dns_json 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: d8cd792f367a5afca6685d1739ba086f7922090bfca844c6802e7a8e551bc09d
+  data.tar.gz: 6b2b2bbce0fd2d6fc2046d3ac2c6e6f6802588b7b138d08564b92c292fd7b6d7
+SHA512:
+  metadata.gz: 8a161dca28081a7f9fe94c9706692efdc28910796325409352c576d2342ed3b51ae68ad45b6f5412b8024a4e20585d18b2c69275014ea7f5c05fa96594bebe78
+  data.tar.gz: 901c4e8ea33b37b6cdd94fa6999fb994f2c95998a41c4d1a1bbc45914e7733637b5aac571b825472ca98b139db7739f0869d8120485f6193fb76f2c547881a32

data/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## 0.1.0 - 2026-10-12
+
+Initial release.

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Yudai Takada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,87 @@
+# dns_json
+
+Read and write DNS messages as [RFC 8427](https://www.rfc-editor.org/rfc/rfc8427) JSON, including malformed packets used for diagnostics. Ruby 3.3+; CRuby, JRuby and TruffleRuby. No dependency on the other JSON format gems.
+
+```ruby
+require "dns_json"
+
+message = DNSJSON.from_wire(packet_bytes, date: Time.now)
+message.malformed? # true when wire diagnostics were collected
+message.problems   # DNSJSON::Problem objects with byte offset and reason
+message.to_json(profile: DNSJSON::Profile::LOGGING)
+DNSJSON.parse(message.to_json).to_wire == packet_bytes # true
+
+query = DNSJSON::Message.new({
+  "ID" => 1042, "RD" => 1, "QNAME" => "service.test.",
+  "QTYPE" => 28, "QCLASS" => 1
+})
+query.to_wire
+query.qname
+```
+
+`Message` and `RR` wrap a Hash; `[]` accesses any member and `to_h` returns a deep copy. Unknown extension members survive the default JSON roundtrip. All RFC members are optional. `parse(..., strict: false)` retains invalid values and provides `warnings` with JSON Pointers; serialization validates strictly. JSON input and output use ASCII, with escaped Unicode in string values. Duplicate object keys are rejected on both json 2.x and 3.x.
+
+| Supported | Scope |
+| --- | --- |
+| Wire decoding | Headers, questions and RR sections; compressed names; partial/malformed packets with diagnostics and original octets |
+| Wire encoding | Original bytes when `messageOctetsHEX` exists; otherwise uncompressed structured reconstruction, including rrSet expansion |
+| RDATA | Every member in RFC 8427 §2.3: A, AAAA, CNAME, DNAME, NS, PTR, TXT, CDNSKEY, CDS, CSYNC, DNSKEY, HIP, IPSECKEY, KEY, MX, NSEC, NSEC3, NSEC3PARAM, OPENPGPKEY, RRSIG, SMIMEA, SPF, SRV, SSHFP, TLSA; also DS |
+| Other RR types | Numeric/IANA names and opaque `RDATAHEX` |
+| Pairs and streams | §3 query/response pairs and §4 RFC 7464 JSON text sequences |
+| Profiles | Member groups, mandatory/prohibited members, boolean or numeric one-bit values, privacy preset |
+| Not included | DNS resolution, DNSSEC verification, IDN U-label conversion, pcap, DNS Update-specific JSON, semantic validation of cryptographic key material |
+
+## Wire reconstruction and names
+
+`messageOctetsHEX` always wins, including for malformed packets. To construct an edited packet, obtain `to_h`, remove that member, make your changes, then create a new `Message`. Header flags default to zero; counts default to section lengths but explicitly supplied counts are retained. ID, each record's name/type/class, and answer TTL/RDATA must be provided. `NAMEHEX`/`QNAMEHEX` take precedence over display names and must contain an uncompressed whole name.
+
+Structured `rdata*` takes precedence over `RDATAHEX` and recalculates RDLENGTH, avoiding stale compression offsets. With opaque RDATAHEX, explicit RDLENGTH is preserved. Unknown raw RDATA can contain compression offsets that cannot safely be relocated; retain the whole-message HEX for exact reproduction. Standalone `rrOctetsHEX`, header and section octets are diagnostics, not reconstruction overrides.
+
+Names implement [verified erratum 5439](https://www.rfc-editor.org/errata/eid5439): literal dots and backslashes within labels use DNS backslash escaping before JSON encoding. Nonprintable/high octets use decimal DNS escapes. Ordinary JSON parsing therefore keeps label boundaries intact. The original RFC text's `\u002E` rule was ambiguous and is superseded by this correction. HEX remains available for exact inspection. Relative display names are accepted and emitted as absolute names; root is `.`. Pointer traversal accepts backward references only, rejects loops and limits expanded names to 255 octets.
