feat(audit): free public store-support audit tool + programmatic-SEO pages (/audit)

_shopify-review/FIX-PLAN.md

@@ -0,0 +1,134 @@
+I have all the confirmation I need. The audit's line numbers and code are accurate. Now I'll produce the final report.
+
+## 1. Veredicto
+
+**Sí — el path de Shopify Billing API está bien cableado.** `appSubscriptionCreate` (29.00 EUR, 14 trial_days, `test=auto` en dev stores) → `confirmation_url`; `/shopify/billing/return` re-verifica `has_active_subscription` contra Shopify antes de habilitar; el webhook `app_subscriptions/update` y `app/uninstalled` mantienen el gate (`chatbot_enabled`/`disabled_reason="billing"`) sincronizado; los OAuth installs arrancan GATED. Eso **se conserva intacto**.
+
+**Root problem de 1.2.1:** no hay una **única fuente de verdad server-side** de "esto es un install de App Store". El routing de cobro depende de un flag de cliente (`shopify_install_source === "oauth"`) evaluado **solo en JS, después** de que `/portal/api/config` resuelva. El MISMO `portal_ui/index.html` se sirve verbatim dentro del iframe de Shopify (`shopify_oauth.py:264`), y en ese HTML el bloque Stripe (`#sub-stripe`) **arranca VISIBLE por defecto** (no tiene clase `hidden`, al revés que `#sub-shopify`). Resultado: cualquier FOUC, fallo/lentitud del bootstrap de sesión, o fallback a login manual deja un link `buy.stripe.com` y precio "29 €/mes" renderizado **dentro del admin de Shopify**. A esto se suman: (a) el cron `pause_expired_trials` que emaila el link de Stripe sin excluir tiendas Shopify, (b) el footer legal incondicional que apunta a páginas que describen SOLO el cobro Stripe, y (c) landing/demo en el mismo host con botones `buy.stripe.com`. El fix de fondo: **derivar el proveedor de cobro en el servidor y, para tiendas Shopify, no emitir nunca markup/links/emails de Stripe — fail closed.**
+
+---
+
+## 2. TODAS las fugas de cobro off-platform que ve un cliente/revisor de Shopify
+
+Dedupe y ordenadas por severidad.
+
+### CRÍTICO
+
+**1. `app/portal_ui/index.html:314` (link en :324)** · El bloque `<div id="sub-stripe">` arranca **VISIBLE** (sin clase `hidden`, a diferencia de `#sub-shopify` en :308) y contiene el link hardcodeado `https://buy.stripe.com/eVq5kC5h6cQS9qa5ar5wI04` "Mensual 29 € / mes". Se sirve verbatim en el iframe (`shopify_oauth.py:264`). Solo se oculta en `fillConfig()` (:446) tras cargar config. · **Ve:** shopify-merchant / reviewer · **Fix exacto:** (a) cambiar a `<div id="sub-stripe" class="hidden">` para que falle cerrado; y (b) — definitivo — en `shopify_embedded_app()` (`shopify_oauth.py:270-281`), antes de servir el HTML, **eliminar/neutralizar el nodo `#sub-stripe`** (el iframe es por definición un install de App Store). Nunca debe existir un nodo `buy.stripe.com` en el DOM que renderice el iframe.
+
+**2. `app/scheduler.py:253-278` (query :260-270, email :236-250, const :42)** · `pause_expired_trials` selecciona trials expirados filtrando solo `is_demo=False, trial_ends_at<now, chatbot_enabled, stripe_subscription_id==""` — **NO excluye `shopify_shop`/`shopify_install_source`** — y llama `_email_trial_ended`, que emaila `TRIAL_PAY_LINK` (buy.stripe.com) + "29 euros al mes". Un OAuth tenant nunca tiene `stripe_subscription_id`, así que el guard actual no lo protege; un tenant con `shopify_shop` set + `trial_ends_at` no-nulo es barrido y emailado el link de Stripe. · **Ve:** shopify-merchant · **Fix exacto:** añadir al SELECT `Tenant.shopify_shop == ""` **y** `Tenant.shopify_install_source != "oauth"`; y en `_email_trial_ended` ramificar por install source (a tiendas Shopify: no email o apuntar a `/shopify/billing/start`, nunca `TRIAL_PAY_LINK`). Pasar el `Tenant` al helper, no solo email/slug.
+
+### ALTO
+
+**3. `app/portal_ui/index.html:316-318` → `app/routes/portal.py:398-432`** · El mismo `#sub-stripe` visible-por-defecto expone "Gestionar mi suscripción" → `openBillingPortal()` → POST `/portal/api/billing-portal` (Stripe Customer Portal). · **Ve:** shopify-merchant · **Fix:** mismo remedio que #1 — ocultar/eliminar todo `#sub-stripe` por defecto en contexto embedded/oauth.
+
+**4. `app/routes/shopify_oauth.py:347-354` + `app/routes/shopify_webhooks.py:127-131`** · Al activarse la suscripción Shopify se pone `chatbot_enabled=True`/`disabled_reason=""` pero **NO se limpia `trial_ends_at`** (a diferencia de `billing.py:193` en el path Stripe). Esto deja a un tenant Shopify clasificable como "trial impago" por el scheduler. · **Ve:** shopify-merchant (indirecto, habilita #2) · **Fix:** en ambos puntos de activación, añadir `tenant.trial_ends_at = None` (espejo de `billing.py:193`), para que un tenant Shopify-billed nunca satisfaga el predicado `trial_ends_at IS NOT NULL`.
+
+**5. `app/portal_ui/index.html:331-336` (footer) → `app/legal_ui/condiciones.html:7,71` + `cookies.html:70-71` + `privacidad.html:75,111`** · El footer se renderiza **incondicionalmente** (también en el iframe) y enlaza a Condiciones/Cookies/Privacidad, que describen SOLO el cobro Stripe ("200 EUR de alta + 10 EUR cada 3 meses… a través de la pasarela de Stripe"). No mencionan el plan Shopify de 29/mo que el merchant de App Store realmente paga. · **Ve:** shopify-merchant / reviewer · **Fix:** ramificar las plantillas legales por `billing_provider`: para installs OAuth, los términos deben describir Shopify Billing (14 días gratis, luego 29/mo en la factura de Shopify) y NO citar Stripe ni el 200€+10€. Alternativa: servir una página de términos Shopify-specific y apuntar el footer del portal embedded ahí.
+
+**6. `app/landing_ui/index.html:418, 433`** · Landing pública (`/`, mismo host que la app) renderiza dos botones Stripe vivos: `buy.stripe.com/eVq5kC5h6cQS9qa5ar5wI04` ("Empezar — 29 €/mes") y `buy.stripe.com/5kQcN4bFu2ce31MfP55wI02` ("Comprar ahora", 200€+10€). Un reviewer que navegue al dominio ve checkout off-Shopify. · **Ve:** reviewer · **Fix:** mover la landing/ventas Stripe a un host de marketing separado del `application_url`; o, si se queda en el mismo host, ocultar/reemplazar ambos botones + las notas "Pago seguro con Stripe" para contexto Shopify, dirigiendo a instalar vía App Store.
+
+**7. `app/demo_ui/index.html:164`** · Demo pública (`/demo`, sin auth, mismo host) muestra en la CTA de trial `buy.stripe.com/eVq5kC5h6cQS9qa5ar5wI04` "Suscribirme · 29 €/mes". Un reviewer que pruebe el bot acaba en una pantalla con link Stripe. · **Ve:** reviewer · **Fix:** quitar el link `buy.stripe.com` + el precio del bloque become-customer (o mover la demo al host de marketing); para merchants Shopify la demo debe enrutar al listing de la App Store.
+
+### MEDIO
+
+**8. `app/routes/demo.py:75, 353` (`_email_prospect`)** · El email de re-engagement de demo añade `MONTHLY_BUY_LINK` (buy.stripe.com) + "29 € al mes". Si un reviewer mete su email en la demo pública, recibe el link off-platform. · **Ve:** reviewer · **Fix:** no emailar link Stripe a prospects de origen Shopify; gatear `_email_prospect` para que no dispare a un email/shop ya ligado a un `shopify_shop` tenant. (También aplica a `_email_trial_activated` en demo.py:546-570.)
+
+**9. `app/routes/widget.py:149`** · El widget de tienda (superficie instalada del merchant) tiene footer "Con tecnología de [Atendyo](https://atendyo.com)". atendyo.com = la landing con botones `buy.stripe.com`. Un clic desde el widget instalado lleva al checkout Stripe. · **Ve:** all-tenants · **Fix:** para tenants Shopify-instalados, quitar el link "powered by", apuntarlo a una página sin botones Stripe, o limpiar los botones Stripe de la landing alcanzada desde contexto Shopify.
+
+**10. `app/landing_ui/index.html:29` (JSON-LD)** · `AggregateOffer` schema.org con `lowPrice 29.00`/`highPrice 200.00` EUR + setup 200€ + 10€/3mo, duplicado en FAQ (:35, :444). Estructura pública que anuncia precios off-Shopify. · **Ve:** all-tenants · **Fix:** quitar/revisar el `AggregateOffer`/`Offer` del JSON-LD y las respuestas FAQ de precio si la landing queda en el host de la app; si se mueve a host de marketing, dejar claro que es el canal directo/no-Shopify.
+
+### BAJO
+
+**11. `app/portal_ui/index.html:279 (inst-manual) + :188 (sh-manual)`** · Mismo patrón visible-por-defecto en dos panes más que ve el merchant embedded; no contienen links Stripe pero refuerzan que el estado base del panel es el experience NO-App-Store, con el App-Store como excepción activada por JS. · **Ve:** shopify-merchant · **Fix:** invertir los defaults: cuando `window.__EMBEDDED_API_KEY__` está set, tratar al tenant como oauth/App-Store por defecto (mostrar `sub-shopify`/`inst-shopify-app`/`sh-auto`, ocultar los bloques manual+Stripe) ANTES de que config resuelva, y solo relajar si config prueba lo contrario.
