Website (excelrewind.com) + Install Page

flowchart TB
  subgraph PAGES["apps/website (static, deployed as-is to Cloudflare Pages)"]
    IDX["index.html
(landing page)"]
    ACC["account.html
(self-serve dashboard, bare fetch)"]
    PRIV["privacy.html
(static policy)"]
    TS["troubleshoot/index.html
(add-in cache repair guide)"]
    COMP["companion/index.html
(redirect stub → install.html)"]
    NF["404.html
(hard-404, disables SPA fallback)"]
    HDR["_headers
(Cloudflare Pages headers: CSP, cache)"]
    ROBOTS["robots.txt"]
    SMAP["sitemap.xml
(generated)"]
    EXE["ExcelRewind-Setup.exe
(committed binary)"]
    PKG["ExcelRewind-Installer.pkg
(committed binary)"]
    OG["og.png
(shared social-card image)"]
    subgraph JS["js/"]
      ATTR["attribution.js
(first-touch + telemetry)"]
      PRICE["pricing.js
(progressive-enhancement pricing)"]
    end
  end

  subgraph GEN["Codegen (build time, outside apps/website)"]
    TPL["scripts/templates/install.html
(placeholder template)"]
    MKMAN["scripts/make-manifest.mts
(npm run manifest)"]
    GENSMAP["scripts/gen-sitemap.mts
(npm run sitemap)"]
  end

  subgraph ADDINPUB["apps/addin-excel/public/ (deployed to addin.excelrewind.com)"]
    INSTALLOUT["install.html
(filled template)"]
    MANIFEST["manifest.prod.xml"]
  end

  IDX -->|"cross-links"| INSTALLOUT
  IDX -->|"cross-links"| VIEWERAPP["viewer.excelrewind.com"]
  IDX -->|"footer link"| ACC
  IDX -->|"footer link"| TS
  ACC -->|"cross-links"| TS
  TS -->|"download link"| EXE
  TS -->|"'Excel on the web' link"| INSTALLOUT
  INSTALLOUT -->|"download links"| EXE
  INSTALLOUT -->|"download link"| PKG
  INSTALLOUT -->|"script src (cross-origin)"| ATTR
  IDX --> ATTR
  ACC --> ATTR
  PRIV --> ATTR
  TS --> ATTR
  NF --> ATTR
  IDX --> PRICE
  ACC --> HDR
  PRIV --> HDR
  COMP -->|"meta-refresh + location.replace()"| INSTALLOUT
  TPL --> MKMAN --> INSTALLOUT
  MKMAN --> MANIFEST
  GENSMAP --> SMAP

  classDef file fill:#f7f8fa,stroke:#c9cede,color:#1a2333;
  classDef script fill:#f2edfc,stroke:#7C3AED,color:#3d1a7a;
  classDef ext fill:#eef7f0,stroke:#3f9e5c,color:#1a4d2b;
  class IDX,ACC,PRIV,TS,COMP,NF,HDR,ROBOTS,SMAP,EXE,PKG,OG,TPL,INSTALLOUT,MANIFEST file;
  class ATTR,PRICE,MKMAN,GENSMAP script;
  class VIEWERAPP ext;

flowchart LR
  V["Visitor's browser"] -->|"URL query: utm_source, utm_medium, utm_campaign, ref, referrer header"| ATTR["js/attribution.js"]
  ATTR -->|"classify() → source enum
(share/directory/paid/ai/organic/referral/direct)"| LS1["localStorage: rw_attr
{source, utm_campaign} (first-touch, once)"]
  ATTR -->|"validated ?ref (regex A-Za-z0-9_-, 1-32 chars)"| LS2["localStorage: rw_ref"]
  ATTR -->|"crypto.randomUUID() fallback Math.random"| LS3["localStorage: rewind.viewer-id
(shared key with viewer app)"]
  ATTR -->|"HTTPS POST JSON: {viewer_id, event, props, source?, utm_campaign?}
keepalive:true, Prefer: return=minimal"| SB["Supabase REST
/rest/v1/viewer_events"]
  ATTR -.->|"navigator.doNotTrack / globalPrivacyControl"| OPT["Opt-out check
(no capture, no storage, no send)"]
  PRICE["js/pricing.js"] -->|"HTTPS POST /rest/v1/rpc/public_tiers"| SB2["Supabase RPC
public_tiers()"]
  SB2 -->|"JSON: [{key, name, monthly_price, sort_order}]"| PRICE
  PRICE -->|"innerHTML (esc()'d) replaces #pricing-tiers"| DOM1["index.html DOM"]

