///|
fn sco_specs() -> Array[TypeSpec] {
  [
    spec(
      "artifact",
      Sco,
      merge_fields(common_sco_fields(), [
        field("mime_type", false, String),
        field("payload_bin", false, String),
        field("url", false, Url),
        field("hashes", false, Hashes),
        field(
          "encryption_algorithm",
          false,
          OpenVocab("encryption-algorithm-ov"),
        ),
        field("decryption_key", false, String),
      ]),
      ["payload_bin", "url"],
    ),
    spec(
      "autonomous-system",
      Sco,
      merge_fields(common_sco_fields(), [
        field("number", true, NonNegativeInteger),
        field("name", false, String),
        field("rir", false, String),
      ]),
      [],
    ),
    spec(
      "directory",
      Sco,
      merge_fields(common_sco_fields(), [
        field("path", true, String),
        field("path_enc", false, String),
        field("ctime", false, Timestamp),
        field("mtime", false, Timestamp),
        field("atime", false, Timestamp),
      ]),
      [],
    ),
    spec(
      "domain-name",
      Sco,
      merge_fields(common_sco_fields(), [
        field("value", true, String),
        field("resolves_to_refs", false, IdentifierList),
      ]),
      [],
    ),
    spec(
      "email-addr",
      Sco,
      merge_fields(common_sco_fields(), [
        field("value", true, Email),
        field("display_name", false, String),
        field("belongs_to_ref", false, IdentifierOf("user-account")),
      ]),
      [],
    ),
    spec(
      "email-message",
      Sco,
      merge_fields(common_sco_fields(), [
        field("is_multipart", true, Boolean),
        field("date", false, Timestamp),
        field("content_type", false, String),
        field("from_ref", false, IdentifierOf("email-addr")),
        field("sender_ref", false, IdentifierOf("email-addr")),
        field("to_refs", false, IdentifierListOf("email-addr")),
        field("cc_refs", false, IdentifierListOf("email-addr")),
        field("bcc_refs", false, IdentifierListOf("email-addr")),
        field("message_id", false, String),
        field("subject", false, String),
        field("received_lines", false, StringList),
        field("additional_header_fields", false, Dictionary),
        field("body", false, String),
        field("body_multipart", false, ObjectList),
        field("raw_email_ref", false, IdentifierOf("artifact")),
      ]),
      [],
    ),
    spec(
      "file",
      Sco,
      merge_fields(common_sco_fields(), [
        field("hashes", false, Hashes),
        field("size", false, NonNegativeInteger),
        field("name", false, String),
        field("name_enc", false, String),
        field("magic_number_hex", false, HexBinary),
        field("mime_type", false, String),
        field("ctime", false, Timestamp),
        field("mtime", false, Timestamp),
        field("atime", false, Timestamp),
        field("parent_directory_ref", false, IdentifierOf("directory")),
        field("contains_refs", false, IdentifierList),
        field("content_ref", false, IdentifierOf("artifact")),
      ]),
      ["hashes", "name", "extensions"],
    ),
    spec(
      "ipv4-addr",
      Sco,
      merge_fields(common_sco_fields(), [
        field("value", true, IPv4),
        field("resolves_to_refs", false, IdentifierListOf("mac-addr")),
        field("belongs_to_refs", false, IdentifierListOf("autonomous-system")),
      ]),
      [],
    ),
    spec(
      "ipv6-addr",
      Sco,
      merge_fields(common_sco_fields(), [
        field("value", true, IPv6),
        field("resolves_to_refs", false, IdentifierListOf("mac-addr")),
        field("belongs_to_refs", false, IdentifierListOf("autonomous-system")),
      ]),
      [],
    ),
    spec(
      "mac-addr",
      Sco,
      merge_fields(common_sco_fields(), [field("value", true, Mac)]),
      [],
    ),
    spec(
      "mutex",
      Sco,
      merge_fields(common_sco_fields(), [field("name", true, String)]),
      [],
    ),
    spec(
      "network-traffic",
      Sco,
      merge_fields(common_sco_fields(), [
        field("start", false, Timestamp),
        field("end", false, Timestamp),
