Data model

Openfront Pharmacy has 45 Keystone lists in features/keystone/models. Most clinical, inventory, and money lists deny create, update, and delete through the generic API. They change only through named commands. Product, DrugReference, Supplier, Prescriber, PharmacyLocation, PaymentProvider, OrganizationMembership, and Organization use the generic drawers.

Tenant and access

List	Purpose
`Organization`	The pharmacy business. Branding, privacy notice, cash and tax policy, fill policy, `storefrontKey`/`storefrontHost`/`slug`
`PharmacyLocation`	A store. Hours, address, ordering, pickup, delivery switches
`OrganizationMembership`	Staff member at an organization or one location, with role and credential evidence
`User`, `Role`	Accounts and the 19 permission flags
`MachineCredential`	Token records with prefix, hash, scopes, and expiry

Catalog and inventory

List	Purpose
`DrugReference`, `DrugReferenceReview`	NDC entries and the organization's review evidence
`Product`	OTC and prescription items
`Supplier`	Wholesalers
`InventoryLot`	A received lot with quantities and expiry
`InventoryMovement`	Append-only stock ledger
`TemperatureExcursion`	Cold-chain breach records on a lot

Patients and prescriptions

List	Purpose
`PatientProfile`, `PatientAllergy`, `PatientMedication`, `ConsentRecord`	Patient record, safety history, consents
`Prescriber`	Prescribers with NPI and credential evidence
`Prescription`, `PrescriptionItem`	The prescription and its medication lines
`PrescriptionReview`, `ClinicalSafetyReview`	Pharmacist and safety review history
`PrescriptionFill`, `PrescriptionFillEvent`	Per-fill entitlement and its event log
`DispensingLabel`	Label snapshot, immutable
`RefillRequest`, `PrescriptionTransfer`, `PrescriptionRequest`	Refill, transfer, and online requests

Orders and payments

Cart, CartItem, Order, OrderLineItem, Fulfillment, PaymentProvider, PaymentSession, Payment, PaymentWebhookEvent.

Recalls, integrations, evidence

Recall, RecallExposure, IntegrationProvider, ExternalIntegrationWorkflow, IntegrationWebhookEvent, HumanApproval, AuditEvent, OutboxEvent.

Key relationships

Organization → many PharmacyLocation, OrganizationMembership, PatientProfile, Product, Prescription, Recall, Order.
Prescription → PatientProfile, Prescriber, PharmacyLocation; has many PrescriptionItem, reviews, safety reviews, DispensingLabel, RefillRequest, PrescriptionTransfer, and Order.
PrescriptionItem → DrugReference and Product.
Product → many InventoryLot → many InventoryMovement.
Recall → many InventoryLot and many RecallExposure; an exposure points to a patient, prescription, order, and movement.
Order → Fulfillment, many Payment, many OrderLineItem, optional PatientProfile and Prescription.
HumanApproval is referenced by the records it approved.

Prescription statuses and other state machines are on the page for each area. The checked-in docs/schema-map.md in the repo lists every field.