+
+---
+
+## 3. Plan de arreglo (orden de aplicación)
+
+Solo toca lo que un merchant de Shopify pueda ver/recibir. **No rompe el cobro Stripe de clientes directos** (todos los cambios son ramas condicionales o exclusiones por contexto Shopify; el path Stripe se conserva idéntico cuando `shopify_install_source != "oauth"`).
+
+1. **Server-side, neutralizar `#sub-stripe` en el shell embedded** (`shopify_oauth.py:270-281`): tras leer `_PAGE`, eliminar/reemplazar el bloque `#sub-stripe` (incl. su link `buy.stripe.com` y el botón billing-portal) antes de inyectar App Bridge. El iframe nunca debe contener un nodo `buy.stripe.com`. *(arregla #1, #3)*
+2. **Fail-closed en el HTML base**: cambiar a `<div id="sub-stripe" class="hidden">` y, en JS, cuando `window.__EMBEDDED_API_KEY__` esté presente, asumir oauth por defecto (ocultar manual+Stripe, mostrar Shopify) antes de cargar config. *(refuerza #1, arregla #11)*
+3. **Scheduler**: añadir `Tenant.shopify_shop == ""` **y** `Tenant.shopify_install_source != "oauth"` al SELECT de `pause_expired_trials` (`scheduler.py:262-268`); y ramificar `_email_trial_ended` por install source (pasar el `Tenant`). *(arregla #2)*
+4. **Limpiar `trial_ends_at` al activar sub Shopify**: `tenant.trial_ends_at = None` en `shopify_oauth.py:~350` y `shopify_webhooks.py:~128`. *(arregla #4, defensa en profundidad de #2)*
+5. **Legal install-source-aware**: ramificar Condiciones/Cookies/Privacidad por `billing_provider`; para oauth describir Shopify Billing y no citar Stripe ni 200€+10€. Apuntar el footer del portal embedded a esos términos. *(arregla #5)*
+6. **Demo emails**: gatear `_email_prospect`/`_email_trial_activated` (demo.py) para no emailar `MONTHLY_BUY_LINK` a emails/shops ligados a un `shopify_shop` tenant. *(arregla #8)*
+7. **Widget footer** (`widget.py:149`): para tenants Shopify, apuntar "powered by" a una página neutra sin botones Stripe (o quitar el link). *(arregla #9)*
+8. **Landing/demo públicas + JSON-LD**: idealmente mover a host de marketing separado del `application_url`; si no, ocultar botones `buy.stripe.com` y el `AggregateOffer` para visitantes de contexto Shopify y dirigir a instalar vía App Store. *(arregla #6, #7, #10)*
+
+Verificar suite verde antes de push (la regla del usuario). No tocar `reconcile_billing`, `carts.recover_due_carts` (link Shopify checkout, no billing), ni el path Shopify Billing API.
+
+---
+
+## 4. 4.5.4 — Credenciales de prueba
+
+**Cómo se accede al dashboard.** Dos vías:
+- **Embedded (lo que usa el reviewer):** dentro del admin de Shopify, el panel se auto-autentica vía **App Bridge session token** (`GET /shopify/app/session`). **No necesita Access Key ni login.** El reviewer solo instala vía OAuth desde el listing y abre la app.
+- **Standalone `/portal`:** se autentica con un **Access Key = `Tenant.dashboard_token`** (formato `"cli_" + token_urlsafe(24)`, columna `models.py:140`). Solo necesario si el reviewer quiere probar el portal fuera de Shopify.
+
+**Qué Access Key dar al reviewer.** Para el flujo App Store **no hace falta ninguna** (session token automático). Si se quiere ofrecer acceso al portal standalone de cortesía, generar/elegir un test store y darle su `dashboard_token` como Access Key. El charge se crea como **TEST** en una development store (`is_development_store` → `test=true`), así que el reviewer completa el trial de 14 días sin dinero real.
+
+**Texto exacto de "Testing instructions" (pegar en el Partner Dashboard, en inglés):**
+
+```
+TESTING INSTRUCTIONS — Atendyo
+
+No separate username/password is required. The app authenticates inside the
+Shopify admin via App Bridge session tokens.
+
+1. From your Partner/development store, install Atendyo via the App Store
+   listing (OAuth). If you land on a 404, the app redirects you to
+   /shopify/install?shop=<your-store> to start the OAuth flow.
+2. After install, open the app from Apps in your Shopify admin. The embedded
+   panel loads automatically — no login screen, no access key.
+3. Billing is handled entirely by Shopify Billing (App Subscriptions API):
+   14 days free, then 29 EUR/month, charged on your Shopify invoice. Open the
+   "Mi suscripción / My subscription" tab and click "Start free trial" — this
+   calls /shopify/billing/start and redirects you to Shopify's standard
+   subscription approval screen. On a development store the charge is created
+   as a TEST charge, so you can approve the 14-day trial with no real money.
+4. After approving, you are returned to the embedded app and the chatbot is
+   enabled. Add knowledge (a URL or PDF) in the "Conocimiento / Knowledge" tab
+   and test the assistant on your storefront or the hosted chat page.
+5. To uninstall, remove the app from Settings > Apps and sales channels — the
+   app/uninstalled webhook disables the bot automatically.
+
+OPTIONAL — standalone dashboard (not required for review): the web portal at
+/portal authenticates with a per-store Access Key. If you want to test it,
+use this Access Key for the test store: cli_<PEGAR_dashboard_token_AQUI>
+
+All app charges go through Shopify Billing. There is no off-Shopify checkout in
+the embedded app experience.
+```
+
+> Antes de enviar, reemplazar `cli_<PEGAR_dashboard_token_AQUI>` por el `dashboard_token` real de un test store (consultable en la DB: `SELECT dashboard_token FROM tenants WHERE slug='<test-store>'`).
+
+---
+
+## 5. Checklist de resubmisión
+
+- [ ] **#1/#3** `#sub-stripe` neutralizado server-side en el shell embedded (`shopify_oauth.py`) — verificado: 0 nodos `buy.stripe.com` en el HTML servido en `/shopify/app` (grep del response).
+- [ ] **#1/#11** `#sub-stripe` con `class="hidden"` por defecto + JS fail-closed (oauth por defecto cuando `__EMBEDDED_API_KEY__` presente).
+- [ ] **#2** `pause_expired_trials` excluye `shopify_shop==""` y `shopify_install_source!="oauth"`; `_email_trial_ended` ramifica por install source.
+- [ ] **#4** `trial_ends_at=None` al activar sub Shopify (oauth callback + webhook).
+- [ ] **#5** Páginas legales (condiciones/cookies/privacidad) install-source-aware; footer embedded apunta a términos Shopify (sin citar Stripe ni 200€+10€).
+- [ ] **#8** `_email_prospect`/`_email_trial_activated` no emailan link Stripe a contexto Shopify.
+- [ ] **#9** Footer del widget no enlaza a página con botones Stripe para tenants Shopify.
+- [ ] **#6/#7/#10** Landing + demo + JSON-LD: Stripe checkout no alcanzable desde contexto Shopify (idealmente host de marketing separado del `application_url`).
+- [ ] **Regresión Stripe directo**: probar un tenant `shopify_install_source!="oauth"` — sigue viendo `#sub-stripe`, recibe `TRIAL_PAY_LINK`, y `pause_expired_trials` lo barre como antes.
+- [ ] **Flujo Shopify Billing intacto**: install OAuth → gate billing → `/shopify/billing/start` → approval (TEST en dev store) → `/shopify/billing/return` habilita el bot.
+- [ ] **Suite de tests completa en verde** (gate de push del usuario; tests que aserten exclusión Shopify del cron y ausencia de `buy.stripe.com` en el HTML embedded).
+- [ ] **4.5.4**: "Testing instructions" pegadas en el Partner Dashboard con el `dashboard_token` real sustituido.
+- [ ] Confirmar que `extension/shopify.app.toml` declara el precio (Managed Pricing) o que `appSubscriptionCreate` price/currency coinciden con el copy del panel (reconciliar "29 $/mes" USD del portal con `shopify_plan_currency="EUR"` de `config.py`).
+
+**Archivos a editar (rutas absolutas):**
+- `/Users/victorgomez/code/shopify-support-bot/app/scheduler.py` (#2, #4-helper)
+- `/Users/victorgomez/code/shopify-support-bot/app/routes/shopify_oauth.py` (#1 server-strip, #4)
+- `/Users/victorgomez/code/shopify-support-bot/app/routes/shopify_webhooks.py` (#4)
+- `/Users/victorgomez/code/shopify-support-bot/app/portal_ui/index.html` (#1, #3, #11)
+- `/Users/victorgomez/code/shopify-support-bot/app/legal_ui/{condiciones,cookies,privacidad}.html` (#5)
+- `/Users/victorgomez/code/shopify-support-bot/app/routes/demo.py` (#8)
+- `/Users/victorgomez/code/shopify-support-bot/app/routes/widget.py` (#9)
+- `/Users/victorgomez/code/shopify-support-bot/app/landing_ui/index.html` + `app/demo_ui/index.html` (#6, #7, #10)
+- `/Users/victorgomez/code/shopify-support-bot/extension/shopify.app.toml` (separación de host / pricing — opcional pero recomendado)

