v1.0v1.0.0

31 files changed, 4412 insertions, 0 deletions

diff --git a/API.md b/API.md
new file mode 100644
index 0000000..74c231c
--- /dev/null
+++ b/API.md
@@ -0,0 +1,797 @@
+API Documentation
+-----------------
+
+API Endpoint: **https://njal.la/api/1/**  
+Requests follow the JSON-RPC 2.0 protocol.  
+You can use session cookies or token based authentication.  
+POST JSON body to the API Endpoint:
+
+    {
+        "jsonrpc": "2.0",
+        "method": "...",
+        "params": {...},
+        "id": "123"
+    }
+
+and you will get a JSON response. Success:
+
+    {
+        "jsonrpc": "2.0",
+        "result": {}.
+        "id": "123"
+    }
+
+or error:
+
+    {
+        "jsonrpc": "2.0",
+        "error": {
+            "code": 0
+            "message": ""
+        },
+        "id": "123"
+    }
+
+Example using python requests
+
+    import requests
+    
+    def njalla(method, **params):
+        url = 'https://njal.la/api/1/'
+        token = '<your-api-token>'
+        headers = {
+            'Authorization': 'Njalla ' + token
+        }
+        response = requests.post(url, json={
+            'method': method,
+            'params': params
+        }, headers=headers).json()
+        if 'result' not in response:
+            raise Exception('API Error', response)
+        return response['result']
+    
+    
+    print(njalla('list-domains'))
+    print(njalla('get-domain', domain='example.com'))
+    
+
+Example using curl
+
+    NJALLA_TOKEN='<your-api-token>'
+    curl -s \
+        -H "Accept: application/json" \
+        -H "Content-Type: application/json" \
+        -H "Authorization: Njalla ${NJALLA_TOKEN}" \
+        --data '{"method":"get-domain", "params": {"domain": "exampe.com"}}' \
+        https://njal.la/api/1/
+    
+
+api
+===
+
+add-token
+
+Add a new API token
+
+    params: {
+        comment: string (optional)
+        from: [string] (optional)   array of IPv4 or IPv6 IPs or networks
+                                    that are allowed to use the token.
+                                    i.e.: ['8.8.8.8', '192.168.0.0/24']
+        allowed_domains: [string] (optional) restrict token to subset of your domains
+        allowed_servers: [string] (optional) restrict token to subset of your servers by id
+        allowed_methods: [string] (optional) restrict token to subset of possible API calls
+        allowed_prefixes: [string] (optional) restrict token to DNS record name prefixes
+        allowed_types: [string] (optional) restrict token to subset of possible types of DNS records
+        acme: bool (optional)       syntax sugar adding allowed_methods,
+                                    allowed_prefixes and allowed_types
+                                    needed for ACME DNS challenge
+    }
+    returns: {
+    }
+
+check-task
+
+Check status of a long running task
+
+    params: {
+        id: string
+    }
+    returns: {
+        id: string
+        status: object
+    }
+
+edit-token
+
+Edit API token
+
+    params: {
+        key: string
+        comment: string (optional)
+        from: [string] (optional) array of IPv4 or IPv6 IPs or networks
+                                  that are allowed to use the token.
+                                  i.e.: ['8.8.8.8', '192.168.0.0/24']
+        allowed_domains: [string] (optional) restrict token to subset of your domains
+        allowed_servers: [string] (optional) restrict token to subset of your servers by id
+        allowed_methods: [string] (optional) restrict token to subset of possible API calls
+        allowed_prefixes: [string] (optional) restrict token to DNS record name prefixes
+        allowed_types: [string] (optional) restrict token to subset of possible types of DNS records
+    }
+    returns: {
+    }
+
+list-tokens
+
+List existing API authorization tokens.
+
+    params: {
+    }
+    returns: {
+        tokens: [...]
+    }
+
+remove-token
+
+Remove an existing API token
+
+    params: {
+        key: string
+    }
+    returns: {
+    }
+
+domain
+======
+
+add-dnssec
+
+Add DNSSEC record for domain
+
+    params: {
+        domain: string
+        algorithm: integer
+    
+        digest: string
+        digest_type: integer
+        key_tag: integer
+    
+        or
+    
+        public_key: string
+    }
+    returns: {
+    }
+
+add-forward
+
+Add email forward
+
+    params: {
+        domain: string
+        from: string
+        to: string
+    }
+    returns: {
+        domain: string
+        from: string
+        to: string
+    }
+
+add-glue
+
+Add glue record for the domain, name is the subdomain
+
+    params: {
+        domain: string
+        name: string
+        address4: string
+        address6: string
+    }
+    returns: {
+    }
+
+add-record
+
+Add new DNS Record to domain
+
+    params: {
+        domain:         string
+        type:           string  (types: A, AAAA, ANAME, CAA, CNAME, DS, Dynamic, HTTPS, MX, NAPTR, NS, PTR, SRV, SSHFP, SVCB, TLSA, TXT)
+        name:           string  (all types)
+        content:        string  (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, Static, TLSA, TXT)
+        ttl:            int     (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, TLSA, TXT)
+        prio:           int     (types: HTTPS, MX, Redirect, SRV, SVCB)
+        weight:         int     (types: SRV)
+        port:           int     (types: SRV)
+        target:         string  (types: HTTPS, SVCB)
+        ssh_algorithm:  int     (types: SSHFP, values: 1-5 // RSA, DSA, ECDSA, Ed25519, XMSS)
+        ssh_type:       int     (types: SSHFP, values: 1-2 // SHA-1, SHA-256)
+    }
+    returns: {
+        id:             string
+        domain:         string
+        type:           string  (types: A, AAAA, ANAME, CAA, CNAME, DS, Dynamic, HTTPS, MX, NAPTR, NS, PTR, SRV, SSHFP, SVCB, TLSA, TXT)
+        name:           string  (all types)
+        content:        string  (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, Static, TLSA, TXT)
+        ttl:            int     (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, TLSA, TXT)
+        prio:           int     (types: HTTPS, MX, Redirect, SRV, SVCB)
+        weight:         int     (types: SRV)
+        port:           int     (types: SRV)
+        target:         string  (types: HTTPS, SVCB)
+        ssh_algorithm:  int     (types: SSHFP, values: 1-5 // RSA, DSA, ECDSA, Ed25519, XMSS)
+        ssh_type:       int     (types: SSHFP, values: 1-2 // SHA-1, SHA-256)
+    }
+
+edit-domain
+
+Edit domain configuration
+
+    params: {
+        domain: string
+        ...
+    }
+    possible keys:
+        mailforwarding: boolean
+        dnssec: boolean
+        lock: boolean
+        contacts: custom whois contact ids
+        nameservers: list of custom nameservers or empty list to use our nameservers
+    
+    returns: {
+        name: string,
+        ...
+    }
+
+edit-glue
+
+Edit glue record
+
+    params: {
+        domain: string
+        name: string
+        address4: string
+        address6: string
+    }
+    returns: {
+    }
+
+edit-record
+
+Edit DNS Record
+
+    params: {
+        id:             string
+        domain:         string
+        type:           string  (types: A, AAAA, ANAME, CAA, CNAME, DS, Dynamic, HTTPS, MX, NAPTR, NS, PTR, SRV, SSHFP, SVCB, TLSA, TXT)
+        name:           string  (all types)
+        content:        string  (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, Static, TLSA, TXT)
+        ttl:            int     (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, TLSA, TXT)
+        prio:           int     (types: HTTPS, MX, Redirect, SRV, SVCB)
+        weight:         int     (types: SRV)
+        port:           int     (types: SRV)
+        target:         string  (types: HTTPS, SVCB)
+        ssh_algorithm:  int     (types: SSHFP, values: 1-5 // RSA, DSA, ECDSA, Ed25519, XMSS)
+        ssh_type:       int     (types: SSHFP, values: 1-2 // SHA-1, SHA-256)
+    }
+    returns: {
+        domain:         string
+        type:           string  (types: A, AAAA, ANAME, CAA, CNAME, DS, Dynamic, HTTPS, MX, NAPTR, NS, PTR, SRV, SSHFP, SVCB, TLSA, TXT)
+        name:           string  (all types)
+        content:        string  (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, Static, TLSA, TXT)
+        ttl:            int     (types: A, AAAA, ANAME, CAA, CNAME, DS, MX, NAPTR, NS, PTR, Redirect, SRV, SSHFP, TLSA, TXT)
+        prio:           int     (types: HTTPS, MX, Redirect, SRV, SVCB)
+        weight:         int     (types: SRV)
+        port:           int     (types: SRV)
+        target:         string  (types: HTTPS, SVCB)
+        ssh_algorithm:  int     (types: SSHFP, values: 1-5 // RSA, DSA, ECDSA, Ed25519, XMSS)
+        ssh_type:       int     (types: SSHFP, values: 1-2 // SHA-1, SHA-256)
+    }
+
+find-domains
+
+Find new domains
+
+    params: {
+        query: string
+    }
+    returns: {
+        domains: [
+            {price: int, status: string, name: string}
+        ]
+    }
+
+get-domain
+
+Get information about one of your domains
+
+    params: {
+        domain: string
+    }
+    returns: {
+        name: string,
+        ...
+    }
+
+get-tlds
+
+Get list of supported TLDs
+
+    params: {
+    }
+    returns: {
+        tld: {price: int, max_year: int, dnssec: boolean},
+    }
+
+import-zone
+
+Import BIND zone file
+
+    params: {
+        domain: string
+        zone: string
+    }
+    returns: {
+    }
+
+list-dnssec
+
+List DNSSEC records for domain
+
+    params: {
+        domain: string
+    }
+    returns: {
+        dnssec: list
+    }
+
+list-domains
+
+Get list of your domains
+
+    params: {
+    }
+    returns: {
+        domains: list
+    }
+
+list-forwards
+
+List existing email forwards
+
+    params: {
+        domain: string
+    }
+    returns: {
+        forwards: list
+    }
+
+list-glue
+
+List glue records for domain
+
+    params: {
+        domain: string
+    }
+    returns: {
+        glue: list
+    }
+
+list-records
+
+List DNS records for given domain
+
+    params: {
+        domain: string
+    }
+    returns: {
+        records: list
+    }
+
+register-domain
+
+Register a new domain
+
+    params: {
+        domain: string
+        years: int (default: 1)
+    }
+    returns: {
+        task: string
+    }
+    use check-task for response
+
+remove-dnssec
+
+Remove DNSSEC record from domain
+
+    params: {
+        domain: string
+        id: string
+    }
+    returns: {
+    }
+
+remove-forward
+
+Remove email forward
+
+    params: {
+        domain: string
+        from: string
+        to: string
+    }
+    returns: {
+    }
+
+remove-glue
+
+Remove glue record
+
+    params: {
+        domain: string
+        name: string
+    }
+    returns: {
+    }
+
+remove-record
+
+Remove DNS Record
+
+    params: {
+        domain: string
+        id: string
+        name: string // optional
+        type: string // optional
+        ...          // optional
+    }
+    
+    remove a dns record by id
+    or multiple records by passing name, type and any other existing record's field
+    
+    returns: {
+        records: list
+    }
+
+renew-domain
+
+Renew one of your domains
+
+    params: {
+        domain: string
+        years: int (default: 1)
+    }
+    returns: {
+        task: string
+    }
+    use check-task for response
+
+server
+======
+
+add-server
+
+Create a new server with the given name, type, os and ssh\_key. Returns an id of the newly created server
+
+    params: {
+        name: string,
+        type: string
+        os: string
+        ssh_key: string
+        months: int (max 12)
+        autorenew: bool
+    }
+    returns: {
+        id: string
+        ...
+    }
+
+add-traffic
+
+Add extra traffic package.
+
+    params: {
+        id: string
+        amount: int
+        months: int
+        starts_today: bool
+    }
+    returns: {
+    ...
+    }
+
+edit-server
+
+Edit an existing server identified by id
+
+    params: {
+        id: string
+        name: string,
+        type: string
+        ssh_key: string
+        reverse_name: string
+        autorenew: bool
+    }
+    returns: {
+        ...
