open-loam 0.1.1 → 0.2.0

data/lib/{loam → open_loam}/events.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   # A thin domain event bus over ActiveSupport::Notifications.
   #
   # Convention: event names are `domain.thing.happened`, e.g.
@@ -7,7 +7,7 @@ module Loam
   # subscribers are always tenant-aware.
   module Events
     NAME_FORMAT = /\A[a-z0-9_]+(\.[a-z0-9_]+){2,}\z/
-    PREFIX = "loam.event."
+    PREFIX = "open_loam.event."
 
     def self.publish(name, payload = {})
       name = name.to_s
@@ -17,12 +17,12 @@ module Loam
 
       ActiveSupport::Notifications.instrument(
         PREFIX + name,
-        payload.merge(tenant_id: Loam::Current.tenant&.id, actor_id: Loam::Current.actor&.id)
+        payload.merge(tenant_id: OpenLoam::Current.tenant&.id, actor_id: OpenLoam::Current.actor&.id)
       )
     end
 
     # The subscription rule, in one place: a trailing dot is a domain prefix,
-    # anything else is an exact event name. Loam::WebhookEndpoint matches
+    # anything else is an exact event name. OpenLoam::WebhookEndpoint matches
     # against this too, so a pattern means the same thing everywhere.
     def self.pattern_matches?(pattern, event_name)
       pattern = pattern.to_s
@@ -31,7 +31,7 @@ module Loam
       pattern.end_with?(".") ? event_name.start_with?(pattern) : event_name == pattern
     end
 
-    # Every Loam event, whatever its domain — the empty prefix matches them
+    # Every OpenLoam event, whatever its domain — the empty prefix matches them
     # all. Used by the webhook dispatcher, which decides per event which
     # endpoints care.
     def self.subscribe_all(&block)

data/lib/{loam → open_loam}/export.rb

@@ -1,16 +1,16 @@
 require "csv"
 
-module Loam
+module OpenLoam
   # CSV export of a tenant-scoped relation, POLICY- and ENCRYPTION-aware:
   #
-  #   Loam::Export.csv(Equipment.all, actor: current_actor)
+  #   OpenLoam::Export.csv(Equipment.all, actor: current_actor)
   #
-  # * only fields the actor's role may READ are columns (Loam::Policy#readable?);
+  # * only fields the actor's role may READ are columns (OpenLoam::Policy#readable?);
   # * an ENCRYPTED column is NEVER exported in the clear — its cell is
   #   "[encrypted]" (the same redaction as the audit trail), so a bulk export can
   #   never become a plaintext dump of PII a role shouldn't see;
   # * declared custom fields are included (a dictionary field exports its stored
-  #   code, so the file round-trips back through Loam::Import);
+  #   code, so the file round-trips back through OpenLoam::Import);
   # * tenant isolation is free — the relation is already scoped.
   #
   # Prototype scale: builds the CSV in memory with the stdlib CSV. A very large
@@ -37,10 +37,10 @@ module Loam
     # redacted), then declared custom fields.
     def exportable_columns(model, actor)
       policy = policy_for(model, actor)
-      encrypted = model.respond_to?(:loam_encrypted_attributes) ? model.loam_encrypted_attributes : []
+      encrypted = model.respond_to?(:open_loam_encrypted_attributes) ? model.open_loam_encrypted_attributes : []
       # The blind-index columns behind searchable encrypted fields (e.g.
       # email_hash) are internal HMACs — never export them either.
-      blind = model.respond_to?(:loam_searchable_encrypted_attributes) ? model.loam_searchable_encrypted_attributes.map { |a| "#{a}_hash" } : []
+      blind = model.respond_to?(:open_loam_searchable_encrypted_attributes) ? model.open_loam_searchable_encrypted_attributes.map { |a| "#{a}_hash" } : []
 
       columns = model.column_names.reject { |c| SKIP_COLUMNS.include?(c) || blind.include?(c) || c == "custom_fields" }
                      .select { |c| policy.readable?(c) }
@@ -61,14 +61,14 @@ module Loam
               when :custom    then (record.custom_field(column[:name]) rescue nil)
               else record.public_send(column[:name])
               end
-      Loam::Csv.safe(value) # neutralize CSV formula injection (=, +, -, @, tab/CR)
+      OpenLoam::Csv.safe(value) # neutralize CSV formula injection (=, +, -, @, tab/CR)
     end
 
