1. Abstract
A production .NET MAUI app is not one library. It is a UI, an application shell, a network contract, a local store, and a set of device and operations concerns. Most teams assemble those from overlapping community packages — CommunityToolkit for properties, Prism or Shell for navigation, Refit for HTTP, and a scatter of plugins for GPS, offline, and crash reporting. The seams are where field apps fail.
Nuvyntra Labs ships the stack as independently versioned products. NuvyntraLabs.UIKit is the Lumina presentation catalog. Plugin.Maui.MVVMExpress is the application shell. Plugin.Maui.HttpForge is the typed REST contract. The MauiEssentials gallery fills location, connectivity, persistence, security, media, and observability. Compose only what the app needs. There is no mega-package dependency.
2. Why an ecosystem, not a mega-SDK
Cross-platform MAUI work collapses when one vendor SDK owns UI, navigation, HTTP, and storage. Teams cannot adopt a chart control without taking a session manager. They cannot pin TLS without taking a retry policy they did not ask for. They cannot upgrade a GPS plugin without a breaking change in the form engine.
The opposite failure is a pile of unrelated NuGets with no shared host story. CommunityToolkit.Mvvm covers properties and commands. Prism.Maui covers page navigation, not Shell. ReactiveUI covers observable pipelines. A field or enterprise app often needs all three, plus bindable async state, lifecycle-aware cancellation, and a typed REST client that can sit on the same HttpClient as retry, cache, and SPKI pin.
- Independently versioned. UIKit 1.0, MVVMExpress 1.3, HttpForge 1.1, and each gallery plugin ship on their own SemVer lock.
- Compose at the host. The UI kit does not PackageReference Plugin.Maui.*. HttpForge does not retry, cache, or refresh tokens. Missing siblings fail closed instead of silently degrading.
- Adopt only what the app needs. A catalog app can take UIKit + MVVMExpress + HttpForge. A depot inspection app adds GeoLocator, OfflineSync, MediaPipeline, and FileVault.
- Honest boundaries. PDF viewers are viewers. NVBarcode generates; it does not scan. LocalStore is not OfflineSync. HttpForge is a MauiEssentials-shaped subset of Refit, not a drop-in replacement.
3. Ecosystem map
A typical MAUI product maps onto six layers. The first three are the pillars this paper names. The rest come from the gallery and from NuvexaDB when the host wants an embedded document file.
| Layer | Product | Role |
|---|---|---|
| Presentation | NuvyntraLabs.UIKit | NV* controls, Lumina tokens, 57 page recipes |
| Application | Plugin.Maui.MVVMExpress | ViewModels, Shell or NavigationPage, dialogs, forms, modules |
| HTTP contract | Plugin.Maui.HttpForge | Source-generated typed REST over HttpClient |
| HTTP runtime | ApiResilience, ApiCache, TlsPin, SecureSession | Retry, GET cache, SPKI pin, 401 refresh — chained on IHttpClientBuilder |
| Persistence | LocalStore, OfflineSync, NuvexaDB | Room-style CRUD, queued sync, one .nvx file |
| Field, security, operations | MauiEssentials gallery + MauiDev | Location, media, lock, crash, profile, doctor CLI |
Registration stays at MauiProgram. The kit, the shell, and the REST client are three calls. Gallery plugins register the same way.
builder
.UseMauiApp<App>()
.UseNuvyntraUIKit()
.UseMvvmExpress()
.UseHttpForge();
builder.Services.AddHttpForgeClient<IFieldApi>(client =>
{
client.BaseAddress = new Uri("https://api.example.com");
});4. Pillar I — UIKit: build a rich UI
NuvyntraLabs.UIKit (1.0.0) is the Lumina catalog for a typical MAUI app: foundation tokens, 177 NV* controls from primitives through advanced surfaces, and 57 NV*View page recipes. Register with UseNuvyntraUIKit(), then use xmlns:nv="http://nuvyntralabs.com/uikit". Kit-level 1.0 is a working Lumina API — not Telerik or Syncfusion parity.
