DEV Community: eimza

Building a PKI Certificate Expiry Monitor for Turkish E-Signature Tokens

eimza — Tue, 22 Sep 2026 15:52:37 +0000

Turkish e-signature certificates (NES — Nitelikli Elektronik Sertifika) expire after 1-3 years. When they do, your company can't sign e-invoices, e-ledgers, or court filings. Here's how to build a monitoring system.

The Problem

Monday morning, 09:01 AM:
"Mali Mühür sertifikası süresi dolmuş, e-fatura kesemiyoruz!"

Revenue lost: ₺0 (but compliance violated)
Penalty risk: ₺100,000+ (GİB cezası)
Reputation: Damaged (client invoices delayed)

Certificate Structure

Turkish e-signature certificates follow X.509v3:

Certificate:
    Version: 3
    Serial Number: 4a:2b:3c:...
    Issuer: C=TR, O=Kamu SM, CN=Kamu SM NES
    Validity:
        Not Before: Sep 22 00:00:00 2025 GMT
        Not After:  Sep 22 23:59:59 2026 GMT  ← This is what we monitor
    Subject: CN=ACME LTD ŞTİ, SERIALNUMBER=1234567890
    Subject Public Key Info:
        RSA 2048-bit
    X509v3 Extensions:
        Key Usage: Digital Signature, Non-Repudiation
        QCStatements: id-etsi-qcs-QcCompliance  ← Qualified certificate

JavaScript Certificate Parser

class CertificateMonitor {
    /**
     * Parse a PEM or DER certificate and extract expiry
     * For browser-based monitoring dashboards
     */
    static parsePEM(pemString) {
        // Extract base64 content between headers
        const b64 = pemString
            .replace(/-----BEGIN CERTIFICATE-----/, '')
            .replace(/-----END CERTIFICATE-----/, '')
            .replace(/\s/g, '');

        const binary = atob(b64);
        const bytes = new Uint8Array(binary.length);
        for (let i = 0; i < binary.length; i++) {
            bytes[i] = binary.charCodeAt(i);
        }

        return this.parseDER(bytes);
    }

    static parseDER(bytes) {
        // Simplified ASN.1 parser for X.509 validity dates
        // In production, use a library like pkijs or asn1js

        const hex = Array.from(bytes).map(b => 
            b.toString(16).padStart(2, '0')
        ).join('');

        // Find UTCTime or GeneralizedTime for notAfter
        // UTCTime tag: 0x17, GeneralizedTime tag: 0x18
        const utcTimePattern = /17(\w{2})(\w+)/g;
        const times = [];
        let match;

        while ((match = utcTimePattern.exec(hex)) !== null) {
            const len = parseInt(match[1], 16);
            const timeHex = match[2].substring(0, len * 2);
            const timeStr = this.hexToAscii(timeHex);
            times.push(this.parseUTCTime(timeStr));
        }

        // Second UTCTime is notAfter
        return {
            notBefore: times[0] || null,
            notAfter: times[1] || null,
            daysRemaining: times[1] ? 
                Math.ceil((times[1] - new Date()) / 86400000) : null
        };
    }

    static hexToAscii(hex) {
        let str = '';
        for (let i = 0; i < hex.length; i += 2) {
            str += String.fromCharCode(parseInt(hex.substr(i, 2), 16));
        }
        return str;
    }

    static parseUTCTime(str) {
        // Format: YYMMDDHHMMSSZ
        const year = parseInt(str.substr(0, 2));
        const fullYear = year >= 50 ? 1900 + year : 2000 + year;
        return new Date(
            fullYear,
            parseInt(str.substr(2, 2)) - 1,
            parseInt(str.substr(4, 2)),
            parseInt(str.substr(6, 2)),
            parseInt(str.substr(8, 2)),
            parseInt(str.substr(10, 2))
        );
    }
}

// Alert thresholds
function checkCertificates(certs) {
    const alerts = [];
    for (const cert of certs) {
        const days = cert.daysRemaining;
        if (days <= 0) {
            alerts.push({ level: 'CRITICAL', message: `EXPIRED ${Math.abs(days)} days ago`, cert });
        } else if (days <= 7) {
            alerts.push({ level: 'CRITICAL', message: `Expires in ${days} days`, cert });
        } else if (days <= 30) {
            alerts.push({ level: 'WARNING', message: `Expires in ${days} days`, cert });
        } else if (days <= 90) {
            alerts.push({ level: 'INFO', message: `Expires in ${days} days`, cert });
        }
    }
    return alerts;
}

Monitoring Dashboard Architecture

┌──────────────────────────────────────────┐
│           Certificate Monitor            │
│                                          │
│  ┌────────┐  ┌────────┐  ┌────────┐     │
│  │Mali    │  │E-İmza  │  │SSL/TLS │     │
│  │Mühür   │  │NES     │  │Server  │     │
│  │45 gün  │  │120 gün │  │230 gün │     │
│  │ ⚠️     │  │  ✅    │  │  ✅    │     │
│  └────────┘  └────────┘  └────────┘     │
│                                          │
│  Alert Rules:                            │
│  • 90 days → Email to IT                 │
│  • 30 days → Email to CEO + IT           │
│  • 7 days  → SMS + Slack + Email         │
│  • 0 days  → 🚨 EMERGENCY               │
└──────────────────────────────────────────┘

Our Open-Source Solution

We built mali-muhur-eimza-suresi-kontrol — a Windows tool that scans all connected USB tokens and reports certificate expiry dates.

