open-loam 0.1.1 → 0.3.0

data/app/models/{loam → open_loam}/audit_record.rb

@@ -1,9 +1,9 @@
-module Loam
+module OpenLoam
   # One row per change: who (actor), what (auditable + action + changeset),
   # when (created_at), in which tenant (tenant_id, via TenantRecord).
   # Append-only by convention; not itself audited or evented.
-  class AuditRecord < Loam::TenantRecord
-    self.table_name = "loam_audit_records"
+  class AuditRecord < OpenLoam::TenantRecord
+    self.table_name = "open_loam_audit_records"
 
     belongs_to :actor, class_name: "User", optional: true
 

data/app/models/{loam → open_loam}/auth_attempt.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # A single failed authentication attempt, for rate-limiting/lockout
-  # (Loam::AuthThrottle). Deliberately NOT tenant-scoped — authentication happens
+  # (OpenLoam::AuthThrottle). Deliberately NOT tenant-scoped — authentication happens
   # BEFORE a tenant is chosen (login), so this is a global auth-layer table keyed
-  # by the submitted identifier (the same reason Loam::MfaCredential is global).
+  # by the submitted identifier (the same reason OpenLoam::MfaCredential is global).
   # Allowlisted in the guardrails tenancy lint.
   class AuthAttempt < ApplicationRecord
-    include Loam::GeneratedKey
-    self.table_name = "loam_auth_attempts"
+    include OpenLoam::GeneratedKey
+    self.table_name = "open_loam_auth_attempts"
 
     validates :identifier, :kind, presence: true
   end

data/app/models/{loam → open_loam}/business_rule.rb

@@ -1,20 +1,20 @@
-module Loam
+module OpenLoam
   # A per-tenant, admin-configurable rule: WHEN a condition holds THEN run
   # actions. Declared as DATA (a trigger event pattern + a safe condition tree +
-  # a typed action list), never as code — see Loam::BusinessRules for the engine
+  # a typed action list), never as code — see OpenLoam::BusinessRules for the engine
   # that evaluates it. Audited like any business record.
-  class BusinessRule < Loam::TenantRecord
-    self.table_name = "loam_business_rules"
+  class BusinessRule < OpenLoam::TenantRecord
+    self.table_name = "open_loam_business_rules"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
-    has_many :runs, class_name: "Loam::BusinessRuleRun", dependent: :delete_all
+    has_many :runs, class_name: "OpenLoam::BusinessRuleRun", dependent: :delete_all
 
     validates :name, :trigger, presence: true
     # A rule may only target a tenant-scoped model (or none, for an event-only
     # rule). Refusing a global class like `User` at SAVE time means a poisoned
     # rule can't even be persisted — kept in lockstep with
-    # Loam::BusinessRules.subject_for, which refuses the same at run time.
+    # OpenLoam::BusinessRules.subject_for, which refuses the same at run time.
     validate :entity_type_targets_a_tenant_record
 
     scope :active, -> { where(active: true) }
@@ -22,7 +22,7 @@ module Loam
     scope :for_entity, ->(entity_type) { where(entity_type: entity_type.to_s) }
 
     def matches_trigger?(event_name)
-      Loam::Events.pattern_matches?(trigger, event_name)
+      OpenLoam::Events.pattern_matches?(trigger, event_name)
     end
 
     # The stored json, defensively — a hand-created row could hold a non-hash /
@@ -41,8 +41,8 @@ module Loam
       return if entity_type.blank?  # event-only rule, no subject to load
 
       klass = entity_type.safe_constantize
-      unless klass.is_a?(Class) && klass < Loam::TenantRecord
-        errors.add(:entity_type, "must name a Loam tenant-scoped model (not #{entity_type.inspect})")
+      unless klass.is_a?(Class) && klass < OpenLoam::TenantRecord
+        errors.add(:entity_type, "must name a OpenLoam tenant-scoped model (not #{entity_type.inspect})")
       end
     end
   end