+
+TXT uses a single text string as specified in §2.3. Multiple wire character-strings are joined; individual boundaries remain available in the original HEX. Encoding splits text into chunks of at most 255 octets. Octets map to U+0000–U+00FF, escaped in JSON. SPF uses quoted DNS presentation strings. RDATA that cannot be decoded is retained as HEX with a diagnostic.
+
+One-bit output defaults to numeric 0/1, matching §1.1 and the RFC examples. Boolean input is also accepted because §2.1 uses that terminology. TTL follows §2.2's signed 32-bit range. `dateSeconds` is nonnegative and emitted without an exponent. The section 5.2 example's inconsistent ANCOUNT is retained (erratum 5570 is held for update).
+
+## Profiles, pairs and streams
+
+```ruby
+profile = DNSJSON::Profile.new(
+  include: %i[header question answer rdata hex],
+  required: %w[QNAME], prohibited: %w[comment], one_bit_as: :boolean
+)
+message.to_json(profile: profile)
+message.to_json(profile: DNSJSON::Profile::PRIVACY)
+
+pair = DNSJSON::Pair.new(query: query, response: message)
+DNSJSON::Stream::Writer.new(io) << pair
+DNSJSON::Stream::Reader.new(io).each { |entry| puts entry.to_json }
+```
+
+Groups: `header`, `question`, `answer`, `authority`, `additional`, `rdata`, `hex`, `metadata`, `extensions`. `FULL` retains all groups; `LOGGING` omits HEX. `PRIVACY` omits all raw bytes, additional records (including EDNS Client Subnet), ID, metadata and extensions. Query names and answer addresses remain visible; this is not anonymization.
+
+Sequence readers process input incrementally, skip malformed elements by default, and expose `problems` (element indexes, not byte offsets). `strict: true` stops on the first invalid element. Error storage is capped at `max_problems: 1000`, with excess counted in `dropped_problems`.
+
+Limits are configurable on `parse`, `from_wire`, and model construction: `max_bytes: 65_535`, `max_records: 4096`, `max_pointers: 128`, `max_json_bytes: 4_194_304`, `max_depth: 32`. Limits raise `LimitError`; reaching the record or pointer bound while decoding wire data instead returns a malformed message and preserves the original bytes. A JSON sequence has a per-element size bound.
+
+## Development and release
+
+```sh
+bundle install
+bundle exec rake test
+COVERAGE=1 bundle exec rake test
+bundle exec rubocop
+bundle exec rbs -I sig validate
+bundle exec ruby script/benchmark.rb
+python3 -m venv tmp/interop/venv
+tmp/interop/venv/bin/python -m pip install --require-hashes -r script/interop-requirements.txt
+bundle exec ruby script/interop.rb
+```
+
+RFC text, extracted examples and notices are downloaded only into ignored `tmp/`. No RFC excerpts, fixtures or third-party implementation source are distributed in Git or the gem. `script/sources.json` pins SHA-256 checksums; fixture generation tests §5.1, §5.2 and its rrSet alternative. The malformed optional fragment examples in §5.1 are not standalone JSON documents; equivalent combinations are covered by independently authored tests. `data/*.yml` contains independently maintained property/RDATA metadata and IANA type identifier facts. Run `script/update_registry.rb` to check the pinned registry; audit a new source and update the checksum before `--write`.
+
+Tests include all RDATA forms, a Ruby `resolv` oracle, pinned dnspython comparison, random packets and names, truncation, pointer loops, resource bounds, and JSON validation. CI covers supported CRuby versions plus head, JRuby and TruffleRuby on Ubuntu/macOS, json 2/3, coverage, lint, RBS and interoperability. dnspython and miekg/dns were reviewed as independent implementations; only dnspython is used in the external oracle.
+
+A `v*` tag runs `.github/workflows/release.yml` with the GitHub environment `release`, validates/builds the gem, publishes through RubyGems Trusted Publishing, then creates the GitHub release from CHANGELOG. Initial RubyGems publication and Trusted Publishing setup require the owner's action before tagging.
+
+MIT; see [LICENSE.txt](LICENSE.txt).

