feat(iios-kernel-client): per-request header factory → 0.1.4

RestConfig.headers now accepts a function, invoked once per request, so a caller can
mint a FRESH context attestation (new single-use nonce) each call. A static header was
replay-rejected on the 2nd request of a multi-call operation. Published 0.1.4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-kernel-client/src/rest.ts

@@ -4,8 +4,13 @@ import type { Message, InboxItem, InboxState, Ticket, TicketState, CallbackReque
 export interface RestConfig {
   serviceUrl: string;
   token?: string;
-  /** Extra headers sent on every request — e.g. `x-context-attestation` (the July 12 trust proof). */
-  headers?: Record<string, string>;
+  /**
+   * Extra headers for every request — e.g. `x-context-attestation` (the July 12 trust proof).
+   * Pass a FUNCTION to mint fresh headers per request: a context attestation carries a single-use
+   * nonce, so a static header would be replay-rejected on the 2nd call. The function is invoked
+   * once per request.
+   */
+  headers?: Record<string, string> | (() => Record<string, string>);
 }
 
 /** REST/polling client for kernel reads and the native-send fallback. */
@@ -17,7 +22,8 @@ export class RestClient {
   }
 
   private headers(extra: Record<string, string> = {}): Record<string, string> {
-    const h: Record<string, string> = { 'content-type': 'application/json', ...this.config.headers, ...extra };
+    const custom = typeof this.config.headers === 'function' ? this.config.headers() : this.config.headers;
+    const h: Record<string, string> = { 'content-type': 'application/json', ...custom, ...extra };
     if (this.config.token) h.authorization = `Bearer ${this.config.token}`;
     return h;
   }