@knowvah/dot-engine 2.6.7 → 2.6.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knowvah/dot-engine",
-  "version": "2.6.7",
+  "version": "2.6.8",
   "description": "Faithful TypeScript port of Graphviz (dot, neato, fdp, sfdp, circo, twopi, osage, patchwork) — no C: no native binary, no WASM. Oracle-verified against the C implementation, runs in the browser.",
   "keywords": [
     "graphviz",

package/src/common/htmltable-attr-warn.ts

@@ -11,7 +11,7 @@
  * @see lib/common/htmllex.c:doAttrs
  */
 
-/** An attribute as written: name in source case, value verbatim. */
+/** An attribute as startElement gets it: name in source case, value decoded by expat. */
 export type AttrEntry = readonly [name: string, value: string];
 
 export interface CheckedAttrs {
@@ -247,9 +247,9 @@ export function checkAttrs(tag: string, pairs: readonly AttrEntry[]): CheckedAtt
 // ---------------------------------------------------------------------------
 
 /**
- * C's stderr as lines: text is appended, each completed line goes to
- * `writeLine`, and a message without a trailing newline stays pending so the
- * next write continues it. `flush` emits a pending partial line.
+ * C's stderr as messages: a write ending in a newline goes to `writeLine`
+ * (newline dropped, embedded newlines kept), while a message without one stays
+ * pending so the next write continues it. `flush` emits a pending message.
  */
 export class StderrLines {
   private pending = '';
@@ -257,9 +257,11 @@ export class StderrLines {
   constructor(private readonly writeLine: (line: string) => void) {}
 
   write(text: string): void {
-    const parts = (this.pending + text).split('\n');
-    this.pending = parts.pop() ?? '';
-    for (const line of parts) this.writeLine(line);
+    this.pending += text;
+    if (!this.pending.endsWith('\n')) return;
+    const line = this.pending.slice(0, -1);
+    this.pending = '';
+    this.writeLine(line);
   }
 
   flush(): void {
@@ -268,3 +270,18 @@ export class StderrLines {
     this.pending = '';
   }
 }
+
+/** A finished stderr line on the console channel the port uses for it. */
+export const consoleLine = (line: string): void => {
+  if (line.startsWith('Warning')) console.warn(line);
+  else console.error(line);
+};
+
+/** One label's stderr: what make_html_label and make_label print, in order. */
+export const labelStderr = (): StderrLines => new StderrLines(consoleLine);
+
+/** agerr of one newline-terminated message: to `out`, or the console when there is none. */
+export const agerrLine = (out: StderrLines | undefined, msg: string): void => {
+  if (out === undefined) consoleLine(msg);
+  else out.write(`${msg}\n`);
+};