     def policy_for(model, actor)
       klass = "#{model.name}Policy".safe_constantize
       # A blank instance as the record: readable? keys off the role, but the
       # policy's custom-field checks read record.class.
-      (klass || Loam::Policy).new(actor, model.new)
+      (klass || OpenLoam::Policy).new(actor, model.new)
     end
   end
 end

data/lib/{loam → open_loam}/features.rb

@@ -1,18 +1,18 @@
-module Loam
+module OpenLoam
   # Runtime feature toggles: is a capability turned ON for this tenant right now.
   #
-  #   Loam::Features.on?(:beta_dashboard)          # for the current tenant
-  #   Loam::Features.enable(:beta_dashboard)       # this tenant only
-  #   Loam::Features.enable(:beta_dashboard, scope: :global)  # everyone
-  #   Loam::Features.disable(:beta_dashboard)
-  #   Loam::Features.reset(:beta_dashboard)        # drop the override → default
+  #   OpenLoam::Features.on?(:beta_dashboard)          # for the current tenant
+  #   OpenLoam::Features.enable(:beta_dashboard)       # this tenant only
+  #   OpenLoam::Features.enable(:beta_dashboard, scope: :global)  # everyone
+  #   OpenLoam::Features.disable(:beta_dashboard)
+  #   OpenLoam::Features.reset(:beta_dashboard)        # drop the override → default
   #
   # A flag gates a CAPABILITY (is this feature live for the tenant), which is
   # orthogonal to a policy — that gates a PERSON (may this user act). The two
   # coexist: a manager may be allowed to approve reports AND the approvals
   # feature may be switched off for their tenant during a rollout.
   #
-  # This is deliberately a thin wrapper over Loam::Configs: a flag is a boolean
+  # This is deliberately a thin wrapper over OpenLoam::Configs: a flag is a boolean
   # setting with the same override → global → declared-default resolution, so it
   # reuses that store (no new table) and its per-request cache. Flags live under
   # the reserved `features.` key prefix and get their own admin screen, because
@@ -22,7 +22,7 @@ module Loam
 
     class << self
       def on?(name)
-        !!Loam::Configs.get(key_for(name), default: default_for(name))
+        !!OpenLoam::Configs.get(key_for(name), default: default_for(name))
       end
 
       def off?(name)
@@ -32,37 +32,37 @@ module Loam
       # Flip a flag on. scope: :tenant (default) overrides for the current tenant
       # and requires a tenant in context; scope: :global sets the app-wide state.
       def enable(name, scope: :tenant)
-        Loam::Configs.set(key_for(name), true, scope: scope)
+        OpenLoam::Configs.set(key_for(name), true, scope: scope)
       end
 
       def disable(name, scope: :tenant)
-        Loam::Configs.set(key_for(name), false, scope: scope)
+        OpenLoam::Configs.set(key_for(name), false, scope: scope)
       end
 
       # Drop the current tenant's override so the flag falls back to the global
       # state / declared default.
       def reset(name)
-        Loam::Configs.reset(key_for(name))
+        OpenLoam::Configs.reset(key_for(name))
       end
 
       def overridden?(name)
-        Loam::Configs.overridden?(key_for(name))
+        OpenLoam::Configs.overridden?(key_for(name))
       end
 
       # Every declared flag, sorted — the admin lists these whether or not a row
       # exists yet, so a flag is visible the moment it is declared.
       def declared
-        Loam.feature_defaults.keys.sort
+        OpenLoam.feature_defaults.keys.sort
       end
 
       def description(name)
-        Loam.feature_defaults.dig(name.to_s, :description)
+        OpenLoam.feature_defaults.dig(name.to_s, :description)
       end
 
       # The declared-default state of a flag (false for an unknown one), used as
       # the last resort when there is no override and no global row.
       def default_for(name)
-        !!Loam.feature_defaults.dig(name.to_s, :default)
+        !!OpenLoam.feature_defaults.dig(name.to_s, :default)
       end
 
