This is a pre-release. djust 0.9.6 has shipped since: read the djust 0.9.6 release notes.
Added
djust deploy— guided end-to-end onboarding (#1422). The CLI now walks first-time users through the full chain in a singledjust deployinvocation: log in → resolve project slug (CLI arg →pyproject.toml→ prompt) → confirm the project exists server-side (or offer to create it) → deploy. Each step is skipped if its precondition is already met, so power users see only the deploy itself. Slug is auto-saved topyproject.toml([tool.djust.deploy] project = "…") so subsequent runs are zero-prompt; the writer is idempotent and survives a server-side slug-uniquification round-trip without producing a duplicate-table TOML. Flags:--yes/-yauto-accepts every confirmation (CI / scripts),--no-createfails fast if the project doesn't exist server-side and propagatesinteractive=Falsethrough the slug-resolution + login chain so CI runs with no creds and no slug exit instead of prompting.djust deploylogin is now an OAuth Auth Code + PKCE browser flow (#1422). Replaces the previous email/password prompt. The CLI binds an ephemeral 127.0.0.1 port (RFC 8252 loopback redirect), opens the browser to djustlive's/o/authorize/, and exchanges the returned code at/o/token/for an access + refresh + id_token. PKCE (RFC 7636 / S256) defends code interception; the CLI is a public client (noclient_secret). Credential format extends to{auth_scheme: "bearer", access_token, refresh_token, expires_at, email, server_url}; the legacy{token: …}DRF shape is still honored transparently until those tokens expire. On/me/401 the CLI silently triesrefresh_tokenbefore re-launching the browser, so weeks-apart deploys don't bounce the user. Loopback callback HTML emitsReferrer-Policy: no-referrer+Cache-Control: no-storeto keep the auth code out of any future Referer header or browser/proxy cache (RFC 8252 §8.10). State parameter compared withsecrets.compare_digest.--server/DJUST_SERVERenforceshttps://except for127.0.0.1/localhostdev hosts.