endpoint_security 0.1.0-universal-darwin

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4b0bc527d2dfed0f2977454734657cbaf7135a4ed15cff6669df95309c422d23
+  data.tar.gz: 22b8aa3d46cfa618dc86d05be8ad9b69d69bdca6926f40c87d4b3d4afb92fa4e
+SHA512:
+  metadata.gz: ec91461e3365f8d76cddbe0e76f0a857f8080acaa1f14165b6aac1d1e2d1986cc4b50b2ca7c4ab9a4d6c4eaa4f401093f646dbfaa3e008a7dd7b338b1dcf7c5b
+  data.tar.gz: a764942a1debc27dbcb3d9c7d702b900a915febe9a7e50379b3df243f025962fd898734e46bfb3a5e20d34d7669487ea95a295d57996ca27d6af285d208b1b4b

data/.rubocop.yml

@@ -0,0 +1,44 @@
+AllCops:
+  CacheRootDirectory: tmp/rubocop_cache
+  NewCops: enable
+  TargetRubyVersion: 3.2
+  Exclude:
+    - "tmp/**/*"
+    - "vendor/**/*"
+    - "lib/endpoint_security/generated/**/*"
+    - "ext/endpoint_security/generated/**/*"
+
+Style/Documentation:
+  Enabled: false
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/GlobalVars:
+  Exclude:
+    - "ext/**/extconf.rb"
+
+Style/StringLiteralsInInterpolation:
+  Enabled: false
+
+Naming/VariableNumber:
+  Enabled: false
+
+Metrics/AbcSize:
+  Max: 45
+
+Metrics/CyclomaticComplexity:
+  Max: 15
+
+Metrics/PerceivedComplexity:
+  Max: 15
+
+Metrics/MethodLength:
+  Max: 50
+
+Metrics/ClassLength:
+  Max: 200
+
+Metrics/BlockLength:
+  Exclude:
+    - "test/**/*"

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Yudai Takada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,114 @@
+# endpoint_security
+
+Native Ruby bindings for Apple's Endpoint Security API on macOS 13 or newer.
+
+The gem keeps Apple's callback thread away from the Ruby VM: callbacks retain and enqueue messages into a bounded lock-free ring, a Ruby dispatcher invokes handlers, and a native watchdog guarantees one AUTH response before the deadline.
+
+## Requirements
+
+- macOS 13+
+- CRuby 3.2+
+- Xcode Command Line Tools
+- A host Ruby executable signed with `com.apple.developer.endpoint-security.client`
+- root privileges and Full Disk Access for that executable
+
+The entitlement belongs to the host executable, not to this gem. Apple must grant it for production use.
+
+For production, request `com.apple.developer.endpoint-security.client` for your Apple Developer team, sign a dedicated host executable with the approved entitlement, then grant that executable Full Disk Access. The helper under [Signing](#development) only performs the signing step; it cannot grant or bypass Apple's approval.
+
+## Installation
+
+```ruby
+gem "endpoint_security"
+```
+
+```sh
+bundle install
+rake compile
+```
+
+## Observe events
+
+```ruby
+require "endpoint_security"
+
+ES::Client.open do |client|
+  client.subscribe(:notify_exec)
+  client.on(:notify_exec) do |message|
+    target = message.event.target
+    puts "#{target.executable.path} pid=#{target.pid}"
+  end
+  client.run
+end
+```
+
+## Authorize events
+
+```ruby
+ES::Client.open(auth_default: :allow, warn_on_truncated_path: true) do |client|
+  client.subscribe(:auth_exec)
+  client.on(:auth_exec) do |message|
+    target = message.event.target
+    target.platform_binary? ? message.allow!(cache: true) : message.deny!(cache: false)
+  end
+  client.run
+end
+```
+
+The native watchdog sends `auth_default` if Ruby misses the deadline. `allow!`, `deny!`, and the watchdog share one atomic state, so a message is never answered twice. Keep network, file, and subprocess I/O out of an AUTH handler; use `retain!` and another thread when slow work is unavoidable.