_shopify-review/TESTING-INSTRUCTIONS.txt

@@ -0,0 +1,42 @@
+TESTING INSTRUCTIONS — Atendyo AI ChatBot & Live Chat
+(Paste this into Partner Dashboard → App listing → App setup → "Testing instructions / app review".)
+
+No separate username or password is required. Atendyo is an embedded app and
+authenticates inside the Shopify admin automatically via App Bridge session
+tokens — there is no login screen and no access key to enter.
+
+HOW TO TEST
+1. From your Partner development store, install Atendyo from the App Store
+   listing (OAuth). If you open a deep link and see a 404, start the flow at
+   /shopify/install?shop=YOUR-STORE.myshopify.com
+2. After install, open Atendyo from "Apps" in your Shopify admin. The embedded
+   panel loads automatically — no login, no access key.
+3. BILLING (Shopify Billing API only): open the "Mi suscripción / My
+   subscription" tab and click "Start free trial". This calls
+   /shopify/billing/start, which creates a Shopify App Subscription
+   (14 days free, then 29 EUR/month) and redirects you to Shopify's standard
+   subscription approval screen. On a development store the charge is created as
+   a TEST charge, so you can approve the 14-day trial with no real money.
+   All app charges go through Shopify Billing — there is NO off-Shopify checkout
+   anywhere in the embedded app experience.
+4. After approving, you return to the embedded app and the assistant is enabled.
+   Add knowledge (paste a URL or upload a PDF) in the "Conocimiento / Knowledge"
+   tab, then test the assistant on your storefront or the hosted chat page.
+5. To uninstall: Settings → Apps and sales channels → remove Atendyo. The
+   app/uninstalled webhook disables the bot automatically.
+
+OPTIONAL — standalone web dashboard (NOT required for review)
+The app also has a standalone portal at /portal that uses a per-store Access
+Key. You do not need it to review the embedded app. If you want to test it, use
+this Access Key for our test store:
+
+    Access Key:  <PASTE dashboard_token OF A TEST STORE HERE>
+    Portal URL:  https://victor34593993-flexigo-support-bot.hf.space/portal
+
+(To get the key, run on the DB:  SELECT dashboard_token FROM tenants WHERE slug='<your-test-store>';  — it looks like  cli_xxxxxxxx.)
+
+NOTE FOR THE REVIEWER
+All app charges are processed through the Shopify Billing API (App
+Subscriptions). The embedded app never links to or uses any external payment
+provider. Our public marketing website sells a separate, self-hosted (non-Shopify)
+version; that channel is not part of, and is not reachable from, the Shopify app.

