webpack 5.108.4 → 5.109.0

package/lib/html/syntax.js

@@ -147,6 +147,7 @@ const CC_QUESTION_MARK = 0x3f;
 const CC_LEFT_SQUARE_BRACKET = 0x5b;
 const CC_RIGHT_SQUARE_BRACKET = 0x5d;
 const CC_GRAVE_ACCENT = 0x60;
+const CC_NO_BREAK_SPACE = 0xa0;
 
 const QUOTE_DOUBLE = 1;
 const QUOTE_SINGLE = 2;
@@ -317,7 +318,7 @@ const getContentModeForTag = (name) => {
  * @param {string} lit lowercase ASCII literal
  * @returns {boolean} true if the range equals `lit` ignoring ASCII case
  */
-const rangeEqualsLower = (input, start, end, lit) => {
+const rangeEqualsLowerCase = (input, start, end, lit) => {
 	if (end - start !== lit.length) return false;
 	for (let i = 0; i < lit.length; i++) {
 		let c = input.charCodeAt(start + i);
@@ -339,27 +340,37 @@ const rangeEqualsLower = (input, start, end, lit) => {
 const getContentModeForRange = (input, start, end) => {
 	switch (end - start) {
 		case 3:
-			if (rangeEqualsLower(input, start, end, "xmp")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "xmp")) return STATE_RAWTEXT;
 			return STATE_DATA;
 		case 5:
-			if (rangeEqualsLower(input, start, end, "title")) return STATE_RCDATA;
-			if (rangeEqualsLower(input, start, end, "style")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "title")) return STATE_RCDATA;
+			if (rangeEqualsLowerCase(input, start, end, "style")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 6:
-			if (rangeEqualsLower(input, start, end, "script")) {
+			if (rangeEqualsLowerCase(input, start, end, "script")) {
 				return STATE_SCRIPT_DATA;
 			}
-			if (rangeEqualsLower(input, start, end, "iframe")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "iframe")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 7:
-			if (rangeEqualsLower(input, start, end, "noembed")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "noembed")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 8:
-			if (rangeEqualsLower(input, start, end, "textarea")) return STATE_RCDATA;
-			if (rangeEqualsLower(input, start, end, "noframes")) return STATE_RAWTEXT;
+			if (rangeEqualsLowerCase(input, start, end, "textarea")) {
+				return STATE_RCDATA;
+			}
+			if (rangeEqualsLowerCase(input, start, end, "noframes")) {
+				return STATE_RAWTEXT;
+			}
 			return STATE_DATA;
 		case 9:
-			if (rangeEqualsLower(input, start, end, "plaintext")) {
+			if (rangeEqualsLowerCase(input, start, end, "plaintext")) {
 				return STATE_PLAINTEXT;
 			}
 			return STATE_DATA;
@@ -374,7 +385,7 @@ const getContentModeForRange = (input, start, end) => {
  * @param {HtmlTokenCallbacks} callbacks callbacks
  * @returns {number} final position
  */
-const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
+const tokenize = (input, pos = 0, callbacks = {}) => {
 	const len = input.length;
 	let state = STATE_DATA;
 	let returnState = STATE_DATA;
@@ -406,6 +417,18 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 	// Tracks whether the current tag has parsed any attributes — used to
 	// fire the `end-tag-with-attributes` parse error when an end tag emits.
 	let tagHasAttributes = false;
+	// Memoized next occurrence of `<` / `&` / NUL for the text-run
+	// fast-forwards: native `indexOf` beats a per-char JS loop, and `pos` only
+	// moves forward, so each memo is refreshed at most once per occurrence
+	// (`len` = no further occurrence).
+	let nextLt = -1;
+	let nextAmp = -1;
+	let nextNul = -1;
+	// Same memo scheme for the closing quote of quoted attribute values (long
+	// values: data: URIs, srcset, inline style). Memoized so a value with many
+	// `&` references doesn't re-run the quote scan per reference.
+	let nextDQuote = -1;
+	let nextSQuote = -1;
 
 	/**
 	 * Reports a tokenizer parse error to the consumer. The offset range and
@@ -429,7 +452,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 	 * the accumulated `charRefCode`, if any. Used both inline (when the
 	 * reference is terminated by a real next character) and at EOF (when the
 	 * reference runs to the end of input). The scanner only flags the error —
-	 * the spec's U+FFFD / Windows-1252 substitution is done by `decodeHtmlEntities`.
+	 * the spec's U+FFFD / Windows-1252 substitution is done by `decodeEntities`.
 	 * @param {number} endPos offset just past the reference
 	 */
 	const validateNumericReference = (endPos) => {
@@ -600,7 +623,7 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 		// All WHATWG tokenizer states handled. Deliberately omitted parse errors
 		// (need state this offset scanner lacks): duplicate-attribute,
 		// cdata-in-html-content, `*-in-input-stream`. Reference substitution is
-		// left to `decodeHtmlEntities`.
+		// left to `decodeEntities`.
 		switch (state) {
 			// https://html.spec.whatwg.org/multipage/parsing.html#data-state
 			case STATE_DATA:
@@ -625,15 +648,23 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					pos++;
 				} else {
 					// Fast-forward over the run of ordinary text without re-entering
-					// the per-state switch; stop on the next significant code point.
+					// the per-state switch — batches only the data state's "Anything
+					// else — emit the current input character" arc; the stops are
+					// exactly the code points with their own arcs (`<`, `&`, NUL).
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_LESS_THAN || c2 === CC_AMPERSAND || c2 === CC_NULL) {
-							break;
-						}
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
+					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
 					}
+					pos = Math.min(nextLt, nextAmp, nextNul);
 				}
 				break;
 
@@ -993,19 +1024,22 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over the ordinary run of the quoted value.
+					// Fast-forward over the ordinary run of the quoted value with the
+					// same memoized native-scan scheme as the data state.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (
-							c2 === CC_QUOTATION_MARK ||
-							c2 === CC_AMPERSAND ||
-							c2 === CC_NULL
-						) {
-							break;
-						}
-						pos++;
+					if (nextDQuote < pos) {
+						nextDQuote = input.indexOf('"', pos);
+						if (nextDQuote === -1) nextDQuote = len;
+					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
 					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
+					}
+					pos = Math.min(nextDQuote, nextAmp, nextNul);
 				}
 				break;
 
@@ -1029,15 +1063,22 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over the ordinary run of the quoted value.
+					// Fast-forward over the ordinary run of the quoted value with the
+					// same memoized native-scan scheme as the data state.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_APOSTROPHE || c2 === CC_AMPERSAND || c2 === CC_NULL) {
-							break;
-						}
-						pos++;
+					if (nextSQuote < pos) {
+						nextSQuote = input.indexOf("'", pos);
+						if (nextSQuote === -1) nextSQuote = len;
+					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
 					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
+					}
+					pos = Math.min(nextSQuote, nextAmp, nextNul);
 				}
 				break;
 
@@ -1416,7 +1457,14 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary bogus-comment text without re-entering the
+					// state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (c2 === CC_GREATER_THAN || c2 === CC_NULL) break;
+						pos++;
+					}
 				}
 				break;
 
@@ -2263,7 +2311,10 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				} else {
 					// Anything else
 					// Emit the current input character as a character token.
-					pos++;
+					// Fast-forward to the next `]` (the only code point with its own
+					// arc) in one native scan.
+					pos = input.indexOf("]", pos + 1);
+					if (pos === -1) pos = len;
 				}
 				break;
 
@@ -2332,15 +2383,23 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over ordinary RCDATA text.
+					// Fast-forward over ordinary RCDATA text (same memoized
+					// `indexOf` scheme as the data state) — batches only this
+					// state's "anything else" arc; `&` / `<` / NUL keep their own.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_AMPERSAND || c2 === CC_LESS_THAN || c2 === CC_NULL) {
-							break;
-						}
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
+					}
+					if (nextAmp < pos) {
+						nextAmp = input.indexOf("&", pos);
+						if (nextAmp === -1) nextAmp = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
 					}
+					pos = Math.min(nextLt, nextAmp, nextNul);
 				}
 				break;
 
@@ -2395,7 +2454,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2411,7 +2475,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2427,7 +2496,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -2467,13 +2541,19 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over ordinary RAWTEXT text.
+					// Fast-forward over ordinary RAWTEXT text (same memoized
+					// `indexOf` scheme as the data state) — batches only this
+					// state's "anything else" arc; `<` / NUL keep their own.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_LESS_THAN || c2 === CC_NULL) break;
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
+					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
 					}
+					pos = Math.min(nextLt, nextNul);
 				}
 				break;
 
@@ -2527,7 +2607,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2542,7 +2627,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2557,7 +2647,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -2596,13 +2691,19 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					reportError("unexpected-null-character", pos, pos + 1, "warning");
 					pos++;
 				} else {
-					// Fast-forward over ordinary script-data text.
+					// Fast-forward over ordinary script-data text (same memoized
+					// `indexOf` scheme as the data state) — batches only this
+					// state's "anything else" arc; `<` / NUL keep their own.
 					pos++;
-					while (pos < len) {
-						const c2 = input.charCodeAt(pos);
-						if (c2 === CC_LESS_THAN || c2 === CC_NULL) break;
-						pos++;
+					if (nextLt < pos) {
+						nextLt = input.indexOf("<", pos);
+						if (nextLt === -1) nextLt = len;
 					}
+					if (nextNul < pos) {
+						nextNul = input.indexOf("\0", pos);
+						if (nextNul === -1) nextNul = len;
+					}
+					pos = Math.min(nextLt, nextNul);
 				}
 				break;
 
@@ -2662,7 +2763,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2677,7 +2783,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2692,7 +2803,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -2770,7 +2886,20 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary escaped script text without re-entering
+					// the state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (
+							c2 === CC_HYPHEN_MINUS ||
+							c2 === CC_LESS_THAN ||
+							c2 === CC_NULL
+						) {
+							break;
+						}
+						pos++;
+					}
 				}
 				break;
 
@@ -2890,7 +3019,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 				if (isSpace(cc)) {
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_BEFORE_ATTRIBUTE_NAME;
@@ -2905,7 +3039,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_SELF_CLOSING_START_TAG;
@@ -2920,7 +3059,12 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					// per the "anything else" entry below.
 					tagNameEnd = pos;
 					if (
-						rangeEqualsLower(input, tagNameStart, tagNameEnd, lastOpenTagName)
+						rangeEqualsLowerCase(
+							input,
+							tagNameStart,
+							tagNameEnd,
+							lastOpenTagName
+						)
 					) {
 						flushText(tagStart);
 						state = STATE_DATA;
@@ -3002,7 +3146,20 @@ const walkHtmlTokens = (input, pos = 0, callbacks = {}) => {
 					if (cc === CC_NULL) {
 						reportError("unexpected-null-character", pos, pos + 1, "warning");
 					}
+					// Fast-forward ordinary double-escaped script text without re-entering
+					// the state switch; stop on the significant code points above.
 					pos++;
+					while (pos < len) {
+						const c2 = input.charCodeAt(pos);
+						if (
+							c2 === CC_HYPHEN_MINUS ||
+							c2 === CC_LESS_THAN ||
+							c2 === CC_NULL
+						) {
+							break;
+						}
+						pos++;
+					}
 				}
 				break;
 
@@ -3618,15 +3775,6 @@ const decodeNumericReference = (code) => {
 	return String.fromCodePoint(code);
 };
 
-// Match one of three forms (each with an optional trailing `;`):
-//   `&#x<hex>` - hex numeric reference (requires the `x`/`X`).
-//   `&#<dec>`  - decimal numeric reference (digits only).
-//   `&<name>`  - named reference (letter followed by alphanumerics).
-// The three alternatives are kept separate so a decimal reference like
-// `&#65b` doesn't greedily eat the trailing `b` as if it were hex.
-const CHARACTER_REFERENCE_REGEXP =
-	/&(?:#[xX][0-9a-fA-F]+|#[0-9]+|[a-zA-Z][a-zA-Z0-9]*);?/g;
-
 /**
  * Decode a single matched character reference.
  * @param {string} match the matched reference text
@@ -3634,45 +3782,34 @@ const CHARACTER_REFERENCE_REGEXP =
  * @param {boolean=} isAttribute true when the match came from an attribute value
  * @returns {string} decoded text, or `match` itself when it stays literal
  */
-const decodeOneReference = (match, nextCharCode, isAttribute) => {
-	// Numeric reference: &#65; or &#x41;
-	if (match.charCodeAt(1) === 0x23 /* # */) {
-		const lastChar = match.charAt(match.length - 1);
-		const isHex = match.charCodeAt(2) === 0x78 || match.charCodeAt(2) === 0x58;
-		const body = isHex
-			? lastChar === ";"
-				? match.slice(3, -1)
-				: match.slice(3)
-			: lastChar === ";"
-				? match.slice(2, -1)
-				: match.slice(2);
-		// The regex above guarantees at least one digit in `body`,
-		// so `parseInt` always returns a finite number here.
-		return decodeNumericReference(Number.parseInt(body, isHex ? 16 : 10));
-	}
-
-	// Named reference. Try the full captured name first, then
-	// progressively shorter prefixes - this handles direct matches
-	// like `&amp;` as well as WHATWG longest-prefix semantics where
-	// e.g. `&notpre;` decodes as `&not` (a legacy bare entity)
-	// followed by `pre;` as literal text.
-	const name = match.slice(1);
+/**
+ * Decode a named character reference spanning `[start, end)` of `str` (the
+ * `&` at `start`, the optional `;` included). Slices the name once; WHATWG
+ * longest-prefix and consumed-as-part-of-an-attribute semantics as before.
+ * @param {string} str the raw string
+ * @param {number} start offset of the reference's `&`
+ * @param {number} end offset just past the reference (past the `;` if present)
+ * @param {number} nextCharCode char code following the reference (NaN at the end)
+ * @param {boolean=} isAttribute true when the reference came from an attribute value
+ * @returns {string | undefined} decoded text, or `undefined` when it stays literal
+ */
+const decodeNamedReference = (str, start, end, nextCharCode, isAttribute) => {
+	// Mirrors the old `match.slice(1)`: the name keeps its trailing `;`.
+	const name = str.slice(start + 1, end);
 	const matchEndsWithSemi = name.charCodeAt(name.length - 1) === 0x3b;
 
 	// Attribute-context guard: if the entity match didn't end with `;`
 	// and the next character in the source is `=` or ASCII
 	// alphanumeric, the WHATWG spec says to flush the literal text
-	// rather than decode. The greedy regex already absorbed any
+	// rather than decode. The greedy scan already absorbed any
 	// trailing alphanumerics, so the only candidate "next char" here
 	// is `=` (or any non-alphanumeric).
 	if (isAttribute && !matchEndsWithSemi && nextCharCode === 0x3d /* = */) {
-		return match;
+		return undefined;
 	}
 
-	// Fast path: the regex usually captures exactly one entity (`&amp;`,
-	// `&lt;`, `&nbsp;`, …), so the whole `name` is the match — avoid the
-	// full-length `name.slice(0, name.length)` the loop's first iteration
-	// would allocate. No leftover, so the attribute guard never applies.
+	// Fast path: the scan usually captures exactly one entity (`&amp;`,
+	// `&lt;`, `&nbsp;`, ...), so the whole `name` is the match.
 	if (name.length <= MAX_ENTITY_NAME_LEN) {
 		const full = HTML_ENTITIES[name];
 		if (full !== undefined) return full;
@@ -3691,31 +3828,20 @@ const decodeOneReference = (match, nextCharCode, isAttribute) => {
 			// Attribute-context longest-prefix guard: if the matched
 			// prefix doesn't end with `;` and the leftover starts with
 			// an alphanumeric character, leave literal per WHATWG.
-			// (The regex greedy-consumes alphanumerics, so any leftover
-			// within `name` is itself alphanumeric — we only need to
-			// check non-empty leftover here; the `=` case is handled
-			// above against the source character after the match.)
 			if (
 				isAttribute &&
 				i < name.length &&
 				prefix.charCodeAt(prefix.length - 1) !== 0x3b
 			) {
-				return match;
+				return undefined;
 			}
 			return HTML_ENTITIES[prefix] + name.slice(i);
 		}
 	}
-	return match;
+	return undefined;
 };
 