| Layer | Examples | Role |
|---|---|---|
| Foundation | NVTheme, NVTokens, NVTypography, NVIcons, NVMotion | Static helpers. Not XAML views. |
| Primitives | NVSurface, NVAvatar, NVBadge, NVSkeleton, NVOverlay | Themed paper, glyphs, overlays. |
| Actions & inputs | NVButton, NVTextField, NVPinPad, NVFormField | Filled / tonal / outline / ghost; labeled fields. |
| Feedback & nav | NVBanner, NVTabView, NVBottomSheet, NVAppScaffold | Status, sheets, tabs, app chrome. |
| Data & viz | NVDataGrid, NVChart, NVCalendar, NVKanban, NVGantt | Grids, charts, planning surfaces. |
| Social & media | NVChat, NVVideoPlayer, NVPdfViewer, NVWebView | Chrome and viewers — not playback engines. |
| Pages | NVSignInView … NVOrderSummaryView | 57 recipes for auth, commerce, content, social, files, system. |
Recipes set titles and seed demo children so a team can stand up sign-in, catalog, checkout, inbox, or settings without inventing chrome. PDF, Docx, and Spreadsheet are viewers. NVBarcode generates; it does not scan. Real biometrics stay on Plugin.Maui.BiometricPlus. Compose FormValidation and KeyboardManager at the host — the kit does not take those dependencies.
XAML and every kit attribute: UIKit component reference
5. Pillar II — MVVMExpress: application architecture
Plugin.Maui.MVVMExpress 1.3.0 is the application shell for production MAUI apps on Android, iOS, Mac Catalyst, and Windows (single-window). CommunityToolkit.Mvvm covers properties and commands. Prism.Maui covers page navigation, not Shell. ReactiveUI covers observable pipelines. A field app often needs all three plus bindable async state, lifecycle-aware cancellation, and typed navigation — without taking three overlapping frameworks. Core targets net10.0 and does not reference MAUI.
- ViewModels. ObservableModel, ViewModel lifecycle, and
ViewModelCancellationTokencancelled on dispose. - Commands. Sync and async commands with UI-thread marshal, timeout, retry, debounce, and throttle.
ICommand.Executedoes not throw. - Hosts.
UseNavigationPageandUseShellare equal hosts. Navigators hop toIMainThreadbeforenew Page()orShell.GoToAsync. - Forms & lists.
FormViewModel.Bind, dirty confirm,SectionHostViewin-place tabs,SnapshotCollection,MvvmSearch. - Auth & deep links.
UseAuth<TChallenge>()wrapsGuardedNavigator.UseSecureSessionAuth()andUseDeepLinks()fail closed if the sibling is missing. - Modules & generators.
IModule/AddModule<T>(),[Notify],[RegisterView],[PersistState],[RequiresAuth]. Analyzers MVVME001–003 and MVVME010–013. - Scaffold.
dotnet new mvvmexpress/mvvmexpress-page, plus Visual Studio Code and Visual Studio Marketplace extensions pinned to 1.3.0.
1.0.0 remains the SemVer lock. Public 1.x APIs stay source-compatible. Capability work — captive portal, HTTP cache, offline sync, form XAML, flags, deep links — stays in focused gallery plugins. The testing package ships LeakProbe, FakeNavigator, FakeDialogs, and 1.0 contract tests.
ViewModels, hosts, generators, templates: MVVMExpress documentation
6. Pillar III — HttpForge: typed REST
Plugin.Maui.HttpForge 1.1.1 is the contract layer. Declare GET, POST, PUT, DELETE, PATCH, and HEAD as a C# interface. The source generator emits the HttpClient implementation at compile time — there is no runtime reflection request builder. It is a MauiEssentials-shaped subset of Refit for Android, iOS, Mac Catalyst, and Windows, not a drop-in Refit replacement.
public interface IFieldApi
{
[Get("/sites/{id}")]
Task<Site> GetSite(int id, CancellationToken cancellationToken = default);
[Post("/inspections")]
Task<Inspection> Submit([Body] InspectionDraft draft);
}
var site = await api.GetSite(42);1.1 adds the Refit-parity request surface: query objects, collection formats, naming presets, [Timeout] / [Url] / [PathPrefix], optional segments, [FormObject], IAsyncEnumerable streaming (JSON Lines / SSE), request compression, and AuthorizationHeaderValueGetter. Optional packages cover Testing, Newtonsoft.Json, and XML. Compile-time diagnostics are HFG001–HFG010.
Contract, analyzers, and sibling recipes: HttpForge documentation
7. Gallery — libraries used in development
The three pillars stand up UI, architecture, and the API contract. A shipped app still needs local data, a truthful network, sessions, field capture, and a way to see why a session failed. The product catalog is that gallery. The rows below are the libraries a development team actually reaches for — not the full index.
