Vamar Owner Platform

Vamar manages buildings for many owners, and owners are paid by post-dated rent cheques. Owners called the office to ask which cheques had cleared or bounced, and staff tracked thousands of cheques, contracts and shared units in spreadsheets.

A pnpm and Turborepo monorepo with three apps on one API.

• Owner app (Expo): phone and OTP sign-in, the monthly cheque overview, cheque statuses, properties and units, shared ownership, disputes, PDF statements, Arabic and English, light and dark themes.
• Staff dashboard (React, Vite, TanStack): owners, buildings, units, contracts, cheques, disputes, Excel import, staff roles, two-step login and a full audit log.
• API (Hono on Cloudflare Workers): Neon PostgreSQL through Drizzle, Firebase Auth for owners and staff, Cloudflare R2 for files, a daily alerts job and push notifications.

1. Owner isolation by construction. Every owner query goes through one scoping helper, and an integration suite proves that owner A gets a 404 on owner B's data.
2. A cheque state machine in a shared package. Transitions return their side effects (stamps, replacement cheque, owner alerts), and the API applies them in one transaction.
3. Money as integer fils. Shares of a cheque are split with a largest-remainder rule, so the parts always add up. 500 randomised test cases cover it.
4. Designed for free tiers. Workers get 10 ms of CPU per request, so handlers are I/O bound: PDFs are made on the phone and Excel is parsed in the browser.
5. An append-only audit log enforced by the database. The runtime role has no UPDATE or DELETE on the log, so history cannot be rewritten even by a bug.

Business rules are fully unit tested, every endpoint runs against an in-process PostgreSQL (PGlite), Playwright covers the dashboard, and CI type checks, lints and tests every push. Backups run nightly, encrypted, to private storage.