package/src/common/htmltable-label.ts

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: EPL-2.0
+
+/**
+ * make_html_label: parse, size and position an HTML-like label, writing what
+ * C writes to stderr along the way through one {@link StderrLines}, so a
+ * message without a trailing newline (htmllex.c's doInt) runs into the next
+ * write: a later warning, the parse error, or make_label's `in label of ...`.
+ *
+ * @see lib/common/htmltable.c:make_html_label
+ */
+
+import type { TextlabelT } from './types.js';
+import type { TextMeasurer } from './textmeasure.js';
+import type { HtmlLabel, ImageSizer } from './htmltable-types.js';
+import { sizeHtmlLabel, parseHtmlLabelRv, inheritTablePenColor } from './htmltable.js';
+import { makeLabel } from './make-label.js';
+import { HtmlLexError } from './htmltable-lex.js';
+import { labelStderr, type StderrLines } from './htmltable-attr-warn.js';
+import { posHtmlLabel, type HtmlFontInfo, type PlacedHtml } from './htmltable-pos.js';
+
+/** parseHTML's rv for a label that failed to parse (`ctx->error`). */
+const HTML_PARSE_FATAL = 3;
+
+/** A built HTML label plus make_html_label's "problem" return value. */
+export interface HtmlLabelResult {
+  label: TextlabelT;
+  rv: number;
+}
+
+/** The label's font, the object's pen color, and the `<IMG>` sizer. */
+export type HtmlLabelInfo = HtmlFontInfo & { imageSizer?: ImageSizer; pencolor?: string };
+
+/**
+ * make_html_label: parse, size and position an HTML-like label. Returns C's
+ * rv too (nonzero: the caller appends `in label of ...`, labels.c:make_label).
+ * Everything C prints goes to `stderr`, which the caller owns and flushes once
+ * its own continuation is written. The optional `imageSizer` resolves
+ * `<IMG SRC>`; absent means C's missing image.
+ * @see lib/common/htmltable.c:make_html_label
+ */
+export function makeHtmlLabelTo(
+  content: string,
+  finfo: HtmlLabelInfo,
+  measurer: TextMeasurer,
+  stderr: StderrLines,
+): HtmlLabelResult {
+  const { fontname, fontsize, fontcolor, imageSizer, pencolor } = finfo;
+  let lbl: HtmlLabel, lexWarn: boolean; // lexWarn: htmllex.c's ctx->warn, rv bit 1
+  try {
+    ({ label: lbl, warn: lexWarn } = parseHtmlLabelRv(content, stderr));
+  } catch (e) {
+    // C aborts the HTML parse on a syntax error (YYABORT): parseHTML returns
+    // rv 3 (ctx->error) with no label, and make_html_label returns it with
+    // lp->html cleared and no spans, so the label renders empty.
+    // @see lib/common/htmltable.c:1880 (rv == 3), htmlparse.y (YYABORT)
+    if (e instanceof HtmlLexError) for (const line of e.diagnostics) stderr.write(`${line}\n`);
+    return { label: makeLabel('', fontname, fontsize, fontcolor, measurer), rv: HTML_PARSE_FATAL };
+  }
+  // A top-level table with no explicit COLOR inherits the object's pen color,
+  // which then flows table->cell->nested-table.
+  // @see lib/common/htmltable.c:1911 (getPenColor), :1406/:1556 (inheritance)
+  if (lbl.kind === 'table') inheritTablePenColor(lbl.table, pencolor);
+  const rv = Number(lexWarn) | sizeHtmlLabel(lbl, measurer, {
+    fontsize, fontname, imageSizer, stderr,
+  });
+  const placed = posHtmlLabel(lbl, { fontname, fontsize, fontcolor }, measurer);
+  const dim = lbl.dimen ?? { w: 0, h: 0 };
+  // C replaces table-label text: "this may be used for the title and
+  // alt fields in image maps" — anchors inherit it as default tooltip.
+  // @see lib/common/htmltable.c:make_html_label (line 1935)
+  const text = lbl.kind === 'table' ? '<TABLE>' : content;
+  return { label: htmlTextLabel(text, { fontname, fontsize, fontcolor }, placed, dim), rv };
+}
+
+/** {@link makeHtmlLabelTo} on a stderr of its own, flushed before it returns. */
+export function makeHtmlLabelRv(content: string, finfo: HtmlLabelInfo, measurer: TextMeasurer): HtmlLabelResult {
+  const stderr = labelStderr();
+  try {
+    return makeHtmlLabelTo(content, finfo, measurer, stderr);
+  } finally {
+    stderr.flush();
+  }
+}
+
+/** {@link makeHtmlLabelRv} without the problem flag. */
+export function makeHtmlLabel(content: string, finfo: HtmlLabelInfo, measurer: TextMeasurer): TextlabelT {
+  return makeHtmlLabelRv(content, finfo, measurer).label;
+}
+
+/** Build the TextlabelT wrapper around a positioned HTML label. */
+function htmlTextLabel(
+  text: string,
+  finfo: HtmlFontInfo,
+  placed: PlacedHtml,
+  dim: { w: number; h: number },
+): TextlabelT {
+  return {
+    text,
+    fontname: finfo.fontname, fontcolor: finfo.fontcolor, charset: 0,
+    fontsize: finfo.fontsize,
+    dimen: { x: dim.w, y: dim.h },
+    space: { x: dim.w, y: dim.h },
+    pos: { x: 0, y: 0 },
+    u: { kind: 'html', html: placed },
+    valign: 'c'.charCodeAt(0),
+    set: false,
+    html: true,
+  };
+}

