Chief Technical Officer · Yarl Ventures (PVT) Ltd · Jaffna, Sri Lanka
I build production systems people depend on daily. Healthcare, education and commerce. Node.js and TypeScript on the backend, React and Flutter on the front, AWS underneath.
I lead engineering at a Sri Lankan technology company and still write most of the backend myself. The work is systems people depend on daily rather than side projects: appointment booking that must not double-book, payment flows that must not double-charge, and student records that must reconcile at the end of term.
Most of what I know came from the unglamorous half of that: idempotent payment webhooks, race-safe state transitions, timezone arithmetic that survives a daylight saving change, and audit trails that hold up when somebody disputes a charge six months later.
Opinions I hold, having been wrong before. Pick the boring option. Validate once at the edge and trust it downstream. Make state transitions atomic instead of hoping. Treat a modular monolith as the default until something genuinely forces a split. Measure before you believe a rule works.
| Organization | What it is | |
|---|---|---|
| Yarl Ventures (PVT) Ltd | The company. Technology partner for SMEs and growth-stage businesses | yarlventures.com |
| Tisankan.dev | Open-source packages and developer tooling | tisankan.dev |
| EDUS Tutor | Education platform. Classes, attendance, exams, fee collection | edustutor.com |
| MediMan | Telehealth. Consultations, video and audio calls, e-prescriptions | mediman.life |
| Starly.me | Product work in progress |
| Product | Scale |
|---|---|
| MediMan telehealth platform | 100+ verified doctors, 1,200+ users across Sri Lanka |
| EDUS education platform | Powers EDUS Online Institute and EDUS Lanka |
| Yarl Ventures CRM | Company-wide leads, customers, projects and invoicing |
I publish tooling I actually use. Everything MIT, documented and maintained.
| Package | What it does | Version |
|---|---|---|
| vetdeps | Tells you whether an npm package you are about to install is the one you think it is. Catches typosquats, AI-hallucinated names and known malware. Zero dependencies, zero telemetry |  |
| depshield | Dependency analyzer. Finds unused packages and cuts bundle size with AST-based detection |  |
| async-queue-manager-tsk | Async task queues with DAG dependencies and adaptive concurrency |  |
| express-auth-magic | Express authentication middleware covering JWT, OAuth and sessions |  |
| openrouter-ai-sdks | OpenRouter AI SDK for Node.js |  |
| s3-file-uploader | Small wrapper for uploading files to Amazon S3 |  |
| social-share-links-generator | Share link generation for the major social platforms |  |
| capdrift | Shows what a Dart package can do, what changed between versions, and whether that change violates your policy. Capability fingerprints, execution surfaces, behavioural diffing. Never executes the code it reads |  |
| deo_emerges | Flutter networking on Dio. Request deduplication, typed responses, uploads and downloads with progress. Two dependencies, all six platforms, WebAssembly ready, 160/160 on pub.dev |  |
| file_compression_plus | Flutter. Image and PDF compression with quality and dimension control |  |
Checking whether an npm package "exists" stopped working
AI tools hallucinate package names about 19.7% of the time, and attackers pre-register the predictable ones. That quietly broke the existence check most install guards rely on. Includes the two detection rules I got wrong and had to measure my way out of.
More at tisankan.dev/blog.
Most of my work lives inside the organizations above rather than on this profile.
Open to talking about backend architecture, supply chain security, and building engineering teams in Sri Lanka.