chore(cli): move @sanity/ui to devDependencies

[runeb]

Description

Small cleanup: @sanity/ui was sitting in @sanity/cli's runtime dependencies, but the CLI only references it in a type position (typeof import('@sanity/ui') in resolveSchemaIcon.tsx). The actual runtime load goes through resolveLocalPackageFrom('@sanity/ui', sanityUrl), which is anchored at the studio's node_modules — that's intentional per ce07d42e, to avoid dual-React instances.

So the CLI's own copy of @sanity/ui was never actually reached at runtime — it was just along for the ride on every install. Moving it to devDependencies keeps types working while trimming what we ship.

Measured by packing both versions and npm install-ing each into a clean directory: 56 fewer packages, 27 MB less on disk per standalone install. The shrinkage comes from @sanity/ui itself plus its transitive closure — @sanity/color, @sanity/icons, styled-components, the @emotion/* family, framer-motion, @floating-ui/*, and a handful of markdown/HTML utility packages.

(Note: bundle-stats reports no change because the CLI's published dist/ is byte-identical — swc transpile only, no bundling. The win is install-tree size, not bundle size.)

What to review

One line in packages/@sanity/cli/package.json (plus the lockfile). No source changes, no behavior change.

Testing

pnpm check:types, check:lint, check:deps, build:cli, and the manifest test suite (58/58) all pass locally.

Rebase note

Rebased onto main to clear the lockfile conflict from #1107 (@types/node bump) and #1065 (@sanity/codegen bump). The regenerated lockfile also contains a few incidental, metadata-only changes that reviewers may notice:

• @babel/helper-define-polyfill-provider@0.6.8 consolidated onto resolve@1.22.12 instead of 1.22.11. Both versions already existed in the lockfile on main (different consumers); pnpm just picked the newer of the two it already had.
• That gave resolve@1.22.12 a non-optional consumer, so its optional: true flag (and the cascading flags on its transitive deps is-core-module@2.16.2 and hasown@2.0.3) were dropped. No new packages, no real version bumps — purely pnpm recomputing reachability.

---

Note

Low Risk
Low risk dependency metadata change: moves @sanity/ui from runtime to dev-only for @sanity/cli, with lockfile churn but no functional code changes.

Overview
Reduces @sanity/cli install footprint by moving @sanity/ui from dependencies to devDependencies while keeping TypeScript type imports working.

Adds a changeset to publish a patch release, and updates pnpm-lock.yaml accordingly (including minor pnpm recomputation/metadata changes around resolve and optional flags).

^{Reviewed by Cursor Bugbot for commit e2f17be. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @runeb's task in 1m 23s —— View job

---

Review

No blocking issues. The dependency move is correct and the lockfile/changeset story is consistent with the description.

Verified

• @sanity/ui is only referenced in CLI source as typeof import('@sanity/ui') (type position) at packages/@sanity/cli/src/actions/manifest/resolveSchemaIcon.tsx:43-44. Type-only imports are erased by the compiler, so nothing in the shipped dist/ reaches for @sanity/ui from the CLI's own node_modules.
• The runtime load goes through resolveLocalPackageFrom('@sanity/ui', sanityUrl) where sanityUrl is anchored at the studio's sanity install — confirming the CLI's own copy was unused at runtime.
• Other matches for @sanity/ui in packages/@sanity/cli/src are: string literals in init templates (emitted into generated studio package.jsons — not imports), mocks in tests, and a comment in uploadSchemaToLexicon.ts:91 explicitly avoiding eager import. None of these require @sanity/ui to be a runtime dep of @sanity/cli.
• @sanity/cli-core and @sanity/cli-test do not depend on @sanity/ui either, so no other workspace is masking a transitive runtime path.
• ^3.1.14 is preserved as the devDep version — pnpm check:types, the icon-resolver tests, and the bundle-stats report (dist byte-identical) all line up with that.

Nits (optional)

• .changeset/move-sanity-ui-dev-dependency.md:5 — the summary describes the mechanical move rather than the effect users will notice. Something like Reduce install size by moving @sanity/ui to development dependencies communicates the user-visible win (the 56-package / 27 MB shrink) without changing the patch bump. Not a blocker.

• Inspect the diff (package.json, lockfile, changeset)

• Verify @sanity/ui is only used in type position in CLI source

• Verify changeset metadata and copy

• Post review
  · Branch

[github-actions]

📦 Bundle Stats — @sanity/cli

Compared against main (bf63c5fd)

@sanity/cli

Metric	Value	vs main (bf63c5f)
Internal (raw)	2.1 KB	-
Internal (gzip)	799 B	-
Bundled (raw)	10.97 MB	-
Bundled (gzip)	2.06 MB	-
Import time	843ms	-1ms, -0.1%

bin:sanity

Metric	Value	vs main (bf63c5f)
Internal (raw)	1023 B	-
Internal (gzip)	486 B	-
Bundled (raw)	9.84 MB	-
Bundled (gzip)	1.77 MB	-
Import time	1.97s	-3ms, -0.1%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — @sanity/cli-core

Compared against main (bf63c5fd)

Metric	Value	vs main (bf63c5f)
Internal (raw)	95.5 KB	-
Internal (gzip)	22.5 KB	-
Bundled (raw)	21.61 MB	-
Bundled (gzip)	3.42 MB	-
Import time	793ms	-11ms, -1.4%

🗺️ View treemap · Artifacts

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

📦 Bundle Stats — create-sanity

Compared against main (bf63c5fd)

Metric	Value	vs main (bf63c5f)
Internal (raw)	908 B	-
Internal (gzip)	483 B	-
Bundled (raw)	931 B	-
Bundled (gzip)	491 B	-
Import time	❌ ChildProcess denied: node	-

Details

• Import time regressions over 10% are flagged with ⚠️
• Sizes shown as raw / gzip 🗜️. Internal bytes = own code only. Total bytes = with all dependencies. Import time = Node.js cold-start median.

[github-actions]

Coverage Delta

No covered files changed in this PR.

Overall Coverage

Metric	Coverage
Statements	84.3% (±0%)
Branches	74.3% (±0%)
Functions	84.2% (±0%)
Lines	84.8% (±0%)