officeparser 7.2.3 → 7.3.0

package/dist/generators/MarkdownGenerator.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MarkdownGenerator = void 0;
+const sanitize_js_1 = require("../utils/sanitize.js");
 const BaseGenerator_js_1 = require("./BaseGenerator.js");
 /**
  * Generates Markdown from an AST.
@@ -29,6 +30,7 @@ const BaseGenerator_js_1 = require("./BaseGenerator.js");
 class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
     isInsideTable = false;
     hoistedContent = [];
+    collectedAbbreviations = new Map();
     constructor(ast, config) {
         super('md', ast, config);
     }
@@ -41,6 +43,41 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
         const ids = metadata?.anchorIds || [];
         return ids.map((aid) => `<a id="${this.slugify(aid)}"></a>`).join('');
     }
+    /**
+     * Serializes a frontmatter array as a YAML flow sequence (e.g. `[a, b]`), matching
+     * MarkdownParser's frontmatter array handling. Plain strings are left bare; anything
+     * that would break flow-array syntax (or isn't a string) falls back to JSON encoding.
+     */
+    serializeFrontmatterArray(arr) {
+        const items = arr.map(item => (typeof item === 'string' && item.trim() === item && !/[,[\]]/.test(item))
+            ? item
+            : JSON.stringify(item));
+        return `[${items.join(', ')}]`;
+    }
+    /**
+     * Renders a Pandoc-style attribute list (e.g. `{width=50% align=left}`) from
+     * ImageMetadata/TableMetadata's width/align fields - the canonical form is always
+     * `key=value`, matching MarkdownParser's own vocabulary (MARKDOWN_DIALECT.md §15).
+     */
+    renderAttributeList(meta) {
+        if (!meta?.width && !meta?.align)
+            return '';
+        const parts = [];
+        // Strip characters that would break out of the `{...}` attribute list.
+        if (meta.width)
+            parts.push(`width=${String(meta.width).replace(/[{}\s]+/g, '')}`);
+        if (meta.align)
+            parts.push(`align=${String(meta.align).replace(/[{}\s]+/g, '')}`);
+        return `{${parts.join(' ')}}`;
+    }
+    /** Converts a document-supplied date to an ISO string, or '' if invalid
+     *  (a malformed date would otherwise throw a RangeError and abort generation). */
+    toIsoDate(value) {
+        if (value === undefined || value === null || value === '')
+            return '';
+        const d = new Date(value);
+        return isNaN(d.getTime()) ? '' : d.toISOString();
+    }
     /**
      * Generates Markdown string from the provided AST.
      *
@@ -51,19 +88,27 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
         // Add Metadata (YAML Front Matter)
         if (this.ast.metadata) {
             output += '---\n';
+            // JSON-encode scalar values so a title/author/description containing a
+            // quote or newline can't break out of the YAML string and inject
+            // arbitrary front-matter keys. (JSON.stringify of a benign value yields
+            // the same `"..."` form as before, so normal output is unchanged.)
             if (this.ast.metadata.title)
-                output += `title: "${this.ast.metadata.title}"\n`;
+                output += `title: ${JSON.stringify(this.ast.metadata.title)}\n`;
             if (this.ast.metadata.author)
-                output += `author: "${this.ast.metadata.author}"\n`;
-            if (this.ast.metadata.created)
-                output += `created: ${new Date(this.ast.metadata.created).toISOString()}\n`;
-            if (this.ast.metadata.modified)
-                output += `modified: ${new Date(this.ast.metadata.modified).toISOString()}\n`;
+                output += `author: ${JSON.stringify(this.ast.metadata.author)}\n`;
+            const createdIso = this.toIsoDate(this.ast.metadata.created);
+            if (createdIso)
+                output += `created: ${createdIso}\n`;
+            const modifiedIso = this.toIsoDate(this.ast.metadata.modified);
+            if (modifiedIso)
+                output += `modified: ${modifiedIso}\n`;
             if (this.ast.metadata.description)
-                output += `description: "${this.ast.metadata.description}"\n`;
+                output += `description: ${JSON.stringify(this.ast.metadata.description)}\n`;
             if (this.ast.metadata.customProperties) {
                 for (const [key, val] of Object.entries(this.ast.metadata.customProperties)) {
-                    output += `${key}: ${JSON.stringify(val)}\n`;
+                    // Strip newlines/colons from the key so it can't inject a new mapping.
