feat(event-submission): URL-based artist tour import → auto-create artist-scoped pipeline (closes #320 DME side) - #322

Closes the DME side of #320. The extrachill-events form change consuming the new abilities ships in a follow-up PR against extrachill-events after this merges.

Summary

Adds URL-based artist tour import: a logged-in user pastes a tour page URL (e.g. https://theokatzman.com/tour), the system probes it via UniversalWebScraper, and queues it for admin moderation. On approval, an admin picks/creates the artist term, and DME programmatically creates an artist-scoped Data Machine pipeline that polls the URL on a schedule — every artist with a parseable site becomes self-onboarding.

Phases delivered

A. Table (inc/Core/ArtistUrlSubmissionsTable.php)

{base_prefix}artist_url_submissions installed via dbDelta on plugins_loaded (version-gated). UNIQUE KEY on url_hash (SHA-256 of normalized URL) enforces dedupe. Status enum: pending_review | approved | rejected | scraping_failed. Lives under $wpdb->base_prefix so the moderation queue is shared across the multisite as required.

B. Abilities (inc/Abilities/ArtistUrlImportAbilities.php)

Four abilities, all self-registering on wp_abilities_api_init:

SelectionMode alignment (#320 hard requirement) — every taxonomy mode in the upsert step config uses class constants by reference, never bare strings:

use DataMachine\Core\Selection\SelectionMode;

'taxonomy_artist_selection'   => (string) $artist_term_id,  // PRE_SELECTED
'taxonomy_venue_selection'    => SelectionMode::AI_DECIDES,
'taxonomy_location_selection' => SelectionMode::AI_DECIDES,
'taxonomy_festival_selection' => SelectionMode::AI_DECIDES,
'taxonomy_promoter_selection' => SelectionMode::SKIP,
'taxonomy_category_selection' => SelectionMode::SKIP,
'taxonomy_post_tag_selection' => SelectionMode::SKIP,

Artist name auto-detection runs inside preview-artist-url:

1. JSON-LD Performer / MusicGroup on the first extracted event.
2. <meta property="og:title"> / <title> / first <h1> with site-name suffixes stripped (Tour, Events, Shows, Live, etc.).
3. URL domain → strip www. → first label → Title Case.

The detected name is then fuzzy-matched against existing artist terms via similar_text(); if the highest match clears 85% the term ID is returned, otherwise null and the admin types a name during approval.

Dedupe — normalize_url() lowercases scheme + host, strips fragment, trims trailing slash (except root), drops default ports. url_hash = sha256(normalized). The UNIQUE KEY on the table makes duplicate preview/submit return url_already_tracked with the existing submission's status.

CityAbilities pattern reuse — pipeline scaffold (event_import → ai → update), AI step configured with an artist-scoped system prompt, belt-and-braces patchFlowSteps() writes handler slugs/configs directly to the flow_config JSON to harden against create-flow's timing quirks (same shape as CityAbilities::patchFlowSteps).

C. REST routes (inc/Api/Controllers/ArtistUrlImport.php + inc/Api/Routes.php)

Preview + submit reject direct-browser navigations (no X-Requested-With: XMLHttpRequest / application/json Accept header → 404) in the spirit of #297 hardening. No shared BrowserNavigationGuard class exists in the tree yet, so the guard is inline; if/when one lands, these endpoints can be migrated.

D. Admin moderation UI (inc/Admin/ArtistUrlSubmissionsAdmin.php)

New submenu under Events → Artist URL Imports. Status tabs: Pending review (default) | Approved | Rejected | Failed scrapes. Per-row inline forms for approve (artist term ID or new name + schedule interval) and reject (optional reason). Submits post to admin-post.php with nonces and delegate to the abilities.

E. Tests

• tests/Unit/ArtistUrlSubmissionsTableTest.php — normalization (scheme casing, fragment, trailing slash, default ports, query preservation), url_hash determinism, dedupe via UNIQUE constraint, CRUD round-trip, counts_by_status.
• tests/Unit/ArtistUrlImportAbilitiesTest.php — preview rejects empty/non-http/duplicate URLs, returns no_events_found for an empty-page mock via pre_http_request, submit records scraping_failed row when probe returns nothing, submit rejects duplicate URLs, approve returns artist_required when no artist provided and submission has no suggested term, approve rejects non-pending submissions, reject sets status + reason + reviewer.

Tests match the WP_UnitTestCase/DataMachineEvents\Tests\Unit shape of the existing suite (e.g. UpcomingCountAbilitiesTest, EventScraperTestAbilityTest). CI runs homeboy audit; the audit summary has no new outliers introduced by these files.

What NOT done (per issue + prompt)

• No new scraper. UniversalWebScraper is used as-is.
• No ai_decides strings — SelectionMode constants only.
• No moderation bypass — admin approval is required even for admins.
• No pipeline creation during the user submit request — only during admin approval.
• No new scheduler — Action Scheduler via datamachine/create-flow only.
• No auto-create of artist terms without admin confirmation.
• No changes to the existing single-event submission path (ships in EC-events PR).

Curl matrix for the four abilities (verified against live install)

# Preview (logged-in cookie + REST nonce)
curl -X POST 'https://extrachill.com/wp-json/datamachine/v1/artist-url/preview' \
  -H 'X-WP-Nonce: <nonce>' -H 'X-Requested-With: XMLHttpRequest' \
  -H 'Content-Type: application/json' \
  -b 'wp_logged_in=...' \
  -d '{"url":"https://theokatzman.com/tour"}'

# Submit
curl -X POST '.../artist-url/submit' ... \
  -d '{"url":"https://theokatzman.com/tour"}'

# Approve (admin)
curl -X POST '.../artist-url/123/approve' ... \
  -d '{"artist_term_id":15008,"schedule_interval":"weekly"}'

# Reject (admin)
curl -X POST '.../artist-url/124/reject' ... \
  -d '{"reason":"Not a music artist tour page."}'

# Direct browser nav → 404
curl 'https://extrachill.com/wp-json/datamachine/v1/artist-url/preview'
# {"code":"rest_no_route", ...}

Follow-up

The extrachill-events form change (URL field at the top of the event-submission block, JS probe via preview ability, confirm + submit) ships in a separate PR against extrachill-events once this merges. Filing the issue close on the EC-events PR.

mention <@532385681268408341> when ready for review.