-// Hoisted `replace` callbacks (one per `isAttribute` mode) — no closure
-// per decode call, and the callback stays monomorphic.
-/** @type {(match: string, offset: number, source: string) => string} */
-const _decodeReferenceInText = (match, offset, source) =>
-	decodeOneReference(match, source.charCodeAt(offset + match.length), false);
-/** @type {(match: string, offset: number, source: string) => string} */
-const _decodeReferenceInAttribute = (match, offset, source) =>
-	decodeOneReference(match, source.charCodeAt(offset + match.length), true);
+/** @typedef {{ text: string, map: number[] | undefined }} DecodedEntitiesWithMap */
 
 /**
  * Decode HTML character references in a string. Handles all numeric
@@ -3728,67 +3854,246 @@ const _decodeReferenceInAttribute = (match, offset, source) =>
  * trailing `;` whose next character is `=` or ASCII alphanumeric is left
  * undecoded, so e.g. `&amp=foo` stays literal in an attribute value but
  * decodes to `&=foo` in text.
+ *
+ * With `withMap` the result also carries a boundary map from the decoded
+ * string back to raw offsets, so spans computed on the decoded text (e.g.
+ * srcset candidate URLs) can be translated to source ranges. `map[i]` is the
+ * raw offset of decoded boundary `i` (`0..text.length`); boundaries inside a
+ * reference's decoded text map to the reference start. `map` is `undefined`
+ * when nothing was decoded (then `text === str`).
+ * @overload
  * @param {string} str the raw string from the token slice
  * @param {boolean=} isAttribute true if `str` came from an attribute value
  * @returns {string} decoded string
  */
-const decodeHtmlEntities = (str, isAttribute) => {
-	if (!str.includes("&")) return str;
-
-	return str.replace(
-		CHARACTER_REFERENCE_REGEXP,
-		isAttribute ? _decodeReferenceInAttribute : _decodeReferenceInText
-	);
-};
-
 /**
- * Like `decodeHtmlEntities`, but also returns a boundary map from the
- * decoded string back to raw offsets, so spans computed on the decoded
- * text (e.g. srcset candidate URLs) can be translated to source ranges.
- * `map[i]` is the raw offset of decoded boundary `i` (`0..text.length`);
- * boundaries inside a reference's decoded text map to the reference start.
- * `map` is `undefined` when nothing was decoded (then `text === str`).
+ * @overload
+ * @param {string} str the raw string from the token slice
+ * @param {boolean | undefined} isAttribute true if `str` came from an attribute value
+ * @param {true} withMap also build the decoded-to-raw boundary map
+ * @returns {DecodedEntitiesWithMap} decoded text and offset map
+ */
+/**
  * @param {string} str the raw string from the token slice
  * @param {boolean=} isAttribute true if `str` came from an attribute value
- * @returns {{ text: string, map: number[] | undefined }} decoded text and offset map
+ * @param {boolean=} withMap also build the decoded-to-raw boundary map
+ * @returns {string | DecodedEntitiesWithMap} decoded string (with map when `withMap`)
  */
-const decodeHtmlEntitiesWithMap = (str, isAttribute) => {
+const decodeEntities = (str, isAttribute, withMap) => {
+	// Hand-rolled scan of one of three reference forms, each with an optional
+	// trailing `;` — `&#x<hex>+` / `&#<dec>+` / `&<alpha><alnum>*` (kept separate
+	// so `&#65b` doesn't eat the `b` as hex): entity-dense text pays no regex
+	// machinery or per-match object, and a string whose references all stay
+	// literal is returned unchanged without rebuilding. Map bookkeeping is
+	// gated on `withMap` at the rare per-decoded-reference points, so the
+	// dominant no-map mode pays nothing for the unified implementation.
+	let amp = str.indexOf("&");
+	if (amp === -1) return withMap ? { text: str, map: undefined } : str;
+	let out = "";
+	let last = 0;
 	/** @type {number[] | undefined} */
 	let map;
-	if (str.includes("&")) {
-		CHARACTER_REFERENCE_REGEXP.lastIndex = 0;
-		let text = "";
-		let last = 0;
-		/** @type {RegExpExecArray | null} */
-		let m;
-		while ((m = CHARACTER_REFERENCE_REGEXP.exec(str)) !== null) {
-			const match = m[0];
-			const decoded = decodeOneReference(
-				match,
-				str.charCodeAt(m.index + match.length),
-				isAttribute
-			);
-			if (decoded === match) continue;
-			if (map === undefined) map = [];
-			for (let r = last; r < m.index; r++) map.push(r);
-			text += str.slice(last, m.index);
-			for (let i = 0; i < decoded.length; i++) map.push(m.index);
-			text += decoded;
-			last = m.index + match.length;
-		}
-		if (map !== undefined) {
-			for (let r = last; r < str.length; r++) map.push(r);
-			map.push(str.length);
-			return { text: text + str.slice(last), map };
+	do {
+		// `end` stays 0 when the `&` doesn't start a well-formed reference; a
+		// numeric reference's code point accumulates during the digit scan
+		// (saturating above the code-point range — every overflow decodes the
+		// same replacement) so it needs no slice at all.
+		let end = 0;
+		let code = -1;
+		let cc = str.charCodeAt(amp + 1);
+		if (cc === 0x23 /* # */) {
+			cc = str.charCodeAt(amp + 2);
+			let p;
+			if (cc === 0x78 /* x */ || cc === 0x58 /* X */) {
+				code = 0;
+				p = amp + 3;
+				while (isAsciiHexDigit((cc = str.charCodeAt(p)))) {
+					code = code * 16 + (cc <= 0x39 ? cc - 0x30 : (cc | 0x20) - 0x57);
+					if (code > 0x10ffff) code = 0x110000;
+					p++;
+				}
+				if (p > amp + 3) end = p;
+			} else {
+				code = 0;
+				p = amp + 2;
+				while (isAsciiDigit((cc = str.charCodeAt(p)))) {
+					code = code * 10 + (cc - 0x30);
+					if (code > 0x10ffff) code = 0x110000;
+					p++;
+				}
+				if (p > amp + 2) end = p;
+			}
+		} else if (isAsciiAlpha(cc)) {
+			code = -1;
+			let p = amp + 2;
+			while (isAsciiAlphanumeric(str.charCodeAt(p))) p++;
+			end = p;
+		}
+		if (end !== 0) {
+			if (str.charCodeAt(end) === 0x3b /* ; */) end++;
+			// Numeric references always decode; named ones may stay literal.
+			const decoded =
+				code >= 0
+					? decodeNumericReference(code)
+					: decodeNamedReference(
+							str,
+							amp,
+							end,
+							str.charCodeAt(end),
+							isAttribute
+						);
+			if (decoded !== undefined) {
+				if (withMap) map = _mapReference(map, last, amp, decoded.length);
+				out += str.slice(last, amp);
+				out += decoded;
+				last = end;
+			}
+			amp = str.indexOf("&", end);
+		} else {
+			amp = str.indexOf("&", amp + 1);
+		}
+	} while (amp !== -1);
+	if (last === 0) return withMap ? { text: str, map: undefined } : str;
+	const text = out + str.slice(last);
+	return withMap
+		? _finishMap(text, /** @type {number[]} */ (map), last, str.length)
+		: text;
+};
+
+// Map-mode bookkeeping for `decodeEntities`, kept out of the scanner body so
+// the dominant no-map mode stays small enough to inline.
+/**
+ * @param {number[] | undefined} map boundary map so far
+ * @param {number} last raw offset the literal run starts at
+ * @param {number} amp raw offset of the decoded reference
+ * @param {number} decodedLength length of the decoded text
+ * @returns {number[]} the map, with the literal run's and reference's boundaries appended
+ */
+const _mapReference = (map, last, amp, decodedLength) => {
+	if (map === undefined) map = [];
+	for (let r = last; r < amp; r++) map.push(r);
+	for (let i = 0; i < decodedLength; i++) map.push(amp);
+	return map;
+};
+
+/**
+ * @param {string} text decoded text
+ * @param {number[]} map boundary map so far
+ * @param {number} last raw offset of the trailing literal run
+ * @param {number} rawLength raw string length
+ * @returns {DecodedEntitiesWithMap} the finished result
+ */
+const _finishMap = (text, map, last, rawLength) => {
+	for (let r = last; r < rawLength; r++) map.push(r);
+	map.push(rawLength);
+	return { text, map };
+};
+
+/**
+ * Escape a string per the WHATWG "escape a string" algorithm
+ * (https://html.spec.whatwg.org/multipage/parsing.html#escapingString) in
+ * attribute mode: `&`, U+00A0 and `"`. CR/LF are additionally encoded as
+ * numeric references so the result stays single-line (usable in a `data:`
+ * URI). Single pass, returns the input unchanged when nothing needs escaping.
+ * @param {string} s string to escape
+ * @returns {string} HTML attribute-safe string
+ */
+const escapeAttribute = (s) => {
+	// fast path: native indexOf scans beat any per-character loop
+	if (
+		!s.includes("&") &&
+		!s.includes('"') &&
+		!s.includes("\u00A0") &&
+		!s.includes("\n") &&
+		!s.includes("\r")
+	) {
+		return s;
+	}
+	let out = "";
+	let last = 0;
+	for (let i = 0; i < s.length; i++) {
+		let rep;
+		switch (s.charCodeAt(i)) {
+			case CC_AMPERSAND:
+				rep = "&amp;";
+				break;
+			case CC_QUOTATION_MARK:
+				rep = "&quot;";
+				break;
+			case CC_NO_BREAK_SPACE:
+				rep = "&nbsp;";
+				break;
+			case CC_LF:
+				rep = "&#10;";
+				break;
+			case CC_CR:
+				rep = "&#13;";
+				break;
+			default:
+				continue;
 		}
+		out += s.slice(last, i) + rep;
+		last = i + 1;
 	}
-	return { text: str, map };
+	return out + s.slice(last);
+};
+
+/**
+ * Escape a string per the WHATWG "escape a string" algorithm in text mode:
+ * `&`, U+00A0, `<` and `>`. CR/LF are additionally encoded as numeric
+ * references so the result stays single-line (usable in a `data:` URI).
+ * Single pass, returns the input unchanged when nothing needs escaping.
+ * @param {string} s string to escape
+ * @returns {string} HTML text-content-safe string
+ */
+const escapeText = (s) => {
+	// fast path: native indexOf scans beat any per-character loop
+	if (
+		!s.includes("&") &&
+		!s.includes("<") &&
+		!s.includes(">") &&
+		!s.includes("\u00A0") &&
+		!s.includes("\n") &&
+		!s.includes("\r")
+	) {
+		return s;
+	}
+	let out = "";
+	let last = 0;
+	for (let i = 0; i < s.length; i++) {
+		let rep;
+		switch (s.charCodeAt(i)) {
+			case CC_AMPERSAND:
+				rep = "&amp;";
+				break;
+			case CC_LESS_THAN:
+				rep = "&lt;";
+				break;
+			case CC_GREATER_THAN:
+				rep = "&gt;";
+				break;
+			case CC_NO_BREAK_SPACE:
+				rep = "&nbsp;";
+				break;
+			case CC_LF:
+				rep = "&#10;";
+				break;
+			case CC_CR:
+				rep = "&#13;";
+				break;
+			default:
+				continue;
+		}
+		out += s.slice(last, i) + rep;
+		last = i + 1;
+	}
+	return out + s.slice(last);
 };
 
 // cspell:ignore advasoft altglyph altglyphdef altglyphitem animatecolor animatemotion animatetransform arcrole aswedit attributename attributetype basefrequency baseprofile bgsound calcmode clippathunits definitionurl diffuseconstant fedropshadow filterunits glyphref gradienttransform gradientunits hotjava hotmetal kernelmatrix kernelunitlength keypoints keysplines keytimes limitingconeangle malignmark markerheight markerwidth maskcontentunits maskunits metrius mglyph mtext numoctaves pathlength patterncontentunits patterntransform patternunits pointsatx pointsaty pointsatz preservealpha primitiveunits refx refy repeatcount repeatdur requiredextensions requiredfeatures selectedcontent silmaril softquad specularconstant specularexponent startoffset stddeviation stitchtiles surfacescale systemlanguage tablevalues targetx targety textlength viewbox viewtarget webtechs xchannelselector ychannelselector megamorphic attributeless rowspan imagesizes novalidate maxlength
 
 // WHATWG HTML tree construction (https://html.spec.whatwg.org/multipage/parsing.html#tree-construction)
-// on top of walkHtmlTokens. Scripting is always disabled (webpack is a build tool).
+// on top of tokenize. Scripting is always disabled (webpack is a build tool).
 
 // Namespaces (mirrors swc_html_ast::Namespace)
 const NS_HTML = 0;
@@ -3828,136 +4133,139 @@ const EMPTY_ATTRS = /** @type {AttributeRun} */ (
 // lives in the four link columns (parent / firstChild / lastChild /
 // nextSibling); the only heap references are the string payload / attribute
 // name-and-value side arrays. Columns are module-level and reused
-// across parses (grown, never shrunk — the CSS parser's `_soa*` strategy), so
-// a steady-state parse allocates almost nothing per node; consumers must fully
-// read a tree before the next `buildHtmlAst` call. Id 0 is reserved as
-// "no node" so the link columns can use 0 as null.
-let _hCap = 0;
-let _hN = 0;
+// across parses (grown, shrunk on release only past `_COLUMN_SHRINK_CAPACITY` —
+// the CSS parser's `_soa*` strategy), so a steady-state parse allocates almost
+// nothing per node; consumers must fully read a tree before the next
+// `parseHtml` call. Id 0 is reserved as "no node" so the link columns can use
+// 0 as null.
+let _nodeCapacity = 0;
+let _nodeCount = 0;
 /** `NodeType` per node */
-let _hTy = new Uint8Array(0);
+let _nodeTypes = new Uint8Array(0);
 /** bits 0-1 namespace (`NS_*`), bit 2 self-closing (void element) */
-let _hFl = new Uint8Array(0);
-let _hSt = new Int32Array(0);
-let _hEn = new Int32Array(0);
+let _nodeFlags = new Uint8Array(0);
+let _nodeStarts = new Int32Array(0);
+let _nodeEnds = new Int32Array(0);
 /** end offset of an element's opening tag (after `>`) */
-let _hTagEnd = new Int32Array(0);
+let _nodeTagEnds = new Int32Array(0);
 /** end offset of an element's tag name */
-let _hNameEnd = new Int32Array(0);
+let _nodeNameEnds = new Int32Array(0);
 /** under `skip.text`, end offset of a raw-text element's body (`HtmlAstSkip`) */
-let _hCEnd = new Int32Array(0);
+let _nodeContentEnds = new Int32Array(0);
 /** a `<template>`'s content DocumentFragment (0 = none) */
-let _hTc = new Int32Array(0);
-let _hParent = new Int32Array(0);
-let _hFirst = new Int32Array(0);
-let _hLast = new Int32Array(0);
-let _hNext = new Int32Array(0);
+let _nodeTemplateContents = new Int32Array(0);
+let _nodeParents = new Int32Array(0);
+let _nodeFirstChildren = new Int32Array(0);
+let _nodeLastChildren = new Int32Array(0);
+let _nodeNextSiblings = new Int32Array(0);
 /** @type {string[]} tag name / text data / comment data / doctype name */
-const _hStr = [];
+const _nodeStrings = [];
 /** first attribute id of an element's contiguous run */
-let _hAStart = new Int32Array(0);
+let _nodeAttrStarts = new Int32Array(0);
 /** attribute count of an element's run */
-let _hACount = new Int32Array(0);
+let _nodeAttrCounts = new Int32Array(0);
 // The single doctype node's public/system ids (a document inserts at most one
 // doctype node — later doctype tokens are ignored — so no column is needed).
 /** @type {string | null} */
-let _hDocPub = null;
+let _doctypePublicId = null;
 /** @type {string | null} */
-let _hDocSys = null;
+let _doctypeSystemId = null;
 
 const NS_MASK = 3;
 const FLAG_SELF_CLOSING = 4;
 
 /** @type {(el: HtmlNodeRef) => string} */
-const _tag = (el) => _hStr[el];
+const _tagNameOf = (el) => _nodeStrings[el];
 /** @type {(el: HtmlNodeRef) => number} */
-const _ns = (el) => _hFl[el] & NS_MASK;
+const _namespaceOf = (el) => _nodeFlags[el] & NS_MASK;
 
