@realtimex/folio 0.1.2

package/supabase/migrations/20260225000000_setup_compatible_mode.sql

@@ -0,0 +1,119 @@
+-- Keep old ingestions table from previous migration step for Hybrid Routing
+-- (Previously this dropped public.ingestions, but we now retain it as Folio's primary UI table).
+-- Create rtx_activities table as defined in Compatible Mode docs
+-- Added user_id for multi-tenant isolation
+CREATE TABLE public.rtx_activities (
+  id uuid NOT NULL DEFAULT gen_random_uuid (),
+  user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  raw_data jsonb NULL,            -- Your input data
+  old_data jsonb NULL,            -- Previous data (for updates)
+  locked_by text NULL,            -- Machine ID holding the lock
+  locked_at timestamp with time zone NULL,
+  status text NULL DEFAULT 'pending'::text,
+  completed_at timestamp with time zone NULL,
+  error_message text NULL,
+  attempted_by text[] NULL DEFAULT '{}'::text[],
+  retry_count integer NULL DEFAULT 0,
+  result jsonb NULL,
+  created_at timestamp with time zone NULL DEFAULT now(),
+  CONSTRAINT rtx_activities_pkey PRIMARY KEY (id)
+);
+
+-- Index for status queries
+CREATE INDEX idx_rtx_activities_status ON public.rtx_activities (status);
+-- Index for user list queries
+CREATE INDEX idx_rtx_activities_user ON public.rtx_activities (user_id, created_at DESC);
+
+-- Ensure all columns are included in Realtime events
+ALTER TABLE public.rtx_activities REPLICA IDENTITY FULL;
+
+-- RLS
+ALTER TABLE public.rtx_activities ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Users can manage their own activities"
+    ON public.rtx_activities FOR ALL
+    USING (auth.uid() = user_id)
+    WITH CHECK (auth.uid() = user_id);
+
+-- Database Functions (RPC)
+
+-- Claim Task
+CREATE OR REPLACE FUNCTION rtx_fn_claim_task(target_task_id UUID, machine_id TEXT)
+RETURNS BOOLEAN AS $$
+DECLARE
+  updated_rows INT;
+BEGIN
+  UPDATE public.rtx_activities
+  SET status = 'claimed', locked_by = machine_id, locked_at = now()
+  WHERE id = target_task_id 
+    AND (status = 'pending' OR status = 'failed' 
+         OR ((status = 'claimed' OR status = 'processing') 
+             AND locked_at < now() - INTERVAL '5 minutes'))
+    AND NOT (machine_id = ANY(attempted_by));
+
+  GET DIAGNOSTICS updated_rows = ROW_COUNT;
+  RETURN updated_rows > 0;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Complete Task
+CREATE OR REPLACE FUNCTION rtx_fn_complete_task(target_task_id UUID, result_data JSONB)
+RETURNS BOOLEAN AS $$
+DECLARE
+  updated_rows INT;
+BEGIN
+  UPDATE public.rtx_activities
+  SET status = 'completed', result = result_data, completed_at = now()
+  WHERE id = target_task_id AND (status = 'claimed' OR status = 'processing');
+
+  GET DIAGNOSTICS updated_rows = ROW_COUNT;
+  RETURN updated_rows > 0;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Fail Task
+CREATE OR REPLACE FUNCTION rtx_fn_fail_task(target_task_id UUID, machine_id TEXT, error_msg TEXT)
+RETURNS BOOLEAN AS $$
+DECLARE
+  updated_rows INT;
+BEGIN
+  UPDATE public.rtx_activities
+  SET 
+    status = 'failed', 
+    error_message = error_msg,
+    attempted_by = array_append(attempted_by, machine_id),
+    retry_count = retry_count + 1,
+    locked_by = NULL,
+    locked_at = NULL
+  WHERE id = target_task_id;
+
+  GET DIAGNOSTICS updated_rows = ROW_COUNT;
+  RETURN updated_rows > 0;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Enable pg_cron extension
+CREATE EXTENSION IF NOT EXISTS pg_cron;
+
+-- Create cleanup function
+CREATE OR REPLACE FUNCTION public.rtx_fn_unlock_stale_locks()
+RETURNS void AS $$
+BEGIN
+  UPDATE public.rtx_activities 
+  SET status = 'pending', locked_by = NULL, locked_at = NULL
+  WHERE (status = 'claimed' OR status = 'processing')
+    AND locked_at < now() - INTERVAL '5 minutes';
+END;
+$$ LANGUAGE plpgsql;
+
+-- Avoid conflicts if it exists already, just drop it and recreate
+DO $$
+BEGIN
+  PERFORM cron.unschedule('scavenge-stale-locks');
+EXCEPTION WHEN OTHERS THEN
+  -- ignore
+END $$;
+SELECT cron.schedule('scavenge-stale-locks', '* * * * *', 'SELECT public.rtx_fn_unlock_stale_locks();');
+
+-- Enable Realtime
+ALTER PUBLICATION supabase_realtime ADD TABLE public.rtx_activities;