data/SECURITY.md

@@ -0,0 +1,9 @@
+# Security
+
+Report vulnerabilities privately at https://github.com/ydah/dns_json/security/advisories/new.
+
+Treat captured DNS packets as untrusted. The reader bounds packet length, record count, expanded names, compression traversal, JSON nesting, and sequence buffers. It returns diagnostics for malformed packets. Input size violations raise `DNSJSON::LimitError`; malformed wire data within the limits is preserved byte for byte.
+
+This library performs no network requests during use, DNS resolution, DNSSEC validation, or packet transmission. JSON fields can intentionally disagree. `messageOctetsHEX` takes precedence over all other wire representations. Do not authorize a packet using one representation and then transmit another.
+
+The privacy profile excludes raw HEX, additional records (including EDNS Client Subnet), message identifiers, comments and unknown metadata. It retains query names and answer addresses and therefore is not an anonymizer. Apply your own retention and access policy.

data/data/properties.yml

@@ -0,0 +1,17 @@
+# Independently maintained API metadata; all members are optional.
+ID: {accessor: id, section: '2.1', minimum: 0, maximum: 65535}
+Opcode: {accessor: opcode, section: '2.1', minimum: 0, maximum: 15}
+RCODE: {accessor: rcode, section: '2.1', minimum: 0, maximum: 15}
+QDCOUNT: {accessor: qdcount, section: '2.1', minimum: 0, maximum: 65535}
+ANCOUNT: {accessor: ancount, section: '2.1', minimum: 0, maximum: 65535}
+NSCOUNT: {accessor: nscount, section: '2.1', minimum: 0, maximum: 65535}
+ARCOUNT: {accessor: arcount, section: '2.1', minimum: 0, maximum: 65535}
+QNAME: {accessor: qname, section: '2.1'}
+QTYPE: {accessor: qtype, section: '2.1', minimum: 0, maximum: 65535}
+QCLASS: {accessor: qclass, section: '2.1', minimum: 0, maximum: 65535}
+NAME: {accessor: name, section: '2.2'}
+TYPE: {accessor: type, section: '2.2', minimum: 0, maximum: 65535}
+CLASS: {accessor: klass, section: '2.2', minimum: 0, maximum: 65535}
+TTL: {accessor: ttl, section: '2.2', minimum: -2147483648, maximum: 2147483647}
+RDLENGTH: {accessor: rdlength, section: '2.2', minimum: 0, maximum: 65535}
+length: {accessor: length, section: '2.1/2.2', minimum: 0, maximum: 65535}

data/data/rdata_formats.yml

@@ -0,0 +1,105 @@
+---
+1:
+  name: A
+  section: '2.3'
+  wire_rfc: 1035
+28:
+  name: AAAA
+  section: '2.3'
+  wire_rfc: 3596
+5:
+  name: CNAME
+  section: '2.3'
+  wire_rfc: 1035
+39:
+  name: DNAME
+  section: '2.3'
+  wire_rfc: 6672
+2:
+  name: NS
+  section: '2.3'
+  wire_rfc: 1035
+12:
+  name: PTR
+  section: '2.3'
+  wire_rfc: 1035
+16:
+  name: TXT
+  section: '2.3'
+  wire_rfc: 1035
+60:
+  name: CDNSKEY
+  section: '2.3'
+  wire_rfc: 7344
+59:
+  name: CDS
+  section: '2.3'
+  wire_rfc: 7344
+62:
+  name: CSYNC
+  section: '2.3'
+  wire_rfc: 7477
+48:
+  name: DNSKEY
+  section: '2.3'
+  wire_rfc: 4034
+55:
+  name: HIP
+  section: '2.3'
+  wire_rfc: 8005
+45:
+  name: IPSECKEY
+  section: '2.3'
+  wire_rfc: 4025
+25:
+  name: KEY
+  section: '2.3'
+  wire_rfc: 2535
+15:
+  name: MX
+  section: '2.3'
+  wire_rfc: 1035
+47:
+  name: NSEC
+  section: '2.3'
+  wire_rfc: 4034
+50:
+  name: NSEC3
+  section: '2.3'
+  wire_rfc: 5155
+51:
+  name: NSEC3PARAM
+  section: '2.3'
+  wire_rfc: 5155
+61:
+  name: OPENPGPKEY
+  section: '2.3'
+  wire_rfc: 7929
+46:
+  name: RRSIG
+  section: '2.3'
+  wire_rfc: 4034
+53:
+  name: SMIMEA
+  section: '2.3'
+  wire_rfc: 8162
+99:
+  name: SPF
+  section: '2.3'
+  wire_rfc: 4408
+33:
+  name: SRV
+  section: '2.3'
+  wire_rfc: 2782
+44:
+  name: SSHFP
+  section: '2.3'
+  wire_rfc: 4255
+52:
+  name: TLSA
+  section: '2.3'
+  wire_rfc: 6698
+43:
+  name: DS
+  section: '2.3'
+  wire_rfc: 4034