+    }
+
+get-server
+
+Returns information about one of your servers
+
+    params: {
+        id: string
+    }
+    returns: {
+        ...
+    }
+
+list-server-images
+
+Returns a list of server images that can be used for new servers
+
+    params: {
+    }
+    returns: {
+        images: list
+    }
+
+list-server-types
+
+Returns a list of server types that can be used for new servers
+
+    params: {
+    }
+    returns: {
+        types: list
+    }
+
+list-servers
+
+Returns a list of your servers
+
+    params: {
+    }
+    returns: {
+        servers: list
+    }
+
+list-traffic
+
+List extra traffic packages per server.
+
+    params: {
+        id: string # server id
+    }
+    returns: {
+      traffic: []
+    }
+
+remove-server
+
+Remote an existing server, your server will be stopped and all data deleted.
+
+    params: {
+        id: string
+    }
+    returns: {
+        task: string
+    }
+
+renew-server
+
+Renew an existing server identified by id, your wallet must have enough credit to complete this operation.
+
+    params: {
+        id: string
+        months: int
+    }
+    returns: {
+        ...
+    }
+
+reset-server
+
+Reset existing server and reinstall the given os. All data will be lost. Required field: \`id\`
+
+    params: {
+        id: string
+        os: string
+        ssh_key: string
+        type: string
+    }
+    returns: {
+        ...
+    }
+
+restart-server
+
+Restart existing server
+
+    params: {
+        id: string
+    }
+    returns: {
+        ...
+    }
+
+start-server
+
+Start existing server
+
+    params: {
+        id: string
+    }
+    returns: {
+        ...
+    }
+
+stop-server
+
+Stop existing server
+
+    params: {
+        id: string
+    }
+    returns: {
+        ...
+    }
+
+user
+====
+
+delete-account
+
+Delete your account. You can only delete the account if all domains and servers have been removed and your wallet is empty.
+
+    params: {
+    }
+    returns: {
+    }
+
+login
+
+Login into an existing account (cookie based session). Consider using API tokens instead
+
+    params: {
+        email: string [or] xmpp: string
+        password: string
+    }
+    returns: {
+    }
+
+logout
+
+Logout and end your current session
+
+    params: {
+    }
+    returns: {
+    }
+
+vpn
+===
+
+add-vpn
+
+Add a new VPN client Returns an id
+
+    params: {
+        name: string,
+        autorenew: boolean
+    }
+    returns: {
+        id: string
+        ...
+    }
+
+edit-vpn
+
+Edit an existing VPN identified by id
+
+    params: {
+        id: string
+        name: string,
+        autorenew: boolean
+        backend: wireguard|openvpn
+        publickey: WireGuard PublicKey, set to your public key or null to generate a new one
+    }
+    returns: {
+        ...
+    }
+
+get-vpn
+
+Returns information about VPN
+
+    params: {
+        id: string
+    }
+    returns: {
+        ...
+    }
+
+list-vpns
+
+Returns a list of your VPNs
+
+    params: {
+    }
+    returns: {
+        vpns: list
+    }
+
+remove-vpn
+
+Remove an existing VPN
+
+    params: {
+        id: string
+    }
+    returns: {
+        ...
+    }
+
+renew-vpn
+
+Renew an existing VPN identified by id, your wallet must have enough credit to complete this operation.
+
+    params: {
+        id: string
+        months: int
+    }
+    returns: {
+        ...
+    }
+
+wallet
+======
+
+add-payment
+
+Refill your wallet
+
+    params: {
+        amount: int (5 or multiple of 15, max: 300)
+        via: string (options: paypal, bitcoin, litecoin, monero, zcash, ethereum)
+    }
+    returns: {
+        amount: int
+        address: string (payment address)
+        url: string (paypal url to process payment)
+    }
+
+get-balance
+
+    params: {
+    }
+    returns: {
+        balance: int (in euros)
+    }
+
+get-payment
+
+Get details about a payment
+
+    params: {
+        id: string
+    }
+    returns: {
+        id: string
+        amount: int
+        status: string
+        address: string
+        url: string
+    }
+
+list-transactions
+
+List transactions (payments, registrations, renewals, etc..) of the last 90 days
+
+    params: {
+    }
+    returns: {
+        transactions: list
+    }
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..f288702
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..88d552a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,91 @@
+# Rune
+
+Njalla on iOS.
+
+Rune is a native iOS client for managing your Njalla account. It provides fast,
+minimal access to domains, DNS, API tokens, and account balance without relying
+on the web UI.
+
+---
+
+## Principles
+
+- **Privacy first**  
+  Token-based auth. No tracking. No analytics.
+
+- **Minimal surface area**  
+  Focus on what you actually need on mobile.
+
+- **Native experience**  
+  Built with SwiftUI. Fast, predictable, and simple.
+
+- **No abstraction layers for the sake of it**  
+  Direct API usage. Clear data flow.
+
+---
+
+## Features (v1.x)
+
+### Domains
+- List domains
+- View domain details
+
+### DNS
+- View DNS records per domain
+- Add, edit, delete records
+
+### API Tokens
+- List tokens
+- Create tokens with restrictions
+- Delete tokens
+
+### Account
+- View wallet balance
+
+---
+
+## Authentication
+
+Rune uses **API tokens only**.
+
+- Tokens are stored securely (Keychain)
+- No username/password login
+- Token is validated on first launch via API
+
+---
+
+## Tech Stack
+
+- SwiftUI
+- URLSession (no third-party networking)
+- Njalla HTTP API
+
+---
+
+## Scope
+
+Rune is intentionally limited.
+
+Not supported:
+- domain registration
+- wallet top-ups
+- server management
+- destructive account actions
+
+---
+
+## Status
+
+Active development.
+
+Early versions focus on:
+- correctness
+- stability
+- clean UX
+
+---
+
+## Why
+
+Njalla has a clean API but no native mobile client. Rune exists to make routine
+tasks fast and accessible on iOS.
diff --git a/Rune.xcodeproj/project.pbxproj b/Rune.xcodeproj/project.pbxproj
new file mode 100644
index 0000000..b45406b
--- /dev/null
+++ b/Rune.xcodeproj/project.pbxproj
@@ -0,0 +1,594 @@
+// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 77;
+	objects = {
+
+/* Begin PBXBuildFile section */
+		8B9907952F7206FB007853B5 /* API.md in Resources */ = {isa = PBXBuildFile; fileRef = 8B9907932F7206FB007853B5 /* API.md */; };
+		8B9907962F7206FB007853B5 /* PLANNING.md in Resources */ = {isa = PBXBuildFile; fileRef = 8B9907942F7206FB007853B5 /* PLANNING.md */; };
+/* End PBXBuildFile section */
+
+/* Begin PBXContainerItemProxy section */
+		8B9907772F7206E3007853B5 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 8B9907612F7206E2007853B5 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 8B9907682F7206E2007853B5;
+			remoteInfo = Rune;
+		};
+		8B9907812F7206E3007853B5 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 8B9907612F7206E2007853B5 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 8B9907682F7206E2007853B5;
+			remoteInfo = Rune;
+		};
+/* End PBXContainerItemProxy section */
+
+/* Begin PBXFileReference section */
+		8B9907692F7206E2007853B5 /* Rune.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Rune.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		8B9907762F7206E3007853B5 /* RuneTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = RuneTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		8B9907802F7206E3007853B5 /* RuneUITests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = RuneUITests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		8B9907932F7206FB007853B5 /* API.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = API.md; sourceTree = "<group>"; };
+		8B9907942F7206FB007853B5 /* PLANNING.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = PLANNING.md; sourceTree = "<group>"; };
+/* End PBXFileReference section */
+
+/* Begin PBXFileSystemSynchronizedRootGroup section */
+		8B99076B2F7206E2007853B5 /* Rune */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			path = Rune;
+			sourceTree = "<group>";
+		};
+		8B9907792F7206E3007853B5 /* RuneTests */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			path = RuneTests;
+			sourceTree = "<group>";
+		};
+		8B9907832F7206E3007853B5 /* RuneUITests */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			path = RuneUITests;
+			sourceTree = "<group>";
+		};
+/* End PBXFileSystemSynchronizedRootGroup section */
+
+/* Begin PBXFrameworksBuildPhase section */
+		8B9907662F7206E2007853B5 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8B9907732F7206E3007853B5 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8B99077D2F7206E3007853B5 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+		8B9907602F7206E2007853B5 = {
+			isa = PBXGroup;
+			children = (
+				8B9907932F7206FB007853B5 /* API.md */,
+				8B9907942F7206FB007853B5 /* PLANNING.md */,
+				8B99076B2F7206E2007853B5 /* Rune */,
+				8B9907792F7206E3007853B5 /* RuneTests */,
+				8B9907832F7206E3007853B5 /* RuneUITests */,
+				8B99076A2F7206E2007853B5 /* Products */,
+			);
+			sourceTree = "<group>";
+		};
+		8B99076A2F7206E2007853B5 /* Products */ = {
+			isa = PBXGroup;
+			children = (
+				8B9907692F7206E2007853B5 /* Rune.app */,
+				8B9907762F7206E3007853B5 /* RuneTests.xctest */,
+				8B9907802F7206E3007853B5 /* RuneUITests.xctest */,
+			);
+			name = Products;
+			sourceTree = "<group>";
+		};
+/* End PBXGroup section */
+
+/* Begin PBXNativeTarget section */
+		8B9907682F7206E2007853B5 /* Rune */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 8B99078A2F7206E3007853B5 /* Build configuration list for PBXNativeTarget "Rune" */;
+			buildPhases = (
+				8B9907652F7206E2007853B5 /* Sources */,
+				8B9907662F7206E2007853B5 /* Frameworks */,
+				8B9907672F7206E2007853B5 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			fileSystemSynchronizedGroups = (
+				8B99076B2F7206E2007853B5 /* Rune */,
+			);
+			name = Rune;
+			packageProductDependencies = (
+			);
+			productName = Rune;
+			productReference = 8B9907692F7206E2007853B5 /* Rune.app */;
+			productType = "com.apple.product-type.application";
+		};
+		8B9907752F7206E3007853B5 /* RuneTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 8B99078D2F7206E3007853B5 /* Build configuration list for PBXNativeTarget "RuneTests" */;
+			buildPhases = (
+				8B9907722F7206E3007853B5 /* Sources */,
+				8B9907732F7206E3007853B5 /* Frameworks */,
+				8B9907742F7206E3007853B5 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				8B9907782F7206E3007853B5 /* PBXTargetDependency */,
+			);
+			fileSystemSynchronizedGroups = (
+				8B9907792F7206E3007853B5 /* RuneTests */,
+			);
+			name = RuneTests;
+			packageProductDependencies = (
+			);
+			productName = RuneTests;
+			productReference = 8B9907762F7206E3007853B5 /* RuneTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
+		8B99077F2F7206E3007853B5 /* RuneUITests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 8B9907902F7206E3007853B5 /* Build configuration list for PBXNativeTarget "RuneUITests" */;
+			buildPhases = (
+				8B99077C2F7206E3007853B5 /* Sources */,
+				8B99077D2F7206E3007853B5 /* Frameworks */,
+				8B99077E2F7206E3007853B5 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				8B9907822F7206E3007853B5 /* PBXTargetDependency */,
+			);
+			fileSystemSynchronizedGroups = (
+				8B9907832F7206E3007853B5 /* RuneUITests */,
+			);
+			name = RuneUITests;
+			packageProductDependencies = (
+			);
+			productName = RuneUITests;
+			productReference = 8B9907802F7206E3007853B5 /* RuneUITests.xctest */;
+			productType = "com.apple.product-type.bundle.ui-testing";
+		};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+		8B9907612F7206E2007853B5 /* Project object */ = {
+			isa = PBXProject;
+			attributes = {
+				BuildIndependentTargetsInParallel = 1;
+				LastSwiftUpdateCheck = 2630;
+				LastUpgradeCheck = 2630;
+				TargetAttributes = {
+					8B9907682F7206E2007853B5 = {
+						CreatedOnToolsVersion = 26.3;
+					};
+					8B9907752F7206E3007853B5 = {
+						CreatedOnToolsVersion = 26.3;
+						TestTargetID = 8B9907682F7206E2007853B5;
+					};
+					8B99077F2F7206E3007853B5 = {
+						CreatedOnToolsVersion = 26.3;
+						TestTargetID = 8B9907682F7206E2007853B5;
+					};
+				};
+			};
+			buildConfigurationList = 8B9907642F7206E2007853B5 /* Build configuration list for PBXProject "Rune" */;
+			developmentRegion = en;
