docs: retire the docsify site, now built by brazilian-utils/docs

.bestpractices.json

@@ -18,7 +18,7 @@
 	"osps_br_07_01_status": "Met",
 	"osps_br_07_01_justification": "GitHub secret scanning with push protection is enabled, TruffleHog scans every pull request (https://github.com/brazilian-utils/javascript/blob/main/.github/workflows/security.yml) and .env files are git-ignored.",
 	"osps_do_01_01_status": "Met",
-	"osps_do_01_01_justification": "https://brazilian-utils.com.br/getting-started and https://brazilian-utils.com.br/utilities document every utility, in English and Portuguese.",
+	"osps_do_01_01_justification": "https://brazilian-utils.com.br/libs/javascript/ and the utility pages it links to (https://brazilian-utils.com.br/utils/cpf/, ...) document every utility, in English and Portuguese; the sources are docs/utilities.md and docs/pt-br/utilities.md.",
 	"osps_do_02_01_status": "Met",
 	"osps_do_02_01_justification": "https://github.com/brazilian-utils/javascript/blob/main/SUPPORT.md and the bug report issue template: https://github.com/brazilian-utils/javascript/issues/new/choose",
 	"osps_gv_02_01_status": "Met",
@@ -44,7 +44,7 @@
 	"osps_qa_05_01_status": "Met",
 	"osps_qa_05_01_justification": "Build output (dist) is git-ignored; nothing generated and executable is committed.",
 	"osps_qa_05_02_status": "Met",
-	"osps_qa_05_02_justification": "The only binary files are two small PNG images of the docs site (docs/images), reviewable as images.",
+	"osps_qa_05_02_justification": "The repository has no binary files: everything committed is text, reviewable in a diff.",
 	"osps_vm_02_01_status": "Met",
 	"osps_vm_02_01_justification": "https://github.com/brazilian-utils/javascript/blob/main/SECURITY.md#reporting-a-vulnerability",
 	"osps_ac_04_01_status": "Met",
@@ -76,7 +76,7 @@
 	"osps_sa_01_01_status": "Met",
 	"osps_sa_01_01_justification": "https://github.com/brazilian-utils/javascript/blob/main/CONTRIBUTING.md#architecture",
 	"osps_sa_02_01_status": "Met",
-	"osps_sa_02_01_justification": "The public API is documented at https://brazilian-utils.com.br/utilities and checked on every pull request against the last npm release, which fails on a breaking change and lists every added, removed and changed declaration: https://github.com/brazilian-utils/javascript/blob/main/CONTRIBUTING.md#public-api-validation",
+	"osps_sa_02_01_justification": "The public API is documented at https://brazilian-utils.com.br/libs/javascript/ and checked on every pull request against the last npm release, which fails on a breaking change and lists every added, removed and changed declaration: https://github.com/brazilian-utils/javascript/blob/main/CONTRIBUTING.md#public-api-validation",
 	"osps_sa_03_01_status": "Met",
 	"osps_sa_03_01_justification": "https://github.com/brazilian-utils/javascript/blob/main/SECURITY.md#threat-model",
 	"osps_vm_01_01_status": "Met",
@@ -142,9 +142,9 @@
 	"license_location_status": "Met",
 	"license_location_justification": "https://github.com/brazilian-utils/javascript/blob/main/LICENSE",
 	"documentation_basics_status": "Met",
-	"documentation_basics_justification": "https://brazilian-utils.com.br/getting-started",
+	"documentation_basics_justification": "https://brazilian-utils.com.br/libs/javascript/",
 	"documentation_interface_status": "Met",
-	"documentation_interface_justification": "https://brazilian-utils.com.br/utilities documents every exported function; API Extractor fails CI on an undocumented export: https://github.com/brazilian-utils/javascript/blob/main/CONTRIBUTING.md#public-api-validation",
+	"documentation_interface_justification": "https://brazilian-utils.com.br/libs/javascript/ documents every exported function; API Extractor fails CI on an undocumented export: https://github.com/brazilian-utils/javascript/blob/main/CONTRIBUTING.md#public-api-validation",
 	"sites_https_status": "Met",
 	"sites_https_justification": "The site, the repository and the npm package are HTTPS only.",
 	"discussion_status": "Met",
@@ -280,9 +280,9 @@
 	"documentation_security_status": "Met",
 	"documentation_security_justification": "https://github.com/brazilian-utils/javascript/blob/main/SECURITY.md#whats-in-scope and https://github.com/brazilian-utils/javascript/blob/main/SECURITY.md#threat-model",
 	"documentation_quick_start_status": "Met",
-	"documentation_quick_start_justification": "https://brazilian-utils.com.br/getting-started",
+	"documentation_quick_start_justification": "https://brazilian-utils.com.br/libs/javascript/",
 	"documentation_current_status": "Met",
-	"documentation_current_justification": "The docs are checked in CI: the Check workflow runs the llms.txt generator over them on every run, so a missing docs file fails it, jsr.json fails it when stale, an undocumented export fails the public API check, and a pull request that changes a utility must update both language versions.",
+	"documentation_current_justification": "The docs are checked in CI: the Check workflow generates the examples of the guides from their templates on every run, so a broken template fails it, jsr.json fails it when stale, an undocumented export fails the public API check, and a pull request that changes a utility must update both language versions.",
 	"documentation_achievements_status": "Met",
 	"documentation_achievements_justification": "The README links the OpenSSF Best Practices and Scorecard badges: https://github.com/brazilian-utils/javascript#readme",
 	"accessibility_best_practices_status": "Unmet",
@@ -292,7 +292,7 @@
 	"sites_password_security_status": "N/A",
 	"sites_password_security_justification": "The project sites store no passwords; authentication is GitHub's and npm's.",
 	"maintenance_or_update_status": "Met",
-	"maintenance_or_update_justification": "1.x names are kept as deprecated aliases in 2.x and the upgrade is documented: https://brazilian-utils.com.br/migration-v1-to-v2",
+	"maintenance_or_update_justification": "1.x names are kept as deprecated aliases in 2.x and the upgrade is documented: https://brazilian-utils.com.br/guides/javascript/migration-v1-to-v2/",
 	"vulnerability_report_credit_status": "N/A",
 	"vulnerability_report_credit_justification": "No vulnerability was resolved in the last 12 months; SECURITY.md commits to crediting reporters.",
 	"vulnerability_response_process_status": "Met",
@@ -374,7 +374,7 @@
 	"test_branch_coverage80_status": "Met",
 	"test_branch_coverage80_justification": "100% branch coverage, enforced in CI.",
 	"hardened_site_status": "Unmet",
-	"hardened_site_justification": "The documentation site is served by GitHub Pages, which does not let a project set Content-Security-Policy, HSTS or X-Content-Type-Options headers.",
+	"hardened_site_justification": "The documentation site, https://brazilian-utils.com.br, is built from https://github.com/brazilian-utils/docs and served by Cloudflare Pages; it sends X-Content-Type-Options: nosniff, but no Content-Security-Policy or HSTS header yet.",
 	"security_review_status": "Met",
 	"security_review_justification": "The maintainers reviewed the security requirements and boundaries in September 2026 and recorded the result as the threat model and policies in https://github.com/brazilian-utils/javascript/blob/main/SECURITY.md",
 	"code_review_standards_status": "Met",

