Start with
one file.

Quickstart

The platform checkout is a Rust workspace plus a small Node toolchain. You need macOS on Apple Silicon, Xcode Command Line Tools, stable Rust, Node.js, CMake 3.24+ and Git. For the Web host, add thewasm32-unknown-unknown target, wasm-pack and Playwright Chromium.

# 1 · dependencies
npm install

# 2 · compile every app/*/app.ts to MBC
npm run build:app

# 3 · build + open the native Home
npm run demo

# 4 · or run the browser host
npm run dev:web

The first native build downloads and compiles SDL 3.4.10 and LVGL 9.5.0 intotarget/native-deps. Later builds reuse the cache. The compiler never runs on the device.

Project map

The workspace separates the contract, the hosts and the products. Dependencies only point one way.

Manifest

Every app starts with app({ … }). The manifest carries identity, the launcher icon and the capability allow-list that the compiler and runtime both enforce.

app({
  id: "notes",
  name: "Notes",
  icon: "edit",
  capabilities: ["kv", "storage"],
});

const draft = state("");

ui.mount(
  ui.column([
    ui.text("Notes", { size: 24, lineHeight: 32 }),
    ui.input(bind(() => draft.value), {
      placeholder: "write something",
      onChange: (text) => { draft.value = text; },
    }),
  ]),
);

Omitting capabilities — or declaring an empty list — denies every host call. The compiler rejects a call outside the manifest at the call site (MTS002). The manifest is stored in the MBC metadata section.

Language

The accepted surface is an allow-list, not full TypeScript. It is designed to be lowered to a small typed stack machine and validated before execution.

Layout is explicit

Columns and rows are containers; children get a position with ui.place. Anchors can pin an edge or stretch between two. There is no hidden layout pass whose result depends on host font metrics.

ui.place(
  ui.button("Add", {
    onClick: () => { count.value++; },
  }),
  { left: 24, top: 120, width: 160, height: 44 },
);

Host API

Host calls are the only way an app touches the outside world. Reads work in bindings and handlers; writes and async requests are handlers-only. Every category must be declared in the manifest.

net.* is asynchronous and delivers results through a callback. clock.now() is sampled per call and is not a reactive source: a binding that reads it only re-evaluates when one of its state dependencies changes.

Storage

Three separate contracts, so apps never write host-specific files themselves.

Paths are relative and sandboxed. storage exposes no host path and no cross-app handle. On a board without a card, storage.available() is false.

Limits

These are current boundaries, not a roadmap promise.

• Static UI. No runtime widget creation, no dynamic list, no source-level debugging.
• One foreground app. No background apps, services, timers or IPC.
• Bounded handlers. 10,000 instructions per handler; all app work is on the host UI thread.
• No MMU isolation. Bytecode executes in one address space, sandboxed by the VM and host API.
• Unsigned artifacts. MBC has a CRC, not a signature; there is no install consent UI.
• No OTA. Single factory app partition; no A/B slot or rollback.
• Shell is an app. An unreadable shell.mbc aborts boot instead of falling back to native UI.

FAQ