data/app/models/{loam → open_loam}/business_rule_run.rb

@@ -1,13 +1,13 @@
-module Loam
+module OpenLoam
   # The log of why a business rule did (or did not) act — so the admin can see
-  # WHY something happened. Plumbing, like Loam::RecordLock: NOT audited (a log
+  # WHY something happened. Plumbing, like OpenLoam::RecordLock: NOT audited (a log
   # of a log is noise). Capped per rule so the table stays lean.
-  class BusinessRuleRun < Loam::TenantRecord
-    self.table_name = "loam_business_rule_runs"
+  class BusinessRuleRun < OpenLoam::TenantRecord
+    self.table_name = "open_loam_business_rule_runs"
 
     KEEP_PER_RULE = 50
 
-    belongs_to :business_rule, class_name: "Loam::BusinessRule"
+    belongs_to :business_rule, class_name: "OpenLoam::BusinessRule"
 
     scope :recent, -> { order(created_at: :desc) }
 

data/app/models/{loam → open_loam}/comment.rb

@@ -1,22 +1,22 @@
-module Loam
+module OpenLoam
   # A note by one person, on one record, in one tenant. Polymorphic, so any
-  # entity that `include Loam::Commentable` gets a discussion for free.
+  # entity that `include OpenLoam::Commentable` gets a discussion for free.
   #
   # Not audited on purpose: the comment IS the activity record. A
-  # Loam::AuditRecord saying "someone created a comment" beside a comment
+  # OpenLoam::AuditRecord saying "someone created a comment" beside a comment
   # saying what they wrote is the same fact stored twice.
   #
-  # Evented on purpose, in Loam's own domain ("loam.comment.created"), because
+  # Evented on purpose, in OpenLoam's own domain ("open_loam.comment.created"), because
   # a new comment is exactly the kind of thing an app wants to react to —
   # notify the watchers, ping a webhook — without every app inventing its own
   # event name for it.
-  class Comment < Loam::TenantRecord
-    include Loam::Eventful
+  class Comment < OpenLoam::TenantRecord
+    include OpenLoam::Eventful
 
-    self.table_name = "loam_comments"
+    self.table_name = "open_loam_comments"
 
-    event_domain :loam
-    event_entity :comment # not "loam_comment", which the namespace would give
+    event_domain :open_loam
+    event_entity :comment # not "open_loam_comment", which the namespace would give
 
     belongs_to :commentable, polymorphic: true
     belongs_to :author, class_name: "User"

data/app/models/{loam → open_loam}/config.rb

@@ -1,22 +1,22 @@
-module Loam
+module OpenLoam
   # A single configuration setting: one namespaced key, one JSON-able value.
   #
-  # Deliberately NOT a Loam::TenantRecord. A setting exists at two levels — a
+  # Deliberately NOT a OpenLoam::TenantRecord. A setting exists at two levels — a
   # GLOBAL default (tenant_id NULL) that every tenant sees, and a per-tenant
   # OVERRIDE (tenant_id set) that wins for that one tenant — so tenancy is a
   # nullable column here, not a default_scope. Resolving a key means reading
   # across both levels at once, which is why the lookup lives in vetted gem code
-  # (Loam::Configs), never in app code (see the tenancy allowlist in
-  # test/loam_guardrails_test.rb).
+  # (OpenLoam::Configs), never in app code (see the tenancy allowlist in
+  # test/open_loam_guardrails_test.rb).
   #
   # The value goes in a json column, so a bool, number, string, array, or hash
   # all round-trip under the same key. Row existence — not the value — is what
   # marks a key as set, so the value may legitimately be JSON null.
   class Config < ApplicationRecord
-    include Loam::GeneratedKey
-    self.table_name = "loam_configs"
+    include OpenLoam::GeneratedKey
+    self.table_name = "open_loam_configs"
 
