@vaultcompass/vault-guard-telemetry 1.4.1 → 1.4.2

package/README.md

@@ -8,7 +8,7 @@ Opt-in, **local-only** store for [Vault Guard](https://github.com/vaultcompasshq
 npm install @vaultcompass/vault-guard-telemetry
 ```
 
-Requires **Node.js 22+** and native `better-sqlite3` bindings (rebuilt automatically on `npm install`).
+Requires **Node.js 22+**. Native `better-sqlite3` bindings are rebuilt automatically on `npm install` where a prebuilt binary or a working compiler toolchain is available, but they are an **optional dependency**: if the install cannot produce them (for example a Windows machine without the Visual Studio build tools, or an `--ignore-scripts` install), the package still installs and still works. See "Graceful degradation" below.
 
 ## Quickstart
 
@@ -38,26 +38,22 @@ const status = store.getStatuslinePayload();
 
 ## Graceful degradation
 
-If `better-sqlite3` bindings are missing (e.g. install with `--ignore-scripts`), catch `TelemetryUnavailableError` and skip telemetry features:
+`new TelemetryStore()` never throws, even when `better-sqlite3` native bindings are missing or incompatible. In that case the store quietly becomes a no-op: every `record*` call does nothing, and every `get*`/`export*`/`suggestModel` call returns an empty or zeroed result of the normal shape (an empty array, a statusline payload with every count at zero, a suggestion with `suggested_model: null`) instead of raising an error. There is no exception to catch and no per-call special case to write:
 
 ```typescript
-import {
-  TelemetryStore,
-  TelemetryUnavailableError,
-} from '@vaultcompass/vault-guard-telemetry';
-
-try {
-  const store = new TelemetryStore();
-  console.log(store.getStatuslinePayload());
-} catch (err) {
-  if (err instanceof TelemetryUnavailableError) {
-    // Telemetry optional; continue without it
-  } else {
-    throw err;
-  }
-}
+import { TelemetryStore } from '@vaultcompass/vault-guard-telemetry';
+
+const store = new TelemetryStore();
+store.recordUsage({ model: 'claude-sonnet-4-20250514', inputTokens: 1200, outputTokens: 340 });
+console.log(store.getStatuslinePayload());
+// Works identically whether or not better-sqlite3 loaded; with it missing,
+// recordUsage recorded nothing and getStatuslinePayload reports all zeros.
 ```
 
+Call `store.isAvailable()` when you specifically need to distinguish "telemetry is working" from "telemetry degraded to a no-op" (the CLI's `data status` and `data export` commands do this, since their whole purpose is inspecting telemetry and an all-zero result would otherwise look identical to "no usage yet"). `store.getUnavailableReason()` returns the underlying reason as a string, or `null` when available. `TelemetryUnavailableError` stays exported for callers that inject their own loader (tests, or a factory such as the MCP server's `telemetryFactory`) and want to signal the same failure mode themselves; the store no longer throws it internally.
+
+A missing native binding is noted at most once per process, and only when `VG_DEBUG=1` is set in the environment. Telemetry is opt-in local tooling, so it must never print a warning on every command (this matters most for `statusline`, which an editor can invoke every few seconds).
+
 ## CLI usage (recommended for end users)
 
 Most users interact with telemetry through the main CLI, not this package directly:

package/dist/store.d.ts

@@ -1,30 +1,16 @@
 /**
- * Thrown when `better-sqlite3` native bindings are missing or incompatible.
- *
- * This happens when:
+ * Thrown internally when `better-sqlite3` native bindings are missing or
+ * incompatible. This happens when:
  *   - The package was installed with `--ignore-scripts` (skips node-gyp compile)
  *   - The Node.js ABI changed after install (e.g. nvm version switch)
- *   - The pre-built binary is missing for the current platform/arch
- *
- * Callers that don't strictly need telemetry should catch this and degrade
- * gracefully (e.g. `statusline` and `suggest-model`). The `proxy` command
- * intentionally lets this propagate — it is the primary telemetry writer and
- * should fail loudly rather than silently discard usage data.