+                    const safeKey = String(key).replace(/[\r\n:]+/g, ' ').trim();
+                    output += `${safeKey}: ${Array.isArray(val) ? this.serializeFrontmatterArray(val) : JSON.stringify(val)}\n`;
                 }
             }
             output += '---\n\n';
@@ -87,7 +132,9 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
             }
             switch (node.type) {
                 case 'text': {
-                    let text = node.text || '';
+                    // Entity-encode angle brackets so document text can't inject a raw
+                    // HTML tag (e.g. <script>) when the Markdown is rendered to HTML.
+                    let text = (0, sanitize_js_1.markdownEscapeText)(node.text || '');
                     if (this.config.includeFormatting && node.formatting) {
                         if (node.formatting.bold)
                             text = `**${text}**`;
@@ -106,7 +153,15 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                         }
                     }
                     const meta = node.metadata;
-                    if (meta?.link) {
+                    if (meta?.wikilink) {
+                        // Obsidian syntax: bare page name, or page|alias when the display
+                        // text differs from the page name. Strip the `[]|`/newline chars
+                        // that would break out of the `[[...]]` wrapper.
+                        const page = (meta.link || '').replace(/[[\]|\r\n]+/g, '');
+                        const alias = (node.text || '').replace(/[[\]|\r\n]+/g, '');
+                        text = (node.text && node.text !== (meta.link || '')) ? `[[${page}|${alias}]]` : `[[${page}]]`;
+                    }
+                    else if (meta?.link) {
                         const isInternal = meta.linkType !== 'external';
                         if (!this.config.ignoreInternalLinks || !isInternal) {
                             let link = meta.link;
@@ -115,9 +170,20 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                                 const target = link.substring(1);
                                 link = '#' + this.slugify(target);
                             }
-                            text = `[${text}](${link})`;
+                            // Reject javascript:/data: schemes and encode `()`/whitespace so the
+                            // URL can't break out of `](...)` or inject a script link.
+                            text = `[${text}](${(0, sanitize_js_1.sanitizeMarkdownUrl)(link)})`;
                         }
                     }
+                    if (meta?.abbreviationTitle) {
+                        // Markdown Extra's abbreviation syntax has no inline marker - the bare
+                        // word round-trips as-is, with its expansion collected at the document
+                        // end via `*[abbr]: title`.
+                        this.collectedAbbreviations.set(node.text || '', meta.abbreviationTitle);
+                    }
+                    if (meta?.citationKey) {
+                        text = `[@${String(meta.citationKey).replace(/[[\]\r\n]+/g, '')}]`;
+                    }
                     return text;
                 }
                 case 'heading': {
@@ -137,13 +203,13 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                         id = ` {#${this.slugify(this.getNodeText(node))}}`;
                     }
                     const anchors = this.config.mdConfig.fallbackToHtml
-                        ? remainingAnchors.map(aid => `<a name="${aid}"></a>`).join('')
+                        ? remainingAnchors.map(aid => `<a name="${this.slugify(aid)}"></a>`).join('')
                         : '';
                     let content = `${prefix}${childrenOutput}${id}`;
                     // Alignment fallback via HTML div/p
                     if (this.config.mdConfig.fallbackToHtml && meta?.alignment && meta.alignment !== 'left') {
                         // Use extra newlines to ensure Markdown inside the div is parsed
-                        content = `<div style="text-align: ${meta.alignment}">\n\n${content}\n\n</div>`;
+                        content = `<div style="text-align: ${(0, sanitize_js_1.sanitizeCssValue)(meta.alignment)}">\n\n${content}\n\n</div>`;
                     }
