## The short version

An asset library blueprint for b2b saas built with Next.js on Ample. Domain schema: 
- **customer_workspaces** (name, plan, seat_count, created_at): customer tenants;
- **workspace_members** (workspace_id, email, role): members and roles per workspace;
- **doc_versions** (product_version, title, object_key, published_at): versioned product documentation;
- **customer_assets** (workspace_id, title, object_key, visibility): assets scoped to one customer;
- **uploads** (id, owner_reference, object_key, content_type, size, uploaded_at): validated uploads linked to their owner. Public information: product documentation by version, pricing and plan comparison, status and changelog. Kept out of scope until handling is reviewed: customer data inside workspaces, usage and billing records, support attachments. Customer workspace data is tenant-scoped; isolation is application-enforced and no security certification is claimed. Technical basis verified on Next.js: content-type and size validation that rejects disallowed files, an object written to a private bucket and a row linking the record to the object key (reject=ok upload=ok linked=ok).

## What it needs

- [Compute](/content/discover/primitive/compute/index.html): verified (Apps run in isolated x86_64 Firecracker microVMs; sizes are the priced VM sizes.)
- [Postgres](/content/discover/primitive/postgres/index.html): verified (Managed PostgreSQL 16 runs in its own microVM and is auto-provisioned when an app needs a database and no DATABASE_URL is supplied.)
- [S3-compatible object storage](/content/discover/primitive/s3-compatible-object-storage/index.html): verified (Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary. Other S3 operations are not verified.)

## Before you start

- A Next.js project (next build then next start -H 0.0.0.0 -p $PORT on the node-22 template)
- A PostgreSQL driver reading DATABASE_URL (auto-provisioned when omitted)
- Bucket credentials from `ample bucket create` passed as encrypted S3_* environment variables
- A review of which b2b saas data classes may be handled at all; this blueprint models public information only

## How to do it

1.  Create the tables **customer_workspaces**, **workspace_members**, **doc_versions**, **customer_assets**, **uploads**. Customer tenants lives in customer_workspaces; keep the sensitive classes (customer data inside workspaces, usage and billing records, support attachments) out of this schema.

2.  Model assets linked to their owning group or workspace

3.  Validate uploads and store them in the private bucket; link each object to its row

4.  Authorize downloads by membership

5.  Deploy and verify rejection of disallowed files and a linked upload

6.  Run the synchronous deploy once and read the result.

```
    ample deploy . --name <app-name> --public --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=...
    ```

7.  Run the pattern self-test(s) from the example (/p/browser-file-uploads) and your own acceptance checks for the b2b saas workflow.

```
    ample logs <deployment_id> --kind build
    ```

## Tested examples

- **Next.js pattern fixture** (`tests/deploy-canaries/next-js-patterns`): Verified browser file uploads basis for this blueprint.

## How to know it worked

- app responds on its public URL (`/` on the live URL, expect ample canary next js patterns)
- browser-file-uploads self-test from the example (`/p/browser-file-uploads` on the live URL, expect see the pattern fixture checks)

## Cost estimate

Estimated 10.00 USD per month (size prices from pricing.toml at build revision ca0b484a7a9957c573a88d3a32dc603c3c10135a).

- app server x1 `s-1vcpu-1gb`: 5.00 USD
- managed PostgreSQL database x1 `s-1vcpu-1gb`: 5.00 USD

Upper-bound monthly price of the tested sizes. Buckets are allocation-priced per quota and not included.

## Verification evidence

- canary_run on 2026-09-21T02:34:39Z at revision `1d28ae0 (CLI 0.1.21)`: Next.js pattern fixture deployed on Ample (next build then next start -H 0.0.0.0 -p $PORT on the node-22 template); the browser file uploads checks passed: content-type and size validation that rejects disallowed files, an object written to a private bucket and a row linking the record to the object key (reject=ok upload=ok linked=ok). The blueprint's B2B SaaS schema and workflow below build on that verified basis and were not separately executed. (expires 2027-03-20T02:34:39Z)

## Execution binding

MCP tool `ample_deploy` (registry `mcp:ample_deploy`), schema hash `876465fce906da0c` observed 2026-09-22T00:31:22.774679+00:00 at revision `e6446ceea69b`. Binding state at export: schema_changed. Required scopes: servers:write, databases:read, buckets:read.

## Typed next actions

- Browse the catalog index (`GET /v1/catalog` on the api origin; authentication not required, approval not required)
- Search published recipes by intent, stack and constraints (`POST /v1/catalog/search` on the api origin; authentication not required, approval not required)
- Prepare a side-effect-free deployment plan for an authorized project (`POST /v1/catalog/plan` on the api origin; authentication required, approval not required)
- Read the existing agent authentication setup (`GET /mcp/setup` on the api origin; authentication not required, approval not required)
- Browse B2B SaaS (`GET /v1/catalog/nodes/industry%3Ab2b-saas` on the api origin; authentication not required, approval not required)
- Browse Asset library (`GET /v1/catalog/nodes/workload%3Aasset-library` on the api origin; authentication not required, approval not required)
- Browse Next.js (`GET /v1/catalog/nodes/stack%3Aframework-next-js` on the api origin; authentication not required, approval not required)
- Browse Deploy web app (`GET /v1/catalog/nodes/intent%3Adeploy-web-app` on the api origin; authentication not required, approval not required)