-    belongs_to :tenant, class_name: "Loam::Tenant", optional: true
+    belongs_to :tenant, class_name: "OpenLoam::Tenant", optional: true
 
     validates :key, presence: true
     # One global per key, one override per key per tenant. AR renders the nil

data/app/models/{loam → open_loam}/custom_field_value.rb

@@ -1,16 +1,16 @@
-module Loam
+module OpenLoam
   # A read-model projection of ONE custom field of ONE record into typed,
   # INDEXED columns — so filtering/sorting/searching on a custom field is
   # index-backed instead of a per-row JSON extraction over the `custom_fields`
   # column (which can't be indexed and full-scans at scale). One row per
-  # (record, custom field); maintained by Loam::CustomFieldIndex from the
-  # Loam::CustomFields save/destroy hooks. Tenant-scoped.
+  # (record, custom field); maintained by OpenLoam::CustomFieldIndex from the
+  # OpenLoam::CustomFields save/destroy hooks. Tenant-scoped.
   #
   # The value is written into the column matching the field's declared type
   # (value_number / value_boolean / value_datetime) AND always into value_text
   # (its string form) for text ops (contains/present) and canonical equality.
-  class CustomFieldValue < Loam::TenantRecord
-    self.table_name = "loam_custom_field_values"
+  class CustomFieldValue < OpenLoam::TenantRecord
+    self.table_name = "open_loam_custom_field_values"
 
     validates :indexable_type, :indexable_id, :field_key, presence: true
     validates :field_key, uniqueness: { scope: %i[indexable_type indexable_id] }

data/app/models/{loam → open_loam}/dashboard_widget.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # A tenant's dashboard layout: which registered widgets appear, in what order.
   # A manager arranges these on the Dashboard settings screen; the dashboard
-  # renders the active ones by position (see Loam::Dashboard). Tenant-scoped and
+  # renders the active ones by position (see OpenLoam::Dashboard). Tenant-scoped and
   # audited.
-  class DashboardWidget < Loam::TenantRecord
-    self.table_name = "loam_dashboard_widgets"
+  class DashboardWidget < OpenLoam::TenantRecord
+    self.table_name = "open_loam_dashboard_widgets"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
     validates :widget_key, presence: true, uniqueness: { scope: :tenant_id }
 

data/app/models/open_loam/dictionary.rb

@@ -0,0 +1,20 @@
+module OpenLoam
+  # A per-tenant managed lookup list — a named set of entries (e.g.
+  # "damage_severity" → minor/major/critical). Admins curate the values without a
+  # code deploy, and a OpenLoam::FieldDefinition of type "dictionary" can point a
+  # custom field at one. Tenant-scoped and audited like every OpenLoam entity; see
+  # OpenLoam::Dictionaries for the read API.
+  class Dictionary < OpenLoam::TenantRecord
+    self.table_name = "open_loam_dictionaries"
+
+    include OpenLoam::Auditable
+
+    has_many :entries, class_name: "OpenLoam::DictionaryEntry",
+             foreign_key: :dictionary_id, dependent: :delete_all
+
+    validates :key, presence: true, uniqueness: { scope: :tenant_id }
+    validates :name, presence: true
+
+    normalizes :key, with: ->(key) { key.to_s.strip.presence }
+  end
+end

data/app/models/{loam → open_loam}/dictionary_entry.rb

@@ -1,15 +1,15 @@
-module Loam
-  # One option in a Loam::Dictionary: a stored `value` (the code that lands in a
+module OpenLoam
+  # One option in a OpenLoam::Dictionary: a stored `value` (the code that lands in a
   # record) plus display metadata (label, color, icon), an ordering `position`,
   # a `is_default` flag, and an `active` switch (a retired option stops being
   # offered without deleting the historical values already stored). Tenant-scoped
   # and audited.
-  class DictionaryEntry < Loam::TenantRecord
-    self.table_name = "loam_dictionary_entries"
+  class DictionaryEntry < OpenLoam::TenantRecord
+    self.table_name = "open_loam_dictionary_entries"
 