                     return `${anchors}${anchors ? '\n' : ''}${content}\n\n`;
                 }
@@ -153,7 +219,7 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                     let content = childrenOutput;
                     // Alignment fallback via HTML div/p
                     if (this.config.mdConfig.fallbackToHtml && meta?.alignment && meta.alignment !== 'left') {
-                        content = `<div style="text-align: ${meta.alignment}">${content}</div>`;
+                        content = `<div style="text-align: ${(0, sanitize_js_1.sanitizeCssValue)(meta.alignment)}">${content}</div>`;
                     }
                     return childrenOutput ? `${anchors}${content}\n\n` : '';
                 }
@@ -161,7 +227,9 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                     const meta = node.metadata;
                     const indentSpaces = ' '.repeat(4);
                     const indent = indentSpaces.repeat(meta?.indentation || 0);
-                    const marker = meta?.listType === 'ordered' ? `${(meta.itemIndex ?? 0) + 1}. ` : '- ';
+                    const marker = meta?.isTask
+                        ? (meta.checked ? '- [x] ' : '- [ ] ')
+                        : (meta?.listType === 'ordered' ? `${(meta.itemIndex ?? 0) + 1}. ` : '- ');
                     const anchors = this.renderAnchors(meta);
                     return `${indent}${marker}${anchors}${childrenOutput}\n`;
                 }
@@ -179,11 +247,24 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                         }
                     }
                     const anchors = this.renderAnchors(meta);
-                    return `${anchors}${anchors ? '\n' : ''}![${alt}](${src})`;
+                    // Strip `[]` from alt (would close the `![...]`) and neutralize the URL scheme.
+                    const safeAlt = (0, sanitize_js_1.markdownEscapeText)(alt).replace(/[[\]]/g, '');
+                    const safeSrc = (0, sanitize_js_1.sanitizeMarkdownUrl)(src, { allowDataImage: true });
+                    return `${anchors}${anchors ? '\n' : ''}![${safeAlt}](${safeSrc})${this.renderAttributeList(meta)}`;
                 }
                 case 'table': {
                     const anchors = this.renderAnchors(node.metadata);
                     const tableOutput = await this.renderMarkdownTable(node, processor);
+                    // The HTML-fallback path (merged cells/nested tables) already carries
+                    // data-align on the <table> tag directly - only the plain pipe-table
+                    // form needs the attribute-list syntax to express alignment.
+                    const usedHtmlFallback = this.config.mdConfig.fallbackToHtml && (this.hasNestedTable(node) || this.hasColspanOrRowspan(node));
+                    const attrList = usedHtmlFallback ? '' : this.renderAttributeList(node.metadata);
+                    if (attrList) {
+                        // Must glue directly below the last row with no blank line, or
+                        // MarkdownParser's block splitter won't see it as part of the same block.
+                        return `${anchors}${anchors ? '\n' : ''}${tableOutput.replace(/\n+$/, '\n')}${attrList}\n`;
+                    }
                     return `${anchors}${anchors ? '\n' : ''}${tableOutput}`;
                 }
                 case 'row':
@@ -196,13 +277,27 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                 }
                 case 'code': {
                     const meta = node.metadata;
-                    const lang = meta?.language || '';
+                    if (meta?.math === 'block') {
+                        return `\n$$\n${node.text || ''}\n$$\n\n`;
+                    }
+                    if (meta?.math === 'inline') {
+                        return `$${node.text || ''}$`;
+                    }
+                    const lang = (meta?.language || '').replace(/[\r\n`]+/g, '');
                     // Block code if it contains newlines, else inline
                     if (node.text && node.text.includes('\n')) {
-                        return `\n\`\`\`${lang}\n${node.text}\n\`\`\`\n\n`;
+                        // Fence with one more backtick than the longest run inside the content
+                        // so an embedded ``` can't close the block early and inject markup.