package/supabase/migrations/20260225000001_restore_ingestions.sql

@@ -0,0 +1,49 @@
+-- Ingestion log table: tracks every document processed through Folio's Policy Engine
+-- (Restoring this table for the Hybrid Routing Architecture, since the previous
+-- compatible_mode migration erroneously dropped it).
+CREATE TABLE IF NOT EXISTS ingestions (
+    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id         uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    source          text NOT NULL DEFAULT 'upload',   -- 'upload' | 'dropzone' | 'email' | 'url'
+    filename        text NOT NULL,
+    mime_type       text,
+    file_size       bigint,
+    status          text NOT NULL DEFAULT 'pending',  -- 'pending' | 'processing' | 'matched' | 'no_match' | 'error'
+    policy_id       text,                             -- matched policy id (nullable)
+    policy_name     text,                             -- denormalised for display
+    extracted       jsonb DEFAULT '{}'::jsonb,        -- key/value pairs extracted by FPE
+    actions_taken   jsonb DEFAULT '[]'::jsonb,        -- list of actions executed
+    error_message   text,
+    storage_path    text,                             -- file path pointer for Hybrid Routing or Supabase Storage ID
+    created_at      timestamptz NOT NULL DEFAULT now(),
+    updated_at      timestamptz NOT NULL DEFAULT now()
+);
+
+-- Index for per-user list queries
+CREATE INDEX IF NOT EXISTS ingestions_user_id_idx ON ingestions(user_id, created_at DESC);
+
+-- RLS
+ALTER TABLE ingestions ENABLE ROW LEVEL SECURITY;
+
+DO $$ BEGIN
+    CREATE POLICY "Users can manage their own ingestions"
+        ON ingestions FOR ALL
+        USING (auth.uid() = user_id)
+        WITH CHECK (auth.uid() = user_id);
+EXCEPTION
+    WHEN duplicate_object THEN null;
+END $$;
+
+-- updated_at trigger
+CREATE OR REPLACE FUNCTION update_ingestions_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = now();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS ingestions_updated_at ON ingestions;
+CREATE TRIGGER ingestions_updated_at
+    BEFORE UPDATE ON ingestions
+    FOR EACH ROW EXECUTE FUNCTION update_ingestions_updated_at();

package/supabase/migrations/20260225000002_add_ingestion_trace.sql

@@ -0,0 +1,2 @@
+-- Add trace column to ingestions table for full AI Transparency
+ALTER TABLE public.ingestions ADD COLUMN IF NOT EXISTS trace JSONB DEFAULT '[]'::jsonb;

package/supabase/migrations/20260225000003_add_baseline_configs.sql

@@ -0,0 +1,35 @@
+-- Versioned baseline extraction configuration per user.
+-- Each row is immutable once referenced by an ingestion record,
+-- enabling full auditability of which prompt config produced each extraction.
+
+CREATE TABLE public.baseline_configs (
+  id         uuid        NOT NULL DEFAULT gen_random_uuid(),
+  user_id    uuid        NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  version    integer     NOT NULL,
+  context    text        NULL,           -- free-text injected into the extraction system prompt
+  fields     jsonb       NOT NULL DEFAULT '[]', -- array of BaselineField definitions
+  is_active  boolean     NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+
+  CONSTRAINT baseline_configs_pkey            PRIMARY KEY (id),
+  CONSTRAINT baseline_configs_user_version_key UNIQUE (user_id, version)
+);
+
+-- Fast lookup of a user's active config
+CREATE INDEX idx_baseline_configs_user_active
+  ON public.baseline_configs (user_id, is_active);
+
+-- RLS
+ALTER TABLE public.baseline_configs ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Users manage own baseline configs"
+  ON public.baseline_configs FOR ALL
+  USING (auth.uid() = user_id)
+  WITH CHECK (auth.uid() = user_id);
+
+-- Record which config version produced each ingestion's extraction.
+-- NULL means the ingestion was processed before this feature existed
+-- or that the default built-in fields were used.
+ALTER TABLE public.ingestions
+  ADD COLUMN baseline_config_id uuid NULL
+    REFERENCES public.baseline_configs(id) ON DELETE SET NULL;