 // === Attribute columns ===
 // One attribute = one integer id into these columns; an element (and a
 // start-tag token) holds a contiguous run. The value string is derived from
-// the source by offset on read — `_aVal` carries an override only for
+// the source by offset on read — `_attrValues` carries an override only for
 // valueless attributes (`""`) and offset-less adoption-agency clones — and the
 // html5lib serializer name is derived from the adjusted name plus one flag
 // bit, so per attribute only the interned name pointer is retained.
-let _aCap = 0;
-let _aN = 0;
-let _aNameStart = new Int32Array(0);
-let _aNameEnd = new Int32Array(0);
-let _aValStart = new Int32Array(0);
-let _aValEnd = new Int32Array(0);
+let _attrCapacity = 0;
+let _attrCount = 0;
+let _attrNameStarts = new Int32Array(0);
+let _attrNameEnds = new Int32Array(0);
+let _attrValueStarts = new Int32Array(0);
+let _attrValueEnds = new Int32Array(0);
 /** bit 0: name has a `FOREIGN_ATTR_NS` serializer name (set on foreign adjust) */
-let _aFl = new Uint8Array(0);
+let _attrFlags = new Uint8Array(0);
 /** @type {string[]} lowercased (foreign-content: adjusted) attribute name */
-const _aName = [];
+const _attrNames = [];
 /** @type {(string | null)[]} value override (null = slice the source by offset) */
-const _aVal = [];
+const _attrValues = [];
 /** source of the current parse, for by-offset attribute values */
-let _hSrc = "";
+let _htmlSource = "";
 
 /** @param {number} need minimum capacity */
-const _aGrow = (need) => {
-	let cap = _aCap || 4096;
+const _growAttrColumns = (need) => {
+	let cap = _attrCapacity || 4096;
 	while (cap < need) cap *= 2;
 	const nameStart = new Int32Array(cap);
-	nameStart.set(_aNameStart);
-	_aNameStart = nameStart;
+	nameStart.set(_attrNameStarts);
+	_attrNameStarts = nameStart;
 	const nameEnd = new Int32Array(cap);
-	nameEnd.set(_aNameEnd);
-	_aNameEnd = nameEnd;
+	nameEnd.set(_attrNameEnds);
+	_attrNameEnds = nameEnd;
 	const valStart = new Int32Array(cap);
-	valStart.set(_aValStart);
-	_aValStart = valStart;
+	valStart.set(_attrValueStarts);
+	_attrValueStarts = valStart;
 	const valEnd = new Int32Array(cap);
-	valEnd.set(_aValEnd);
-	_aValEnd = valEnd;
+	valEnd.set(_attrValueEnds);
+	_attrValueEnds = valEnd;
 	const fl = new Uint8Array(cap);
-	fl.set(_aFl);
-	_aFl = fl;
-	_aCap = cap;
+	fl.set(_attrFlags);
+	_attrFlags = fl;
+	_attrCapacity = cap;
 };
 
 /** @type {(name: string, value: string | null, nameStart: number, nameEnd: number, valueStart: number, valueEnd: number) => number} */
-const _aAlloc = (name, value, nameStart, nameEnd, valueStart, valueEnd) => {
-	const i = ++_aN;
-	if (i >= _aCap) _aGrow(i + 1);
-	_aNameStart[i] = nameStart;
-	_aNameEnd[i] = nameEnd;
-	_aValStart[i] = valueStart;
-	_aValEnd[i] = valueEnd;
-	_aFl[i] = 0;
+const _allocAttr = (name, value, nameStart, nameEnd, valueStart, valueEnd) => {
+	const i = ++_attrCount;
+	if (i >= _attrCapacity) _growAttrColumns(i + 1);
+	_attrNameStarts[i] = nameStart;
+	_attrNameEnds[i] = nameEnd;
+	_attrValueStarts[i] = valueStart;
+	_attrValueEnds[i] = valueEnd;
+	_attrFlags[i] = 0;
 	// Ids are sequential, so these indexed writes append (arrays stay packed).
-	_aName[i] = name;
-	_aVal[i] = value;
+	_attrNames[i] = name;
+	_attrValues[i] = value;
 	return i;
 };
 
 /** @type {(i: number) => string} */
-const _aValueOf = (i) => {
-	const v = _aVal[i];
-	return v !== null ? v : _hSrc.slice(_aValStart[i], _aValEnd[i]);
+const _attrValueOf = (i) => {
+	const v = _attrValues[i];
+	return v !== null
+		? v
+		: _htmlSource.slice(_attrValueStarts[i], _attrValueEnds[i]);
 };
 
 // Linear name lookup in a run — attribute lists are short, a loop beats a Map.
 /** @type {(start: number, count: number, name: string) => number} */
-const _aFind = (start, count, name) => {
+const _findAttr = (start, count, name) => {
 	for (let i = start; i < start + count; i++) {
-		if (_aName[i] === name) return i;
+		if (_attrNames[i] === name) return i;
 	}
 	return 0;
 };
 
 /** @type {(i: number) => number} exact copy of an attribute into a new id */
-const _aCopy = (i) => {
-	const c = _aAlloc(
-		_aName[i],
-		_aVal[i],
-		_aNameStart[i],
-		_aNameEnd[i],
-		_aValStart[i],
-		_aValEnd[i]
+const _copyAttr = (i) => {
+	const c = _allocAttr(
+		_attrNames[i],
+		_attrValues[i],
+		_attrNameStarts[i],
+		_attrNameEnds[i],
+		_attrValueStarts[i],
+		_attrValueEnds[i]
 	);
-	_aFl[c] = _aFl[i];
+	_attrFlags[c] = _attrFlags[i];
 	return c;
 };
 
@@ -3966,135 +4274,167 @@ const _aCopy = (i) => {
 // an uppercase letter (unadjusted names are always lowercased), serializing as
 // itself. Everything else serializes as the plain name (undefined here).
 /** @type {(i: number) => string | undefined} */
-const _aSerializedName = (i) => {
-	if ((_aFl[i] & 1) !== 0) return FOREIGN_ATTR_NS[_aName[i]];
-	const name = _aName[i];
+const _attrSerializedName = (i) => {
+	if ((_attrFlags[i] & 1) !== 0) return FOREIGN_ATTR_NS[_attrNames[i]];
+	const name = _attrNames[i];
 	return /[A-Z]/.test(name) ? name : undefined;
 };
 
 /** @param {number} need minimum capacity */
-const _hGrow = (need) => {
-	let cap = _hCap || 4096;
+const _growNodeColumns = (need) => {
+	let cap = _nodeCapacity || 4096;
 	while (cap < need) cap *= 2;
 	const ty = new Uint8Array(cap);
-	ty.set(_hTy);
-	_hTy = ty;
+	ty.set(_nodeTypes);
+	_nodeTypes = ty;
 	const fl = new Uint8Array(cap);
-	fl.set(_hFl);
-	_hFl = fl;
+	fl.set(_nodeFlags);
+	_nodeFlags = fl;
 	const st = new Int32Array(cap);
-	st.set(_hSt);
-	_hSt = st;
+	st.set(_nodeStarts);
+	_nodeStarts = st;
 	const en = new Int32Array(cap);
-	en.set(_hEn);
-	_hEn = en;
+	en.set(_nodeEnds);
+	_nodeEnds = en;
 	const tagEnd = new Int32Array(cap);
-	tagEnd.set(_hTagEnd);
-	_hTagEnd = tagEnd;
+	tagEnd.set(_nodeTagEnds);
+	_nodeTagEnds = tagEnd;
 	const nameEnd = new Int32Array(cap);
-	nameEnd.set(_hNameEnd);
-	_hNameEnd = nameEnd;
+	nameEnd.set(_nodeNameEnds);
+	_nodeNameEnds = nameEnd;
 	const cEnd = new Int32Array(cap);
-	cEnd.set(_hCEnd);
-	_hCEnd = cEnd;
+	cEnd.set(_nodeContentEnds);
+	_nodeContentEnds = cEnd;
 	const tc = new Int32Array(cap);
-	tc.set(_hTc);
-	_hTc = tc;
+	tc.set(_nodeTemplateContents);
+	_nodeTemplateContents = tc;
 	const parent = new Int32Array(cap);
-	parent.set(_hParent);
-	_hParent = parent;
+	parent.set(_nodeParents);
+	_nodeParents = parent;
 	const first = new Int32Array(cap);
-	first.set(_hFirst);
-	_hFirst = first;
+	first.set(_nodeFirstChildren);
+	_nodeFirstChildren = first;
 	const last = new Int32Array(cap);
-	last.set(_hLast);
-	_hLast = last;
+	last.set(_nodeLastChildren);
+	_nodeLastChildren = last;
 	const next = new Int32Array(cap);
-	next.set(_hNext);
-	_hNext = next;
+	next.set(_nodeNextSiblings);
+	_nodeNextSiblings = next;
 	const aStart = new Int32Array(cap);
-	aStart.set(_hAStart);
-	_hAStart = aStart;
+	aStart.set(_nodeAttrStarts);
+	_nodeAttrStarts = aStart;
 	const aCount = new Int32Array(cap);
-	aCount.set(_hACount);
-	_hACount = aCount;
-	_hCap = cap;
+	aCount.set(_nodeAttrCounts);
+	_nodeAttrCounts = aCount;
+	_nodeCapacity = cap;
 };
 
 /** Start a new parse: invalidate all prior refs, release prior heap refs. */
-const _hReset = () => {
-	_hN = 0;
-	_aN = 0;
-	_hStr.length = 0;
-	_aName.length = 0;
-	_aVal.length = 0;
+const _resetAstColumns = () => {
+	_nodeCount = 0;
+	_attrCount = 0;
+	_nodeStrings.length = 0;
+	_attrNames.length = 0;
+	_attrValues.length = 0;
 	// Keep id 0 ("no node" / "no attribute") occupied so writes stay packed.
-	_hStr.push("");
-	_aName.push("");
-	_aVal.push(null);
-	_hDocPub = null;
-	_hDocSys = null;
+	_nodeStrings.push("");
+	_attrNames.push("");
+	_attrValues.push(null);
+	_doctypePublicId = null;
+	_doctypeSystemId = null;
 };
 
+// The typed-array columns grow to the largest document ever parsed; above this
+// capacity they are re-shrunk on release so one pathological file can't pin
+// tens of MB at module level for the process lifetime (~50 bytes/node,
+// ~17 bytes/attribute of capacity across the columns).
+const _COLUMN_SHRINK_CAPACITY = 65536;
+
 // Release the side arrays' heap references (strings, attribute names/values)
 // once a walk has consumed the tree, so the retained columns don't pin the
 // parsed source until the next parse.
-const _hRelease = () => {
-	_hN = 0;
-	_aN = 0;
-	_hStr.length = 0;
-	_aName.length = 0;
-	_aVal.length = 0;
-	_hSrc = "";
-	_hDocPub = null;
-	_hDocSys = null;
+const _releaseAstColumns = () => {
+	_nodeCount = 0;
+	_attrCount = 0;
+	_nodeStrings.length = 0;
+	_attrNames.length = 0;
+	_attrValues.length = 0;
+	_htmlSource = "";
+	_doctypePublicId = null;
+	_doctypeSystemId = null;
+	if (_nodeCapacity > _COLUMN_SHRINK_CAPACITY) {
+		_nodeCapacity = 0;
+		_nodeTypes = new Uint8Array(0);
+		_nodeFlags = new Uint8Array(0);
+		_nodeStarts = new Int32Array(0);
+		_nodeEnds = new Int32Array(0);
+		_nodeTagEnds = new Int32Array(0);
+		_nodeNameEnds = new Int32Array(0);
+		_nodeContentEnds = new Int32Array(0);
+		_nodeTemplateContents = new Int32Array(0);
+		_nodeParents = new Int32Array(0);
+		_nodeFirstChildren = new Int32Array(0);
+		_nodeLastChildren = new Int32Array(0);
+		_nodeNextSiblings = new Int32Array(0);
+		_nodeAttrStarts = new Int32Array(0);
+		_nodeAttrCounts = new Int32Array(0);
+	}
+	if (_attrCapacity > _COLUMN_SHRINK_CAPACITY) {
+		_attrCapacity = 0;
+		_attrNameStarts = new Int32Array(0);
+		_attrNameEnds = new Int32Array(0);
+		_attrValueStarts = new Int32Array(0);
+		_attrValueEnds = new Int32Array(0);
+		_attrFlags = new Uint8Array(0);
+	}
 };
 
 /** @type {(type: number, start: number, end: number) => HtmlNodeRef} */
-const _hAlloc = (type, start, end) => {
-	const i = ++_hN;
-	if (i >= _hCap) _hGrow(i + 1);
-	_hTy[i] = type;
-	_hFl[i] = 0;
-	_hSt[i] = start;
-	_hEn[i] = end;
-	_hTagEnd[i] = 0;
-	_hNameEnd[i] = 0;
-	_hCEnd[i] = 0;
-	_hTc[i] = 0;
-	_hParent[i] = 0;
-	_hFirst[i] = 0;
-	_hLast[i] = 0;
-	_hNext[i] = 0;
-	_hAStart[i] = 0;
-	_hACount[i] = 0;
-	// Ids are sequential, so this indexed write appends (array stays packed).
-	_hStr[i] = "";
+const _allocNode = (type, start, end) => {
+	const i = ++_nodeCount;
+	if (i >= _nodeCapacity) _growNodeColumns(i + 1);
+	_nodeTypes[i] = type;
+	_nodeFlags[i] = 0;
+	_nodeStarts[i] = start;
+	_nodeEnds[i] = end;
+	_nodeTagEnds[i] = 0;
+	_nodeNameEnds[i] = 0;
+	_nodeContentEnds[i] = 0;
+	_nodeTemplateContents[i] = 0;
+	_nodeParents[i] = 0;
+	_nodeFirstChildren[i] = 0;
+	_nodeLastChildren[i] = 0;
+	_nodeNextSiblings[i] = 0;
+	_nodeAttrStarts[i] = 0;
+	_nodeAttrCounts[i] = 0;
+	// `_nodeStrings[i]` is written by every caller right after this returns
+	// (tag name / text / comment data; "" at the few string-less sites), as a
+	// packed sequential append — no placeholder double-write here.
 	return i;
 };
 
 // Raw child append — no text merging, no `<template>` content redirect (the
 // tree builder layers those on top). `node` must be detached (`next` = 0).
 /** @type {(parent: HtmlNodeRef, node: HtmlNodeRef) => void} */
-const _hAppend = (parent, node) => {
-	_hParent[node] = parent;
-	const last = _hLast[parent];
-	if (last === 0) _hFirst[parent] = node;
-	else _hNext[last] = node;
-	_hLast[parent] = node;
+const _appendChild = (parent, node) => {
+	_nodeParents[node] = parent;
+	const last = _nodeLastChildren[parent];
+	if (last === 0) _nodeFirstChildren[parent] = node;
+	else _nodeNextSiblings[last] = node;
+	_nodeLastChildren[parent] = node;
 };
 
 /** @type {(data: string, start: number, end: number) => HtmlNodeRef} */
-const _mkText = (data, start, end) => {
-	const i = _hAlloc(NodeType.Text, start, end);
-	_hStr[i] = data;
+const _makeTextNode = (data, start, end) => {
+	const i = _allocNode(NodeType.Text, start, end);
+	_nodeStrings[i] = data;
 	return i;
 };
 
 /** @type {(data: string, start: number, end: number) => HtmlNodeRef} */
-const _mkComment = (data, start, end) => {
-	const i = _hAlloc(NodeType.Comment, start, end);
-	_hStr[i] = data;
+const _makeCommentNode = (data, start, end) => {
+	const i = _allocNode(NodeType.Comment, start, end);
+	_nodeStrings[i] = data;
 	return i;
 };
 
