Library
01 · Capture — iOS Shortcut / browser

Shortcut "Humane" (Share Sheet)

Accepts URLs + Text from any app. Normalizes the link — regex replace \?.* → "" strips ?igsh=… tracking so dedup keys on the canonical URL.

Then a raw REST call, no SDK: POST /rest/v1/inbox_links?on_conflict=url — headers apikey: <anon> · Authorization: Bearer <anon> · Content-Type: application/json · Prefer: resolution=ignore-duplicates — body {"url": <cleaned link>}. Re-sharing the same reel is a silent no-op.

/add page (fallback + monitor)

Static HTML in a Squarespace code block, anon key baked in. Same insert via fetch(), plus GET …?status=eq.pending&order=created_at.desc to render the live queue — doubles as a health check without touching the PC.

The anon key is public by design — RLS below is what makes that safe
02 · Queue — Supabase (Postgres + PostgREST)

The queue is the only state in the system

create table inbox_links (
  id  bigint generated always as identity primary key,
  url  text unique not null, -- dedup constraint the upsert targets
  status  text default 'pending', -- pending → done; failures stay pending
  created_at  timestamptz default now() );

Row-level security on. Two policies for anon: INSERT and SELECT only — the public key physically cannot update or delete. The service_role key (PC only, in config.json) is what flips status.

Polled, not pushed — Task Scheduler: at logon + daily 02:00 with WakeToRun. No webhook, no listener, nothing exposed
03 · Worker — Windows PC, Python venv

run_auto.bat → pythonw library_tool.py --auto

pythonw = zero console flash. Per run: GET status=eq.pending with the service key, then for each row —

1  yt-dlp download, cookie chain --cookies-from-browser firefox → edge → chrome (Chromium cookies are DPAPI-locked on Windows; Firefox's SQLite jar is readable, so Firefox must be logged in & closed).

2  Credit extraction from metadata — prefers a human uploader handle over Instagram's numeric uploader_id; a Fix Credits pass can rewrite old entries from metadata alone, no re-download.

3  PATCH …?id=eq.{id} → status=done. Any failure: row untouched, retried next run. Every step timestamped into log.txt.

Storage — boto3 → Cloudflare R2 (S3 API)

put_object to the inspo bucket via the S3-compatible endpoint. Key = the reel's shortcode (DaDpHOeuemh.mp4) — re-processing overwrites instead of duplicating, so the whole pipeline is idempotent.

list.json is read-modified-written alongside: an append-only array of {"video", "handle", "post"} — the entire "database" the public site ever sees. Zero egress fees; the R2 public domain is the CDN.

Front end never talks to Supabase or the PC — it only reads two static things: list.json and the MP4s
04 · Delivery — the wall, no framework

arboledaf.com/visualinfluence

Vanilla JS in one code block. fetch(list.json) → Fisher-Yates shuffle → one <video> tile per item in a CSS scroll-snap feed. An IntersectionObserver plays only the visible tile and lazy-assigns src from data-src, so 160+ videos don't preload.

Autoplay policy handled per platform: muted autoplay playsinline attributes for iPadOS, sound upgrade attempted after, first-gesture unlock, silent retry on canplay — never more than one play prompt, ever. ended → auto-advance. Credit links back to the original post.