All tools: github.com/eimza-kep

The 8-Day Invoice Objection Rule: Automating Turkish Commercial Law Deadlines

eimza — Tue, 22 Sep 2026 15:47:20 +0000

In Turkish commercial law (TTK Madde 21/2), when a merchant receives an invoice, they have 8 days to formally object. If they don't, the invoice is deemed accepted. This creates a critical automation opportunity.

The Legal Framework

TTK Madde 21/2:
"Bir fatura alan kişi, aldığı tarihten itibaren 
sekiz gün içinde, faturanın içeriği hakkında bir 
itirazda bulunmamışsa, bu içeriği kabul etmiş sayılır."

Translation: If a person who receives an invoice does not object to its content within 8 days from the date of receipt, they are deemed to have accepted its content.

Why This Matters

Missing the 8-day window means:

You've legally accepted the invoice amount
You can't dispute pricing errors later
In court, the invoice becomes conclusive evidence against you
Tax implications are locked in

Building a Deadline Tracker

class InvoiceDeadlineTracker {
    constructor() {
        this.invoices = [];
    }

    addInvoice(invoiceId, receivedDate, amount, supplier) {
        const received = new Date(receivedDate);
        const deadline = new Date(received);
        deadline.setDate(deadline.getDate() + 8);

        // Skip weekends? Turkish law counts calendar days
        // but if day 8 falls on a holiday, it extends to next business day
        deadline = this.adjustForHolidays(deadline);

        this.invoices.push({
            id: invoiceId,
            received,
            deadline,
            amount,
            supplier,
            status: 'pending', // pending | objected | accepted
            daysRemaining: this.calcDaysRemaining(deadline)
        });
    }

    calcDaysRemaining(deadline) {
        const now = new Date();
        const diff = deadline.getTime() - now.getTime();
        return Math.ceil(diff / (1000 * 60 * 60 * 24));
    }

    adjustForHolidays(date) {
        // Turkish official holidays
        const holidays2026 = [
            '2026-01-01', // New Year
            '2026-04-23', // National Sovereignty
            '2026-05-01', // Labour Day
            '2026-05-19', // Commemoration of Atatürk
            '2026-07-15', // Democracy Day
            '2026-08-30', // Victory Day
            '2026-10-28', // Republic Day Eve
            '2026-10-29', // Republic Day
            // Ramadan and Eid dates change yearly
        ];

        const dateStr = date.toISOString().split('T')[0];
        while (holidays2026.includes(dateStr) || date.getDay() === 0) {
            date.setDate(date.getDate() + 1);
        }
        return date;
    }

    getUrgent(withinDays = 3) {
        return this.invoices
            .filter(inv => inv.status === 'pending' && inv.daysRemaining <= withinDays)
            .sort((a, b) => a.daysRemaining - b.daysRemaining);
    }

    objectToInvoice(invoiceId, objectionText) {
        const inv = this.invoices.find(i => i.id === invoiceId);
        if (!inv) throw new Error('Invoice not found');
        if (inv.daysRemaining < 0) {
            console.warn('⚠️ Objection period has expired!');
        }
        inv.status = 'objected';
        inv.objection = {
            text: objectionText,
            date: new Date(),
            // Should be sent via KEP for legal validity
            method: 'KEP recommended'
        };
        return inv;
    }
}

// Usage
const tracker = new InvoiceDeadlineTracker();
tracker.addInvoice('ABC2026000000042', '2026-09-22', 15000, 'Tedarikçi A.Ş.');

const urgent = tracker.getUrgent(3);
// [{ id: 'ABC2026000000042', daysRemaining: 6, ... }]

Notification Architecture

         Invoice Received
              │
              ▼
    ┌─────────────────┐
    │ Parse e-Fatura   │
    │ XML (UBL-TR)     │
    └────────┬────────┘
             │
    ┌────────▼────────┐
    │ Calculate 8-day  │
    │ deadline         │
    └────────┬────────┘
             │
    ┌────────▼────────┐     Day 1-5: Low priority
    │ Schedule alerts  │────▶ Day 6: ⚠️ Warning
    │                  │────▶ Day 7: 🔴 Urgent  
    │                  │────▶ Day 8: 🚨 Last day
    └────────┬────────┘
             │
    ┌────────▼────────┐
    │ If objecting:    │
    │ Send via KEP     │──▶ Creates legal evidence
    │ (not email!)     │
    └──────────────────┘

Integration with e-Fatura

Combine this with our e-Fatura XML Viewer to automatically parse incoming invoices and start the 8-day countdown.

Key Takeaway

The 8-day rule is one of the most commonly missed deadlines in Turkish commercial law. Automating it isn't just convenient — it's essential risk management.

All our open-source tools: github.com/eimza-kep

Implementing E-Invoice (e-Fatura) XML Validation in JavaScript: UBL-TR Deep Dive

eimza — Tue, 22 Sep 2026 15:47:14 +0000

Turkey's tax authority (GİB) requires all invoices above a certain threshold to be issued electronically in UBL-TR format — a localized version of Universal Business Language. Here's how to validate these XML documents client-side.