app/audit.py

@@ -0,0 +1,352 @@
+"""Free public "store support audit" tool — logic + rendering.
+
+For a crawled Shopify store we score how many of the 12 universal high-intent
+buyer questions its OWN public site answers (reusing the honest gap report), grade
+it, and persist it (AuditResult, keyed by domain) so /audit/<domain> is a PERMANENT,
+shareable, crawlable page — the build-as-marketing / programmatic-SEO wedge.
+
+Everything here is honest by construction: real buyer questions, HIT/MISS from the
+store's own indexed pages, conservative MISS threshold, no invented figures.
+"""
+# ruff: noqa: E501 - this module embeds HTML/CSS page templates
+
+from __future__ import annotations
+
+import html
+import io
+from datetime import UTC, datetime
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.demo_gap import generate_gap_report
+from app.models import AuditResult, Tenant
+
+PUBLIC_BASE = "https://atendyo.com"
+BACKEND_BASE = "https://victor34593993-flexigo-support-bot.hf.space"
+
+
+def grade_for(answered: int, total: int) -> str:
+    """A clear letter grade from the answered ratio (honest, not punitive)."""
+    if total <= 0:
+        return "F"
+    pct = answered / total
+    if pct >= 0.9:
+        return "A"
+    if pct >= 0.75:
+        return "B"
+    if pct >= 0.6:
+        return "C"
+    if pct >= 0.4:
+        return "D"
+    return "F"
+
+
+def _norm_domain(raw: str) -> str:
+    d = (raw or "").strip().lower()
+    d = d.split("//")[-1].split("/")[0].removeprefix("www.")
+    return d[:255]
+
+
+async def save_audit(
+    db: AsyncSession, domain: str, report: dict, lang: str = "es"
+) -> AuditResult:
+    """Upsert the audit result for a domain (re-audits update the same row)."""
+    domain = _norm_domain(domain)
+    answered = int(report.get("answered", 0))
+    total = int(report.get("total", 12))
+    row = (
+        await db.execute(select(AuditResult).where(AuditResult.domain == domain))
+    ).scalar_one_or_none()
+    now = datetime.now(UTC)
+    if row is None:
+        row = AuditResult(domain=domain, created_at=now)
+        db.add(row)
+    row.brand = (report.get("brand") or domain)[:255]
+    row.answered = answered
+    row.total = total
+    row.grade = grade_for(answered, total)
+    row.questions = report.get("questions", [])
+    row.lang = "en" if lang == "en" else "es"
+    row.updated_at = now
+    await db.flush()
+    return row
+
+
+async def get_audit(db: AsyncSession, domain: str) -> AuditResult | None:
+    return (
+        await db.execute(
+            select(AuditResult).where(AuditResult.domain == _norm_domain(domain))
+        )
+    ).scalar_one_or_none()
+
+
+async def audit_demo_tenant(db: AsyncSession, tenant: Tenant, lang: str = "es") -> AuditResult:
+    """Run the gap report on an already-crawled demo tenant and persist it."""
+    report = await generate_gap_report(db, tenant, lang=lang)
+    domain = _norm_domain(tenant.brand_name or tenant.name or "")
+    return await save_audit(db, domain, report, lang=lang)
+
+
+# ── rendering ───────────────────────────────────────────────────────────────
+_T = {
+    "es": {
+        "title": "{brand}: responde {a}/{t} preguntas de compra | Auditoría Atendyo",
+        "desc": "{brand} responde {a} de {t} preguntas clave que tus clientes hacen antes de comprar. Mira cuáles fallan (gratis).",
+        "h1": "{brand} responde {a}/{t} preguntas de compra",
+        "sub": "Estas son las preguntas que tus clientes hacen ANTES de comprar. Cada una sin respuesta clara en tu web = una venta que se escapa o un ticket de soporte.",
+        "answers": "Tu web responde",
+        "gaps_h": "No responde con claridad:",
+        "ok_h": "Sí responde:",
+        "cta_h": "El asistente de IA de Atendyo responde TODAS estas, 24/7, con la información de tu propia tienda.",
+        "cta_btn": "Probar gratis con mi tienda",
+        "share": "Comparte tu resultado",
+        "copy": "Copiar enlace",
+        "audit_another": "Auditar otra tienda",
+        "powered": "Auditoría gratis de Atendyo · atendyo.com",
+    },
+    "en": {
+        "title": "{brand}: answers {a}/{t} shopper questions | Atendyo Audit",
+        "desc": "{brand} answers {a} of {t} key questions your customers ask before buying. See which ones fail (free).",
+        "h1": "{brand} answers {a}/{t} shopper questions",
+        "sub": "These are the questions your customers ask BEFORE buying. Each one your site doesn't clearly answer = a lost sale or a support ticket.",
+        "answers": "Your site answers",
+        "gaps_h": "Not clearly answered:",
+        "ok_h": "Answered:",
+        "cta_h": "Atendyo's AI assistant answers ALL of these, 24/7, from your own store's info.",
+        "cta_btn": "Try free on my store",
+        "share": "Share your result",
+        "copy": "Copy link",
+        "audit_another": "Audit another store",
+        "powered": "Free audit by Atendyo · atendyo.com",
+    },
+}
+
+_GRADE_COLOR = {"A": "#16a34a", "B": "#65a30d", "C": "#ca8a04", "D": "#ea580c", "F": "#dc2626"}
+
+
+def _question_text(q: dict, lang: str) -> str:
+    return str(q.get("q") or "")
+
+
+def render_audit_page(row: AuditResult, *, base: str = PUBLIC_BASE) -> str:
+    lang = "en" if row.lang == "en" else "es"
+    t = _T[lang]
+    brand = html.escape(row.brand or row.domain)
+    a, tot = row.answered, row.total
+    grade = row.grade or grade_for(a, tot)
+    color = _GRADE_COLOR.get(grade, "#dc2626")
+    qs = row.questions or []
+    gaps = [q for q in qs if q.get("status") == "miss"]
+    oks = [q for q in qs if q.get("status") == "hit"]
+    page_url = f"{base}/audit/{row.domain}"
+    og = f"{base}/audit/{row.domain}/og.png"
+
+    def _li(items):
+        return "".join(f"<li>{html.escape(_question_text(q, lang))}</li>" for q in items)
+
+    title = t["title"].format(brand=brand, a=a, t=tot)
+    desc = t["desc"].format(brand=brand, a=a, t=tot)
+    try_url = f"{base}/audit?u={html.escape(row.domain)}"
+    return f"""<!doctype html>
+<html lang="{lang}"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{title}</title>
+<meta name="description" content="{html.escape(desc)}" />
+<link rel="canonical" href="{page_url}" />
+<meta property="og:type" content="website" />
+<meta property="og:title" content="{title}" />
+<meta property="og:description" content="{html.escape(desc)}" />
+<meta property="og:image" content="{og}" />
+<meta property="og:url" content="{page_url}" />
+<meta name="twitter:card" content="summary_large_image" />
+<meta name="twitter:image" content="{og}" />
+<style>
+  :root {{ --c:{color}; }}
+  *{{box-sizing:border-box}} body{{margin:0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;color:#0f172a;background:#f8fafc}}
+  .wrap{{max-width:680px;margin:0 auto;padding:28px 20px 60px}}
+  .logo{{font-weight:800;font-size:18px;color:#1c59e9;text-decoration:none}}
+  .card{{background:#fff;border:1px solid #e2e8f0;border-radius:18px;padding:26px;margin-top:18px;box-shadow:0 8px 30px rgba(2,8,20,.05)}}
+  .score{{display:flex;align-items:center;gap:18px}}
+  .grade{{flex:none;width:78px;height:78px;border-radius:16px;background:var(--c);color:#fff;font-size:40px;font-weight:800;display:flex;align-items:center;justify-content:center}}
+  h1{{font-size:24px;margin:0 0 4px}}
+  .sub{{color:#475569;font-size:15px;margin:14px 0 0;line-height:1.55}}
+  h3{{font-size:15px;margin:22px 0 8px}}
+  ul{{margin:0;padding-left:20px;line-height:1.8}}
+  ul.miss li{{color:#b91c1c}} ul.ok li{{color:#15803d}}
+  .cta{{background:#0f1830;color:#fff;border-radius:16px;padding:22px;margin-top:22px;text-align:center}}
+  .cta p{{margin:0 0 14px;font-size:16px;line-height:1.5}}
+  .btn{{display:inline-block;background:#1c59e9;color:#fff;text-decoration:none;font-weight:700;border-radius:999px;padding:13px 26px}}
+  .share{{margin-top:20px}} .share label{{font-size:13px;color:#64748b;display:block;margin-bottom:6px}}
+  .row{{display:flex;gap:8px}} .row input{{flex:1;border:1px solid #cbd5e1;border-radius:10px;padding:10px;font-size:13px}}
+  .row a,.row button{{border:1px solid #cbd5e1;background:#fff;border-radius:10px;padding:10px 12px;font-size:13px;cursor:pointer;text-decoration:none;color:#0f172a;white-space:nowrap}}
+  footer{{text-align:center;color:#94a3b8;font-size:12px;margin-top:30px}} footer a{{color:#94a3b8}}
+</style></head>
+<body><div class="wrap">
+  <a class="logo" href="{base}/audit">Atendyo</a>
+  <div class="card">
+    <div class="score">
+      <div class="grade">{grade}</div>
+      <div><h1>{t['h1'].format(brand=brand, a=a, t=tot)}</h1>
+      <div style="color:#64748b;font-size:14px">{t['answers']} <b>{a}/{tot}</b></div></div>
+    </div>
+    <p class="sub">{t['sub']}</p>
+    {f'<h3>{t["gaps_h"]}</h3><ul class="miss">{_li(gaps)}</ul>' if gaps else ''}
+    {f'<h3>{t["ok_h"]}</h3><ul class="ok">{_li(oks)}</ul>' if oks else ''}
+    <div class="cta">
+      <p>{t['cta_h']}</p>
+      <a class="btn" href="{try_url}">{t['cta_btn']}</a>
+    </div>
+    <div class="share">
+      <label>{t['share']}</label>
+      <div class="row">
+        <input id="u" value="{page_url}" readonly />
+        <button onclick="navigator.clipboard&&navigator.clipboard.writeText(document.getElementById('u').value);this.textContent='OK'">{t['copy']}</button>
+        <a href="https://wa.me/?text={html.escape(page_url)}" target="_blank" rel="noopener">WhatsApp</a>
+      </div>
+    </div>
+  </div>
+  <footer><a href="{base}/audit">{t['powered']}</a> · <a href="{base}/audit">{t['audit_another']}</a></footer>
+</div></body></html>"""
+
+
+_LANDING = {
+    "es": {
+        "title": "¿Qué preguntas de compra NO responde tu tienda Shopify? Compruébalo gratis (2026) | Atendyo",
+        "desc": "Pega la URL de tu tienda Shopify y en 60 segundos te decimos cuántas de las 12 preguntas que tus clientes hacen antes de comprar responde tu web. Gratis, sin registro.",
+        "h1": "¿Qué preguntas de tus clientes NO responde tu tienda?",
+        "sub": "Pega la URL de tu tienda Shopify. En 60 segundos analizamos tu propia web y te decimos cuántas de las 12 preguntas clave de compra responde — y cuáles se te escapan. Gratis, sin registro.",
+        "ph": "tutienda.com",
+        "btn": "Auditar mi tienda gratis",
+        "working": "Analizando tu tienda… (suele tardar menos de un minuto)",
+        "err": "No pudimos analizar esa tienda. Revisa la URL e inténtalo otra vez.",
+    },
+    "en": {
+        "title": "Which shopper questions does your Shopify store NOT answer? Check free (2026) | Atendyo",
+        "desc": "Paste your Shopify store URL and in 60 seconds we tell you how many of the 12 questions customers ask before buying your site answers. Free, no signup.",
+        "h1": "Which of your customers' questions does your store NOT answer?",
+        "sub": "Paste your Shopify store URL. In 60 seconds we analyze your own site and tell you how many of the 12 key buying questions it answers — and which ones slip through. Free, no signup.",
+        "ph": "yourstore.com",
+        "btn": "Audit my store free",
+        "working": "Analyzing your store… (usually under a minute)",
+        "err": "We couldn't analyze that store. Check the URL and try again.",
+    },
+}
+
+
+def render_audit_landing(lang: str = "es", *, base: str = PUBLIC_BASE) -> str:
+    lang = "en" if lang == "en" else "es"
+    t = _LANDING[lang]
+    return f"""<!doctype html>
+<html lang="{lang}"><head>
+<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{t['title']}</title>
+<meta name="description" content="{html.escape(t['desc'])}" />
+<link rel="canonical" href="{base}/audit" />
+<meta property="og:title" content="{html.escape(t['title'])}" />
+<meta property="og:description" content="{html.escape(t['desc'])}" />
+<meta property="og:image" content="{base}/og.png" />
+<meta name="twitter:card" content="summary_large_image" />
+<style>
+  *{{box-sizing:border-box}} body{{margin:0;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;color:#0f172a;background:linear-gradient(180deg,#fff,#eef2ff)}}
+  .wrap{{max-width:640px;margin:0 auto;padding:64px 20px;text-align:center}}
+  .logo{{font-weight:800;font-size:18px;color:#1c59e9;text-decoration:none}}
+  h1{{font-size:32px;margin:26px 0 12px;line-height:1.2}}
+  p.sub{{color:#475569;font-size:17px;line-height:1.55;margin:0 auto 26px;max-width:520px}}
+  form{{display:flex;gap:8px;max-width:460px;margin:0 auto}}
+  input{{flex:1;border:1px solid #cbd5e1;border-radius:12px;padding:14px;font-size:16px;min-width:0}}
+  button{{background:#1c59e9;color:#fff;border:0;border-radius:12px;padding:14px 22px;font-size:16px;font-weight:700;cursor:pointer;white-space:nowrap}}
+  .status{{margin-top:18px;color:#475569;min-height:24px}}
+  .err{{color:#b91c1c}}
+  @media(max-width:560px){{h1{{font-size:26px}} form{{flex-direction:column}}}}
+</style></head>
+<body><div class="wrap">
+  <a class="logo" href="{base}">Atendyo</a>
+  <h1>{t['h1']}</h1>
+  <p class="sub">{t['sub']}</p>
+  <form id="f" onsubmit="return go(event)">
+    <input id="u" type="text" inputmode="url" placeholder="{t['ph']}" autocomplete="off" />
+    <button type="submit">{t['btn']}</button>
+  </form>
+  <div class="status" id="s"></div>
+<script>
+var WORKING={t['working']!r}, ERR={t['err']!r};
+(function(){{var p=new URLSearchParams(location.search).get('u');if(p){{document.getElementById('u').value=p;}}}})();
+function go(e){{
+  e.preventDefault();
+  var u=(document.getElementById('u').value||'').trim();
+  if(!u) return false;
+  var s=document.getElementById('s'); s.className='status'; s.textContent=WORKING;
+  fetch('/audit/start',{{method:'POST',headers:{{'Content-Type':'application/json'}},body:JSON.stringify({{url:u}})}})
+   .then(function(r){{return r.ok?r.json():r.json().then(function(j){{throw new Error(j.detail||'error')}})}})
+   .then(function(d){{poll(d.slug,0)}})
+   .catch(function(){{s.className='status err';s.textContent=ERR}});
+  return false;
+}}
+function poll(slug,n){{
+  var s=document.getElementById('s');
+  if(n>40){{s.className='status err';s.textContent=ERR;return}}
+  fetch('/audit/status?d='+encodeURIComponent(slug))
+   .then(function(r){{return r.json()}})
+   .then(function(st){{
+     if(st.done && st.stage==='error'){{s.className='status err';s.textContent=ERR;return}}
+     // crawl ready enough to score once we have pages OR it's done
+     if(st.done || (st.pages_done||0)>=4){{ finalize(slug); return; }}
+     setTimeout(function(){{poll(slug,n+1)}},2500);
+   }})
+   .catch(function(){{setTimeout(function(){{poll(slug,n+1)}},2500)}});
+}}
+function finalize(slug){{
+  fetch('/audit/'+encodeURIComponent(slug)+'/finalize',{{method:'POST'}})
+   .then(function(r){{return r.ok?r.json():r.json().then(function(j){{throw new Error(j.detail||'error')}})}})
+   .then(function(d){{ window.location.href = '/audit/'+encodeURIComponent(d.domain); }})
+   .catch(function(){{document.getElementById('s').className='status err';document.getElementById('s').textContent=ERR}});
+}}
+</script>
+</div></body></html>"""
+
+
+def og_image_bytes(row: AuditResult) -> bytes:
+    """A 1200x630 share card with the score. Bulletproof: any failure returns a
+    minimal valid PNG instead of raising (the page must never break)."""
+    try:
+        from PIL import Image, ImageDraw, ImageFont
+
+        grade = row.grade or grade_for(row.answered, row.total)
+        color = _GRADE_COLOR.get(grade, "#dc2626")
+        img = Image.new("RGB", (1200, 630), "#0f1830")
+        d = ImageDraw.Draw(img)
+
+        def font(sz: int):
+            try:
+                return ImageFont.truetype("DejaVuSans-Bold.ttf", sz)
+            except Exception:  # noqa: BLE001
+                try:
+                    return ImageFont.load_default(sz)
+                except TypeError:
+                    return ImageFont.load_default()
+
+        d.text((70, 70), "Atendyo · Auditoría de tienda", font=font(34), fill="#8aa0c8")
+        brand = (row.brand or row.domain)[:34]
+        d.text((70, 180), brand, font=font(64), fill="#ffffff")
+        d.text((70, 300), f"responde {row.answered}/{row.total}", font=font(58), fill="#ffffff")
+        d.text((70, 372), "preguntas de compra", font=font(40), fill="#cbd5e1")
+        # grade chip + centered letter (anchor="mm" centers cleanly; fallback if
+        # the loaded font doesn't support anchors)
+        d.rounded_rectangle((900, 180, 1130, 410), radius=28, fill=color)
+        gf = font(150)
+        try:
+            d.text((1015, 295), grade, font=gf, fill="#ffffff", anchor="mm")
+        except (ValueError, TypeError):
+            d.text((975, 225), grade, font=gf, fill="#ffffff")
+        d.text((70, 520), "atendyo.com/audit · pruébalo gratis con tu tienda", font=font(30), fill="#8aa0c8")
+        buf = io.BytesIO()
+        img.save(buf, format="PNG")
+        return buf.getvalue()
+    except Exception:  # noqa: BLE001 - never break the page over an image
+        # 1x1 transparent PNG fallback
+        import base64
+        return base64.b64decode(
+            "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mbut"
+            "FAAAAAElFTkSuQmCC"
+        )

