Execution classes

Varc uses one TypeScript language and module catalog across four execution classes. The class decides what data the script receives, which host APIs are installed, and how tightly the run is bounded.

Capability matrix

Behavior	Manual script	Command macro	Transformer	Dashboard script
Static built-in imports	Yes	Yes	Yes	Yes
Active env values	Yes	Yes	Yes	Yes
Redis reads	Yes	Yes	No	Yes
Redis writes	Yes, subject to policy	Yes, subject to policy	No	No
fetch	With Network permission	With Network permission	No	No
Clipboard, dialogs, notifications	With permission	With permission	No	No
Injected value and complete	No	No	Yes	No
Default deadline	5 seconds	5 seconds	500 milliseconds	30 seconds
Memory limit	64 MiB	64 MiB	16 MiB	16 MiB

The editor uses the selected class to remove unavailable globals from completion and diagnostics. A module can be pure and available everywhere even when a host API such as Fetch is not.

Manual scripts

Manual scripts are the general-purpose Scripts workflow. They run on demand against the connected workspace and may perform ordinary Redis reads and writes.

The root redis facade follows the workspace database. Use redis.db(n) for an explicit route. Scripts store no fixed database metadata, so this routing remains visible in source.

A new unsaved editor can run with all host permissions denied. Save the script before granting Clipboard, Dialogs, Notifications, or Network.

Command macros

A command macro is a saved script with Macro enabled. It uses the same scripting engine, Redis policy, limits, and optional permissions as a manual script.

Assign the macro to one of the configured macro slots or run it from the macro palette. Varc loads its source immediately before the run and does not start two concurrent runs of the same write-capable macro.

Use macros for repeatable operator actions whose database targeting and side effects are clear in source. Do not use them as background schedulers.

Transformers

Transformers are pure value decoders shared by value viewers. They receive the selected value as exact Uint8Array bytes:

import { toString } from "varc:bytes";

return {
  kind: "text",
  body: toString(value),
  warnings: [],
  truncated: false,
};

The transformer policy denies every Redis command and every host capability. It still provides the active env and pure built-in modules, allowing a decoder to use user-supplied configuration without gaining network or database access.

Transformers have a 256 KiB source cap, 512 KiB output cap, 32-message console cap, and a tighter nesting limit. A failed transformer falls back to the normal binary viewer rather than replacing the original bytes.

Dashboard scripts

Each script-backed dashboard widget runs on its configured polling schedule. It permits Redis reads and selected read-only diagnostic subcommands while Varc checks the server’s command metadata to reject writes, including module commands.

const connectedClients = await redis.call("INFO", "clients");
return redis.text(connectedClients);

Dashboard scripts have a 30-second deadline for legitimate aggregations, but remain small: 16 MiB of memory, a 32 KiB source cap, 512 Redis operations, 128 scan iterations, 4,096 scan results, and a 256 KiB output cap. Polls never overlap for the same widget.

Network-enabled dashboard widgets are not currently supported. Dashboard configuration syncs with the connection profile; results and in-session history do not.

Shared limits

Every class also has a native stack cap, output-depth cap, source and argument limits, cancellation, bounded console capture, and a finite host-operation queue. A caller may tighten a run but cannot raise it above the sandbox ceilings.

Manual scripts and macros default to:

Limit	Default
Source	1 MiB
Redis operations	10,000
Distinct logical databases	32
SCAN-family iterations	1,000
SCAN-family returned entries	10,000
One Redis reply	8 MiB
Returned value	8 MiB
Captured console messages	1,000
Native stack	256 KiB

Fetch has separate request and response quotas documented in the Fetch API.

Redis and Valkey topology

The same class rules apply to standalone, Sentinel, and cluster connections. The host performs topology routing; scripts do not receive raw connection handles. Cluster permits logical database 0 only, and an uncertain write is never silently retried.

Varc scripts remain separate from Redis- or Valkey-hosted Lua and Functions. The scripting policy rejects EVAL, EVALSHA, SCRIPT, FCALL, and FUNCTION.