type.inbound
and any(body.links,
length(.href_url.domain.subdomain) == 40
and regex.match(.href_url.domain.subdomain, '^[a-f0-9]{40}')
and any(strings.scan_base64(.href_url.fragment),
. == recipients.to[0].email.email
)
)
Playground
Test against your own EMLs or sample data.