fix: update sanity cors add copy

[mwritter]

Description

Update sanity cors add copy text to include 'Sanity App sdk app' wording alongside studio for clarity, cors applies to both studios and sdk apps.

---

Note

Low Risk
Copy-only change to interactive CLI prompts; no functional behavior or API interactions are modified.

Overview
Updates the sanity cors add interactive credentials warning text to explicitly mention apps built with the Sanity App SDK alongside studios (including the wildcard-origin warning).

Adds a patch changeset for @sanity/cli reflecting the copy update.

^{Reviewed by Cursor Bugbot for commit c455f70. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @mwritter's task in 1m 26s —— View job

---

Review

• Read changed files
• Verify changeset
• Post review

No blocking issues. A couple of minor notes:

1. Changeset summary is internal-flavored — .changeset/pr-1095.md reads fix: update sanity cors add copy. It describes the internal change rather than the user-facing effect, so the changelog entry won't tell a developer what actually changed. Something like Mention App SDK apps in the sanity cors add credential warnings would read better. (It's auto-generated from the PR title, so updating the title would also fix the changeset.)

2. Inconsistent phrasing in the non-wildcard prompt (packages/@sanity/cli/src/commands/cors/add.ts:140) — the first sentence says "a Sanity studio or app" and the next sentence says "a studio or an app built with the Sanity App SDK". Noting it since Bugbot raised the same concern, but I see you've already considered and dismissed this — leaving it as-is is fine.

Verified

• Changeset is appropriate: copy change in packages/ → @sanity/cli: patch is correct.
• No test assertions on changed substrings (add.test.ts:267-268 only checks recommend NOT allowing credentials and on origins containing wildcards, both untouched).
• Coverage on add.ts remains at 100%.
  · Branch fix/aigro-4973

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (a4419d2f)

@sanity/cli

Metric	Value	vs main (a4419d2)
Internal (raw)	2.1 KB	-
Internal (gzip)	799 B	-
Bundled (raw)	10.97 MB	-
Bundled (gzip)	2.06 MB	-
Import time	828ms	-3ms, -0.4%

bin:sanity

Metric	Value	vs main (a4419d2)
Internal (raw)	1023 B	-
Internal (gzip)	486 B	-
Bundled (raw)	9.84 MB	-
Bundled (gzip)	1.77 MB	-
Import time	1.98s	-27ms, -1.4%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (a4419d2f)

Metric	Value	vs main (a4419d2)
Internal (raw)	96.2 KB	-
Internal (gzip)	22.5 KB	-
Bundled (raw)	21.61 MB	-
Bundled (gzip)	3.42 MB	-
Import time	785ms	-13ms, -1.7%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (a4419d2f)

Metric	Value	vs main (a4419d2)
Internal (raw)	976 B	-
Internal (gzip)	507 B	-
Bundled (raw)	50.7 KB	-
Bundled (gzip)	12.6 KB	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[github-actions]

Coverage Delta

File	Statements
packages/@sanity/cli/src/commands/cors/add.ts	100.0% (±0%)

Comparing 1 changed file against main @ a4419d2f90c85e3ba49f86f1b6874eff1eab0894

Overall Coverage

Metric	Coverage
Statements	84.3% (±0%)
Branches	74.3% (±0%)
Functions	84.1% (±0%)
Lines	84.7% (±0%)

[mwritter]

Inconsistent phrasing within the same prompt

I think the wording is fine.