// Never load Clarity inside the native app — the app tracks nothing // (App Store Guideline 5.1.2(i)). The native-flag script above runs // first, but read the UA directly here so this is self-contained. // // 🔴 And never load it on a no-track route. ClarityTracking's 'stop' // runs in an effect, AFTER hydration, so it cannot stop the first // page being recorded — on /intake/ the URL itself is // a one-shot write credential (FEATURES.md 8d). Refusing to inject // is the only thing that runs early enough. Prefixes come from // lib/clarity-no-track.ts so this and the component cannot drift. var mhNoTrack = ["/dashboard","/admin","/intake","/auth","/update-card","/close-account"]; var mhPath = location.pathname; var mhBlocked = mhNoTrack.some(function (prefix) { return mhPath === prefix || mhPath.indexOf(prefix + "/") === 0; }); // Four more shapes a prefix cannot express: the first two found by // /root-cause-check 2026-08-18, the third on 2026-08-19, the FRAGMENT on // 2026-09-11. Segment/substring comparisons, not // regex — escaping a regex through this template literal was got // wrong twice and shipped a pattern that could never match. // • a secret nested under a therapist slug: //tip/ var mhSeg = mhPath.split("/"); if (mhSeg.length > 3 && (mhSeg[2] === "tip" || mhSeg[2] === "review")) mhBlocked = true; // • a secret in the QUERY STRING: /bookings/?token= // Lower-cased to match queryCarriesSecret — see the note there. if (location.search.toLowerCase().indexOf("token") !== -1) mhBlocked = true; // • PII in the query string under a named param, e.g. // //account/check?email= (added 2026-08-19). // ⚠️ Matched on the param NAME. A substring test over the whole // query would also match utm_source=email&utm_medium=email, which // we email to clients pointing at their therapist's public page, // and would stop that page being recorded at all. forEach gives // (value, key) — the key is the SECOND argument. var mhKeyParts = ["email"]; new URLSearchParams(location.search).forEach(function (_v, k) { var mhK = k.toLowerCase(); for (var i = 0; i < mhKeyParts.length; i++) { if (mhK.indexOf(mhKeyParts[i]) !== -1) mhBlocked = true; } }); // • a secret in the FRAGMENT, e.g. //account?error=link_expired // #access_token=…&refresh_token=… (added 2026-09-11). A browser // REATTACHES a fragment to a redirect target that has none, so our // own 302 out of /auth/callback cannot strip one — and every client // who ever tapped a sign-in link landed here with a LIVE refresh // token in the address bar. Refresh tokens do not expire on their own. // ⚠️ The "token" substring test ONLY, mirroring fragmentCarriesSecret — // deliberately NOT the mhKeyParts loop above. That list holds "email", // and run over a fragment it would block an ordinary in-page anchor // like #contact-email, silently killing the tag on that page. if (location.hash.toLowerCase().indexOf("token") !== -1) mhBlocked = true; // 🔴 And never record a SIGNED-IN session, on any route. Clarity // exists to watch the ANONYMOUS booking funnel. ⚠️ This excludes // signed-in CLIENTS too, not only therapists — they hold the same // cookie, so returning portal clients drop out of booking-funnel // recordings. Measured 2026-08-18: 98 of 2,944 clients have ever // logged in (~3%), which is why this is accepted rather than // narrowed. Route prefixes alone could not hold this line — /dashboard // and /admin were on the list for months and were still the most // recorded pages on the platform, because login does a client-side // router navigation and the component's clarity('stop') runs an // effect too late (FEATURES.md 8d). Reading the cookie here is what // covers every private route, including ones added later. // Probed 2026-08-18: @supabase/ssr sets httpOnly:false // (dist/main/utils/constants.js), so this cookie IS visible to JS — // despite CLAUDE.md describing sessions as HttpOnly. // Substring check, deliberately not a regex: escaping one through a // template literal and then the HTML serializer was got wrong twice here, // once emitting a pattern that could never match. Supabase names the // cookie sb-PROJECTREF-auth-token, and a chunked session appends .0/.1, // so matching on -auth-token covers every variant with nothing to escape. var mhSignedIn = document.cookie.indexOf('-auth-token') !== -1; if (!mhBlocked && !mhSignedIn && navigator.userAgent.indexOf("MassageHubNative") === -1) { (function(c,l,a,r,i,t,y){ c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)}; c[a]("consent", false); // [USA Phase 4 P4-2] A US practice's page carries // (app/[slug]/layout.tsx), but it is in the BODY, which this head script runs // before. So the stub above stays immediate and only the tag insertion waits for // the document to be parsed — then is skipped when the marker is there. UK pages // still load the tag, just after parsing instead of during the head. function mhInsert(){ if (l.querySelector('meta[name="mh-no-track"]')) return; t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i; y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y); } if (l.readyState === "loading") l.addEventListener("DOMContentLoaded", mhInsert); else mhInsert(); })(window, document, "clarity", "script", "wlbdx30a7v"); }

6 Session Bundle (Facial Reflexology)