-    include Loam::Auditable
+    include OpenLoam::Auditable
 
-    belongs_to :dictionary, class_name: "Loam::Dictionary"
+    belongs_to :dictionary, class_name: "OpenLoam::Dictionary"
 
     validates :value, presence: true, uniqueness: { scope: :dictionary_id }
     validates :label, presence: true
@@ -25,7 +25,7 @@ module Loam
     # A within-request edit must not read a stale cached list (the cache also
     # resets per request, so this only matters when a write and a read share one).
     def clear_dictionary_cache
-      Loam::Dictionaries.clear_cache
+      OpenLoam::Dictionaries.clear_cache
     end
   end
 end

data/app/models/{loam → open_loam}/event_delivery.rb

@@ -1,14 +1,14 @@
-module Loam
+module OpenLoam
   # One durable delivery of one event to one persistent subscriber
-  # (see Loam::DurableEvents). The ROW is the durable record of intent: it is
+  # (see OpenLoam::DurableEvents). The ROW is the durable record of intent: it is
   # committed in the event's tenant at publish time, and the background job is
   # only an accelerator. If the job is lost, the sweep re-enqueues from this row.
   #
   # Lifecycle: pending -> delivered (handler ran) | dead (handler removed, or
   # MAX_ATTEMPTS exhausted). A pending row with next_attempt_at in the future is
   # simply waiting out its backoff.
-  class EventDelivery < Loam::TenantRecord
-    self.table_name = "loam_event_deliveries"
+  class EventDelivery < OpenLoam::TenantRecord
+    self.table_name = "open_loam_event_deliveries"
 
     STATUSES = %w[pending delivered dead].freeze
 

data/app/models/open_loam/event_record.rb

@@ -0,0 +1,42 @@
+module OpenLoam
+  # One captured domain event (see OpenLoam::EventLog). Where
+  # OpenLoam::EventDelivery records that a durable subscriber was told, this
+  # records that the thing happened at all.
+  #
+  # Append-only: a persisted row is readonly, so retention must delete_all
+  # rather than destroy.
+  class EventRecord < OpenLoam::TenantRecord
+    self.table_name = "open_loam_event_records"
+
+    validates :name, :occurred_at, presence: true
+
+    scope :chronological, -> { order(:occurred_at, :id) }
+
+    # ESCAPE is load-bearing: sanitize_sql_like backslash-escapes `_`, and SQLite
+    # has no default escape character, so "damage_report." would search for a
+    # literal backslash and silently match nothing.
+    scope :matching, ->(name_or_prefix) {
+      pattern = name_or_prefix.to_s
+      if pattern.end_with?(".")
+        where("name LIKE ? ESCAPE ?", "#{sanitize_sql_like(pattern)}%", "\\")
+      else
+        where(name: pattern)
+      end
+    }
+
+    def readonly?
+      persisted?
+    end
+
+    # The stored payload as a Hash regardless of adapter (Postgres jsonb returns
+    # a Hash; a text/json column may hand back a String).
+    def payload_hash
+      value = self[:payload]
+      return value if value.is_a?(Hash)
+
+      JSON.parse(value.to_s.presence || "{}")
+    rescue JSON::ParserError
+      {}
+    end
+  end
+end

data/app/models/{loam → open_loam}/field_definition.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # Runtime declaration of a migration-free field on a tenant-scoped entity —
   # "entity_type Equipment gets a field called serial_number of type string,
   # writable by managers only." Tenant-scoped like everything else: a field
   # defined in one tenant is invisible to another's records of the same
   # entity_type, and definitions are the ONLY way values in an entity's
-  # `custom_fields` json column get read/written (see Loam::CustomFields).
-  class FieldDefinition < Loam::TenantRecord
-    self.table_name = "loam_field_definitions"
+  # `custom_fields` json column get read/written (see OpenLoam::CustomFields).
+  class FieldDefinition < OpenLoam::TenantRecord
+    self.table_name = "open_loam_field_definitions"
 