+                        const longestRun = Math.max(0, ...(node.text.match(/`+/g) || []).map(s => s.length));
+                        const fence = '`'.repeat(Math.max(3, longestRun + 1));
+                        return `\n${fence}${lang}\n${node.text}\n${fence}\n\n`;
                     }
                     else {
-                        return `\`${node.text || ''}\` `;
+                        const t = node.text || '';
+                        const longestRun = Math.max(0, ...(t.match(/`+/g) || []).map(s => s.length));
+                        const fence = '`'.repeat(Math.max(1, longestRun + 1));
+                        const pad = (t.startsWith('`') || t.endsWith('`')) ? ' ' : '';
+                        return `${fence}${pad}${t}${pad}${fence} `;
                     }
                 }
                 case 'sheet': {
@@ -220,9 +315,40 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                 }
                 case 'note': {
                     const meta = node.metadata;
-                    const typeLabel = meta?.noteType === 'footnote' ? 'Footnote' : (meta?.noteType === 'endnote' ? 'Endnote' : 'Note');
-                    return `> **${typeLabel}:** ${childrenOutput.trim()}\n\n`;
+                    if (meta?.noteType === 'footnote' || meta?.noteType === 'endnote') {
+                        return `[^${this.getFootnoteKey(node)}]: ${childrenOutput.trim()}\n\n`;
+                    }
+                    return `> **Note:** ${childrenOutput.trim()}\n\n`;
+                }
+                case 'embed': {
+                    // Markdown has no native embed syntax. When fallbackToHtml is on (our save
+                    // default), emit the exact single-line div MarkdownParser recognises on
+                    // reimport; otherwise degrade to a plain link.
+                    const meta = node.metadata;
+                    const id = meta?.videoId || '';
+                    if (this.config.mdConfig.fallbackToHtml) {
+                        const width = meta?.width ? ` data-width="${(0, sanitize_js_1.escapeHtml)(meta.width)}"` : '';
+                        const align = meta?.align ? ` data-align="${(0, sanitize_js_1.escapeHtml)(meta.align)}"` : '';
+                        return `\n<div data-youtube-video="${(0, sanitize_js_1.escapeHtml)(id)}"${width}${align}></div>\n\n`;
+                    }
+                    const url = meta?.url || (id ? `https://youtu.be/${id}` : '');
+                    return url ? `[YouTube](${(0, sanitize_js_1.sanitizeMarkdownUrl)(url)})\n\n` : '';
+                }
+                case 'admonition': {
+                    // Canonical output is always the GitHub blockquote form, even when the
+                    // source was GLFM's `:::type` fenced-div - see MARKDOWN_DIALECT.md's Decisions.
+                    const meta = node.metadata;
+                    const label = (meta?.admonitionType || 'note').toUpperCase();
+                    const body = childrenOutput.trim();
+                    const quotedLines = body.split('\n').map(l => l.length > 0 ? `> ${l}` : '>').join('\n');
+                    return `> [!${label}]\n${quotedLines}\n\n`;
                 }
+                case 'definitionList':
+                    return `${childrenOutput}\n`;
+                case 'definitionTerm':
+                    return `${childrenOutput}\n`;
+                case 'definitionDescription':
+                    return `: ${childrenOutput}\n`;
                 default:
                     return childrenOutput;
             }
@@ -253,6 +379,12 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
             }
             output += notesMd;
         }
+        if (this.collectedAbbreviations.size > 0) {
+            output += '\n\n';
+            for (const [abbr, title] of this.collectedAbbreviations) {
+                output += `*[${abbr}]: ${title}\n`;
+            }
+        }
         return {
             value: (output + '\n\n' + this.hoistedContent.join('\n\n')).trim(),
             messages: this.messages
@@ -290,6 +422,17 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                 result += await this.processNodeRecursive(note, processor);
             }
         }
+        else if (node.notes && node.notes.length > 0) {
+            // Emit the [^id] reference marker at the point of reference. Without this,
+            // a footnote/endnote would only ever show up in the collected ### Notes
+            // section at the end, with no indication of where it was originally cited.
