Module user_api 

Personal usage view (/me, enterprise#64) — served on the proxy port, authenticated by the caller’s own gateway key.

The admin console (enterprise#45) answers “what does the org spend?”; this surface answers “what did I spend and save?”. It reuses the same design language and the same usage_events store, but every query is scoped to the person resolved from the presented key — nobody sees anybody else’s rows, and an org-wide token (no person identity) is refused.

Wiring: the proxy compiles this router in under the gateway-server feature and mounts it inside its auth middleware. gateway serve installs the Postgres pool into install_pool before the proxy starts; without a store (plain lean-ctx proxy) the data endpoint answers 503 and the shell explains what is missing. Fail-open rule untouched: this is a read-only periphery, LLM traffic never depends on it.

Auth split (same as the admin console): the static shell is public — every number comes from GET /api/me/usage, which sits behind the proxy’s Bearer guard and reads the identity tags the guard attached. The key never appears in a URL; the shell keeps it in sessionStorage.

Structs

MeModelRow

One aggregated model row of the personal breakdown.

MeProjectRow

One aggregated project row of the personal breakdown.

MeQuery

Query parameters of GET /api/me/usage.

MeToolRow

One aggregated MCP tool row of the personal breakdown (GL#104): the tools this person called through /mcp/{server} and what that context costs.

MeTotals

Personal aggregate totals over the queried window.

MeUsageResponse

Response of GET /api/me/usage.

Functions

install_pool

Installs the process-wide store pool for the personal view. First caller wins (one gateway run-mode per process); later calls return false.

is_shell_path

True for the unauthenticated shell paths (/me + its static assets). The proxy’s auth guard exempts exactly these — the data API stays guarded.

personal_usage

Runs the person-scoped queries and assembles the response.

router

The personal-view router: static shell + the guarded data endpoint. State-generic so the proxy can merge it regardless of its own state type; no handler here reads router state.