From 5cecfe19011f9f67c21ef149c6b35d61b1c567ef Mon Sep 17 00:00:00 2001
From: Kiko Beats <josefrancisco.verdu@gmail.com>
Date: Tue, 27 Oct 2026 20:26:59 +0100
Subject: [PATCH 1/5] perf(parse): stream script tags with htmlparser2 instead
 of building a himalaya AST

himalaya tokenizes, builds a full node tree, and walks it just to find
<script> tags. htmlparser2's streaming Parser with onopentagname/onattribute
collects attributes only for script tags and builds no tree.

A/B, node benchmark/index.js, 6 alternating runs per side, median (range):

| case                 | base               | change             | delta  |
| -------------------- | ------------------ | ------------------ | ------ |
| getScripts 1MB page  | 75.1ms (72.4-77.0) | 36.0ms (35.6-36.9) | -52.1% |
| getScripts 20KB page | 72.2ms (69.6-74.2) | 45.8ms (45.3-46.2) | -36.6% |

Output changes (spec-correct, each covered by a test):
- attribute names are lowercased (<SCRIPT SRC> gave {SRC})
- entities in attribute values are decoded (&amp; stayed literal)
- unquoted values containing "/" are kept (src=/m.js gave src: true)
- scripts after a stray </script> are found (himalaya dropped them)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 package.json                 |   2 +-
 src/index.js                 |  40 +++++++++++----------
 test/index.js                |  65 +++++++++++++++++++++++++++++++++++
 test/snapshots/index.js.md   |   2 +-
 test/snapshots/index.js.snap | Bin 464 -> 464 bytes
 5 files changed, 88 insertions(+), 21 deletions(-)

diff --git a/package.json b/package.json
index 2787119..5a3f56d 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "src"
   ],
   "dependencies": {
-    "himalaya": "~1.1.0"
+    "htmlparser2": "~10.1.0"
   },
   "devDependencies": {
     "@commitlint/cli": "latest",
diff --git a/src/index.js b/src/index.js
index ba3df43..a14c008 100644
--- a/src/index.js
+++ b/src/index.js
@@ -1,28 +1,30 @@
 'use strict'
 
-const { parse } = require('himalaya')
+const { Parser } = require('htmlparser2')
 
-const getValue = value => {
-  if (value === null) return true
+const getValue = (value, quote) => {
+  if (quote === undefined) return true
   if (value === '1') return true
   return value
 }
 