+            for (const note of node.notes) {
+                const meta = note.metadata;
+                if (meta?.noteType === 'footnote' || meta?.noteType === 'endnote') {
+                    result += `[^${this.getFootnoteKey(note)}]`;
+                }
+            }
+        }
         return result;
     }
     /**
@@ -460,7 +603,11 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                     rows += await this.renderTableAsHtml(row, await this.handleOnNode(row));
                 }
             }
-            return `<table>\n${rows}</table>\n`;
+            // Carry table-layout alignment through the HTML fallback so it isn't lost
+            // just because the table also needed HTML for merged cells.
+            const tableMeta = node.metadata;
+            const alignAttr = tableMeta?.align ? ` data-align="${(0, sanitize_js_1.escapeHtml)(tableMeta.align)}"` : '';
+            return `<table${alignAttr}>\n${rows}</table>\n`;
         }
         else if (node.type === 'row') {
             let cells = '';
@@ -482,7 +629,9 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                     content += await this.processNodeRecursive(child, async (n, co) => {
                         switch (n.type) {
                             case 'text': {
-                                let text = n.text || '';
+                                // Inside HTML table cells, entity-encode angle brackets so cell
+                                // text can't inject a raw tag (e.g. </td><script>).
+                                let text = (0, sanitize_js_1.markdownEscapeText)(n.text || '');
                                 if (n.formatting?.bold)
                                     text = `<b>${text}</b>`;
                                 if (n.formatting?.italic)
@@ -497,7 +646,7 @@ class MarkdownGenerator extends BaseGenerator_js_1.BaseGenerator {
                             }
                             case 'paragraph': return `<p>${co}</p>`;
                             case 'heading': {
-                                const level = n.metadata?.level || 1;
+                                const level = Math.min(Math.max(Number(n.metadata?.level) || 1, 1), 6);
                                 return `<h${level}>${co}</h${level}>`;
                             }
                             case 'table': return await this.renderTableAsHtml(n);

package/dist/generators/PdfGenerator.js

@@ -85,6 +85,35 @@ class PdfGenerator extends BaseGenerator_js_1.BaseGenerator {
             // a system-installed Chrome, both of which are too intrusive for a library.
             browser = await puppeteer.launch(launchOptions);
             const page = await browser.newPage();
+            // Harden against SSRF: the HTML being rendered is derived from an untrusted
+            // document, and `networkidle0` would otherwise fetch every URL it references
+            // (external images, stylesheets, etc.) from this host — reaching internal
+            // services or a cloud metadata endpoint (169.254.169.254). Intercept requests
+            // and allow only inline data/blob URIs and the configured chart CDN; abort every
+            // other remote fetch.
+            const allowedHosts = new Set();
+            try {
+                const chartSrc = this.config.htmlConfig?.chartJsSrc;
+                if (chartSrc)
+                    allowedHosts.add(new URL(chartSrc).host);
+            }
+            catch { /* no or invalid chart CDN configured */ }
+            let blockedRemoteResource = false;
+            await page.setRequestInterception(true);
+            page.on('request', (req) => {
+                const url = req.url();
+                if (url.startsWith('data:') || url.startsWith('blob:') || url.startsWith('about:')) {
+                    return req.continue().catch(() => { });
+                }
+                try {
+                    if (allowedHosts.has(new URL(url).host)) {
+                        return req.continue().catch(() => { });
+                    }
+                }
+                catch { /* unparseable URL — fall through and block */ }
+                blockedRemoteResource = true;
+                return req.abort().catch(() => { });
+            });
             const pdfConfig = this.config.pdfConfig;
             const timeout = pdfConfig.timeout;
             if (timeout !== undefined && timeout > 0) {
@@ -107,6 +136,9 @@ class PdfGenerator extends BaseGenerator_js_1.BaseGenerator {
             });
             await browser.close();
             browser = null;
+            if (blockedRemoteResource) {
+                this.warn(types_js_1.OfficeWarningType.BROWSER_GENERATION_LIMITATION, 'One or more remote resources referenced by the document were blocked during PDF rendering to prevent server-side request forgery (SSRF). Only inline images and the configured chart CDN are loaded.');
+            }
             return {
                 value: new Uint8Array(pdfBuffer),
                 messages: this.messages

package/dist/generators/RtfGenerator.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RtfGenerator = void 0;
+const sanitize_js_1 = require("../utils/sanitize.js");
 const BaseGenerator_js_1 = require("./BaseGenerator.js");
 /**
  * Generates high-fidelity RTF (Rich Text Format) from an AST.
