## Problem Headless SDK examples use environment variables that are inconsistent or unnecessarily manual: - `DRUPAL_BASE_URL` differs from the `CANVAS_SITE_URL` name used by the CLI and Workbench. - `DRAFT_ALLOWED_FRAME_ANCESTORS` duplicates the Canvas editor origin already present in signed draft-session data and can drift from the actual site configuration. ## Proposed resolution - Rename `DRUPAL_BASE_URL` to `CANVAS_SITE_URL` across SDK packages, examples, and documentation. - Remove `DRAFT_ALLOWED_FRAME_ANCESTORS`. - Keep CSP protection, but derive the exact Canvas editor origin from the signed renewal URL. - Use that origin for both `frame-ancestors` and draft-session `postMessage` validation. - Keep component metadata synchronization server-to-server without browser CORS configuration. ## Acceptance criteria - No references to either legacy environment variable remain. - All example apps load inside Canvas. - Draft activation and in-place renewal work. - CSP permits only the app itself and the originating Canvas site. - Component metadata synchronization continues to work.