package/src/common/htmltable-lex-attvalue.ts

@@ -0,0 +1,141 @@
+// SPDX-License-Identifier: EPL-2.0
+/**
+ * expat's handling of an attribute value, which `doAttrs` only ever sees
+ * decoded: scanAtts tokenizes the quoted value (a `<`, or an `&` that does not
+ * start a well-formed reference, is an invalid token), storeAtts then
+ * normalizes it (references decoded, white space to spaces) and reports an
+ * undefined entity or a reference to a character XML does not allow.
+ *
+ * Not vendored with graphviz; read from libexpat R_2_6_4.
+ * @see expat lib/xmltok_impl.c:PREFIX(scanAtts)
+ * @see expat lib/xmltok_impl.c:PREFIX(scanRef)
+ * @see expat lib/xmlparse.c:storeAtts
+ * @see expat lib/xmlparse.c:appendAttributeValue
+ */
+
+/** expat `XML_ErrorString(XML_ERROR_UNDEFINED_ENTITY)`. */
+export const XML_ERROR_UNDEFINED_ENTITY = 'undefined entity';
+/** expat `XML_ErrorString(XML_ERROR_BAD_CHAR_REF)`. */
+export const XML_ERROR_BAD_CHAR_REF = 'reference to invalid character number';
+
+/** How scanAtts ends a quoted value: at its closing quote, short of data, or on an invalid token. */
+export type AttValueScan = { close: number } | { partial: true } | { invalid: number };
+
+/** A storeAtts error: its message and where expat's event pointer is (undefined: the tag's start). */
+export interface AttValueError {
+  message: string;
+  offset?: number;
+}
+
+const NAME_START = /[A-Za-z_:\u0080-￿]/;
+const NAME_CHAR = /[\w.:\u0080-￿-]/;
+const DEC_DIGIT = /[0-9]/;
+const HEX_DIGIT = /[0-9A-Fa-f]/;
+/** Bytes expat's tokenizer rejects anywhere (BT_NONXML): controls other than tab, LF and CR. */
+const NON_XML = /[\x00-\x08\x0b\x0c\x0e-\x1f]/;
+
+/** A reference's digits from `i` up to `;`: the index after it, or where scanning stops. */
+function scanDigits(text: string, i: number, digit: RegExp): number | AttValueScan {
+  if (i >= text.length) return { partial: true };
+  if (!digit.test(text[i]!)) return { invalid: i };
+  for (let k = i + 1; k < text.length; k++) {
+    if (text[k] === ';') return k + 1;
+    if (!digit.test(text[k]!)) return { invalid: k };
+  }
+  return { partial: true };
+}
+
+/**
+ * The reference after the `&` at `i - 1`: the index after its `;`, or where
+ * scanning stops.
+ * @see expat lib/xmltok_impl.c:PREFIX(scanRef)
+ * @see expat lib/xmltok_impl.c:PREFIX(scanCharRef)
+ */
+function scanRef(text: string, i: number): number | AttValueScan {
+  const c = text[i];
+  if (c === undefined) return { partial: true };
+  if (c === '#') return text[i + 1] === 'x' ? scanDigits(text, i + 2, HEX_DIGIT) : scanDigits(text, i + 1, DEC_DIGIT);
+  if (!NAME_START.test(c)) return { invalid: i };
+  for (let k = i + 1; k < text.length; k++) {
+    if (text[k] === ';') return k + 1;
+    if (!NAME_CHAR.test(text[k]!)) return { invalid: k };
+  }
+  return { partial: true };
+}
+
+/**
+ * scanAtts over the value whose opening quote is at `j`.
+ * @see expat lib/xmltok_impl.c:PREFIX(scanAtts) ("in attribute value")
+ */