+			hasScannedForEncodings = 0;
+			knownRegions = (
+				en,
+				Base,
+			);
+			mainGroup = 8B9907602F7206E2007853B5;
+			minimizedProjectReferenceProxies = 1;
+			preferredProjectObjectVersion = 77;
+			productRefGroup = 8B99076A2F7206E2007853B5 /* Products */;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (
+				8B9907682F7206E2007853B5 /* Rune */,
+				8B9907752F7206E3007853B5 /* RuneTests */,
+				8B99077F2F7206E3007853B5 /* RuneUITests */,
+			);
+		};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+		8B9907672F7206E2007853B5 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				8B9907952F7206FB007853B5 /* API.md in Resources */,
+				8B9907962F7206FB007853B5 /* PLANNING.md in Resources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8B9907742F7206E3007853B5 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8B99077E2F7206E3007853B5 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+		8B9907652F7206E2007853B5 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8B9907722F7206E3007853B5 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		8B99077C2F7206E3007853B5 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin PBXTargetDependency section */
+		8B9907782F7206E3007853B5 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 8B9907682F7206E2007853B5 /* Rune */;
+			targetProxy = 8B9907772F7206E3007853B5 /* PBXContainerItemProxy */;
+		};
+		8B9907822F7206E3007853B5 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 8B9907682F7206E2007853B5 /* Rune */;
+			targetProxy = 8B9907812F7206E3007853B5 /* PBXContainerItemProxy */;
+		};
+/* End PBXTargetDependency section */
+
+/* Begin XCBuildConfiguration section */
+		8B9907882F7206E3007853B5 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				DEBUG_INFORMATION_FORMAT = dwarf;
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_TESTABILITY = YES;
+				ENABLE_USER_SCRIPT_SANDBOXING = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GCC_DYNAMIC_NO_PIC = NO;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_OPTIMIZATION_LEVEL = 0;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"DEBUG=1",
+					"$(inherited)",
+				);
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
+				MTL_FAST_MATH = YES;
+				ONLY_ACTIVE_ARCH = YES;
+				SDKROOT = iphoneos;
+				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "DEBUG $(inherited)";
+				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+			};
+			name = Debug;
+		};
+		8B9907892F7206E3007853B5 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS = YES;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++20";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				ENABLE_NS_ASSERTIONS = NO;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_USER_SCRIPT_SANDBOXING = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu17;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
+				LOCALIZATION_PREFERS_STRING_CATALOGS = YES;
+				MTL_ENABLE_DEBUG_INFO = NO;
+				MTL_FAST_MATH = YES;
+				SDKROOT = iphoneos;
+				SWIFT_COMPILATION_MODE = wholemodule;
+				VALIDATE_PRODUCT = YES;
+			};
+			name = Release;
+		};
+		8B99078B2F7206E3007853B5 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				ENABLE_PREVIEWS = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
+				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
+				INFOPLIST_KEY_UILaunchScreen_Generation = YES;
+				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
+				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+				);
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = net.cleberg.Rune;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Debug;
+		};
+		8B99078C2F7206E3007853B5 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				ENABLE_PREVIEWS = YES;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_KEY_UIApplicationSceneManifest_Generation = YES;
+				INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents = YES;
+				INFOPLIST_KEY_UILaunchScreen_Generation = YES;
+				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
+				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+				);
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = net.cleberg.Rune;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor;
+				SWIFT_EMIT_LOC_STRINGS = YES;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Release;
+		};
+		8B99078E2F7206E3007853B5 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				GENERATE_INFOPLIST_FILE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = net.cleberg.RuneTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = NO;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Rune.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/Rune";
+			};
+			name = Debug;
+		};
+		8B99078F2F7206E3007853B5 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				GENERATE_INFOPLIST_FILE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 26.2;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = net.cleberg.RuneTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = NO;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Rune.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/Rune";
+			};
+			name = Release;
+		};
+		8B9907912F7206E3007853B5 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				GENERATE_INFOPLIST_FILE = YES;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = net.cleberg.RuneUITests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = NO;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_TARGET_NAME = Rune;
+			};
+			name = Debug;
+		};
+		8B9907922F7206E3007853B5 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = 1;
+				DEVELOPMENT_TEAM = ZCNAX3VL9D;
+				GENERATE_INFOPLIST_FILE = YES;
+				MARKETING_VERSION = 1.0;
+				PRODUCT_BUNDLE_IDENTIFIER = net.cleberg.RuneUITests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				STRING_CATALOG_GENERATE_SYMBOLS = NO;
+				SWIFT_APPROACHABLE_CONCURRENCY = YES;
+				SWIFT_EMIT_LOC_STRINGS = NO;
+				SWIFT_UPCOMING_FEATURE_MEMBER_IMPORT_VISIBILITY = YES;
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_TARGET_NAME = Rune;
+			};
+			name = Release;
+		};
+/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+		8B9907642F7206E2007853B5 /* Build configuration list for PBXProject "Rune" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				8B9907882F7206E3007853B5 /* Debug */,
+				8B9907892F7206E3007853B5 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		8B99078A2F7206E3007853B5 /* Build configuration list for PBXNativeTarget "Rune" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				8B99078B2F7206E3007853B5 /* Debug */,
+				8B99078C2F7206E3007853B5 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		8B99078D2F7206E3007853B5 /* Build configuration list for PBXNativeTarget "RuneTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				8B99078E2F7206E3007853B5 /* Debug */,
+				8B99078F2F7206E3007853B5 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		8B9907902F7206E3007853B5 /* Build configuration list for PBXNativeTarget "RuneUITests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				8B9907912F7206E3007853B5 /* Debug */,
+				8B9907922F7206E3007853B5 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+/* End XCConfigurationList section */
+	};
+	rootObject = 8B9907612F7206E2007853B5 /* Project object */;
+}
diff --git a/Rune.xcodeproj/project.xcworkspace/contents.xcworkspacedata b/Rune.xcodeproj/project.xcworkspace/contents.xcworkspacedata
new file mode 100644
index 0000000..919434a
--- /dev/null
+++ b/Rune.xcodeproj/project.xcworkspace/contents.xcworkspacedata
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Workspace
+   version = "1.0">
+   <FileRef
+      location = "self:">
+   </FileRef>
+</Workspace>
diff --git a/Rune.xcodeproj/project.xcworkspace/xcuserdata/cmc.xcuserdatad/UserInterfaceState.xcuserstate b/Rune.xcodeproj/project.xcworkspace/xcuserdata/cmc.xcuserdatad/UserInterfaceState.xcuserstate
new file mode 100644
index 0000000..c59008e
--- /dev/null
+++ b/Rune.xcodeproj/project.xcworkspace/xcuserdata/cmc.xcuserdatad/UserInterfaceState.xcuserstate
diff --git a/Rune.xcodeproj/xcuserdata/cmc.xcuserdatad/xcschemes/xcschememanagement.plist b/Rune.xcodeproj/xcuserdata/cmc.xcuserdatad/xcschemes/xcschememanagement.plist
new file mode 100644
index 0000000..6045ccc
--- /dev/null
+++ b/Rune.xcodeproj/xcuserdata/cmc.xcuserdatad/xcschemes/xcschememanagement.plist
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>SchemeUserState</key>
+	<dict>
+		<key>Rune.xcscheme_^#shared#^_</key>
+		<dict>
+			<key>orderHint</key>
+			<integer>0</integer>
+		</dict>
+	</dict>
+</dict>
+</plist>
diff --git a/Rune/API/Models.swift b/Rune/API/Models.swift
new file mode 100644
index 0000000..f0209b4
--- /dev/null
+++ b/Rune/API/Models.swift
@@ -0,0 +1,385 @@
+import Foundation
+
+struct EmptyResult: Codable {}
+
+struct WalletBalance: Codable, Equatable {
+    let balance: Int
+}
+
+struct DomainListResponse: Codable {
+    let domains: [Domain]
+}
+
+struct RecordListResponse: Codable {
+    let records: [DNSRecord]
+}
+
+struct TokenListResponse: Codable {
+    let tokens: [APIToken]
+}
+
+struct Domain: Codable, Identifiable, Hashable {
+    var id: String { name }
+
+    let name: String
+    let status: String?
+    let expiry: String?
+    let autorenew: Bool?
+    let mailforwarding: Bool?
+    let dnssec: Bool?
+    let lock: Bool?
+    let nameservers: [String]?
+}
+
+struct DNSRecord: Codable, Identifiable, Hashable {
+    let id: String
+    let domain: String
+    let type: String
+    let name: String
+    let content: String?
+    let ttl: Int?
+    let prio: Int?
+    let weight: Int?
+    let port: Int?
+    let target: String?
+    let sshAlgorithm: Int?
+    let sshType: Int?
+
+    enum CodingKeys: String, CodingKey {
+        case id
+        case domain
+        case type
+        case name
+        case content
+        case ttl
+        case prio
+        case weight
+        case port
+        case target
+        case sshAlgorithm = "ssh_algorithm"
+        case sshType = "ssh_type"
+    }
+
+    init(
+        id: String,
+        domain: String,
+        type: String,
+        name: String,
+        content: String?,
+        ttl: Int?,
+        prio: Int?,
+        weight: Int?,
+        port: Int?,
+        target: String?,
+        sshAlgorithm: Int?,
+        sshType: Int?
+    ) {
+        self.id = id
+        self.domain = domain
+        self.type = type
+        self.name = name
+        self.content = content
+        self.ttl = ttl
+        self.prio = prio
+        self.weight = weight
+        self.port = port
+        self.target = target
+        self.sshAlgorithm = sshAlgorithm
+        self.sshType = sshType
+    }
+
+    init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+
+        id = try container.decodeLossyString(forKey: .id)
+        domain = try container.decodeIfPresent(String.self, forKey: .domain) ?? ""
+        type = try container.decode(String.self, forKey: .type)
+        name = try container.decode(String.self, forKey: .name)
+        content = try container.decodeIfPresent(String.self, forKey: .content)
+        ttl = try container.decodeLossyIntIfPresent(forKey: .ttl)
+        prio = try container.decodeLossyIntIfPresent(forKey: .prio)
+        weight = try container.decodeLossyIntIfPresent(forKey: .weight)
+        port = try container.decodeLossyIntIfPresent(forKey: .port)
+        target = try container.decodeIfPresent(String.self, forKey: .target)
+        sshAlgorithm = try container.decodeLossyIntIfPresent(forKey: .sshAlgorithm)
+        sshType = try container.decodeLossyIntIfPresent(forKey: .sshType)
+    }
+
+    func withDomain(_ domain: String) -> DNSRecord {
+        DNSRecord(
+            id: id,
+            domain: domain,
+            type: type,
+            name: name,
+            content: content,
+            ttl: ttl,
+            prio: prio,
+            weight: weight,
+            port: port,
+            target: target,
+            sshAlgorithm: sshAlgorithm,
+            sshType: sshType
+        )
+    }
+}
+
+struct APIToken: Codable, Identifiable, Hashable {
+    var id: String { key }
+
+    let key: String
+    let comment: String?
+    let from: [String]?
+    let allowedDomains: [String]?
+    let allowedServers: [String]?
+    let allowedMethods: [String]?
+    let allowedPrefixes: [String]?
+    let allowedTypes: [String]?
