refactor: deduplicate helpers between setup.js and pds.js

- setup.js now imports shared helpers from pds.js instead of duplicating them
- Export cborEncodeDagCbor from pds.js for proper DAG-CBOR encoding
- Add docker-compose.yml for local PLC directory testing
- Reduces setup.js from 558 to 362 lines

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

docker-compose.yml

···
+services:
+  plc:
+    build:
+      context: https://github.com/did-method-plc/did-method-plc.git
+      dockerfile: packages/server/Dockerfile
+    ports:
+      - "2582:2582"
+    environment:
+      - DATABASE_URL=postgres://plc:plc@postgres:5432/plc
+      - PORT=2582
+    command: ["dumb-init", "node", "--enable-source-maps", "../dist/bin.js"]
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_USER=plc
+      - POSTGRES_PASSWORD=plc
+      - POSTGRES_DB=plc
+    volumes:
+      - plc_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U plc"]
+      interval: 2s
+      timeout: 5s
+      retries: 10
+
+volumes:
+  plc_data:

scripts/setup.js

···
  * PDS Setup Script
  *
  * Registers a did:plc, initializes the PDS, and notifies the relay.
- * Zero dependencies - uses Node.js built-ins only.
  *
  * Usage: node scripts/setup.js --handle alice --pds https://your-pds.workers.dev
  */
 
-import { webcrypto } from 'node:crypto';
 import { writeFileSync } from 'node:fs';
+import {
+  base32Encode,
+  base64UrlEncode,
+  bytesToHex,
+  cborEncodeDagCbor,
+  generateKeyPair,
+  importPrivateKey,
+  sign,
+} from '../src/pds.js';
 
 // === ARGUMENT PARSING ===
 
···
   return opts;
 }
 
-// === KEY GENERATION ===
-
-async function generateP256Keypair() {
-  const keyPair = await webcrypto.subtle.generateKey(
-    { name: 'ECDSA', namedCurve: 'P-256' },
-    true,
-    ['sign', 'verify'],
-  );
-
-  // Export private key as raw 32 bytes
-  const privateJwk = await webcrypto.subtle.exportKey(
-    'jwk',
-    keyPair.privateKey,
-  );
-  const privateBytes = base64UrlDecode(privateJwk.d);
-
-  // Export public key as uncompressed point (65 bytes)
-  const publicRaw = await webcrypto.subtle.exportKey('raw', keyPair.publicKey);
-  const publicBytes = new Uint8Array(publicRaw);
-
-  // Compress public key to 33 bytes
-  const compressedPublic = compressPublicKey(publicBytes);
-
-  return {
-    privateKey: privateBytes,
-    publicKey: compressedPublic,
-    cryptoKey: keyPair.privateKey,
-  };
-}
-
-function compressPublicKey(uncompressed) {
-  // uncompressed is 65 bytes: 0x04 + x(32) + y(32)
-  const x = uncompressed.slice(1, 33);
-  const y = uncompressed.slice(33, 65);
-  const prefix = (y[31] & 1) === 0 ? 0x02 : 0x03;
-  const compressed = new Uint8Array(33);
-  compressed[0] = prefix;
-  compressed.set(x, 1);
-  return compressed;
-}
-
-function base64UrlDecode(str) {
-  const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
-
-function bytesToHex(bytes) {
-  return Array.from(bytes)
-    .map((b) => b.toString(16).padStart(2, '0'))
-    .join('');
-}
 
 // === DID:KEY ENCODING ===
 
···
   return result;
 }
 
-// === CBOR ENCODING (dag-cbor compliant for PLC operations) ===
-
-function cborEncodeKey(key) {
-  // Encode a string key to CBOR bytes (for sorting)
-  const bytes = new TextEncoder().encode(key);
-  const parts = [];
-  const mt = 3 << 5; // major type 3 = text string
-  if (bytes.length < 24) {
-    parts.push(mt | bytes.length);
-  } else if (bytes.length < 256) {
-    parts.push(mt | 24, bytes.length);
-  } else if (bytes.length < 65536) {
-    parts.push(mt | 25, bytes.length >> 8, bytes.length & 0xff);
-  }
-  parts.push(...bytes);
-  return new Uint8Array(parts);
-}
-
-function compareBytes(a, b) {
-  // dag-cbor: bytewise lexicographic order of encoded keys
-  const minLen = Math.min(a.length, b.length);
-  for (let i = 0; i < minLen; i++) {
-    if (a[i] !== b[i]) return a[i] - b[i];
-  }
-  return a.length - b.length;
-}
-
-function cborEncode(value) {
-  const parts = [];
-
-  function encode(val) {
-    if (val === null) {
-      parts.push(0xf6);
-    } else if (typeof val === 'string') {
-      const bytes = new TextEncoder().encode(val);
-      encodeHead(3, bytes.length);
-      parts.push(...bytes);
-    } else if (typeof val === 'number') {
-      if (Number.isInteger(val) && val >= 0) {
-        encodeHead(0, val);
-      }
-    } else if (val instanceof Uint8Array) {
-      encodeHead(2, val.length);
-      parts.push(...val);
-    } else if (Array.isArray(val)) {
-      encodeHead(4, val.length);
-      for (const item of val) encode(item);
-    } else if (typeof val === 'object') {
-      // dag-cbor: sort keys by their CBOR-encoded bytes (length first, then lexicographic)
-      const keys = Object.keys(val);
-      const keysSorted = keys.sort((a, b) =>
-        compareBytes(cborEncodeKey(a), cborEncodeKey(b)),
-      );
-      encodeHead(5, keysSorted.length);
-      for (const key of keysSorted) {
-        encode(key);
-        encode(val[key]);
-      }
-    }
-  }
-
-  function encodeHead(majorType, length) {
-    const mt = majorType << 5;
-    if (length < 24) {
-      parts.push(mt | length);
-    } else if (length < 256) {
-      parts.push(mt | 24, length);
-    } else if (length < 65536) {
-      parts.push(mt | 25, length >> 8, length & 0xff);
-    }
-  }
-
-  encode(value);
-  return new Uint8Array(parts);
-}
-
 // === HASHING ===
 
