Sync master from upstream

README.md

@@ -2,9 +2,9 @@
 **Contributors:** [brainstormforce](https://profiles.wordpress.org/brainstormforce/)  
 **Tags:** forms, ai forms, contact form, form builder, payment form  
 **Requires at least:** 6.4  
-**Tested up to:** 7.1.2  
+**Tested up to:** 7.1.3  
 **Requires PHP:** 7.4  
-**Stable tag:** 2.12.8  
+**Stable tag:** 2.12.9  
 **License:** GPLv2 or later  
 **License URI:** http://www.gnu.org/licenses/gpl-2.0.html  
 
@@ -426,6 +426,17 @@ Visit the [SureForms features page](https://sureforms.com/features/?utm_source=w
 You can report security issues through our [Bug Bounty Program](https://brainstormforce.com/bug-bounty-program/). We collaborate with Patchstack to validate, triage, and handle security reports.
 
 ## Changelog ##
+### 2.12.9 - 13th October 2026 ###
+* New: Added the `srfm_submission_accepted` developer action, fired as soon as a submission is accepted.
+* New: Forms that do not store entries now warn you when a failed notification loses a submission.
+* New: MCP Adapter can now be installed and activated in one click.
+* Improvement: Failed notifications are no longer silently retried through PHP's mail(); the reason now shows in Entry Logs and Form Checks. Use the `srfm_allow_php_mail_fallback` filter to restore it.
+* Improvement: Smart tags such as {get_input:name} now resolve only inside SureForms form content. A tag written in ordinary page or post content is shown as written.
+* Fix: Deleting an option in a duplicated Multiple Choice block no longer removes it from the original.
+* Fix: Form fields no longer fail accessibility scans for a missing error message reference.
+* Fix: The submit button now stays disabled while a form redirects, preventing duplicate submissions.
+* Fix: Unticked Checkbox fields now appear in entries and notification emails.
+* Fix: This update addressed a security bug. Props to dzaku from Patchstack for reporting it responsibly to our team.
 ### 2.12.8 - 25th September 2026 ###
 * Improvement: The debug log no longer records routine validation stops, such as an empty required field, keeping it focused on real failures.
 * Fix: Entry Logs now record the email notification sent when a form is submitted.
@@ -439,12 +450,6 @@ You can report security issues through our [Bug Bounty Program](https://brainsto
 * Fix: The conversion rate no longer counts submissions made by site editors while previewing a form.
 * Fix: The Edit Form icon is no longer oversized in Divi.
 * Fix: This update addressed a security bug. Props to nh4tvd from Patchstack for reporting it responsibly to our team.
-### 2.12.6 - 2nd September 2026 ###
-* New: Added an Enable Logs option that records form submission failures to a downloadable file, making it easier to diagnose issues on a live site.
-* New: Added Views and Conversion Rate columns to the Forms list, so you can see how each form is performing at a glance.
-* New: SureForms now detects a missing entries database table and offers a one-click repair, so submissions start saving again without manual database work.
-* Fix: The Edit Form button no longer overlaps form fields on the front end.
-* Fix: This update addressed a security bug. Props to Patchstack for reporting it responsibly to our team.
 The full changelog is available [here](https://sureforms.com/whats-new/?utm_source=wordpress.org&utm_medium=whats_new).
 
 ## Upgrade Notice ##

admin/analytics.php

@@ -7,8 +7,10 @@
 
 namespace SRFM\Admin;
 
+use SRFM\Inc\AI_Form_Builder\AI_Helper;
 use SRFM\Inc\Database\Register;
 use SRFM\Inc\Database\Tables\Entries;
+use SRFM\Inc\Email_Delivery\Status as Email_Delivery_Status;
 use SRFM\Inc\Form_Views;
 use SRFM\Inc\Helper;
 use SRFM\Inc\Learn;
@@ -92,6 +94,7 @@ static function () {
 		add_action( 'current_screen', [ $this, 'track_first_editor_open' ] );
 		add_action( 'transition_post_status', [ $this, 'track_first_form_published' ], 10, 3 );
 		add_action( 'save_post', [ $this, 'track_embed_styling_configured' ], 10, 2 );
+		add_action( 'admin_init', [ $this, 'track_email_delivery_status' ] );
 
 		// Detect state-based events on admin load (dedup prevents repeat tracking).
 		$this->detect_state_events();
@@ -736,6 +739,58 @@ public function track_first_form_published( $new_status, $old_status, $post ) {
 		);
 	}
 