UBL-TR Structure

A Turkish e-Invoice XML follows this hierarchy:

<?xml version="1.0" encoding="UTF-8"?>
<Invoice xmlns="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2"
         xmlns:cac="urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2"
         xmlns:cbc="urn:oasis:names:specification:ubl:schema:xsd:CommonBasicComponents-2">

    <cbc:UBLVersionID>2.1</cbc:UBLVersionID>
    <cbc:CustomizationID>TR1.2</cbc:CustomizationID>
    <cbc:ProfileID>TICARIFATURA</cbc:ProfileID>

    <cbc:ID>ABC2026000000001</cbc:ID>
    <cbc:IssueDate>2026-09-22</cbc:IssueDate>
    <cbc:InvoiceTypeCode>SATIS</cbc:InvoiceTypeCode>
    <cbc:DocumentCurrencyCode>TRY</cbc:DocumentCurrencyCode>

    <!-- Digital Signature (XAdES) -->
    <cac:Signature>
        <cbc:ID>...</cbc:ID>
        <cac:SignatoryParty>...</cac:SignatoryParty>
        <cac:DigitalSignatureAttachment>
            <cac:ExternalReference>
                <cbc:URI>#Signature_ABC2026000000001</cbc:URI>
            </cac:ExternalReference>
        </cac:DigitalSignatureAttachment>
    </cac:Signature>

    <!-- Supplier (Satıcı) -->
    <cac:AccountingSupplierParty>
        <cac:Party>
            <cac:PartyIdentification>
                <cbc:ID schemeID="VKN">1234567890</cbc:ID>
            </cac:PartyIdentification>
        </cac:Party>
    </cac:AccountingSupplierParty>

    <!-- Line Items -->
    <cac:InvoiceLine>
        <cbc:ID>1</cbc:ID>
        <cbc:InvoicedQuantity unitCode="C62">10</cbc:InvoicedQuantity>
        <cbc:LineExtensionAmount currencyID="TRY">1000.00</cbc:LineExtensionAmount>
        <cac:TaxTotal>
            <cbc:TaxAmount currencyID="TRY">200.00</cbc:TaxAmount>
            <cac:TaxSubtotal>
                <cbc:TaxableAmount currencyID="TRY">1000.00</cbc:TaxableAmount>
                <cbc:TaxAmount currencyID="TRY">200.00</cbc:TaxAmount>
                <cac:TaxCategory>
                    <cac:TaxScheme>
                        <cbc:TaxTypeCode>0015</cbc:TaxTypeCode>
                        <cbc:Name>KDV</cbc:Name>
                    </cac:TaxScheme>
                </cac:TaxCategory>
            </cac:TaxSubtotal>
        </cac:TaxTotal>
    </cac:InvoiceLine>
</Invoice>

Client-Side Validation Engine

class EFaturaValidator {
    constructor(xmlString) {
        const parser = new DOMParser();
        this.doc = parser.parseFromString(xmlString, "text/xml");
        this.ns = {
            inv: "urn:oasis:names:specification:ubl:schema:xsd:Invoice-2",
            cbc: "urn:oasis:names:specification:ubl:schema:xsd:CommonBasicComponents-2",
            cac: "urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2"
        };
        this.errors = [];
    }

    xpath(expr, context = this.doc) {
        return this.doc.evaluate(expr, context, (prefix) => this.ns[prefix],
            XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue;
    }

    validate() {
        this.checkRequiredFields();
        this.checkVKN();
        this.checkTaxCalculations();
        this.checkInvoiceId();
        return { valid: this.errors.length === 0, errors: this.errors };
    }

    checkRequiredFields() {
        const required = [
            ["cbc:ID", "Fatura Numarası"],
            ["cbc:IssueDate", "Düzenleme Tarihi"],
            ["cbc:InvoiceTypeCode", "Fatura Tipi"],
            ["cbc:DocumentCurrencyCode", "Para Birimi"]
        ];
        for (const [path, label] of required) {
            if (!this.doc.querySelector(path)) {
                this.errors.push(`Zorunlu alan eksik: ${label} (${path})`);
            }
        }
    }

    checkVKN() {
        // Turkish tax number (VKN) must be exactly 10 digits
        const vknNode = this.doc.querySelector(
            'AccountingSupplierParty PartyIdentification ID[schemeID="VKN"]'
        );
        if (vknNode) {
            const vkn = vknNode.textContent.trim();
            if (!/^\d{10}$/.test(vkn)) {
                this.errors.push(`Geçersiz VKN: "${vkn}" (10 haneli olmalı)`);
            }
        }
    }

    checkTaxCalculations() {
        const lines = this.doc.querySelectorAll("InvoiceLine");
        for (const line of lines) {
            const lineId = line.querySelector("ID")?.textContent;
            const amount = parseFloat(
                line.querySelector("LineExtensionAmount")?.textContent || "0"
            );
            const taxAmount = parseFloat(
                line.querySelector("TaxTotal TaxAmount")?.textContent || "0"
            );
            const taxable = parseFloat(
                line.querySelector("TaxSubtotal TaxableAmount")?.textContent || "0"
            );

            if (Math.abs(amount - taxable) > 0.01) {
                this.errors.push(
                    `Satır ${lineId}: Matrah uyumsuzluğu (${amount} ≠ ${taxable})`
                );
            }
        }
    }

    checkInvoiceId() {
        // GİB format: 3 letters + year + 9 digits
        const id = this.doc.querySelector("ID")?.textContent?.trim();
        if (id && !/^[A-Z]{3}\d{13}$/.test(id)) {
            this.errors.push(
                `Fatura numarası GİB formatına uymuyor: "${id}" (ABC2026000000001 gibi olmalı)`
            );
        }
    }
}

// Usage
const validator = new EFaturaValidator(xmlContent);
const result = validator.validate();
console.log(result);
// { valid: false, errors: ["Geçersiz VKN: ..."] }

Tax Code Reference

Code	Tax Type	Rate
0015	KDV (VAT)	1%, 10%, 20%
0003	ÖTV (Special Consumption)	Varies
0021	Banka Muamele Vergisi	5%
0071	Damga Vergisi (Stamp)	0.948%
9015	KDV Tevkifatı (Withholding)	Varies

Try It Yourself

Our open-source e-Fatura XML Viewer parses and displays UBL-TR invoices entirely in the browser.

