[anilkreddy]

Summary

• allows the CommerceKit Vite origin http://localhost:5173 alongside https://commercekit.tools
• keeps exact-origin matching and rejection of unlisted origins
• aligns generated local configuration and Worker binding types with the deployed source of truth
• documents the comma-separated allowlist and adds simple-request and preflight regression coverage for both origins

Problem

The CCv2 API reference and Playground call the Sandbox directly from the browser. During CommerceKit local development, the Worker returned successful responses without Access-Control-Allow-Origin because its source-controlled ALLOWED_ORIGINS contained only the production website. Browsers therefore blocked the response from http://localhost:5173.

Validation

• pnpm run ci
  • generated Worker types check
  • formatting and lint
  • TypeScript
  • Management and Control OpenAPI validation
  • 59 Worker-runtime tests
  • Wrangler deployment dry run

Deployment

Cloudflare Workers Builds remains the deployment owner. Merging this PR will publish the updated runtime variable through the existing deployment; no manual deployment, wildcard CORS rule, credential change, or website proxy is required.