///|
fn sdo_specs() -> Array[TypeSpec] {
  [
    spec(
      "attack-pattern",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field("aliases", false, StringList),
        field("kill_chain_phases", false, KillChainPhases),
      ]),
      [],
    ),
    spec(
      "campaign",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field("aliases", false, StringList),
        field("first_seen", false, Timestamp),
        field("last_seen", false, Timestamp),
        field("objective", false, String),
      ]),
      [],
    ),
    spec(
      "course-of-action",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field("action_type", false, String),
        field("os_execution_envs", false, StringList),
      ]),
      [],
    ),
    spec(
      "grouping",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", false, String),
        field("description", false, String),
        field("context", true, OpenVocab("grouping-context-ov")),
        field("object_refs", true, IdentifierList),
      ]),
      [],
    ),
    spec(
      "identity",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field("roles", false, StringList),
        field("identity_class", false, OpenVocab("identity-class-ov")),
        field("sectors", false, OpenVocabList("industry-sector-ov")),
        field("contact_information", false, String),
      ]),
      [],
    ),
    spec(
      "indicator",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", false, String),
        field("description", false, String),
        field("indicator_types", false, OpenVocabList("indicator-type-ov")),
        field("pattern", true, Pattern),
        field("pattern_type", true, OpenVocab("pattern-type-ov")),
        field("pattern_version", false, String),
        field("valid_from", true, Timestamp),
        field("valid_until", false, Timestamp),
        field("kill_chain_phases", false, KillChainPhases),
      ]),
      [],
    ),
    spec(
      "infrastructure",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field(
          "infrastructure_types",
          false,
          OpenVocabList("infrastructure-type-ov"),
        ),
        field("aliases", false, StringList),
        field("kill_chain_phases", false, KillChainPhases),
        field("first_seen", false, Timestamp),
        field("last_seen", false, Timestamp),
      ]),
      [],
    ),
    spec(
      "intrusion-set",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field("aliases", false, StringList),
        field("first_seen", false, Timestamp),
        field("last_seen", false, Timestamp),
        field("goals", false, StringList),
        field("resource_level", false, OpenVocab("attack-resource-level-ov")),
        field("primary_motivation", false, OpenVocab("attack-motivation-ov")),
        field(
          "secondary_motivations",
          false,
          OpenVocabList("attack-motivation-ov"),
        ),
      ]),
      [],
    ),
    spec(
      "location",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", false, String),
        field("description", false, String),
        field("latitude", false, Any),
        field("longitude", false, Any),
        field("precision", false, Any),
        field("region", false, OpenVocab("region-ov")),
        field("country", false, String),
        field("administrative_area", false, String),
        field("city", false, String),
        field("street_address", false, String),
        field("postal_code", false, String),
      ]),
      ["name", "region", "country", "latitude"],
    ),
    spec(
      "malware",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", false, String),
        field("description", false, String),
        field("malware_types", false, OpenVocabList("malware-type-ov")),
        field("is_family", true, Boolean),
        field("aliases", false, StringList),
        field("kill_chain_phases", false, KillChainPhases),
        field("first_seen", false, Timestamp),
        field("last_seen", false, Timestamp),
        field("operating_system_refs", false, IdentifierListOf("software")),
        field(
          "architecture_execution_envs",
          false,
          OpenVocabList("processor-architecture-ov"),
        ),
        field(
          "implementation_languages",
          false,
          OpenVocabList("implementation-language-ov"),
        ),
        field("capabilities", false, OpenVocabList("malware-capabilities-ov")),
        field("sample_refs", false, IdentifierList),
      ]),
      [],
    ),
    spec(
      "malware-analysis",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("product", true, String),
        field("version", false, String),
        field("host_vm_ref", false, IdentifierOf("software")),
        field("operating_system_ref", false, IdentifierOf("software")),
        field("installed_software_refs", false, IdentifierListOf("software")),
        field("configuration_version", false, String),
        field("modules", false, StringList),
        field("analysis_engine_version", false, String),
        field("analysis_definition_version", false, String),
        field("submitted", false, Timestamp),
        field("analysis_started", false, Timestamp),
        field("analysis_ended", false, Timestamp),
        field("result_name", false, String),
        field("result", false, OpenVocab("malware-result-ov")),
        field("analysis_sco_refs", false, IdentifierList),
        field("sample_ref", false, Identifier),
      ]),
      [],
    ),
    spec(
      "note",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("abstract", false, String),
        field("content", true, String),
        field("authors", false, StringList),
        field("object_refs", true, IdentifierList),
      ]),
      [],
    ),
    spec(
      "observed-data",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("first_observed", true, Timestamp),
        field("last_observed", true, Timestamp),
        field("number_observed", true, NonNegativeInteger),
        field("object_refs", true, IdentifierList),
      ]),
      [],
    ),
    spec(
      "opinion",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("explanation", false, String),
        field("authors", false, StringList),
        field("opinion", true, ClosedVocab("opinion-ov")),
        field("object_refs", true, IdentifierList),
      ]),
      [],
    ),
    spec(
      "report",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field("report_types", false, OpenVocabList("report-type-ov")),
        field("published", true, Timestamp),
        field("object_refs", true, IdentifierList),
      ]),
      [],
    ),
    spec(
      "threat-actor",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field(
          "threat_actor_types",
          false,
          OpenVocabList("threat-actor-type-ov"),
        ),
        field("aliases", false, StringList),
        field("first_seen", false, Timestamp),
        field("last_seen", false, Timestamp),
        field("roles", false, OpenVocabList("threat-actor-role-ov")),
        field("goals", false, StringList),
        field(
          "sophistication",
          false,
          OpenVocab("threat-actor-sophistication-ov"),
        ),
        field("resource_level", false, OpenVocab("attack-resource-level-ov")),
        field("primary_motivation", false, OpenVocab("attack-motivation-ov")),
        field(
          "secondary_motivations",
          false,
          OpenVocabList("attack-motivation-ov"),
        ),
        field(
          "personal_motivations",
          false,
          OpenVocabList("attack-motivation-ov"),
        ),
      ]),
      [],
    ),
    spec(
      "tool",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
        field("tool_types", false, OpenVocabList("tool-type-ov")),
        field("aliases", false, StringList),
        field("kill_chain_phases", false, KillChainPhases),
        field("tool_version", false, String),
      ]),
      [],
    ),
    spec(
      "vulnerability",
      Sdo,
      merge_fields(common_sdo_fields(), [
        field("name", true, String),
        field("description", false, String),
      ]),
      [],
    ),
  ]
}