+export function scanAttValue(text: string, j: number): AttValueScan {
+  const q = text[j];
+  let k = j + 1;
+  for (;;) {
+    const c = text[k];
+    if (c === undefined) return { partial: true };
+    if (c === q) return { close: k };
+    if (c === '<' || NON_XML.test(c)) return { invalid: k };
+    if (c !== '&') {
+      k++;
+      continue;
+    }
+    const r = scanRef(text, k + 1);
+    if (typeof r !== 'number') return r;
+    k = r;
+  }
+}
+
+/**
+ * XmlCharRefNumber: the code point of `&#...;`, or -1 for one XML does not
+ * allow (controls other than tab, LF and CR; surrogates; U+FFFE and U+FFFF;
+ * beyond U+10FFFF).
+ * @see expat lib/xmltok_impl.c:PREFIX(charRefNumber)
+ * @see expat lib/xmltok.c:checkCharRefNumber
+ */
+export function charRefNumber(ref: string): number {
+  const hex = ref.startsWith('&#x');
+  const n = parseInt(ref.slice(hex ? 3 : 2, -1), hex ? 16 : 10);
+  if (n >= 0x110000) return -1;
+  if (n >= 0xd800 && n <= 0xdfff) return -1;
+  if (n < 0x20 && NON_XML.test(String.fromCharCode(n))) return -1;
+  return n === 0xfffe || n === 0xffff ? -1 : n;
+}
+
+const PREDEFINED: Readonly<Record<string, string>> = { lt: '<', gt: '>', amp: '&', quot: '"', apos: "'" };
+
+/** The references of a well-formed value, and its CR LF pairs. */
+const VALUE_PIECE = /&#x?[0-9A-Fa-f]+;|&[^;]+;|\r\n|[\t\n\r]/g;
+
+/**
+ * storeAtts' check of a well-formed value (`raw`, between the quotes, at
+ * `base`): the first undefined entity or disallowed character reference. No
+ * DTD, so only the five predefined entities exist.
+ * @see expat lib/xmlparse.c:appendAttributeValue
+ */
+export function attValueError(raw: string, base: number): AttValueError | undefined {
+  for (const m of raw.matchAll(VALUE_PIECE)) {
+    const ref = m[0];
+    if (!ref.startsWith('&')) continue;
+    if (ref.startsWith('&#')) {
+      if (charRefNumber(ref) < 0) return { message: XML_ERROR_BAD_CHAR_REF, offset: base + m.index };
+    } else if (!Object.hasOwn(PREDEFINED, ref.slice(1, -1))) {
+      return { message: XML_ERROR_UNDEFINED_ENTITY };
+    }
+  }
+  return undefined;
+}
+
+/**
+ * appendAttributeValue for a CDATA attribute (no DTD declares one otherwise)
+ * on a value storeAtts accepted: references become their characters, which
+ * stay as they are (a `&#9;` is a tab); a tab, LF, CR or CR LF in the source
+ * becomes one space.
+ * @see expat lib/xmlparse.c:appendAttributeValue
+ */
+export function decodeAttValue(raw: string): string {
+  return raw.replace(VALUE_PIECE, (m) => {
+    if (!m.startsWith('&')) return ' ';
+    if (m.startsWith('&#')) return String.fromCodePoint(charRefNumber(m));
+    return PREDEFINED[m.slice(1, -1)]!;
+  });
+}

package/src/common/htmltable-lex-expat.ts

@@ -15,6 +15,9 @@
  */
 
 import { HTML_ENTITIES } from './html-entities.js';
+import {
+  attValueError, charRefNumber, scanAttValue, XML_ERROR_BAD_CHAR_REF, XML_ERROR_UNDEFINED_ENTITY, type AttValueError,
+} from './htmltable-lex-attvalue.js';
 