All tools: github.com/eimza-kep

UETS vs KEP: Understanding Turkey's Dual Electronic Notification System

eimza — Tue, 22 Sep 2026 15:41:57 +0000

Turkey has two separate but often confused electronic notification systems: KEP and UETS. If you're building software for the Turkish legal market, understanding the distinction is critical.

UETS: Ulusal Elektronik Tebligat Sistemi

UETS (National Electronic Notification System) is operated exclusively by PTT (Turkey's postal service) and is used only by courts and government agencies to serve legal notifications.

Who Gets UETS Notifications?

All lawyers registered with a bar association
All companies registered in the trade registry
All government agencies
Anyone who voluntarily registers

The Mandatory 5-Day Rule

// Tebligat Kanunu Madde 7/a implementation
function calculateServiceDate(deliveryDate) {
    const GRACE_PERIOD_DAYS = 5;
    const serviceDate = new Date(deliveryDate);
    serviceDate.setDate(serviceDate.getDate() + GRACE_PERIOD_DAYS);

    // If recipient opens before day 5, service date = open date
    // If not opened by day 5, service date = day 5
    return serviceDate;
}

function calculateDeadline(serviceDate, responseDays) {
    const deadline = new Date(serviceDate);
    deadline.setDate(deadline.getDate() + responseDays);
    return deadline;
}

// Example: Court gives 15 days to respond
const delivered = new Date('2026-09-15');
const served = calculateServiceDate(delivered); // Sept 20
const deadline = calculateDeadline(served, 15); // Oct 5

Key Technical Differences

Aspect	KEP	UETS
Operator	Multiple licensed providers	PTT only
Direction	Bidirectional (anyone → anyone)	One-way (government → citizen)
Protocol	SMTP/S with evidence layer	Custom PTT protocol
Authentication	E-Imza (qualified certificate)	TC Kimlik + SMS OTP
Evidence format	CAdES/XAdES signed XML	PTT proprietary
API availability	Some providers offer REST/SOAP	No public API
Address format	`user@hsXX.kep.tr`	TCKN-based (no email format)

Common Confusion Points

1. "My lawyer says I need a KEP address for court"

Wrong. Court notifications come via UETS, not KEP. But your lawyer might need KEP for sending ihtarname (formal notices) to opposing parties.

2. "Can I send a UETS notification?"

No. Only courts, tax offices, municipalities, and authorized government bodies can send via UETS. Private parties use KEP.

3. "Are KEP and UETS addresses the same?"

No. KEP address: firma@hs01.kep.tr. UETS address: derived from your TCKN (national ID) or tax number.

Architecture for LegalTech Developers

If you're building a case management system:

┌─────────────────┐
│  Case Management │
│     System       │
├─────────────────┤
│                 │
│  ┌───────────┐  │     ┌─────────────────┐
│  │ KEP Module│──┼────▶│ KEP Provider API│ (for sending notices)
│  └───────────┘  │     └─────────────────┘
│                 │
│  ┌───────────┐  │     ┌─────────────────┐
│  │UETS Reader│──┼────▶│ PTT e-Tebligat  │ (for receiving court docs)
│  └───────────┘  │     │ (screen scraping)│
│                 │     └─────────────────┘
│  ┌───────────┐  │
│  │ Deadline  │  │  ← Calculates response deadlines
│  │ Calculator│  │     from UETS service dates
│  └───────────┘  │
└─────────────────┘

Open Source Tools

We're building open-source tools for Turkey's e-transformation ecosystem:

Check out all projects: github.com/eimza-kep

Turkey's KEP System: How Registered Email Creates Legally Binding Digital Evidence

eimza — Tue, 22 Sep 2026 15:41:51 +0000

In Turkey, a regular email has zero legal standing in court. But a KEP (Kayıtlı Elektronik Posta — Registered Electronic Mail) message is as binding as a notarized document. Here's the technical architecture behind it.

What is KEP?

KEP is a government-regulated electronic mail system where every message generates 6 cryptographic evidence records:

Evidence Type	Turkish Name	When Generated
Submission	Gönderi Delili	Sender clicks "Send"
Acceptance	Kabul Delili	KEP server accepts the message
Dispatch	Sevk Delili	Message leaves sender's KEP provider
Delivery	Teslim Delili	Message arrives at recipient's inbox
Read	Okundu Delili	Recipient opens the message
Error	Hata Delili	Delivery fails

Each evidence record is digitally signed with the KEP provider's qualified certificate and timestamped with an RFC 3161 timestamp.

The 5-Day Rule

Under Turkish law (Tebligat Kanunu 7/a), if a KEP message is not opened within 5 days of delivery, it is legally deemed "served" (tebliğ edilmiş) on the 5th day. This is critical for:

Court notifications (UETS)
Tax assessments
Employment terminations
Contract cancellations

Day 0: Message delivered to KEP inbox (Teslim Delili generated)
Day 1-4: Recipient hasn't opened it
Day 5: Legally served — clock starts on response deadlines

KEP vs Regular Email vs UETS

Feature	Regular Email	KEP	UETS
Legal standing	None	Full (HMK 205)	Full (Teb. K. 7/a)
Evidence generation	No	Yes (6 types)	Yes
Who can send	Anyone	Licensed providers	Courts & gov only
Timestamp	No	RFC 3161 qualified	Yes
Storage obligation	None	20 years	10 years
Cost	Free	~₺200-500/year	Free for recipients

Technical Architecture

┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│   Sender's   │    │  KEP Provider │    │  Recipient's │
│   KEP Client │───▶│   (ESHS)     │───▶│  KEP Inbox   │
└──────┬───────┘    └──────┬───────┘    └──────────────┘
       │                   │
       │            ┌──────▼───────┐
       │            │  Timestamp   │
       │            │  Authority   │
       │            │  (RFC 3161)  │
       │            └──────┬───────┘
       │                   │
       ▼                   ▼
  ┌────────────────────────────┐
  │    Evidence Records (ASN.1) │
  │    Signed + Timestamped     │
  │    Stored for 20 years      │
  └────────────────────────────┘

The KEP provider (ESHS — Elektronik Sertifika Hizmet Sağlayıcısı) acts as a trusted third party, similar to how Certificate Authorities work in TLS.

