docs(v2): port comparisons (FHE/KMS/HSM/Vault) into /concepts/compare

[coderdan]

Ports and refreshes the comparison section under /concepts/compare, against the current v2 branch.

Pages

• CipherStash vs AWS KMS
• CipherStash vs HashiCorp Vault
• ZeroKMS vs hardware security modules
• CipherStash vs homomorphic encryption

The Comparisons item is a menu-only folder in the sidebar; the four comparisons are its children.

Updates from the original draft

• rewrites the Vault comparison for the current plural datakeys batch endpoint, removing the obsolete claim that envelope-mode data-key generation cannot be batched
• removes unverified AWS KMS latency, throughput, pricing-plan, and product claims while retaining the architectural comparison
• aligns the FHE page with EQL v3 capabilities and the current published EQL benchmark page
• keeps the public TFHE/ORE primitive benchmark, with an explicit microbenchmark caveat
• replaces the unfinished HSM draft and all of its TODOs with a scoped custody, operations, and complementary-deployment comparison
• updates internal links, terminology, and navigation for the current V2 IA

Validation

• bun run types:check
• bun run lint
• content, Mermaid, link, and redirect validators
• Next.js production build

Supersedes the older comparison drafts from #31 and #34.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
public-docs	Ready	Preview	Jul 30, 2026 3:36pm

[coderdan]

Pushed abc761d to this branch.

The aws-kms.mdx identity example was ported before #57 landed on main, so it carried two problems:

const lockContext = await new LockContext().identify(userJwt);   // deprecated
await client.encrypt(...).withLockContext(lockContext);          // Result, not LockContext

identify() is deprecated (per-operation CTS tokens were removed in protect-ffi 0.25 — it compiles, warns, and no longer affects encryption). And identify() returns Result<LockContext, EncryptionError>, so passing it straight to .withLockContext() skips the .data unwrap.

Merging as-is would have reintroduced into the v2 tree exactly what #57 removed from main. The snippet now matches: OidcFederationStrategy via config.authStrategy, then .withLockContext({ identityClaim: ["sub"] }).

aws-kms.mdx was the only comparison page with TypeScript examples; fhe, zerokms-vs-hsm, and hashicorp-vault are prose and SQL only. Build passes, 664 pages.

Heads up that this branch is 33 commits behind v2 — worth a rebase before merge.

[coderdan]

Reviewed against shipped Stack 1.0-rc.0 / EQL 3.0. No changes needed for correctness — the pages already match what shipped:

• fhe.mdx — the fast-path claim "~0.12 ms exact match and order-preserving range" is correct (_ord is the OPE default in 3.0). The FHE-vs-ORE primitive numbers (~755 ns, ~200,000×, 5–6 orders of magnitude) are unaffected by the OPE default flip, since they measure the ORE primitive itself, which still ships as _ord_ore.
• aws-kms.mdx — the SDK examples import @cipherstash/stack and @cipherstash/stack/schema with the fluent builder (encryptedColumn().freeTextSearch().equality().orderAndRange()). All of that still ships in 1.0-rc.0 (./schema export present; the three fluent methods present), so no import breakage. No deprecated identity API.
• hashicorp-vault.mdx / zerokms-vs-hsm.mdx — conceptual, no SDK imports, no version-specific claims.

Two optional (non-blocking) items, your call:

1. aws-kms.mdx demonstrates the v2 fluent schema builder, while the integration pages now lead with the v3 concrete-type style (types.TextEq(...)). Both ship, but it reads as inconsistent. Want it modernized to v3?
2. There's an unresolved {/* TODO */} on aws-kms.mdx asking to replace the ~16×/~85× KMS figures with a public-facing citation (currently sourced from cipherstash/benches kms-app/REPORT.md). I left it rather than fabricate a citation.