+
+Do not authorize from a path string alone: paths can be truncated or replaced between observation and use. Prefer `cdhash`, `signing_id`, `team_id`, and platform-signing metadata; treat `path_truncated?` as unsafe for path-based decisions.
+
+## Muting and recording
+
+```ruby
+client.mute_path("/tmp/", type: :prefix)
+client.mute_process(pid: Process.pid)
+client.invert_muting(:path)
+
+ES::Recorder.new(events: ES::EventType.all_notify, out: $stdout).run
+```
+
+`Message#to_h` makes a JSON-compatible deep copy. Lazy `Event`, `Process`, and `File` views are invalid after the handler returns unless the message was retained.
+
+## Development
+
+Most work needs no entitlement:
+
+```sh
+rake compile:mock
+rake test
+rake test:sanitize
+rake test:drift
+rake bench
+rake rubocop
+rake dev:doctor
+```
+
+Generate metadata for a new SDK with `rake codegen`. Generated files under `ext/endpoint_security/generated` and `lib/endpoint_security/generated` must not be edited by hand.
+
+For a dedicated development machine, create a signed Ruby copy:
+
+```sh
+rake 'sign:ruby[/path/to/ruby,Developer ID Application: Example (TEAMID)]'
+```
+
+Then grant `build/es-ruby` Full Disk Access and run the bounded integration test:
+
+```sh
+RUN_ES_INTEGRATION=1 sudo -E ./build/es-ruby -S rake test:integration
+```
+
+Do not disable SIP on a general-purpose machine. This project never changes SIP, NVRAM, TCC, or signing settings automatically.
+
+## Limitations
+
+- Fork after client creation is unsupported and raises `ES::ForkedClientError`.
+- Undocumented `RESERVED_*` events expose their enum and `raw_event_bytes`, but no guessed structure.
+- Real integration tests require Apple-granted entitlement, root, signing, and TCC; CI uses `libesmock`.
+
+Public releases follow Semantic Versioning. Before 1.0, minor releases may contain breaking API changes; from 1.0 onward, breaking changes require a major release.
+
+## License
+
+MIT. See [LICENSE.txt](LICENSE.txt).

data/Rakefile

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "fileutils"
+require "open3"
+require "rake/extensiontask"
+require "rspec/core/rake_task"
+
+Rake::ExtensionTask.new("endpoint_security") do |ext|
+  ext.ext_dir = "ext/endpoint_security"
+  ext.lib_dir = "lib/endpoint_security"
+end
+
+RSpec::Core::RakeTask.new("test:unit") do |task|
+  task.pattern = "test/unit/**/*_test.rb"
+  task.rspec_opts = "-Itest"
+end
+
+RSpec::Core::RakeTask.new("test:native:spec") do |task|
+  task.pattern = "test/native/**/*_test.rb"
+  task.rspec_opts = "-Itest"
+end
+
+RSpec::Core::RakeTask.new("test:integration:spec") do |task|
+  task.pattern = "test/integration/**/*_test.rb"
+  task.rspec_opts = "-Itest"
+end
+
+task "compile:mock" do
+  Rake::Task[:clobber].invoke
+  sdk = `xcrun --show-sdk-path`.strip
+  FileUtils.mkdir_p("build")
+  sh "xcrun", "clang", "-dynamiclib", "-fblocks", "-std=c11", "-Wall", "-Wextra",
+     "-Werror", "-mmacosx-version-min=13.0", "-isysroot", sdk, "-I#{sdk}/usr/include",
+     "-install_name", "@rpath/libesmock.dylib",
+     "support/esmock/esmock.c", "-o", "build/libesmock.dylib"
+  sh({ "ES_MOCK" => "1" }, RbConfig.ruby, "-S", "rake", "clobber", "compile")
+end
+
+task "compile:real" do
+  sh({ "ES_MOCK" => nil }, RbConfig.ruby, "-S", "rake", "clobber", "compile")
+end
+
+task "test:eslogger" do
+  require_relative "lib/endpoint_security/generated/event_types"
+
+  output, status = Open3.capture2e("/usr/bin/eslogger", "--list-events")
+  raise "eslogger --list-events failed: #{output}" unless status.success?