+ *   - The pre-built binary is missing for the current platform/arch (e.g. a
+ *     Windows install where node-gyp could not find a Visual Studio toolchain)
  *
- * @example
- * ```ts
- * try {
- *   const store = new TelemetryStore();
- *   const payload = store.getStatuslinePayload();
- *   console.log(payload);
- * } catch (err) {
- *   if (err instanceof TelemetryUnavailableError) {
- *     console.error('Telemetry unavailable:', err.message);
- *   } else {
- *     throw err;
- *   }
- * }
- * ```
+ * {@link TelemetryStore} catches this internally and degrades to a no-op
+ * store rather than letting it escape the constructor. See "Graceful
+ * degradation" below. It stays exported for callers that want to distinguish
+ * this failure mode from a genuine bug when they inject their own loader
+ * (tests, or a factory such as the MCP server's `telemetryFactory`).
  */
 export declare class TelemetryUnavailableError extends Error {
     constructor(cause: unknown);
@@ -169,8 +155,35 @@ export declare class TelemetryStore {
     private readonly db;
     private readonly counter;
     private readonly saltBuf;
+    private readonly available;
+    private readonly unavailableMessage;
     private lastRetentionPurgeMs;
+    /**
+     * @param dbPath Defaults to `~/.vault-guard/usage.sqlite`.
+     *
+     * Never throws, even when `better-sqlite3` native bindings are missing or
+     * incompatible: in that case the store degrades to a no-op (see
+     * {@link isAvailable}) instead of raising {@link TelemetryUnavailableError}.
+     */
     constructor(dbPath?: string);
+    /** True when `better-sqlite3` loaded and this store is backed by a real DB. */
+    isAvailable(): boolean;
+    /**
+     * Human-readable reason telemetry is unavailable, or `null` when
+     * {@link isAvailable} is true. Lets callers that are specifically about
+     * inspecting telemetry (`vault-guard data status`, `data export`) report
+     * "unavailable" explicitly rather than silently show all-zero results.
+     */
+    getUnavailableReason(): string | null;
+    /**
+     * Non-null accessor for the handful of private methods that only ever run
+     * from inside `if (this.db)` (constructor init) or after an
+     * `isAvailable`/`this.db` guard in a public method. Never reachable while
+     * degraded; exists so those method bodies don't each repeat the guard.
+     */
+    private requireDb;
+    /** Same invariant as {@link requireDb}: only ever reached while available, where saltBuf is always set alongside db. */
+    private requireSalt;
     /**
      * One-time migration (pragma `user_version` < 2): replace plaintext `cwd`
      * values with HMAC-SHA256 hex digests using the current salt file.
@@ -179,9 +192,11 @@ export declare class TelemetryStore {
     /**
      * Delete rows older than {@link getTelemetryRetentionDays}. Throttled to at
      * most once per hour per process to avoid hammering SQLite on hot paths.
+     * No-op when the store is unavailable.
      */
     private maybePurgeStaleRows;
     private initSchema;
+    /** No-op when the store is unavailable: there is no handle to close. */
     close(): void;
     /**
      * Force a WAL checkpoint (TRUNCATE) and close the database.
@@ -194,17 +209,22 @@ export declare class TelemetryStore {
      * with no recovery surprises.
      *
      * Best-effort: if the pragma fails (e.g. handle already closed by another
-     * shutdown path) we still attempt to close the underlying handle.
+     * shutdown path) we still attempt to close the underlying handle. No-op
+     * when the store is unavailable.
      */
     closeAndCheckpoint(): void;
+    /** No-op (records nothing) when the store is unavailable. */
     recordUsage(input: UsageRecordInput): void;
+    /** No-op (records nothing) when the store is unavailable. */
     recordSession(input: SessionRecordInput): void;
-    /** Count session events that represent blocked secrets today (UTC date). */
+    /** Count session events that represent blocked secrets today (UTC date). Returns 0 when unavailable. */
     secretsBlockedToday(day?: string): number;
+    /** Returns a zeroed payload (never throws) when the store is unavailable. */
     getStatuslinePayload(now?: Date): StatuslineJson;
     /**
      * Heuristic model hint from the last 7 days of session + usage data.
      * Prefer models with more usage and lower revert_rate when session metrics exist.
+     * Returns an empty suggestion (never throws) when the store is unavailable.
      */
     suggestModel(opts?: {
         cwd?: string;
@@ -214,14 +234,16 @@ export declare class TelemetryStore {
      * Read all rows from `usage_events` ordered by `id ASC`.
