Domain Model
This page covers the Animal passport and the Safety domain only. They are the two
aggregates the site has always documented, and they remain a good introduction to the
platform's shape — but they are two of 52 modules. For any other domain, read the module
under apps/api/internal/modules/ and its contract in packages/contracts/; there are 53
OpenAPI documents and this page does not attempt to summarize them.
Private identity, ownership, delegation, emergency profile, and photo metadata are deliberately separate so that public/emergency projections never expose private data.
Safety / Lost & Found
Radius search uses ST_DWithin/ST_Distance over geography(Point,4326) with GiST
indexes. The precise location is authorized-only; public alerts and events expose a
coarsened (~2 km) point.
Views by sensitivity
| View | Exposes |
|---|---|
| Private identity | full record incl. chip/tattoo/passport — authorized only |
| Emergency (QR) | safe summaries + masked relay contact — no identity numbers. This includes free-text allergy and chronic-condition summaries, which are live on the unauthenticated QR surface and are deliberately the only PII exposed without a session |
Preventive health record (Domain 29, health module) | vaccinations, antiparasitics, weight, observations — owner-facing, its own table, no foreign key into any clinical schema. Every entry is owner_entered/unverified: professional verification depends on a model that does not exist yet |
| Regulated clinical record (Domain 8) | separate tables, explicit access + audit. Distinct from the above by design |
Do not read the emergency row as a leak. It is a decision, argued in
docs/security/THREAT_MODEL.md: a summary a stranger can read at the scene is the point of
the QR code, and it carries no identity numbers and no structured chart data.