+
+  actual = output.lines.map { |line| line.strip.to_sym }.reject { |event| event.to_s.empty? }.sort
+  expected = EndpointSecurity::EventType.all_notify.map { |event| event.to_s.delete_prefix("notify_").to_sym }.sort
+  missing = expected - actual
+  extra = actual - expected
+  unless missing.empty? && extra.empty?
+    raise "eslogger drifted (missing: #{missing.join(", ")}; extra: #{extra.join(", ")})"
+  end
+end
+
+task "test:api_surface" do
+  sdk = `xcrun --show-sdk-path`.strip
+  header = File.read(File.join(sdk, "usr/include/EndpointSecurity/ESClient.h")).gsub(%r{/\*.*?\*/}m, "")
+  declarations = header.split(";").filter_map do |statement|
+    name = statement.scan(/\b(es_[a-z0-9_]+)\s*\(/).last&.first
+    [name, statement.include?("API_DEPRECATED")] if name
+  end
+  native = Dir["ext/endpoint_security/*.c"].map { |path| File.read(path) }.join
+  native = native.gsub(%r{/\*.*?\*/}m, "").gsub(%r{//.*$}, "")
+  missing = declarations.reject(&:last).map(&:first).reject { |name| native.match?(/\b#{Regexp.escape(name)}\s*\(/) }
+  deprecated = declarations.select(&:last).map(&:first).select { |name| native.match?(/\b#{Regexp.escape(name)}\s*\(/) }
+  raise "unbound Endpoint Security functions: #{missing.join(", ")}" unless missing.empty?
+  raise "deprecated Endpoint Security functions used: #{deprecated.join(", ")}" unless deprecated.empty?
+end
+
+# rubocop:disable-next Metrics/BlockLength
+namespace :test do
+  task native: ["compile:mock", "test:native:spec"]
+  task :drift do
+    require_relative "lib/endpoint_security/generated/event_types"
+
+    generated_roots = "{codegen/overlay,codegen/snapshots," \
+                      "ext/endpoint_security/generated,lib/endpoint_security/generated}"
+    files = Dir["#{generated_roots}/**/*"].select { |path| File.file?(path) }
+    before = files.to_h { |path| [path, File.binread(path)] }
+    Rake::Task[:codegen].invoke
+    after_files = Dir["#{generated_roots}/**/*"].select { |path| File.file?(path) }
+    changed = (files | after_files).reject { |path| before[path] == (File.binread(path) if File.exist?(path)) }
+    raise "generated files drifted: #{changed.join(", ")}" unless changed.empty?
+
+    Rake::Task["test:eslogger"].invoke
+    Rake::Task["test:api_surface"].invoke
+  end
+  task :sanitize do
+    sdk = `xcrun --show-sdk-path`.strip
+    ruby_headers = [RbConfig::CONFIG.fetch("rubyhdrdir"), RbConfig::CONFIG.fetch("rubyarchhdrdir")]
+    %w[address,undefined thread].each do |sanitizer|
+      output = "tmp/queue_#{sanitizer.tr(",", "_")}"
+      sh "xcrun", "clang", "-std=c11", "-Wall", "-Wextra", "-Werror", "-pthread", "-isysroot", sdk,
+         "-I#{sdk}/usr/include", "-Iext/endpoint_security", "-fsanitize=#{sanitizer}",
+         "test/native/queue_stress.c", "ext/endpoint_security/queue.c", "-o", output
+      sh output
+
+      watchdog_output = "tmp/watchdog_#{sanitizer.tr(",", "_")}"
+      sh "xcrun", "clang", "-fblocks", "-std=c11", "-Wall", "-Wextra", "-Werror", "-Wno-unused-parameter",
+         "-pthread", "-isysroot", sdk,
+         "-I#{sdk}/usr/include", "-Iext/endpoint_security", "-Isupport/esmock",
+         *ruby_headers.flat_map { |path| ["-isystem", path] },
+         "-fsanitize=#{sanitizer}", "test/native/watchdog_stress.c", "ext/endpoint_security/watchdog.c",
+         "ext/endpoint_security/queue.c", "support/esmock/esmock.c", "-o", watchdog_output
+      sh watchdog_output
+    end
+
+    Rake::Task["compile:mock"].invoke
+    sanitizer_flags = "-fsanitize=undefined"
+    build_environment = { "ES_MOCK" => "1", "CFLAGS" => sanitizer_flags, "LDFLAGS" => sanitizer_flags }