       private

data/lib/{loam → open_loam}/generated_key.rb

@@ -1,4 +1,4 @@
-module Loam
+module OpenLoam
   # Primary-key generation for tables whose key is not an integer.
   #
   # Rails leaves key generation to the database, which works for integer keys
@@ -7,22 +7,22 @@ module Loam
   # has neither: the INSERT sends NULL and the row is rejected or lands with an
   # empty key.
   #
-  # Loam's tables follow the host app's key type (see
-  # Loam::Generators::PrimaryKeyOptions), so on a string-keyed app every Loam
+  # OpenLoam's tables follow the host app's key type (see
+  # OpenLoam::Generators::PrimaryKeyOptions), so on a string-keyed app every OpenLoam
   # model needs its key generated in Ruby. Before this, hosts patched it in
   # themselves with a global before_create on ActiveRecord::Base — a lot to ask
   # of an app whose only deviation was not using bigints, and a hook broad
-  # enough to reach models that had nothing to do with Loam.
+  # enough to reach models that had nothing to do with OpenLoam.
   #
   # Integer keys take the early return, so nothing changes for the default app.
   module GeneratedKey
     def self.included(base)
-      base.before_create :assign_loam_generated_key
+      base.before_create :assign_open_loam_generated_key
     end
 
     private
 
-    def assign_loam_generated_key
+    def assign_open_loam_generated_key
       key = self.class.primary_key
       return if key.nil?             # a join table declared with id: false
       return if self[key].present?   # the caller chose the key

data/lib/{loam → open_loam}/import.rb

@@ -1,14 +1,14 @@
 require "csv"
 require "set"
 
-module Loam
+module OpenLoam
   # CSV import mapping engine — reusable, tenant-scoped, policy-safe.
   #
-  #   Loam::Import.preview(csv)                       # headers + first rows for the mapping UI
-  #   Loam::Import.run(csv, model:, mapping:, actor:, # map CSV header => field
+  #   OpenLoam::Import.preview(csv)                       # headers + first rows for the mapping UI
+  #   OpenLoam::Import.run(csv, model:, mapping:, actor:, # map CSV header => field
   #                    match_key: "name",             # update-or-create by a key (nil = create-only)
   #                    dry_run: true,                 # validate + report, commit nothing
-  #                    progress: progress_job)        # advance a Loam::ProgressJob per row
+  #                    progress: progress_job)        # advance a OpenLoam::ProgressJob per row
   #
   # Safety: the mapping may only target fields the actor's role can WRITE (real
   # columns + declared custom fields); tenant_id, plumbing, and non-permitted
@@ -27,14 +27,14 @@ module Loam
 
     module_function
 
-    # Resolve an entity_type string to a model — ONLY a Loam::TenantRecord
+    # Resolve an entity_type string to a model — ONLY a OpenLoam::TenantRecord
     # subclass (never an arbitrary constant), so an import target can't be
     # smuggled to a global model like User (same guard as the business-rules
     # engine).
     def allowed_model(entity_type)
       klass = entity_type.to_s.safe_constantize
-      unless klass.is_a?(Class) && klass < Loam::TenantRecord
-        raise Loam::Error, "import target #{entity_type.inspect} is not a Loam entity"
+      unless klass.is_a?(Class) && klass < OpenLoam::TenantRecord
+        raise OpenLoam::Error, "import target #{entity_type.inspect} is not a OpenLoam entity"
       end
 
       klass
@@ -79,7 +79,7 @@ module Loam
           is_new ? (result.created += 1) : (result.updated += 1)
         rescue StandardError => error
           # Store ONLY the row number + message — NEVER the raw cell values. The
-          # result is persisted (Loam::ProgressJob.result); a failed row into an
+          # result is persisted (OpenLoam::ProgressJob.result); a failed row into an
           # encrypted field would otherwise write PLAINTEXT PII at rest.
           result.failed += 1
           result.errors << { "row" => line, "message" => error.message }
@@ -103,7 +103,7 @@ module Loam
         out << (Array(headers) + [ "_error" ])
         result.errors.each do |error|
           original = data_rows[error["row"] - 2] || [] # row is 1-based incl. the header
-          out << original.map { |cell| Loam::Csv.safe(cell) } + [ error["message"] ]
+          out << original.map { |cell| OpenLoam::Csv.safe(cell) } + [ error["message"] ]
         end
       end
     end
@@ -115,7 +115,7 @@ module Loam
         next if target.to_s.blank?
         next if allowed.include?(target.to_s)
 
-        raise Loam::Error, "import mapping refuses #{target.inspect} — not a writable column or custom field"
+        raise OpenLoam::Error, "import mapping refuses #{target.inspect} — not a writable column or custom field"
       end
     end
 