+
+    enum CodingKeys: String, CodingKey {
+        case key
+        case comment
+        case from
+        case allowedDomains = "allowed_domains"
+        case allowedServers = "allowed_servers"
+        case allowedMethods = "allowed_methods"
+        case allowedPrefixes = "allowed_prefixes"
+        case allowedTypes = "allowed_types"
+    }
+}
+
+enum DNSRecordType: String, CaseIterable, Identifiable, Codable {
+    case a = "A"
+    case aaaa = "AAAA"
+    case aname = "ANAME"
+    case caa = "CAA"
+    case cname = "CNAME"
+    case ds = "DS"
+    case dynamic = "Dynamic"
+    case https = "HTTPS"
+    case mx = "MX"
+    case naptr = "NAPTR"
+    case ns = "NS"
+    case ptr = "PTR"
+    case srv = "SRV"
+    case sshfp = "SSHFP"
+    case svcb = "SVCB"
+    case tlsa = "TLSA"
+    case txt = "TXT"
+
+    var id: String { rawValue }
+
+    var usesContent: Bool {
+        switch self {
+        case .dynamic, .https, .svcb:
+            return false
+        default:
+            return true
+        }
+    }
+
+    var usesTTL: Bool {
+        usesContent
+    }
+
+    var usesPriority: Bool {
+        switch self {
+        case .https, .mx, .srv, .svcb:
+            return true
+        default:
+            return false
+        }
+    }
+
+    var usesWeight: Bool {
+        self == .srv
+    }
+
+    var usesPort: Bool {
+        self == .srv
+    }
+
+    var usesTarget: Bool {
+        self == .https || self == .svcb
+    }
+
+    var usesSSHFields: Bool {
+        self == .sshfp
+    }
+}
+
+struct DNSRecordDraft: Equatable {
+    var type: DNSRecordType = .a
+    var name = ""
+    var content = ""
+    var ttl = ""
+    var prio = ""
+    var weight = ""
+    var port = ""
+    var target = ""
+    var sshAlgorithm = ""
+    var sshType = ""
+
+    init() {}
+
+    init(record: DNSRecord) {
+        type = DNSRecordType(rawValue: record.type) ?? .a
+        name = record.name
+        content = record.content ?? ""
+        ttl = record.ttl.map(String.init) ?? ""
+        prio = record.prio.map(String.init) ?? ""
+        weight = record.weight.map(String.init) ?? ""
+        port = record.port.map(String.init) ?? ""
+        target = record.target ?? ""
+        sshAlgorithm = record.sshAlgorithm.map(String.init) ?? ""
+        sshType = record.sshType.map(String.init) ?? ""
+    }
+
+    mutating func resetTypeSpecificFields() {
+        content = ""
+        ttl = ""
+        prio = ""
+        weight = ""
+        port = ""
+        target = ""
+        sshAlgorithm = ""
+        sshType = ""
+    }
+
+    var trimmedName: String {
+        name.trimmingCharacters(in: .whitespacesAndNewlines)
+    }
+
+    var canSubmit: Bool {
+        !trimmedName.isEmpty
+    }
+
+    func params(domain: String, id: String? = nil) -> [String: Any] {
+        var params: [String: Any] = [
+            "domain": domain,
+            "type": type.rawValue,
+            "name": trimmedName
+        ]
+
+        if let id {
+            params["id"] = id
+        }
+
+        if type.usesContent {
+            params["content"] = content.trimmingCharacters(in: .whitespacesAndNewlines)
+        }
+
+        if type.usesTTL, let value = Int(ttl.trimmingCharacters(in: .whitespacesAndNewlines)) {
+            params["ttl"] = value
+        }
+
+        if type.usesPriority, let value = Int(prio.trimmingCharacters(in: .whitespacesAndNewlines)) {
+            params["prio"] = value
+        }
+
+        if type.usesWeight, let value = Int(weight.trimmingCharacters(in: .whitespacesAndNewlines)) {
+            params["weight"] = value
+        }
+
+        if type.usesPort, let value = Int(port.trimmingCharacters(in: .whitespacesAndNewlines)) {
+            params["port"] = value
+        }
+
+        if type.usesTarget {
+            params["target"] = target.trimmingCharacters(in: .whitespacesAndNewlines)
+        }
+
+        if type.usesSSHFields {
+            if let value = Int(sshAlgorithm.trimmingCharacters(in: .whitespacesAndNewlines)) {
+                params["ssh_algorithm"] = value
+            }
+            if let value = Int(sshType.trimmingCharacters(in: .whitespacesAndNewlines)) {
+                params["ssh_type"] = value
+            }
+        }
+
+        return params
+    }
+}
+
+struct DomainUpdateRequest {
+    var autorenew: Bool
+    var mailforwarding: Bool
+    var dnssec: Bool
+    var lock: Bool
+    var nameservers: [String]
+
+    var params: [String: Any] {
+        [
+            "autorenew": autorenew,
+            "mailforwarding": mailforwarding,
+            "dnssec": dnssec,
+            "lock": lock,
+            "nameservers": nameservers
+        ]
+    }
+}
+
+struct TokenCreateRequest {
+    var comment: String
+    var from: [String]
+    var allowedMethods: [String]
+
+    var params: [String: Any] {
+        var params: [String: Any] = [:]
+
+        let trimmedComment = comment.trimmingCharacters(in: .whitespacesAndNewlines)
+        if !trimmedComment.isEmpty {
+            params["comment"] = trimmedComment
+        }
+
+        if !from.isEmpty {
+            params["from"] = from
+        }
+
+        if !allowedMethods.isEmpty {
+            params["allowed_methods"] = allowedMethods
+        }
+
+        return params
+    }
+}
+
+extension String {
+    func formattedExpiry() -> String {
+        let parser = ISO8601DateFormatter()
+        guard let date = parser.date(from: self) else { return self }
+        let formatter = DateFormatter()
+        formatter.dateStyle = .medium
+        formatter.timeStyle = .none
+        return formatter.string(from: date)
+    }
+}
+
+private extension KeyedDecodingContainer where K == DNSRecord.CodingKeys {
+    func decodeLossyString(forKey key: K) throws -> String {
+        if let stringValue = try decodeIfPresent(String.self, forKey: key) {
+            return stringValue
+        }
+
+        if let intValue = try decodeIfPresent(Int.self, forKey: key) {
+            return String(intValue)
+        }
+
+        throw DecodingError.keyNotFound(
+            key,
+            DecodingError.Context(codingPath: codingPath, debugDescription: "Missing required value for \(key.stringValue).")
+        )
+    }
+
+    func decodeLossyIntIfPresent(forKey key: K) throws -> Int? {
+        if let intValue = try decodeIfPresent(Int.self, forKey: key) {
+            return intValue
+        }
+
+        if let stringValue = try decodeIfPresent(String.self, forKey: key) {
+            return Int(stringValue)
+        }
+
+        return nil
+    }
+}
diff --git a/Rune/API/NjallaClient.swift b/Rune/API/NjallaClient.swift
new file mode 100644
index 0000000..9158e20
--- /dev/null
+++ b/Rune/API/NjallaClient.swift
@@ -0,0 +1,129 @@
+import Foundation
+
+struct NjallaClient: Sendable, Equatable {
+    private let token: String
+    private let endpoint = URL(string: "https://njal.la/api/1/")!
+
+    init(token: String) {
+        self.token = token
+    }
+
+    func call<T: Decodable>(_ method: String, params: [String: Any] = [:]) async throws -> T {
+        var request = URLRequest(url: endpoint)
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        request.setValue("application/json", forHTTPHeaderField: "Accept")
+        request.setValue("Njalla \(token)", forHTTPHeaderField: "Authorization")
+
+        let body: [String: Any] = [
+            "jsonrpc": "2.0",
+            "method": method,
+            "params": params,
+            "id": "1"
+        ]
+
+        request.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        let (data, response) = try await URLSession.shared.data(for: request)
+        let statusCode = (response as? HTTPURLResponse)?.statusCode ?? -1
+
+        #if DEBUG
+        debugPrint("Njalla method:", method)
+        debugPrint("Njalla status:", statusCode)
+        #endif
+
+        let decoder = JSONDecoder()
+        let envelope = try decoder.decode(RPCResponse<T>.self, from: data)
+
+        if let error = envelope.error {
+            throw NjallaError.api(message: error.message)
+        }
+
+        guard let result = envelope.result else {
+            throw NjallaError.missingResult
+        }
+
+        return result
+    }
+
+    func listDomains() async throws -> [Domain] {
+        let response: DomainListResponse = try await call("list-domains")
+        return response.domains
+    }
+
+    func getDomain(named domain: String) async throws -> Domain {
+        try await call("get-domain", params: ["domain": domain])
+    }
+
+    func editDomain(named domain: String, request: DomainUpdateRequest) async throws -> Domain {
+        var params = request.params
+        params["domain"] = domain
+        return try await call("edit-domain", params: params)
+    }
+
+    func listRecords(for domain: String) async throws -> [DNSRecord] {
+        let response: RecordListResponse = try await call("list-records", params: ["domain": domain])
+        return response.records.map { record in
+            record.domain.isEmpty ? record.withDomain(domain) : record
+        }
+    }
+
+    func addRecord(for domain: String, draft: DNSRecordDraft) async throws -> DNSRecord {
+        try await call("add-record", params: draft.params(domain: domain))
+    }
+
+    func editRecord(for domain: String, id: String, draft: DNSRecordDraft) async throws -> DNSRecord {
+        try await call("edit-record", params: draft.params(domain: domain, id: id))
+    }
+
+    func removeRecord(_ record: DNSRecord) async throws {
+        let params: [String: Any] = [
+            "domain": record.domain,
+            "id": record.id,
+            "name": record.name,
+            "type": record.type
+        ]
+        let _: RecordListResponse = try await call("remove-record", params: params)
+    }
+
+    func listTokens() async throws -> [APIToken] {
+        let response: TokenListResponse = try await call("list-tokens")
+        return response.tokens
+    }
+
+    func addToken(request: TokenCreateRequest) async throws {
+        let _: EmptyResult = try await call("add-token", params: request.params)
+    }
+
+    func removeToken(key: String) async throws {
+        let _: EmptyResult = try await call("remove-token", params: ["key": key])
+    }
+
+    func getBalance() async throws -> WalletBalance {
+        try await call("get-balance")
+    }
+}
+
+enum NjallaError: LocalizedError {
+    case api(message: String)
+    case missingResult
+
+    var errorDescription: String? {
+        switch self {
+        case .api(let message):
+            return message
+        case .missingResult:
+            return "The API response did not include a result."
+        }
+    }
+}
+
+private struct RPCResponse<Result: Decodable>: Decodable {
+    let result: Result?
+    let error: RPCError?