@@ -4106,12 +4446,12 @@ const AFE_MARKER = -1;
 // dependency for the reopened element's spans. Values are materialized since
 // the offsets are gone.
 const cloneAttrs = (/** @type {HtmlElement} */ el) => {
-	const start = _hAStart[el];
-	const count = _hACount[el];
-	const newStart = _aN + 1;
+	const start = _nodeAttrStarts[el];
+	const count = _nodeAttrCounts[el];
+	const newStart = _attrCount + 1;
 	for (let i = start; i < start + count; i++) {
-		const c = _aAlloc(_aName[i], _aValueOf(i), -1, -1, -1, -1);
-		_aFl[c] = _aFl[i];
+		const c = _allocAttr(_attrNames[i], _attrValueOf(i), -1, -1, -1, -1);
+		_attrFlags[c] = _attrFlags[i];
 	}
 	return { start: newStart, count };
 };
@@ -4124,20 +4464,20 @@ const mergeAttrs = (
 	/** @type {HtmlElement} */ el,
 	/** @type {AttributeRun} */ run
 ) => {
-	const start = _hAStart[el];
-	const count = _hACount[el];
+	const start = _nodeAttrStarts[el];
+	const count = _nodeAttrCounts[el];
 	let extra = 0;
 	for (let i = run.start; i < run.start + run.count; i++) {
-		if (_aFind(start, count, _aName[i]) === 0) extra++;
+		if (_findAttr(start, count, _attrNames[i]) === 0) extra++;
 	}
 	if (extra === 0) return;
-	const newStart = _aN + 1;
-	for (let i = start; i < start + count; i++) _aCopy(i);
+	const newStart = _attrCount + 1;
+	for (let i = start; i < start + count; i++) _copyAttr(i);
 	for (let i = run.start; i < run.start + run.count; i++) {
-		if (_aFind(start, count, _aName[i]) === 0) _aCopy(i);
+		if (_findAttr(start, count, _attrNames[i]) === 0) _copyAttr(i);
 	}
-	_hAStart[el] = newStart;
-	_hACount[el] = count + extra;
+	_nodeAttrStarts[el] = newStart;
+	_nodeAttrCounts[el] = count + extra;
 };
 
 /**
@@ -4157,7 +4497,7 @@ const mergeAttrs = (
 /**
  * A node reference into the struct-of-arrays AST: an integer id indexing the
  * parallel `_h*` columns. Read fields through the exported accessor `A`. Refs
- * are only valid until the next `buildHtmlAst` call — the columns are reused
+ * are only valid until the next `parseHtml` call — the columns are reused
  * across parses — so consume a tree fully before parsing again.
  * @typedef {number} HtmlNodeRef
  */
@@ -4375,8 +4715,8 @@ const FORMATTING = new Set([
 const HEADING = new Set(["h1", "h2", "h3", "h4", "h5", "h6"]);
 
 const isSpecial = (/** @type {HtmlElement} */ el) => {
-	const ns = _ns(el);
-	const tag = _tag(el);
+	const ns = _namespaceOf(el);
+	const tag = _tagNameOf(el);
 	if (ns === NS_HTML) return SPECIAL.has(tag);
 	if (ns === NS_MATHML) return MATHML_SPECIAL.has(tag);
 	if (ns === NS_SVG) return SVG_SPECIAL.has(tag.toLowerCase());
@@ -4830,7 +5170,7 @@ const FONT_BREAKOUT_ATTRS = new Set(["color", "face", "size"]);
 // `<font color|face|size>` breaks out of foreign content (§13.2.6.5).
 const hasFontBreakoutAttr = (/** @type {AttributeRun} */ run) => {
 	for (let i = run.start; i < run.start + run.count; i++) {
-		if (FONT_BREAKOUT_ATTRS.has(_aName[i])) return true;
+		if (FONT_BREAKOUT_ATTRS.has(_attrNames[i])) return true;
 	}
 	return false;
 };
@@ -4922,10 +5262,10 @@ const internLowerName = (table, input, start, end) => {
 		if (hit === undefined) break;
 		if (hashes[slot] === h) {
 			if (typeof hit === "string") {
-				if (rangeEqualsLower(input, start, end, hit)) return hit;
+				if (rangeEqualsLowerCase(input, start, end, hit)) return hit;
 			} else {
 				for (let i = 0; i < hit.length; i++) {
-					if (rangeEqualsLower(input, start, end, hit[i])) return hit[i];
+					if (rangeEqualsLowerCase(input, start, end, hit[i])) return hit[i];
 				}
 			}
 			break;
@@ -4969,7 +5309,7 @@ const ATTR_NAME_INTERN = buildNameInternTable(
 // Hoisted so the many `open.some(...)` "is there an open HTML <template>?"
 // checks reuse one predicate instead of allocating an arrow per call.
 const isHtmlTemplateEl = (/** @type {HtmlElement} */ e) =>
-	_tag(e) === "template" && _ns(e) === NS_HTML;
+	_tagNameOf(e) === "template" && _namespaceOf(e) === NS_HTML;
 
 // Raw text / escapable raw text elements (WHATWG §13.1.2) plus the other
 // RAWTEXT/RCDATA/PLAINTEXT-tokenized elements. Under `skip.text` their body's
@@ -4988,7 +5328,10 @@ const RAW_TEXT_ELEMENTS = new Set([
 	"plaintext"
 ]);
 
-/** Shared empty skip set so the common (no-skip) call allocates nothing. */
+/**
+ * Shared empty skip set so the common (no-skip) call allocates nothing.
+ * @type {HtmlAstSkip}
+ */
 const EMPTY_SKIP = Object.freeze({});
 
 /**
@@ -5002,18 +5345,40 @@ const EMPTY_SKIP = Object.freeze({});
  */
 
 /**
- * @param {string} source HTML source
- * @param {string=} fragmentContext context element name for fragment parsing (e.g. `td`, `svg path`); omit for a full document
- * @param {HtmlAstSkip=} skip node kinds to omit from the AST (see `HtmlAstSkip`); omit to build the full tree
+ * @typedef {object} HtmlParseOptions
+ * @property {string=} fragmentContext context element name for fragment parsing (e.g. `td`, `svg path`); omit for a full document
+ * @property {HtmlAstSkip=} skip node kinds to omit from the AST (see `HtmlAstSkip`); omit to build the full tree
+ */
+
+/**
+ * @param {string} input HTML source
+ * @param {number=} pos start byte offset (string input only; default `0`)
+ * @param {HtmlParseOptions=} options parse options (fragment context, AST skips)
  * @returns {HtmlDocument} ref to the document node — read through `A`; valid until the next parse
  */
-const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
+const parseHtml = (input, pos = 0, options = {}) => {
+	const source = input;
+	const { fragmentContext, skip = EMPTY_SKIP } = options;
 	const skipText = skip.text === true;
 	const skipComments = skip.comments === true;
 	const skipDoctype = skip.doctype === true;
-	_hReset();
-	_hSrc = source;
-	const doc = _hAlloc(NodeType.Document, 0, 0);
+	_resetAstColumns();
+	// Pre-size the columns from the input length: a document big enough to
+	// exceed `_COLUMN_SHRINK_CAPACITY` re-enters with released (empty) columns,
+	// and growing through the doubling cascade re-allocates and copies every
+	// column several times per parse. ~12 bytes/node and ~50 bytes/attribute
+	// are the densest realistic HTML, so `len/12` (`len/48`) reaches the final
+	// capacity in one allocation; a sparser document over-allocates bounded
+	// scratch that the post-walk release frees, and the doubling growth remains
+	// as the safety net when the estimate is short.
+	const _sizeEstimate = (input.length / 12) | 0;
+	if (_sizeEstimate > _nodeCapacity) _growNodeColumns(_sizeEstimate);
+	if (_sizeEstimate > _attrCapacity << 2) {
+		_growAttrColumns(_sizeEstimate >> 2);
+	}
+	_htmlSource = source;
+	const doc = _allocNode(NodeType.Document, 0, 0);
+	_nodeStrings[doc] = "";
 	let mode = MODE_INITIAL;
 	// Mode to return to after MODE_TEXT / MODE_IN_TABLE_TEXT (0 = unset).
 	let originalMode = 0;
@@ -5049,24 +5414,24 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {AttributeRun} */ attrs,
 		/** @type {TagPos | null | undefined} */ pos
 	) => {
-		const el = _hAlloc(
+		const el = _allocNode(
 			NodeType.Element,
 			pos ? pos.start : 0,
 			pos ? pos.end : 0
 		);
 		// Void HTML elements are marked self-closing and never receive children.
-		_hFl[el] =
+		_nodeFlags[el] =
 			ns === NS_HTML && VOID.has(tagName) ? ns | FLAG_SELF_CLOSING : ns;
-		_hStr[el] = tagName;
-		_hAStart[el] = attrs.start;
-		_hACount[el] = attrs.count;
+		_nodeStrings[el] = tagName;
+		_nodeAttrStarts[el] = attrs.start;
+		_nodeAttrCounts[el] = attrs.count;
 		if (pos) {
-			_hTagEnd[el] = pos.tagEnd;
-			_hNameEnd[el] = pos.nameEnd;
+			_nodeTagEnds[el] = pos.tagEnd;
+			_nodeNameEnds[el] = pos.nameEnd;
 			// End of a raw-text element's body under `skip.text` (defaults to the
 			// body start, i.e. empty); lets consumers read `<script>`/`<style>`
 			// content as [`tagEnd`, `contentEnd`] without a `Text` node.
-			_hCEnd[el] = pos.tagEnd;
+			_nodeContentEnds[el] = pos.tagEnd;
 		}
 		return el;
 	};
@@ -5078,7 +5443,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	 * @returns {HtmlNodeRef} effective container to link children into
 	 */
 	const effParent = (parent) => {
-		const tc = _hTc[parent];
+		const tc = _nodeTemplateContents[parent];
 		return tc !== 0 ? tc : parent;
 	};
 
@@ -5087,17 +5452,17 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {HtmlNodeRef} */ node
 	) => {
 		const p = effParent(parent);
-		const last = _hLast[p];
+		const last = _nodeLastChildren[p];
 		if (
-			_hTy[node] === NodeType.Text &&
+			_nodeTypes[node] === NodeType.Text &&
 			last !== 0 &&
-			_hTy[last] === NodeType.Text
+			_nodeTypes[last] === NodeType.Text
 		) {
-			_hStr[last] += _hStr[node];
-			_hEn[last] = _hEn[node];
+			_nodeStrings[last] += _nodeStrings[node];
+			_nodeEnds[last] = _nodeEnds[node];
 			return;
 		}
-		_hAppend(p, node);
+		_appendChild(p, node);
 	};
 
 	// Reused result of `appropriatePlace` — consumed synchronously by
@@ -5119,23 +5484,23 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		const target = cur();
 		if (
 			fosterParenting &&
-			TABLE_CONTEXT.has(_tag(target)) &&
-			_ns(target) === NS_HTML
+			TABLE_CONTEXT.has(_tagNameOf(target)) &&
+			_namespaceOf(target) === NS_HTML
 		) {
 			// find last template / last table
 			let lastTemplate = -1;
 			let lastTable = -1;
 			for (let i = open.length - 1; i >= 0; i--) {
 				if (
-					_tag(open[i]) === "template" &&
-					_ns(open[i]) === NS_HTML &&
+					_tagNameOf(open[i]) === "template" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTemplate === -1
 				) {
 					lastTemplate = i;
 				}
 				if (
-					_tag(open[i]) === "table" &&
-					_ns(open[i]) === NS_HTML &&
+					_tagNameOf(open[i]) === "table" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTable === -1
 				) {
 					lastTable = i;
@@ -5151,7 +5516,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				return placeAt(open[0], 0);
 			}
 			const table = open[lastTable];
-			const tp = _hParent[table];
+			const tp = _nodeParents[table];
 			if (tp !== 0) return placeAt(tp, table);
 			return placeAt(open[lastTable - 1], 0);
 		}
@@ -5168,10 +5533,10 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			// Find `before`'s previous sibling (insert-before is a rare foster/
 			// adoption path, so the sibling scan stays off the hot path).
 			let prev = 0;
-			let c = _hFirst[p];
+			let c = _nodeFirstChildren[p];
 			while (c !== 0 && c !== before) {
 				prev = c;
-				c = _hNext[c];
+				c = _nodeNextSiblings[c];
 			}
 			if (c === 0) {
 				// `before` not under `parent` (not reachable from the spec paths).
@@ -5179,18 +5544,18 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				return;
 			}
 			if (
-				_hTy[node] === NodeType.Text &&
+				_nodeTypes[node] === NodeType.Text &&
 				prev !== 0 &&
-				_hTy[prev] === NodeType.Text
+				_nodeTypes[prev] === NodeType.Text
 			) {
 				// Before-node merge deliberately does not bump the sibling's `end`.
-				_hStr[prev] += _hStr[node];
+				_nodeStrings[prev] += _nodeStrings[node];
 				return;
 			}
-			_hParent[node] = p;
-			_hNext[node] = before;
-			if (prev === 0) _hFirst[p] = node;
-			else _hNext[prev] = node;
+			_nodeParents[node] = p;
+			_nodeNextSiblings[node] = before;
+			if (prev === 0) _nodeFirstChildren[p] = node;
+			else _nodeNextSiblings[prev] = node;
 		} else {
 			appendTo(place.parent, node);
 		}
@@ -5202,7 +5567,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {number} */ end
 	) => {
 		const place = appropriatePlace();
-		if (_hTy[place.parent] === NodeType.Document) return; // never insert text into document
+		if (_nodeTypes[place.parent] === NodeType.Document) return; // never insert text into document
 		// `skip.text`: drop every `Text` node — construction already used the
 		// decoded token, so removing the node never affects element structure.
 		// For a raw-text element record the body end so a consumer reads the span
@@ -5211,8 +5576,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		// foreign content (e.g. SVG `<style>`) too.
 		if (skipText) {
 			const p = place.parent;
-			if (_hTy[p] === NodeType.Element && RAW_TEXT_ELEMENTS.has(_tag(p))) {
-				_hCEnd[p] = end;
+			if (
+				_nodeTypes[p] === NodeType.Element &&
+				RAW_TEXT_ELEMENTS.has(_tagNameOf(p))
+			) {
+				_nodeContentEnds[p] = end;
 			}
 			return;
 		}
@@ -5224,33 +5592,33 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		const before = place.beforeNode;
 		if (before !== 0) {
 			let prev = 0;
-			let c = _hFirst[p];
+			let c = _nodeFirstChildren[p];
 			while (c !== 0 && c !== before) {
 				prev = c;
-				c = _hNext[c];
+				c = _nodeNextSiblings[c];
 			}
 			if (c === 0) {
 				// `before` not under `parent` (not reachable from the spec paths).
-				_hAppend(p, _mkText(data, start, end));
+				_appendChild(p, _makeTextNode(data, start, end));
 				return;
 			}
-			if (prev !== 0 && _hTy[prev] === NodeType.Text) {
-				_hStr[prev] += data;
+			if (prev !== 0 && _nodeTypes[prev] === NodeType.Text) {
+				_nodeStrings[prev] += data;
 				return;
 			}
-			const node = _mkText(data, start, end);
-			_hParent[node] = p;
-			_hNext[node] = before;
-			if (prev === 0) _hFirst[p] = node;
-			else _hNext[prev] = node;
+			const node = _makeTextNode(data, start, end);
+			_nodeParents[node] = p;
+			_nodeNextSiblings[node] = before;
+			if (prev === 0) _nodeFirstChildren[p] = node;
+			else _nodeNextSiblings[prev] = node;
 		} else {
-			const last = _hLast[p];
-			if (last !== 0 && _hTy[last] === NodeType.Text) {
-				_hStr[last] += data;
-				_hEn[last] = end;
+			const last = _nodeLastChildren[p];
+			if (last !== 0 && _nodeTypes[last] === NodeType.Text) {
+				_nodeStrings[last] += data;
+				_nodeEnds[last] = end;
 				return;
 			}
-			_hAppend(p, _mkText(data, start, end));
+			_appendChild(p, _makeTextNode(data, start, end));
 		}
 	};
 