7.1 Local data and offline
| Library | Use in development | Page |
|---|---|---|
| Plugin.Maui.LocalStore 1.1 | Room-style ILocalStore / IStoreCollection<T>. Host picks SQLite, NuvexaDB, Realm, LiteDB, or another engine. AutoMigrate, QueryAsync, [StoreDao]. | LocalStore |
| Plugin.Maui.OfflineSync | Offline-first local writes, queued sync, and conflict resolution. Not a CRUD API — pair with LocalStore. | OfflineSync |
| NuvexaDB 1.0.6 | Embedded NoSQL: one .nvx file, NQL, optional AES-256-GCM. Standalone engine; LocalStore can host it. | NuvexaDB |
| Plugin.Maui.JobQueue | Durable SQLite work queue with retry, backoff, and dead letter. Survives process death. | JobQueue |
| Plugin.Maui.RetryQueue | Retry the call that already failed — telemetry, orders, payments. Longer default backoff than JobQueue. | RetryQueue |
| Plugin.Maui.SmartUpload | Chunked, resumable uploads with HTTPS by default. Continues after a kill instead of restarting at byte zero. | SmartUpload |
7.2 Network truth and HTTP runtime
HttpForge is the contract. These plugins are the runtime the contract sits on — and the diagnostics when the OS says “connected” but the API is unreachable.
| Library | Use in development | Page |
|---|---|---|
| Plugin.Maui.NetworkMonitor | Validated public internet, captive portals, Wi-Fi versus cellular. Answers a question MAUI Connectivity cannot. | NetworkMonitor |
| Plugin.Maui.NetworkDiagnostics | On-demand layered probe: internet, DNS, TLS, then the API. For support screens, not a monitor. | NetworkDiagnostics |
| Plugin.Maui.ApiResilience | Retry, circuit breaker, AES-256-GCM offline queue, token-refresh cooperation. | ApiResilience |
| Plugin.Maui.ApiCache | HTTP GET cache with CacheFirst, NetworkFirst, and stale-while-revalidate. | ApiCache |
| Plugin.Maui.TlsPin | HttpClient SPKI / public-key pin. Empty or mismatched pins fail closed unless report-only staging is on. | TlsPin |
7.3 Identity, session, and device security
| Library | Use in development | Page |
|---|---|---|
| Plugin.Maui.SecureSession | Login, Bearer attach, single-flight 401 refresh, multi-device revoke, biometric unlock. Persistence is SecureStoragePlus. | SecureSession |
| Plugin.Maui.SecureStoragePlus | AES-256-GCM envelope over MAUI SecureStorage, expiry, migration, typed JSON. | SecureStoragePlus |
| Plugin.Maui.AppLock | Lock timer, privacy cover, and gate after background. Face ID / PIN are how the user unlocks — not the product. | AppLock |
| Plugin.Maui.BiometricPlus | One-shot Face ID, fingerprint, or device PIN. Not an app-lock timer. | BiometricPlus |
| Plugin.Maui.ScreenGuard | FLAG_SECURE on Android; iOS capture overlay. Not AppLock and not FileVault. | ScreenGuard |
| Plugin.Maui.PermissionFlow | Named flows with rationale, one-at-a-time requests, denial cooldown, Settings fallback. | PermissionFlow |
7.4 Field, media, and device UX
These are the libraries that show up once the app leaves the office — inspection, depot, POS, attendance, and always-connected field work.
| Library | Use in development | Page |
|---|---|---|
| Plugin.Maui.GeoLocator | On-demand fix, tracking session, reverse geocoding. | GeoLocator |
| Plugin.Maui.Geofence | Circular enter / exit / dwell (max 20). Not a GPS tracker. | Geofence |
| Plugin.Maui.MediaPipeline | Camera or gallery → resize, EXIF strip, watermark, redact, encrypt → FileVault or SmartUpload. | MediaPipeline |
| Plugin.Maui.VideoPipeline | Camera or gallery video with duration / size gates, thumbnail, AES-256-GCM. No FFmpeg in 1.0. | VideoPipeline |
| Plugin.Maui.FileVault | Encrypted on-device files with key protection and background lock. | FileVault |
| Plugin.Maui.FormValidation | Fluent rules next to the model; Validation.For in XAML. Compose with UIKit fields. | FormValidation |
| Plugin.Maui.KeyboardManager | Hide, show, dismiss-on-tap, resize / pan / safe-area. Compose with UIKit forms. | KeyboardManager |
| Plugin.Maui.Printing | PDF, image, AirPrint, Bluetooth ESC/POS thermal — invoices, receipts, inspection reports. | Printing |
| Plugin.Maui.BluetoothManager | BLE connection lifecycle for printers, POS, and IoT — not another GATT wrapper. | BluetoothManager |
| Plugin.Maui.NfcPlus | NDEF read/write, tag ID, attendance and inventory. | NfcPlus |
7.5 App services, observability, and the doctor
| Library | Use in development | Page |
|---|---|---|
| Plugin.Maui.DeepLinks | App Links, Universal Links, custom schemes, auth-restore. Fail-closed host allowlists. | DeepLinks |
| Plugin.Maui.PushRouter | Route FCM / APNs payloads the host already received. Fail-closed unmapped routes. | PushRouter |
| Plugin.Maui.FeatureFlags | Mobile-first flags with HTTPS remote config and optional HMAC signature. | FeatureFlags |
| Plugin.Maui.Diagnostics | Crash, ANR, unhandled exceptions, breadcrumbs. | Diagnostics |
| Plugin.Maui.Performance | On-device scoreboard plus maui-perf wrapper for maui profile. | Performance |
| Plugin.Maui.LeakAnalyser | WeakReference liveness after a page is popped. Detection Debug-only; teardown may stay in Release. | LeakAnalyser |
| Plugin.Maui.Observability | Umbrella telemetry over health, network, API, upload, sync, and crash events. | Observability |
| MauiDev CLI 1.2.1 | maui-dev doctor, permissions, publish validate, migrate, JSON/SARIF for CI. Not a PackageReference. | MauiDev |
8. A typical composition
An inspection or field-commerce app is the composition this ecosystem was built for. The table is a recommended set, not a required install.