+}
+
+private struct RPCError: Decodable {
+    let code: Int
+    let message: String
+}
diff --git a/Rune/App/RuneApp.swift b/Rune/App/RuneApp.swift
new file mode 100644
index 0000000..8c63dd6
--- /dev/null
+++ b/Rune/App/RuneApp.swift
@@ -0,0 +1,76 @@
+import SwiftUI
+
+@main
+struct RuneApp: App {
+    var body: some Scene {
+        WindowGroup {
+            RootView()
+        }
+    }
+}
+
+private struct RootView: View {
+    @StateObject private var settingsViewModel = SettingsViewModel()
+    @StateObject private var domainViewModel = DomainViewModel()
+    @StateObject private var tokenViewModel = TokenViewModel()
+    @State private var selectedTab = 0
+
+    var body: some View {
+        TabView(selection: $selectedTab) {
+            DomainListView(viewModel: domainViewModel, client: settingsViewModel.client)
+                .tabItem {
+                    Label("Domains", systemImage: "globe")
+                }
+                .tag(0)
+
+            TokenListView(viewModel: tokenViewModel, client: settingsViewModel.client) { deletedTokenKey in
+                do {
+                    let didLogout = try settingsViewModel.logoutIfCurrentTokenDeleted(deletedTokenKey)
+                    if didLogout {
+                        selectedTab = 0
+                    }
+                } catch {
+                    settingsViewModel.errorMessage = error.localizedDescription
+                }
+            }
+                .tabItem {
+                    Label("Tokens", systemImage: "key.horizontal")
+                }
+                .tag(1)
+
+            SettingsView(viewModel: settingsViewModel) {
+                domainViewModel.reset()
+                tokenViewModel.reset()
+                selectedTab = 0
+            }
+            .tabItem {
+                Label("Settings", systemImage: "gearshape")
+            }
+            .tag(2)
+        }
+        .task {
+            await settingsViewModel.bootstrap()
+        }
+        .task(id: settingsViewModel.isAuthenticated) {
+            guard let client = settingsViewModel.client else {
+                domainViewModel.reset()
+                tokenViewModel.reset()
+                selectedTab = 0
+                return
+            }
+
+            await domainViewModel.loadDomains(client: client)
+            await tokenViewModel.loadTokens(client: client)
+        }
+        .fullScreenCover(isPresented: onboardingBinding) {
+            OnboardingView(viewModel: settingsViewModel)
+        }
+    }
+
+    private var onboardingBinding: Binding<Bool> {
+        Binding(
+            get: { settingsViewModel.requiresOnboarding },
+            set: { _ in }
+        )
+    }
+}
diff --git a/Rune/Assets.xcassets/AccentColor.colorset/Contents.json b/Rune/Assets.xcassets/AccentColor.colorset/Contents.json
new file mode 100644
index 0000000..eb87897
--- /dev/null
+++ b/Rune/Assets.xcassets/AccentColor.colorset/Contents.json
@@ -0,0 +1,11 @@
+{
+  "colors" : [
+    {
+      "idiom" : "universal"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/Rune/Assets.xcassets/AppIcon.appiconset/Contents.json b/Rune/Assets.xcassets/AppIcon.appiconset/Contents.json
new file mode 100644
index 0000000..2305880
--- /dev/null
+++ b/Rune/Assets.xcassets/AppIcon.appiconset/Contents.json
@@ -0,0 +1,35 @@
+{
+  "images" : [
+    {
+      "idiom" : "universal",
+      "platform" : "ios",
+      "size" : "1024x1024"
+    },
+    {
+      "appearances" : [
+        {
+          "appearance" : "luminosity",
+          "value" : "dark"
+        }
+      ],
+      "idiom" : "universal",
+      "platform" : "ios",
+      "size" : "1024x1024"
+    },
+    {
+      "appearances" : [
+        {
+          "appearance" : "luminosity",
+          "value" : "tinted"
+        }
+      ],
+      "idiom" : "universal",
+      "platform" : "ios",
+      "size" : "1024x1024"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/Rune/Assets.xcassets/Contents.json b/Rune/Assets.xcassets/Contents.json
new file mode 100644
index 0000000..73c0059
--- /dev/null
+++ b/Rune/Assets.xcassets/Contents.json
@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/Rune/Keychain/KeychainManager.swift b/Rune/Keychain/KeychainManager.swift
new file mode 100644
index 0000000..bade4f8
--- /dev/null
+++ b/Rune/Keychain/KeychainManager.swift
@@ -0,0 +1,91 @@
+import Foundation
+import Security
+
+struct KeychainManager {
+    private let service = "net.cleberg.rune"
+    private let account = "api-token"
+
+    func saveToken(_ token: String) throws {
+        let encodedToken = Data(token.utf8)
+        var query = baseQuery()
+        query[kSecValueData as String] = encodedToken
+        query[kSecAttrAccessible as String] = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+
+        let status = SecItemAdd(query as CFDictionary, nil)
+        if status == errSecDuplicateItem {
+            try updateToken(token)
+            return
+        }
+
+        guard status == errSecSuccess else {
+            throw KeychainError.unhandled(status)
+        }
+    }
+
+    func readToken() throws -> String? {
+        var query = baseQuery()
+        query[kSecReturnData as String] = true
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+
+        if status == errSecItemNotFound {
+            return nil
+        }
+
+        guard status == errSecSuccess else {
+            throw KeychainError.unhandled(status)
+        }
+
+        guard
+            let data = result as? Data,
+            let token = String(data: data, encoding: .utf8)
+        else {
+            throw KeychainError.invalidData
+        }
+
+        return token
+    }
+
+    func deleteToken() throws {
+        let status = SecItemDelete(baseQuery() as CFDictionary)
+        guard status == errSecSuccess || status == errSecItemNotFound else {
+            throw KeychainError.unhandled(status)
+        }
+    }
+
+    private func updateToken(_ token: String) throws {
+        let attributes: [String: Any] = [
+            kSecValueData as String: Data(token.utf8),
+            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+        ]
+
+        let status = SecItemUpdate(baseQuery() as CFDictionary, attributes as CFDictionary)
+        guard status == errSecSuccess else {
+            throw KeychainError.unhandled(status)
+        }
+    }
+
+    private func baseQuery() -> [String: Any] {
+        [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account
+        ]
+    }
+}
+
+enum KeychainError: LocalizedError {
+    case invalidData
+    case unhandled(OSStatus)
+
+    var errorDescription: String? {
+        switch self {
+        case .invalidData:
+            return "Stored token data is invalid."
+        case .unhandled(let status):
+            return SecCopyErrorMessageString(status, nil) as String? ?? "Keychain error: \(status)"
+        }
+    }
+}
diff --git a/Rune/ViewModels/DomainViewModel.swift b/Rune/ViewModels/DomainViewModel.swift
new file mode 100644
index 0000000..efad5b9
--- /dev/null
+++ b/Rune/ViewModels/DomainViewModel.swift
@@ -0,0 +1,143 @@
+import Combine
+import Foundation
+
+@MainActor
+final class DomainViewModel: ObservableObject {
+    @Published private(set) var domains: [Domain] = []
+    @Published private(set) var selectedDomain: Domain?
+    @Published private(set) var records: [DNSRecord] = []
+    @Published private(set) var isLoadingDomains = false
+    @Published private(set) var isLoadingDetail = false
+    @Published private(set) var isLoadingRecords = false
+    @Published private(set) var isSaving = false
+    @Published var errorMessage: String?
+
+    func reset() {
+        domains = []
+        selectedDomain = nil
+        records = []
+        isLoadingDomains = false
+        isLoadingDetail = false
+        isLoadingRecords = false
+        isSaving = false
+        errorMessage = nil
+    }
+
+    func loadDomains(client: NjallaClient) async {
+        isLoadingDomains = true
+        defer {
+            isLoadingDomains = false
+        }
+
+        do {
+            domains = try await client.listDomains().sorted {
+                $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending
+            }
+            errorMessage = nil
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            errorMessage = error.localizedDescription
+        }
+    }
+
+    func loadDomainDetail(named name: String, client: NjallaClient) async {
+        isLoadingDetail = true
+        defer {
+            isLoadingDetail = false
+        }
+
+        do {
+            let domain = try await client.getDomain(named: name)
+            selectedDomain = domain
+            if let index = domains.firstIndex(where: { $0.name == name }) {
+                domains[index] = domain
+            }
+            errorMessage = nil
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            errorMessage = error.localizedDescription
+        }
+    }
+
+    func updateDomain(named name: String, request: DomainUpdateRequest, client: NjallaClient) async throws {
+        isSaving = true
+        defer {
+            isSaving = false
+        }
+
+        let updated = try await client.editDomain(named: name, request: request)
+        selectedDomain = updated
+        if let index = domains.firstIndex(where: { $0.name == updated.name }) {
+            domains[index] = updated
+        }
+        errorMessage = nil
+    }
+
+    func loadRecords(for domain: String, client: NjallaClient) async {
+        isLoadingRecords = true
+        defer {
+            isLoadingRecords = false
+        }
+
+        do {
+            records = try await client.listRecords(for: domain).sorted {
+                ($0.name, $0.type, $0.id) < ($1.name, $1.type, $1.id)
+            }
+            errorMessage = nil
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            errorMessage = error.localizedDescription
+        }
+    }
+
+    func addRecord(for domain: String, draft: DNSRecordDraft, client: NjallaClient) async throws {
+        isSaving = true
+        defer {
+            isSaving = false
+        }
+
+        _ = try await client.addRecord(for: domain, draft: draft)
+        try await reloadRecords(for: domain, client: client)
+        errorMessage = nil
+    }
+
+    func editRecord(for domain: String, recordID: String, draft: DNSRecordDraft, client: NjallaClient) async throws {
+        isSaving = true
+        defer {
+            isSaving = false
+        }
+
+        _ = try await client.editRecord(for: domain, id: recordID, draft: draft)
+        try await reloadRecords(for: domain, client: client)
+        errorMessage = nil
+    }
+
+    func removeRecord(_ record: DNSRecord, client: NjallaClient) async throws {
+        isSaving = true
+        defer {
+            isSaving = false
+        }
+
+        try await client.removeRecord(record)
+        try await reloadRecords(for: record.domain, client: client)
+        errorMessage = nil
+    }
+
+    private func reloadRecords(for domain: String, client: NjallaClient) async throws {
+        records = try await client.listRecords(for: domain).sorted {
+            ($0.name, $0.type, $0.id) < ($1.name, $1.type, $1.id)
+        }
+    }
+}
diff --git a/Rune/ViewModels/SettingsViewModel.swift b/Rune/ViewModels/SettingsViewModel.swift
new file mode 100644
index 0000000..6b773eb
--- /dev/null
+++ b/Rune/ViewModels/SettingsViewModel.swift
@@ -0,0 +1,102 @@
+import Combine
+import Foundation
+
+@MainActor
+final class SettingsViewModel: ObservableObject {
+    @Published private(set) var client: NjallaClient?
+    @Published private(set) var balance: WalletBalance?
+    @Published private(set) var isAuthenticated = false
+    @Published private(set) var isBootstrapped = false
+    @Published private(set) var isLoadingBalance = false
+    @Published var errorMessage: String?
+
+    private let keychainManager = KeychainManager()
+
+    var requiresOnboarding: Bool {
+        isBootstrapped && !isAuthenticated
+    }
+
+    func bootstrap() async {
+        guard !isBootstrapped else { return }
+
+        defer {
+            isBootstrapped = true
+        }
+
+        do {
+            guard let token = try keychainManager.readToken(), !token.isEmpty else {
+                isAuthenticated = false
+                client = nil
+                balance = nil
+                return
+            }
+
+            let client = NjallaClient(token: token)
+            self.client = client
+            isAuthenticated = true
+            try await refreshBalance()
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            errorMessage = error.localizedDescription
+            client = nil
+            balance = nil
+            isAuthenticated = false
+        }
+    }
+
+    func login(token: String) async throws {
+        let trimmedToken = token.trimmingCharacters(in: .whitespacesAndNewlines)
+        let client = NjallaClient(token: trimmedToken)
+        let balance = try await client.getBalance()
+        try keychainManager.saveToken(trimmedToken)
+
+        self.client = client
+        self.balance = balance
+        isAuthenticated = true
+        isBootstrapped = true
+        errorMessage = nil
+    }
+
+    func refreshBalance() async throws {
+        guard let client else { return }
+
+        isLoadingBalance = true
+        defer {
+            isLoadingBalance = false
+        }
+
+        do {
+            balance = try await client.getBalance()
+            errorMessage = nil
+        } catch is CancellationError {
+            throw CancellationError()
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                throw error
+            }
+            errorMessage = error.localizedDescription
+            throw error
+        }
+    }
+
+    func logout() throws {
+        try keychainManager.deleteToken()
+        client = nil
+        balance = nil
+        isAuthenticated = false
+        errorMessage = nil
+    }
+
+    func logoutIfCurrentTokenDeleted(_ key: String) throws -> Bool {
+        guard let storedToken = try keychainManager.readToken(), storedToken == key else {
+            return false
+        }
+
+        try logout()
+        return true
+    }
+}
diff --git a/Rune/ViewModels/TokenViewModel.swift b/Rune/ViewModels/TokenViewModel.swift
new file mode 100644
index 0000000..40495b4
--- /dev/null
+++ b/Rune/ViewModels/TokenViewModel.swift
@@ -0,0 +1,91 @@
+import Combine
+import Foundation
+
+@MainActor
+final class TokenViewModel: ObservableObject {
+    @Published private(set) var tokens: [APIToken] = []
+    @Published private(set) var isLoading = false
+    @Published private(set) var isSaving = false
+    @Published var errorMessage: String?