+    begin
+      sh build_environment, RbConfig.ruby, "-S", "rake", "clobber", "compile"
+      sh({ "UBSAN_OPTIONS" => "halt_on_error=1" },
+         RbConfig.ruby, "-S", "rspec", "-Itest", *Dir["test/native/**/*_test.rb"])
+    ensure
+      sh({ "ES_MOCK" => "1", "CFLAGS" => ENV.fetch("CFLAGS", nil), "LDFLAGS" => ENV.fetch("LDFLAGS", nil) },
+         RbConfig.ruby, "-S", "rake", "clobber", "compile")
+    end
+  end
+  task integration: ["compile:real", "test:integration:spec"]
+end
+
+desc "Generate Ruby and native schema files from the active macOS SDK"
+task :codegen do
+  ruby "codegen/run.rb"
+end
+
+task test: ["test:unit", "test:native", "test:drift"]
+
+task :rubocop do
+  sh "rubocop"
+end
+
+desc "Build API documentation"
+task :yard do
+  stats, status = Open3.capture2e("yard", "stats", "--list-undoc", "lib")
+  puts stats
+  raise "YARD coverage is below 100%" unless status.success? && stats.include?("100.00% documented")
+
+  sh "yard", "doc", "lib"
+end
+
+namespace :dev do
+  desc "Diagnose the host requirements for Endpoint Security"
+  task :doctor do
+    require_relative "lib/endpoint_security/doctor"
+    EndpointSecurity::Doctor.run
+  end
+end
+
+namespace :sign do
+  desc "Copy and sign a Ruby executable with the Endpoint Security entitlement"
+  task :ruby, %i[ruby developer_id] do |_task, arguments|
+    ruby = arguments[:ruby] || RbConfig.ruby
+    identity = arguments[:developer_id] || "-"
+    sh "support/sign_ruby.sh", ruby, identity
+  end
+end
+
+desc "Run the mock delivery throughput benchmark"
+task :bench do
+  Rake::Task["compile:mock"].invoke
+  ruby "bench/throughput.rb"
+end
+
+task default: %i[compile test rubocop yard]

data/codegen/ast.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+
+module EndpointSecurity
+  module Codegen
+    class AST
+      def self.load(header:, sdk:)
+        output, error, status = Open3.capture3(
+          "xcrun", "clang", "-x", "c", "-isysroot", sdk,
+          "-Xclang", "-ast-dump=json", "-fsyntax-only", "-fparse-all-comments", header
+        )
+        raise CodegenError, "clang AST extraction failed: #{error}" unless status.success?
+
+        new(JSON.parse(output))
+      end
+
+      def initialize(root)
+        @root = root
+      end
+
+      def enum_containing(constant)
+        walk.find do |node|
+          node["kind"] == "EnumDecl" && node.fetch("inner", []).any? { |child| child["name"] == constant }
+        end || raise(CodegenError, "enum containing #{constant} was not found")
+      end
+
+      def typedef_records
+        nodes = walk.to_a
+        by_id = nodes.to_h { |node| [node["id"], node] }
+        nodes.filter_map do |node|
+          next unless node["kind"] == "TypedefDecl" && node["name"]&.start_with?("es_")
+
+          record_id = node.dig("inner", 0, "ownedTagDecl", "id")
+          record = by_id[record_id]
+          [node["name"], record] if record&.fetch("completeDefinition", false)
+        end.to_h
+      end
+
+      def typedef_enums
+        nodes = walk.to_a
+        by_id = nodes.to_h { |node| [node["id"], node] }
+        nodes.filter_map do |node|
+          next unless node["kind"] == "TypedefDecl" && node["name"]&.start_with?("es_")
+
+          enum_id = node.dig("inner", 0, "ownedTagDecl", "id")
+          enum = by_id[enum_id]
+          [node["name"], enum] if enum&.fetch("kind", nil) == "EnumDecl"
+        end.to_h
+      end
+
+      private
+
+      def walk
+        Enumerator.new do |items|
+          pending = [@root]
+          until pending.empty?