@@ -5263,7 +5631,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const insertComment = (data, start, end, place) => {
 		if (skipComments) return;
 		const p = place || appropriatePlace();
-		insertAtPlace(p, _mkComment(data, start, end));
+		insertAtPlace(p, _makeCommentNode(data, start, end));
 	};
 
 	const insertHtmlElement = (
@@ -5293,10 +5661,12 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 
 	// ---- scopes ----
 	const isScopeBoundary = (/** @type {HtmlElement} */ el) => {
-		if (_ns(el) === NS_HTML) return HTML_SCOPE.has(_tag(el));
-		if (_ns(el) === NS_MATHML) return MATHML_SPECIAL.has(_tag(el));
-		if (_ns(el) === NS_SVG) {
-			return SVG_SPECIAL.has(_tag(el).toLowerCase());
+		if (_namespaceOf(el) === NS_HTML) return HTML_SCOPE.has(_tagNameOf(el));
+		if (_namespaceOf(el) === NS_MATHML) {
+			return MATHML_SPECIAL.has(_tagNameOf(el));
+		}
+		if (_namespaceOf(el) === NS_SVG) {
+			return SVG_SPECIAL.has(_tagNameOf(el).toLowerCase());
 		}
 		return false;
 	};
@@ -5311,10 +5681,10 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {number} */ kind
 	) => {
 		if (isScopeBoundary(el)) return true;
-		if (_ns(el) !== NS_HTML) return false;
-		if (kind === SCOPE_BUTTON) return _tag(el) === "button";
+		if (_namespaceOf(el) !== NS_HTML) return false;
+		if (kind === SCOPE_BUTTON) return _tagNameOf(el) === "button";
 		if (kind === SCOPE_LIST_ITEM) {
-			return _tag(el) === "ol" || _tag(el) === "ul";
+			return _tagNameOf(el) === "ol" || _tagNameOf(el) === "ul";
 		}
 		return false;
 	};
@@ -5326,7 +5696,9 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	) => {
 		for (let i = open.length - 1; i >= 0; i--) {
 			const el = open[i];
-			if (_ns(el) === NS_HTML && _tag(el) === tagName) return true;
+			if (_namespaceOf(el) === NS_HTML && _tagNameOf(el) === tagName) {
+				return true;
+			}
 			if (isBoundaryForKind(el, kind)) return false;
 		}
 		return false;
@@ -5350,9 +5722,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		const set = typeof target === "string" ? null : target;
 		for (let i = open.length - 1; i >= 0; i--) {
 			const el = open[i];
-			if (_ns(el) === NS_HTML) {
-				if (set ? set.has(_tag(el)) : _tag(el) === target) return true;
-				if (TABLE_SCOPE_STOP.has(_tag(el))) return false;
+			if (_namespaceOf(el) === NS_HTML) {
+				if (set ? set.has(_tagNameOf(el)) : _tagNameOf(el) === target) {
+					return true;
+				}
+				if (TABLE_SCOPE_STOP.has(_tagNameOf(el))) return false;
 			}
 		}
 		return false;
@@ -5360,7 +5734,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const generateImpliedEndTags = (except = "") => {
 		while (open.length) {
 			const el = cur();
-			if (_ns(el) === NS_HTML && IMPLIED.has(_tag(el)) && _tag(el) !== except) {
+			if (
+				_namespaceOf(el) === NS_HTML &&
+				IMPLIED.has(_tagNameOf(el)) &&
+				_tagNameOf(el) !== except
+			) {
 				open.pop();
 			} else {
 				break;
@@ -5370,7 +5748,10 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const generateImpliedEndTagsThorough = () => {
 		while (open.length) {
 			const el = cur();
-			if (_ns(el) === NS_HTML && IMPLIED_THOROUGH.has(_tag(el))) {
+			if (
+				_namespaceOf(el) === NS_HTML &&
+				IMPLIED_THOROUGH.has(_tagNameOf(el))
+			) {
 				open.pop();
 			} else {
 				break;
@@ -5384,7 +5765,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		for (let i = afe.length - 1; i >= 0; i--) {
 			const e = afe[i];
 			if (e === AFE_MARKER) break;
-			if (_tag(e) === _tag(el) && _ns(e) === _ns(el) && sameAttrs(e, el)) {
+			if (
+				_tagNameOf(e) === _tagNameOf(el) &&
+				_namespaceOf(e) === _namespaceOf(el) &&
+				sameAttrs(e, el)
+			) {
 				count++;
 				if (count === 3) {
 					afe.splice(i, 1);
@@ -5398,16 +5783,16 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {HtmlElement} */ a,
 		/** @type {HtmlElement} */ b
 	) => {
-		const aStart = _hAStart[a];
-		const aCount = _hACount[a];
-		const bStart = _hAStart[b];
-		const bCount = _hACount[b];
+		const aStart = _nodeAttrStarts[a];
+		const aCount = _nodeAttrCounts[a];
+		const bStart = _nodeAttrStarts[b];
+		const bCount = _nodeAttrCounts[b];
 		if (aCount !== bCount) return false;
 		// Names are unique (deduped), counts tiny — a nested scan beats a Map
 		// here on this formatting-element hot path.
 		for (let i = bStart; i < bStart + bCount; i++) {
-			const j = _aFind(aStart, aCount, _aName[i]);
-			if (j === 0 || _aValueOf(j) !== _aValueOf(i)) return false;
+			const j = _findAttr(aStart, aCount, _attrNames[i]);
+			if (j === 0 || _attrValueOf(j) !== _attrValueOf(i)) return false;
 		}
 		return true;
 	};
@@ -5430,7 +5815,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		}
 		for (; i < afe.length; i++) {
 			const e = afe[i];
-			const el = mkEl(_tag(e), _ns(e), cloneAttrs(e), null);
+			const el = mkEl(_tagNameOf(e), _namespaceOf(e), cloneAttrs(e), null);
 			const place = appropriatePlace();
 			insertAtPlace(place, el);
 			open.push(el);
@@ -5444,23 +5829,23 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		// pop until a p has been popped
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			_hEn[el] = tokenEnd;
-			if (_ns(el) === NS_HTML && _tag(el) === "p") break;
+			_nodeEnds[el] = tokenEnd;
+			if (_namespaceOf(el) === NS_HTML && _tagNameOf(el) === "p") break;
 		}
 	};
 
 	const popUntil = (/** @type {string} */ tagName) => {
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			_hEn[el] = tokenEnd;
-			if (_ns(el) === NS_HTML && _tag(el) === tagName) break;
+			_nodeEnds[el] = tokenEnd;
+			if (_namespaceOf(el) === NS_HTML && _tagNameOf(el) === tagName) break;
 		}
 	};
 	const popUntilOneOf = (/** @type {Set<string>} */ set) => {
 		while (open.length) {
 			const el = /** @type {HtmlElement} */ (open.pop());
-			_hEn[el] = tokenEnd;
-			if (_ns(el) === NS_HTML && set.has(_tag(el))) break;
+			_nodeEnds[el] = tokenEnd;
+			if (_namespaceOf(el) === NS_HTML && set.has(_tagNameOf(el))) break;
 		}
 	};
 
@@ -5473,8 +5858,8 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				last = true;
 				if (fragment) node = fragment;
 			}
-			const tn = _tag(node);
-			if (_ns(node) === NS_HTML) {
+			const tn = _tagNameOf(node);
+			if (_namespaceOf(node) === NS_HTML) {
 				if ((tn === "td" || tn === "th") && !last) {
 					mode = MODE_IN_CELL;
 					return;
@@ -5567,7 +5952,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		const useForeign =
 			open.length > 0 &&
 			ac &&
-			_ns(ac) !== NS_HTML &&
+			_namespaceOf(ac) !== NS_HTML &&
 			ty !== TOKEN_EOF &&
 			shouldUseForeignRules(ac, t);
 		if (useForeign) {
@@ -5581,7 +5966,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {HtmlElement} */ ac,
 		/** @type {Token} */ t
 	) => {
-		if (_ns(ac) === NS_HTML) return false;
+		if (_namespaceOf(ac) === NS_HTML) return false;
 		if (t.type === TOKEN_START_TAG) {
 			if (
 				mathmlTextIntegrationPoint(ac) &&
@@ -5591,8 +5976,8 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				return false;
 			}
 			if (
-				_ns(ac) === NS_MATHML &&
-				_tag(ac) === "annotation-xml" &&
+				_namespaceOf(ac) === NS_MATHML &&
+				_tagNameOf(ac) === "annotation-xml" &&
 				t.name === "svg"
 			) {
 				return false;
@@ -5611,19 +5996,27 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	};
 
 	const mathmlTextIntegrationPoint = (/** @type {HtmlElement} */ el) =>
-		_ns(el) === NS_MATHML && MATHML_TEXT_INTEGRATION.has(_tag(el));
+		_namespaceOf(el) === NS_MATHML &&
+		MATHML_TEXT_INTEGRATION.has(_tagNameOf(el));
 	const htmlIntegrationPoint = (/** @type {HtmlElement} */ el) => {
-		if (_ns(el) === NS_MATHML && _tag(el) === "annotation-xml") {
-			const enc = _aFind(_hAStart[el], _hACount[el], "encoding");
+		if (_namespaceOf(el) === NS_MATHML && _tagNameOf(el) === "annotation-xml") {
+			const enc = _findAttr(
+				_nodeAttrStarts[el],
+				_nodeAttrCounts[el],
+				"encoding"
+			);
 			if (enc !== 0) {
-				const value = _aValueOf(enc).toLowerCase();
+				const value = _attrValueOf(enc).toLowerCase();
 				if (value === "text/html" || value === "application/xhtml+xml") {
 					return true;
 				}
 			}
 			return false;
 		}
-		if (_ns(el) === NS_SVG && SVG_SPECIAL.has(_tag(el).toLowerCase())) {
+		if (
+			_namespaceOf(el) === NS_SVG &&
+			SVG_SPECIAL.has(_tagNameOf(el).toLowerCase())
+		) {
 			return true;
 		}
 		return false;
@@ -5633,23 +6026,23 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {Record<string, string>} */ (SVG_TAG_ADJUST)[name] || name;
 	// Adjust a foreign start tag's attribute run in place (the run is consumed
 	// only by this tag's element): SVG camelCase names are rewritten, and
-	// namespaced names get the serializer-name flag (see `_aSerializedName`).
+	// namespaced names get the serializer-name flag (see `_attrSerializedName`).
 	const adjustForeignAttrs = (
 		/** @type {AttributeRun} */ run,
 		/** @type {number} */ ns
 	) => {
 		for (let i = run.start; i < run.start + run.count; i++) {
-			const name = _aName[i];
+			const name = _attrNames[i];
 			if (
 				ns === NS_SVG &&
 				/** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[name]
 			) {
-				_aName[i] = /** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[
+				_attrNames[i] = /** @type {Record<string, string>} */ (SVG_ATTR_ADJUST)[
 					name
 				];
 			}
 			if (/** @type {Record<string, string>} */ (FOREIGN_ATTR_NS)[name]) {
-				_aFl[i] |= 1;
+				_attrFlags[i] |= 1;
 			}
 		}
 		return run;
@@ -5669,7 +6062,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		}
 		if (t.type === TOKEN_DOCTYPE) return;
 		if (t.type === TOKEN_START_TAG) {
-			const acn = _ns(adjustedCurrent());
+			const acn = _namespaceOf(adjustedCurrent());
 			if (
 				FOREIGN_BREAKOUT.has(t.name) ||
 				(t.name === "font" && hasFontBreakoutAttr(t.attrs))
@@ -5678,7 +6071,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				while (open.length > 1) {
 					const c = cur();
 					if (
-						_ns(c) === NS_HTML ||
+						_namespaceOf(c) === NS_HTML ||
 						mathmlTextIntegrationPoint(c) ||
 						htmlIntegrationPoint(c)
 					) {
@@ -5708,8 +6101,8 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		if (t.type === TOKEN_END_TAG) {
 			if (
 				t.name === "script" &&
-				_tag(cur()) === "script" &&
-				_ns(cur()) === NS_SVG
+				_tagNameOf(cur()) === "script" &&
+				_namespaceOf(cur()) === NS_SVG
 			) {
 				open.pop();
 				return;
@@ -5719,7 +6112,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			if (t.name === "p" || t.name === "br") {
 				while (
 					open.length > 1 &&
-					_ns(cur()) !== NS_HTML &&
+					_namespaceOf(cur()) !== NS_HTML &&
 					!mathmlTextIntegrationPoint(cur()) &&
 					!htmlIntegrationPoint(cur())
 				) {
@@ -5731,18 +6124,21 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			// any other end tag
 			let i = open.length - 1;
 			let node = open[i];
-			if (_tag(node).toLowerCase() !== t.name) {
+			if (_tagNameOf(node).toLowerCase() !== t.name) {
 				/* parse error */
 			}
 			while (i >= 0) {
 				node = open[i];
 				if (i === 0) return;
-				if (_ns(node) !== NS_HTML && _tag(node).toLowerCase() === t.name) {
+				if (
+					_namespaceOf(node) !== NS_HTML &&
+					_tagNameOf(node).toLowerCase() === t.name
+				) {
 					while (open.length > i) open.pop();
 					return;
 				}
 				i--;
-				if (open[i] && _ns(open[i]) === NS_HTML) {
+				if (open[i] && _namespaceOf(open[i]) === NS_HTML) {
 					runMode(t);
 					return;
 				}
@@ -5757,7 +6153,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	) => {
 		// step 1
 		const c = cur();
-		if (_ns(c) === NS_HTML && _tag(c) === subject && !afe.includes(c)) {
+		if (
+			_namespaceOf(c) === NS_HTML &&
+			_tagNameOf(c) === subject &&
+			!afe.includes(c)
+		) {
 			open.pop();
 			return true;
 		}
@@ -5768,7 +6168,10 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			let fmtIdx = -1;
 			for (let i = afe.length - 1; i >= 0; i--) {
 				if (afe[i] === AFE_MARKER) break;
-				if (_tag(afe[i]) === subject && _ns(afe[i]) === NS_HTML) {
+				if (
+					_tagNameOf(afe[i]) === subject &&
+					_namespaceOf(afe[i]) === NS_HTML
+				) {
 					fmtIdx = i;
 					break;
 				}
@@ -5817,7 +6220,12 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 					continue;
 				}
 				// create clone
-				const clone = mkEl(_tag(node), _ns(node), cloneAttrs(node), null);
+				const clone = mkEl(
+					_tagNameOf(node),
+					_namespaceOf(node),
+					cloneAttrs(node),
+					null
+				);
 				afe[nodeAfeIdx] = clone;
 				open[nodeIdx] = clone;
 				node = clone;
@@ -5832,16 +6240,21 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			const place = placeForCommonAncestor(commonAncestor);
 			insertAtPlace(place, lastNode);
 			// create element for fmt token, take children of furthest
-			const cloneFmt = mkEl(_tag(fmt), _ns(fmt), cloneAttrs(fmt), null);
+			const cloneFmt = mkEl(
+				_tagNameOf(fmt),
+				_namespaceOf(fmt),
+				cloneAttrs(fmt),
+				null
+			);
 			// Take all direct children of `furthest` (a template's content fragment
 			// deliberately stays put — mirrors childrenOf-less spec behavior here).
-			let k = _hFirst[furthest];
-			_hFirst[furthest] = 0;
-			_hLast[furthest] = 0;
+			let k = _nodeFirstChildren[furthest];
+			_nodeFirstChildren[furthest] = 0;
+			_nodeLastChildren[furthest] = 0;
 			while (k !== 0) {
-				const next = _hNext[k];
-				_hNext[k] = 0;
-				_hParent[k] = 0;
+				const next = _nodeNextSiblings[k];
+				_nodeNextSiblings[k] = 0;
+				_nodeParents[k] = 0;
 				appendTo(cloneFmt, k);
 				k = next;
 			}
@@ -5866,8 +6279,8 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		/** @type {HtmlElement} */ commonAncestor
 	) => {
 		if (
-			TABLE_CONTEXT.has(_tag(commonAncestor)) &&
-			_ns(commonAncestor) === NS_HTML
+			TABLE_CONTEXT.has(_tagNameOf(commonAncestor)) &&
+			_namespaceOf(commonAncestor) === NS_HTML
 		) {
 			// foster
 			// reuse appropriatePlace logic but rooted differently: emulate
@@ -5875,15 +6288,15 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			let lastTable = -1;
 			for (let i = open.length - 1; i >= 0; i--) {
 				if (
-					_tag(open[i]) === "template" &&
-					_ns(open[i]) === NS_HTML &&
+					_tagNameOf(open[i]) === "template" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTemplate === -1
 				) {
 					lastTemplate = i;
 				}
 				if (
-					_tag(open[i]) === "table" &&
-					_ns(open[i]) === NS_HTML &&
+					_tagNameOf(open[i]) === "table" &&
+					_namespaceOf(open[i]) === NS_HTML &&
 					lastTable === -1
 				) {
 					lastTable = i;
@@ -5897,7 +6310,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			}
 			if (lastTable === -1) return { parent: open[0], beforeNode: 0 };
 			const table = open[lastTable];
-			const tp = _hParent[table];
+			const tp = _nodeParents[table];
 			if (tp !== 0) return { parent: tp, beforeNode: table };
 			return { parent: open[lastTable - 1], beforeNode: 0 };
 		}
@@ -5905,20 +6318,20 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	};
 
 	const detach = (/** @type {HtmlNodeRef} */ node) => {
-		const p = _hParent[node];
+		const p = _nodeParents[node];
 		if (p === 0) return;
 		let prev = 0;
-		let c = _hFirst[p];
+		let c = _nodeFirstChildren[p];
 		while (c !== 0 && c !== node) {
 			prev = c;
-			c = _hNext[c];
+			c = _nodeNextSiblings[c];
 		}
 		if (c === 0) return;
-		if (prev === 0) _hFirst[p] = _hNext[node];
-		else _hNext[prev] = _hNext[node];
-		if (_hLast[p] === node) _hLast[p] = prev;
-		_hNext[node] = 0;
-		_hParent[node] = 0;
+		if (prev === 0) _nodeFirstChildren[p] = _nodeNextSiblings[node];
+		else _nodeNextSiblings[prev] = _nodeNextSiblings[node];
+		if (_nodeLastChildren[p] === node) _nodeLastChildren[p] = prev;
+		_nodeNextSiblings[node] = 0;
+		_nodeParents[node] = 0;
 	};
 