app/legal_ui/condiciones.html

@@ -68,7 +68,10 @@
     <p>Las respuestas del asistente se generan automáticamente mediante inteligencia artificial a partir de la información configurada por el cliente. Aunque el sistema está diseñado para responder solo con esa información, ningún sistema de IA está libre de errores: el cliente es responsable de revisar la información que le proporciona y la configuración de su asistente.</p>
 
     <h2>3. Precio y forma de pago</h2>
-    <p>El precio del servicio es de <strong>200 EUR de alta</strong> (pago único) más <strong>10 EUR cada 3 meses</strong> en concepto de mantenimiento, <strong>IVA incluido</strong> en ambos importes. El pago se realiza de forma segura a través de la pasarela de Stripe. Para empresas y autónomos se emite factura con NIF a través de Stripe.</p>
+    <p>El precio del servicio para clientes <strong>directos</strong> (que contratan en atendyo.com) es de <strong>200 EUR de alta</strong> (pago único) más <strong>10 EUR cada 3 meses</strong> en concepto de mantenimiento, <strong>IVA incluido</strong> en ambos importes. El pago se realiza de forma segura a través de la pasarela de Stripe. Para empresas y autónomos se emite factura con NIF a través de Stripe.</p>
+    <div class="box">
+      <p><strong>Instalación desde la Shopify App Store.</strong> Si has instalado Atendyo como aplicación desde la Shopify App Store, <strong>el precio anterior (200 EUR + 10 EUR) y la pasarela de Stripe no se te aplican</strong>. En ese caso el servicio dispone de <strong>14 días gratis</strong> y, a continuación, <strong>29 €/mes</strong>, importes que se cobran <strong>exclusivamente a través de Shopify Billing</strong> y aparecen en tu factura de Shopify. No te cobramos ni te facturamos por Stripe.</p>
+    </div>
 
     <h2>4. Activación tras el pago</h2>
     <p>La activación es inmediata y automática: al completarse el pago se crea tu cuenta y recibes un email con tu clave de acceso al panel y las instrucciones de instalación. Desde ese momento el servicio de alta queda completamente ejecutado y puedes configurar e instalar el asistente en tu web.</p>

app/legal_ui/cookies.html

@@ -68,7 +68,8 @@
     <p>La normativa (artículo 22.2 de la LSSI-CE, que traslada la Directiva ePrivacy) solo exige consentimiento para los dispositivos de almacenamiento que <em>no</em> sean estrictamente necesarios para prestar el servicio solicitado por el usuario. Todo el almacenamiento descrito arriba es técnico y necesario (mantener tu sesión de chat, tu idioma o tu acceso), por lo que está <strong>exento de consentimiento</strong> y no se requiere banner. Si algún día incorporásemos cookies de analítica o publicidad, actualizaríamos esta política y pediríamos consentimiento previo.</p>
 
     <h2>4. Pagos con Stripe</h2>
-    <p>El pago del servicio se realiza en la pasarela de Stripe (en el dominio de Stripe). Durante el proceso de pago, Stripe utiliza sus propias cookies conforme a su <a href="https://stripe.com/es/legal/cookies-policy" target="_blank" rel="noopener">política de cookies</a>.</p>
+    <p>Para los clientes <strong>directos</strong> (que contratan en atendyo.com), el pago del servicio se realiza en la pasarela de Stripe (en el dominio de Stripe). Durante el proceso de pago, Stripe utiliza sus propias cookies conforme a su <a href="https://stripe.com/es/legal/cookies-policy" target="_blank" rel="noopener">política de cookies</a>.</p>
+    <p>Si has instalado Atendyo desde la <strong>Shopify App Store</strong>, el cobro (14 días gratis y luego 29 €/mes) se gestiona <strong>a través de Shopify Billing</strong>, no de Stripe, por lo que Stripe no interviene ni instala cookies en tu proceso de pago.</p>
 
     <h2>5. Cómo eliminar este almacenamiento</h2>
     <p>Puedes borrar el almacenamiento local en cualquier momento desde la configuración de tu navegador (borrar datos de sitios web). Al hacerlo, el chat iniciará una conversación nueva y tendrás que volver a elegir tus preferencias.</p>

app/legal_ui/privacidad.html

@@ -72,7 +72,7 @@
       </tr>
       <tr>
         <td><strong>Compra y cuenta de cliente</strong></td>
-        <td>Email, nombre del negocio y datos de facturación. El pago se realiza en la pasarela de Stripe; no almacenamos los datos de tu tarjeta.</td>
+        <td>Email, nombre del negocio y datos de facturación. Para clientes <strong>directos</strong> (atendyo.com) el pago se realiza en la pasarela de Stripe. Si instalaste Atendyo desde la <strong>Shopify App Store</strong>, el cobro lo gestiona <strong>Shopify Billing</strong> (no Stripe). En ningún caso almacenamos los datos de tu tarjeta.</td>
         <td>Ejecución del contrato (art. 6.1.b) y obligaciones legales, en especial fiscales (art. 6.1.c).</td>
         <td>Mientras dure la relación contractual y, después, durante los plazos de prescripción legales y fiscales aplicables.</td>
       </tr>
@@ -108,7 +108,8 @@
       <li><strong>Hugging Face, Inc.</strong> (EE. UU.) — alojamiento de la aplicación.</li>
       <li><strong>Neon, Inc.</strong> — base de datos PostgreSQL, alojada en la región <strong>eu-central-1</strong> (Fráncfort, Unión Europea).</li>
       <li><strong>Brevo</strong> (Sendinblue SAS, Francia, UE) — envío de emails transaccionales.</li>
-      <li><strong>Stripe</strong> (Stripe Payments Europe, Ltd. y Stripe, Inc.) — pagos y facturación.</li>
+      <li><strong>Stripe</strong> (Stripe Payments Europe, Ltd. y Stripe, Inc.) — pagos y facturación de los clientes directos (atendyo.com).</li>
+      <li><strong>Shopify</strong> (Shopify International Ltd.) — facturación a través de Shopify Billing únicamente cuando Atendyo se ha instalado desde la Shopify App Store (en ese caso no se utiliza Stripe).</li>
       <li><strong>Proveedores de inferencia de IA</strong> — generación de las respuestas del asistente: Groq, Cloudflare, Cerebras, SambaNova y OpenRouter (EE. UU.) y Mistral AI (Francia, UE). Usamos sus API con condiciones de <strong>no entrenamiento</strong>: los mensajes enviados por API no se utilizan para entrenar sus modelos.</li>
       <li><strong>Meta Platforms</strong> (WhatsApp Cloud API) — solo cuando el canal WhatsApp está activo, para recibir y enviar los mensajes de WhatsApp.</li>
     </ul>