package/supabase/migrations/20260226000000_add_processing_events.sql

@@ -0,0 +1,26 @@
+-- Create processing_events table for granular logging
+CREATE TABLE IF NOT EXISTS processing_events (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    ingestion_id UUID REFERENCES ingestions(id) ON DELETE CASCADE,
+    user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE,
+    event_type TEXT NOT NULL CHECK (event_type IN ('info', 'analysis', 'action', 'error')),
+    agent_state TEXT, -- e.g., 'Triage', 'Baseline Extraction', 'Policy Matching', 'Action Execution'
+    details JSONB, -- Stores LLM inputs/outputs, reasoning, confidence
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);
+
+-- Enable RLS
+ALTER TABLE processing_events ENABLE ROW LEVEL SECURITY;
+
+-- RLS Policy: Users can access their own processing events
+CREATE POLICY "Users can access their own processing events" ON processing_events
+    FOR ALL USING (auth.uid() = user_id);
+
+-- Enable Realtime for this table (standard Supabase publication)
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_publication_tables WHERE pubname = 'supabase_realtime' AND schemaname = 'public' AND tablename = 'processing_events') THEN
+    ALTER PUBLICATION supabase_realtime ADD TABLE processing_events;
+  END IF;
+END
+$$;

package/supabase/migrations/20260226000001_add_ingestion_file_hash.sql

@@ -0,0 +1,10 @@
+-- Add file_hash column to ingestions for duplicate detection.
+-- SHA-256 hex digest (64 chars) of the raw file bytes.
+-- Nullable so existing rows are unaffected.
+ALTER TABLE ingestions ADD COLUMN IF NOT EXISTS file_hash TEXT;
+
+-- Partial index: only non-null hashes, scoped per user — makes the
+-- duplicate lookup (user_id + file_hash) fast without indexing NULLs.
+CREATE INDEX IF NOT EXISTS idx_ingestions_user_file_hash
+    ON ingestions (user_id, file_hash)
+    WHERE file_hash IS NOT NULL;