data/data/rr_types.yml

@@ -0,0 +1,99 @@
+---
+1: A
+2: NS
+3: MD
+4: MF
+5: CNAME
+6: SOA
+7: MB
+8: MG
+9: MR
+10: 'NULL'
+11: WKS
+12: PTR
+13: HINFO
+14: MINFO
+15: MX
+16: TXT
+17: RP
+18: AFSDB
+19: X25
+20: ISDN
+21: RT
+22: NSAP
+23: NSAP-PTR
+24: SIG
+25: KEY
+26: PX
+27: GPOS
+28: AAAA
+29: LOC
+30: NXT
+31: EID
+32: NIMLOC
+33: SRV
+34: ATMA
+35: NAPTR
+36: KX
+37: CERT
+38: A6
+39: DNAME
+40: SINK
+41: OPT
+42: APL
+43: DS
+44: SSHFP
+45: IPSECKEY
+46: RRSIG
+47: NSEC
+48: DNSKEY
+49: DHCID
+50: NSEC3
+51: NSEC3PARAM
+52: TLSA
+53: SMIMEA
+55: HIP
+56: NINFO
+57: RKEY
+58: TALINK
+59: CDS
+60: CDNSKEY
+61: OPENPGPKEY
+62: CSYNC
+63: ZONEMD
+64: SVCB
+65: HTTPS
+66: DSYNC
+67: HHIT
+68: BRID
+69: UNECE
+70: ISO
+99: SPF
+100: UINFO
+101: UID
+102: GID
+103: UNSPEC
+104: NID
+105: L32
+106: L64
+107: LP
+108: EUI48
+109: EUI64
+128: NXNAME
+249: TKEY
+250: TSIG
+251: IXFR
+252: AXFR
+253: MAILB
+254: MAILA
+256: URI
+257: CAA
+258: AVC
+259: DOA
+260: AMTRELAY
+261: RESINFO
+262: WALLET
+263: CLA
+264: IPN
+32768: TA
+32769: DLV