| Concern | Compose |
|---|---|
| Screens | UIKit recipes + NV* controls. FormValidation and KeyboardManager at the host. |
| Shell | MVVMExpress: UseMvvmExpress, UseShell or UseNavigationPage, UseAuth, modules per feature team. |
| API | HttpForge interface + AddHttpForgeClient. Chain ApiResilience, ApiCache, TlsPin, SecureSession. |
| Local + sync | LocalStore (SQLite or NuvexaDB) for CRUD. OfflineSync for the queue. JobQueue / SmartUpload for durable work. |
| Field | GeoLocator or Geofence. MediaPipeline → FileVault or SmartUpload. PermissionFlow before the first prompt. |
| Session | SecureSession + SecureStoragePlus. AppLock after background. ScreenGuard on payment or PII screens. |
| Ship | Diagnostics + LeakAnalyser in Debug. Performance scoreboard. MauiDev doctor and publish --validate in CI. |
A catalog or internal tool can stop at UIKit + MVVMExpress + HttpForge. A kiosk or POS add KeepAwake, DeviceOrientationPlus, Printing, and BluetoothManager. A VoIP surface adds VoipCore. The catalog is opt-in by design.
9. Boundaries
- UIKit is a UI library, not a MauiEssentials runtime plugin. It does not PackageReference Plugin.Maui.*.
- MVVMExpress does not own HTTP, location, or storage. Adapters compose siblings and throw if they are missing.
- HttpForge is the contract, not retry, cache, pin, or upload. Chain those on
IHttpClientBuilder. - LocalStore is CRUD. OfflineSync is the sync engine. JobQueue is planned work. RetryQueue is a failed call. FileVault is encrypted files. They do not replace each other.
- NuvexaDB is a standalone engine with its own white paper. LocalStore can host it; Data Studio stays on the engine.
- Most gallery plugins are Android + iOS. Do not assume Mac Catalyst or Windows unless the package page says so.
- **Plugin.Maui.\* restores from GitHub Packages**, not nuget.org. A project needs two feeds. GitHub Packages requires a token even when the packages are public.
10. How to start
- Scaffold the host:
dotnet new install Plugin.Maui.MVVMExpress.Templatesthendotnet new mvvmexpress -n MyApp. Or install the MVVMExpress Visual Studio Code / Visual Studio Marketplace listings. - Add the GitHub Packages feed for Plugin.Maui.*. nuget.org remains the feed for Microsoft.*, UIKit, and public packages.
- Register
UseNuvyntraUIKit()and paint the first screen from an NV* recipe or a primitive. - Declare the API as an HttpForge interface and
AddHttpForgeClient<T>(). Add ApiResilience or TlsPin only when the environment needs them. - Pull gallery plugins as the product requires them. Start with LocalStore if the app writes on-device; NetworkMonitor if the app must distinguish captive Wi-Fi from real internet.
- Run
maui-dev doctorbefore a store build. The getting-started guide is the install path; this paper is the map.
Every independently versioned plugin: Full product catalog
11. Closing
Nuvyntra Labs is the development ecosystem for teams who want to ship .NET MAUI apps without a mega-SDK and without an unmanaged pile of community packages. UIKit covers the rich UI. MVVMExpress covers the architecture. HttpForge covers the REST contract. The gallery covers the rest of development — local data, network truth, session, field capture, and operations — as focused plugins a team can name, version, and replace.
Research and public proofs still come first. When a pattern is reusable, it becomes a package. The catalog is the published form of that loop. Evaluate a pillar, compose a set, or contact the lab.