+            node = pending.pop
+            items << node
+            pending.concat(node.fetch("inner", []).reverse)
+          end
+        end
+      end
+    end
+  end
+end

data/codegen/emit_c.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module EndpointSecurity
+  module Codegen
+    class EmitC
+      def initialize(records, events)
+        @records = records
+        @events = events
+      end
+
+      def schema
+        tables = @records.map do |record|
+          next if record.fields.empty?
+
+          fields = record.fields.map do |field|
+            %(    {"#{field.name}", "#{field.type}", offsetof(#{record.name}, #{field.name}), #{field.minimum_version}})
+          end.join(",\n")
+          <<~C
+            static const esrb_field_t fields_#{record.name}[] = {
+            #{fields}
+            };
+          C
+        end.join("\n")
+
+        schemas = @records.map do |record|
+          if record.fields.empty?
+            %(    {"#{record.name}", NULL, 0})
+          else
+            table = "fields_#{record.name}"
+            %(    {"#{record.name}", #{table}, sizeof(#{table}) / sizeof(#{table}[0])})
+          end
+        end.join(",\n")
+
+        by_name = @records.to_h { |record| [record.name, record] }
+        event_entries = @events.events.filter_map do |event|
+          member = event.symbol.to_s.sub(/\A(?:auth|notify)_/, "")
+          schema = "es_event_#{member}_t"
+          next unless by_name.key?(schema)
+
+          record = by_name.fetch("es_events_t", nil)
+          field = record&.fields&.find { |candidate| candidate.name == member }
+          next unless field
+
+          indirect = field.type.include?("*") ? "true" : "false"
+          %(    {#{event.value}, offsetof(es_events_t, #{member}), "#{schema}", sizeof(#{schema}), #{indirect}})
+        end.join(",\n")
+
+        <<~C
+          /* es_schema.c -- generated by codegen/run.rb. Do not edit. */
+          #include <EndpointSecurity/EndpointSecurity.h>
+          #include <stddef.h>
+          #include "field.h"
+
+          #{tables}
+          const esrb_schema_t esrb_schemas[] = {
+          #{schemas}
+          };
+          const size_t esrb_schema_count = sizeof(esrb_schemas) / sizeof(esrb_schemas[0]);
+
+          const esrb_event_schema_t esrb_event_schemas[] = {
+          #{event_entries}
+          };
+          const size_t esrb_event_schema_count = sizeof(esrb_event_schemas) / sizeof(esrb_event_schemas[0]);
+        C
+      end
+    end
+  end
+end

data/codegen/emit_ruby.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module EndpointSecurity
+  module Codegen
+    class EmitRuby
+      def initialize(event_types_ir, cacheable: [], enumerations: [])
+        @ir = event_types_ir
+        @cacheable = cacheable
+        @enumerations = enumerations
+      end
+
+      def event_types
+        constants = @ir.events.map do |event|
+          "    # The +#{event.symbol}+ event.\n    #{event.symbol.upcase} = :#{event.symbol}"
+        end.join("\n")
+        pairs = @ir.events.map { |event| "      #{event.symbol}: #{event.value}" }.join(",\n")
+        reserved = @ir.events.select(&:reserved).map { |event| ":#{event.symbol}" }.join(", ")
+        cacheable = @cacheable.map { |event| ":#{event}" }.join(", ")
+
+        <<~RUBY
+          # frozen_string_literal: true
+
+          # Generated by codegen/run.rb. Do not edit.
