fix(webhooks): make the SDK browser-bundle-safe (namespace import of node:crypto) (#4)

webhooks.ts did a NAMED import of node:crypto (createHmac, timingSafeEqual).
Because the package index re-exports verifyWebhook, any bundler building an app
that imports the SDK (Vite/webpack/rollup) externalizes node:crypto to an empty
module and then ERRORS on the missing named exports - so the SDK could not be
bundled for the browser at all (found while building a browser demo).

Switch to a namespace import (import * as nodeCrypto) and reference
nodeCrypto.createHmac / nodeCrypto.timingSafeEqual. Browser bundles now build
(a single benign 'externalized for browser' warning instead of a hard error);
verifyWebhook stays synchronous and works unchanged in Node, where it actually
runs. No API change. 17 tests still green. Bump 0.1.2 -> 0.1.3.

Author: mik3fly

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mik3fly-lab/rektradar-sdk",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Official SDK for the RektRadar API - Ethereum scam & rug-pull detection (token risk scores, flags, live rug feed, webhooks).",
   "type": "module",
   "main": "./dist/index.js",

src/webhooks.ts

@@ -1,4 +1,10 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
+// Namespace import (not named) so browser bundlers don't choke. verifyWebhook
+// is server-only - a browser never receives webhooks - but the SDK's index
+// re-exports it, and a *named* `node:crypto` import makes Vite/webpack/rollup
+// fail to build ANY app that imports the SDK (they externalize node:crypto to an
+// empty module, then error on the missing named exports). A namespace import
+// only warns; the functions stay reachable in Node where verifyWebhook runs.
+import * as nodeCrypto from "node:crypto";
 
 /**
  * Verify a RektRadar webhook signature.
@@ -21,11 +27,11 @@ export function verifyWebhook(rawBody: string, signature: string, secret: string
   if (!signature || !secret) {
     return false;
   }
-  const expected = `sha256=${createHmac("sha256", secret).update(rawBody, "utf8").digest("hex")}`;
+  const expected = `sha256=${nodeCrypto.createHmac("sha256", secret).update(rawBody, "utf8").digest("hex")}`;
   const provided = Buffer.from(signature);
   const computed = Buffer.from(expected);
   if (provided.length !== computed.length) {
     return false;
   }
-  return timingSafeEqual(provided, computed);
+  return nodeCrypto.timingSafeEqual(provided, computed);
 }