 	// ---------- insertion modes ----------
@@ -6082,13 +6495,13 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		if (t.type === TOKEN_DOCTYPE) {
 			// `skip.doctype` drops the node only; quirks detection below is unaffected.
 			if (!skipDoctype) {
-				const dt = _hAlloc(NodeType.Doctype, t.start, t.end);
-				_hStr[dt] = t.name;
+				const dt = _allocNode(NodeType.Doctype, t.start, t.end);
+				_nodeStrings[dt] = t.name;
 				// At most one doctype node is ever inserted (later doctype tokens
 				// are ignored), so its ids live in two per-parse scalars.
-				_hDocPub = t.publicId;
-				_hDocSys = t.systemId;
-				_hAppend(doc, dt);
+				_doctypePublicId = t.publicId;
+				_doctypeSystemId = t.systemId;
+				_appendChild(doc, dt);
 			}
 			quirks = isQuirky(t.name, t.publicId, t.systemId);
 			mode = MODE_BEFORE_HTML;
@@ -6112,7 +6525,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		}
 		if (t.type === TOKEN_START_TAG && t.name === "html") {
 			const el = mkEl("html", NS_HTML, t.attrs, t.pos);
-			_hAppend(doc, el);
+			_appendChild(doc, el);
 			open.push(el);
 			mode = MODE_BEFORE_HEAD;
 			return;
@@ -6121,7 +6534,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			return;
 		}
 		const el = mkEl("html", NS_HTML, EMPTY_ATTRS, null);
-		_hAppend(doc, el);
+		_appendChild(doc, el);
 		open.push(el);
 		mode = MODE_BEFORE_HEAD;
 		process(t);
@@ -6197,10 +6610,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				mode = MODE_IN_TEMPLATE;
 				templateModes.push(MODE_IN_TEMPLATE);
 				const el = cur();
-				const fragment = _hAlloc(NodeType.DocumentFragment, 0, 0);
+				const fragment = _allocNode(NodeType.DocumentFragment, 0, 0);
+				_nodeStrings[fragment] = "";
 				// Parent link so the iterative walk can ascend out of the content.
-				_hParent[fragment] = el;
-				_hTc[el] = fragment;
+				_nodeParents[fragment] = el;
+				_nodeTemplateContents[el] = fragment;
 				return;
 			}
 			if (t.name === "head") return;
@@ -6343,10 +6757,10 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const anyOtherEndTag = (/** @type {string} */ name) => {
 		for (let i = open.length - 1; i >= 0; i--) {
 			const node = open[i];
-			if (_ns(node) === NS_HTML && _tag(node) === name) {
+			if (_namespaceOf(node) === NS_HTML && _tagNameOf(node) === name) {
 				generateImpliedEndTags(name);
 				while (open.length > i) {
-					_hEn[open[open.length - 1]] = tokenEnd;
+					_nodeEnds[open[open.length - 1]] = tokenEnd;
 					open.pop();
 				}
 				return;
@@ -6369,7 +6783,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		}
 		if (name === "body") {
 			const second = open[1];
-			if (!second || _tag(second) !== "body" || open.some(isHtmlTemplateEl)) {
+			if (
+				!second ||
+				_tagNameOf(second) !== "body" ||
+				open.some(isHtmlTemplateEl)
+			) {
 				return;
 			}
 			framesetOk = false;
@@ -6378,7 +6796,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		}
 		if (name === "frameset") {
 			const second = open[1];
-			if (!second || _tag(second) !== "body") return;
+			if (!second || _tagNameOf(second) !== "body") return;
 			if (!framesetOk) return;
 			detach(second);
 			while (open.length > 1) open.pop();
@@ -6393,7 +6811,9 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		}
 		if (HEADING.has(name)) {
 			closeIfPInButtonScope();
-			if (_ns(cur()) === NS_HTML && HEADING.has(_tag(cur()))) open.pop();
+			if (_namespaceOf(cur()) === NS_HTML && HEADING.has(_tagNameOf(cur()))) {
+				open.pop();
+			}
 			insertHtmlElement(name, t.attrs, t.pos);
 			return;
 		}
@@ -6419,14 +6839,17 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			framesetOk = false;
 			for (let i = open.length - 1; i >= 0; i--) {
 				const node = open[i];
-				if (_ns(node) === NS_HTML && _tag(node) === "li") {
+				if (_namespaceOf(node) === NS_HTML && _tagNameOf(node) === "li") {
 					generateImpliedEndTags("li");
 					popUntil("li");
 					break;
 				}
 				if (
 					isSpecial(node) &&
-					!(_ns(node) === NS_HTML && ADDRESS_DIV_P.has(_tag(node)))
+					!(
+						_namespaceOf(node) === NS_HTML &&
+						ADDRESS_DIV_P.has(_tagNameOf(node))
+					)
 				) {
 					break;
 				}
@@ -6440,16 +6863,19 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			for (let i = open.length - 1; i >= 0; i--) {
 				const node = open[i];
 				if (
-					_ns(node) === NS_HTML &&
-					(_tag(node) === "dd" || _tag(node) === "dt")
+					_namespaceOf(node) === NS_HTML &&
+					(_tagNameOf(node) === "dd" || _tagNameOf(node) === "dt")
 				) {
-					generateImpliedEndTags(_tag(node));
-					popUntil(_tag(node));
+					generateImpliedEndTags(_tagNameOf(node));
+					popUntil(_tagNameOf(node));
 					break;
 				}
 				if (
 					isSpecial(node) &&
-					!(_ns(node) === NS_HTML && ADDRESS_DIV_P.has(_tag(node)))
+					!(
+						_namespaceOf(node) === NS_HTML &&
+						ADDRESS_DIV_P.has(_tagNameOf(node))
+					)
 				) {
 					break;
 				}
@@ -6477,9 +6903,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			// if there's an <a> in afe after last marker
 			for (let i = afe.length - 1; i >= 0; i--) {
 				if (afe[i] === AFE_MARKER) break;
-				if (_tag(afe[i]) === "a") {
+				if (_tagNameOf(afe[i]) === "a") {
 					adoptionAgency("a", t.pos);
-					const idx = afe.findIndex((e) => e !== AFE_MARKER && _tag(e) === "a");
+					const idx = afe.findIndex(
+						(e) => e !== AFE_MARKER && _tagNameOf(e) === "a"
+					);
 					if (idx !== -1) {
 						const el = afe[idx];
 						afe.splice(idx, 1);
@@ -6541,16 +6969,16 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				resetInsertionMode();
 			} else if (
 				fragment &&
-				_ns(fragment) === NS_HTML &&
-				_tag(fragment) === "select"
+				_namespaceOf(fragment) === NS_HTML &&
+				_tagNameOf(fragment) === "select"
 			) {
 				return;
 			}
 			reconstructAfe();
 			insertHtmlElement("input", t.attrs, t.pos);
 			open.pop();
-			const ty = _aFind(t.attrs.start, t.attrs.count, "type");
-			if (ty === 0 || _aValueOf(ty).toLowerCase() !== "hidden") {
+			const ty = _findAttr(t.attrs.start, t.attrs.count, "type");
+			if (ty === 0 || _attrValueOf(ty).toLowerCase() !== "hidden") {
 				framesetOk = false;
 			}
 			return;
@@ -6561,8 +6989,10 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			return;
 		}
 		if (name === "hr") {
-			if (_ns(cur()) === NS_HTML && _tag(cur()) === "option") open.pop();
-			if (_ns(cur()) === NS_HTML && _tag(cur()) === "optgroup") {
+			if (_namespaceOf(cur()) === NS_HTML && _tagNameOf(cur()) === "option") {
+				open.pop();
+			}
+			if (_namespaceOf(cur()) === NS_HTML && _tagNameOf(cur()) === "optgroup") {
 				open.pop();
 			}
 			closeIfPInButtonScope();
@@ -6611,11 +7041,13 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			return;
 		}
 		if (name === "optgroup" || name === "option") {
-			if (_ns(cur()) === NS_HTML && _tag(cur()) === "option") open.pop();
+			if (_namespaceOf(cur()) === NS_HTML && _tagNameOf(cur()) === "option") {
+				open.pop();
+			}
 			if (
 				name === "optgroup" &&
-				_ns(cur()) === NS_HTML &&
-				_tag(cur()) === "optgroup"
+				_namespaceOf(cur()) === NS_HTML &&
+				_tagNameOf(cur()) === "optgroup"
 			) {
 				open.pop();
 			}
@@ -6659,7 +7091,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	// this tag's element); the camelCase name serializes as itself.
 	const adjustMathmlAttrs = (/** @type {AttributeRun} */ run) => {
 		for (let i = run.start; i < run.start + run.count; i++) {
-			if (_aName[i] === "definitionurl") _aName[i] = "definitionURL";
+			if (_attrNames[i] === "definitionurl") _attrNames[i] = "definitionURL";
 		}
 		return run;
 	};
@@ -6785,7 +7217,10 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			// current element: a non-matching name (e.g. a fragment context), or
 			// a name that ran straight to EOF with no delimiter (`</script` at
 			// EOF — the tokenizer still emits a partial tag there).
-			if (cur() && (t.name !== _tag(cur()) || t.pos.end === t.pos.nameEnd)) {
+			if (
+				cur() &&
+				(t.name !== _tagNameOf(cur()) || t.pos.end === t.pos.nameEnd)
+			) {
 				insertCharacters(
 					source.slice(t.pos.start, t.pos.end),
 					t.pos.start,
@@ -6793,7 +7228,8 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				);
 				return;
 			}
-			open.pop();
+			// span the close tag, like every other explicit-close pop
+			_nodeEnds[/** @type {HtmlElement} */ (open.pop())] = tokenEnd;
 			mode = originalMode;
 		}
 	};
@@ -6805,7 +7241,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	modes.inTable = (t) => {
 		if (t.type === TOKEN_CHAR) {
 			const c = cur();
-			if (TABLE_CONTEXT.has(_tag(c)) && _ns(c) === NS_HTML) {
+			if (TABLE_CONTEXT.has(_tagNameOf(c)) && _namespaceOf(c) === NS_HTML) {
 				pendingTableChars = { list: [], hasNonWs: false };
 				originalMode = mode;
 				mode = MODE_IN_TABLE_TEXT;
@@ -6860,8 +7296,8 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				return modes.inHead(t);
 			}
 			if (name === "input") {
-				const ty = _aFind(t.attrs.start, t.attrs.count, "type");
-				if (ty !== 0 && _aValueOf(ty).toLowerCase() === "hidden") {
+				const ty = _findAttr(t.attrs.start, t.attrs.count, "type");
+				if (ty !== 0 && _attrValueOf(ty).toLowerCase() === "hidden") {
 					insertHtmlElement("input", t.attrs, t.pos);
 					open.pop();
 					return;
@@ -6931,7 +7367,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const clearStackToTableContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (_ns(c) === NS_HTML && CLEAR_TABLE.has(_tag(c))) {
+			if (_namespaceOf(c) === NS_HTML && CLEAR_TABLE.has(_tagNameOf(c))) {
 				break;
 			}
 			open.pop();
@@ -6940,7 +7376,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const clearStackToTableBodyContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (_ns(c) === NS_HTML && CLEAR_TABLE_BODY.has(_tag(c))) {
+			if (_namespaceOf(c) === NS_HTML && CLEAR_TABLE_BODY.has(_tagNameOf(c))) {
 				break;
 			}
 			open.pop();
@@ -6949,7 +7385,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const clearStackToTableRowContext = () => {
 		while (open.length) {
 			const c = cur();
-			if (_ns(c) === NS_HTML && CLEAR_TABLE_ROW.has(_tag(c))) {
+			if (_namespaceOf(c) === NS_HTML && CLEAR_TABLE_ROW.has(_tagNameOf(c))) {
 				break;
 			}
 			open.pop();
@@ -6982,7 +7418,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		if (t.type === TOKEN_CHAR) {
 			const r = leadingWs(t, true);
 			if (!r) return;
-			if (_tag(cur()) !== "colgroup") return;
+			if (_tagNameOf(cur()) !== "colgroup") return;
 			open.pop();
 			mode = MODE_IN_TABLE;
 			process(r);
@@ -7000,7 +7436,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			return;
 		}
 		if (t.type === TOKEN_END_TAG && t.name === "colgroup") {
-			if (_tag(cur()) !== "colgroup") return;
+			if (_tagNameOf(cur()) !== "colgroup") return;
 			open.pop();
 			mode = MODE_IN_TABLE;
 			return;
@@ -7013,7 +7449,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			return modes.inHead(t);
 		}
 		if (t.type === TOKEN_EOF) return modes.inBody(t);
-		if (_tag(cur()) !== "colgroup") return;
+		if (_tagNameOf(cur()) !== "colgroup") return;
 		open.pop();
 		mode = MODE_IN_TABLE;
 		process(t);
@@ -7196,9 +7632,11 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			return;
 		}
 		if (t.type === TOKEN_END_TAG && t.name === "frameset") {
-			if (_tag(cur()) === "html") return;
+			if (_tagNameOf(cur()) === "html") return;
 			open.pop();
-			if (!fragment && _tag(cur()) !== "frameset") mode = MODE_AFTER_FRAMESET;
+			if (!fragment && _tagNameOf(cur()) !== "frameset") {
+				mode = MODE_AFTER_FRAMESET;
+			}
 			return;
 		}
 		if (t.type === TOKEN_START_TAG && t.name === "frame") {
@@ -7271,7 +7709,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		}
 		fragment = mkEl(ctxName, ctxNs, EMPTY_ATTRS, null);
 		const htmlEl = mkEl("html", NS_HTML, EMPTY_ATTRS, null);
-		_hAppend(doc, htmlEl);
+		_appendChild(doc, htmlEl);
 		open.push(htmlEl);
 		if (ctxNs !== NS_HTML) {
 			mode = MODE_IN_BODY;
@@ -7297,7 +7735,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	}
 
 	// ---------- tokenizer callbacks ----------
-	const decode = decodeHtmlEntities;
+	const decode = decodeEntities;
 
 	let swallowNextNewline = false;
 	// Set by the tokenizer when it hits EOF mid-tag; such a partial tag is
@@ -7326,12 +7764,12 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 	const dispatch = () =>
 		process(/** @type {Token} */ (/** @type {unknown} */ (tok)));
 
