Attachment: ICS invite meeting lure

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
)
and 2 of (
  strings.icontains(body.current_thread.text, 'join the meeting now'),
  strings.icontains(body.current_thread.text, 'reset dial-in pin'),
  strings.icontains(body.current_thread.text, 'find a local number'),
  strings.icontains(body.current_thread.text, 'phone conference id')
)
and any(body.current_thread.links,
        .href_url.domain.root_domain == sender.email.domain.root_domain
        and strings.istarts_with(.href_url.path, "/ls/click")
)
and 2 of (
  strings.icontains(subject.subject, 'project implementing agreement kick-off'),
  strings.icontains(subject.subject, 'management progress meeting'),
  strings.icontains(subject.subject, 'finance committee meeting'),
  strings.icontains(subject.subject, 'project closeout report'),
  strings.icontains(subject.subject, '(and new time)'),
  // kit personalizes with the target org name: "Discussion w/ <Company>:"
  (
    regex.icontains(subject.subject, 'discussion w/ .{1,40}:')
    or 
    // machine-appended timestamp
    regex.icontains(subject.subject,
                    '(?:\d{1,2}:\d{2}:\d{2}|\d{1,2}:\d{2}\s*(?:am|pm))\s*$'
    )
  )
)