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,7 +10,6 @@
   - [ ] `docs/utilities.md` (English)
   - [ ] `docs/pt-br/utilities.md` (Portuguese)
 - [ ] `npm run check` passes locally (format, lint, types).
-- [ ] I ran `npm run build:llms` if I touched `docs/utilities.md` (the Check workflow fails when `docs/llms.txt` is stale).
 - [ ] This change does not introduce a breaking change, **or** I flagged it clearly below and it was discussed with maintainers beforehand.
 - [ ] This change does not add any runtime dependency (this library is zero-runtime-dependency by design).
 

.github/workflows/check.yml

@@ -53,16 +53,13 @@ jobs:
       - name: Validate the public API
         run: npm run check:api
 
-      - name: Check llms.txt/llms-full.txt build from the docs
-        run: npm run build:llms
-
       - name: Check the JSR exports are up to date
         run: npm run build:jsr && git diff --exit-code -- jsr.json
 
-      - name: Build the documentation site
-        # The site is generated at deploy time (the Docs workflow), so nothing here can be stale;
-        # this only has to fail when a generator does.
-        run: npm run build:docs
+      - name: Generate the examples of the guides
+        # The docs site (brazilian-utils/docs) runs this before it reads `docs/`; the generated files
+        # are not committed, so this only has to fail when the generator does.
+        run: npm run build:examples
 
       - name: Check the VEX statements against the suppressed advisories
         run: npm run check:vex

.github/zizmor.yml

@@ -7,7 +7,6 @@ rules:
     ignore:
       - build.yml
       - check.yml
-      - docs.yml
       - datasets.yml
       - live-tests.yml
       - mutation.yml

.gitignore

@@ -18,16 +18,8 @@ reports
 # the one that pins this project's dependencies.
 deno.lock
 
-# The documentation site is generated by `npm run build:docs` and published by the Docs workflow:
-# only what a person writes is kept here.
-docs/*.html
-!docs/index.html
-docs/pt-br/*.html
-docs/guides/*.html
-docs/pt-br/guides/*.html
-docs/sitemap.xml
-docs/llms.txt
-docs/llms-full.txt
+# The examples the guides show are generated from templates by `npm run build:examples` (the docs
+# site, brazilian-utils/docs, runs it before reading `docs/`): only what a person writes is kept here.
 docs/snippets/document-field/generated/
 docs/snippets/address-form/*/cep-field.*
 docs/snippets/address-form/*/field.*