flowchart LR
  U["User"] -->|"email"| ACC["account.html"]
  ACC -->|"POST /auth/v1/otp {email, create_user:true}"| AUTH["Supabase GoTrue"]
  AUTH -->|"6-digit code (email, out of band)"| U
  U -->|"code"| ACC
  ACC -->|"POST /auth/v1/verify {type:email, email, token}"| AUTH
  AUTH -->|"JSON: {access_token, ...}"| ACC
  ACC -->|"localStorage: rewind.account-token"| LS["Browser localStorage"]
  ACC -->|"GET /rest/v1/profiles?select=email,tier,status,created_at
Authorization: Bearer <token>"| PG["Supabase PostgREST"]
  ACC -->|"GET /rest/v1/devices?select=label,last_seen&order=last_seen.desc"| PG
  ACC -->|"POST /rest/v1/rpc/get_my_org {}"| PG
  ACC -->|"POST /rest/v1/rpc/my_referral, public_promo_config, my_referrals"| PG
  ACC -->|"POST /rest/v1/rpc/public_tiers {}"| PG
  ACC -->|"POST /rest/v1/rpc/redeem_coupon {p_code}"| PG
  PG -->|"JSON rows (RLS: caller sees only own profile/devices/org)"| ACC
  ACC -->|"esc() then innerHTML"| DOM2["account.html DOM
(dl/ul fields, referral list, tier cards)"]

sequenceDiagram
  participant Browser
  participant AttrJS as "attribution.js"
  participant LocalStorage
  participant Supabase as "Supabase REST (viewer_events)"

  Browser->>AttrJS: page load (index.html / account.html / privacy.html / troubleshoot / 404 / install.html)
  AttrJS->>AttrJS: optedOut() check (DNT / GPC)
  alt opted out
    AttrJS-->>Browser: return immediately, no storage, no network
  else not opted out
    AttrJS->>LocalStorage: read rw_attr
    alt first visit (no rw_attr)
      AttrJS->>AttrJS: classify() from utm_*/referrer host
      AttrJS->>LocalStorage: write rw_attr = {source, utm_campaign}
    end
    AttrJS->>LocalStorage: read/write rw_ref (validated ?ref, first wins)
    AttrJS->>LocalStorage: read/write rewind.viewer-id (random UUID)
    AttrJS->>Supabase: POST /rest/v1/viewer_events {viewer_id, event:"page_view", source, utm_campaign, props:{path}}
    Note over Supabase: fire-and-forget — .catch(()=>{}) swallows failure
    Browser->>AttrJS: click on an anchor (delegated, capture phase)
    alt href contains "install.html"
      AttrJS->>Supabase: POST viewer_events {event:"cta_install_click"}
    else href matches .exe/.msi/.pkg/.dmg
      AttrJS->>Supabase: POST viewer_events {event:"download_started", props:{platform}}
    end
  end

sequenceDiagram
  participant User
  participant AccountHtml as "account.html"
  participant GoTrue as "Supabase Auth (/auth/v1)"
  participant PostgREST as "Supabase PostgREST (/rest/v1)"

  User->>AccountHtml: enter email, click "Send code"
  AccountHtml->>GoTrue: POST /auth/v1/otp {email, create_user:true}
  alt request fails
    GoTrue-->>AccountHtml: non-2xx
    AccountHtml-->>User: "Could not send the code. Check the email and try again."
  else success
    GoTrue-->>AccountHtml: 2xx (email sent out of band)
    AccountHtml-->>User: shows code field, "Code sent - check your email."
    User->>AccountHtml: enter 6-digit code, click "Verify"
    AccountHtml->>GoTrue: POST /auth/v1/verify {type:"email", email, token:code}
    alt code invalid
      GoTrue-->>AccountHtml: non-2xx / no access_token
      AccountHtml-->>User: "That code did not match. Try again."
    else code valid
      GoTrue-->>AccountHtml: {access_token, ...}
      AccountHtml->>AccountHtml: localStorage.setItem(rewind.account-token, access_token)
      AccountHtml->>PostgREST: GET /rest/v1/profiles?select=... (Bearer token)
      alt 401 (expired/invalid token)
        PostgREST-->>AccountHtml: 401
        AccountHtml->>AccountHtml: clear token, "Your session expired - sign in again."
      else 2xx
        PostgREST-->>AccountHtml: [{email, tier, status, created_at}]
        AccountHtml->>PostgREST: GET /rest/v1/devices?select=label,last_seen
        AccountHtml->>PostgREST: POST /rest/v1/rpc/get_my_org {}
        Note over AccountHtml,PostgREST: get_my_org failure is swallowed (try/catch) — org card just stays hidden
        AccountHtml->>PostgREST: POST /rest/v1/rpc/my_referral, public_promo_config
        AccountHtml->>PostgREST: POST /rest/v1/rpc/public_tiers {}
        PostgREST-->>AccountHtml: JSON rows
        AccountHtml-->>User: renders Account, Organization, Active devices, Refer & earn, Plans cards
      end
    end
  end

