Send an Automatic Reply from Your Form with SureForms and AI

My site runs SureForms. Add an automatic reply to my form [form name] that goes to the person who filled it in. It should thank them, repeat [what they picked, for example the villa and the number of guests] and say [when we reply, for example within one working day]. Replies to it should come to [my email address].

1. Run get_ability_info for each SureForms ability this uses: sureforms/list-forms, sureforms/get-form and sureforms/get-global-settings. If one is not found, SureForms is keeping it off: tell me to update SureForms if it is older than 2.12.9, then go to SureForms > Settings > MCP (install and activate the MCP Adapter plugin if the tab asks for it) and switch on Enable Abilities; this recipe needs nothing else there, and stop. MY_EMAIL below means the reply address from my request above. Curly-brace codes such as {admin_email}, {site_title}, {form_title}, {all_data} and {form:email} are SureForms smart tags: keep them as they are. {form:SLUG} is the answer to the field with that slug (get-form lists each field's slug).
2. Find the form with sureforms/list-forms, status publish, per_page 100 and search set to its name (ask me if more than one matches), then run sureforms/get-form with its id. Find the email field (type email) and note its slug; if there is none, stop and tell me. Repeat only answers from dropdown, multi-choice or number fields, never free text, names included: this email goes to whatever address the visitor typed, so free text would let a bot send its own words from my site. SureForms does not check that a dropdown answer is one of its choices, so this limits what a bot can make the reply say rather than ruling it out.
3. To read a form's emails, run rest_api GET /wp/v2/sureforms_form/FORM_ID with context edit and _fields id,meta._srfm_email_notification: each item in the list is one email. status true means on, false means off; email_to, email_cc and email_bcc are where it goes; email_reply_to is where replies go. Note the whole list exactly as it came back. If one already goes to {form:EMAIL_SLUG}, show it and ask whether to change that one instead.
4. Check the form is protected from bots, because a bot that fills it in gets this reply at whatever address it typed. Run sureforms/get-global-settings with categories ["security"]. A captcha on the form counts as protection. srfm_honeypot true on its own is weak: SureForms' honeypot is a hidden field that most bots leave alone, so say so. Read the form's captcha with the rest_api call from step 3, adding meta._srfm_captcha_security_type,meta._srfm_form_recaptcha to _fields: a meta._srfm_captcha_security_type of g-recaptcha (with v2-checkbox, v2-invisible or v3-reCAPTCHA in meta._srfm_form_recaptcha), hcaptcha or cf-turnstile counts only if both the matching site key (srfm_v2_checkbox_site_key, srfm_v2_invisible_site_key, srfm_v3_site_key, srfm_hcaptcha_site_key, srfm_cf_turnstile_site_key) and the matching secret key (the same name ending _secret_key) are set in those settings: a set secret comes back as @@SRFM_SECRET_UNCHANGED@@, an empty one as an empty string. Without the secret, SureForms skips the reCAPTCHA check. Treat v3-reCAPTCHA as weak: SureForms does not check its score. If the form has no working captcha, tell me before going on and suggest adding Cloudflare Turnstile (free) under SureForms > Settings > Spam Protection and choosing it in the form's settings.
5. Run run_wp_cli option get admin_email: the reply is sent from that address. If it is not on my site's domain (for example a gmail.com address), say inboxes often junk or reject it and ask me for an address on my own domain to use as from_email instead of {admin_email}. Draft the subject and the message (short HTML paragraphs in my words, with {form:SLUG} tags for the picked answers). Show me exactly what a person will get, with the tags filled in from an example, and wait for my yes.
6. On my yes, run rest_api_write POST /wp/v2/sureforms_form/FORM_ID with body {"meta": {"_srfm_email_notification": LIST}}, where LIST is every item from step 3 unchanged plus one new item: {"id": NEXT_ID, "status": true, "is_raw_format": false, "name": "Auto-reply to visitor", "email_to": "{form:EMAIL_SLUG}", "email_reply_to": "MY_EMAIL", "from_name": "{site_title}", "from_email": "FROM_EMAIL", "email_cc": "", "email_bcc": "", "subject": "SUBJECT", "email_body": "MESSAGE"}. NEXT_ID is one more than the highest id in the list; FROM_EMAIL is the address from step 5, or {admin_email}. The list replaces the form's emails, so leaving an item out deletes it.
7. Read it back as in step 3 and confirm the old emails are unchanged and the new one has status true. Ask me to fill in the form with my own email address and check my inbox and spam folder. If nothing arrives, ask me to open that entry under SureForms > Entries and read its logs (SureForms notes each email it handed to the mail server, or why it failed), and run run_wp_cli plugin list --status=active and tell me whether a mailer plugin (SureMail, WP Mail SMTP, FluentSMTP, Post SMTP or similar) is active. To switch the reply off later, send the list again with its status false.