+
+          module EndpointSecurity
+            # Event names and numeric values from the build SDK.
+            module EventType
+          #{constants}
+              # Exclusive upper bound for event enum values.
+              LAST = #{@ir.last}
+              # Event symbols keyed by their SDK enum values.
+              SYMBOL_TO_VALUE = {
+          #{pairs}
+              }.freeze
+              # SDK enum values keyed by event symbol.
+              VALUE_TO_SYMBOL = SYMBOL_TO_VALUE.invert.freeze
+              # All events known to the build SDK.
+              ALL = SYMBOL_TO_VALUE.keys.freeze
+              # All authorization events.
+              ALL_AUTH = ALL.select { |event| event.to_s.start_with?("auth_") }.freeze
+              # All notification events.
+              ALL_NOTIFY = ALL.select { |event| event.to_s.start_with?("notify_") }.freeze
+              # Undocumented reserved event slots.
+              RESERVED = [#{reserved}].freeze
+              # Events for which Endpoint Security accepts cached responses.
+              CACHEABLE = [#{cacheable}].freeze
+
+              module_function
+
+              # @return [Array<Symbol>] all events
+              def all = ALL
+              # @return [Array<Symbol>] authorization events
+              def all_auth = ALL_AUTH
+              # @return [Array<Symbol>] notification events
+              def all_notify = ALL_NOTIFY
+              # @return [Boolean] whether +event+ is an authorization event
+              def auth?(event) = event.to_s.start_with?("auth_")
+              # @return [Boolean] whether +event+ is a notification event
+              def notify?(event) = event.to_s.start_with?("notify_")
+              # @return [Boolean] whether +event+ is an undocumented reserved slot
+              def reserved?(event) = RESERVED.include?(event.to_sym)
+              # @return [Boolean] whether +event+ accepts a cached response
+              def cacheable?(event) = CACHEABLE.include?(event.to_sym)
+              # @return [Boolean] whether +event+ uses a flags response
+              def flags_response?(event) = event.to_sym == :auth_open
+              # @return [Integer] SDK enum value for +event+
+              def value(event) = SYMBOL_TO_VALUE.fetch(event.to_sym)
+              # @return [Symbol, Integer] event symbol, or +value+ when unknown
+              def symbol(value) = VALUE_TO_SYMBOL.fetch(value, value)
+            end
+          end
+        RUBY
+      end
+
+      def enums
+        tables = @enumerations.map do |enumeration|
+          values = enumeration.values.map { |value| "        #{value.value} => :#{value.symbol}" }.join(",\n")
+          <<~RUBY.chomp
+              "#{enumeration.name}" => {
+            #{values}
+              }.freeze
+          RUBY
+        end.join(",\n")
+
+        <<~RUBY
+          # frozen_string_literal: true
+
+          # Generated by codegen/run.rb. Do not edit.
+
+          module EndpointSecurity
+            # Symbol conversion for SDK enumeration fields.
+            module Enum
+              # Numeric-to-symbol tables keyed by SDK typedef name.
+              TABLES = {
+          #{tables}
+              }.freeze
+
+              module_function
+
+              # Returns the symbolic enum value, preserving unknown numeric values.
+              # @return [Symbol, Integer]
+              def symbol(type, value) = TABLES.fetch(type, {}).fetch(value, value)
+            end
+          end
+        RUBY
+      end
+
+      def availability
+        pairs = @ir.events.map { |event| "      #{event.symbol}: \"#{event.minimum_os}\"" }.join(",\n")
+        <<~RUBY
+          # frozen_string_literal: true
+
+          # Generated by codegen/run.rb. Do not edit.
+
+          module EndpointSecurity
+            # Runtime support metadata for SDK events.
+            module Availability
+              # Minimum macOS version keyed by event symbol.
+              EVENT_MIN_OS = {
+          #{pairs}
+              }.freeze
+            end
+          end
+        RUBY
+      end
+    end
+  end
+end