      *
      * Intended for `vault-guard data export`. Returns raw `cwd` strings — see
-     * {@link DataStatusJson} for the privacy-respecting alternative.
+     * {@link DataStatusJson} for the privacy-respecting alternative. Returns an
+     * empty array (never throws) when the store is unavailable.
      */
     exportUsageEvents(): UsageEventRow[];
     /**
      * Read all rows from `session_events` ordered by `id ASC`.
      *
      * Intended for `vault-guard data export`. Returns raw `cwd` strings and
-     * the `extra_json` payload as stored.
+     * the `extra_json` payload as stored. Returns an empty array (never
+     * throws) when the store is unavailable.
      */
     exportSessionEvents(): SessionEventRow[];
     /**

package/dist/store.js

@@ -23,32 +23,18 @@ const _require = (0, module_1.createRequire)(__filename);
 // TelemetryUnavailableError
 // ---------------------------------------------------------------------------
 /**
- * Thrown when `better-sqlite3` native bindings are missing or incompatible.
- *
- * This happens when:
+ * Thrown internally when `better-sqlite3` native bindings are missing or
+ * incompatible. This happens when:
  *   - The package was installed with `--ignore-scripts` (skips node-gyp compile)
  *   - The Node.js ABI changed after install (e.g. nvm version switch)
- *   - The pre-built binary is missing for the current platform/arch
- *
- * Callers that don't strictly need telemetry should catch this and degrade
- * gracefully (e.g. `statusline` and `suggest-model`). The `proxy` command
- * intentionally lets this propagate — it is the primary telemetry writer and
- * should fail loudly rather than silently discard usage data.
+ *   - The pre-built binary is missing for the current platform/arch (e.g. a
+ *     Windows install where node-gyp could not find a Visual Studio toolchain)
  *
- * @example
- * ```ts
- * try {
- *   const store = new TelemetryStore();
- *   const payload = store.getStatuslinePayload();
- *   console.log(payload);
- * } catch (err) {
- *   if (err instanceof TelemetryUnavailableError) {
- *     console.error('Telemetry unavailable:', err.message);
- *   } else {
- *     throw err;
- *   }
- * }
- * ```
+ * {@link TelemetryStore} catches this internally and degrades to a no-op
+ * store rather than letting it escape the constructor. See "Graceful
+ * degradation" below. It stays exported for callers that want to distinguish
+ * this failure mode from a genuine bug when they inject their own loader
+ * (tests, or a factory such as the MCP server's `telemetryFactory`).
  */
 class TelemetryUnavailableError extends Error {
     constructor(cause) {
@@ -60,6 +46,27 @@ class TelemetryUnavailableError extends Error {
     }
 }
 exports.TelemetryUnavailableError = TelemetryUnavailableError;
+// ---------------------------------------------------------------------------
+// Once-per-process "unavailable" notice
+// ---------------------------------------------------------------------------
+let hasNotedUnavailable = false;
+/**
+ * Graceful degradation, in one place: when the native binding can't load,
+ * every {@link TelemetryStore} entry point (record*, get*, export*) becomes a
+ * safe no-op instead of throwing. This function logs that fact **at most
+ * once per process**, and only when `VG_DEBUG=1` is set. Telemetry is
+ * opt-in local tooling, so a missing native binding must never print a
+ * warning on every command (`statusline` in particular can be invoked by an
+ * editor every few seconds).
+ */
+function noteTelemetryUnavailable(cause) {
+    if (hasNotedUnavailable)
+        return;
+    hasNotedUnavailable = true;
+    if (process.env.VG_DEBUG === '1') {
+        process.stderr.write(`vault-guard telemetry: native bindings unavailable, recording nothing this run: ${String(cause)}\n`);
+    }
+}
 let _DbClass = null;
 function getDbClass() {
     if (_DbClass)
@@ -153,53 +160,116 @@ class TelemetryStore {
     db;
     counter = new vault_guard_core_1.TokenCounter();
     saltBuf;
+    available;
+    unavailableMessage;
     lastRetentionPurgeMs = 0;
+    /**
+     * @param dbPath Defaults to `~/.vault-guard/usage.sqlite`.
+     *
+     * Never throws, even when `better-sqlite3` native bindings are missing or
+     * incompatible: in that case the store degrades to a no-op (see
+     * {@link isAvailable}) instead of raising {@link TelemetryUnavailableError}.