@@ -155,14 +155,14 @@ module Loam
     def safe_parse(csv_string)
       CSV.parse(csv_string.to_s)
     rescue CSV::MalformedCSVError => error
-      raise Loam::Error, "could not parse CSV: #{error.message}"
+      raise OpenLoam::Error, "could not parse CSV: #{error.message}"
     end
 
     def policy_for(model, actor)
       klass = "#{model.name}Policy".safe_constantize
       # A blank instance as the record: readable?/writable? key off the role, but
       # custom_field_writable? reads record.class.custom_field_definitions.
-      (klass || Loam::Policy).new(actor, model.new)
+      (klass || OpenLoam::Policy).new(actor, model.new)
     end
   end
 end

data/lib/{loam → open_loam}/inbound_webhooks.rb

@@ -1,9 +1,9 @@
 require "openssl"
 require "digest"
 
-module Loam
+module OpenLoam
   # Receiving webhooks FROM external systems (the inbound sibling of
-  # Loam::Webhooks). One entry point — `ingest` — does the whole verified,
+  # OpenLoam::Webhooks). One entry point — `ingest` — does the whole verified,
   # replay-resistant pipeline and returns a Result the controller turns into an
   # HTTP status. Kept here (not in a controller) so it is testable without HTTP
   # and shared by the generated app and the demo.
@@ -30,13 +30,13 @@ module Loam
     module_function
 
     def ingest(token:, raw_body:, headers:)
-      Loam::Telemetry.span("inbound_webhook") { run_ingest(token, raw_body.to_s, headers) }
+      OpenLoam::Telemetry.span("inbound_webhook") { run_ingest(token, raw_body.to_s, headers) }
     end
 
     def run_ingest(token, raw_body, headers)
       return Result.new(status: 413, reason: "body too large") if raw_body.bytesize > MAX_BYTES
 
-      source = Loam::InboundWebhookSource.resolve(token)
+      source = OpenLoam::InboundWebhookSource.resolve(token)
       return Result.new(status: 404, reason: "unknown or inactive source") if source.nil?
 
       signature = header(headers, source.signature_header_key)
@@ -51,8 +51,8 @@ module Loam
 
       begin
         delivery = nil
-        Loam::InboundWebhookDelivery.transaction do
-          delivery = Loam::InboundWebhookDelivery.create!(
+        OpenLoam::InboundWebhookDelivery.transaction do
+          delivery = OpenLoam::InboundWebhookDelivery.create!(
             source: source, external_id: external_id, event_name: source.event_name,
             status: "received", received_at: Time.current, payload: parse(raw_body)
           )
@@ -60,7 +60,7 @@ module Loam
           # lives on the delivery row, subscribers read it from there. Publishing
           # inside the txn ties capture to the row — a publish failure rolls the
           # row back so the sender's retry isn't deduped away.
-          Loam::Events.publish(source.event_name, { source_id: source.id, delivery_id: delivery.id })
+          OpenLoam::Events.publish(source.event_name, { source_id: source.id, delivery_id: delivery.id })
         end
         Result.new(status: 202, reason: "accepted", delivery: delivery)
       rescue ActiveRecord::RecordNotUnique

data/lib/{loam → open_loam}/lifecycle.rb

@@ -1,17 +1,17 @@
-module Loam
+module OpenLoam
   # Tenant lifecycle: what a brand-new tenant gets for free.
   #
-  # An app declares seeding once, in config/initializers/loam.rb:
+  # An app declares seeding once, in config/initializers/open_loam.rb:
   #
-  #   Loam.on_tenant_created do |tenant|
-  #     Loam::FieldDefinition.find_or_create_by!(entity_type: "Equipment", name: "asset_tag") { ... }
+  #   OpenLoam.on_tenant_created do |tenant|
+  #     OpenLoam::FieldDefinition.find_or_create_by!(entity_type: "Equipment", name: "asset_tag") { ... }
   #   end
   #
-  # The block runs inside `Loam.as_tenant(tenant)`, so tenant-scoped writes
+  # The block runs inside `OpenLoam.as_tenant(tenant)`, so tenant-scoped writes
   # need no extra ceremony.
   #
   # THE CONTRACT: callbacks MUST be idempotent. They fire once when a tenant is
-  # created, and again for EVERY existing tenant whenever `bin/rails loam:sync`
+  # created, and again for EVERY existing tenant whenever `bin/rails open_loam:sync`
   # runs — which is how a role/field/default added by a later release reaches
   # tenants that already exist. Write `find_or_create_by!`, never `create!`.
   module Lifecycle
@@ -27,14 +27,14 @@ module Loam
     end
 
