# Rewind recovery demo

Run one command with Node.js 24 or later:

```sh
npx --yes https://rewind.kanishq.dev/integrations/rewind-cli-0.2.0.tgz demo
```

The package is downloaded directly from Rewind. It is not an npm registry listing. It contains the client, recorder and recovery adapter, never the hosted application, server credentials or database. No installation scripts or runtime dependencies are used.

1. Open the Connect link printed by the command. Sign in, choose a workspace and create a recording key and a worker key there.
2. Paste the keys into the hidden terminal prompts. They stay in memory; the CLI never saves them. Environment variables `REWIND_RECORD_KEY` and `REWIND_WORKER_KEY` are supported. Never put secrets in command arguments or chat.
3. The command creates one private synthetic local row, changes `active` to `inactive`, and records its real before/after values in that workspace. This uses one operation of the current history allowance.
4. In Rewind, preview and approve the named **CLI disposable recovery demo** run. An API key cannot approve it.
5. The bundled worker checks only the uniquely named demo connection. After recovery it independently reads the local provider and verifies the restored value and version. No n8n installation or real provider credential is needed.

This proves the disposable connected path. It does not protect an existing integration automatically. For your real workflow, follow [n8n/Supabase setup](https://rewind.kanishq.dev/n8n-supabase-recovery) or the [JavaScript guide](https://rewind.kanishq.dev/integrations/sdk-quickstart.md), and verify the actual provider state yourself.

## Resume and conflict check

State lives in `~/.rewind/demo`, with private directory/file permissions. It contains the synthetic provider state, receipts, recorder outbox, recovery journal and a local `status.json` after independent verification. No telemetry service or additional tracking event is used. Normal recordings and worker outcomes appear in hosted Rewind history. Keep the original keys while resuming; revoke the demo keys in Connect when finished.

Ctrl+C or the default 15-minute approval timeout preserves the provider's value and version. Run the same command with the same keys to resume. A completed demo stays completed; it does not create another operation on replay. `--new` explicitly creates a separate state directory; the command prints its path, which must be supplied with `--state-dir PATH` to resume it. Never start a new demo to bypass an unresolved write or report.

```sh
# Check key scopes and workspace before any provider change:
npx --yes https://rewind.kanishq.dev/integrations/rewind-cli-0.2.0.tgz doctor

# Fresh disposable run with a later edit that recovery must preserve:
npx --yes https://rewind.kanishq.dev/integrations/rewind-cli-0.2.0.tgz demo --new --conflict
```

The CLI never claims jobs on your normal production connections. The local provider is bound to loopback, protected by a process-local token and implements conditional writes. Only synthetic `active`, `inactive` and `later-edit` statuses are supported. A crash between a write and durable receipt or result persistence stops automatic replay; inspect the saved state. Worker-reported success without an independent matching provider read is not reported as verified.

This is a client for the free hosted beta. Existing Rewind and provider limits still apply. No subscription or card is required. No general-purpose shell execution, auto-approval, database discovery or arbitrary provider writes are performed.

## Read-only n8n monitoring

Use `rewind monitor --config monitor.json --once` to check setup, then omit `--once` for continuous polling. Follow the [complete monitoring guide](https://rewind.kanishq.dev/n8n-monitor). Set separate n8n and Rewind monitoring keys in private environment variables. The config references environment-variable names only; never put secrets in it. One key identifies one instance, and up to five instances may be configured.

The connector issues GET requests to n8n workflow/execution list endpoints, discards all node definitions, pinned data, payloads and raw errors, and uploads only allowlisted metadata to the canonical Rewind server. It never edits, runs or retries workflows. Non-Enterprise n8n API keys have broader permissions than the connector uses. Keep your machine and environment secure.

`--interval 180..3600` controls polling (default 180 seconds). Stop with Ctrl+C. Run it on your own always-on infrastructure for continuous updates; Rewind does not host this process. A stopped connector produces stale snapshots, not a guaranteed outage alarm. The API must be enabled and is not available on n8n Cloud trials.