-const fromPairs = collection =>
-  collection.reduce((acc, { key, value }) => {
-    acc[key] = getValue(value)
-    return acc
-  }, {})
-
-const collectScripts = (nodes, acc = []) => {
-  for (const node of nodes) {
-    if (node.tagName === 'script') acc.push(node)
-    if (node.children) collectScripts(node.children, acc)
-  }
-  return acc
-}
-
 module.exports = html => {
-  const scripts = collectScripts(parse(html))
-  return scripts.map(({ attributes }) => fromPairs(attributes))
+  const scripts = []
+  let attributes = null
+  let templateDepth = 0
+  const parser = new Parser({
+    onopentagname: name => {
+      if (name === 'template') templateDepth++
+      attributes = name === 'script' && templateDepth === 0 ? {} : null
+      if (attributes) scripts.push(attributes)
+    },
+    onattribute: (name, value, quote) => {
+      if (attributes) attributes[name] = getValue(value, quote)
+    },
+    onclosetag: name => {
+      if (name === 'template') templateDepth--
+    }
+  })
+  parser.end(html)
+  return scripts
 }
diff --git a/test/index.js b/test/index.js
index 09a28e9..1e39d94 100644
--- a/test/index.js
+++ b/test/index.js
@@ -31,3 +31,68 @@ test('detect scripts from instagram iframe', t => {
   const scripts = parseIframe(html)
   t.snapshot(scripts)
 })
+
+test('lowercase attribute names', t => {
+  t.deepEqual(parseIframe('<SCRIPT SRC="/a.js" Async></SCRIPT>'), [
+    { src: '/a.js', async: true }
+  ])
+})
+
+test('decode entities in attribute values', t => {
+  t.deepEqual(
+    parseIframe('<script src="/a.js?x=1&amp;y=&lt;2&gt;"></script>'),
+    [{ src: '/a.js?x=1&y=<2>' }]
+  )
+})
+
+test('map boolean and "1" attribute values to true', t => {
+  t.deepEqual(
+    parseIframe(
+      '<script async defer="1" data-empty="" data-zero="0"></script>'
+    ),
+    [{ async: true, defer: true, 'data-empty': '', 'data-zero': '0' }]
+  )
+})
+
+test('keep the last value of a repeated attribute', t => {
+  t.deepEqual(parseIframe('<script src="/a.js" SRC="/b.js"></script>'), [
+    { src: '/b.js' }
+  ])
+})
+
+test('keep unquoted attribute values containing slashes', t => {
+  t.deepEqual(
+    parseIframe(
+      '<script src=https://cdn.example.com/a.js async></script><script type=module src=/m.js></script>'
+    ),
+    [
+      { src: 'https://cdn.example.com/a.js', async: true },
+      { type: 'module', src: '/m.js' }
+    ]
+  )
+})
+
+test('detect scripts after a stray closing script tag', t => {
+  t.deepEqual(
+    parseIframe('<script>a()</script></script><script src="/b.js"></script>'),
+    [{}, { src: '/b.js' }]
+  )
+})
+
+test('ignore markup inside script content and comments', t => {
+  t.deepEqual(
+    parseIframe(
+      '<script>document.write("<script src=x><\\/script>")</script><!-- <script src="/c.js"></script> --><script src="/d.js"></script>'
+    ),
+    [{}, { src: '/d.js' }]
+  )
+})
+
+test('ignore scripts inside template', t => {
+  t.deepEqual(
+    parseIframe(
+      '<template><script src="/t.js"></script></template><script src="/after.js"></script>'
+    ),
+    [{ src: '/after.js' }]
+  )
+})
diff --git a/test/snapshots/index.js.md b/test/snapshots/index.js.md
index 064df99..f49b5b9 100644
--- a/test/snapshots/index.js.md
+++ b/test/snapshots/index.js.md
@@ -25,7 +25,7 @@ Generated by [AVA](https://avajs.dev).
         async: true,
         crossorigin: 'anonymous',
         defer: true,
-        src: 'https://connect.facebook.net/en_US/sdk.js#xfbml=1&amp;version=v5.0',
+        src: 'https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v5.0',
       },
     ]
 
diff --git a/test/snapshots/index.js.snap b/test/snapshots/index.js.snap
index f7325ff23705a63f6b14fc36ab4a0a7e8fb8f498..e7c9a6a3721b40ef4a3b1e7b9d99388eb55bb83b 100644
GIT binary patch
literal 464
zcmV;>0WbbRRzV<BZeeh9Xm4~Nb~6eC0G8D<jJmw42<O@D2woDmtem{`cv~Vr<HZ`@
zJCIUc2p@|G00000000A}(#>iVK@bP<f6ZnSHOOp;M-Ph;y=adH1ra0o1Rg}tll1iT
z?Dp<<_u5sP$sWa14mtP;@ezCg!PoFTyypXF3Co5M(x>X~s)G7a$8|Z0X3XDzT5&S5
z2M;PM)<~aCa#P`coucnc<3w!gyE<ua9S1$-VHEy$Tvb~1r+*!6;Ox*X%ANq&1+Y!)
zThx7*lAaT_QJ&|ZJ0JpW61{1Q*2Vz70ysJ?{?!(*zb{AD2xW_~*Xx1qf;yla+mziq
zi@ICX)jSX8{FdcQe;a0~6I)s2&ZK_&YALD1$+Yp~p~#e97sYg<rH;v~|MM#oebKmT
zV1?C)Te6*1WVJT7jB$LK*=KrjQ?zabFaz)dz;6J5uZCN@2Hd7ekvS$eaG`y>twRiR
zA7{MWsIs+9s~cU!ecR%i7=ksTS|}B)6gGVM_@UrxtVX<ZP?vtP_x#bmP3&UW+kdH^
zwdN03nY+NE2TA)&7xm9g%{v1C9>C$%*4Z_zFB07^il%AQVw&@{v%a*I8u1B8vn$uJ
G0{{R+qve7C