 /** expat `XML_ErrorString(XML_ERROR_INVALID_TOKEN)`. */
 export const XML_ERROR_INVALID_TOKEN = 'not well-formed (invalid token)';
@@ -31,8 +34,8 @@ export interface ExpatToken {
   end: number;
   /** A `cdata` token's character data, as expat reports it (no entity decoding). */
   data?: string;
-  /** Offset of the second occurrence of an attribute name in a start tag. */
-  dup?: number;
+  /** A start tag's first storeAtts error: a duplicate name or a bad value. */
+  attError?: AttValueError & { offset: number };
 }
 
 /** The first well-formedness error of a parse call. */
@@ -47,13 +50,18 @@ export interface ExpatResult {
   invalid?: ExpatInvalid;
 }
 
+/** expat `XML_ErrorString(XML_ERROR_DUPLICATE_ATTRIBUTE)`. */
+const XML_ERROR_DUPLICATE_ATTRIBUTE = 'duplicate attribute';
+
+type AttError = AttValueError & { offset: number };
+
 type Scan =
-  | { kind: 'complete'; end: number; dup?: number }
+  | { kind: 'complete'; end: number; attError?: AttError }
   | { kind: 'partial' }
   | { kind: 'invalid'; offset: number };
 
-const COMPLETE_END = (end: number, dup?: number): Scan =>
-  dup === undefined ? { kind: 'complete', end } : { kind: 'complete', end, dup };
+const COMPLETE_END = (end: number, attError?: AttError): Scan =>
+  attError === undefined ? { kind: 'complete', end } : { kind: 'complete', end, attError };
 const PARTIAL: Scan = { kind: 'partial' };
 const INVALID = (offset: number): Scan => ({ kind: 'invalid', offset });
 
@@ -94,21 +102,22 @@ export function fedBytes(unit: string, isText: boolean): number {
 interface Pair {
   name: string;
   next: number;
+  /** The value between its quotes. */
+  value: { start: number; end: number };
 }
 
-/** The quoted value opening at `j`: the index after it and any white space, or how scanning stops. */
+/** The quoted value opening at `j`: its closing quote, or how scanning stops. */
 function scanValue(text: string, j: number): number | Scan {
   const q = text[j];
   if (q !== '"' && q !== "'") return INVALID(j);
-  const close = text.indexOf(q, j + 1);
-  if (close < 0) {
-    const lt = text.indexOf('<', j + 1);
-    return lt >= 0 ? INVALID(lt) : PARTIAL;
-  }
+  const v = scanAttValue(text, j);
+  if ('partial' in v) return PARTIAL;
+  if ('invalid' in v) return INVALID(v.invalid);
+  const close = v.close;
   const next = skipSpace(text, close + 1);
   // Attributes are separated by white space.
   if (next === close + 1 && !'>/'.includes(text[next] ?? '>')) return INVALID(next);
-  return next;
+  return close;
 }
 
 /** The `name = "value"` pair at `i`, or how expat's tokenizer stops there. */
@@ -120,8 +129,9 @@ function scanPair(text: string, i: number): Pair | Scan {
   if (text[eq] !== '=') return INVALID(eq);
   const j = skipSpace(text, eq + 1);
   if (j >= text.length) return PARTIAL;
-  const next = scanValue(text, j);
-  return typeof next === 'number' ? { name, next } : next;
+  const close = scanValue(text, j);
+  if (typeof close !== 'number') return close;
+  return { name, next: skipSpace(text, close + 1), value: { start: j + 1, end: close } };
 }
 
 /** `>` or `/>` at `i` ends the tag; end of data leaves it partial; otherwise more attributes. */
@@ -134,19 +144,30 @@ function tagEdge(text: string, i: number): Scan | undefined {
   return text[i + 1] === '>' ? COMPLETE_END(i + 2) : undefined;
 }
 