     FIELD_TYPES = %w[string text integer decimal boolean date datetime dictionary].freeze
 
@@ -17,15 +17,15 @@ module Loam
 
     # Field-level READ gate for the runtime field, mirroring writable_roles: an
     # empty readable_roles means any member may read it; otherwise only the listed
-    # roles. Used by Loam::CustomFieldIndex (so a filter can't be an oracle on a
-    # restricted field) and Loam::Policy#custom_field_readable?.
+    # roles. Used by OpenLoam::CustomFieldIndex (so a filter can't be an oracle on a
+    # restricted field) and OpenLoam::Policy#custom_field_readable?.
     def readable_by?(role)
       roles = readable_roles
       roles.blank? || (role.present? && roles.map(&:to_sym).include?(role.to_sym))
     end
 
     # The `config` json holds type-specific settings. For a "dictionary" field it
-    # carries the key of the Loam::Dictionary whose entries populate the select.
+    # carries the key of the OpenLoam::Dictionary whose entries populate the select.
     def dictionary_key
       config.is_a?(Hash) ? config["dictionary"] : nil
     end
@@ -40,7 +40,7 @@ module Loam
     def dictionary_key_resolves
       if dictionary_key.blank?
         errors.add(:dictionary_key, "is required for a dictionary field")
-      elsif Loam::Dictionaries.get(dictionary_key).nil?
+      elsif OpenLoam::Dictionaries.get(dictionary_key).nil?
         errors.add(:dictionary_key, "must name an existing dictionary in this tenant")
       end
     end

data/app/models/{loam → open_loam}/inbound_webhook_delivery.rb

@@ -1,12 +1,12 @@
-module Loam
+module OpenLoam
   # One received inbound webhook. Two jobs: an idempotency ledger (a unique
   # (source_id, external_id) index turns a replayed delivery into a no-op) and an
   # audit/payload store — the raw body is kept here so an event subscriber reads
   # it, keeping the published event payload scalar-clean (ids only).
-  class InboundWebhookDelivery < Loam::TenantRecord
-    self.table_name = "loam_inbound_webhook_deliveries"
+  class InboundWebhookDelivery < OpenLoam::TenantRecord
+    self.table_name = "open_loam_inbound_webhook_deliveries"
 
-    belongs_to :source, class_name: "Loam::InboundWebhookSource", inverse_of: :deliveries
+    belongs_to :source, class_name: "OpenLoam::InboundWebhookSource", inverse_of: :deliveries
 
     validates :external_id, presence: true
     # (source_id, external_id) uniqueness is enforced by a DB index — the ledger

data/app/models/{loam → open_loam}/inbound_webhook_source.rb

@@ -1,27 +1,27 @@
-module Loam
+module OpenLoam
   # A registered external system allowed to POST webhooks INTO this tenant — the
-  # inbound sibling of Loam::WebhookEndpoint (which delivers events OUT). The
+  # inbound sibling of OpenLoam::WebhookEndpoint (which delivers events OUT). The
   # `token` is the unguessable URL id (`/webhooks/:token`) that identifies the
   # source; the `secret` is the HMAC key that AUTHENTICATES each call. Identity is
   # not authority: rotating either is supported from the admin.
   #
-  # On a verified delivery, Loam publishes `event_name` onto the domain event bus
-  # with a reference to the stored Loam::InboundWebhookDelivery, so durable
-  # subscribers (Loam::DurableEvents) react — the payload itself lives on the row.
-  class InboundWebhookSource < Loam::TenantRecord
-    self.table_name = "loam_inbound_webhook_sources"
+  # On a verified delivery, OpenLoam publishes `event_name` onto the domain event bus
+  # with a reference to the stored OpenLoam::InboundWebhookDelivery, so durable
+  # subscribers (OpenLoam::DurableEvents) react — the payload itself lives on the row.
+  class InboundWebhookSource < OpenLoam::TenantRecord
+    self.table_name = "open_loam_inbound_webhook_sources"
 