+     */
     constructor(dbPath) {
         const resolved = dbPath ?? defaultDbPath();
-        const dir = path_1.default.dirname(resolved);
-        fs_1.default.mkdirSync(dir, { recursive: true });
-        this.saltBuf = getOrCreateTelemetrySalt();
-        // getDbClass() throws TelemetryUnavailableError if bindings missing.
-        this.db = new (getDbClass())(resolved);
-        this.db.pragma('journal_mode = WAL');
-        this.initSchema();
-        this.applyTelemetryMigrations();
-        this.maybePurgeStaleRows();
+        let db = null;
+        let salt = null;
+        let unavailableMessage = null;
+        try {
+            const DbCtor = getDbClass(); // throws TelemetryUnavailableError if bindings missing.
+            const dir = path_1.default.dirname(resolved);
+            fs_1.default.mkdirSync(dir, { recursive: true });
+            salt = getOrCreateTelemetrySalt();
+            const opened = new DbCtor(resolved);
+            opened.pragma('journal_mode = WAL');
+            db = opened;
+        }
+        catch (err) {
+            db = null;
+            salt = null;
+            unavailableMessage = new TelemetryUnavailableError(err).message;
+            noteTelemetryUnavailable(err);
+        }
+        this.db = db;
+        this.saltBuf = salt;
+        this.available = db !== null;
+        this.unavailableMessage = unavailableMessage;
+        if (this.db) {
+            this.initSchema();
+            this.applyTelemetryMigrations();
+            this.maybePurgeStaleRows();
+        }
+    }
+    /** True when `better-sqlite3` loaded and this store is backed by a real DB. */
+    isAvailable() {
+        return this.available;
+    }
+    /**
+     * Human-readable reason telemetry is unavailable, or `null` when
+     * {@link isAvailable} is true. Lets callers that are specifically about
+     * inspecting telemetry (`vault-guard data status`, `data export`) report
+     * "unavailable" explicitly rather than silently show all-zero results.
+     */
+    getUnavailableReason() {
+        return this.unavailableMessage;
+    }
+    /**
+     * Non-null accessor for the handful of private methods that only ever run
+     * from inside `if (this.db)` (constructor init) or after an
+     * `isAvailable`/`this.db` guard in a public method. Never reachable while
+     * degraded; exists so those method bodies don't each repeat the guard.
+     */
+    requireDb() {
+        if (!this.db) {
+            throw new Error('vault-guard telemetry: internal invariant violated (db unavailable)');
+        }
+        return this.db;
+    }
+    /** Same invariant as {@link requireDb}: only ever reached while available, where saltBuf is always set alongside db. */
+    requireSalt() {
+        if (!this.saltBuf) {
+            throw new Error('vault-guard telemetry: internal invariant violated (salt unavailable)');
+        }
+        return this.saltBuf;
     }
     /**
      * One-time migration (pragma `user_version` < 2): replace plaintext `cwd`
      * values with HMAC-SHA256 hex digests using the current salt file.
      */
     applyTelemetryMigrations() {
-        const ver = Number(this.db.pragma('user_version', { simple: true }));
+        const db = this.requireDb();
+        const ver = Number(db.pragma('user_version', { simple: true }));
         if (ver >= 2)
             return;
-        const salt = this.saltBuf;
-        const uRows = this.db
+        const salt = this.requireSalt();
+        const uRows = db
             .prepare(`SELECT id, cwd FROM usage_events WHERE cwd IS NOT NULL AND cwd != ''`)
             .all();
-        const uUpd = this.db.prepare(`UPDATE usage_events SET cwd = ? WHERE id = ?`);
+        const uUpd = db.prepare(`UPDATE usage_events SET cwd = ? WHERE id = ?`);
         for (const r of uRows) {
             if (isStoredCwdDigest(r.cwd))
                 continue;
             uUpd.run(hashCwdForStore(r.cwd, salt), r.id);
         }
-        const sRows = this.db
+        const sRows = db
             .prepare(`SELECT id, cwd FROM session_events WHERE cwd IS NOT NULL AND cwd != ''`)
             .all();
-        const sUpd = this.db.prepare(`UPDATE session_events SET cwd = ? WHERE id = ?`);
+        const sUpd = db.prepare(`UPDATE session_events SET cwd = ? WHERE id = ?`);
         for (const r of sRows) {
             if (isStoredCwdDigest(r.cwd))
                 continue;
             sUpd.run(hashCwdForStore(r.cwd, salt), r.id);
         }
-        this.db.pragma('user_version = 2');
+        db.pragma('user_version = 2');
     }
     /**
      * Delete rows older than {@link getTelemetryRetentionDays}. Throttled to at
      * most once per hour per process to avoid hammering SQLite on hot paths.
