chore: drop Supabase support and the legacy newsletter package

The fleet has fully moved off Supabase. Remove every Supabase code path,
dependency, lint rule, and reference, and delete the newsletter package
(superseded by nk-marketing).

- newsletter: delete the package entirely; drop refs in READMEs, guide,
  architecture/db/philosophy docs, CI publint loop, and publish script.
- nk-db (breaking, major): resolve the connection from DATABASE_URL only
  (drop the POSTGRES_URL_NON_POOLING / POSTGRES_URL Supabase fallbacks);
  remove configureTimestampsAsStrings() and the ./types module (a
  Supabase-row-types shim — use Drizzle's per-column mode). Reword RLS /
  coerce / pool / pglite comments to drop Supabase/PostgREST framing.
- nk-auth: mark bcryptPassword @deprecated (legacy support only); drop the
  optional @supabase/supabase-js peer/dev dependency and the "Supabase RLS
  bridge" description; document the bcrypt->scrypt migration path in the
  README (dual-format verify + lazy rehash-on-login or a reset campaign).
- nk-dev: remove the @supabase/supabase-js no-restricted-imports rule;
  reword dev/format script comments.
- nk-api: reword "PostgREST-style auto API" framing to "auto-generated REST
  API" in the description, README, and comments.
- docs: delete better-auth-migration.md (migration complete); reframe the
  RLS guidance as the JWT-claims pattern on a direct connection; generalize
  the vendor-stance reasoning without naming the product.
- Migration SQL comments reworded only (DDL byte-identical).

Changesets: nk-db major; nk-auth, nk-api, nk-dev, nk-marketing patch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jleclanche

.changeset/nk-api-drop-postgrest-framing.md

@@ -0,0 +1,7 @@
+---
+"@ingram-tech/nk-api": patch
+---
+
+Docs/metadata only: reword the package description, README, and source comments
+to describe nk-api as the alternative to an auto-generated REST API rather than
+"a PostgREST-style auto API." No code change.

.changeset/nk-auth-deprecate-bcrypt.md

@@ -0,0 +1,16 @@
+---
+"@ingram-tech/nk-auth": patch
+---
+
+Mark `bcryptPassword` as **legacy support only** (`@deprecated`): it exists
+solely so sites with pre-existing bcrypt hashes keep verifying. New sites should
+omit it and use Better Auth's default scrypt. The README's canonical `lib/auth.ts`
+no longer wires it, and a new "Migrating bcrypt passwords to scrypt" section
+documents the path (a dual-format verifier + lazy rehash-on-login or a reset
+campaign; Better Auth has the reset flow natively but no rehash-on-login and no
+"must reset" gate). `bcryptPassword` still works — no API change.
+
+Also drops the optional `@supabase/supabase-js` peer dependency (and the
+"Supabase RLS bridge" mention in the package description); the fleet is fully off
+Supabase, and RLS now lives in `@ingram-tech/nk-db` (`withRls` /
+`withRlsTransaction`).

.changeset/nk-db-drop-supabase.md

@@ -0,0 +1,17 @@
+---
+"@ingram-tech/nk-db": major
+---
+
+Drop Supabase-era compatibility. **Breaking:**
+
+- **Connection string is `DATABASE_URL` only.** The `POSTGRES_URL_NON_POOLING`
+  and `POSTGRES_URL` fallbacks (the Supabase integration's autopopulated vars)
+  are no longer read by `getDatabaseUrl` / `dbEnv`. Set `DATABASE_URL`.
+- **Removed `configureTimestampsAsStrings()`** (and the `./types` module). It was
+  a shim for Supabase-generated row types that declared timestamps as `string`.
+  On the golden path, express this per-column with Drizzle's
+  `timestamp(..., { mode: "string" })`; the `pgTimestampToIso` /
+  `pgNumericToNumber` response-boundary coercions remain for strict schemas.
+
+No behavioral change to the pool, RLS helpers, or queries — only doc comments
+were reworded to drop Supabase/PostgREST framing.

.changeset/nk-dev-drop-supabase-lint.md

@@ -0,0 +1,7 @@
+---
+"@ingram-tech/nk-dev": patch
+---
+
+Remove the `@supabase/supabase-js` `no-restricted-imports` rule from the tier-b
+oxlint config — the fleet no longer uses supabase-js, so the guardrail is moot.
+The `pg` `Pool`/`Client` restriction (use `createPool` from nk-db) is unchanged.

.changeset/nk-marketing-scrub-supabase.md

@@ -0,0 +1,8 @@
+---
+"@ingram-tech/nk-marketing": patch
+---
+
+Docs/comments only: drop the "successor to `@ingram-tech/newsletter` (which was
+Supabase-bound)" framing from the README and migration header, and remove the
+stale reference to nk-db's removed `configureTimestampsAsStrings` helper. No code
+change.