literal 464
zcmV;>0WbbRRzV<BZeeh9Xm4~Nb~6eC0J%IPZk~)Z54TYdQ<E7MY6o%yaW;y*-}c8=
z(OK=|g&&Iu00000000A}lFdpSK@i8MW?erCv%ws5SX7dW&O{*~ejMTpcn~2ug`S?C
z-FCOT$FABP_b8q`c*rB@BlrM<uaWo2-BQwvEGr^5{Hf~hs-o&gU6*;^$sS(ZDALqd
zXDfvwC8>?l>x!^ldS}{HYa->_y7a;*jaF3Hb%f{FMIlK1{MU%)qQ?XC5U;b{VlBh$
zM`-@=UW@>Omn2C9ixEHsO8|QzX{N{aly$|r4au{I`3d&|@z`y(S`mDRpb<gBG4ZEI
zugS#)j;wsT#mU6qoa_pZipH@6DmS(#f*R;$@V|D6D%{DksxPQ?-lYHMPo*<it&5H#
zOiwT%Tb+ii6jJ5R^<HB33%1`2t?AefSbtb|tiP{=n|TAcCFvca^SYyLcv}$G*^zMr
zoGetRQu*nHp2Ix|aHX@B8%qPI)GEr9{e66tVbNo}t7m0y`um$-gsFCi%A<C6fA~H9
z7PzlX<E|}|=rHmZm-YU=+#4OXhIRQm@AwV8pJV!*Wp!Pr<7u8&Pnld5Oy&X0i;R%9
G0{{Tpr{}f+


From 5116850c2f06415a3009b5668c6f1d7b11f3c0dd Mon Sep 17 00:00:00 2001
From: Kiko Beats <josefrancisco.verdu@gmail.com>
Date: Tue, 27 Oct 2026 20:59:18 +0100
Subject: [PATCH 2/5] docs: boolean attributes come out as true

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 55014c1..ef73502 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ const scripts = getScripts('<blockquote class="twitter-tweet"><p lang="en" dir="
 console.log(scripts)
 // [
 //   {
-//     async: null,
+//     async: true,
 //     charset: 'utf-8',
 //     src: 'https://platform.twitter.com/widgets.js',
 //   },

From 9697d2f48428ff40dbb4080e7c94f12a49ccb37d Mon Sep 17 00:00:00 2001
From: Kiko Beats <josefrancisco.verdu@gmail.com>
Date: Tue, 27 Oct 2026 21:10:21 +0100
Subject: [PATCH 3/5] fix(parse): keep a self-closing script's content as text

htmlparser2 leaves raw-text mode on `<script/>`, so markup inside the script
body was reported as more scripts. Tags seen while a script is open are now
ignored, as browsers do. Input is read with String() so a Buffer parses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/index.js  | 18 +++++++++++++++---
 test/index.js | 25 +++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/src/index.js b/src/index.js
index a14c008..4c0c123 100644
--- a/src/index.js
+++ b/src/index.js
@@ -12,19 +12,31 @@ module.exports = html => {
   const scripts = []
   let attributes = null
   let templateDepth = 0
+  let isInScript = false
   const parser = new Parser({
     onopentagname: name => {
+      attributes = null
+      if (isInScript) return
       if (name === 'template') templateDepth++
-      attributes = name === 'script' && templateDepth === 0 ? {} : null
-      if (attributes) scripts.push(attributes)
+      if (name !== 'script') return
+      isInScript = true
+      if (templateDepth === 0) {
+        attributes = {}
+        scripts.push(attributes)
+      }
     },
     onattribute: (name, value, quote) => {
       if (attributes) attributes[name] = getValue(value, quote)
     },
     onclosetag: name => {
+      if (name === 'script') {
+        isInScript = false
+        return
+      }
+      if (isInScript) return
       if (name === 'template') templateDepth--
     }
   })
-  parser.end(html)
+  parser.end(String(html))
   return scripts
 }
diff --git a/test/index.js b/test/index.js
index 1e39d94..bf80012 100644
--- a/test/index.js
+++ b/test/index.js
@@ -96,3 +96,28 @@ test('ignore scripts inside template', t => {
     [{ src: '/after.js' }]
   )
 })
+
+test('a self-closing script keeps its content as text until </script>', t => {
+  t.deepEqual(
+    parseIframe(
+      '<script src="/a.js"/>var s = "<script src=/evil.js>";</script><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+})
+
+test('a self-closing script inside svg ends right away', t => {
+  t.deepEqual(
+    parseIframe(
+      '<svg><script href="/x.js"/></svg><script src="/y.js"></script>'
+    ),
+    [{ href: '/x.js' }, { src: '/y.js' }]
+  )
+})
+
+test('non-string input is read as a string', t => {
+  t.deepEqual(parseIframe(Buffer.from('<script src="/buf.js"></script>')), [
+    { src: '/buf.js' }
+  ])
+  t.deepEqual(parseIframe(undefined), [])
+})