+     * No-op when the store is unavailable.
      */
     maybePurgeStaleRows() {
+        if (!this.db)
+            return;
         const days = getTelemetryRetentionDays();
         if (days <= 0)
             return;
@@ -212,7 +282,8 @@ class TelemetryStore {
         this.db.prepare(`DELETE FROM session_events WHERE created_at < ?`).run(cutoff);
     }
     initSchema() {
-        this.db.exec(`
+        const db = this.requireDb();
+        db.exec(`
       CREATE TABLE IF NOT EXISTS usage_events (
         id INTEGER PRIMARY KEY AUTOINCREMENT,
         created_at TEXT NOT NULL,
@@ -242,8 +313,9 @@ class TelemetryStore {
       CREATE INDEX IF NOT EXISTS idx_session_type ON session_events(event_type);
     `);
     }
+    /** No-op when the store is unavailable: there is no handle to close. */
     close() {
-        this.db.close();
+        this.db?.close();
     }
     /**
      * Force a WAL checkpoint (TRUNCATE) and close the database.
@@ -256,9 +328,12 @@ class TelemetryStore {
      * with no recovery surprises.
      *
      * Best-effort: if the pragma fails (e.g. handle already closed by another
-     * shutdown path) we still attempt to close the underlying handle.
+     * shutdown path) we still attempt to close the underlying handle. No-op
+     * when the store is unavailable.
      */
     closeAndCheckpoint() {
+        if (!this.db)
+            return;
         try {
             this.db.pragma('wal_checkpoint(TRUNCATE)');
         }
@@ -272,7 +347,10 @@ class TelemetryStore {
             // Best-effort: nothing useful we can do on shutdown if close throws.
         }
     }
+    /** No-op (records nothing) when the store is unavailable. */
     recordUsage(input) {
+        if (!this.db)
+            return;
         this.maybePurgeStaleRows();
         const created = (input.createdAt ?? new Date()).toISOString();
         let cost = input.estCostUsd;
@@ -289,9 +367,12 @@ class TelemetryStore {
       INSERT INTO usage_events (created_at, provider, model, cwd, input_tokens, output_tokens, est_cost_usd, source)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
     `);
-        stmt.run(created, input.provider ?? 'unknown', input.model ?? null, hashCwdForStore(input.cwd, this.saltBuf), input.inputTokens, input.outputTokens, cost, input.source ?? null);
+        stmt.run(created, input.provider ?? 'unknown', input.model ?? null, hashCwdForStore(input.cwd, this.requireSalt()), input.inputTokens, input.outputTokens, cost, input.source ?? null);
     }
+    /** No-op (records nothing) when the store is unavailable. */
     recordSession(input) {
+        if (!this.db)
+            return;
         this.maybePurgeStaleRows();
         const created = (input.createdAt ?? new Date()).toISOString();
         const extra = input.extra && Object.keys(input.extra).length > 0 ? JSON.stringify(input.extra) : null;
@@ -301,19 +382,32 @@ class TelemetryStore {
         lines_accepted, lines_suggested, lines_reverted, extra_json
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
-        stmt.run(created, input.eventType, input.model ?? null, hashCwdForStore(input.cwd, this.saltBuf), input.language ?? null, input.linesAccepted ?? null, input.linesSuggested ?? null, input.linesReverted ?? null, extra);
+        stmt.run(created, input.eventType, input.model ?? null, hashCwdForStore(input.cwd, this.requireSalt()), input.language ?? null, input.linesAccepted ?? null, input.linesSuggested ?? null, input.linesReverted ?? null, extra);
     }
-    /** Count session events that represent blocked secrets today (UTC date). */
+    /** Count session events that represent blocked secrets today (UTC date). Returns 0 when unavailable. */
     secretsBlockedToday(day = utcDayStart()) {
+        if (!this.db)
+            return 0;
         const row = this.db
             .prepare(`SELECT COUNT(*) AS c FROM session_events
          WHERE event_type = 'secret_blocked' AND substr(created_at, 1, 10) = ?`)
             .get(day);
         return row.c;
     }
+    /** Returns a zeroed payload (never throws) when the store is unavailable. */
     getStatuslinePayload(now = new Date()) {
         const day = utcDayStart(now);
         const windowStart = `${day}T00:00:00.000Z`;
+        if (!this.db) {
+            return {
+                secrets_today: 0,
+                tokens_today_input: 0,
+                tokens_today_output: 0,
+                est_cost_usd: 0,
+                model: null,
+                window_start_utc: windowStart,
+            };
+        }
         const usage = this.db
             .prepare(`SELECT
            COALESCE(SUM(input_tokens), 0) AS tin,
@@ -339,8 +433,16 @@ class TelemetryStore {
     /**
      * Heuristic model hint from the last 7 days of session + usage data.
