Root element — one per application. The generator visits a single Application.xml and emits all the glue files that bind generated Models / Services / ViewModels together into a runnable frontend or backend project. Application name. Becomes the AppStore class basename / WPF DI module / FastAPI app title — pick the project's logical name (e.g. "TestApp"). Root namespace for generated C# (WPF + DI registration). Optional; defaults to name. Ignored by React / Python emitters which use module paths instead. Optional C# namespace where the generated ViewModel classes referenced by Navigation Items live (e.g. TestApp.ViewModels). Emitted as a using directive in WPF's BaseMainWindowViewModel.g.cs so the per-Item OpenSingleton<TViewModel> calls resolve. React / RN ignore this attribute. Optional C# namespace where the generated View partial classes (e.g. ProductListView) live. Defaults to viewModelNamespace when omitted. Required when Views inherit the source Model's namespace (the generator's default) instead of co-locating with ViewModels — used in WPF's BasePageDataTemplates.g.xaml to declare a vw: xmlns prefix for View element references. React / RN ignore this attribute. Optional WPF assembly hosting the ViewModel / View types. Used in the xmlns clause of the generated BaseMainWindowMenu.g.xaml + BasePageDataTemplates.g.xaml (clr-namespace:NS;assembly=Asm). Defaults to the application namespace when omitted. Per-application UI defaults. Scopes the framework-level switches that apply across every view (single vs. tabbed multi-view layout, future icon-library / layout-density knobs). Omit the element entirely to take the per-attribute defaults. Selects between two layout models: `Single` shows one View at a time (today's default — React: route swaps, WPF: ContentControl); `Tabbed` lets multiple Update / Read Views stay open side-by-side with independent VM instances per tab (React: TabHost over AppRoutes, WPF: TabControl bound to PageManager.OpenViewModels). Closing a dirty tab triggers the framework save/discard confirm dialog regardless of mode. Navigation placement. `Horizontal` (default) is the traditional top bar (React: Bootstrap Navbar). `Vertical` is a Claude/ChatGPT-style left sidebar: a collapsible icon-first rail with a toggle, plus a bottom-docked user/account item (see Item `dock`). WPF parity is a follow-up. UI view-layout selector. `Single` = one view at a time (route-swap / ContentControl). `Tabbed` = multiple views open simultaneously in a tab strip, each with independent VM state. Navigation orientation. `Horizontal` = traditional top bar. `Vertical` = left sidebar rail (Claude-style). Service clients each frontend wires into its AppStore / App.Current / DI container. The Python backend uses these to drive `include_router` calls in main.py; frontends use the alias as the property name on AppStore. Type name of an existing Service (the `name=` attribute on a Service.xml). The generator looks up the service in its `-servicePath` index to resolve the client class emitted into AppStore / DI. Property name the frontend AppStore exposes for this service. Defaults to the camelCased `type` value + "Client" (e.g. type="ApiUserService" -> name="apiUserServiceClient"). Set explicitly to share a single accessor across multiple services (e.g. name="service") or to align with hand-written code. Optional C# / TS module path where the generated service-client type lives. Required by WPF (emitted as a `using` directive in BaseApp.g.cs) when the client is not in the same namespace as the App class. React uses module-relative paths and ignores this attribute. Optional comma-separated list of frontends that should wire this service (e.g. "React,Wpf"). Omit to wire on every target. Useful when a service is consumed only by one frontend (e.g. an admin API used solely by WPF). Tree of menu entries. Top-level Items + Groups become the root menu; Groups nest sub-menus. Each Item also becomes a route (React/RN) or a registered VM page (WPF). Item order is preserved on every target. A menu folder. Holds nested Items / sub-Groups; doesn't navigate anywhere itself. Children inherit Group-level `frontends` unless they override it. Menu label. Supports the framework's standard multi-language syntax: `English[fi]Finnish[sv]Swedish`. Optional icon identifier. Honored by WPF (MahApps Material icons) and React Native (Ionicons). React/web honors when an icon set is configured in the runtime; otherwise rendered as text only. Comma-separated list of frontends to emit this group on. Inherited by children unless they declare their own `frontends`. A navigable menu entry. Either binds to a generated ViewModel (the framework knows its view + user-right) or to a hand-written View (anonymous pages like Home / About). Exactly one of `viewModel` or `view` must be set. Menu label. Supports `English[fi]Finnish` syntax. Name of a generated ViewModel (matches its class name, e.g. `ApiProductListViewModel`). The generator resolves the matching View, requireUserRight bucket, and route from the VM. Mutually exclusive with `view`. Name of a hand-written view component (e.g. `HomePage`, `AboutPage`). Used for pages outside the generated VM pipeline. Mutually exclusive with `viewModel`. Optional path of the view's source file, relative to the frontend's output root (e.g. `./views/modelViews/ApiProductListView/ApiProductListView.g`). Omit to use the default per-target convention: React uses `./views/modelViews/{ViewName}/{ViewName}.g` for VM-backed items and `./views/screens/{ViewName}/{ViewName}` for hand-written views. Reserved buckets: `./views/pages/` for `mode=Page` ViewModels and `./views/assistants/` for chat clients. Set explicitly when a project organises its views under a non-default directory layout. React/web route URL (e.g. `/`, `/products/:id?