+	/**
+	 * Track AI form creation, broken down by the starter card used (if any).
+	 *
+	 * Keeps cumulative counters in srfm_options and queues the latest totals as
+	 * the `ai_starter_usage` event each time an AI form is created, so the share
+	 * of AI forms started from each card can be read from the warehouse.
+	 *
+	 * @param mixed $starter_id Starter card id (sanitized here), or empty string for a free-text prompt.
+	 * @param bool  $edited     Whether the starter prompt was edited before generating.
+	 * @since 2.12.9
+	 * @return void
+	 */
+	public static function track_ai_starter_usage( $starter_id, $edited ) {
+		// The id becomes an option key and an event property key, so clean it here
+		// rather than trusting every caller.
+		$starter_id = substr( sanitize_key( Helper::get_string_value( $starter_id ) ), 0, 40 );
+
+		$usage = Helper::get_srfm_option( 'ai_starter_usage', [] );
+		$usage = is_array( $usage ) ? $usage : [];
+
+		$counts = isset( $usage['starters'] ) && is_array( $usage['starters'] ) ? array_map( 'absint', $usage['starters'] ) : [];
+
+		// Counts AI forms created since this tracking shipped, deleted ones included
+		// (unlike the `ai_generated_forms` stat, which counts forms that exist now).
+		$usage['ai_forms_created'] = absint( $usage['ai_forms_created'] ?? 0 ) + 1;
+
+		// Cap distinct keys so a filtered starter list can't grow the option unbounded.
+		if ( '' !== $starter_id && ( isset( $counts[ $starter_id ] ) || count( $counts ) < 20 ) ) {
+			$counts[ $starter_id ] = absint( $counts[ $starter_id ] ?? 0 ) + 1;
+
+			if ( $edited ) {
+				$usage['edited'] = absint( $usage['edited'] ?? 0 ) + 1;
+			}
+		}
+
+		$usage['starters'] = $counts;
+		Helper::update_srfm_option( 'ai_starter_usage', $usage );
+
+		$properties = [
+			'ai_forms_created' => (string) $usage['ai_forms_created'],
+			'edited'           => (string) absint( $usage['edited'] ?? 0 ),
+		];
+		foreach ( $counts as $id => $count ) {
+			$properties[ 'starter_' . $id ] = (string) $count;
+		}
+
+		// $force = true: skip the already-sent check and replace any queued copy, so
+		// the next flush sends these totals. Nothing is re-sent until another AI form
+		// is created.
+		self::events()->track( 'ai_starter_usage', (string) array_sum( $counts ), $properties, true );
+	}
+
 	/**
 	 * Track embed styling configuration when a post/page is saved.
 	 *
@@ -824,6 +879,47 @@ public function track_plugin_activated_event() {
 		self::events()->track( 'plugin_activated', SRFM_VER, [ 'source' => $source ] );
 	}
 
+	/**
+	 * Track the site's email delivery state.
+	 *
+	 * Whether form notifications have a real mailer behind them. A state, not a
+	 * milestone, so it is re-sent (forced) whenever it changes -- and checked at
+	 * most daily, because admin_init runs on every admin page load and the status
+	 * can scan the plugins directory. Only fixed labels are sent: connection
+	 * titles are owner-entered text.
+	 *
+	 * On admin_init rather than in detect_state_events(), which runs while
+	 * plugins are still loading: pluggable functions do not exist yet, so a
+	 * redefined wp_mail() would be missed and current_user_can() is undefined.
+	 *
+	 * @since 2.12.9
+	 * @return void
+	 */
+	public function track_email_delivery_status() {
+		if ( false !== get_transient( 'srfm_email_delivery_state_checked' ) ) {
+			return;
+		}
+
+		set_transient( 'srfm_email_delivery_state_checked', 1, DAY_IN_SECONDS );
+
+		$email_delivery = Email_Delivery_Status::get_status();
+		$mailer_slug    = Helper::get_string_value( $email_delivery['mailer']['slug'] ?? '' );
+		$verified       = $email_delivery['surecontact']['email_verified'] ?? null;
+		$delivery_props = [
+			'mailer'               => $mailer_slug,
+			'mailer_plugin'        => 'other' === $mailer_slug ? Helper::get_string_value( $email_delivery['mailer']['label'] ?? '' ) : '',
+			'surecontact'          => ! empty( $email_delivery['surecontact']['connected'] ) ? 'yes' : 'no',
+			'surecontact_verified' => null === $verified ? 'unknown' : ( $verified ? 'yes' : 'no' ),
+		];
+		$delivery_state = Helper::get_string_value( $email_delivery['state'] ?? '' );
+		$fingerprint    = $delivery_state . '|' . implode( '|', $delivery_props );
+
+		if ( '' !== $delivery_state && Helper::get_srfm_option( 'email_delivery_state_tracked', '' ) !== $fingerprint ) {
+			self::events()->track( 'email_delivery_status', $delivery_state, $delivery_props, true );
+			Helper::update_srfm_option( 'email_delivery_state_tracked', $fingerprint );
+		}
+	}
+
 	/**
 	 * Extract non-inherit formTheme values from Bricks element data.
 	 *
@@ -1007,6 +1103,49 @@ private function detect_state_events() {
 					$onboarding_props['suremail_installed'] = (bool) $onboarding_analytics['suremailInstalled'] ? 'yes' : 'no';
 				}
 