data/lib/dns_json/model.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+module DNSJSON
+  class Message
+    PROPERTIES = YAML.safe_load_file(File.expand_path("../../data/properties.yml", __dir__)).transform_values do |properties|
+      properties.transform_values(&:freeze).freeze
+    end.freeze
+    PROPERTIES.each { |name, spec| define_method(spec.fetch("accessor")) { self[name] } }
+    attr_reader :problems, :warnings
+
+    def initialize(data = {}, strict: true, profile: nil, problems: [], **limits)
+      raise ValidationError, "expected an object" unless data.is_a?(Hash)
+
+      @limits = DNSJSON.validate_limits(limits)
+      @data = DNSJSON.copy(data)
+      @problems = problems.freeze
+      @warnings = validate
+      @warnings.concat(profile.validate(@data)) if profile
+      raise @warnings.first if strict && !@warnings.empty?
+    end
+
+    def [](key) = @data[key.to_s]
+    def to_h = DNSJSON.copy(@data)
+    def malformed? = !@problems.empty?
+    def to_wire = Wire::Writer.new(@data, **@limits).write
+
+    def to_json(*_args, profile: Profile::FULL)
+      raise validate.first unless validate.empty?
+
+      output = profile.apply(@data)
+      errors = self.class.new(output, strict: false, **@limits).warnings + profile.validate(output)
+      raise errors.first unless errors.empty?
+
+      text = JSONWriter.generate(output)
+      raise LimitError, "JSON output exceeds max_json_bytes" if text.bytesize > @limits[:max_json_bytes]
+
+      text
+    end
+
+    def validate
+      errors = []
+      validate_value(@data, "", 0, errors)
+      errors
+    end
+
+    private
+
+    def error(errors, pointer, message) = errors << ValidationError.new(message, pointer: pointer)
+
+    def validate_value(value, pointer, depth, errors, known: true)
+      raise LimitError, "object exceeds max_depth" if depth > @limits[:max_depth]
+
+      case value
+      when Hash
+        value.each do |key, item|
+          raise ValidationError, "object keys must be strings" unless key.is_a?(String)
+
+          path = "#{pointer}/#{key.gsub("~", "~0").gsub("/", "~1")}"
+          validate_member(key, item, path, errors) if known
+          child_known = known && (%w[queryMessage responseMessage compressedNAME compressedQNAME rrSet].include?(key) || SECTIONS.any? { |s| key == "#{s}RRs" })
+          validate_value(item, path, depth + 1, errors, known: child_known)
+        end
+      when Array
+        raise LimitError, "array exceeds max_records" if value.length > @limits[:max_records]
+
+        value.each_with_index { |v, i| validate_value(v, "#{pointer}/#{i}", depth + 1, errors, known: known) }
+      when Float
+        error(errors, pointer, "number must be finite") unless value.finite?
+      when String, Integer, TrueClass, FalseClass, NilClass
+        nil
+      else
+        error(errors, pointer, "unsupported JSON value")
+      end
+    end
+
+    def validate_member(key, value, path, errors)
+      spec = PROPERTIES[key]
+      range = spec && spec["minimum"] && (spec["minimum"]..spec["maximum"])
+      error(errors, path, "integer out of range") if range && !(value.is_a?(Integer) && range.cover?(value))
+      error(errors, path, "expected boolean or integer 0/1") if (BITS.key?(key) || key == "isCompressed") && ![0, 1, true, false].include?(value)
+      if key.end_with?("HEX") && !(value.is_a?(String) && value.match?(/\A(?:[0-9A-F]{2})*\z/))
+        error(errors, path, "expected uppercase even-length hexadecimal")
+      end
+      error(errors, path, "expected an array of objects") if (key.end_with?("RRs") || key == "rrSet") && !(value.is_a?(Array) && value.all?(Hash))
+      error(errors, path, "expected an object") if %w[compressedNAME compressedQNAME queryMessage responseMessage].include?(key) && !value.is_a?(Hash)
+      if (key.start_with?("rdata") || %w[NAME QNAME TYPEname CLASSname QTYPEname QCLASSname dateString comment].include?(key)) && !value.is_a?(String)
+        error(errors, path, "expected a string")
+      end
+      error(errors, path, "expected finite nonnegative seconds") if key == "dateSeconds" && !(value.is_a?(Numeric) && value.finite? && value >= 0)
+      return unless key == "dateString" && value.is_a?(String)
+
+      begin
+        match = /\A(\d{4})-(\d\d)-(\d\d)T(\d\d):(\d\d):(\d\d)(?:\.\d+)?(?:Z|[+-]([01]\d|2[0-3]):([0-5]\d))\z/.match(value)
+        raise ArgumentError unless match
+
+        year, month, day, hour, minute, second = match.captures.first(6).map(&:to_i)
+        raise ArgumentError unless Date.valid_date?(year, month, day, Date::GREGORIAN) && hour < 24 && minute < 60 && second <= 60
+
+        Time.iso8601(value)
+      rescue ArgumentError
+        error(errors, path, "expected RFC 3339 timestamp")
+      end
+    end
+  end
+
+  class RR < Message; end
+
+  class Pair < Message
+    def initialize(data = {}, query: nil, response: nil, **)
+      data = data.merge("queryMessage" => query.to_h) if query
+      data = data.merge("responseMessage" => response.to_h) if response
+      super(data, **)
+    end
+
+    def query = self["queryMessage"] && Message.new(self["queryMessage"])
+    def response = self["responseMessage"] && Message.new(self["responseMessage"])
+    def to_wire = raise(ConversionError, "select the query or response before writing wire data")
+  end
+
+  module JSONWriter
+    def self.generate(value, key = nil)
+      case value
+      when Hash then "{#{value.map { |k, v| "#{JSON.generate(k, ascii_only: true)}:#{generate(v, k)}" }.join(",")}}"
+      when Array then "[#{value.map { |v| generate(v) }.join(",")}]"
+      when Float
+        # dateSeconds forbids exponent notation; 17 significant digits retain binary64 precision.
+        number = format("%.17g", value)
+        if key == "dateSeconds" && number.match?(/[eE]/)
+          mantissa, exponent = number.split(/[eE]/)
+          digits = mantissa.delete(".")
+          point = (mantissa.index(".") || mantissa.length) + exponent.to_i
+          number = if point <= 0 then "0.#{"0" * -point}#{digits}"
+                   elsif point >= digits.length then digits + ("0" * (point - digits.length))
+                   else "#{digits[0, point]}.#{digits[point..]}"
+                   end
+        end
+        number += ".0" unless number.match?(/[.eE]/)
+        number
+      else JSON.generate(value, ascii_only: true)
+      end
+    end
+  end
+end