      * Prefer models with more usage and lower revert_rate when session metrics exist.
+     * Returns an empty suggestion (never throws) when the store is unavailable.
      */
     suggestModel(opts = {}) {
+        if (!this.db) {
+            return {
+                suggested_model: null,
+                reason: 'Telemetry is unavailable (better-sqlite3 native bindings not installed); no suggestion.',
+                by_model: [],
+            };
+        }
         const since = new Date();
         since.setUTCDate(since.getUTCDate() - 7);
         const sinceIso = since.toISOString();
@@ -409,9 +511,12 @@ class TelemetryStore {
      * Read all rows from `usage_events` ordered by `id ASC`.
      *
      * Intended for `vault-guard data export`. Returns raw `cwd` strings — see
-     * {@link DataStatusJson} for the privacy-respecting alternative.
+     * {@link DataStatusJson} for the privacy-respecting alternative. Returns an
+     * empty array (never throws) when the store is unavailable.
      */
     exportUsageEvents() {
+        if (!this.db)
+            return [];
         return this.db
             .prepare(`SELECT id, created_at, provider, model, cwd, input_tokens, output_tokens, est_cost_usd, source
          FROM usage_events ORDER BY id ASC`)
@@ -421,9 +526,12 @@ class TelemetryStore {
      * Read all rows from `session_events` ordered by `id ASC`.
      *
      * Intended for `vault-guard data export`. Returns raw `cwd` strings and
-     * the `extra_json` payload as stored.
+     * the `extra_json` payload as stored. Returns an empty array (never
+     * throws) when the store is unavailable.
      */
     exportSessionEvents() {
+        if (!this.db)
+            return [];
         return this.db
             .prepare(`SELECT id, created_at, event_type, model, cwd, language,
                 lines_accepted, lines_suggested, lines_reverted, extra_json
@@ -461,6 +569,25 @@ class TelemetryStore {
             }
         })
             .filter((x) => x !== null);
+        // File-level facts (db_exists / db_size_bytes / last_write_iso / sidecars)
+        // come from fs, not the DB handle, so they stay accurate even when the
+        // store is unavailable. Row-level facts default to zero/null below.
+        if (!this.db) {
+            return {
+                db_path: dbFilePath,
+                db_exists: dbExists,
+                db_size_bytes: dbSize,
+                last_write_iso: lastWriteIso,
+                sidecars,
+                usage_events: 0,
+                session_events: 0,
+                earliest_event_iso: null,
+                latest_event_iso: null,
+                distinct_cwd_count: 0,
+                distinct_model_count: 0,
+                last_model: null,
+            };
+        }
         // COUNT(*) on indexed tables is cheap; we don't need to bound it.
         const usageEvents = this.db.prepare('SELECT COUNT(*) AS n FROM usage_events').get().n;
         const sessionEvents = this.db.prepare('SELECT COUNT(*) AS n FROM session_events').get().n;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-telemetry",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Local-only Anthropic token cost and session tracking via the Vault Guard proxy. No cloud.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -22,8 +22,10 @@
   },
   "license": "MIT",
   "dependencies": {
-    "better-sqlite3": "^13.0.2",
-    "@vaultcompass/vault-guard-core": "1.4.1"
+    "@vaultcompass/vault-guard-core": "1.4.2"
+  },
+  "optionalDependencies": {
+    "better-sqlite3": "^13.0.2"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.12",