Add read-only NPM certificate discovery

dns_sync/certificates/normalizer.py

@@ -0,0 +1,47 @@
+from datetime import datetime, timezone
+
+from ..normalizer import normalize_hostname
+from .models import CertificateIdentity
+
+
+def normalize_certificate_domains(values) -> CertificateIdentity:
+    domains: set[str] = set()
+
+    for raw in values or []:
+        hostname, _ = normalize_hostname(
+            str(raw),
+            allow_wildcard=True,
+        )
+        domains.add(hostname)
+
+    if not domains:
+        raise RuntimeError(
+            "Certificate has no usable domain names"
+        )
+
+    return CertificateIdentity(
+        domains=tuple(sorted(domains))
+    )
+
+
+def parse_npm_datetime(value) -> datetime | None:
+    if not value:
+        return None
+
+    raw = str(value).strip()
+
+    # NPM normally emits ISO timestamps ending in Z.
+    if raw.endswith("Z"):
+        raw = raw[:-1] + "+00:00"
+
+    try:
+        result = datetime.fromisoformat(raw)
+    except ValueError as exc:
+        raise RuntimeError(
+            f"Invalid NPM certificate timestamp: {value!r}"
+        ) from exc
+
+    if result.tzinfo is None:
+        result = result.replace(tzinfo=timezone.utc)
+
+    return result.astimezone(timezone.utc)