+				// Email delivery step: the delivery state on arrival and on leaving,
+				// and what the owner did. Closed sets, intersected like the premium
+				// tabs below, because the blob is whatever the wizard POSTed.
+				if ( ! empty( $onboarding_analytics['emailDelivery'] ) && is_array( $onboarding_analytics['emailDelivery'] ) ) {
+					$email_delivery = $onboarding_analytics['emailDelivery'];
+					$states         = [ 'attention', 'not_configured', 'suremail_no_connection', 'limited', 'other_mailer', 'ready' ];
+					$step_actions   = [ 'skip', 'cannot_install', 'install_other_smtp', 'continue_limited', 'continue_other_mailer', 'continue_ready', 'continue_attention', 'continue_not_set_up' ];
+
+					$state_props = [
+						'stateAtStep' => 'email_delivery_state_at_step',
+						'finalState'  => 'email_delivery_state_at_exit',
+					];
+
+					foreach ( $state_props as $key => $prop ) {
+						if ( isset( $email_delivery[ $key ] ) && in_array( $email_delivery[ $key ], $states, true ) ) {
+							$onboarding_props[ $prop ] = $email_delivery[ $key ];
+						}
+					}
+
+					if ( isset( $email_delivery['action'] ) && in_array( $email_delivery['action'], $step_actions, true ) ) {
+						$onboarding_props['email_delivery_action'] = $email_delivery['action'];
+					}
+
+					if ( isset( $email_delivery['suremailOpened'] ) ) {
+						$onboarding_props['email_delivery_suremail_opened'] = (bool) $email_delivery['suremailOpened'] ? 'yes' : 'no';
+					}
+
+					if ( isset( $email_delivery['consented'] ) ) {
+						$onboarding_props['email_delivery_consented'] = (bool) $email_delivery['consented'] ? 'yes' : 'no';
+					}
+
+					// The option card open when the step was left.
+					if ( isset( $email_delivery['option'] ) && in_array( $email_delivery['option'], [ 'surecontact', 'other_smtp' ], true ) ) {
+						$onboarding_props['email_delivery_option'] = $email_delivery['option'];
+					}
+
+					// Outcome of the one-click SureContact sign-up, when it was tried.
+					$provision_outcomes = [ 'created', 'already_registered', 'unavailable', 'failed' ];
+					if ( isset( $email_delivery['provision'] ) && in_array( $email_delivery['provision'], $provision_outcomes, true ) ) {
+						$onboarding_props['email_delivery_provision'] = $email_delivery['provision'];
+					}
+				}
+
 				if ( isset( $onboarding_analytics['accountConnected'] ) ) {
 					$onboarding_props['account_connected'] = (bool) $onboarding_analytics['accountConnected'] ? 'yes' : 'no';
 				}
@@ -1066,25 +1205,8 @@ private function detect_state_events() {
 
 		// first_ai_form_generated: detect if any AI-generated form exists.
 		// Guard with is_tracked() to skip the meta_query after the event is already tracked.
-		if ( ! self::events()->is_tracked( 'first_ai_form_generated' ) ) {
-			$ai_forms = get_posts(
-				[
-					'post_type'      => SRFM_FORMS_POST_TYPE,
-					'post_status'    => 'any',
-					'posts_per_page' => 1,
-					'fields'         => 'ids',
-					'meta_query'     => [ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Runs once per lifecycle via is_tracked guard.
-						[
-							'key'     => '_srfm_is_ai_generated',
-							'value'   => '',
-							'compare' => '!=',
-						],
-					],
-				]
-			);
-			if ( ! empty( $ai_forms ) ) {
-				self::events()->track( 'first_ai_form_generated' );
-			}
+		if ( ! self::events()->is_tracked( 'first_ai_form_generated' ) && AI_Helper::has_ai_generated_forms() ) {
+			self::events()->track( 'first_ai_form_generated' );
 		}
 
 		// MCP / Abilities API first-enable events.

assets/js/unminified/blocks/dropdown.js

@@ -32,11 +32,6 @@ function initializeDropdown() {
 
 			let additionalConfig = {};
 			const inputName = element.getAttribute( 'name' );
-			const errorContainerID = element
-				?.closest( '.srfm-dropdown-block' )
-				?.querySelector( '.srfm-error-message' )
-				?.getAttribute( 'data-srfm-id' );
-
 			if ( element.getAttribute( 'data-multiple' ) === 'true' ) {
 				additionalConfig = {
 					maxItems: null, // Enabling multi selection for dropdown.
@@ -55,17 +50,22 @@ function initializeDropdown() {
 				plugins: [ 'remove_button', 'clear_button' ], // Adding remove button to the selected options and clear button for the dropdown.
 				openOnFocus: false, // Stop the dropdown from opening on focus.
 				/**
-				 * If the error container is present, assign it to the aria-describedby attribute.
-				 * This will ensure that when there is a error, it will be announced by the screen reader
-				 * when the field is in focus state.
+				 * Mirror the select's aria-describedby onto the search input, so the error
+				 * (linked only while shown) and the help text are announced on focus.
 				 *
 				 * If there are selected options, announce them on field focus.
 				 */
 				onFocus() {
-					if ( errorContainerID ) {
+					const describedBy =
+						element.getAttribute( 'aria-describedby' );
+					if ( describedBy ) {
 						tomInputInstance.control_input.setAttribute(
 							'aria-describedby',
-							errorContainerID
+							describedBy
+						);
+					} else {
+						tomInputInstance.control_input.removeAttribute(
+							'aria-describedby'
 						);
 					}
 					if (