app/main.py

@@ -12,6 +12,7 @@ from app import db as dbmod
 from app.config import get_settings
 from app.routes import (
     admin,
+    audit,
     blog,
     chat,
     demo,
@@ -118,6 +119,7 @@ def create_app() -> FastAPI:
     app.include_router(blog.router)
     app.include_router(legal.router)
     app.include_router(demo.router)
+    app.include_router(audit.router)
     app.include_router(reviews.router)
     return app
 

app/models.py

@@ -439,3 +439,25 @@ class ChatMessage(Base):
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
 
     session: Mapped[ChatSession] = relationship(back_populates="messages")
+
+
+class AuditResult(Base):
+    """PERSISTENT, public, SEO-indexable result of the free "store support audit"
+    tool: for a crawled Shopify store, how many of the 12 universal high-intent
+    buyer questions its OWN site answers. Keyed by domain (one page per store,
+    re-audits update it) and SURVIVES the ephemeral demo tenant being purged at
+    48h — that's the point: /audit/<domain> is a permanent, shareable, crawlable
+    page that seeds programmatic SEO and funnels to the bot that DOES answer them."""
+
+    __tablename__ = "audit_results"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    domain: Mapped[str] = mapped_column(String(255), unique=True, index=True)
+    brand: Mapped[str] = mapped_column(String(255), default="")
+    answered: Mapped[int] = mapped_column(Integer, default=0)
+    total: Mapped[int] = mapped_column(Integer, default=12)
+    grade: Mapped[str] = mapped_column(String(2), default="")     # A..F
+    questions: Mapped[list] = mapped_column(JSON, default=list)   # [{q,status,score}]
+    lang: Mapped[str] = mapped_column(String(4), default="es")
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
+    updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)

app/portal_ui/index.html

@@ -310,8 +310,10 @@
         <p class="muted" id="sub-sh-status">Tu plan se gestiona a través de Shopify: 14 días gratis y luego 29 $/mes (aparece en tu factura de Shopify). Para cambiar de plan o cancelar, hazlo desde tu admin de Shopify: Configuración → Aplicaciones y canales de venta → Atendyo.</p>
         <div class="row" id="sub-sh-cta" style="margin-top:12px;"><button onclick="startShopifyTrial('/shopify/billing/start')">Empezar prueba gratis</button></div>
       </div>
-      <!-- Stripe (direct) tenants. -->
-      <div id="sub-stripe">
+      <!-- Stripe (direct) tenants. Starts hidden so it FAILS CLOSED: a Shopify
+           App-Store install must never see off-platform Stripe billing. fillConfig()
+           relaxes it only for a proven non-oauth (direct) tenant. -->
+      <div id="sub-stripe" class="hidden">
         <div class="card">
           <strong>Mi suscripción</strong>
           <p class="muted">Cancela, cambia tu tarjeta o consulta tus facturas.</p>
@@ -762,6 +764,15 @@
     // show another store's data — auth comes only from the Shopify session token.
     try { localStorage.removeItem("ssb_portal_token"); } catch(e){}
     var lg = $("login"); if(lg) lg.classList.add("hidden");
+    // FAIL CLOSED for App-Store installs: default to the Shopify experience BEFORE
+    // config loads, so off-platform Stripe billing is never shown/linked even for a
+    // moment. Show the Shopify subscription pane; keep the Stripe pane and the
+    // manual (non-App-Store) Shopify/install panes hidden. fillConfig() later relaxes
+    // these ONLY if config proves this is a non-oauth (direct) tenant.
+    if($("sub-shopify")) $("sub-shopify").classList.remove("hidden");
+    if($("sub-stripe")) $("sub-stripe").classList.add("hidden");
+    if($("sh-manual")) $("sh-manual").classList.add("hidden");
+    if($("inst-manual")) $("inst-manual").classList.add("hidden");
     (function boot(tries){
       if(!(window.shopify && window.shopify.idToken)){
         if(tries>0) return setTimeout(function(){ boot(tries-1); }, 300);

app/routes/audit.py

@@ -0,0 +1,100 @@
+"""Public free "store support audit" tool — the build-as-marketing wedge.
+
+Paste any Shopify store URL -> we crawl it (reusing the demo machinery) and score
+how many of the 12 universal buyer questions its OWN site answers, then render a
+PERMANENT, shareable, SEO-indexable page at /audit/<domain> (survives the demo
+tenant purge). Each page funnels to the bot that DOES answer them. No signup.
+
+ALL endpoints live under /audit/* so a single Netlify 200-proxy serves the whole
+tool under atendyo.com (clean canonical URLs for SEO). Route order matters:
+the catch-all GET /audit/{domain} is registered LAST so /audit/start and
+/audit/status are not swallowed as a "domain".
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from fastapi.responses import FileResponse, HTMLResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app import audit as audit_mod
+from app.db import get_session
+from app.routes.demo import DemoStartIn, demo_start, demo_status
+from app.tenancy import get_tenant_by_slug
+
+router = APIRouter()
+
+_OG_FALLBACK = Path(__file__).resolve().parent.parent / "landing_ui" / "og.png"
+
+
+def _lang(request: Request) -> str:
+    q = (request.query_params.get("lang") or "").lower()
+    if q in ("es", "en"):
+        return q
+    al = (request.headers.get("accept-language") or "").lower()
+    return "es" if al.startswith("es") else ("en" if al.startswith("en") else "es")
+
+
+@router.get("/audit", response_class=HTMLResponse)
+async def audit_landing(request: Request) -> HTMLResponse:
+    return HTMLResponse(audit_mod.render_audit_landing(_lang(request)))
+
+
+@router.post("/audit/start")
+async def audit_start(
+    body: DemoStartIn, request: Request, db: AsyncSession = Depends(get_session)
+) -> dict:
+    """Kick off the crawl (delegates to the demo machinery so we reuse its
+    rate-limits, SSRF guard, crawl + lead capture). Returns the slug."""
+    return await demo_start(body, request, db)
+
+
+@router.get("/audit/status")
+async def audit_status(d: str, db: AsyncSession = Depends(get_session)) -> dict:
+    """Live crawl progress (delegates to the demo status)."""
+    return await demo_status(d=d, db=db)
+
+
+@router.post("/audit/{slug}/finalize")
+async def audit_finalize(
+    slug: str, request: Request, db: AsyncSession = Depends(get_session)
+) -> dict:
+    """Score an already-crawled demo tenant and persist the AuditResult by domain.
+    Called by the landing once the crawl is ready; returns the domain to redirect to."""
+    tenant = await get_tenant_by_slug(db, slug)
+    if tenant is None or not tenant.is_demo:
+        raise HTTPException(status_code=404, detail="Auditoría no encontrada o caducada.")
+    row = await audit_mod.audit_demo_tenant(db, tenant, lang=_lang(request))
+    await db.commit()
+    return {
+        "domain": row.domain,
+        "answered": row.answered,
+        "total": row.total,
+        "grade": row.grade,
+    }
+
+
+@router.get("/audit/{domain}/og.png")
+async def audit_og(domain: str, db: AsyncSession = Depends(get_session)) -> Response:
+    row = await audit_mod.get_audit(db, domain)
+    if row is None:
+        return FileResponse(_OG_FALLBACK, media_type="image/png")
+    return Response(
+        content=audit_mod.og_image_bytes(row),
+        media_type="image/png",
+        headers={"Cache-Control": "public, max-age=3600"},
+    )
+
+
+@router.get("/audit/{domain}", response_class=HTMLResponse)
+async def audit_page(
+    domain: str, request: Request, db: AsyncSession = Depends(get_session)
+) -> HTMLResponse:
+    row = await audit_mod.get_audit(db, domain)
+    if row is None:
+        # Not audited yet -> serve the tool prefilled with this domain so the URL
+        # still works AND invites the visitor/crawler to run the audit.
+        return HTMLResponse(audit_mod.render_audit_landing(_lang(request)))
+    return HTMLResponse(audit_mod.render_audit_page(row))

app/routes/shopify_oauth.py

@@ -15,6 +15,7 @@ import asyncio
 import hashlib
 import hmac
 import logging
+import re
 from datetime import UTC, datetime, timedelta
 from json import dumps as json_dumps
 
@@ -249,6 +250,39 @@ def _embed_csp(shop: str) -> dict[str, str]:
     return {"Content-Security-Policy": f"frame-ancestors https://{shop} https://admin.shopify.com;"}
 