Developer Integration

Some KEP providers offer SOAP/REST APIs for programmatic sending:

# Pseudocode for KEP API integration
import requests

kep_api = "https://api.kepservisi.com/v1/send"
payload = {
    "from": "firma@hs01.kep.tr",
    "to": "muhatap@hs02.kep.tr",
    "subject": "Fesih Bildirimi",
    "body": "İş akdiniz ... tarihinde feshedilmiştir.",
    "attachments": [{"name": "fesih.pdf", "base64": "..."}],
    "sign_with": "e-imza"  # Requires qualified certificate
}
response = requests.post(kep_api, json=payload, cert=("client.pem", "key.pem"))
# Returns: delivery_id, submission_evidence_url

Why This Matters for LegalTech

If you're building legal software for the Turkish market, KEP integration is not optional — it's mandatory for any application handling:

Employment contracts and terminations
Invoice disputes (8-day objection period)
KVKK (GDPR equivalent) data subject requests
Commercial lease notifications

📎 Our open-source tools: github.com/eimza-kep

Privacy-First Architecture: Building Web Tools That Never See Your Data

eimza — Mon, 21 Sep 2026 22:20:05 +0000

In Turkey, legal documents are protected under KVKK (the Turkish equivalent of GDPR). Uploading a court petition to a random web service isn't just risky — it could be illegal.

Here's the architecture pattern we use for building document processing tools that are physically incapable of leaking data.

The Core Principle

If data never leaves the browser, it can never be intercepted, stored, or breached.

This isn't just about promises in a privacy policy. It's about architectural guarantees.

Architecture Diagram

┌─────────────────────────────────────┐
│           User's Browser            │
│                                     │
│  ┌──────────┐    ┌───────────────┐  │
│  │ File API │───▶│ ArrayBuffer   │  │
│  └──────────┘    └───────┬───────┘  │
│                          │          │
│                  ┌───────▼───────┐  │
│                  │    JSZip      │  │
│                  │  (ZIP Parse)  │  │
│                  └───────┬───────┘  │
│                          │          │
│                  ┌───────▼───────┐  │
│                  │  DOMParser    │  │
│                  │  (XML Parse)  │  │
│                  └───────┬───────┘  │
│                          │          │
│                  ┌───────▼───────┐  │
│                  │  Converter    │  │
│                  │  (XML → MD)   │  │
│                  └───────┬───────┘  │
│                          │          │
│                  ┌───────▼───────┐  │
│                  │ Blob/Download │  │
│                  └───────────────┘  │
│                                     │
│  Network calls: ZERO                │
└─────────────────────────────────────┘

Implementation Checklist

1. No `fetch()` / `XMLHttpRequest` for user data

// ❌ NEVER do this with sensitive documents
const res = await fetch('/api/convert', {
    method: 'POST',
    body: formData // Contains the user's legal document!
});

// ✅ Process entirely in-browser
const result = await Udf2Md.convert(file); // Pure JS, no network

2. Use `File.arrayBuffer()` instead of `FileReader`

// Modern, clean API
const buffer = await file.arrayBuffer();

3. Generate downloads with `Blob` + `URL.createObjectURL`

const blob = new Blob([markdown], { type: "text/markdown" });
const url = URL.createObjectURL(blob);
// This URL is local-only, not accessible from network

4. Use `navigator.clipboard` for copy

await navigator.clipboard.writeText(result.markdown);
// Clipboard API is local-only

Verification: How Users Can Confirm

Tell users to open DevTools → Network tab. They should see zero requests during document processing. This is the ultimate trust signal.

Trade-offs

Aspect	Client-Side	Server-Side
Privacy	Guaranteed	Depends on trust
Speed	Limited by device CPU	Can use powerful servers
File size limit	~100MB practical	Unlimited
Offline support	Yes	No
Maintenance	Simpler (static hosting)	Complex

For document conversion tools, client-side wins overwhelmingly.

Our Tools

udf2md — UDF → Markdown converter
uyap-web-udf-editor — Full UDF editor with PDF/DOCX/TIFF import

Both are open source. Both process zero bytes on any server.

Building XML-to-Markdown Converters: Algorithms and Edge Cases

eimza — Mon, 21 Sep 2026 22:14:48 +0000

Converting XML documents to Markdown sounds simple until you actually try it. Here's what we learned building a converter for Turkey's UYAP legal document format.