.github/workflows/ci.yml

@@ -17,15 +17,15 @@ jobs:
       - name: Lint & format check
         run: bun run check
       # Build before type-check: packages whose deps resolve to built workspace
-      # types (e.g. newsletter → email's dist/*.d.ts) need dist to exist first.
-      # check runs first on the clean tree, so oxlint never sees dist/.
+      # types (e.g. nk-marketing → nk-email's dist/*.d.ts) need dist to exist
+      # first. check runs first on the clean tree, so oxlint never sees dist/.
       - name: Build
         run: bun run build
       # Catches malformed exports / types / files fields before they ship — the
       # class of packaging bug that only surfaces on `npm install` in a real app.
       - name: Check package publishing (publint)
         run: |
-          for dir in packages/email packages/bot-protection packages/newsletter; do
+          for dir in packages/nk-email packages/bot-protection; do
             bunx publint "$dir"
           done
       - name: Type-check

README.md

@@ -30,7 +30,6 @@ Read **[docs/philosophy.md](./docs/philosophy.md)** for the full reasoning.
 | [`@ingram-tech/nk-api`](./packages/nk-api) | Typed API toolkit: Hono + zod-openapi router, auth/scope guards, cursor pagination, and a typed client — mounts into a Next.js route |
 | [`@ingram-tech/nk-i18n`](./packages/nk-i18n) | Lightweight i18n: `intl-messageformat` formatting, Accept-Language negotiation, and React client helpers |
 | [`@ingram-tech/nk-marketing`](./packages/nk-marketing) | Postgres-backed marketing & lifecycle email: contacts + consent, newsletter audiences (broadcast), and idempotent triggered campaigns, with RFC 8058 one-click unsubscribe |
-| [`@ingram-tech/newsletter`](./packages/newsletter) | **Deprecated** → `nk-marketing`. Supabase-backed newsletter subscriptions + sending |
 
 More to come (blog). See [docs/](./docs/README.md).
 

bun.lock

@@ -17,12 +17,7 @@ with the philosophy, then dip into specifics as needed.
 - **[db-package.md](./db-package.md)** — the `@ingram-tech/nk-db` plan: the shared
   Postgres pool, Drizzle, and the PGlite dev/test harness (`nk dev`).
 - **[marketing.md](./marketing.md)** — `@ingram-tech/nk-marketing`: contacts +
-  consent, newsletter broadcasts, and idempotent lifecycle/triggered email; the
-  Postgres successor to `@ingram-tech/newsletter`.
-- **[better-auth-migration.md](./better-auth-migration.md)** — moving the fleet
-  from Supabase Auth to Better Auth. The RLS-bridge path here now applies to the
-  remaining Supabase-Postgres holdouts; migrated apps went to DO Postgres
-  outright.
+  consent, newsletter broadcasts, and idempotent lifecycle/triggered email.
 - **[creating-a-package.md](./creating-a-package.md)** — checklist for new
   packages.
 - **[releasing.md](./releasing.md)** — versioning + npm Trusted Publishing flow.

docs/README.md

@@ -35,8 +35,8 @@ nextkit/
   and the `nk` CLI (`bin` + `lib`). No build step. `nk init` scaffolds a site.
   See [`philosophy.md`](./philosophy.md) for why dev-time config is one bundle
   while runtime stays vertical slices.
-- **Runtime packages** (`email`, `nk-db`, `nk-auth`, `nk-billing`, `nk-api`,
-  `nk-i18n`, `bot-protection`, `newsletter`): ship compiled JS + `.d.ts` from
+- **Runtime packages** (`nk-email`, `nk-db`, `nk-auth`, `nk-billing`, `nk-api`,
+  `nk-i18n`, `bot-protection`, `nk-marketing`): ship compiled JS + `.d.ts` from
   `src/`, built with `tsc`. These stay separate and peer-depend on
   `next`/`react`.
 
@@ -75,7 +75,7 @@ feel it first.
   tags (`changeset tag`).
 - **Publishing does not use `changeset publish`.** It shells out to `npm
   publish`, which can't resolve bun's `workspace:` protocol, so a package with a
-  *runtime* workspace dep (e.g. newsletter → nk-email) would ship an
+  *runtime* workspace dep (e.g. nk-marketing → nk-email) would ship an
   uninstallable `workspace:^` range. `scripts/publish.ts` resolves those ranges
   from each package's `package.json` version — the source of truth, immune to a
   stale `bun.lock` — and refuses to publish anything still carrying a