Add RPC support with account-key isolation and custom endpoint URLs

[johnpmitsch]

Adds RPC support to the SDK across all four languages (qn.rpc.call(...)), plus the admin tooling-access endpoints used to mint the short-lived session tokens RPC calls authenticate with.

How it works

RPC data-plane calls authenticate with an ephemeral Bearer JWT minted via the control-plane tooling-access/token endpoint. The client caches the token in memory, refreshes proactively before exp, and reactively retries once on a 401. Callers can seed a token from disk via RpcConfig.seed and route multichain calls via RpcConfig.networks.

Account-key isolation

The point of the ephemeral-token model is that the long-lived account key never reaches the provisioned RPC endpoint. RPC calls go through a dedicated HTTP client that omits the account x-api-key default header, so the data-plane request carries only the Bearer JWT (or nothing, for a custom URL). A test asserts x-api-key is absent on RPC requests.

Custom HTTP URL for RPC calls

endpoint_url points a call at a fully-formed HTTP URL instead of the Tooling Access endpoint. A custom URL is treated as self-authenticating: no token is minted and no Authorization header is attached. Two ways to set it:

• RpcConfig.endpoint_url (client-wide default)
• per-call endpoint_url argument (overrides the default)

endpoint_url and network are mutually exclusive (a custom URL is not multichain-routed) and passing both returns a Config error.

call signature and argument combinations

call(method, params?, network?, endpoint_url?) — the two trailing args are independently optional.

Rust

// Tooling endpoint, default network (mints/refreshes the JWT)
qn.rpc.call("eth_blockNumber", None, None, None).await?;

// With params
qn.rpc.call("eth_getBalance", Some(json!(["0xabc...", "latest"])), None, None).await?;

// Multichain: route by network key (seed the map first via set_networks)
qn.rpc.call("getSlot", None, Some("solana-mainnet".into()), None).await?;

// Custom URL per-call (no JWT, no Authorization header)
qn.rpc.call("eth_blockNumber", None, None, Some("https://my-endpoint.example/rpc".into())).await?;

// Custom URL as a client-wide default
let mut cfg = SdkFullConfig::from_api_key(key);
cfg.rpc = Some(RpcConfig { endpoint_url: Some("https://my-endpoint.example/rpc".into()), ..Default::default() });

Python

await qn.rpc.call("eth_blockNumber")                               # tooling, default network
await qn.rpc.call("eth_getBalance", ["0xabc...", "latest"])        # with params
await qn.rpc.call("getSlot", network="solana-mainnet")             # multichain
await qn.rpc.call("eth_blockNumber", endpoint_url="https://my-endpoint.example/rpc")  # custom URL
QuicknodeSdk(config=SdkFullConfig(api_key=key, rpc=RpcConfig(endpoint_url="https://my-endpoint.example/rpc")))  # client-wide

Node

await qn.rpc.call("eth_blockNumber");                                       // tooling, default network
await qn.rpc.call("eth_getBalance", ["0xabc...", "latest"]);                // with params
await qn.rpc.call("getSlot", [], "solana-mainnet");                         // multichain
await qn.rpc.call("eth_blockNumber", [], undefined, "https://my-endpoint.example/rpc");  // custom URL
new RpcConfig({ endpointUrl: "https://my-endpoint.example/rpc" });          // client-wide default

Ruby

qn.rpc.call(method: "eth_blockNumber")                                      # tooling, default network
qn.rpc.call(method: "eth_getBalance", params: ["0xabc...", "latest"])       # with params
qn.rpc.call(method: "getSlot", network: "solana-mainnet")                   # multichain
qn.rpc.call(method: "eth_blockNumber", endpoint_url: "https://my-endpoint.example/rpc")  # custom URL
# client-wide default: rpc: { endpoint_url: "https://my-endpoint.example/rpc" } in the SDK config

Passing both network and endpoint_url in any language raises/returns a Config error.

Also

• CachedToken's Debug redacts the JWT (it's a live credential).
• Dropped the unused RpcConfig.base_url field (token minting resolves against the admin base URL).

Verification

cargo test (242 pass, incl. new custom-URL tests), just lint, just python-build, just node-build, just ruby-build all green. Examples updated and syntax-checked in all four languages.