Connect each runtime to the services it needs
Wildo derives backing-service configuration and network membership from a runtime’s declared purpose. A background runtime can receive the services it needs without automatically receiving the backend’s full data access.
Example — Connect each runtime to what it needs
A read-only background task works with todos. Its declaration gives it the corresponding data access, while a task with no application-data declaration does not acquire database access by default.
For engineers
Wonder Todos selects read-only application data for its marketing-scrapper minion:
Selected source from wildo.saas.config.ts:
minions: {
marketingScrapper: {
path: './minions/marketing-scrapper',
resourceAccess: {
read: ['todos'],
write: [],
},
},
},
This is a selected minions entry inside the existing wildo.saas.config.ts declaration, not a standalone configuration file. A minion is a separately declared background service with tick-based execution. The example omits its independent platform-access settings. A worker is a different runtime category; do not use the names interchangeably or assume a worker is the backend’s queue consumer.
After editing the declaration, run wildo config sync from the configured application workspace. Inspect the environment generated for ./minions/marketing-scrapper and its deployment network membership. Queue, cache and telemetry are part of the minion service set; database and object-storage topology follow the presence of resourceAccess. Inspect names and grants without printing credential values.
The presence of resourceAccess activates the data-service topology. Omitting it excludes those services; an explicit { read: [], write: [] } still activates the topology but grants no resources through these lists. Reachability and resource grants are separate decisions.
Derive addresses and reachability together
resolveRuntimeBackingServiceAccess evaluates the runtime principal and declaration. The environment builder intersects that access with provisioned services; resolveRuntimeNetworkMembership uses the same result for network membership.
| Runtime | Backing-service interpretation |
|---|---|
| Application backend | The application’s provisioned service set |
| Minion | Queue, cache and telemetry, plus data services when declared |
| Worker | No application backing-service capability by default |
| Missing or unknown principal | No granted capability |
Serving HTTP is a deployment choice. Internet egress is a separate explicit declaration. A connection address does not select the application’s database engine, and network reachability does not replace operation-level permissions.
For a new runtime, inspect the generated environment and network projection together. They should express the same declared access instead of compensating for one another.