The Core Algorithm

XML DOM → Walk tree → Emit Markdown tokens → Join & clean

Step 1: Parse XML

const parser = new DOMParser();
const doc = parser.parseFromString(xmlText, "text/xml");

// Always check for parse errors!
const err = doc.querySelector("parsererror");
if (err) throw new Error("Invalid XML: " + err.textContent);

Step 2: Walk the Element Tree

function walkElements(container) {
    let md = "";
    for (const child of container.children) {
        switch (child.nodeName.toLowerCase()) {
            case "paragraph": md += paragraphToMd(child) + "\n\n"; break;
            case "table":     md += tableToMd(child) + "\n\n"; break;
            case "image":     md += imageToMd(child) + "\n\n"; break;
        }
    }
    return md;
}

Step 3: Inline Formatting

The tricky part — XML attributes map to Markdown syntax:

function formatText(text, attrs) {
    if (attrs.bold && attrs.italic) return `***${text}***`;
    if (attrs.bold) return `**${text}**`;
    if (attrs.italic) return `*${text}*`;
    return text;
}

Edge case: What if bold and italic spans overlap partially? XML handles this naturally with separate <content> elements, but you need to be careful not to produce broken Markdown like **bold *both** italic*.

Heading Detection Heuristics

UYAP XML doesn't have explicit heading elements. We detect headings via heuristics:

function isHeading(paragraph, firstContent) {
    const fontSize = parseInt(firstContent.getAttribute("fontSize") || "12");
    const isBold = firstContent.getAttribute("bold") === "true";
    const isCenter = paragraph.getAttribute("alignment") === "2";
    const text = paragraph.textContent.trim();

    // Short, large-font text → H1
    if (fontSize >= 18 && text.length < 120) return 1;
    // Bold + large or bold + centered → H2
    if (fontSize >= 14 && isBold && text.length < 120) return 2;
    if (isBold && isCenter && text.length < 120) return 2;

    return 0; // Not a heading
}

Table Conversion

XML tables → Markdown tables require knowing the column count upfront:

function tableToMd(tableNode) {
    const rows = tableNode.querySelectorAll("row");
    let md = "";
    let headerDone = false;

    for (const row of rows) {
        const cells = [...row.querySelectorAll("cell")]
            .map(c => c.textContent.trim().replace(/\|/g, "\\|"));

        md += "| " + cells.join(" | ") + " |\n";

        if (!headerDone) {
            md += "| " + cells.map(() => "---").join(" | ") + " |\n";
            headerDone = true;
        }
    }
    return md;
}

Edge case: Cells containing pipe characters (|) must be escaped, or the table breaks.

Character Encoding

Turkish legal documents may use Windows-1254 encoding:

// Try UTF-8 first
let text = new TextDecoder("utf-8").decode(buffer);

// If it looks garbled, try Windows-1254
if (!text.includes("<template")) {
    text = new TextDecoder("windows-1254").decode(buffer);
}

The Result

Input: Opaque binary .udf file
Output: Clean, structured Markdown that any LLM can understand

Check out the full implementation: github.com/eimza-kep/udf2md

Parsing ZIP Archives in the Browser with JSZip: A Practical Guide

eimza — Mon, 21 Sep 2026 22:14:41 +0000

Most developers reach for server-side tools when they need to work with ZIP files. But what if your users are uploading sensitive documents (legal filings, medical records, financial data) and you can't — or shouldn't — send them to a server?

Here's how to parse ZIP archives entirely in the browser using JSZip.

Setup

<script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js"></script>

Or for offline use, bundle jszip.min.js locally (~100KB gzipped).

Reading a File Input

const fileInput = document.getElementById('fileInput');
fileInput.addEventListener('change', async (e) => {
    const file = e.target.files[0];
    const arrayBuffer = await file.arrayBuffer();

    const zip = await JSZip.loadAsync(arrayBuffer);

    // List all entries
    zip.forEach((relativePath, zipEntry) => {
        console.log(relativePath, zipEntry.dir ? '📁' : '📄');
    });
});

Extracting Text Files

const contentXml = zip.file("content.xml");
if (contentXml) {
    const text = await contentXml.async("string"); // UTF-8 text
    console.log(text);
}

Extracting Binary Files as Base64

for (const [path, entry] of Object.entries(zip.files)) {
    if (path.match(/\.(png|jpg|jpeg)$/i)) {
        const base64 = await entry.async("base64");
        const img = document.createElement("img");
        img.src = `data:image/png;base64,${base64}`;
        document.body.appendChild(img);
    }
}

Creating ZIP Files

const zip = new JSZip();
zip.file("content.xml", '<template format_id="1.8">...</template>');
zip.file("images/logo.png", base64Data, { base64: true });

const blob = await zip.generateAsync({
    type: "blob",
    compression: "DEFLATE",
    compressionOptions: { level: 6 }
});

// Trigger download
const url = URL.createObjectURL(blob);
const a = document.createElement("a");
a.href = url;
a.download = "document.udf";
a.click();

Performance Considerations

File Size	Parse Time (M1 Mac, Chrome)
50 KB	~5ms
1 MB	~25ms
10 MB	~180ms
50 MB	~900ms

For files >10MB, consider using zip.generateAsync() with a progress callback:

const blob = await zip.generateAsync({ type: "blob" }, (metadata) => {
    console.log(`Progress: ${metadata.percent.toFixed(1)}%`);
});

Real-World Use Case: udf2md

We used this approach in udf2md to convert Turkey's UYAP court documents (.udf) to Markdown — entirely in the browser. Zero backend, full GDPR/KVKK compliance.

The key insight: if you never send data to a server, you never have a data breach.

Reverse Engineering UYAP's .udf File Format: What's Inside a Turkish Court Document?

eimza — Mon, 21 Sep 2026 22:09:23 +0000

If you've ever worked with Turkey's national judiciary system (UYAP), you've encountered .udf files — the proprietary document format used for legal petitions, court orders, and official filings. But what actually is a .udf file?

TL;DR

A .udf file is a ZIP archive containing a single content.xml file that follows a custom XML schema (not ODF, not OOXML — something entirely unique to UYAP).