 
+def _strip_stripe(html: str) -> str:
+    """Shopify App Store rule 1.2.1: an App-Store (OAuth) install must NEVER be
+    exposed to off-platform Stripe billing. Server-side remove the entire
+    `#sub-stripe` block (its "manage subscription" + "change plan" cards, which
+    hold the buy.stripe.com link) from the portal HTML BEFORE serving it inside
+    the Shopify admin iframe — so the embedded panel can never contain a Stripe
+    node, even momentarily, regardless of client JS. Balanced-div aware (the
+    block nests <div class="card"> children) and idempotent. As a belt-and-braces
+    safety net, also neutralize any stray buy.stripe.com URL left in the markup.
+    """
+    open_re = re.compile(r'<div\b[^>]*\bid="sub-stripe"[^>]*>', re.IGNORECASE)
+    m = open_re.search(html)
+    if m:
+        # Walk forward from the opening tag, tracking <div>/</div> nesting, so we
+        # cut exactly the matching close of #sub-stripe (not the first inner one).
+        tag_re = re.compile(r'<div\b[^>]*>|</div>', re.IGNORECASE)
+        depth = 0
+        end = None
+        for t in tag_re.finditer(html, m.start()):
+            if t.group().lower().startswith("</div"):
+                depth -= 1
+                if depth == 0:
+                    end = t.end()
+                    break
+            else:
+                depth += 1
+        if end is not None:
+            html = html[: m.start()] + html[end:]
+    # Belt-and-braces: kill any remaining buy.stripe.com link target.
+    html = re.sub(r'https?://buy\.stripe\.com/[^\s"\'<>]*', "#", html, flags=re.IGNORECASE)
+    return html
+
+
 @router.get("/shopify/app")
 async def shopify_embedded_app(
     request: Request, shop: str = "", settings: Settings = Depends(get_settings)
@@ -262,6 +296,11 @@ async def shopify_embedded_app(
     csp = _embed_csp(shop_n or "*.myshopify.com")
     from app.routes.portal import _PAGE
     html = _PAGE.read_text(encoding="utf-8")
+    # App Store rule 1.2.1: strip ALL off-platform Stripe billing from the panel
+    # served inside the Shopify admin iframe (App-Store installs are billed only
+    # via the Shopify Billing API). The iframe must never contain a Stripe node.
+    html = _strip_stripe(html)
+    assert "buy.stripe.com" not in html  # noqa: S101 - guard the rule above
     # App Bridge setup, in the order Shopify requires (and the App Store check looks
     # for): the api-key META tag FIRST, then the App Bridge CDN script, BEFORE any
     # other script. App Bridge reads the key from the meta tag and exposes
@@ -452,6 +491,7 @@ async def billing_return(
         if active:
             tenant.chatbot_enabled = True
             tenant.disabled_reason = ""
+            tenant.trial_ends_at = None  # converted -> never auto-paused as a trial
             _registry.invalidate(tenant.id)
             await db.commit()
             log.info("shopify billing active for tenant=%s", tenant.slug)

app/routes/shopify_webhooks.py

@@ -127,6 +127,9 @@ async def app_subscriptions_update(
         if status == "ACTIVE":
             tenant.chatbot_enabled = True
             tenant.disabled_reason = ""
+            # Shopify-billed -> never let the scheduler treat this as a Stripe
+            # trial (its predicate is trial_ends_at IS NOT NULL); mirror billing.py.
+            tenant.trial_ends_at = None
             changed = True
         elif status in TERMINAL:
             tenant.chatbot_enabled = False

app/routes/widget.py

@@ -25,6 +25,18 @@ _WIDGET_JS = Path(__file__).resolve().parent.parent / "static" / "widget.js"
 _SLUG_RE = re.compile(r"[^a-z0-9-]")
 
 
+def _is_shopify_install(tenant) -> bool:
+    """A merchant who installed via the Shopify App Store (OAuth) or has a linked
+    Shopify shop. Such tenants must NEVER be linked to off-platform Stripe billing
+    (App Store policy 1.2.1); direct/Stripe tenants are unaffected."""
+    if tenant is None:
+        return False
+    return bool(
+        getattr(tenant, "shopify_shop", "")
+        or getattr(tenant, "shopify_install_source", "") == "oauth"
+    )
+
+
 @router.get("/widget.js")
 async def widget_js() -> FileResponse:
     return FileResponse(
@@ -146,7 +158,7 @@ _HOSTED_HTML = """<!doctype html>
     <p>{sub}</p>
     <button class="cta" id="hosted-open" type="button">{open_label}</button>
   </main>
-  <footer>Con tecnologia de <a href="https://atendyo.com" target="_blank" rel="noopener">Atendyo</a></footer>
+  <footer>{footer}</footer>
   <script src="/widget.js?t={slug}" defer></script>
   <script>
     // Open the assistant automatically (and via the button) — on this page the
@@ -203,11 +215,20 @@ async def hosted_chat(
         )
     brand = (tenant.brand_name or "Asistente").replace("<", "").replace(">", "")
     color = (tenant.brand_color or "#1c59e9").replace("<", "").replace(">", "")
+    # Shopify-installed tenants must not be linked to the atendyo.com landing
+    # (which carries Stripe checkout buttons) — show plain text instead of a link.
+    # Direct/Stripe tenants keep the link exactly as before.
+    footer = (
+        "Con tecnologia de Atendyo"
+        if _is_shopify_install(tenant)
+        else 'Con tecnologia de <a href="https://atendyo.com" target="_blank" rel="noopener">Atendyo</a>'
+    )
     html = _HOSTED_HTML.format(
         brand=brand, color=color, slug=safe,
         hello="¿En qué te ayudo?",
         sub=f"Pregúntame lo que quieras sobre {brand}: productos, envíos, devoluciones y más.",
         open_label="Hablar con el asistente",
+        footer=footer,
     )
     return HTMLResponse(html)
 

app/scheduler.py

@@ -233,7 +233,14 @@ async def _maybe_purge_demos() -> None:
             log.info("demo purge removed %d expired demo tenant(s)", n)
 
 
-async def _email_trial_ended(email: str, slug: str) -> None:
+async def _email_trial_ended(email: str, slug: str, tenant: Tenant | None = None) -> None:
+    # Defense-in-depth: a Shopify App Store install is billed ONLY via the
+    # Shopify Billing API and must never receive the off-platform Stripe
+    # TRIAL_PAY_LINK. Never email the Stripe link to such a tenant.
+    if tenant is not None and (
+        tenant.shopify_shop or tenant.shopify_install_source == "oauth"
+    ):
+        return
     body = (
         "Hola,\n\n"
         "Tu prueba gratis de Atendyo ha terminado y el bot se ha desactivado en tu "
@@ -265,6 +272,11 @@ async def pause_expired_trials(db: AsyncSession) -> int:
                 Tenant.trial_ends_at < now,
                 Tenant.chatbot_enabled.is_(True),
                 Tenant.stripe_subscription_id == "",
+                # Shopify App Store installs are billed ONLY via the Shopify
+                # Billing API — they must never be paused into the Stripe
+                # trial-ended flow nor emailed the off-platform Stripe link.
+                Tenant.shopify_shop == "",
+                Tenant.shopify_install_source != "oauth",
             )
         )
     ).scalars().all()
@@ -273,7 +285,7 @@ async def pause_expired_trials(db: AsyncSession) -> int:
         tenant.chatbot_enabled = False
         tenant.disabled_reason = "trial"
         if tenant.support_email:
-            await _email_trial_ended(tenant.support_email, tenant.slug)
+            await _email_trial_ended(tenant.support_email, tenant.slug, tenant)
     await db.commit()
     return len(expired)
 

migrations/versions/0031_audit_results.py

@@ -0,0 +1,45 @@
+"""Persistent public audit results for the free "store support audit" tool.
+
+One row per store domain (re-audits update it), survives the ephemeral demo
+tenant purge so /audit/<domain> is a permanent, crawlable, shareable SEO page.
+
+Additive, idempotent on Postgres. No-op on other dialects (tests/dev use
+create_all, which already has the table).
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "0031_audit_results"
+down_revision = "0030_image_embeddings"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    if op.get_bind().dialect.name != "postgresql":
+        return
+    op.execute(
+        """
+        CREATE TABLE IF NOT EXISTS audit_results (
+            id SERIAL PRIMARY KEY,
+            domain VARCHAR(255) NOT NULL UNIQUE,
+            brand VARCHAR(255) DEFAULT '',
+            answered INTEGER DEFAULT 0,
+            total INTEGER DEFAULT 12,
+            grade VARCHAR(2) DEFAULT '',
+            questions JSONB DEFAULT '[]'::jsonb,
+            lang VARCHAR(4) DEFAULT 'es',
+            created_at TIMESTAMPTZ DEFAULT now(),
+            updated_at TIMESTAMPTZ DEFAULT now()
+        )
+        """
+    )
+    op.execute("CREATE INDEX IF NOT EXISTS ix_audit_results_domain ON audit_results (domain)")
+
+
+def downgrade() -> None:
+    if op.get_bind().dialect.name != "postgresql":
+        return
+    op.execute("DROP TABLE IF EXISTS audit_results")

scripts/build_static_site.py

@@ -64,6 +64,7 @@ def _sitemap() -> str:
         f"  <url><loc>{SITE}/</loc><changefreq>weekly</changefreq><priority>1.0</priority></url>",
         f"  <url><loc>{SITE}/blog</loc><changefreq>weekly</changefreq><priority>0.7</priority></url>",  # noqa: E501
         f"  <url><loc>{SITE}/partners</loc><changefreq>monthly</changefreq><priority>0.7</priority></url>",  # noqa: E501
+        f"  <url><loc>{SITE}/audit</loc><changefreq>weekly</changefreq><priority>0.8</priority></url>",  # noqa: E501
     ]
     for p in POSTS:
         rows.append(
@@ -87,6 +88,12 @@ def _redirects() -> str:
         f"/demo    {BACKEND}/demo       302\n"
         f"/c/*     {BACKEND}/c/:splat    302\n"
         f"/r/*     {BACKEND}/r/:splat    302\n"
+        # /audit/* is a 200 REWRITE (proxy), not a redirect: the URL stays on
+        # atendyo.com so the per-store audit pages are indexed under our own
+        # domain (the whole SEO point). The interactive tool's API lives under
+        # /audit/* too (start/status/finalize), so this one rule serves it all.
+        f"/audit    {BACKEND}/audit          200\n"
+        f"/audit/*  {BACKEND}/audit/:splat   200\n"
     )
 