-/** The pairs of a start tag from `from`; a duplicate only counts once the tag tokenizes whole. */
-function scanAttributes(text: string, from: number): Scan {
+/**
+ * storeAtts on one attribute: a repeated name, else its value's error. Its
+ * undefined-entity error leaves the event pointer at the tag (`p`).
+ * @see expat lib/xmlparse.c:storeAtts
+ */
+function storeAttError(text: string, p: number, at: number, pair: Pair, seen: Set<string>): AttError | undefined {
+  if (seen.has(pair.name)) return { message: XML_ERROR_DUPLICATE_ATTRIBUTE, offset: at };
+  seen.add(pair.name);
+  const err = attValueError(text.slice(pair.value.start, pair.value.end), pair.value.start);
+  return err === undefined ? undefined : { message: err.message, offset: err.offset ?? p };
+}
+
+/** The pairs of the start tag at `p` from `from`; storeAtts' errors only count once the tag tokenizes whole. */
+function scanAttributes(text: string, p: number, from: number): Scan {
   const seen = new Set<string>();
-  let dup: number | undefined;
+  let attError: AttError | undefined;
   let i = skipSpace(text, from);
   for (;;) {
     const edge = tagEdge(text, i);
-    if (edge?.kind === 'complete') return COMPLETE_END(edge.end, dup);
+    if (edge?.kind === 'complete') return COMPLETE_END(edge.end, attError);
     if (edge !== undefined) return edge;
     const pair = scanPair(text, i);
     if ('kind' in pair) return pair;
-    if (seen.has(pair.name)) dup ??= i;
-    seen.add(pair.name);
+    attError ??= storeAttError(text, p, i, pair, seen);
     i = pair.next;
   }
 }
@@ -165,7 +186,7 @@ function scanStartTag(text: string, p: number): Scan {
   const c = text[name.next];
   if (c === undefined) return PARTIAL;
   if (!isSpace(c) && c !== '>' && c !== '/') return INVALID(name.next);
-  return scanAttributes(text, name.next);
+  return scanAttributes(text, p, name.next);
 }
 
 /** An end tag at `p`: a name, optional white space, `>`. */
@@ -281,7 +302,7 @@ function scanContent(text: string, base: number, inCdata: boolean, dataOf: Cdata
     if (scan.kind === 'invalid') return { tokens, consumed: p, invalid: base + scan.offset, inCdata: false };
     if (scan.kind === 'partial') return { tokens, consumed: p, inCdata: false };
     const tok: ExpatToken = { kind, start: base + p, end: base + scan.end };
-    if (scan.dup !== undefined) tok.dup = base + scan.dup;
+    if (scan.attError !== undefined) tok.attError = { ...scan.attError, offset: base + scan.attError.offset };
     tokens.push(tok);
     p = scan.end;
   }
@@ -389,18 +410,29 @@ const XML_PREDEFINED_ENTITIES = new Set(['lt', 'gt', 'amp', 'quot', 'apos']);
 
 const ENTITY_NAME = /^[A-Za-z_:][\w.:-]*$/;
 
-/** Offset of the first `&name;` that scanEntity leaves for expat to reject. */
-export function findUndefinedEntity(text: string): number {
+const CHAR_REF = /^&#(?:x[0-9A-Fa-f]+|[0-9]+);/;
+
+/**
+ * The first reference of character data that expat rejects, at its offset: a
+ * `&name;` scanEntity leaves alone (neither an HTML entity nor predefined), or
+ * a character reference XML does not allow.
+ * @see expat lib/xmlparse.c:doContent (XML_TOK_ENTITY_REF, XML_TOK_CHAR_REF)
+ */
+export function textRefError(text: string): { message: string; offset: number } | undefined {
   for (let t = text.indexOf('&'); t >= 0; t = text.indexOf('&', t + 1)) {
-    if (text[t + 1] === '#') continue;
+    if (text[t + 1] === '#') {
+      const ref = CHAR_REF.exec(text.slice(t))?.[0];
+      if (ref !== undefined && charRefNumber(ref) < 0) return { message: XML_ERROR_BAD_CHAR_REF, offset: t };
+      continue;
+    }
     const semi = text.indexOf(';', t + 1);
     if (semi < 0) continue;
     const key = text.slice(t + 1, semi);
     if (ENTITY_NAME.test(key) && !Object.hasOwn(HTML_ENTITIES, key) && !XML_PREDEFINED_ENTITIES.has(key)) {
-      return t;
+      return { message: XML_ERROR_UNDEFINED_ENTITY, offset: t };
     }
   }
-  return -1;
+  return undefined;
 }
 
