fix: require explicit pass-through billing access

[colegottdank]

What this does

• require the existing ptb_enabled feature flag before a PTB inference request can spend Helicone provider credits
• require the same flag before creating a cloud-credit checkout session
• require the same flag before scheduling or initiating an automatic top-off

What this does not touch

• BYOK requests
• successful Stripe payment webhooks or wallet credit reconciliation
• subscriptions or non-PTB billing
• provider routing after PTB access is approved

Policy

• ptb_enabled present: PTB allowed
• ptb_enabled absent: PTB denied
• feature lookup failure: PTB denied

Verification

• full Worker suite: 32 files, 1,428 tests passed
• focused PTB/BYOK suite after final refactor: 24 tests passed
• Jawn PTB tests: 3 passed
• Jawn TypeScript compilation: passed
• formatting and diff checks: passed

Rollout

• 19 approved US orgs already have ptb_enabled
• do not deploy to EU until its legitimate PTB orgs are reviewed and allowlisted

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
helicone	Ready	Preview	Aug 24, 2026 10:37pm
helicone-eu	Ready	Preview	Aug 24, 2026 10:37pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
helicone-bifrost	Skipped		Aug 24, 2026 10:37pm

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[supabase]

This pull request has been ignored for the connected project bolqqmqbrciybnypvklh because there are no changes detected in supbase/supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[supabase]

This pull request has been ignored for the connected project lmahfbbnchpworytrrqk because there are no changes detected in .supabase/supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.