     # The single execution path for a tenant's callbacks — used both by
-    # Loam::Tenant's after_create_commit and by sync_tenants!, so "runs inside
+    # OpenLoam::Tenant's after_create_commit and by sync_tenants!, so "runs inside
     # as_tenant, in declaration order" can never drift between the two.
     #
     # Exceptions propagate: a failing callback fails the tenant creation (Rails
     # re-raises from after_commit) or the sync run, loudly, like every other
-    # Loam guardrail.
+    # OpenLoam guardrail.
     def self.run_tenant_created(tenant)
-      Loam.as_tenant(tenant) do
+      OpenLoam.as_tenant(tenant) do
         tenant_created_callbacks.each { |callback| callback.call(tenant) }
       end
     end
@@ -44,7 +44,7 @@ module Loam
     # Returns the number of tenants synced.
     def self.sync_tenants!
       count = 0
-      Loam::Tenant.find_each do |tenant|
+      OpenLoam::Tenant.find_each do |tenant|
         run_tenant_created(tenant)
         count += 1
       end
@@ -52,8 +52,8 @@ module Loam
     end
 
     # Role names this app expects every tenant to have — declared in the
-    # initializer (`Loam.default_roles = %w[manager employee]`) and read by
-    # whatever seeds memberships. A registry, not a mechanism: Loam does not
+    # initializer (`OpenLoam.default_roles = %w[manager employee]`) and read by
+    # whatever seeds memberships. A registry, not a mechanism: OpenLoam does not
     # create roles for you, because who gets which role is business logic.
     def self.default_roles
       @default_roles ||= []
@@ -64,7 +64,7 @@ module Loam
     end
 
     # App-wide setting defaults: `{ "billing.currency" => "USD" }`, declared in
-    # the initializer and read by Loam::Configs as the baseline a key resolves
+    # the initializer and read by OpenLoam::Configs as the baseline a key resolves
     # to when no global row and no tenant override exist. A registry, like
     # default_roles — declaring a default here needs no migration and no row.
     def self.config_defaults
@@ -75,8 +75,8 @@ module Loam
       @config_defaults = defaults.to_h.transform_keys(&:to_s)
     end
 
-    # Event-name patterns (Loam::Events.pattern_matches?) whose events may be
-    # pushed to the browser over SSE (Loam::EventStream). DEFAULT OFF — an empty
+    # Event-name patterns (OpenLoam::Events.pattern_matches?) whose events may be
+    # pushed to the browser over SSE (OpenLoam::EventStream). DEFAULT OFF — an empty
     # list means nothing reaches a browser; an app opts in explicitly, so a stray
     # event never leaks by default.
     def self.broadcast_events
@@ -87,8 +87,8 @@ module Loam
       @broadcast_events = Array(patterns).map(&:to_s)
     end
 
-    # The locales content translations (Loam::Translatable) may be authored in —
-    # declared in the initializer (`Loam.locales = %w[en de pl]`), so the admin
+    # The locales content translations (OpenLoam::Translatable) may be authored in —
+    # declared in the initializer (`OpenLoam.locales = %w[en de pl]`), so the admin
     # knows which languages to offer. A registry like the others; defaults to the
     # single default locale.
     def self.locales
@@ -100,9 +100,9 @@ module Loam
     end
 
     # Job classes an app EXPLICITLY allows the scheduler to run, beyond the ones
-    # it registers via Loam::Scheduler.register. An allowlist (not "any
+    # it registers via OpenLoam::Scheduler.register. An allowlist (not "any
     # ActiveJob") so a tenant admin can't schedule ActiveStorage::PurgeJob or a
-    # mailer. Declared in the initializer: `Loam.schedulable_jobs = %w[DigestJob]`.
+    # mailer. Declared in the initializer: `OpenLoam.schedulable_jobs = %w[DigestJob]`.
     def self.schedulable_jobs
       @schedulable_jobs ||= []
     end
@@ -116,17 +116,17 @@ module Loam
     end
 
     # The current request/job locale — content reads overlay onto it. Request
-    # state like the tenant (set in a before_action, reset with Loam::Current).
+    # state like the tenant (set in a before_action, reset with OpenLoam::Current).
     def self.locale
-      (Loam::Current.locale || default_locale).to_s
+      (OpenLoam::Current.locale || default_locale).to_s
     end
 
     def self.locale=(code)
-      Loam::Current.locale = code&.to_s
+      OpenLoam::Current.locale = code&.to_s
     end
 