From 9bbc72a6f671140dcdfad3ffd20a0b3735810de8 Mon Sep 17 00:00:00 2001
From: Kiko Beats <josefrancisco.verdu@gmail.com>
Date: Tue, 27 Oct 2026 21:35:30 +0100
Subject: [PATCH 4/5] fix(parse): never let template depth go negative

A template opened inside a self-closing script's text is skipped, but a
script nested in it closes the raw text first, so the template's real close
tag decremented a depth that was never incremented.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/index.js  | 2 +-
 test/index.js | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/index.js b/src/index.js
index 4c0c123..6eb9b0d 100644
--- a/src/index.js
+++ b/src/index.js
@@ -34,7 +34,7 @@ module.exports = html => {
         return
       }
       if (isInScript) return
-      if (name === 'template') templateDepth--
+      if (name === 'template' && templateDepth > 0) templateDepth--
     }
   })
   parser.end(String(html))
diff --git a/test/index.js b/test/index.js
index bf80012..8027326 100644
--- a/test/index.js
+++ b/test/index.js
@@ -121,3 +121,12 @@ test('non-string input is read as a string', t => {
   ])
   t.deepEqual(parseIframe(undefined), [])
 })
+
+test('a stray </template> after a self-closing script keeps later scripts', t => {
+  t.deepEqual(
+    parseIframe(
+      '<script src="/a.js"/><template><script></script></template><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+})

From d1fc165b5b619a13553e8d8aa8eaaf5fa67fb154 Mon Sep 17 00:00:00 2001
From: Kiko Beats <josefrancisco.verdu@gmail.com>
Date: Tue, 27 Oct 2026 22:07:11 +0000
Subject: [PATCH 5/5] fix(parse): match browser script and raw-text rules

htmlparser2 ends an HTML script on an implied tag and keeps svg/math
title, style, and textarea raw. Follow the script until its real end
tag, and parse those elements as markup in foreign content.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/index.js  | 185 +++++++++++++++++++++++++++++++++++++------
 test/index.js | 215 ++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 377 insertions(+), 23 deletions(-)

diff --git a/src/index.js b/src/index.js
index 6eb9b0d..c38b0ae 100644
--- a/src/index.js
+++ b/src/index.js
@@ -1,42 +1,181 @@
 'use strict'
 
+const { dirname, join } = require('path')
+
 const { Parser } = require('htmlparser2')
+const Tokenizer = require(join(
+  dirname(require.resolve('htmlparser2')),
+  'Tokenizer.js'
+)).default
+
+// htmlparser2 treats title/textarea/style/script as raw text everywhere.
+// In svg/math that is only true for HTML, so parse those tags as markup.
+const IN_TAG_NAME = 3
 
+class ForeignTokenizer extends Tokenizer {
+  stateBeforeSpecialS (char) {
+    if (this.cbs.foreignContext[0] === true) {
+      this.state = IN_TAG_NAME
+      this.stateInTagName(char)
+      return
+    }
+    super.stateBeforeSpecialS(char)
+  }
+
+  stateBeforeSpecialT (char) {
+    if (this.cbs.foreignContext[0] === true) {
+      this.state = IN_TAG_NAME
+      this.stateInTagName(char)
+      return
+    }
+    super.stateBeforeSpecialT(char)
+  }
+}
+
+// svg/math are foreign content. These elements switch back to HTML.
+// annotation-xml does that only with an HTML encoding, so it is handled apart.
+const FOREIGN_ELEMENTS = new Set(['math', 'svg'])
+const HTML_INTEGRATION_ELEMENTS = new Set([
+  'desc',
+  'foreignobject',
+  'mi',
+  'mn',
+  'mo',
+  'ms',
+  'mtext',
+  'title'
+])
+// style, textarea, xmp, and script are raw in HTML via the tokenizer.
+const RAW_TEXT_ELEMENTS = new Set([
+  'iframe',
+  'noembed',
+  'noframes',
+  'noscript',
+  'plaintext'
+])
 const getValue = (value, quote) => {
   if (quote === undefined) return true
   if (value === '1') return true
   return value
 }
 