 async function sha256(data) {
-  const hash = await webcrypto.subtle.digest('SHA-256', data);
+  const hash = await crypto.subtle.digest('SHA-256', data);
   return new Uint8Array(hash);
 }
 
 // === PLC OPERATIONS ===
 
-async function signPlcOperation(operation, privateKey) {
+async function signPlcOperation(operation, cryptoKey) {
   // Encode operation without sig field
   const { sig, ...opWithoutSig } = operation;
-  const encoded = cborEncode(opWithoutSig);
-
-  // Sign with P-256
-  const signature = await webcrypto.subtle.sign(
-    { name: 'ECDSA', hash: 'SHA-256' },
-    privateKey,
-    encoded,
-  );
-
-  // Convert to low-S form and base64url encode
-  const sigBytes = ensureLowS(new Uint8Array(signature));
-  return base64UrlEncode(sigBytes);
-}
-
-function ensureLowS(sig) {
-  // P-256 order N
-  const N = BigInt(
-    '0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551',
-  );
-  const halfN = N / 2n;
-
-  const r = sig.slice(0, 32);
-  const s = sig.slice(32, 64);
-
-  // Convert s to BigInt
-  let sInt = BigInt(`0x${bytesToHex(s)}`);
-
-  // If s > N/2, replace with N - s
-  if (sInt > halfN) {
-    sInt = N - sInt;
-    const newS = hexToBytes(sInt.toString(16).padStart(64, '0'));
-    const result = new Uint8Array(64);
-    result.set(r);
-    result.set(newS, 32);
-    return result;
-  }
+  const encoded = cborEncodeDagCbor(opWithoutSig);
 
-  return sig;
-}
-
-function hexToBytes(hex) {
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < hex.length; i += 2) {
-    bytes[i / 2] = parseInt(hex.substr(i, 2), 16);
-  }
-  return bytes;
-}
-
-function base64UrlEncode(bytes) {
-  const binary = String.fromCharCode(...bytes);
-  return btoa(binary)
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/, '');
+  // Sign with P-256 (sign() handles low-S normalization)
+  const signature = await sign(cryptoKey, encoded);
+  return base64UrlEncode(signature);
 }
 
 async function createGenesisOperation(opts) {
···
 
 async function deriveDidFromOperation(operation) {
   // DID is computed from the FULL operation INCLUDING the signature
-  const encoded = cborEncode(operation);
+  const encoded = cborEncodeDagCbor(operation);
   const hash = await sha256(encoded);
   // DID is base32 of first 15 bytes of hash (= 24 base32 chars)
   return `did:plc:${base32Encode(hash.slice(0, 15))}`;
-}
-
-function base32Encode(bytes) {
-  const alphabet = 'abcdefghijklmnopqrstuvwxyz234567';
-  let result = '';
-  let bits = 0;
-  let value = 0;
-
-  for (const byte of bytes) {
-    value = (value << 8) | byte;
-    bits += 8;
-    while (bits >= 5) {
-      bits -= 5;
-      result += alphabet[(value >> bits) & 31];
-    }
-  }
-
-  if (bits > 0) {
-    result += alphabet[(value << (5 - bits)) & 31];
-  }
-
-  return result;
 }
 
 // === PLC DIRECTORY REGISTRATION ===
···
 
   // Step 1: Generate keypair
   console.log('Generating P-256 keypair...');
-  const keyPair = await generateP256Keypair();
+  const keyPair = await generateKeyPair();
+  const cryptoKey = await importPrivateKey(keyPair.privateKey);
   const didKey = publicKeyToDidKey(keyPair.publicKey);
   console.log(`  did:key: ${didKey}`);
   console.log('');
···
     didKey,
     handle: opts.handle,
     pdsUrl: opts.pds,
-    cryptoKey: keyPair.cryptoKey,
+    cryptoKey,
   });
   const did = await deriveDidFromOperation(operation);
   console.log(`  DID: ${did}`);

src/pds.js

···
  * @param {*} value
  * @returns {Uint8Array}
  */
-function cborEncodeDagCbor(value) {
+export function cborEncodeDagCbor(value) {
   /** @type {number[]} */
   const parts = [];