 export interface TagChunk {

package/src/common/htmltable-lex.ts

@@ -15,11 +15,12 @@ import { HtmlParseError } from './htmltable-types.js';
 import type { LexerOutput, OpenToken, TextToken, Token } from './htmltable-types.js';
 import { checkAttrs } from './htmltable-attr-warn.js';
 import type { AttrEntry } from './htmltable-attr-warn.js';
-import { ExpatFeed, findUndefinedEntity, parseTagChunk } from './htmltable-lex-expat.js';
+import { ExpatFeed, parseTagChunk, textRefError } from './htmltable-lex-expat.js';
 import { charDataTokens, initialCharData, keepLostText, releaseXb, tagInCell, textTokens } from './htmltable-lex-chardata.js';
 import type { CharDataState } from './htmltable-lex-chardata.js';
 import type { ExpatResult, ExpatToken } from './htmltable-lex-expat.js';
 import { findNext } from './htmltable-lex-units.js';
+import { decodeAttValue } from './htmltable-lex-attvalue.js';
 import type { Unit } from './htmltable-lex-units.js';
 
 export type { Token } from './htmltable-types.js';
@@ -42,7 +43,8 @@ const isWs = (c: string | undefined): boolean =>
 /**
  * Parse key="value" attribute pairs. Values are consumed, never
  * re-scanned (the old scanner re-matched words inside quoted values as
- * phantom attributes). Bare or unquoted attributes are not well-formed
+ * phantom attributes), and decoded as expat hands them to startElement
+ * (`decodeAttValue`; storeAtts' errors were raised before this runs). Bare or unquoted attributes are not well-formed
  * XML — expat rejects the document and the label falls back to plain
  * text; throwing here reproduces that.
  * Names keep their source case (doAttrs prints them as written) and pairs
@@ -67,7 +69,7 @@ function parseAttrPairs(raw: string): AttrEntry[] {
     if (q !== '"' && q !== "'") throw new HtmlParseError(name);
     const end = raw.indexOf(q, i + 1);
     if (end < 0) throw new HtmlParseError(name);
-    out.push([name, raw.slice(i + 1, end)]);
+    out.push([name, decodeAttValue(raw.slice(i + 1, end))]);
     i = end + 1;
   }
   return out;
@@ -145,9 +147,7 @@ function parseOpenToken(inner: string) {
  * with the graphviz sources.
  * @see lib/common/htmllex.c:htmllex (XML_ErrorString at the XML_Parse failure)
  */
-const XML_ERROR_UNDEFINED_ENTITY = 'undefined entity';
 const XML_ERROR_TAG_MISMATCH = 'mismatched tag';
-const XML_ERROR_DUPLICATE_ATTRIBUTE = 'duplicate attribute';
 /** yacc's message when the token stream ends inside an unfinished construct. */
 const SYNTAX_ERROR = 'syntax error';
 