 

tests/routes/test_audit.py

@@ -0,0 +1,102 @@
+from __future__ import annotations
+
+from app import audit as A
+from app.models import AuditResult, Tenant
+
+
+def test_grade_for_boundaries():
+    assert A.grade_for(12, 12) == "A"
+    assert A.grade_for(9, 12) == "B"   # 0.75
+    assert A.grade_for(8, 12) == "C"   # 0.667
+    assert A.grade_for(5, 12) == "D"   # 0.417
+    assert A.grade_for(4, 12) == "F"   # 0.333
+    assert A.grade_for(0, 0) == "F"
+
+
+async def test_save_get_audit_upserts_by_domain(db_session):
+    rep = {
+        "brand": "MiTienda", "answered": 7, "total": 12,
+        "questions": [
+            {"q": "¿Envíos a Canarias?", "status": "miss"},
+            {"q": "¿Devoluciones?", "status": "hit"},
+        ],
+    }
+    r1 = await A.save_audit(db_session, "MiTienda.com", rep, lang="es")
+    assert r1.answered == 7 and r1.grade == "D" and r1.domain == "mitienda.com"  # 7/12=58%->D
+    # re-audit (normalized https/www/slash variant) updates the SAME row
+    r2 = await A.save_audit(db_session, "https://www.mitienda.com/", dict(rep, answered=3))
+    assert r2.id == r1.id
+    got = await A.get_audit(db_session, "mitienda.com")
+    assert got.id == r1.id and got.answered == 3 and got.grade == "F"
+
+
+def test_render_audit_page_has_score_gaps_and_og():
+    row = AuditResult(
+        domain="mitienda.com", brand="MiTienda", answered=6, total=12, grade="D",
+        questions=[
+            {"q": "¿Envíos a Canarias?", "status": "miss"},
+            {"q": "¿Devoluciones?", "status": "hit"},
+        ], lang="es",
+    )
+    h = A.render_audit_page(row)
+    assert "MiTienda" in h and "6/12" in h
+    assert 'property="og:image"' in h and "/audit/mitienda.com/og.png" in h
+    assert "¿Envíos a Canarias?" in h  # the real gap is shown
+
+
+def test_og_image_is_valid_png():
+    row = AuditResult(domain="x.com", brand="X", answered=5, total=12, grade="D",
+                      questions=[], lang="es")
+    b = A.og_image_bytes(row)
+    assert b[:8] == b"\x89PNG\r\n\x1a\n"
+
+
+async def test_audit_routes_landing_page_and_og(app_client, db_session):
+    _app, client = app_client
+    r = await client.get("/audit")
+    assert r.status_code == 200 and "Atendyo" in r.text
+
+    await A.save_audit(db_session, "seedstore.com", {
+        "brand": "SeedStore", "answered": 4, "total": 12,
+        "questions": [{"q": "¿Devoluciones?", "status": "miss"}],
+    })
+    await db_session.commit()
+
+    rp = await client.get("/audit/seedstore.com")
+    assert rp.status_code == 200 and "SeedStore" in rp.text and "4/12" in rp.text
+    ro = await client.get("/audit/seedstore.com/og.png")
+    assert ro.status_code == 200 and ro.content[:8] == b"\x89PNG\r\n\x1a\n"
+    # an un-audited domain serves the tool (200), never a 500
+    ru = await client.get("/audit/never-audited-xyz.com")
+    assert ru.status_code == 200
+
+
+async def test_finalize_scores_and_persists(app_client, db_session, monkeypatch):
+    _app, client = app_client
+    t = Tenant(slug="demo-aud1", name="Demo finalstore.com",
+               brand_name="finalstore.com", is_demo=True)
+    db_session.add(t)
+    await db_session.commit()
+
+    async def fake_gap(db, tenant, lang="es"):
+        return {
+            "brand": tenant.brand_name, "total": 12, "answered": 8,
+            "questions": [{"q": "x", "status": "hit"}], "gaps": [],
+        }
+
+    monkeypatch.setattr(A, "generate_gap_report", fake_gap)
+    r = await client.post("/audit/demo-aud1/finalize")
+    assert r.status_code == 200
+    d = r.json()
+    assert d["domain"] == "finalstore.com" and d["answered"] == 8 and d["grade"] == "C"
+    got = await A.get_audit(db_session, "finalstore.com")
+    assert got is not None and got.answered == 8
+
+
+async def test_finalize_404_on_non_demo(app_client, db_session):
+    _app, client = app_client
+    t = Tenant(slug="real1", name="Real", brand_name="real.com")  # NOT is_demo
+    db_session.add(t)
+    await db_session.commit()
+    r = await client.post("/audit/real1/finalize")
+    assert r.status_code == 404

tests/routes/test_shopify_billing_strip.py

@@ -0,0 +1,30 @@
+"""Regression: the embedded Shopify panel (the /shopify/app iframe) must NEVER
+contain an off-platform Stripe billing node (App Store policy 1.2.1)."""
+from __future__ import annotations
+
+from pathlib import Path
+
+from app.routes.shopify_oauth import _strip_stripe
+
+
+def test_strip_stripe_removes_block_and_link():
+    html = (
+        '<div id="sub-shopify" class="hidden"><div class="card">Shopify 29/mo</div></div>'
+        '<div id="sub-stripe"><div class="card">manage</div>'
+        '<div class="card"><a href="https://buy.stripe.com/eVq5kC5h6cQS9qa5ar5wI04">29/mo</a></div>'
+        '</div><footer>keep me</footer>'
+    )
+    out = _strip_stripe(html)
+    assert "buy.stripe.com" not in out
+    assert 'id="sub-stripe"' not in out
+    assert 'id="sub-shopify"' in out             # Shopify Billing pane kept
+    assert "<footer>keep me</footer>" in out     # nothing after the block lost
+    assert _strip_stripe(out) == out             # idempotent
+
+
+def test_real_portal_html_strips_clean():
+    """The actual portal HTML served inside the iframe must be Stripe-free."""
+    page = Path(__file__).resolve().parents[2] / "app" / "portal_ui" / "index.html"
+    stripped = _strip_stripe(page.read_text(encoding="utf-8"))
+    assert "buy.stripe.com" not in stripped
+    assert 'id="sub-stripe"' not in stripped

tests/test_scheduler_trial.py

@@ -61,5 +61,43 @@ async def test_pause_is_idempotent(db_session, monkeypatch):
     assert await pause_expired_trials(db_session) == 0
 
 
+async def test_pause_excludes_shopify_installs(db_session, monkeypatch):
+    """Shopify App Store installs are billed via the Shopify Billing API, never
+    Stripe — the trial sweep must NEVER pause them or email the Stripe pay link
+    (App Store policy 1.2.1). Direct/Stripe trials keep being swept as before."""
+    from app import mailer
+    sent = []
+
+    async def fake(settings, to, subject, body, **k):
+        sent.append(to)
+        return True
+
+    monkeypatch.setattr(mailer, "send_email", fake)
+    past = datetime.now(UTC) - timedelta(hours=1)
+    db_session.add_all([
+        Tenant(slug="t-sh-shop", trial_ends_at=past, chatbot_enabled=True,
+               support_email="s1@x.com", shopify_shop="s1.myshopify.com",
+               shopify_install_source="oauth"),
+        Tenant(slug="t-sh-src", trial_ends_at=past, chatbot_enabled=True,
+               support_email="s2@x.com", shopify_install_source="oauth"),
+        Tenant(slug="t-direct", trial_ends_at=past, chatbot_enabled=True,
+               support_email="d@x.com"),  # direct/Stripe -> still swept
+    ])
+    await db_session.commit()
+
+    assert await pause_expired_trials(db_session) == 1  # only the direct one
+
+    db_session.expire_all()
+
+    async def _get(slug):
+        return (await db_session.execute(select(Tenant).where(Tenant.slug == slug))).scalar_one()
+
+    assert (await _get("t-sh-shop")).chatbot_enabled is True   # Shopify -> untouched
+    assert (await _get("t-sh-src")).chatbot_enabled is True
+    assert (await _get("t-direct")).chatbot_enabled is False   # direct -> paused
+    assert "s1@x.com" not in sent and "s2@x.com" not in sent   # no Stripe email to Shopify
+    assert "d@x.com" in sent                                   # direct still emailed
+
+
 async def _noop():
     return True