`). Optional — generator derives a default from the bound VM/view name when omitted. WPF + React Native ignore this attribute; their routing is identity-based. Icon identifier shown next to the menu label on icon-capable frontends. True for pages that don't require authentication (Home, About, public landing). Generator skips ProtectedRoute wrapping / WPF login redirect. Optional override for the user-right bucket guarding this route. Defaults to the bound VM's bucket (auto-derived from the VM name, mirroring the per-VM rights contract). Set when the route should be guarded by a different bucket than the VM uses internally (e.g. AdminOnly wrapper around a public-VM page). Comma-separated list of frontends to emit this Item on (e.g. "React,Wpf"). Omit to emit on every target. When false, the Item still registers as a navigable route but isn't drawn in the visible menu. Use for detail pages reachable only by code-driven navigation (e.g. ApiProductUpdateView is opened via the list's Edit button, not the top menu). Vertical-sidebar dock position (UI orientation="Vertical" only; ignored by the horizontal top bar). `Top` (default) flows the item in the main rail. `Bottom` pins it to the sidebar footer — the slot for the user/account item (avatar + name + menu). Vertical-sidebar dock position. `Top` = main rail; `Bottom` = pinned footer (user/account slot). Auth strategy + redirect targets the generator wires into ProtectedRoute / WPF login flow / React Native auth navigator. Omit the element entirely on apps that don't authenticate. Two ways to declare how users sign in: 1. `strategy="..."` (single mechanism) — the original shorthand. Still fully supported. 2. `<Methods>` (multiple login-screen options, issue #153) — one app offers several buttons on the same login screen, e.g. "Continue with Google" / "Continue with Apple" / form fields. When `<Methods>` is present it WINS; `strategy` becomes optional. All methods converge on the same AuthenticationReply, so downstream gating (RequireUserRight / ProtectedRoute) is identical regardless of which method the user picked. How users sign in (single-mechanism shorthand). `FormCredentials` = username+password POST to /auth/form. `WindowsAuth` = Negotiate / Windows-domain identity. `Bearer` = pre-issued token (e.g. SSO). `Anonymous` = no auth, everything public. Optional: supply EITHER this OR `<Methods>`. When both are present, `<Methods>` wins and `strategy` is ignored. When neither is present the app defaults to an interactive FormCredentials login. View component shown for the login form. Default: `LoginView`. Generator wires ProtectedRoute to redirect here on missing auth. Optional. Registration / sign-up view — typically a Wizard ViewModel's View (e.g. a sign-up wizard). The generator routes it at /signup as an ANONYMOUS pre-auth route (outside ProtectedRoute — the caller isn't logged in yet), so the app can offer a "Sign up" link beside Login. Pair the wizard's first step with `authMethods` to let the new user authenticate mid-flow. Omit for apps with no self-service registration. View component shown when an authenticated user lacks the required user-right for the requested route. Default: `ForbiddenPage`. View component shown at the application root path. Default: `HomePage`. Generator wires this as the `/` route on React / startup screen on WPF / initial screen on React Native. Optional reference to the `<Service type="..."/>` that carries the authentication call (e.g. `AuthenticateWindowsCredentials` / `AuthenticateFormCredentials`). Defaults to the first `<Service>` when omitted. The generated `AuthenticateOnStartupAsync` invokes the chosen client's auth method per the `strategy`. Ordered list of login-screen auth methods (issue #153). Render order on the login screen follows document order. At least one Method is required when the element is present. One selectable login option. `FormCredentials` renders username+password fields and POSTs to /auth/form. `Google` / `Apple` render a "Continue with ..." button that runs the provider's JS SDK, then exchanges the returned id_token at /auth/google or /auth/apple (server validates the token against the provider JWKS). All converge on the same AuthenticationReply. Method kind: `FormCredentials` | `Google` | `Apple` | `Email`. `Email` is passwordless: the user submits an email, the server emails a short-lived confirm link, and clicking it signs the user in. OAuth public client id for `Google` / `Apple` — handed to the provider's JS SDK on the client and validated as the id_token audience server-side. Required for Google / Apple; ignored for FormCredentials. For `Email` only. `Link` (default) emails a magic confirm link that navigates the browser to /confirm-email — fine for a standalone login screen, but it destroys an in-progress wizard's state. `Code` emails a short one-time code the user types back in place (no navigation), so an email step inside a sign-up wizard keeps its state. Ignored for non-Email methods.