@@ -254,7 +254,8 @@ function checkTagToken(site: TokenSite): void {
       throw htmlErrorInLine(XML_ERROR_TAG_MISMATCH, lineAt(src, tok.start), context);
     }
   } else {
-    if (tok.dup !== undefined) throw htmlErrorInLine(XML_ERROR_DUPLICATE_ATTRIBUTE, lineAt(src, tok.dup), context);
+    const err = tok.attError;
+    if (err !== undefined) throw htmlErrorInLine(err.message, lineAt(src, err.offset), context);
     if (!tag.selfClose) st.stack.push(tag.name);
   }
   if (KNOWN_TAGS.has(tag.name.toUpperCase())) return;
@@ -273,10 +274,8 @@ function eventTokens(site: TokenSite): Token[] {
     checkTagToken(site);
     return tagTokens(text);
   }
-  const off = findUndefinedEntity(text);
-  if (off >= 0) {
-    throw htmlErrorInLine(XML_ERROR_UNDEFINED_ENTITY, lineAt(src, tok.start + off), st.prev + st.curr);
-  }
+  const err = textRefError(text);
+  if (err !== undefined) throw htmlErrorInLine(err.message, lineAt(src, tok.start + err.offset), st.prev + st.curr);
   return textTokens(text);
 }
 

package/src/common/htmltable-parse-attrs.ts

@@ -11,6 +11,7 @@
 import type {
   HtmlAlign,
   HtmlCell,
+  HtmlCellAlign,
   HtmlCellContent,
   HtmlRow,
   HtmlTable,
@@ -23,14 +24,6 @@ import {
   BORDER_BOTTOM,
   BORDER_MASK,
 } from './htmltable-types.js';
-import { htmlEntityUTF8 } from './html-entities.js';
-
-/** Decode XML/HTML entities in an anchor attribute value (href/target), as C's
- *  HTML parser does. The stored value is the real character (`&` → `&`), so
- *  imap emits it raw and cmapx re-escapes it. Undefined passes through. */
-function anchorAttr(v: string | undefined): string | undefined {
-  return v === undefined ? undefined : htmlEntityUTF8(v);
-}
 
 // ---------------------------------------------------------------------------
 // Attribute helpers
@@ -44,6 +37,10 @@ export const parseAlign = (v: string): HtmlAlign | undefined => {
   return undefined;
 };
 
+/** @see lib/common/htmllex.c:cell_halignfn */
+export const parseCellAlign = (v: string): HtmlCellAlign | undefined =>
+  v.toUpperCase() === 'TEXT' ? 'text' : parseAlign(v);
+
 export const parseVAlign = (v: string): HtmlVAlign | undefined => {
   const u = v.toUpperCase();
   if (u === 'TOP') return 'top';
@@ -112,7 +109,7 @@ export const buildCell = (content: HtmlCellContent[], a: Record<string, string>)
   kind: 'cell',
   content,
   port: a['port'],
-  align: parseAlign(a['align'] !== undefined ? a['align'] : ''),
+  align: parseCellAlign(a['align'] !== undefined ? a['align'] : ''),
   valign: parseVAlign(a['valign'] !== undefined ? a['valign'] : ''),
   balign: parseAlign(a['balign'] !== undefined ? a['balign'] : ''),
   bgcolor: a['bgcolor'],
@@ -128,9 +125,9 @@ export const buildCell = (content: HtmlCellContent[], a: Record<string, string>)
   fixedsize: parseFixedSize(a),
   colspan: num(a['colspan']),
   rowspan: num(a['rowspan']),
-  href: anchorAttr(a['href']),
+  href: a['href'],
   title: parseTitle(a),
-  target: anchorAttr(a['target']),
+  target: a['target'],
   id: a['id'],
 });
 
@@ -149,9 +146,9 @@ export const buildTable = (rows: HtmlRow[], a: Record<string, string>): HtmlTabl
   fixedsize: parseFixedSize(a),
   width: num(a['width']),
   height: num(a['height']),
-  href: anchorAttr(a['href']),
+  href: a['href'],
   title: parseTitle(a),
-  target: anchorAttr(a['target']),
+  target: a['target'],
   id: a['id'],
   port: a['port'],
   sides: parseSides(a['sides']),