+const isHtmlEncoding = value => {
+  const mime = value.toLowerCase()
+  return mime === 'text/html' || mime === 'application/xhtml+xml'
+}
+
+const isWhitespace = code =>
+  code === 9 || code === 10 || code === 12 || code === 13 || code === 32
+
+// Index of the `</script` that ends an HTML script, or the end of the string.
+const findScriptEnd = (source, from) => {
+  for (
+    let index = source.indexOf('<', from);
+    index !== -1;
+    index = source.indexOf('<', index + 1)
+  ) {
+    if (source.slice(index, index + 8).toLowerCase() !== '</script') continue
+    const next = source.charCodeAt(index + 8)
+    if (next === 62 || isWhitespace(next)) return index
+  }
+  return source.length
+}
+
+const isForeignContextElement = name =>
+  FOREIGN_ELEMENTS.has(name) || HTML_INTEGRATION_ELEMENTS.has(name)
+
 module.exports = html => {
+  const source = String(html)
   const scripts = []
   let attributes = null
   let templateDepth = 0
   let isInScript = false
-  const parser = new Parser({
-    onopentagname: name => {
-      attributes = null
-      if (isInScript) return
-      if (name === 'template') templateDepth++
-      if (name !== 'script') return
-      isInScript = true
-      if (templateDepth === 0) {
-        attributes = {}
-        scripts.push(attributes)
+  // Taken when the script opens. htmlparser2 pops an integration point
+  // before the implied close, so the close event is too late to read.
+  let scriptInForeign = false
+  // htmlparser2 drops script-data mode on `<script/>` and then swallows the
+  // real `</script>`. Events before this index are still that script's text.
+  let scriptEnd = -1
+  let rawText = null
+  let sawAnnotation = false
+  let annotationHtml = false
+  let sawAnnotationEncoding = false
+  const annotationHtmlStack = []
+  const foreignContext = [false]
+  const leaveScriptIfEnded = () => {
+    if (scriptEnd !== -1 && parser.endIndex >= scriptEnd) {
+      isInScript = false
+      scriptEnd = -1
+    }
+  }
+  const parser = new Parser(
+    {
+      onopentagname: name => {
+        leaveScriptIfEnded()
+        attributes = null
+        if (isInScript || rawText) return
+        if (FOREIGN_ELEMENTS.has(name)) foreignContext.unshift(true)
+        else if (HTML_INTEGRATION_ELEMENTS.has(name)) {
+          foreignContext.unshift(false)
+        }
+        if (name === 'annotation-xml') sawAnnotation = true
+        // These elements are raw text in HTML only. In svg/math they are markup.
+        if (RAW_TEXT_ELEMENTS.has(name) && foreignContext[0] !== true) {
+          rawText = name
+          return
+        }
+        if (name === 'template') templateDepth++
+        if (name !== 'script') return
+        scriptInForeign = foreignContext[0] === true
+        // A foreign script does not swallow the markup inside it.
+        if (!scriptInForeign) isInScript = true
+        if (templateDepth === 0) {
+          attributes = {}
+          scripts.push(attributes)
+        }
+      },
+      onattribute: (name, value, quote) => {
+        if (sawAnnotation && name === 'encoding' && !sawAnnotationEncoding) {
+          sawAnnotationEncoding = true
+          annotationHtml = isHtmlEncoding(value)
+        }
+        if (attributes) attributes[name] = getValue(value, quote)
+      },
+      onopentag: name => {
+        if (name === 'annotation-xml' && sawAnnotation) {
+          annotationHtmlStack.unshift(annotationHtml)
+          if (annotationHtml) foreignContext.unshift(false)
+          sawAnnotation = false
+          annotationHtml = false
+          sawAnnotationEncoding = false
+        }
+        if (name !== 'script' || !isInScript) return
+        scriptEnd = findScriptEnd(source, parser.endIndex + 1)
+      },
+      onclosetag: (name, isImplied) => {
+        leaveScriptIfEnded()
+        if (rawText) {
+          if (name === rawText && name !== 'plaintext') rawText = null
+          return
+        }
+        if (name === 'script') {
+          if (!isImplied || scriptInForeign) {
+            isInScript = false
+            scriptEnd = -1
+          }
+          return
+        }
+        if (isInScript) return
+        if (name === 'annotation-xml') {
+          if (annotationHtmlStack.shift()) foreignContext.shift()
+          return
+        }
+        if (isForeignContextElement(name)) foreignContext.shift()
+        if (name === 'template' && templateDepth > 0) templateDepth--
       }
     },
-    onattribute: (name, value, quote) => {
-      if (attributes) attributes[name] = getValue(value, quote)
-    },
-    onclosetag: name => {
-      if (name === 'script') {
-        isInScript = false
-        return
-      }
-      if (isInScript) return
-      if (name === 'template' && templateDepth > 0) templateDepth--
-    }
-  })
-  parser.end(String(html))
+    { Tokenizer: ForeignTokenizer }
+  )
+  parser.end(source)
   return scripts
 }
diff --git a/test/index.js b/test/index.js
index 8027326..644862a 100644
--- a/test/index.js
+++ b/test/index.js
@@ -106,6 +106,39 @@ test('a self-closing script keeps its content as text until </script>', t => {
   )
 })
 