Dissecting the ZIP Layer

const zip = await JSZip.loadAsync(arrayBuffer);
zip.forEach((path, entry) => {
    console.log(path, entry.dir ? 'DIR' : `${entry._data.uncompressedSize} bytes`);
});
// Output: content.xml  4821 bytes

Most .udf files contain just one file: content.xml. Some newer variants may include embedded images (PNG/JPG) alongside it.

The XML Schema

The root element is <template> with a format_id attribute (typically "1.8"):

<?xml version="1.0" encoding="UTF-8"?>
<template format_id="1.8">
  <properties>
    <pageFormat leftMargin="70.86" rightMargin="70.86"
                topMargin="70.86" bottomMargin="70.86"/>
  </properties>
  <elements>
    <paragraph alignment="3">
      <content fontName="Times New Roman" fontSize="12"
               bold="true">DILEKÇE</content>
    </paragraph>
  </elements>
</template>

Key observations:

Element	Purpose
`<template format_id="1.8">`	Root container, versioned
`<properties>`	Page margins in points (1 point ≈ 0.353mm)
`<elements>`	Ordered list of paragraphs and tables
`<paragraph alignment="N">`	Text block (0=left, 1=right, 2=center, 3=justify)
`<content>`	Text run with inline formatting attributes
`<table> → <row> → <cell>`	Table structure

The `<content>` Element

Each <content> element is a "text run" — a span of text sharing the same formatting:

<content fontName="Times New Roman" fontSize="12"
         bold="true" italic="false" underline="false"
         foreground="-16777216">Saygılarımızla</content>

The foreground attribute uses Java's Color.getRGB() integer encoding:

-16777216 = 0xFF000000 = black (alpha + RGB)
To extract hex color: (num >>> 0).toString(16).slice(2)

Why This Matters for AI

None of the major LLMs (GPT-4, Claude, Gemini) can parse .udf files natively. Converting to Markdown preserves the semantic structure while making it universally readable:

**DILEKÇE** → ## DILEKÇE (heading detection via font size)
bold="true" → **text**
italic="true" → *text*
<table> → | col1 | col2 |

Open Source

We built udf2md — a 100% client-side converter. No data leaves your browser. Check it out!

UYAP .udf Dosyalarını Yapay Zekaya Hazır Markdown'a Dönüştürün (Açık Kaynak, %100 Client-Side)

eimza — Mon, 21 Sep 2026 22:06:55 +0000

UYAP (Ulusal Yargı Ağı Projesi) sisteminin kullandığı .udf dosya formatı, aslında içinde content.xml barındıran bir ZIP arşividir. Ne ChatGPT ne Gemini ne de Claude bu dosyayı doğrudan okuyabilir.

Bu sorunu çözmek için udf2md adlı yeni bir açık kaynak araç geliştirdik! 🚀

Ne İşe Yarar?

.udf dosyanızı sürükleyip bırakıyorsunuz, araç tarayıcınızda (hiçbir sunucuya veri göndermeden) şunları yapıyor:

ZIP Çözme: JSZip ile arşivi açar, content.xml dosyasını bulur.
XML Analizi: DOMParser ile UYAP'ın özel XML şemasını parse eder.
Markdown Üretimi: Paragrafları, kalın/italik formatları, tabloları ve görselleri temiz Markdown'a çevirir.
Akıllı Başlık Algılama: Büyük fontlu veya kalın ortalanmış satırları otomatik olarak # başlıklara dönüştürür.

Neden Markdown?

Markdown, tüm büyük LLM'lerin (ChatGPT, Claude, Gemini, Llama) en iyi anladığı formattır:

Yapılandırılmış metin (başlıklar, listeler, tablolar)
Hafif ve okunabilir
Evrensel uyumluluk

Gizlilik (KVKK) Güvencesi

Hukuki belgeler son derece hassastır. Bu yüzden araç %100 istemci taraflı (client-side) çalışır:

İnternet bağlantısı kapalıyken bile çalışır
Hiçbir veri hiçbir sunucuya gönderilmez
Tüm işlem tarayıcınızın belleğinde gerçekleşir

Teknik Detaylar

Teknoloji	Kullanım
Vanilla JS	Sıfır bağımlılık
JSZip	UDF arşivini çözme
DOMParser	XML → DOM
Inter + JetBrains Mono	Modern tipografi
Phosphor Icons	Vektörel ikonlar

Kullanmak İçin

Projeyi GitHub'dan indirip index.html dosyasını açmanız yeterli:

👉 GitHub: github.com/eimza-kep/udf2md

Star ⭐ vererek destek olabilirsiniz!

Açık Kaynak Çözümümüz: awesome-turkiye-e-donusum 🚀

eimza — Mon, 21 Sep 2026 21:50:47 +0000

E-İmza, KEP ve e-Dönüşüm ekosistemi için geliştirdiğimiz açık kaynak kodlu projelerimizi tanıtmaya devam ediyoruz! Bugün sizlere awesome-turkiye-e-donusum projemizden bahsedeceğiz.

Proje Hakkında

Türkiye E-İmza, Mali Mühür, KEP, E-Fatura, UYAP ve e-Dönüşüm ekosistemi için açık kaynak kütüphaneler, araçlar ve rehberler.

E-İmza.plus ekibi olarak, elektronik imza, mali mühür, KEP ve e-fatura süreçlerinde geliştiricilerin ve son kullanıcıların hayatını kolaylaştırmayı hedefliyoruz. Bu projemiz de tamamen şeffaf ve güvenilir bir şekilde açık kaynak olarak tasarlandı.

