fix: tighten Coinbase popup message handling

[broody]

Summary

• tighten Coinbase popup postMessage parsing to be strict JSON/object handling (remove raw-string field extraction fallback) and keep safe nested payload unwrapping
• normalize UI state transitions across documented Coinbase events (load_pending, load_success, load_error, commit_success, commit_error, cancel, polling_start, polling_success, polling_error) so processing/success/error states are consistent
• ensure cancel is treated as a terminal failure state and no longer leaves the popup in a stale "Payment processing..." state
• add focused unit tests for stringified Coinbase payloads, including load_success, polling_error with message surface, apple_pay_button_pressed, pending_payment_auth, and cancel

Test plan

• Run pnpm format
• Run pnpm --filter @cartridge/keychain test:ci -- src/components/coinbase-popup.test.tsx
• Manual check: trigger onramp_api.cancel and verify processing clears + cancellation message appears
• Manual check: trigger onramp_api.polling_error and verify Coinbase error text is surfaced
• Manual check: successful flow still reaches onramp_api.polling_success and closes popup

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
controller-example-next	Ready	Preview	Feb 26, 2026 3:21am
keychain	Ready	Preview	Feb 26, 2026 3:21am
keychain-storybook	Ready	Preview	Feb 26, 2026 3:21am

[claude]

Claude finished @broody's task —— View job

---

Documentation Analysis

Analyzing PR #2450 to determine if documentation updates are needed...

Tasks:

• Analyze changes for user-facing impact
• Determine if documentation updates are required
• Update docs if needed

---

Analysis Complete

Changes in PR #2450:

• Tightened postMessage parsing for Coinbase popup (removed raw-string fallback)
• Normalized UI state transitions across Coinbase events
• Fixed cancel event to be treated as terminal failure state
• Added unit tests for stringified Coinbase payloads

Documentation Impact: None required

This PR is an internal bug fix that does not require documentation updates for the following reasons:

1. No API changes: No new public APIs, hooks, or user-facing methods were added or modified
2. No configuration changes: No new configuration options or required setup steps
3. Internal implementation: Changes are confined to internal state management and error handling within the coinbase-popup.tsx component
4. Bug fix category: Fixes stale UI states and improves message parsing reliability—these are corrections to existing behavior, not new features

Per documentation rules:

"DEFAULT TO NO CHANGES. Most code PRs do not need docs updates. Internal refactors, test changes, CI changes, and dependency bumps need nothing. Only proceed if there is a concrete user-facing change (new API, changed behavior, new feature, removed feature, changed configuration)."

The existing Coinbase Onramp documentation (docs-repo/src/pages/controller/coinbase-onramp.md) already covers:

• User experience flow (including "Payment Processing" and completion states)
• Error handling (including "Order Failures" with clear messaging)
• These are already documented at the appropriate level of abstraction

Conclusion: No documentation updates needed for this PR.

---