+
+    func reset() {
+        tokens = []
+        isLoading = false
+        isSaving = false
+        errorMessage = nil
+    }
+
+    func loadTokens(client: NjallaClient) async {
+        isLoading = true
+        defer {
+            isLoading = false
+        }
+
+        do {
+            tokens = try await client.listTokens().sorted {
+                tokenLabel(for: $0).localizedCaseInsensitiveCompare(tokenLabel(for: $1)) == .orderedAscending
+            }
+            errorMessage = nil
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            errorMessage = error.localizedDescription
+        }
+    }
+
+    func addToken(request: TokenCreateRequest, client: NjallaClient) async -> Bool {
+        isSaving = true
+        defer {
+            isSaving = false
+        }
+
+        do {
+            try await client.addToken(request: request)
+            tokens = try await client.listTokens()
+            errorMessage = nil
+            return true
+        } catch is CancellationError {
+            return false
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return false
+            }
+            errorMessage = error.localizedDescription
+            return false
+        }
+    }
+
+    func removeToken(_ token: APIToken, client: NjallaClient) async -> Bool {
+        isSaving = true
+        defer {
+            isSaving = false
+        }
+
+        do {
+            try await client.removeToken(key: token.key)
+            tokens.removeAll { $0.key == token.key }
+            errorMessage = nil
+            return true
+        } catch is CancellationError {
+            return false
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return false
+            }
+            errorMessage = error.localizedDescription
+            return false
+        }
+    }
+
+    func tokenLabel(for token: APIToken) -> String {
+        let trimmedComment = token.comment?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        if !trimmedComment.isEmpty {
+            return trimmedComment
+        }
+
+        return String(token.key.prefix(8))
+    }
+}
diff --git a/Rune/Views/Domains/DomainDetailView.swift b/Rune/Views/Domains/DomainDetailView.swift
new file mode 100644
index 0000000..dbb90a1
--- /dev/null
+++ b/Rune/Views/Domains/DomainDetailView.swift
@@ -0,0 +1,114 @@
+import SwiftUI
+
+struct DomainDetailView: View {
+    let domainName: String
+    @ObservedObject var viewModel: DomainViewModel
+    let client: NjallaClient
+
+    var body: some View {
+        Group {
+            if viewModel.isLoadingDetail && viewModel.selectedDomain?.name != domainName {
+                ProgressView()
+            } else if let domain = currentDomain {
+                List {
+                    Section("Status") {
+                        DetailRow(label: "Name", value: domain.name)
+                        DetailRow(label: "Status", value: textValue(domain.status))
+                        DetailRow(label: "Expiry", value: domain.expiry?.formattedExpiry() ?? "Not available")
+                        DetailRow(label: "Autorenew", value: boolText(domain.autorenew))
+                    }
+
+                    Section("Settings") {
+                        DetailRow(label: "Mail Forwarding", value: boolText(domain.mailforwarding))
+                        DetailRow(label: "DNSSEC", value: boolText(domain.dnssec))
+                        DetailRow(label: "Registrar Lock", value: boolText(domain.lock))
+                        DetailRow(label: "Nameservers", value: nameserverText(domain.nameservers))
+                    }
+
+                    Section("DNS") {
+                        NavigationLink("Records") {
+                            RecordListView(domainName: domain.name, viewModel: viewModel, client: client)
+                        }
+                    }
+                }
+                .listStyle(.insetGrouped)
+                .toolbar {
+                    NavigationLink("Edit") {
+                        DomainEditView(domain: domain, viewModel: viewModel, client: client)
+                    }
+                }
+            } else {
+                ContentUnavailableView("Domain Unavailable", systemImage: "globe", description: Text("The domain details could not be loaded."))
+            }
+        }
+        .navigationTitle(domainName)
+        .navigationBarTitleDisplayMode(.inline)
+        .task {
+            await viewModel.loadDomainDetail(named: domainName, client: client)
+        }
+        .alert("API Error", isPresented: errorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(viewModel.errorMessage ?? "")
+        }
+    }
+
+    private var currentDomain: Domain? {
+        if viewModel.selectedDomain?.name == domainName {
+            return viewModel.selectedDomain
+        }
+
+        return viewModel.domains.first(where: { $0.name == domainName })
+    }
+
+    private func boolText(_ value: Bool?) -> String {
+        guard let value else { return "Not available" }
+        return value ? "On" : "Off"
+    }
+
+    private func nameserverText(_ nameservers: [String]?) -> String {
+        guard let nameservers else {
+            return "Not available"
+        }
+
+        guard !nameservers.isEmpty else {
+            return "Default"
+        }
+
+        return nameservers.joined(separator: ", ")
+    }
+
+    private func textValue(_ value: String?) -> String {
+        guard let value, !value.isEmpty else {
+            return "Not available"
+        }
+
+        return value
+    }
+
+    private var errorBinding: Binding<Bool> {
+        Binding(
+            get: { viewModel.errorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    viewModel.errorMessage = nil
+                }
+            }
+        )
+    }
+}
+
+private struct DetailRow: View {
+    let label: String
+    let value: String
+
+    var body: some View {
+        HStack {
+            Text(label)
+            Spacer()
+            Text(value)
+                .foregroundStyle(.secondary)
+                .multilineTextAlignment(.trailing)
+        }
+    }
+}
diff --git a/Rune/Views/Domains/DomainEditView.swift b/Rune/Views/Domains/DomainEditView.swift
new file mode 100644
index 0000000..3f197e3
--- /dev/null
+++ b/Rune/Views/Domains/DomainEditView.swift
@@ -0,0 +1,99 @@
+import SwiftUI
+
+struct DomainEditView: View {
+    let domain: Domain
+    @ObservedObject var viewModel: DomainViewModel
+    let client: NjallaClient
+
+    @Environment(\.dismiss) private var dismiss
+
+    @State private var autorenew: Bool
+    @State private var mailforwarding: Bool
+    @State private var dnssec: Bool
+    @State private var lock: Bool
+    @State private var nameserversText: String
+    @State private var localErrorMessage: String?
+
+    init(domain: Domain, viewModel: DomainViewModel, client: NjallaClient) {
+        self.domain = domain
+        self.viewModel = viewModel
+        self.client = client
+        _autorenew = State(initialValue: domain.autorenew ?? false)
+        _mailforwarding = State(initialValue: domain.mailforwarding ?? false)
+        _dnssec = State(initialValue: domain.dnssec ?? false)
+        _lock = State(initialValue: domain.lock ?? false)
+        _nameserversText = State(initialValue: (domain.nameservers ?? []).joined(separator: "\n"))
+    }
+
+    var body: some View {
+        Form {
+            Section("Settings") {
+                Toggle("Autorenew", isOn: $autorenew)
+                Toggle("Mail Forwarding", isOn: $mailforwarding)
+                Toggle("DNSSEC", isOn: $dnssec)
+                Toggle("Registrar Lock", isOn: $lock)
+            }
+
+            Section {
+                TextEditor(text: $nameserversText)
+                    .frame(minHeight: 120)
+            } header: {
+                Text("Nameservers")
+            } footer: {
+                Text("Enter one nameserver per line. Leave blank to use Njalla defaults.")
+            }
+
+            Section {
+                Button("Save") {
+                    Task {
+                        await save()
+                    }
+                }
+                .disabled(viewModel.isSaving)
+            }
+        }
+        .navigationTitle("Edit Domain")
+        .navigationBarTitleDisplayMode(.inline)
+        .alert("API Error", isPresented: localErrorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(localErrorMessage ?? "")
+        }
+    }
+
+    private func save() async {
+        let request = DomainUpdateRequest(
+            autorenew: autorenew,
+            mailforwarding: mailforwarding,
+            dnssec: dnssec,
+            lock: lock,
+            nameservers: nameserversText
+                .split(whereSeparator: \.isNewline)
+                .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+                .filter { !$0.isEmpty }
+        )
+
+        do {
+            try await viewModel.updateDomain(named: domain.name, request: request, client: client)
+            dismiss()
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            localErrorMessage = error.localizedDescription
+        }
+    }
+
+    private var localErrorBinding: Binding<Bool> {
+        Binding(
+            get: { localErrorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    localErrorMessage = nil
+                }
+            }
+        )
+    }
+}
diff --git a/Rune/Views/Domains/DomainListView.swift b/Rune/Views/Domains/DomainListView.swift
new file mode 100644
index 0000000..d728bd7
--- /dev/null
+++ b/Rune/Views/Domains/DomainListView.swift
@@ -0,0 +1,86 @@
+import SwiftUI
+
+struct DomainListView: View {
+    @ObservedObject var viewModel: DomainViewModel
+    let client: NjallaClient?
+
+    var body: some View {
+        NavigationStack {
+            Group {
+                if let client {
+                    content(client: client)
+                } else {
+                    ContentUnavailableView("Sign in required", systemImage: "key.fill", description: Text("Add a valid Njalla API token to load domains."))
+                }
+            }
+            .navigationTitle("Domains")
+        }
+        .alert("API Error", isPresented: errorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(viewModel.errorMessage ?? "")
+        }
+    }
+
+    @ViewBuilder
+    private func content(client: NjallaClient) -> some View {
+        if viewModel.isLoadingDomains && viewModel.domains.isEmpty {
+            ProgressView()
+        } else if viewModel.domains.isEmpty {
+            ContentUnavailableView("No Domains", systemImage: "globe", description: Text("No domains found on this account."))
+        } else {
+            List(viewModel.domains) { domain in
+                NavigationLink {
+                    DomainDetailView(domainName: domain.name, viewModel: viewModel, client: client)
+                } label: {
+                    DomainRow(domain: domain)
+                }
+            }
+            .listStyle(.insetGrouped)
+            .refreshable {
+                await viewModel.loadDomains(client: client)
+            }
+        }
+    }
+
+    private var errorBinding: Binding<Bool> {
+        Binding(
+            get: { viewModel.errorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    viewModel.errorMessage = nil
+                }
+            }
+        )
+    }
+}
+
+private struct DomainRow: View {
+    let domain: Domain
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 6) {
+            Text(domain.name)
+                .font(.headline)
+
+            HStack {
+                if let status = domain.status {
+                    Text(status)
+                }
+
+                if let expiry = domain.expiry {
+                    Text("Expiry: \(expiry.formattedExpiry())")
+                }
+            }
+            .font(.subheadline)
+            .foregroundStyle(.secondary)
+
+            if let autorenew = domain.autorenew {
+                Text(autorenew ? "Autorenew On" : "Autorenew Off")
+                    .font(.subheadline)
+                    .foregroundStyle(.secondary)
+            }
+        }
+        .padding(.vertical, 4)
+    }
+}
diff --git a/Rune/Views/Domains/RecordAddView.swift b/Rune/Views/Domains/RecordAddView.swift
new file mode 100644
index 0000000..8dfa81d
--- /dev/null
+++ b/Rune/Views/Domains/RecordAddView.swift
@@ -0,0 +1,144 @@
+import SwiftUI
+
+struct RecordAddView: View {
+    let domainName: String
+    @ObservedObject var viewModel: DomainViewModel
+    let client: NjallaClient
+
+    @Environment(\.dismiss) private var dismiss
+
+    @State private var draft = DNSRecordDraft()
+    @State private var localErrorMessage: String?