package/supabase/migrations/20260226000002_add_dynamic_rag.sql

@@ -0,0 +1,150 @@
+-- Enable pgvector extension for vector similarity search
+CREATE EXTENSION IF NOT EXISTS vector;
+
+-- Document chunks table for Semantic Search (RAG)
+CREATE TABLE IF NOT EXISTS document_chunks (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    ingestion_id UUID NOT NULL REFERENCES ingestions(id) ON DELETE CASCADE,
+    
+    -- Content
+    content TEXT NOT NULL,
+    content_hash TEXT NOT NULL, -- To detect duplicates
+    embedding_provider TEXT NOT NULL,
+    embedding_model TEXT NOT NULL,
+    
+    -- Unconstrained Vector Embedding
+    -- By not defining the dimension (e.g. vector(1536)), we allow multiple 
+    -- embedding models to coexist in the same table seamlessly.
+    embedding vector NOT NULL,
+    vector_dim INTEGER NOT NULL,
+    
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    
+    -- Prevent duplicate chunks for the same document + model identity.
+    -- This allows hot-swapping models while keeping each model's vector space isolated.
+    UNIQUE(ingestion_id, content_hash, embedding_provider, embedding_model)
+);
+
+-- Enable RLS
+ALTER TABLE document_chunks ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Users can manage their own document chunks"
+    ON document_chunks
+    FOR ALL
+    USING (user_id = auth.uid())
+    WITH CHECK (user_id = auth.uid());
+
+-- Advanced Partial Indexes for HNSW
+-- We create partial indexes for the most common dimensions to maintain 
+-- sub-millisecond search performance while keeping the 'embedding' column unconstrained.
+CREATE INDEX IF NOT EXISTS document_chunks_embedding_384_idx 
+    ON document_chunks USING hnsw ((embedding::vector(384)) vector_cosine_ops) 
+    WHERE (vector_dim = 384);
+
+CREATE INDEX IF NOT EXISTS document_chunks_embedding_768_idx 
+    ON document_chunks USING hnsw ((embedding::vector(768)) vector_cosine_ops) 
+    WHERE (vector_dim = 768);
+
+CREATE INDEX IF NOT EXISTS document_chunks_embedding_1536_idx 
+    ON document_chunks USING hnsw ((embedding::vector(1536)) vector_cosine_ops) 
+    WHERE (vector_dim = 1536);
+
+-- Index for fast deletion and lookup by ingestion_id
+CREATE INDEX IF NOT EXISTS document_chunks_ingestion_id_idx 
+    ON document_chunks(ingestion_id);
+
+CREATE INDEX IF NOT EXISTS document_chunks_user_id_idx 
+    ON document_chunks(user_id);
+
+CREATE INDEX IF NOT EXISTS document_chunks_model_scope_idx
+    ON document_chunks(user_id, embedding_provider, embedding_model, vector_dim);
+
+-- Dynamic Semantic Search Function
+CREATE OR REPLACE FUNCTION search_documents(
+    p_user_id UUID,
+    p_embedding_provider TEXT,
+    p_embedding_model TEXT,
+    query_embedding vector,
+    match_threshold float DEFAULT 0.7,
+    match_count int DEFAULT 5,
+    query_dim int DEFAULT 1536
+)
+RETURNS TABLE (
+    id UUID,
+    ingestion_id UUID,
+    content TEXT,
+    similarity float
+)
+LANGUAGE plpgsql
+AS $$
+BEGIN
+    IF query_dim = 384 THEN
+        RETURN QUERY
+        SELECT
+            dc.id,
+            dc.ingestion_id,
+            dc.content,
+            1 - (dc.embedding::vector(384) <=> query_embedding::vector(384)) AS similarity
+        FROM document_chunks dc
+        WHERE dc.user_id = p_user_id
+          AND dc.embedding_provider = p_embedding_provider
+          AND dc.embedding_model = p_embedding_model
+          AND dc.vector_dim = 384
+          AND 1 - (dc.embedding::vector(384) <=> query_embedding::vector(384)) > match_threshold
+        ORDER BY dc.embedding::vector(384) <=> query_embedding::vector(384)
+        LIMIT match_count;
+    ELSIF query_dim = 768 THEN
+        RETURN QUERY
+        SELECT
+            dc.id,
+            dc.ingestion_id,
+            dc.content,
+            1 - (dc.embedding::vector(768) <=> query_embedding::vector(768)) AS similarity
+        FROM document_chunks dc
+        WHERE dc.user_id = p_user_id
+          AND dc.embedding_provider = p_embedding_provider
+          AND dc.embedding_model = p_embedding_model
+          AND dc.vector_dim = 768
+          AND 1 - (dc.embedding::vector(768) <=> query_embedding::vector(768)) > match_threshold
+        ORDER BY dc.embedding::vector(768) <=> query_embedding::vector(768)
+        LIMIT match_count;
+    ELSIF query_dim = 1536 THEN
+        RETURN QUERY
+        SELECT
+            dc.id,
+            dc.ingestion_id,
+            dc.content,
+            1 - (dc.embedding::vector(1536) <=> query_embedding::vector(1536)) AS similarity
+        FROM document_chunks dc
+        WHERE dc.user_id = p_user_id
+          AND dc.embedding_provider = p_embedding_provider
+          AND dc.embedding_model = p_embedding_model
+          AND dc.vector_dim = 1536
+          AND 1 - (dc.embedding::vector(1536) <=> query_embedding::vector(1536)) > match_threshold
+        ORDER BY dc.embedding::vector(1536) <=> query_embedding::vector(1536)
+        LIMIT match_count;
+    ELSE
+        -- Fallback to unconstrained exact nearest neighbor scan for unindexed dimensions
+        RETURN QUERY
+        SELECT
+            dc.id,
+            dc.ingestion_id,
+            dc.content,
+            1 - (dc.embedding <=> query_embedding) AS similarity
+        FROM document_chunks dc
+        WHERE dc.user_id = p_user_id
+          AND dc.embedding_provider = p_embedding_provider
+          AND dc.embedding_model = p_embedding_model
+          AND dc.vector_dim = query_dim
+          AND 1 - (dc.embedding <=> query_embedding) > match_threshold
+        ORDER BY dc.embedding <=> query_embedding
+        LIMIT match_count;
+    END IF;
+END;
+$$;
+
+-- Comments
+COMMENT ON TABLE document_chunks IS 'Stores semantic text chunks from parsed documents for RAG.';
+COMMENT ON COLUMN document_chunks.embedding IS 'Unconstrained vector to support dynamic embedding models.';
+COMMENT ON FUNCTION search_documents IS 'Performs dynamic cosine similarity search against unconstrained vectors.';

