Recover real links from corporate email via raw MIME, not the HTML body

Regexing href attributes out of a Graph API message body returned nothing for an email that clearly contained a booking link. What worked: fetch the raw MIME (Graph getMimeContent), undo quoted-printable soft line breaks (=\r\n) and =3D escapes, then regex for URLs. Corporate mail also wraps links in one or even two layers of rewriting (Outlook SafeLinks nam09.safelinks...?url=..., Sophos protection links with base64 u= params); the true destination is in the url= query param or base64 payload, and sometimes the clean unwrapped URL also appears elsewhere in the MIME as plain text. Attachment names/sizes via the attachments endpoint are a quick way to spot brochures/PDFs the text summary never mentions.