Add stellar token clawback subcommand

[fnando]

What

Adds stellar token clawback, a SAC-admin write subcommand that claws tokens back from a holder. --admin signs and authorizes the clawback (the asset issuer for a Stellar Asset Contract), --from is the holder, and --amount is the quantity in smallest units. Returns a JSON receipt with the tx hash.

Why

Part of #2620 (typed SEP-41 + SAC client), a SAC-admin command alongside mint. A thin wrapper over contract invoke reusing args::invoke_by_position and args::not_deployed_error; like mint, the admin only authorizes and is not a clawback argument, so only [from, amount] are passed positionally.

Known limitations

Muxed (M…) source accounts are rejected with a clear error (same constraint as transfer, see #2645). Clawback requires the asset's issuer to have AUTH_CLAWBACK_ENABLED (which also requires AUTH_REVOCABLE) set before the holder's trustline is created — this is an asset-configuration prerequisite, not enforced by the command.

[Copilot]

Pull request overview

Adds stellar token clawback as an SAC-admin wrapper over contract invocation.

Changes:

• Implements clawback execution, validation, authorization, and JSON receipts.
• Registers the command and documents its CLI options.
• Adds integration tests for success and error paths.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
FULL_HELP_DOCS.md	Documents the clawback command.
cmd/soroban-cli/src/commands/token/mod.rs	Registers and dispatches clawback.
cmd/soroban-cli/src/commands/token/clawback.rs	Implements clawback behavior.
cmd/soroban-cli/src/cli.rs	Enables JSON error formatting.
cmd/crates/soroban-test/tests/it/integration/token/mod.rs	Registers clawback tests.
cmd/crates/soroban-test/tests/it/integration/token/clawback.rs	Tests success, deployment errors, and validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

cmd/soroban-cli/src/commands/token/clawback.rs:145

• --id native reaches this invocation path, but the native SAC has no Admin contract-data entry (see commands/contract/deploy/asset.rs:234-243), so clawback cannot succeed and surfaces only a downstream invoke failure. Detect a resolved native SAC here and return a typed unsupported/invalid-token error before invoking the contract.

        let token = self
            .id
            .resolve(&config.locator, &network.network_passphrase)?;

cmd/soroban-cli/src/commands/token/clawback.rs:153

• This new muxed-admin rejection has no integration coverage, while the equivalent branches are explicitly tested for token transfer and token approve. Add a clawback integration test using an M… admin and assert the clear unsupported error so the known #2645 guard cannot regress into the raw decode failure.

        if matches!(source_account, crate::xdr::MuxedAccount::MuxedEd25519(_)) {
            return Err(Error::MuxedSourceNotSupported);

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.