Tool Kits 2.7.33 — On-demand Collector Heartbeat (Pre-release)

Tool Kits 2.7.33 — On-demand Collector Heartbeat (Pre-release)

This is a pre-release, following 2.7.32. The stable release remains 2.7.30.

• Add an authenticated POST endpoint so NexaMonitor Check Ulang receives fresh
  heartbeat data and restores Collector ACTIVE after validation and persistence.
• Reuse the daily/manual heartbeat payload, including PHP, WordPress and plugin
  versions, saved audit summaries, maintenance data and cron metrics.
• Bind requests and responses to a random challenge, timestamp, website and
  installation; sign both directions with the configured collector token.
• Prevent nonce replay and concurrent collection; apply a short cooldown and
  no-store response headers. Add no cron, callback HTTP request or automatic scan.

Deploy the matching NexaMonitor Collector update and install/activate this plugin
on each monitored site. HTTPS and matching collector tokens are required. Existing
Check Ulang database columns are reused; no additional migration is required.

This package inherits signed licensing from 2.7.31/2.7.32. The matching signing API
and key must already be deployed; see the plugin LICENSE_SECURITY.md.

Validation:

• 55/55 default plugin regression cases pass on PHP 7.4 and PHP 8.4, including
  30 on-demand heartbeat authentication, payload, replay, cooldown and lock checks.
• 28 NexaMonitor tests pass (310 assertions), including a real plugin-response
  interoperability test, data persistence and ACTIVE status restoration.

The server-side Collector update must be deployed separately. Publishing this
plugin does not deploy NexaMonitor or activate/update plugins on monitored websites.