+test('a script inside an svg title is a script', t => {
+  t.deepEqual(
+    parseIframe(
+      '<svg><title><script src="/a.js"></script></title></svg><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+  t.deepEqual(
+    parseIframe(
+      '<svg><title><script src="/a.js"/></title></svg><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }]
+  )
+})
+
+test('a script inside an html title is text', t => {
+  t.deepEqual(
+    parseIframe(
+      '<title><script src="/a.js"></script></title><script src="/b.js"></script>'
+    ),
+    [{ src: '/b.js' }]
+  )
+})
+
+test('a script inside an svg script is still a script', t => {
+  t.deepEqual(
+    parseIframe(
+      '<svg><script><script src="/inner.js"></script></script></svg>'
+    ),
+    [{}, { src: '/inner.js' }]
+  )
+})
+
 test('a self-closing script inside svg ends right away', t => {
   t.deepEqual(
     parseIframe(
@@ -115,6 +148,188 @@ test('a self-closing script inside svg ends right away', t => {
   )
 })
 
+test('a self-closing script inside math ends right away', t => {
+  t.deepEqual(
+    parseIframe(
+      '<math><script href="/x.js"/></math><script src="/y.js"></script>'
+    ),
+    [{ href: '/x.js' }, { src: '/y.js' }]
+  )
+})
+
+test('closing an integration point returns to foreign content', t => {
+  t.deepEqual(
+    parseIframe(
+      '<svg><desc></desc><script href="/x.js"/></svg><script src="/y.js"></script>'
+    ),
+    [{ href: '/x.js' }, { src: '/y.js' }]
+  )
+  t.deepEqual(
+    parseIframe(
+      '<math><mi></mi><script href="/x.js"/></math><script src="/y.js"></script>'
+    ),
+    [{ href: '/x.js' }, { src: '/y.js' }]
+  )
+})
+
+test('a self-closing script inside an html integration point stays open', t => {
+  const points = [
+    ['svg', 'foreignObject'],
+    ['svg', 'desc'],
+    ['math', 'mi'],
+    ['math', 'mo'],
+    ['math', 'mn'],
+    ['math', 'ms'],
+    ['math', 'mtext']
+  ]
+  for (const [outer, inner] of points) {
+    t.deepEqual(
+      parseIframe(
+        `<${outer}><${inner}><script src="/a.js"/></${inner}></${outer}><script src="/b.js"></script>`
+      ),
+      [{ src: '/a.js' }],
+      inner
+    )
+  }
+})
+
+test('a script end tag still closes a self-closing html script', t => {
+  t.deepEqual(
+    parseIframe(
+      '<svg><foreignObject><script src="/a.js"/></foreignObject></svg></script><script href="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { href: '/b.js' }]
+  )
+})
+
+test('annotation-xml stays in math without an html encoding', t => {
+  t.deepEqual(
+    parseIframe(
+      '<math><annotation-xml><script src="/a.js"/></annotation-xml></math><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+  t.deepEqual(
+    parseIframe(
+      '<math><annotation-xml><script src="/a.js"/><script src="/inner.js"></script></annotation-xml></math>'
+    ),
+    [{ src: '/a.js' }, { src: '/inner.js' }]
+  )
+  t.deepEqual(
+    parseIframe(
+      '<math><annotation-xml encoding="text/plain" encoding="text/html"><script src="/a.js"/></annotation-xml></math><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+})