     # Known feature flags: `{ "beta_dashboard" => { default: false, description:
-    # "..." } }`, declared in the initializer and read by Loam::Features. A
+    # "..." } }`, declared in the initializer and read by OpenLoam::Features. A
     # registry like the others — a flag with no row resolves to its declared
     # default, and the admin can list EVERY known flag, not just toggled ones.
     def self.feature_defaults
@@ -143,8 +143,8 @@ module Loam
     end
   end
 
-  # The public surface is on Loam itself — apps and agents write
-  # `Loam.on_tenant_created`, never `Loam::Lifecycle.on_tenant_created`.
+  # The public surface is on OpenLoam itself — apps and agents write
+  # `OpenLoam.on_tenant_created`, never `OpenLoam::Lifecycle.on_tenant_created`.
   def self.on_tenant_created(&block) = Lifecycle.on_tenant_created(&block)
   def self.tenant_created_callbacks = Lifecycle.tenant_created_callbacks
   def self.sync_tenants! = Lifecycle.sync_tenants!

data/lib/{loam/locales/loam.en.yml → open_loam/locales/open_loam.en.yml}

@@ -1,11 +1,11 @@
-# Loam's own UI strings (the framework chrome). Shipped inside lib/ so the gem
-# packages it, and added to the app's I18n load path by Loam::Engine. An app
-# localizes Loam by adding its own `config/locales/loam.<locale>.yml` overriding
-# these keys — distinct from Loam::Translatable, which localizes record DATA.
+# OpenLoam's own UI strings (the framework chrome). Shipped inside lib/ so the gem
+# packages it, and added to the app's I18n load path by OpenLoam::Engine. An app
+# localizes OpenLoam by adding its own `config/locales/open_loam.<locale>.yml` overriding
+# these keys — distinct from OpenLoam::Translatable, which localizes record DATA.
 # Entity and field names come from Rails' own activerecord.models /
 # activerecord.attributes (via model_name.human / human_attribute_name).
 en:
-  loam:
+  open_loam:
     chrome:
       tenant: "Tenant"
       user: "User"

data/lib/{loam → open_loam}/mcp/server.rb

@@ -1,22 +1,22 @@
 require "json"
 
-module Loam
+module OpenLoam
   module Mcp
-    # The stdio transport for the Loam MCP server (L-302): newline-delimited
+    # The stdio transport for the OpenLoam MCP server (L-302): newline-delimited
     # JSON-RPC over stdin/stdout, the MCP-spec stdio binding. Authenticates ONCE
-    # from LOAM_MCP_TOKEN (a Loam API token — never a tool argument, so it can't
+    # from OPEN_LOAM_MCP_TOKEN (a OpenLoam API token — never a tool argument, so it can't
     # land in an agent transcript), then runs every message inside that token's
     # tenant + actor. Nothing but JSON-RPC is written to stdout; logs go to stderr
     # (wired in the rake task) — a stray stdout line corrupts the stream.
     class Server
-      def initialize(input: $stdin, output: $stdout, token: ENV["LOAM_MCP_TOKEN"])
+      def initialize(input: $stdin, output: $stdout, token: ENV["OPEN_LOAM_MCP_TOKEN"])
         @input = input
         @output = output
         @token = token
       end
 
       def run
-        api_token = Loam::ApiToken.authenticate(@token)
+        api_token = OpenLoam::ApiToken.authenticate(@token)
         return fail_auth unless api_token
 
         tenant = api_token.tenant
@@ -27,13 +27,13 @@ module Loam
           next if line.empty?
 
           request = parse(line)
-          next write(Loam::Mcp.err(nil, -32700, "parse error")) if request.nil?
+          next write(OpenLoam::Mcp.err(nil, -32700, "parse error")) if request.nil?
 
           begin
-            response = Loam.as_tenant(tenant, actor: actor) { Loam::Mcp.handle_jsonrpc(request) }
+            response = OpenLoam.as_tenant(tenant, actor: actor) { OpenLoam::Mcp.handle_jsonrpc(request) }
             write(response) if response
           ensure
-            Loam::Current.reset
+            OpenLoam::Current.reset
           end
         end
       end
@@ -52,7 +52,7 @@ module Loam
       end
 
       def fail_auth
-        write(Loam::Mcp.err(nil, -32001, "authentication failed: set LOAM_MCP_TOKEN to a valid Loam API token"))
+        write(OpenLoam::Mcp.err(nil, -32001, "authentication failed: set OPEN_LOAM_MCP_TOKEN to a valid OpenLoam API token"))
         exit(1)
       end
     end