-	walkHtmlTokens(source, 0, {
+	tokenize(source, pos, {
 		isForeign: () => {
 			const ac = adjustedCurrent();
-			return open.length > 0 && ac !== 0 && _ns(ac) !== NS_HTML;
+			return open.length > 0 && ac !== 0 && _namespaceOf(ac) !== NS_HTML;
 		},
-		fragmentContext: fragment ? _tag(fragment) : undefined,
+		fragmentContext: fragment ? _tagNameOf(fragment) : undefined,
 		parseError: (input, code) => {
 			if (code === "eof-in-tag") eofInTag = true;
 		},
@@ -7353,7 +7791,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			// The tokenizer emits CDATA sections through this callback too.
 			if (input.startsWith("<![CDATA[", start)) {
 				const ac = adjustedCurrent();
-				if (open.length > 0 && ac && _ns(ac) !== NS_HTML) {
+				if (open.length > 0 && ac && _namespaceOf(ac) !== NS_HTML) {
 					const innerEnd = input.endsWith("]]>", end) ? end - 3 : end;
 					const data = input.slice(start + 9, innerEnd).replace(/\r\n?/g, "\n");
 					if (data !== "") {
@@ -7424,11 +7862,13 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			const top = adjustedCurrent();
 			const rawMode =
 				mode === MODE_TEXT ||
-				(top && _ns(top) === NS_HTML && _tag(top) === "plaintext");
+				(top &&
+					_namespaceOf(top) === NS_HTML &&
+					_tagNameOf(top) === "plaintext");
 			const noDecode =
 				top &&
-				_ns(top) === NS_HTML &&
-				NO_DECODE_TEXT.has(_tag(top)) &&
+				_namespaceOf(top) === NS_HTML &&
+				NO_DECODE_TEXT.has(_tagNameOf(top)) &&
 				(mode === MODE_TEXT || mode === MODE_IN_BODY);
 			let data = noDecode ? s : decode(s, false);
 			// In RAWTEXT/RCDATA/script/PLAINTEXT, NULL becomes U+FFFD (tokenizer
@@ -7449,12 +7889,12 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 		},
 		attribute: (input, nameStart, nameEnd, valueStart, valueEnd, quoteType) => {
 			const name = internLowerName(ATTR_NAME_INTERN, input, nameStart, nameEnd);
-			if (pendAttrStart === 0) pendAttrStart = _aN + 1;
+			if (pendAttrStart === 0) pendAttrStart = _attrCount + 1;
 			// Drop duplicate attribute names (per spec). Plain loop avoids a
 			// per-attribute closure allocation on this hot path.
 			let dup = false;
-			for (let i = pendAttrStart; i <= _aN; i++) {
-				if (_aName[i] === name) {
+			for (let i = pendAttrStart; i <= _attrCount; i++) {
+				if (_attrNames[i] === name) {
 					dup = true;
 					break;
 				}
@@ -7464,7 +7904,7 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 				// demand: consumers re-resolve requests from it and the offsets must
 				// stay aligned with the source. Only a valueless attribute stores an
 				// override ("").
-				_aAlloc(
+				_allocAttr(
 					name,
 					valueStart !== -1 ? null : "",
 					nameStart,
@@ -7491,7 +7931,8 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
 			// The reused token carries the tag's attribute run; every consumer of
 			// `t.attrs` runs synchronously within this dispatch.
 			tok.attrs.start = pendAttrStart;
-			tok.attrs.count = pendAttrStart === 0 ? 0 : _aN + 1 - pendAttrStart;
+			tok.attrs.count =
+				pendAttrStart === 0 ? 0 : _attrCount + 1 - pendAttrStart;
 			pendAttrStart = 0;
 			tok.selfClosing = selfClosing;
 			tok.swallowNewline = false;
@@ -7532,30 +7973,31 @@ const buildHtmlAst = (source, fragmentContext, skip = EMPTY_SKIP) => {
  * @returns {HtmlNodeRef} clone
  */
 const cloneSubtree = (node) => {
-	const ty = _hTy[node];
-	const clone = _hAlloc(ty, _hSt[node], _hEn[node]);
-	_hStr[clone] = _hStr[node];
+	const ty = _nodeTypes[node];
+	const clone = _allocNode(ty, _nodeStarts[node], _nodeEnds[node]);
+	_nodeStrings[clone] = _nodeStrings[node];
 	if (ty !== NodeType.Element) return clone;
-	_hFl[clone] = _hFl[node];
+	_nodeFlags[clone] = _nodeFlags[node];
 	const attrs = cloneAttrs(node);
-	_hAStart[clone] = attrs.start;
-	_hACount[clone] = attrs.count;
-	_hTagEnd[clone] = _hTagEnd[node];
-	_hNameEnd[clone] = _hNameEnd[node];
+	_nodeAttrStarts[clone] = attrs.start;
+	_nodeAttrCounts[clone] = attrs.count;
+	_nodeTagEnds[clone] = _nodeTagEnds[node];
+	_nodeNameEnds[clone] = _nodeNameEnds[node];
 	// Empty body span: the clone re-emits no raw-text dependency.
-	_hCEnd[clone] = _hTagEnd[node];
-	for (let k = _hFirst[node]; k !== 0; k = _hNext[k]) {
-		_hAppend(clone, cloneSubtree(k));
+	_nodeContentEnds[clone] = _nodeTagEnds[node];
+	for (let k = _nodeFirstChildren[node]; k !== 0; k = _nodeNextSiblings[k]) {
+		_appendChild(clone, cloneSubtree(k));
 	}
 	// Clone `<template>` content into the clone's own fragment.
-	const tc = _hTc[node];
+	const tc = _nodeTemplateContents[node];
 	if (tc !== 0) {
-		const fragment = _hAlloc(NodeType.DocumentFragment, 0, 0);
+		const fragment = _allocNode(NodeType.DocumentFragment, 0, 0);
+		_nodeStrings[fragment] = "";
 		// Parent link so the iterative walk can ascend out of the content.
-		_hParent[fragment] = clone;
-		_hTc[clone] = fragment;
-		for (let k = _hFirst[tc]; k !== 0; k = _hNext[k]) {
-			_hAppend(fragment, cloneSubtree(k));
+		_nodeParents[fragment] = clone;
+		_nodeTemplateContents[clone] = fragment;
+		for (let k = _nodeFirstChildren[tc]; k !== 0; k = _nodeNextSiblings[k]) {
+			_appendChild(fragment, cloneSubtree(k));
 		}
 	}
 	return clone;
@@ -7572,17 +8014,19 @@ const selectedOption = (select) => {
 	const options = [];
 	/** @param {HtmlElement} el element */
 	const collect = (el) => {
-		for (let c = _hFirst[el]; c !== 0; c = _hNext[c]) {
-			if (_hTy[c] !== NodeType.Element || _ns(c) !== NS_HTML) continue;
-			if (_hStr[c] === "option") options.push(c);
-			else if (_hStr[c] === "optgroup") collect(c);
+		for (let c = _nodeFirstChildren[el]; c !== 0; c = _nodeNextSiblings[c]) {
+			if (_nodeTypes[c] !== NodeType.Element || _namespaceOf(c) !== NS_HTML) {
+				continue;
+			}
+			if (_nodeStrings[c] === "option") options.push(c);
+			else if (_nodeStrings[c] === "optgroup") collect(c);
 		}
 	};
 	collect(select);
 	if (options.length === 0) return 0;
 	for (let i = options.length - 1; i >= 0; i--) {
 		const el = options[i];
-		if (_aFind(_hAStart[el], _hACount[el], "selected") !== 0) {
+		if (_findAttr(_nodeAttrStarts[el], _nodeAttrCounts[el], "selected") !== 0) {
 			return el;
 		}
 	}
@@ -7597,24 +8041,32 @@ const selectedOption = (select) => {
  */
 const mirrorSelectedContent = (node, select) => {
 	// A `<template>`'s children live in its content fragment.
-	const tc = _hTc[node];
+	const tc = _nodeTemplateContents[node];
 	const container = tc !== 0 ? tc : node;
-	for (let child = _hFirst[container]; child !== 0; child = _hNext[child]) {
-		if (_hTy[child] !== NodeType.Element) continue;
-		if (_ns(child) === NS_HTML && _hStr[child] === "select") {
+	for (
+		let child = _nodeFirstChildren[container];
+		child !== 0;
+		child = _nodeNextSiblings[child]
+	) {
+		if (_nodeTypes[child] !== NodeType.Element) continue;
+		if (_namespaceOf(child) === NS_HTML && _nodeStrings[child] === "select") {
 			mirrorSelectedContent(child, child);
 		} else if (
 			select !== 0 &&
-			_ns(child) === NS_HTML &&
-			_hStr[child] === "selectedcontent"
+			_namespaceOf(child) === NS_HTML &&
+			_nodeStrings[child] === "selectedcontent"
 		) {
 			const option = selectedOption(select);
 			if (option !== 0) {
 				// Replace the children with clones of the option's subtree.
-				_hFirst[child] = 0;
-				_hLast[child] = 0;
-				for (let k = _hFirst[option]; k !== 0; k = _hNext[k]) {
-					_hAppend(child, cloneSubtree(k));
+				_nodeFirstChildren[child] = 0;
+				_nodeLastChildren[child] = 0;
+				for (
+					let k = _nodeFirstChildren[option];
+					k !== 0;
+					k = _nodeNextSiblings[k]
+				) {
+					_appendChild(child, cloneSubtree(k));
 				}
 			}
 		} else {
@@ -7661,7 +8113,7 @@ const parseDoctype = (/** @type {string} */ raw) => {
 
 /**
  * @typedef {object} HtmlProcessOptions
- * @property {string=} fragmentContext context element tag name for fragment parsing (see `buildHtmlAst`); the HTML analog of the CSS parser's `as` parse-mode option
+ * @property {string=} fragmentContext context element tag name for fragment parsing (see `parseHtml`); the HTML analog of the CSS parser's `as` parse-mode option
  * @property {HtmlAstSkip=} skip node kinds to omit from the AST for speed/memory (see `HtmlAstSkip`)
  */
 
@@ -7674,26 +8126,26 @@ const parseDoctype = (/** @type {string} */ raw) => {
  * @param {HtmlProcessOptions} options process options
  */
 const grammar = (input, visitors, options) => {
-	const root = buildHtmlAst(input, options.fragmentContext, options.skip);
+	const root = parseHtml(input, 0, options);
 
 	// Iterative depth-first walk over the link columns: `firstChild`
 	// / `nextSibling` descend, the `parent` column ascends, so arbitrarily deep
 	// markup can't overflow the call stack (the old recursive walk died at
 	// ~10⁵ nesting). A `<template>`'s content fragment is visited before the
 	// element's children; ascending out of it continues with those children
-	// (the fragment is never in a sibling chain, `_hNext` = 0).
+	// (the fragment is never in a sibling chain, `_nodeNextSiblings` = 0).
 	/**
 	 * Fire a node's `enter` visitors; true when the walk may descend.
 	 * @param {HtmlNodeRef} node node
 	 * @returns {boolean} false when a visitor called `skipChildren()`
 	 */
 	const enter = (node) => {
-		const b = visitors[_hTy[node]];
+		const b = visitors[_nodeTypes[node]];
 		if (b === undefined || b.enter.length === 0) return true;
 		_walkSkip = false;
-		_curNode = node;
-		const p = _hParent[node];
-		_curParent = p === 0 ? null : p;
+		_currentNode = node;
+		const p = _nodeParents[node];
+		_currentParent = p === 0 ? null : p;
 		const e = b.enter;
 		for (let i = 0; i < e.length; i++) e[i](A);
 		const skip = _walkSkip;
@@ -7705,11 +8157,11 @@ const grammar = (input, visitors, options) => {
 	 * @param {HtmlNodeRef} node node
 	 */
 	const exit = (node) => {
-		const b = visitors[_hTy[node]];
+		const b = visitors[_nodeTypes[node]];
 		if (b === undefined) return;
-		_curNode = node;
-		const p = _hParent[node];
-		_curParent = p === 0 ? null : p;
+		_currentNode = node;
+		const p = _nodeParents[node];
+		_currentParent = p === 0 ? null : p;
 		const x = b.exit;
 		for (let i = 0; i < x.length; i++) x[i](A);
 	};
@@ -7719,13 +8171,13 @@ const grammar = (input, visitors, options) => {
 	 * @returns {HtmlNodeRef} first inner node (0 = leaf)
 	 */
 	const firstInner = (node) => {
-		const ty = _hTy[node];
+		const ty = _nodeTypes[node];
 		if (ty === NodeType.Element) {
-			const tc = _hTc[node];
-			return tc !== 0 ? tc : _hFirst[node];
+			const tc = _nodeTemplateContents[node];
+			return tc !== 0 ? tc : _nodeFirstChildren[node];
 		}
 		if (ty === NodeType.Document || ty === NodeType.DocumentFragment) {
-			return _hFirst[node];
+			return _nodeFirstChildren[node];
 		}
 		return 0;
 	};
@@ -7743,16 +8195,16 @@ const grammar = (input, visitors, options) => {
 		for (;;) {
 			exit(node);
 			if (node === root) break descend;
-			const parent = _hParent[node];
+			const parent = _nodeParents[node];
 			// Out of a template's content fragment: the element's children follow.
-			if (_hTc[parent] === node) {
-				const first = _hFirst[parent];
+			if (_nodeTemplateContents[parent] === node) {
+				const first = _nodeFirstChildren[parent];
 				if (first !== 0) {
 					node = first;
 					continue descend;
 				}
 			} else {
-				const sibling = _hNext[node];
+				const sibling = _nodeNextSiblings[node];
 				if (sibling !== 0) {
 					node = sibling;
 					continue descend;
@@ -7764,7 +8216,7 @@ const grammar = (input, visitors, options) => {
 
 	// The walk consumed the tree: release the side arrays' heap references so
 	// the reused columns don't pin this parse's strings until the next parse.
-	_hRelease();
+	_releaseAstColumns();
 };
 
 /**
@@ -7772,14 +8224,16 @@ const grammar = (input, visitors, options) => {
  * `grammar`. Babel-style usage:
  *
  * ```
- * processor.use({ [NodeType.Element]: (path) => {}, [NodeType.Comment]: { enter, exit } });
- * processor.process(source);
+ * new SourceProcessor({ skip }).use({ [NodeType.Element]: (path) => {}, [NodeType.Comment]: { enter, exit } }).process(source);
  * ```
  * @extends {GenericSourceProcessor<HtmlPath, HtmlProcessOptions>}
  */
 class SourceProcessor extends GenericSourceProcessor {
-	constructor() {
-		super(grammar);
+	/**
+	 * @param {HtmlProcessOptions=} options default process options (`skip`, `fragmentContext`) merged under each `process` call's own options
+	 */
+	constructor(options) {
+		super(grammar, options);
 	}
 }
 
@@ -7974,7 +8428,7 @@ const parseSrcset = (input) => {
 	/**
 	 * @returns {void}
 	 */
-	function tokenize() {
+	function tokenizeDescriptor() {
 		// 8.1. Descriptor tokenizer: Skip whitespace
 		collectCharacters(LEADING_SPACES_REGEXP);
 
@@ -8128,22 +8582,162 @@ const parseSrcset = (input) => {
 		}
 		//	Otherwise, follow these sub steps:
 		else {
-			tokenize();
+			tokenizeDescriptor();
 		}
 
 		// 16. Return to the step labeled splitting loop.
 	}
 };
 
