
+	attributeNameEnd(a) {
+		return _attrNameEnds[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} value start offset (-1 when valueless or on adoption-agency clones)
+	 */
+	attributeValueStart(a) {
+		return _attrValueStarts[a];
+	},
+	/**
+	 * @param {HtmlAttributeRef} a attribute ref
+	 * @returns {number} value end offset
+	 */
+	attributeValueEnd(a) {
+		return _attrValueEnds[a];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} end offset of the opening tag (after `>`)
+	 */
+	tagEnd(n = _currentNode) {
+		return _nodeTagEnds[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} end offset of the tag name
+	 */
+	nameEnd(n = _currentNode) {
+		return _nodeNameEnds[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {number} under `skip.text`, end offset of a raw-text element's body (`tagEnd` when empty)
+	 */
+	contentEnd(n = _currentNode) {
+		return _nodeContentEnds[n];
+	},
+	/**
+	 * @param {HtmlElement=} n element
+	 * @returns {HtmlDocumentFragment} `<template>` content fragment (0 = none)
+	 */
+	templateContent(n = _currentNode) {
+		return _nodeTemplateContents[n];
+	},
+	/**
+	 * @param {HtmlText | HtmlComment=} n text / comment node
+	 * @returns {string} decoded text / comment data
+	 */
+	data(n = _currentNode) {
+		return _nodeStrings[n];
+	},
+	/**
+	 * @param {HtmlDoctype=} n doctype node
+	 * @returns {string} doctype name
+	 */
+	doctypeName(n = _currentNode) {
+		return _nodeStrings[n];
+	},
+	// The doctype ids are per-parse scalars (a document has at most one
+	// doctype node); the node parameter is accepted for call-shape uniformity.
+	/**
+	 * @param {HtmlDoctype=} _n doctype node
+	 * @returns {string | null} doctype public id
+	 */
+	doctypePublicId(_n) {
+		return _doctypePublicId;
+	},
+	/**
+	 * @param {HtmlDoctype=} _n doctype node
+	 * @returns {string | null} doctype system id
+	 */
+	doctypeSystemId(_n) {
+		return _doctypeSystemId;
+	},
+	// === tree links (0 = none) ===
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef} first child
+	 */
+	firstChild(n = _currentNode) {
+		return _nodeFirstChildren[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef} next sibling
+	 */
+	nextSibling(n = _currentNode) {
+		return _nodeNextSiblings[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef} parent node (a `<template>`'s content links to its fragment)
+	 */
+	parentOf(n = _currentNode) {
+		return _nodeParents[n];
+	},
+	/**
+	 * @param {HtmlNodeRef=} n node
+	 * @returns {HtmlNodeRef[]} materialized child list — test/tooling convenience, allocates
+	 */
+	children(n = _currentNode) {
+		const out = [];
+		for (let c = _nodeFirstChildren[n]; c !== 0; c = _nodeNextSiblings[c]) {
+			out.push(c);
+		}
+		return out;
+	}
+};
+
+module.exports.A = A;
 module.exports.NS_HTML = NS_HTML;
 module.exports.NS_MATHML = NS_MATHML;
 module.exports.NS_SVG = NS_SVG;
@@ -7726,13 +9002,19 @@ module.exports.NodeType = NodeType;
 module.exports.QUOTE_DOUBLE = QUOTE_DOUBLE;
 module.exports.QUOTE_NONE = QUOTE_NONE;
 module.exports.QUOTE_SINGLE = QUOTE_SINGLE;
-module.exports.SVG_TAG_ADJUST = SVG_TAG_ADJUST;
-module.exports.SourceProcessor = SourceProcessor;
 // Exposed so HtmlParser can map user-configured (lowercased) tag names to
 // the adjusted camelCase names the AST carries for foreign content.
-module.exports.buildHtmlAst = buildHtmlAst;
-module.exports.decodeHtmlEntities = decodeHtmlEntities;
-module.exports.decodeHtmlEntitiesWithMap = decodeHtmlEntitiesWithMap;
-module.exports.findAttr = findAttr;
+module.exports.SVG_TAG_ADJUST = SVG_TAG_ADJUST;
+module.exports.SourceProcessor = SourceProcessor;
+module.exports.decodeEntities = decodeEntities;
+module.exports.escapeAttribute = escapeAttribute;
+module.exports.escapeText = escapeText;
+// WHATWG "ASCII whitespace" (tab / LF / FF / CR / space) — the tokenizer's
+// whitespace class, exported under the spec's name.
+module.exports.isAsciiWhitespace = isSpace;
+module.exports.parseCssUrls = parseCssUrls;
+module.exports.parseHtml = parseHtml;
+module.exports.parseMsapplicationTask = parseMsapplicationTask;
+module.exports.parseSrc = parseSrc;
 module.exports.parseSrcset = parseSrcset;
-module.exports.walkHtmlTokens = walkHtmlTokens;
+module.exports.tokenize = tokenize;