Service abuse: SendGrid-formatted link with actor-controlled fragment

type.inbound
and length(body.links) < 10
and any(body.links,
        // SendGrid or SendGrid-like links have been abused
        (
          .href_url.path == "/ls/click"
          or any(.href_url.query_params_decoded['upn'], . is not null)
        )
        // base64-encoded zlib-compressed JSON
        and regex.match(.href_url.fragment, 'eJy.{7}A.*')
)