package/supabase/migrations/20260226000003_add_ingestion_summary.sql

@@ -0,0 +1,4 @@
+-- Add AI-generated prose summary column to ingestions.
+-- Populated on first modal open, cleared when a re-run resets extraction.
+ALTER TABLE public.ingestions
+    ADD COLUMN IF NOT EXISTS summary text NULL;

package/supabase/migrations/20260226000004_add_ingestion_tags.sql

@@ -0,0 +1,7 @@
+-- Add LLM-generated + human-curated tags to ingestions.
+-- GIN index enables efficient array-containment queries (e.g. @> '{tax-deductible}').
+ALTER TABLE public.ingestions
+    ADD COLUMN IF NOT EXISTS tags text[] NOT NULL DEFAULT '{}';
+
+CREATE INDEX IF NOT EXISTS ingestions_tags_gin_idx
+    ON public.ingestions USING gin(tags);

package/supabase/migrations/20260226000005_add_chat_tables.sql

@@ -0,0 +1,60 @@
+-- Chat Sessions Table
+CREATE TABLE IF NOT EXISTS chat_sessions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    title TEXT NOT NULL DEFAULT 'New Conversation',
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Chat Messages Table
+CREATE TABLE IF NOT EXISTS chat_messages (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    session_id UUID NOT NULL REFERENCES chat_sessions(id) ON DELETE CASCADE,
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    
+    role TEXT NOT NULL CHECK (role IN ('user', 'assistant', 'system')),
+    content TEXT NOT NULL,
+    context_sources JSONB DEFAULT '[]'::jsonb, -- Store the RAG chunks used to answer this message
+    
+    created_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Enable RLS
+ALTER TABLE chat_sessions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE chat_messages ENABLE ROW LEVEL SECURITY;
+
+-- Policies for chat_sessions
+CREATE POLICY "Users can manage their own chat sessions"
+    ON chat_sessions
+    FOR ALL
+    USING (user_id = auth.uid())
+    WITH CHECK (user_id = auth.uid());
+
+-- Policies for chat_messages
+CREATE POLICY "Users can manage their own chat messages"
+    ON chat_messages
+    FOR ALL
+    USING (user_id = auth.uid())
+    WITH CHECK (user_id = auth.uid());
+
+-- Indexes for performance
+CREATE INDEX IF NOT EXISTS chat_sessions_user_id_idx ON chat_sessions(user_id);
+CREATE INDEX IF NOT EXISTS chat_messages_session_id_idx ON chat_messages(session_id);
+CREATE INDEX IF NOT EXISTS chat_messages_user_id_idx ON chat_messages(user_id);
+
+-- Trigger to update session updated_at
+CREATE OR REPLACE FUNCTION update_chat_session_timestamp()
+RETURNS TRIGGER AS $$
+BEGIN
+    UPDATE chat_sessions
+    SET updated_at = NOW()
+    WHERE id = NEW.session_id;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER trigger_update_chat_session_timestamp
+AFTER INSERT ON chat_messages
+FOR EACH ROW
+EXECUTE FUNCTION update_chat_session_timestamp();

package/supabase/migrations/20260227000000_harden_chat_messages_rls.sql

@@ -0,0 +1,25 @@
+-- Tighten chat message authorization to require ownership of both the row user_id
+-- and the referenced session. This prevents cross-session inserts/selects.
+DROP POLICY IF EXISTS "Users can manage their own chat messages" ON chat_messages;
+
+CREATE POLICY "Users can manage their own chat messages"
+    ON chat_messages
+    FOR ALL
+    USING (
+        user_id = auth.uid()
+        AND EXISTS (
+            SELECT 1
+            FROM chat_sessions cs
+            WHERE cs.id = chat_messages.session_id
+              AND cs.user_id = auth.uid()
+        )
+    )
+    WITH CHECK (
+        user_id = auth.uid()
+        AND EXISTS (
+            SELECT 1
+            FROM chat_sessions cs
+            WHERE cs.id = chat_messages.session_id
+              AND cs.user_id = auth.uid()
+        )
+    );