sequenceDiagram
  participant User
  participant AccountHtml as "account.html"
  participant PostgREST as "Supabase PostgREST"

  User->>AccountHtml: enter code, click "Redeem"
  AccountHtml->>PostgREST: POST /rest/v1/rpc/redeem_coupon {p_code: code}
  alt success
    PostgREST-->>AccountHtml: {tier, value}
    AccountHtml-->>User: "Code applied - N month(s) of <Tier>."
    AccountHtml->>AccountHtml: showAccount() re-fetch (refresh tier + tier cards)
  else known error code (invalid_coupon / expired / used_up / already_redeemed / not_authenticated)
    PostgREST-->>AccountHtml: error message containing one of the known codes
    AccountHtml-->>User: friendly mapped message (REDEEM_ERR table)
  else unknown error
    PostgREST-->>AccountHtml: other error
    AccountHtml-->>User: "Could not redeem that code."
  end

sequenceDiagram
  participant User
  participant InstallPage as "install.html (addin.excelrewind.com)"
  participant Website as "excelrewind.com"
  participant Excel

  User->>InstallPage: visit (from index.html "Install the add-in" link)
  InstallPage->>InstallPage: OS auto-detect (navigator.platform/userAgent) → scroll to Windows or Mac section
  User->>InstallPage: click "Download for Windows"
  InstallPage->>Website: GET /ExcelRewind-Setup.exe (download)
  Note over Website: attribution.js (loaded cross-origin from excelrewind.com)
fires download_started {platform:"windows"} on the click
  User->>User: double-click ExcelRewind-Setup.exe
  alt SmartScreen warning (unsigned binary)
    User->>User: "More info" → "Run anyway" (documented with SVG callouts on both install.html and troubleshoot/)
  end
  User->>Excel: close + reopen Excel
  Excel-->>User: ExcelRewind on Home tab (installer registered the shared-folder catalog)
  opt add-in cache broken (post-update)
    User->>Website: visit /troubleshoot/
    alt easiest path
      User->>Website: GET /ExcelRewind-Setup.exe again
      User->>User: re-run installer — resets %LOCALAPPDATA%\...\Wef cache, re-registers
    else manual path
      User->>User: close Excel, delete %LOCALAPPDATA%\Microsoft\Office\16.0\Wef contents
      User->>Excel: Insert → My Add-ins → Shared Folder → ExcelRewind → Add
    end
  end

flowchart TB
  WEB["apps/website
(excelrewind.com)"]
  SB["Supabase project
tohvepsjfeecjycspocg.supabase.co"]
  ADDIN["addin-excel
(addin.excelrewind.com)"]
  VIEWER["viewer
(viewer.excelrewind.com)"]
  CF["Cloudflare Pages"]
  STRIPE["Stripe
(billing, referenced not wired here)"]

  WEB -->|"HTTPS: auth OTP, PostgREST, RPC"| SB
  WEB -->|"HTTPS: anonymous event insert"| SB
  ADDIN -->|"install.html script src (cross-origin)"| WEB
  ADDIN -->|"install.html download links"| WEB
  WEB -->|"cross-links (Install CTA)"| ADDIN
  WEB -->|"cross-links (Open the viewer CTA)"| VIEWER
  CF -->|"static hosting, wrangler pages deploy"| WEB
  WEB -.->|"pricing copy mentions Stripe/Razorpay Payment Links (not implemented in this module)"| STRIPE