-    DEFAULT_SIGNATURE_HEADER = "X-Loam-Signature".freeze
+    DEFAULT_SIGNATURE_HEADER = "X-OpenLoam-Signature".freeze
     DEFAULT_TOLERANCE = 300 # seconds
 
-    has_many :deliveries, class_name: "Loam::InboundWebhookDelivery",
+    has_many :deliveries, class_name: "OpenLoam::InboundWebhookDelivery",
                           foreign_key: :source_id, dependent: :destroy, inverse_of: :source
 
     validates :name, presence: true
     validates :token, presence: true, uniqueness: true
     validates :secret, presence: true
     validates :event_name, presence: true,
-              format: { with: Loam::Events::NAME_FORMAT, message: "must follow domain.thing.happened" }
+              format: { with: OpenLoam::Events::NAME_FORMAT, message: "must follow domain.thing.happened" }
 
     scope :active, -> { where(active: true) }
 
@@ -32,9 +32,9 @@ module Loam
       self.active = true if active.nil?
     end
 
-    # THE blessed cross-tenant lookup (see Loam::ApiToken.authenticate): a public
+    # THE blessed cross-tenant lookup (see OpenLoam::ApiToken.authenticate): a public
     # inbound request arrives with no tenant context — the token in the URL is how
-    # it discovers its tenant. Establishes Loam::Current.tenant (never an actor:
+    # it discovers its tenant. Establishes OpenLoam::Current.tenant (never an actor:
     # the sender is a machine, not a user) and returns the ACTIVE source, or nil.
     def self.resolve(raw_token)
       return nil if raw_token.blank?
@@ -42,7 +42,7 @@ module Loam
       source = unscoped.find_by(token: raw_token)
       return nil unless source&.active?
 
-      Loam::Current.tenant = source.tenant
+      OpenLoam::Current.tenant = source.tenant
       source
     end
 

data/app/models/{loam → open_loam}/membership.rb

@@ -1,27 +1,27 @@
-module Loam
+module OpenLoam
   # Connects an actor (the host app's User) to a tenant with a role. Roles are
   # plain strings ("manager", "employee", ...) — policies interpret them.
   # Tenant-scoped like everything else: asking for someone's role always means
   # "their role in the CURRENT tenant".
-  class Membership < Loam::TenantRecord
-    self.table_name = "loam_memberships"
+  class Membership < OpenLoam::TenantRecord
+    self.table_name = "open_loam_memberships"
 
     belongs_to :user
 
     validates :role, presence: true
     validates :user_id, uniqueness: { scope: :tenant_id }
 
-    # The other blessed cross-tenant lookup (see Loam::ApiToken.authenticate).
+    # The other blessed cross-tenant lookup (see OpenLoam::ApiToken.authenticate).
     # "Which tenants may this person enter?" is asked at login, before any
     # tenant is chosen, so it cannot be answered from inside one — which is why
     # it lives in the gem rather than in host app code, where reaching across
     # tenants is a guardrail failure.
     #
-    # Returns a Loam::Tenant relation, so callers can order/filter it further.
+    # Returns a OpenLoam::Tenant relation, so callers can order/filter it further.
     def self.tenants_for(user)
       user_id = user.respond_to?(:id) ? user.id : user
 
-      Loam::Tenant.where(id: unscoped.where(user_id: user_id).select(:tenant_id)).order(:name)
+      OpenLoam::Tenant.where(id: unscoped.where(user_id: user_id).select(:tenant_id)).order(:name)
     end
   end
 end

data/app/models/{loam → open_loam}/mfa_credential.rb

@@ -1,21 +1,21 @@
 require "bcrypt"
 
