feat(module init): apps-service routing, pre-flight slug check, rich UX

Three issues from local dev testing:

1. **404 on POST /v1/modules**: the CLI was talking to the account
   service (8081), but modules live on the applications service (8082).
   Split out `MIRRORSTACK_APPS_API_URL` (default `https://apps-api.mirrorstack.ai`,
   local `http://localhost:8082`) and route `create_module` / `get_module`
   through it. The `me` lookup still goes to the account service.

2. **No availability check before POST**: easy to forget you already
   created `media` last week and end up with a confusing 409. New
   `GET /v1/modules/{slug}` pre-flight catches the common
   already-owned-by-caller case with a clear error before we POST.
   Reserved/format checks still happen server-side (no equivalent
   endpoint, and not worth adding for one CLI consumer).

3. **Plain-text prompts**: replaced ad-hoc `prompt`/`confirm` helpers
   with `dialoguer` (themed Input + Confirm), `console` (styled output:
   bold cyan slugs, dim labels, green ✓), and `indicatif` (steady-tick
   spinner during network calls). `--yes` mode unchanged — no prompts,
   no spinner-suppression needed since indicatif already detects
   non-tty stderr.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: I-am-nothing

.env.example

@@ -2,4 +2,5 @@
 # Process env vars override .env if both are set.
 
 MIRRORSTACK_API_URL=http://localhost:8081
+MIRRORSTACK_APPS_API_URL=http://localhost:8082
 MIRRORSTACK_WEB_URL=http://localhost:3000

Cargo.lock

@@ -25,6 +25,9 @@ anyhow = "1"
 thiserror = "2"
 tempfile = "3"
 dotenvy = "0.15"
+dialoguer = { version = "0.11", default-features = false }
+console = "0.15"
+indicatif = "0.17"
 
 [dev-dependencies]
 mockito = "1.6"

Cargo.toml

@@ -108,13 +108,57 @@ pub fn me(api_base: &str, access_token: &str) -> Result<Identity, ApiError> {
     })
 }
 
+/// GET /v1/modules/{slug} — returns the caller's module by slug.
+/// `Ok(None)` on 404 (caller has no module with that slug). Note this
+/// only checks ownership by the *current* user — module slugs are scoped
+/// per-owner, so 404 here does NOT mean the platform-wide name is unique
+/// (reserved/format checks still happen on POST).
+pub fn get_module(
+    apps_base: &str,
+    access_token: &str,
+    slug: &str,
+) -> Result<Option<Module>, ApiError> {
+    // Slug is pre-validated against `^[a-z][a-z0-9-]{1,38}[a-z0-9]$` before
+    // this call, so it's URL-safe with no encoding needed.
+    let endpoint = format!("{}/v1/modules/{}", apps_base.trim_end_matches('/'), slug);
+    let http = http::client(Duration::from_secs(15))?;
+
+    let resp = http
+        .get(&endpoint)
+        .bearer_auth(access_token)
+        .header("Accept", "application/json")
+        .send()?;
+
+    let status = resp.status();
+    if status.is_success() {
+        return Ok(Some(resp.json::<Module>()?));
+    }
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Ok(None);
+    }
+    if status == reqwest::StatusCode::UNAUTHORIZED || status == reqwest::StatusCode::FORBIDDEN {
+        return Err(ApiError::Unauthenticated);
+    }
+    let mut body = Vec::with_capacity(1024);
+    resp.take(MAX_RESPONSE_BYTES)
+        .read_to_end(&mut body)
+        .map_err(|e| ApiError::Unexpected {
+            status: status.as_u16(),
+            body: format!("(read body failed: {e})"),
+        })?;
+    Err(ApiError::Unexpected {
+        status: status.as_u16(),
+        body: String::from_utf8_lossy(&body).into_owned(),
+    })
+}
+
 /// POST /v1/modules — create a developer-owned module.
 pub fn create_module(
-    api_base: &str,
+    apps_base: &str,
     access_token: &str,
     input: &CreateModuleInput,
 ) -> Result<Module, ApiError> {
-    let endpoint = format!("{}/v1/modules", api_base.trim_end_matches('/'));
+    let endpoint = format!("{}/v1/modules", apps_base.trim_end_matches('/'));
     let http = http::client(Duration::from_secs(15))?;
 
     let resp = http
@@ -234,6 +278,41 @@ mod tests {
         assert_eq!(m.id, "m-1");
     }
 
+    #[test]
+    fn get_module_200_returns_some() {
+        let mut server = Server::new();
+        let _m = server
+            .mock("GET", "/v1/modules/media")
+            .match_header("authorization", "Bearer AT")
+            .with_status(200)
+            .with_body(
+                json!({
+                    "id": "m-1",
+                    "name": "Media",
+                    "slug": "media",
+                    "owner_id": "u-1",
+                })
+                .to_string(),
+            )
+            .create();
+
+        let m = get_module(&server.url(), "AT", "media").expect("ok");
+        assert!(m.is_some());
+        assert_eq!(m.unwrap().slug, "media");
+    }
+
+    #[test]
+    fn get_module_404_returns_none() {
+        let mut server = Server::new();
+        let _m = server
+            .mock("GET", "/v1/modules/none")
+            .with_status(404)
+            .create();
+
+        let m = get_module(&server.url(), "AT", "none").expect("ok");
+        assert!(m.is_none());
+    }
+
     #[test]
     fn create_module_409_surfaces_code() {
         let mut server = Server::new();

src/api.rs

@@ -8,14 +8,20 @@ mod login;
 mod module;
 mod whoami;
 
-/// Default api-platform host. Override per-invocation with
+/// Default api-platform account-service host. Override per-invocation with
 /// `MIRRORSTACK_API_URL` (or via `.env`).
 pub(crate) const DEFAULT_API_BASE: &str = "https://api.mirrorstack.ai";
 
+/// Default api-platform applications-service host. Modules and apps live
+/// here (separate Lambda from the account service). Override with
+/// `MIRRORSTACK_APPS_API_URL`.
+pub(crate) const DEFAULT_APPS_API_BASE: &str = "https://apps-api.mirrorstack.ai";
+
 /// Default web-account host. Override with `MIRRORSTACK_WEB_URL`.
 pub(crate) const DEFAULT_WEB_BASE: &str = "https://account.mirrorstack.ai";
 
 pub(crate) const ENV_API_URL: &str = "MIRRORSTACK_API_URL";
+pub(crate) const ENV_APPS_API_URL: &str = "MIRRORSTACK_APPS_API_URL";
 pub(crate) const ENV_WEB_URL: &str = "MIRRORSTACK_WEB_URL";
 
 /// Official command-line tool for the MirrorStack platform.