What this directory sells (anonymous)

Unauthenticated, and safe to call from a browser — it exposes no credential, no Stripe id and no redirect URL.

Returns one entry per product: { kind, enabled, priceCents?, currency?, name? }.

Render a button if and only if priceCents is present. An entry with enabled: true and no price carries misconfigured: true instead — the operator has opted in and the terms are broken, so checkout would answer 503. That is reported rather than advertised.

404 when the directory sells nothing at all, and deliberately the same 404 as an unknown directory: the checkout routes refuse to tell those two apart so that this API cannot be used to enumerate slugs, and an endpoint that answered 200 for every directory that exists would hand that distinction straight back. A consumer sees no difference — either way there is nothing to render.

Prices come from the same function the CHARGE comes from, so a quote here and the amount Stripe collects cannot drift.