package/supabase/migrations/20260228000000_add_vision_model_capabilities.sql

@@ -0,0 +1,8 @@
+-- Migration: Persist learned vision capability state per user model
+-- Created: 2026-02-28
+
+ALTER TABLE public.user_settings
+ADD COLUMN IF NOT EXISTS vision_model_capabilities JSONB NOT NULL DEFAULT '{}'::jsonb;
+
+COMMENT ON COLUMN public.user_settings.vision_model_capabilities IS
+'Learned VLM capability map keyed by provider:model with state/TTL metadata.';

package/supabase/migrations/20260228000001_add_policy_match_feedback.sql

@@ -0,0 +1,51 @@
+-- Stores explicit user feedback when they manually map an ingestion to a policy.
+-- Used to improve future policy matching via lightweight similarity scoring.
+CREATE TABLE IF NOT EXISTS public.policy_match_feedback (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    ingestion_id UUID NOT NULL REFERENCES public.ingestions(id) ON DELETE CASCADE,
+    policy_id TEXT NOT NULL,
+    policy_name TEXT,
+    feedback_type TEXT NOT NULL DEFAULT 'manual_match' CHECK (feedback_type IN ('manual_match')),
+    features JSONB NOT NULL DEFAULT '{}'::jsonb,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(user_id, ingestion_id, policy_id)
+);
+
+CREATE INDEX IF NOT EXISTS policy_match_feedback_user_policy_idx
+    ON public.policy_match_feedback(user_id, policy_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS policy_match_feedback_user_created_idx
+    ON public.policy_match_feedback(user_id, created_at DESC);
+
+ALTER TABLE public.policy_match_feedback ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Users can read own policy match feedback"
+    ON public.policy_match_feedback FOR SELECT
+    USING (auth.uid() = user_id);
+
+CREATE POLICY "Users can insert own policy match feedback"
+    ON public.policy_match_feedback FOR INSERT
+    WITH CHECK (auth.uid() = user_id);
+
+CREATE POLICY "Users can update own policy match feedback"
+    ON public.policy_match_feedback FOR UPDATE
+    USING (auth.uid() = user_id);
+
+CREATE POLICY "Users can delete own policy match feedback"
+    ON public.policy_match_feedback FOR DELETE
+    USING (auth.uid() = user_id);
+
+CREATE OR REPLACE FUNCTION update_policy_match_feedback_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = NOW();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS policy_match_feedback_updated_at ON public.policy_match_feedback;
+CREATE TRIGGER policy_match_feedback_updated_at
+    BEFORE UPDATE ON public.policy_match_feedback
+    FOR EACH ROW EXECUTE FUNCTION update_policy_match_feedback_updated_at();

package/supabase/templates/confirmation.html

@@ -0,0 +1,76 @@
+<!doctype html>
+<html>
+
+<head>
+  <style>
+    body {
+      font-family: Arial, sans-serif;
+      background-color: #f4f4f4;
+      margin: 0;
+      padding: 0;
+    }
+
+    .container {
+      width: 100%;
+      max-width: 600px;
+      margin: 0 auto;
+      background-color: #ffffff;
+      padding: 20px;
+      border-radius: 8px;
+      box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
+    }
+
+    .header {
+      text-align: center;
+      padding: 10px 0;
+    }
+
+    .header h2 {
+      margin: 0;
+      color: #333333;
+    }
+
+    .content {
+      padding: 20px;
+      line-height: 1.6;
+      color: #555555;
+    }
+
+    .content p {
+      margin: 0 0 10px;
+    }
+
+    .button {
+      display: block;
+      width: 200px;
+      margin: 20px auto;
+      padding: 10px;
+      text-align: center;
+      background-color: #007bff;
+      color: #ffffff !important;
+      text-decoration: none;
+      border-radius: 5px;
+    }
+  </style>
+</head>
+
+<body>
+  <div class="container">
+    <div class="header">
+      <h2>Confirm your email</h2>
+    </div>
+    <div class="content">
+      <p>Hello,</p>
+      <p>
+        Thanks for signing up for Folio! Please confirm your email
+        address by clicking the button below.
+      </p>
+      <p>
+        <a href="{{ .ConfirmationURL }}auth-callback.html" class="button">Confirm my email</a>
+      </p>
+      <p>The Folio team</p>
+    </div>
+  </div>
+</body>
+
+</html>