data/lib/dns_json/profile.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module DNSJSON
+  class Profile
+    HEADER = (%w[ID Opcode RCODE] + BITS.keys + COUNTS).freeze
+    GROUPS = %i[header question answer authority additional rdata hex metadata extensions].freeze
+    def initialize(include: GROUPS, required: [], prohibited: [], one_bit_as: :number, privacy: false)
+      raise ArgumentError, "unknown profile group" unless (include - GROUPS).empty?
+      raise ArgumentError, "one_bit_as must be :number or :boolean" unless %i[number boolean].include?(one_bit_as)
+
+      @include = include.dup.freeze
+      @required = required.map { |name| name.to_s.dup.freeze }.freeze
+      @prohibited = prohibited.map { |name| name.to_s.dup.freeze }.freeze
+      @one_bit_as = one_bit_as
+      @privacy = privacy
+      freeze
+    end
+
+    def validate(data)
+      @required.reject { |k| data.key?(k) }.map { |k| ValidationError.new("profile requires member", pointer: "/#{k}") } +
+        @prohibited.select { |k| data.key?(k) }.map { |k| ValidationError.new("profile prohibits member", pointer: "/#{k}") }
+    end
+
+    def apply(data)
+      data.each_with_object({}) do |(key, value), output|
+        next if @prohibited.include?(key) || (@privacy && %w[ID additionalRRs additionalOctetsHEX].include?(key))
+        next unless selected?(key)
+
+        nested = %w[queryMessage responseMessage compressedNAME compressedQNAME rrSet].include?(key) || SECTIONS.any? { |s| key == "#{s}RRs" }
+        unless nested
+          output[key] = DNSJSON.copy(value)
+          if BITS.key?(key) || key == "isCompressed"
+            bit = [true, 1].include?(value)
+            output[key] = if @one_bit_as == :boolean
+                            bit
+                          else
+                            (bit ? 1 : 0)
+                          end
+          end
+          next
+        end
+        output[key] = case value
+                      when Hash then apply(value)
+                      when Array then value.map { |v| v.is_a?(Hash) ? apply(v) : v }
+                      else value
+                      end
+      end
+    end
+
+    def selected?(key)
+      return true if %w[queryMessage responseMessage].include?(key)
+      return @include.include?(:hex) if key.end_with?("HEX")
+      return @include.include?(:header) if HEADER.include?(key)
+      return @include.include?(:question) if %w[QNAME QTYPE QTYPEname QCLASS QCLASSname compressedQNAME questionRRs].include?(key)
+      return @include.include?(:answer) if key == "answerRRs"
+      return @include.include?(:authority) if key == "authorityRRs"
+      return @include.include?(:additional) if key == "additionalRRs"
+      return @include.include?(:rdata) if RData::FORMATS.value?(key.delete_prefix("rdata")) && key.start_with?("rdata")
+      return @include.include?(:metadata) if %w[dateString dateSeconds comment].include?(key)
+      return true if %w[NAME TYPE TYPEname CLASS CLASSname TTL RDLENGTH rrSet compressedNAME isCompressed length].include?(key)
+
+      @include.include?(:extensions)
+    end
+    FULL = new
+    LOGGING = new(include: %i[header question answer authority additional rdata metadata])
+    PRIVACY = new(include: %i[header question answer authority rdata], privacy: true)
+  end
+end