        field("is_active", false, Boolean),
        field("src_ref", false, Identifier),
        field("dst_ref", false, Identifier),
        field("src_port", false, NonNegativeInteger),
        field("dst_port", false, NonNegativeInteger),
        field("protocols", true, StringList),
        field("src_byte_count", false, NonNegativeInteger),
        field("dst_byte_count", false, NonNegativeInteger),
        field("src_packets", false, NonNegativeInteger),
        field("dst_packets", false, NonNegativeInteger),
        field("ipfix", false, Dictionary),
        field("src_payload_ref", false, IdentifierOf("artifact")),
        field("dst_payload_ref", false, IdentifierOf("artifact")),
        field("encapsulates_refs", false, IdentifierListOf("network-traffic")),
        field("encapsulated_by_ref", false, IdentifierOf("network-traffic")),
      ]),
      [],
    ),
    spec(
      "process",
      Sco,
      merge_fields(common_sco_fields(), [
        field("is_hidden", false, Boolean),
        field("pid", false, NonNegativeInteger),
        field("created_time", false, Timestamp),
        field("cwd", false, String),
        field("command_line", false, String),
        field("environment_variables", false, Dictionary),
        field(
          "opened_connection_refs",
          false,
          IdentifierListOf("network-traffic"),
        ),
        field("creator_user_ref", false, IdentifierOf("user-account")),
        field("image_ref", false, IdentifierOf("file")),
        field("parent_ref", false, IdentifierOf("process")),
        field("child_refs", false, IdentifierListOf("process")),
      ]),
      ["pid", "command_line", "image_ref", "extensions"],
    ),
    spec(
      "software",
      Sco,
      merge_fields(common_sco_fields(), [
        field("name", true, String),
        field("cpe", false, String),
        field("swid", false, String),
        field("languages", false, StringList),
        field("vendor", false, String),
        field("version", false, String),
      ]),
      [],
    ),
    spec(
      "url",
      Sco,
      merge_fields(common_sco_fields(), [field("value", true, Url)]),
      [],
    ),
    spec(
      "user-account",
      Sco,
      merge_fields(common_sco_fields(), [
        field("user_id", false, String),
        field("credential", false, String),
        field("account_login", false, String),
        field("account_type", false, OpenVocab("account-type-ov")),
        field("display_name", false, String),
        field("is_service_account", false, Boolean),
        field("is_privileged", false, Boolean),
        field("can_escalate_privs", false, Boolean),
        field("is_disabled", false, Boolean),
        field("account_created", false, Timestamp),
        field("account_expires", false, Timestamp),
        field("credential_last_changed", false, Timestamp),
        field("account_first_login", false, Timestamp),
        field("account_last_login", false, Timestamp),
      ]),
      ["user_id", "account_login", "extensions"],
    ),
    spec(
      "windows-registry-key",
      Sco,
      merge_fields(common_sco_fields(), [
        field("key", false, String),
        field("values", false, ObjectList),
        field("modified_time", false, Timestamp),
        field("creator_user_ref", false, IdentifierOf("user-account")),
        field("number_of_subkeys", false, NonNegativeInteger),
      ]),
      ["key", "extensions"],
    ),
    spec(
      "x509-certificate",
      Sco,
      merge_fields(common_sco_fields(), [
        field("is_self_signed", false, Boolean),
        field("hashes", false, Hashes),
        field("version", false, String),
        field("serial_number", false, String),
        field("signature_algorithm", false, String),
        field("issuer", false, String),
        field("validity_not_before", false, Timestamp),
        field("validity_not_after", false, Timestamp),
        field("subject", false, String),
        field("subject_public_key_algorithm", false, String),
        field("subject_public_key_modulus", false, String),
        field("subject_public_key_exponent", false, NonNegativeInteger),
      ]),
      ["hashes", "extensions"],
    ),
  ]
}