fix(ui-kit): declare react-hook-form as a dependency of @loopover/ui-kit

[joaovictor91123]

Summary

@loopover/ui-kit is a real, published npm package (publishConfig.access: "public"). Every other component that wraps an external library declares that library under dependencies — 23 separate @radix-ui/react-* packages plus cmdk, embla-carousel-react, input-otp, react-day-picker, react-resizable-panels, recharts, sonner, tailwind-merge, vaul, class-variance-authority, and clsx. form.tsx imports directly from react-hook-form, but that package was never declared anywhere in packages/loopover-ui-kit/package.json — resolution only succeeded inside this monorepo because npm workspaces hoist apps/loopover-ui's own react-hook-form install to the shared root node_modules. A consumer installing @loopover/ui-kit in isolation (or a workspace member that doesn't happen to hoist it, e.g. apps/loopover-miner-ui) would hit an unresolved import.

• Added react-hook-form to packages/loopover-ui-kit/package.json's dependencies, version-matched to apps/loopover-ui's existing ^7.80.0 range.
• Regenerated package-lock.json to reflect the new declared dependency.
• Added test/unit/ui-kit-manifest-dependencies.test.ts, asserting every external import across the package's non-test src/components/*.tsx files has a matching dependencies/peerDependencies entry — catching this class of gap automatically for any future component instead of only failing for a consumer outside this monorepo's hoisting.

No changes to form.tsx or any other component logic — manifest/lockfile fix plus a drift-check test only.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves — a linked open issue is required for every contributor PR.

Closes #8309

Validation

• git diff --check
• npm run typecheck
• npm run docs:drift-check
• npm run manifest:drift-check
• npm --workspace @loopover/ui-kit run typecheck
• Manually verified the new test's detection logic against both the fixed and (simulated) original-bug states of the manifest, confirming it correctly flags form.tsx: react-hook-form as undeclared when the dependency is absent, and reports nothing once it's declared.
• New or changed behavior has tests for the new branches (scoped-package vs. unscoped, declared-via-peerDependencies vs. declared-via-dependencies, and the failing/undeclared case).

Safety

• No secrets, tokens, wallets, hotkeys/coldkeys, trust scores, reward/payout values, or private scoring anywhere in this diff.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.51%. Comparing base (9adcccb) to head (31f040f).
⚠️ Report is 24 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8494       +/-   ##
===========================================
+ Coverage   79.49%   92.51%   +13.01%     
===========================================
  Files         791      791               
  Lines       79333    79343       +10     
  Branches    23960    23967        +7     
===========================================
+ Hits        63067    73403    +10336     
+ Misses      13112     4807     -8305     
+ Partials     3154     1133     -2021     

Flag	Coverage Δ
shard-1	58.82% <ø> (+3.31%)	⬆️
shard-2	46.94% <ø> (-2.96%)	⬇️
shard-3	55.43% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 241 files with indirect coverage changes

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-24 15:55:40 UTC}

3 files · 1 AI reviewer · no blockers · readiness 95/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds the missing `react-hook-form` declaration to `packages/loopover-ui-kit/package.json`'s dependencies, matching the version already used in `apps/loopover-ui` (`^7.80.0`), regenerates the lockfile accordingly, and adds a drift-check test that walks every non-test component file and asserts each external import has a corresponding dependencies/peerDependencies entry. The manifest fix is correct and matches the existing pattern used for the other 23+ external libraries already declared there (radix packages, cmdk, sonner, etc.). The added test is a genuine regression guard, not a fabricated one — it reads real source files off disk and checks real package.json contents, so it will actually catch a future undeclared import.

Nits — 4 non-blocking

• The `packageNameFromSpecifier` regex-based import scanner in test/unit/ui-kit-manifest-dependencies.test.ts won't catch imports without a `from` clause (e.g. bare `import "some-pkg/polyfill"`) or type-only `import type {...} from "pkg"` re-exports across multiple lines with nested braces — likely fine for this codebase's current style but worth a one-line comment noting the scanner's known limits.
• package-lock.json's size is expected for a lockfile regeneration and isn't a real maintainability concern despite the automated size-smell flag.
• Consider asserting the declared version range in package.json exactly matches apps/loopover-ui's `^7.80.0` (not just presence) in the new test, to prevent future version drift between the two.
• No action needed beyond what's here — the change is narrow and well-scoped to the stated dependency gap.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8309
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 183 registered-repo PR(s), 83 merged, 5 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	joaovictor91123; Gittensor profile; 183 PR(s), 5 issue(s).
Improvement	ℹ️ Insufficient signal	risk: clean · value: insufficient-signal · LLM: moderate

Linked issue satisfaction

Addressed
The PR adds react-hook-form to packages/loopover-ui-kit/package.json's dependencies with a version matching apps/loopover-ui's ^7.80.0, updates package-lock.json accordingly, and adds a new test asserting all external imports in ui-kit components have corresponding manifest entries, satisfying all three stated deliverables.

Review context

• Author: joaovictor91123
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 183 PR(s), 5 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.