@@ -134,7 +135,7 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
                     if (meta?.link) {
                         const isInternal = meta.linkType !== 'external';
                         if (!this.config.ignoreInternalLinks || !isInternal) {
-                            return `{\\field{\\*\\fldinst{HYPERLINK "${meta.link}"}}{\\fldrslt ${text}}}`;
+                            return `{\\field{\\*\\fldinst{HYPERLINK "${this.escapeRtf(meta.link)}"}}{\\fldrslt ${text}}}`;
                         }
                     }
                     return text;
@@ -214,6 +215,15 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
                 case 'break': {
                     return node.metadata?.breakType === 'page' ? '\\page\n' : '\\line\n';
                 }
+                case 'embed': {
+                    // RTF has no embed concept - degrade to the URL as plain text rather than
+                    // silently dropping the node (it has no children to fall back to).
+                    const meta = node.metadata;
+                    if (!meta?.url)
+                        return '';
+                    const pPr = this.inTable ? '\\pard\\intbl' : '\\pard';
+                    return `${pPr}\\sa120 ${this.escapeRtf(meta.url)}\\par\n`;
+                }
                 default:
                     return childrenOutput;
             }
@@ -251,20 +261,7 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
         return luminance > 0.8;
     }
     escapeRtf(text) {
-        return text
-            .replace(/\\/g, '\\\\')
-            .replace(/{/g, '\\{')
-            .replace(/}/g, '\\}')
-            .replace(/[^\x00-\x7F]/g, (match) => {
-            let code = match.charCodeAt(0);
-            if (code < 256) {
-                return `\\'${code.toString(16).padStart(2, '0')}`;
-            }
-            if (code > 32767) {
-                code -= 65536;
-            }
-            return `{\\uc0\\u${code}}`;
-        });
+        return (0, sanitize_js_1.escapeRtf)(text);
     }
 }
 exports.RtfGenerator = RtfGenerator;

package/dist/generators/TextGenerator.js

@@ -40,6 +40,17 @@ class TextGenerator extends BaseGenerator_js_1.BaseGenerator {
                 const meta = node.metadata;
                 return `[Image: ${meta?.altText || meta?.attachmentName || 'Untitled'}]${newline}`;
             }
+            if (node.type === 'embed') {
+                const meta = node.metadata;
+                return meta?.url ? `[${meta.embedType === 'youtube' ? 'YouTube' : 'Embed'}: ${meta.url}]${newline}` : '';
+            }
+            if (node.type === 'admonition') {
+                const meta = node.metadata;
+                if (childrenOutput.trim() === '')
+                    return '';
+                const label = (meta?.admonitionType || 'note').toUpperCase();
+                return `[${label}] ${childrenOutput.trim()}${newline}`;
+            }
             if (node.type === 'table' && this.config.textConfig.preserveLayout) {
                 return await this.renderTable(node, processor, newline);
             }

package/dist/index.d.ts

@@ -10,6 +10,7 @@
  * - Portable: PDF
  * - Legacy: RTF (Rich Text Format)
  * - Web/Plain: CSV, MD, HTML
+ * - E-book: EPUB
  *
  * **Key Features:**
  * - Unified AST output across all formats

package/dist/index.js

@@ -11,6 +11,7 @@
  * - Portable: PDF
  * - Legacy: RTF (Rich Text Format)
  * - Web/Plain: CSV, MD, HTML
+ * - E-book: EPUB
  *
  * **Key Features:**
  * - Unified AST output across all formats