Özellikler ve Kullanım

Projeyi kendi sunucunuza kurabilir, yerel (local) ortamınızda test edebilir veya kaynak kodlarını inceleyerek kendi projelerinize entegre edebilirsiniz. Hiçbir lisans kısıtlaması olmadan, ülkemizin dijital dönüşümüne katkı sağlamak amacıyla geliştirilmiştir.

👉 Kaynak Kodları ve Detaylar İçin: awesome-turkiye-e-donusum GitHub Deposu

Katkıda bulunmak isterseniz Pull Request göndermekten çekinmeyin. Açık kaynak ekosistemini birlikte büyütelim! 🌟

Java'ya Veda Edin: %100 Tarayıcı Tabanlı Açık Kaynak UYAP UDF Editörü (PDF, DOCX ve OCR Destekli) 🚀

eimza — Mon, 21 Sep 2026 21:48:13 +0000

Hukuk teknolojileri (LegalTech) alanında Türkiye'de en çok karşılaşılan sorunlardan biri şüphesiz Adalet Bakanlığı'nın UYAP Doküman Editörü sistemidir. Resmi dilekçeleri hazırlamak için kullanılan bu .udf uzantılı format, on yıllardır bilgisayarlarımıza Java (JRE) kurmamızı, sayısız güvenlik ayarıyla boğuşmamızı ve macOS/Linux gibi modern işletim sistemlerinde sorunlar yaşamamızı zorunlu kılıyordu.

Bugün, bu sorunu tamamen ortadan kaldıran açık kaynaklı (Open Source) projemizi duyurmaktan heyecan duyuyoruz: UYAP Web UDF Editörü! 🎉

Nedir Bu Web UDF Editörü?

Projemiz, hiçbir sunucuya veri göndermeden (backend veya API olmadan) tamamen tarayıcınızın belleğinde (%100 Client-Side) çalışan bir .udf okuyucu ve oluşturucudur.

Java'ya, eklentilere veya masaüstü uygulamalarına ihtiyacınız yok. Sayfayı açın, belgenizi yükleyin veya yazın ve anında resmi UYAP formatında indirin!

🌟 Öne Çıkan Özellikler ve Gizlilik (KVKK) Güvencesi

En büyük önceliğimiz Gizlilik. Dilekçeleriniz ve hukuki belgeleriniz son derece hassastır. Bu yüzden uygulama sunucusuz tasarlandı. İnternetinizi (Wi-Fi) kapatsanız dahi uygulama tarayıcınızda eksiksiz çalışır.

Java'sız UDF Çözme ve Paketleme: Sistem, JSZip ve yerel DOMParser kullanarak UDF paketlerini (aslında sıkıştırılmış bir XML olan content.xml dosyasını) saniyeler içinde tarayıcıda çözer.
Gerçek A4 Simülasyonu: 2.5 cm'lik resmi kenar boşlukları, Times New Roman 12pt varsayılan tipografi, iki yana yaslama ve 1.5 paragraf girintisi tek tıkla elinizin altında.

🚀 Sınırları Zorladık: DOCX, PDF ve TIFF (Yapay Zeka OCR) Desteği

UDF editörlerinin en büyük eksiği farklı formatlarla haberleşememesidir. Bu projeyi geliştirirken avukatların ve vatandaşların hayatını kolaylaştırmak için üç devrimsel "İçe Aktarma" özelliği ekledik:

DOCX Desteği (Mammoth.js): Microsoft Word (.docx) belgelerinizi sürükleyip bırakın. Yazılarınız, formatı bozulmadan anında UDF editörüne HTML blokları olarak akar.
PDF Desteği (PDF.js): Metin tabanlı PDF dosyalarını yüklediğinizde, Mozilla'nın pdf.js motoru belgedeki yazıları satır satır okur ve düzenlenebilir paragraf olarak UYAP formatına dönüştürür.
TIFF ve Taranmış Görüntüler için Tarayıcı İçi OCR: En heyecan verici kısım burası! Eski bir UYAP belgesini veya tarayıcıdan çıkmış TIFF bir resmi yüklediğinizde, proje arkaplanda Tesseract.js (WebAssembly tabanlı Yapay Zeka OCR motoru) çalıştırarak resimdeki yazıları okur. Üstelik bu işlem de hiçbir veriniz sunucuya gitmeden, kendi cihazınızın işlemcisiyle tarayıcınızda yapılır!

🛠️ Kaputun Altında Ne Var? (Geliştiriciler İçin)

Proje Vanilla JS, HTML5 ve CSS3'ün en saf halleriyle, modern standartlara göre tasarlandı:

jszip.min.js: UDF (ZIP) ayrıştırma ve DEFLATE formatında yeniden paketleme.
Modüler Yapı: udf-parser.js (XML'den DOM'a) ve udf-generator.js (DOM'dan UYAP v1.8 XML'ine).
<dialog> API: Native ve modern modal pencereleri.
Modern CSS Değişkenleri ve Phosphor Icons.

🤝 Katkıda Bulunun! (Açık Kaynak)

E-İmza.plus ekibi olarak bu projeyi Türkiye'deki tüm avukatlar, katipler ve vatandaşlar için tamamen ücretsiz ve açık kaynaklı olarak GitHub'a yükledik.

Geliştirmeye çok açık bir mimarisi var. Daha fazla şablon eklemek, arayüzü geliştirmek veya e-imza entegrasyonu (WebUSB) eklemek için PR (Pull Request) gönderebilirsiniz.

👉 GitHub Deposu: github.com/eimza-kep/uyap-web-udf-editor

Projeyi yıldızlayarak (Star ⭐) destek olabilir, düşüncelerinizi ve katkılarınızı bizimle paylaşabilirsiniz. Yorumlarda görüşmek üzere!