-module Loam
+module OpenLoam
   # A user's multi-factor credential: a TOTP secret plus single-use recovery
   # codes. Deliberately NOT tenant-scoped — MFA belongs to the PERSON, who spans
   # tenants, and the second-factor challenge runs at login BEFORE any tenant is
-  # chosen. So the secret is encrypted under a USER-scoped key (Loam::Encryptable
+  # chosen. So the secret is encrypted under a USER-scoped key (OpenLoam::Encryptable
   # `scope:`), which decrypts in any tenant and with no tenant at all — the whole
   # reason a per-tenant key would be a lockout bug here.
   class MfaCredential < ApplicationRecord
-    include Loam::GeneratedKey
-    self.table_name = "loam_mfa_credentials"
+    include OpenLoam::GeneratedKey
+    self.table_name = "open_loam_mfa_credentials"
 
     RECOVERY_CODE_COUNT = 10
 
     belongs_to :user
 
-    include Loam::Encryptable
+    include OpenLoam::Encryptable
     encrypts :totp_secret, scope: ->(credential) { "user/#{credential.user_id}" }
 
     # Recovery codes are stored HASHED (BCrypt), never in the clear: [{ "digest",
@@ -46,7 +46,7 @@ module Loam
     # if the code is wrong. The old secret stays valid until this succeeds, so a
     # half-finished re-enrollment never downgrades an active credential.
     def activate_with!(candidate_secret, code)
-      step = Loam::Totp.matching_step(candidate_secret, code)
+      step = OpenLoam::Totp.matching_step(candidate_secret, code)
       return nil unless step
 
       self.totp_secret = candidate_secret
@@ -66,7 +66,7 @@ module Loam
       return false unless activated?
 
       with_lock do
-        step = Loam::Totp.matching_step(totp_secret, code)
+        step = OpenLoam::Totp.matching_step(totp_secret, code)
         if step && (last_totp_step.nil? || step > last_totp_step)
           update!(last_totp_step: step)
           true
@@ -100,7 +100,7 @@ module Loam
     end
 
     def provisioning_uri(issuer:)
-      Loam::Totp.provisioning_uri(totp_secret, account: user.email, issuer: issuer)
+      OpenLoam::Totp.provisioning_uri(totp_secret, account: user.email, issuer: issuer)
     end
 
     private

data/app/models/{loam → open_loam}/notification.rb

@@ -1,15 +1,15 @@
-module Loam
+module OpenLoam
   # One in-app message for one recipient (`user`) in one tenant. The same
   # person in two tenants has two separate inboxes — like everything else in
-  # Loam, "your notifications" always means "in the current tenant".
+  # OpenLoam, "your notifications" always means "in the current tenant".
   #
-  # Plumbing, not business data: not audited, the same way Loam::AuditRecord
-  # isn't. It IS evented, though — creating one publishes "loam.notification.created"
-  # (carrying the recipient's user_id) so Loam::EventStream can push it to that
+  # Plumbing, not business data: not audited, the same way OpenLoam::AuditRecord
+  # isn't. It IS evented, though — creating one publishes "open_loam.notification.created"
+  # (carrying the recipient's user_id) so OpenLoam::EventStream can push it to that
   # user's browser and the bell updates live. Created through
-  # Loam::Notifications.notify, read through the admin bell.
-  class Notification < Loam::TenantRecord
-    self.table_name = "loam_notifications"
+  # OpenLoam::Notifications.notify, read through the admin bell.
+  class Notification < OpenLoam::TenantRecord
+    self.table_name = "open_loam_notifications"
 
     belongs_to :user
 
@@ -18,9 +18,9 @@ module Loam
     scope :unread, -> { where(read_at: nil) }
 
     # The one signal the real-time bell listens for. Only id + recipient ride the
-    # event (Loam::Events also stamps tenant_id); no message content is broadcast.
+    # event (OpenLoam::Events also stamps tenant_id); no message content is broadcast.
     after_create_commit do
-      Loam::Events.publish("loam.notification.created", id: id, user_id: user_id)
+      OpenLoam::Events.publish("open_loam.notification.created", id: id, user_id: user_id)
     end
 
     # What the notification is about, if anything (source_type/source_id) —