+    var body: some View {
+        Form {
+            DNSRecordFormSections(draft: $draft)
+
+            Section {
+                Button("Save") {
+                    Task {
+                        await save()
+                    }
+                }
+                .disabled(viewModel.isSaving || !draft.canSubmit)
+            }
+        }
+        .navigationTitle("Add Record")
+        .navigationBarTitleDisplayMode(.inline)
+        .toolbar {
+            ToolbarItem(placement: .cancellationAction) {
+                Button("Cancel", role: .cancel) {
+                    dismiss()
+                }
+            }
+        }
+        .onChange(of: draft.type) { oldValue, newValue in
+            guard oldValue != newValue else { return }
+            draft.resetTypeSpecificFields()
+        }
+        .alert("API Error", isPresented: localErrorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(localErrorMessage ?? "")
+        }
+    }
+
+    private func save() async {
+        do {
+            try await viewModel.addRecord(for: domainName, draft: draft, client: client)
+            dismiss()
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            localErrorMessage = error.localizedDescription
+        }
+    }
+
+    private var localErrorBinding: Binding<Bool> {
+        Binding(
+            get: { localErrorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    localErrorMessage = nil
+                }
+            }
+        )
+    }
+}
+
+struct DNSRecordFormSections: View {
+    @Binding var draft: DNSRecordDraft
+
+    var body: some View {
+        Section("Record") {
+            Picker("Type", selection: $draft.type) {
+                ForEach(DNSRecordType.allCases) { type in
+                    Text(type.rawValue).tag(type)
+                }
+            }
+
+            TextField("Name", text: $draft.name)
+                .textInputAutocapitalization(.never)
+                .autocorrectionDisabled()
+        }
+
+        if draft.type.usesContent {
+            Section("Content") {
+                TextField("Content", text: $draft.content, axis: .vertical)
+                    .textInputAutocapitalization(.never)
+                    .autocorrectionDisabled()
+            }
+        }
+
+        if draft.type.usesTTL {
+            Section("TTL") {
+                TextField("TTL", text: $draft.ttl)
+                    .keyboardType(.numberPad)
+            }
+        }
+
+        if draft.type.usesPriority {
+            Section("Priority") {
+                TextField("Priority", text: $draft.prio)
+                    .keyboardType(.numberPad)
+            }
+        }
+
+        if draft.type.usesWeight {
+            Section("Weight") {
+                TextField("Weight", text: $draft.weight)
+                    .keyboardType(.numberPad)
+            }
+        }
+
+        if draft.type.usesPort {
+            Section("Port") {
+                TextField("Port", text: $draft.port)
+                    .keyboardType(.numberPad)
+            }
+        }
+
+        if draft.type.usesTarget {
+            Section("Target") {
+                TextField("Target", text: $draft.target)
+                    .textInputAutocapitalization(.never)
+                    .autocorrectionDisabled()
+            }
+        }
+
+        if draft.type.usesSSHFields {
+            Section {
+                TextField("SSH Algorithm", text: $draft.sshAlgorithm)
+                    .keyboardType(.numberPad)
+                TextField("SSH Type", text: $draft.sshType)
+                    .keyboardType(.numberPad)
+            } header: {
+                Text("SSHFP")
+            } footer: {
+                Text("Algorithm values: 1-5. Type values: 1-2.")
+            }
+        }
+    }
+}
diff --git a/Rune/Views/Domains/RecordEditView.swift b/Rune/Views/Domains/RecordEditView.swift
new file mode 100644
index 0000000..e0c0fde
--- /dev/null
+++ b/Rune/Views/Domains/RecordEditView.swift
@@ -0,0 +1,105 @@
+import SwiftUI
+
+struct RecordEditView: View {
+    let domainName: String
+    let record: DNSRecord
+    @ObservedObject var viewModel: DomainViewModel
+    let client: NjallaClient
+
+    @Environment(\.dismiss) private var dismiss
+
+    @State private var draft: DNSRecordDraft
+    @State private var showingDeleteConfirmation = false
+    @State private var localErrorMessage: String?
+
+    init(domainName: String, record: DNSRecord, viewModel: DomainViewModel, client: NjallaClient) {
+        self.domainName = domainName
+        self.record = record
+        self.viewModel = viewModel
+        self.client = client
+        _draft = State(initialValue: DNSRecordDraft(record: record))
+    }
+
+    var body: some View {
+        Form {
+            DNSRecordFormSections(draft: $draft)
+
+            Section {
+                Button("Save") {
+                    Task {
+                        await save()
+                    }
+                }
+                .disabled(viewModel.isSaving || !draft.canSubmit)
+            }
+
+            Section {
+                Button("Delete Record", role: .destructive) {
+                    showingDeleteConfirmation = true
+                }
+                .foregroundStyle(.red)
+            }
+        }
+        .navigationTitle(record.name)
+        .navigationBarTitleDisplayMode(.inline)
+        .onChange(of: draft.type) { oldValue, newValue in
+            guard oldValue != newValue else { return }
+            draft.resetTypeSpecificFields()
+        }
+        .confirmationDialog(
+            "Delete \(record.type) record \(record.name)?",
+            isPresented: $showingDeleteConfirmation,
+            titleVisibility: .visible
+        ) {
+            Button("Delete Record", role: .destructive) {
+                Task {
+                    await deleteRecord()
+                }
+            }
+        }
+        .alert("API Error", isPresented: localErrorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(localErrorMessage ?? "")
+        }
+    }
+
+    private func save() async {
+        do {
+            try await viewModel.editRecord(for: domainName, recordID: record.id, draft: draft, client: client)
+            dismiss()
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            localErrorMessage = error.localizedDescription
+        }
+    }
+
+    private func deleteRecord() async {
+        do {
+            try await viewModel.removeRecord(record, client: client)
+            dismiss()
+        } catch is CancellationError {
+            return
+        } catch {
+            if (error as? URLError)?.code == .cancelled {
+                return
+            }
+            localErrorMessage = error.localizedDescription
+        }
+    }
+
+    private var localErrorBinding: Binding<Bool> {
+        Binding(
+            get: { localErrorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    localErrorMessage = nil
+                }
+            }
+        )
+    }
+}
diff --git a/Rune/Views/Domains/RecordListView.swift b/Rune/Views/Domains/RecordListView.swift
new file mode 100644
index 0000000..67a4140
--- /dev/null
+++ b/Rune/Views/Domains/RecordListView.swift
@@ -0,0 +1,81 @@
+import SwiftUI
+
+struct RecordListView: View {
+    let domainName: String
+    @ObservedObject var viewModel: DomainViewModel
+    let client: NjallaClient
+
+    @State private var showingAddRecord = false
+
+    var body: some View {
+        Group {
+            if viewModel.isLoadingRecords && viewModel.records.isEmpty {
+                ProgressView()
+            } else if viewModel.records.isEmpty {
+                ContentUnavailableView("No Records", systemImage: "list.bullet", description: Text("No DNS records for this domain."))
+            } else {
+                List(viewModel.records) { record in
+                    NavigationLink {
+                        RecordEditView(domainName: domainName, record: record, viewModel: viewModel, client: client)
+                    } label: {
+                        RecordRow(record: record)
+                    }
+                }
+                .listStyle(.insetGrouped)
+            }
+        }
+        .navigationTitle("DNS Records")
+        .navigationBarTitleDisplayMode(.inline)
+        .toolbar {
+            Button {
+                showingAddRecord = true
+            } label: {
+                Label("Add Record", systemImage: "plus")
+            }
+        }
+        .sheet(isPresented: $showingAddRecord) {
+            NavigationStack {
+                RecordAddView(domainName: domainName, viewModel: viewModel, client: client)
+            }
+        }
+        .task {
+            await viewModel.loadRecords(for: domainName, client: client)
+        }
+        .refreshable {
+            await viewModel.loadRecords(for: domainName, client: client)
+        }
+        .alert("API Error", isPresented: errorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(viewModel.errorMessage ?? "")
+        }
+    }
+
+    private var errorBinding: Binding<Bool> {
+        Binding(
+            get: { viewModel.errorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    viewModel.errorMessage = nil
+                }
+            }
+        )
+    }
+}
+
+private struct RecordRow: View {
+    let record: DNSRecord
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 4) {
+            Text("\(record.type) \(record.name)")
+                .font(.headline)
+            if let detail = [record.content, record.target].compactMap({ $0 }).first, !detail.isEmpty {
+                Text(detail)
+                    .font(.subheadline)
+                    .foregroundStyle(.secondary)
+            }
+        }
+        .padding(.vertical, 4)
+    }
+}
diff --git a/Rune/Views/Onboarding/OnboardingView.swift b/Rune/Views/Onboarding/OnboardingView.swift
new file mode 100644
index 0000000..3fba6c9
--- /dev/null
+++ b/Rune/Views/Onboarding/OnboardingView.swift
@@ -0,0 +1,60 @@
+import SwiftUI
+
+struct OnboardingView: View {
+    @ObservedObject var viewModel: SettingsViewModel
+
+    @State private var token = ""
+    @State private var isSubmitting = false
+    @State private var localErrorMessage: String?
+
+    var body: some View {
+        NavigationStack {
+            Form {
+                Section {
+                    SecureField("Enter Njalla API token", text: $token)
+                        .textInputAutocapitalization(.never)
+                        .autocorrectionDisabled()
+
+                    Button("Validate and Save") {
+                        Task {
+                            await submit()
+                        }
+                    }
+                    .disabled(isSubmitting || token.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty)
+                } header: {
+                    Text("API Token")
+                } footer: {
+                    Text("Rune validates the token with `get-balance` before saving it to Keychain.")
+                }
+
+                if let localErrorMessage {
+                    Section {
+                        Text(localErrorMessage)
+                            .foregroundStyle(.red)
+                    }
+                }
+            }
+            .navigationTitle("Welcome")
+            .overlay {
+                if isSubmitting {
+                    ProgressView()
+                        .controlSize(.large)
+                }
+            }
+        }
+    }
+
+    private func submit() async {
+        isSubmitting = true
+        defer {
+            isSubmitting = false
+        }
+
+        do {
+            try await viewModel.login(token: token)
+            localErrorMessage = nil
+        } catch {
+            localErrorMessage = error.localizedDescription
+        }
+    }
+}
diff --git a/Rune/Views/Settings/SettingsView.swift b/Rune/Views/Settings/SettingsView.swift
new file mode 100644
index 0000000..4d07887
--- /dev/null
+++ b/Rune/Views/Settings/SettingsView.swift
@@ -0,0 +1,73 @@
+import SwiftUI
+
+struct SettingsView: View {
+    @ObservedObject var viewModel: SettingsViewModel
+    let onLogout: () -> Void
+    @State private var showingLogoutConfirmation = false
+
+    var body: some View {
+        NavigationStack {
+            List {
+                Section("Wallet") {
+                    if let balance = viewModel.balance {
+                        HStack {
+                            Text("Balance")
+                            Spacer()
+                            Text("€\(balance.balance)")
+                                .foregroundStyle(.secondary)
+                        }
+                    } else if viewModel.isLoadingBalance {
+                        ProgressView()
+                    } else {
+                        Text("Wallet balance unavailable.")
+                            .foregroundStyle(.secondary)
+                    }
+
+                    Button("Refresh Balance") {
+                        Task {
+                            do {
+                                try await viewModel.refreshBalance()
+                            } catch {
+                                viewModel.errorMessage = error.localizedDescription
+                            }
+                        }
+                    }
+                    .disabled(viewModel.client == nil || viewModel.isLoadingBalance)
+                }
+
+                Section("Account") {
+                    Button("Logout", role: .destructive) {
+                        showingLogoutConfirmation = true
+                    }
+                    .foregroundStyle(.red)
+                }
+
+                if let errorMessage = viewModel.errorMessage {
+                    Section {
+                        Text(errorMessage)
+                            .foregroundStyle(.red)
+                    }
+                }
+            }
+            .navigationTitle("Settings")
+        }
+        .confirmationDialog(
+            "Log out of Rune?",
+            isPresented: $showingLogoutConfirmation,
+            titleVisibility: .visible
+        ) {
+            Button("Log Out", role: .destructive) {
+                do {
+                    try viewModel.logout()
+                    onLogout()
+                } catch {
+                    viewModel.errorMessage = error.localizedDescription
+                }
+            }
+
+            Button("Cancel", role: .cancel) {}
+        } message: {
+            Text("Your API token will be removed from this device.")
+        }
+    }
+}
diff --git a/Rune/Views/Tokens/TokenAddView.swift b/Rune/Views/Tokens/TokenAddView.swift
new file mode 100644
index 0000000..6b71783
--- /dev/null
+++ b/Rune/Views/Tokens/TokenAddView.swift
@@ -0,0 +1,137 @@
+import SwiftUI
+
+struct TokenAddView: View {
+    @ObservedObject var viewModel: TokenViewModel
+    let client: NjallaClient
+
+    @Environment(\.dismiss) private var dismiss
+
+    @State private var comment = ""
+    @State private var fromText = ""
+    @State private var allowedMethodsText = ""
+    @State private var ipValidationMessage: String?