+
+test('closing an html annotation-xml returns to math', t => {
+  t.deepEqual(
+    parseIframe(
+      '<math><annotation-xml encoding="text/html"></annotation-xml><script src="/a.js"/></math><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+})
+
+test('annotation-xml with an html encoding keeps the script open', t => {
+  for (const encoding of ['text/html', 'application/xhtml+xml', 'TEXT/HTML']) {
+    t.deepEqual(
+      parseIframe(
+        `<math><annotation-xml encoding="${encoding}"><script src="/a.js"/></annotation-xml></math><script src="/b.js"></script>`
+      ),
+      [{ src: '/a.js' }],
+      encoding
+    )
+  }
+})
+
+test('a script end tag may have whitespace before >', t => {
+  for (const gap of [' ', '\n', '\t', '\r', '\f']) {
+    t.deepEqual(
+      parseIframe(
+        `<div><script src="/a.js"/></div></script${gap}><script src="/b.js"></script>`
+      ),
+      [{ src: '/a.js' }, { src: '/b.js' }],
+      JSON.stringify(gap)
+    )
+  }
+})
+
+test('raw text elements inside svg are markup', t => {
+  t.deepEqual(
+    parseIframe(
+      '<svg><iframe><script src="/a.js"></script></iframe></svg><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+})
+
+test('plaintext has no end tag', t => {
+  t.deepEqual(
+    parseIframe('<plaintext></plaintext><script src="/b.js"></script>'),
+    []
+  )
+})
+
+test('an unclosed script runs to the end of the document', t => {
+  t.deepEqual(parseIframe('<script src="/a.js"/><div><script src="/b.js">'), [
+    { src: '/a.js' }
+  ])
+})
+
+test('an unquoted slash is part of the attribute value', t => {
+  t.deepEqual(parseIframe('<script src=a/><script src="/b.js"></script>'), [
+    { src: 'a/' }
+  ])
+})
+
+test('an end tag inside a script does not close the element around it', t => {
+  t.deepEqual(
+    parseIframe(
+      '<template><script src="/a.js"/></template></script><script src="/b.js"></script>'
+    ),
+    []
+  )
+})
+
+test('raw text elements hide the scripts inside them', t => {
+  for (const tag of ['iframe', 'noembed', 'noframes', 'noscript']) {
+    t.deepEqual(
+      parseIframe(
+        `<${tag}><script src="/a.js"></script></${tag}><script src="/b.js"></script>`
+      ),
+      [{ src: '/b.js' }],
+      tag
+    )
+  }
+  t.deepEqual(
+    parseIframe(
+      '<script src="/a.js"></script><plaintext><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }]
+  )
+})
+
+test('an implied end tag does not end an html script', t => {
+  t.deepEqual(
+    parseIframe('<script src="/a.js"/><body><script src="/b.js"></script>'),
+    [{ src: '/a.js' }]
+  )
+  t.deepEqual(
+    parseIframe(
+      '<div><script src="/a.js"/></div><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }]
+  )
+  t.deepEqual(
+    parseIframe(
+      '<head><script src="/a.js"></script></head><body><script src="/b.js"></script>'
+    ),
+    [{ src: '/a.js' }, { src: '/b.js' }]
+  )
+})
+
 test('non-string input is read as a string', t => {
   t.deepEqual(parseIframe(Buffer.from('<script src="/buf.js"></script>')), [
     { src: '/buf.js' }