# No external secrets required.
# Canvas + cooldown state live inside the CanvasRoom Durable Object (SQLite).
# Configurable Worker vars (set via wrangler.json or `wrangler secret put`):
#   ALLOWED_ORIGINS  - comma-separated WebSocket origin allowlist (empty = allow all)
#   ENVIRONMENT      - "production" enables fail-closed identity resolution