+    @State private var methodValidationMessage: String?
+
+    var body: some View {
+        Form {
+            Section("Token") {
+                TextField("Comment", text: $comment)
+            }
+
+            Section {
+                TextEditor(text: $fromText)
+                    .frame(minHeight: 100)
+                if let ipValidationMessage {
+                    Text(ipValidationMessage)
+                        .font(.caption)
+                        .foregroundStyle(.red)
+                }
+            } header: {
+                Text("IP Restrictions")
+            } footer: {
+                Text("Enter one IPv4, IPv6, or CIDR range per line.")
+            }
+
+            Section {
+                TextEditor(text: $allowedMethodsText)
+                    .frame(minHeight: 100)
+                if let methodValidationMessage {
+                    Text(methodValidationMessage)
+                        .font(.caption)
+                        .foregroundStyle(.red)
+                }
+            } header: {
+                Text("Allowed Methods")
+            } footer: {
+                Text("Enter one API method per line, for example `list-domains`.")
+            }
+
+            Section {
+                Button("Save") {
+                    Task {
+                        await save()
+                    }
+                }
+                .disabled(viewModel.isSaving)
+            }
+        }
+        .navigationTitle("Add Token")
+        .navigationBarTitleDisplayMode(.inline)
+        .toolbar {
+            ToolbarItem(placement: .cancellationAction) {
+                Button("Cancel", role: .cancel) {
+                    dismiss()
+                }
+            }
+        }
+        .onChange(of: fromText) { _, _ in
+            ipValidationMessage = nil
+        }
+        .onChange(of: allowedMethodsText) { _, _ in
+            methodValidationMessage = nil
+        }
+        .alert("API Error", isPresented: errorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(viewModel.errorMessage ?? "")
+        }
+    }
+
+    private func save() async {
+        guard validateInput() else {
+            return
+        }
+
+        let request = TokenCreateRequest(
+            comment: comment,
+            from: lines(fromText),
+            allowedMethods: lines(allowedMethodsText)
+        )
+
+        if await viewModel.addToken(request: request, client: client) {
+            dismiss()
+        }
+    }
+
+    private func lines(_ value: String) -> [String] {
+        value
+            .split(whereSeparator: \.isNewline)
+            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+            .filter { !$0.isEmpty }
+    }
+
+    private func validateInput() -> Bool {
+        let ipEntries = lines(fromText)
+        let methodEntries = lines(allowedMethodsText)
+
+        ipValidationMessage = ipEntries.allSatisfy(isValidIPOrCIDR(_:))
+            ? nil
+            : "One or more entries are not valid IP addresses or CIDR ranges."
+
+        methodValidationMessage = methodEntries.allSatisfy(isValidMethodName(_:))
+            ? nil
+            : "One or more method names appear invalid. Use format: list-domains"
+
+        return ipValidationMessage == nil && methodValidationMessage == nil
+    }
+
+    private func isValidMethodName(_ value: String) -> Bool {
+        value.range(of: "^[a-z-]+$", options: .regularExpression) != nil
+    }
+
+    private func isValidIPOrCIDR(_ value: String) -> Bool {
+        let pattern = #"^((\d{1,3}\.){3}\d{1,3})(/(3[0-2]|[12]?\d))?$|^([0-9A-Fa-f:]+)(/\d{1,3})?$"#
+        return value.range(of: pattern, options: .regularExpression) != nil
+    }
+
+    private var errorBinding: Binding<Bool> {
+        Binding(
+            get: { viewModel.errorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    viewModel.errorMessage = nil
+                }
+            }
+        )
+    }
+}
diff --git a/Rune/Views/Tokens/TokenListView.swift b/Rune/Views/Tokens/TokenListView.swift
new file mode 100644
index 0000000..51bae49
--- /dev/null
+++ b/Rune/Views/Tokens/TokenListView.swift
@@ -0,0 +1,143 @@
+import SwiftUI
+
+struct TokenListView: View {
+    @ObservedObject var viewModel: TokenViewModel
+    let client: NjallaClient?
+    let onTokenRemoved: (String) -> Void
+
+    @State private var showingAddToken = false
+    @State private var tokenPendingDeletion: APIToken?
+
+    var body: some View {
+        NavigationStack {
+            Group {
+                if let client {
+                    content(client: client)
+                } else {
+                    ContentUnavailableView("Sign in required", systemImage: "key.fill", description: Text("Add a valid Njalla API token to load account tokens."))
+                }
+            }
+            .navigationTitle("Tokens")
+            .toolbar {
+                if client != nil {
+                    Button {
+                        showingAddToken = true
+                    } label: {
+                        Label("Add Token", systemImage: "plus")
+                    }
+                }
+            }
+        }
+        .sheet(isPresented: $showingAddToken) {
+            if let client {
+                NavigationStack {
+                    TokenAddView(viewModel: viewModel, client: client)
+                }
+            }
+        }
+        .confirmationDialog(
+            deletionTitle,
+            isPresented: deleteBinding,
+            titleVisibility: .visible
+        ) {
+            Button("Delete Token", role: .destructive) {
+                guard let tokenPendingDeletion, let client else { return }
+                Task {
+                    let removed = await viewModel.removeToken(tokenPendingDeletion, client: client)
+                    if removed {
+                        onTokenRemoved(tokenPendingDeletion.key)
+                    }
+                    self.tokenPendingDeletion = nil
+                }
+            }
+        }
+        .alert("API Error", isPresented: errorBinding) {
+            Button("OK", role: .cancel) {}
+        } message: {
+            Text(viewModel.errorMessage ?? "")
+        }
+    }
+
+    @ViewBuilder
+    private func content(client: NjallaClient) -> some View {
+        if viewModel.isLoading && viewModel.tokens.isEmpty {
+            ProgressView()
+        } else if viewModel.tokens.isEmpty {
+            ContentUnavailableView("No Tokens", systemImage: "key.horizontal", description: Text("No API tokens were found on this account."))
+        } else {
+            List(viewModel.tokens) { token in
+                Button {
+                    tokenPendingDeletion = token
+                } label: {
+                    TokenRow(token: token, label: viewModel.tokenLabel(for: token))
+                }
+                .buttonStyle(.plain)
+            }
+            .listStyle(.insetGrouped)
+            .refreshable {
+                await viewModel.loadTokens(client: client)
+            }
+        }
+    }
+
+    private var deletionTitle: String {
+        guard let tokenPendingDeletion else {
+            return ""
+        }
+
+        return "Delete token \(viewModel.tokenLabel(for: tokenPendingDeletion))?"
+    }
+
+    private var deleteBinding: Binding<Bool> {
+        Binding(
+            get: { tokenPendingDeletion != nil },
+            set: { newValue in
+                if !newValue {
+                    tokenPendingDeletion = nil
+                }
+            }
+        )
+    }
+
+    private var errorBinding: Binding<Bool> {
+        Binding(
+            get: { viewModel.errorMessage != nil },
+            set: { newValue in
+                if !newValue {
+                    viewModel.errorMessage = nil
+                }
+            }
+        )
+    }
+}
+
+private struct TokenRow: View {
+    let token: APIToken
+    let label: String
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 6) {
+            Text(label)
+                .font(.headline)
+
+            Text(methodsText)
+                .font(.subheadline)
+                .foregroundStyle(.secondary)
+
+            if let from = token.from, !from.isEmpty {
+                Text("From: \(from.joined(separator: ", "))")
+                    .font(.subheadline)
+                    .foregroundStyle(.secondary)
+            }
+        }
+        .padding(.vertical, 4)
+    }
+
+    private var methodsText: String {
+        guard let methods = token.allowedMethods, !methods.isEmpty else {
+            return "Methods: Unrestricted"
+        }
+
+        return "Methods: \(methods.joined(separator: ", "))"
+    }
+}
diff --git a/RuneTests/RuneTests.swift b/RuneTests/RuneTests.swift
new file mode 100644
index 0000000..16abf59
--- /dev/null
+++ b/RuneTests/RuneTests.swift
@@ -0,0 +1,17 @@
+//
+//  RuneTests.swift
+//  RuneTests
+//
+//  Created by cmc on 2026-03-23.
+//
+
+import Testing
+@testable import Rune
+
+struct RuneTests {
+
+    @Test func example() async throws {
+        // Write your test here and use APIs like `#expect(...)` to check expected conditions.
+    }
+
+}
diff --git a/RuneUITests/RuneUITests.swift b/RuneUITests/RuneUITests.swift
new file mode 100644
index 0000000..aac749d
--- /dev/null
+++ b/RuneUITests/RuneUITests.swift
@@ -0,0 +1,41 @@
+//
+//  RuneUITests.swift
+//  RuneUITests
+//
+//  Created by cmc on 2026-03-23.
+//
+
+import XCTest
+
+final class RuneUITests: XCTestCase {
+
+    override func setUpWithError() throws {
+        // Put setup code here. This method is called before the invocation of each test method in the class.
+
+        // In UI tests it is usually best to stop immediately when a failure occurs.
+        continueAfterFailure = false
+
+        // In UI tests it’s important to set the initial state - such as interface orientation - required for your tests before they run. The setUp method is a good place to do this.
+    }
+
+    override func tearDownWithError() throws {
+        // Put teardown code here. This method is called after the invocation of each test method in the class.
+    }
+
+    @MainActor
+    func testExample() throws {
+        // UI tests must launch the application that they test.
+        let app = XCUIApplication()
+        app.launch()
+
+        // Use XCTAssert and related functions to verify your tests produce the correct results.
+    }
+
+    @MainActor
+    func testLaunchPerformance() throws {
+        // This measures how long it takes to launch your application.
+        measure(metrics: [XCTApplicationLaunchMetric()]) {
+            XCUIApplication().launch()
+        }
+    }
+}
diff --git a/RuneUITests/RuneUITestsLaunchTests.swift b/RuneUITests/RuneUITestsLaunchTests.swift
new file mode 100644
index 0000000..e26be62
--- /dev/null
+++ b/RuneUITests/RuneUITestsLaunchTests.swift
@@ -0,0 +1,33 @@
+//
+//  RuneUITestsLaunchTests.swift
+//  RuneUITests
+//
+//  Created by cmc on 2026-03-23.
+//
+
+import XCTest
+
+final class RuneUITestsLaunchTests: XCTestCase {
+
+    override class var runsForEachTargetApplicationUIConfiguration: Bool {
+        true
+    }
+
+    override func setUpWithError() throws {
+        continueAfterFailure = false
+    }
+
+    @MainActor
+    func testLaunch() throws {
+        let app = XCUIApplication()
+        app.launch()
+
+        // Insert steps here to perform after app launch but before taking a screenshot,
+        // such as logging into a test account or navigating somewhere in the app
+
+        let attachment = XCTAttachment(screenshot: app.screenshot())
+        attachment.name = "Launch Screen"
+        attachment.lifetime = .keepAlways
+        add(attachment)
+    }
+}
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..1423145
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,33 @@
+# Security Policy
+
+## Supported Versions
+
+|Version|Supported|
+|-------|---------|
+| 1.x   | ✅ Yes  |
+| < 1.0 | ❌ No   |
+
+---
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, **do not open a public issue**.
+Instead:
+
+1. **Email** your report to [[email protected]](mailto:[email protected]).
+  Include:
+  - A detailed description of the vulnerability
+  - Steps to reproduce
+  - Any relevant context (e.g., affected versions, environment)
+2. **Response Time**: We will acknowledge your report within **3 business days**
+  and keep you updated on the progress.
+3. **Resolution**: If confirmed, we will:
+  - Provide an estimated timeline for a fix
+  - Work with you to verify the resolution
+  - Credit you for the discovery (if you wish)
+4. **Declined Reports**: If the report is invalid or out of scope, we will
+  explain why and close the issue.
+
+---
+
+**Thank you for helping improve the security of our project!**