Link: SharePoint OneNote or PDF link with self sender behavior

type.inbound
// self sender
and length(recipients.to) == 1
and recipients.to[0].email.email == sender.email.email
// single link to sharepoint
and length(filter(body.current_thread.links,
                  .href_url.domain.root_domain == 'sharepoint.com'
                  // it is either a OneNote or PDF file, or unknown
                  and regex.icontains(.href_url.path,
                                      '\/:[obu]:\/(?:p|g\/personal)'
                  )
           )
) == 1
// only one link to sharepoint
and length(filter(body.current_thread.links,
                  .href_url.domain.root_domain == 'sharepoint.com'
           )
) == 1
// not sent via sharepoint
and not strings.starts_with(headers.message_id, '<Share-')
and not strings.ends_with(headers.message_id, '@odspnotify>')
// 0 or 1 attachments (this reduces FPs which had many attachments)
and length(attachments) - length(filter(attachments,
                                        strings.contains(body.html.raw,
                                                         strings.concat('src="cid:',
                                                                        .content_id
                                                         )
                                        )
                                 )
) <= 1