+// The spec's "URL-potentially-surrounded-by-spaces" cleanup: C0 controls,
+// DEL..C1 and U+00A0 are stripped from the value after the whitespace trim.
+// eslint-disable-next-line no-control-regex
+const IGNORE_CHARS_REGEXP = /[\u0000-\u001F\u007F-\u009F\u00A0]/g;
+
+/**
+ * Parse a `src`-like URL attribute value: trim ASCII whitespace / U+00A0 from
+ * both ends (offsets preserved for source rewriting), then strip ignorable
+ * control characters. Throws when nothing remains.
+ * @param {string} input attribute value
+ * @returns {ParsedSource[]} parsed src
+ */
+const parseSrc = (input) => {
+	const len = input.length;
+	if (len === 0) throw new Error("Must be non-empty");
+
+	let start = 0;
+	let end = len;
+
+	while (start < end) {
+		const code = input.charCodeAt(start);
+		if (code > 32 && code !== 160) break;
+		start++;
+	}
+
+	if (start === end) throw new Error("Must be non-empty");
+
+	while (end > start) {
+		const code = input.charCodeAt(end - 1);
+		if (code > 32 && code !== 160) break;
+		end--;
+	}
+
+	let value = input.slice(start, end);
+
+	if (IGNORE_CHARS_REGEXP.test(value)) {
+		value = value.replace(IGNORE_CHARS_REGEXP, "");
+		if (value.length === 0) throw new Error("Must be non-empty");
+	}
+
+	return [[value, start, end]];
+};
+
+/**
+ * Extracts the `icon-uri` value of an `msapplication-task` meta content
+ * (`name=…;action-uri=…;icon-uri=…`) — the other parts are page URLs, not assets.
+ * @param {string} input input
+ * @returns {ParsedSource[]} parsed icon-uri
+ */
+const parseMsapplicationTask = (input) => {
+	const len = input.length;
+	let pos = 0;
+	while (pos < len) {
+		let sep = input.indexOf(";", pos);
+		if (sep === -1) sep = len;
+		const eq = input.indexOf("=", pos);
+		if (eq !== -1 && eq < sep) {
+			const key = input.slice(pos, eq).trim().toLowerCase();
+			if (key === "icon-uri") {
+				let start = eq + 1;
+				let end = sep;
+				while (start < end && isSpace(input.charCodeAt(start))) {
+					start++;
+				}
+				while (end > start && isSpace(input.charCodeAt(end - 1))) {
+					end--;
+				}
+				if (start === end) return [];
+				return [[input.slice(start, end), start, end]];
+			}
+		}
+		pos = sep + 1;
+	}
+	return [];
+};
+
+// CSS syntax is loaded on first `parseCssUrls` call, not at module load —
+// `HtmlGenerator` deliberately defers it the same way, and most documents
+// never carry a URL-bearing SVG presentation attribute.
+/** @type {typeof import("../css/syntax") | undefined} */
+let _cssSyntax;
+
+/**
+ * Extracts `url(...)` references from a CSS value (an SVG presentation
+ * attribute). Reuses webpack's CSS lexer so quoting/escaping match the CSS
+ * spec; returns the `parseSrc` shape so the shared emit path maps and rewrites
+ * the spans. Unquoted `url(path)` rewrites the content span; quoted
+ * `url("path")` rewrites the inner string span (quotes preserved).
+ * @param {string} input attribute value (a CSS component-value list)
+ * @returns {ParsedSource[]} url references
+ */
+const parseCssUrls = (input) => {
+	const {
+		TT_EOF,
+		TT_FUNCTION,
+		TT_STRING,
+		TT_URL,
+		TT_WHITESPACE,
+		TokenStream,
+		equalsLowerCase
+	} = _cssSyntax || (_cssSyntax = require("../css/syntax"));
+	const ts = new TokenStream(input);
+	/** @type {ParsedSource[]} */
+	const result = [];
+	for (;;) {
+		const t = ts.consume();
+		if (t.type === TT_EOF) break;
+		if (t.type === TT_URL) {
+			if (t.contentEnd > t.contentStart) {
+				result.push([
+					input.slice(t.contentStart, t.contentEnd),
+					t.contentStart,
+					t.contentEnd
+				]);
+			}
+		} else if (
+			t.type === TT_FUNCTION &&
+			equalsLowerCase(input.slice(t.start, t.end - 1), "url")
+		) {
+			let s = ts.consume();
+			while (s.type === TT_WHITESPACE) s = ts.consume();
+			if (s.type === TT_STRING) {
+				const quote = input.charCodeAt(s.start);
+				const innerStart = s.start + 1;
+				// Drop the closing quote, unless the string is unterminated at EOF.
+				const innerEnd =
+					input.charCodeAt(s.end - 1) === quote ? s.end - 1 : s.end;
+				if (innerEnd > innerStart) {
+					result.push([
+						input.slice(innerStart, innerEnd),
+						innerStart,
+						innerEnd
+					]);
+				}
+			}
+		}
+	}
+	return result;
+};
+
 // Babel's `path.skip()`, children-only: set by `A.skipChildren()` during an
 // `enter` dispatch, consumed by the walk.
 let _walkSkip = false;
 // The walk's current position (`A.node` / `A.parent` read these; module-level
 // so the accessor methods' defaults avoid self-referential `this` typing).
 /** @type {HtmlNodeRef} */
-let _curNode = 0;
+let _currentNode = 0;
 /** @type {HtmlNodeRef | null} */
-let _curParent = null;
+let _currentParent = null;
 
 /* eslint-disable jsdoc/require-template -- `A` below is the accessor const, not a type parameter */
 /**
@@ -8156,20 +8750,20 @@ let _curParent = null;
 // AST field-access seam (mirrors the CSS parser's `A`): every AST field a
 // consumer reads goes through one of these accessors, so the node
 // representation can change underneath without touching consumers. `n` is an
-// `HtmlNodeRef`; results are valid until the next `buildHtmlAst` call.
+// `HtmlNodeRef`; results are valid until the next `parseHtml` call.
 const A = {
 	// === path position (rebound by the walk before every visitor call) ===
 	/**
 	 * @returns {HtmlNodeRef} current node — only valid during a visitor callback
 	 */
 	get node() {
-		return _curNode;
+		return _currentNode;
 	},
 	/**
 	 * @returns {HtmlNodeRef | null} enclosing node (null = the document root)
 	 */
 	get parent() {
-		return _curParent;
+		return _currentParent;
 	},
 	/** Stop the walk descending into the current node (enter only). */
 	skipChildren() {
@@ -8180,43 +8774,43 @@ const A = {
 	 * @param {HtmlNodeRef=} n node
 	 * @returns {number} `NodeType`
 	 */
-	type(n = _curNode) {
-		return _hTy[n];
+	type(n = _currentNode) {
+		return _nodeTypes[n];
 	},
 	/**
 	 * @param {HtmlNodeRef=} n node
 	 * @returns {number} start offset
 	 */
-	start(n = _curNode) {
-		return _hSt[n];
+	start(n = _currentNode) {
+		return _nodeStarts[n];
 	},
 	/**
 	 * @param {HtmlNodeRef=} n node
 	 * @returns {number} end offset
 	 */
-	end(n = _curNode) {
-		return _hEn[n];
+	end(n = _currentNode) {
+		return _nodeEnds[n];
 	},
 	/**
 	 * @param {HtmlElement=} n element
 	 * @returns {string} lowercased (foreign-content: adjusted) tag name
 	 */
-	tagName(n = _curNode) {
-		return _hStr[n];
+	tagName(n = _currentNode) {
+		return _nodeStrings[n];
 	},
 	/**
 	 * @param {HtmlElement=} n element
 	 * @returns {number} `NS_*` namespace
 	 */
-	namespace(n = _curNode) {
-		return _hFl[n] & NS_MASK;
+	namespace(n = _currentNode) {
+		return _nodeFlags[n] & NS_MASK;
 	},
 	/**
 	 * @param {HtmlElement=} n element
 	 * @returns {boolean} true for void elements
 	 */
-	selfClosing(n = _curNode) {
-		return (_hFl[n] & FLAG_SELF_CLOSING) !== 0;
+	selfClosing(n = _currentNode) {
+		return (_nodeFlags[n] & FLAG_SELF_CLOSING) !== 0;
 	},
 	// materialized attribute list — test/tooling convenience, allocates; the
 	// parser reads attributes through the scalar accessors below
@@ -8224,18 +8818,18 @@ const A = {
 	 * @param {HtmlElement=} n element
 	 * @returns {HtmlAttribute[]} materialized attributes
 	 */
-	attributes(n = _curNode) {
+	attributes(n = _currentNode) {
 		const out = [];
-		const start = _hAStart[n];
-		for (let i = start; i < start + _hACount[n]; i++) {
+		const start = _nodeAttrStarts[n];
+		for (let i = start; i < start + _nodeAttrCounts[n]; i++) {
 			out.push({
-				name: _aName[i],
-				value: _aValueOf(i),
-				serializedName: _aSerializedName(i),
-				nameStart: _aNameStart[i],
-				nameEnd: _aNameEnd[i],
-				valueStart: _aValStart[i],
-				valueEnd: _aValEnd[i]
+				name: _attrNames[i],
+				value: _attrValueOf(i),
+				serializedName: _attrSerializedName(i),
+				nameStart: _attrNameStarts[i],
+				nameEnd: _attrNameEnds[i],
+				valueStart: _attrValueStarts[i],
+				valueEnd: _attrValueEnds[i]
 			});
 		}
 		return out;
@@ -8244,8 +8838,8 @@ const A = {
 	 * @param {HtmlElement=} n element
 	 * @returns {number} attribute count
 	 */
-	attributeCount(n = _curNode) {
-		return _hACount[n];
+	attributeCount(n = _currentNode) {
+		return _nodeAttrCounts[n];
 	},
 	/**
 	 * The i-th attribute of an element, as an id for the `attribute*` reads.
@@ -8253,8 +8847,8 @@ const A = {
 	 * @param {HtmlElement=} n element
 	 * @returns {HtmlAttributeRef} attribute ref
 	 */
-	attributeAt(i, n = _curNode) {
-		return _hAStart[n] + i;
+	attributeAt(i, n = _currentNode) {
+		return _nodeAttrStarts[n] + i;
 	},
 	/**
 	 * Linear lookup by (lowercased) name.
@@ -8262,92 +8856,92 @@ const A = {
 	 * @param {HtmlElement=} n element
 	 * @returns {HtmlAttributeRef} attribute ref (0 = not present)
 	 */
-	findAttribute(name, n = _curNode) {
-		return _aFind(_hAStart[n], _hACount[n], name);
+	findAttribute(name, n = _currentNode) {
+		return _findAttr(_nodeAttrStarts[n], _nodeAttrCounts[n], name);
 	},
 	/**
 	 * @param {HtmlAttributeRef} a attribute ref
 	 * @returns {string} lowercased (foreign-content: adjusted) attribute name
 	 */
 	attributeName(a) {
-		return _aName[a];
+		return _attrNames[a];
 	},
 	/**
 	 * @param {HtmlAttributeRef} a attribute ref
 	 * @returns {string} raw (undecoded) attribute value ("" when valueless)
 	 */
 	attributeValue(a) {
-		return _aValueOf(a);
+		return _attrValueOf(a);
 	},
 	/**
 	 * @param {HtmlAttributeRef} a attribute ref
 	 * @returns {number} name start offset
 	 */
 	attributeNameStart(a) {
-		return _aNameStart[a];
+		return _attrNameStarts[a];
 	},
 	/**
 	 * @param {HtmlAttributeRef} a attribute ref
 	 * @returns {number} name end offset
 	 */
 	attributeNameEnd(a) {
-		return _aNameEnd[a];
+		return _attrNameEnds[a];
 	},
 	/**
 	 * @param {HtmlAttributeRef} a attribute ref
 	 * @returns {number} value start offset (-1 when valueless or on adoption-agency clones)
 	 */
 	attributeValueStart(a) {
-		return _aValStart[a];
+		return _attrValueStarts[a];
 	},
 	/**
 	 * @param {HtmlAttributeRef} a attribute ref
 	 * @returns {number} value end offset
 	 */
 	attributeValueEnd(a) {
-		return _aValEnd[a];
+		return _attrValueEnds[a];
 	},
 	/**
 	 * @param {HtmlElement=} n element
 	 * @returns {number} end offset of the opening tag (after `>`)
 	 */
-	tagEnd(n = _curNode) {
-		return _hTagEnd[n];
+	tagEnd(n = _currentNode) {
+		return _nodeTagEnds[n];
 	},
 	/**
 	 * @param {HtmlElement=} n element
 	 * @returns {number} end offset of the tag name
 	 */
-	nameEnd(n = _curNode) {
-		return _hNameEnd[n];
+	nameEnd(n = _currentNode) {
+		return _nodeNameEnds[n];
 	},
 	/**
 	 * @param {HtmlElement=} n element
 	 * @returns {number} under `skip.text`, end offset of a raw-text element's body (`tagEnd` when empty)
 	 */
-	contentEnd(n = _curNode) {
-		return _hCEnd[n];
+	contentEnd(n = _currentNode) {
+		return _nodeContentEnds[n];
 	},
 	/**
 	 * @param {HtmlElement=} n element
 	 * @returns {HtmlDocumentFragment} `<template>` content fragment (0 = none)
 	 */
-	templateContent(n = _curNode) {
-		return _hTc[n];
+	templateContent(n = _currentNode) {
+		return _nodeTemplateContents[n];
 	},
 	/**
 	 * @param {HtmlText | HtmlComment=} n text / comment node
 	 * @returns {string} decoded text / comment data
 	 */
-	data(n = _curNode) {
-		return _hStr[n];
+	data(n = _currentNode) {
+		return _nodeStrings[n];
 	},
 	/**
 	 * @param {HtmlDoctype=} n doctype node
 	 * @returns {string} doctype name
 	 */
-	doctypeName(n = _curNode) {
-		return _hStr[n];
+	doctypeName(n = _currentNode) {
+		return _nodeStrings[n];
 	},
 	// The doctype ids are per-parse scalars (a document has at most one
 	// doctype node); the node parameter is accepted for call-shape uniformity.
@@ -8356,44 +8950,46 @@ const A = {
 	 * @returns {string | null} doctype public id
 	 */
 	doctypePublicId(_n) {
-		return _hDocPub;
+		return _doctypePublicId;
 	},
 	/**
 	 * @param {HtmlDoctype=} _n doctype node
 	 * @returns {string | null} doctype system id
 	 */
 	doctypeSystemId(_n) {
-		return _hDocSys;
+		return _doctypeSystemId;
 	},
 	// === tree links (0 = none) ===
 	/**
 	 * @param {HtmlNodeRef=} n node
 	 * @returns {HtmlNodeRef} first child
 	 */
-	firstChild(n = _curNode) {
-		return _hFirst[n];
+	firstChild(n = _currentNode) {
+		return _nodeFirstChildren[n];
 	},
 	/**
 	 * @param {HtmlNodeRef=} n node
 	 * @returns {HtmlNodeRef} next sibling
 	 */
-	nextSibling(n = _curNode) {
-		return _hNext[n];
+	nextSibling(n = _currentNode) {
+		return _nodeNextSiblings[n];
 	},
 	/**
 	 * @param {HtmlNodeRef=} n node
 	 * @returns {HtmlNodeRef} parent node (a `<template>`'s content links to its fragment)
 	 */
-	parentOf(n = _curNode) {
-		return _hParent[n];
+	parentOf(n = _currentNode) {
+		return _nodeParents[n];
 	},
 	/**
 	 * @param {HtmlNodeRef=} n node
 	 * @returns {HtmlNodeRef[]} materialized child list — test/tooling convenience, allocates
 	 */
-	children(n = _curNode) {
+	children(n = _currentNode) {
 		const out = [];
-		for (let c = _hFirst[n]; c !== 0; c = _hNext[c]) out.push(c);
+		for (let c = _nodeFirstChildren[n]; c !== 0; c = _nodeNextSiblings[c]) {
+			out.push(c);
+		}
 		return out;
 	}
 };
@@ -8406,12 +9002,19 @@ module.exports.NodeType = NodeType;
 module.exports.QUOTE_DOUBLE = QUOTE_DOUBLE;
 module.exports.QUOTE_NONE = QUOTE_NONE;
 module.exports.QUOTE_SINGLE = QUOTE_SINGLE;
-module.exports.SVG_TAG_ADJUST = SVG_TAG_ADJUST;
-module.exports.SourceProcessor = SourceProcessor;
 // Exposed so HtmlParser can map user-configured (lowercased) tag names to
 // the adjusted camelCase names the AST carries for foreign content.
-module.exports.buildHtmlAst = buildHtmlAst;
-module.exports.decodeHtmlEntities = decodeHtmlEntities;
-module.exports.decodeHtmlEntitiesWithMap = decodeHtmlEntitiesWithMap;
+module.exports.SVG_TAG_ADJUST = SVG_TAG_ADJUST;
+module.exports.SourceProcessor = SourceProcessor;
+module.exports.decodeEntities = decodeEntities;
+module.exports.escapeAttribute = escapeAttribute;
+module.exports.escapeText = escapeText;
+// WHATWG "ASCII whitespace" (tab / LF / FF / CR / space) — the tokenizer's
+// whitespace class, exported under the spec's name.
+module.exports.isAsciiWhitespace = isSpace;
+module.exports.parseCssUrls = parseCssUrls;
+module.exports.parseHtml = parseHtml;
+module.exports.parseMsapplicationTask = parseMsapplicationTask;
+module.exports.parseSrc = parseSrc;
 module.exports.parseSrcset = parseSrcset;
-module.exports.walkHtmlTokens = walkHtmlTokens;
+module.exports.tokenize = tokenize;