Passkey integration and telemetry

[CDRussell]

Task/Issue URL: https://app.asana.com/1/137249556945/task/1215167419281512?focus=true
Tech Design URL (if applicable):
API Proposals URL(s) (if applicable):

Description

Final steps of passkey integration to prepare for releasing to all users (it's currently internal-only).

Steps to test this PR

Testing Patch

We are awaiting an update of CSS lib, so for now to test this you'll need to target a specific CSS branch. You can do so by applying this patch: Patch for testing

• targets specific CSS branch
• points to custom remote config which has the CSS passkey feature flag enabled
• sets the native-level feature flag value to TRUE (this will be updated properly by remote config later)

Pre-requisites

• You need to be using the shared debug certificate
• You need to have applied the Patch for testing
• You need a Passkey provider (e.g., Google Password manager, or Samsung Pass available if on a Samsung etc... these will be available on most real devices but you might need to sign into into Google / Samsung account first)

Create new passkey

• Ensure pre-requisites are in place (see above)
• Do a fresh install of play variant
• Visit https://webauthn.io
• Enter a username and choose Register; verify you are prompted to create a passkey
• Accept creating the key; verify it is a success
• Verify in logs: Autofill-passkey: new passkey created

Using a passkey

• It will prompt you to try authenticating, so leave the same username in the field and tap Authenticate and verify you are signed in.
• Verify in logs: Autofill-passkey: passkey used

Registering a second passkey

• Tap Try it again to return, and this time enter a different username and tap Register
• Verify it successfully creates another one

Selecting from multiple available passkeys

• Clear the username field and tap Authenticate; verify it shows you a selection of passkeys to choose from
• Choose one, and verify you can use it to login

Cancel out of selecting a passkey

• Clear the username field and tap Authenticate; now hit back button
• Verify in logs: Autofill-passkey: failure when using passkey: NotAllowedError

Cancel out of creating a passkey

• Clear the username field and tap Register; now hit back button
• Verify in logs: Autofill-passkey: failure when creating a passkey: NotAllowedError

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

---

Note

Low Risk
Telemetry-only path with sanitized, enum-bounded error names; no credential storage or WebAuthn ceremony logic in this diff.

Overview
Adds passkey WebAuthn telemetry by listening for Content Scope Scripts (webCompat) JS messages passkeyUsed and passkeyFailed, parsing ceremony type (get vs create), and firing matching autofill pixels.

Success paths emit count + daily pixels for passkey use and create. Failures attach a bounded error param (allowlisted DOMException names, collapsing unknown/CSS Other to UnknownError) and use error-specific daily tags. Unparseable notifications fire an unknown event pixel.

Pixel catalog updates add five passkey events plus a shared passkeyError param dictionary entry. autofill-impl gains content-scope-scripts-api and js-messaging-api dependencies for the new handler stack, with unit tests for the parser, pixel sender, and message handler.

^{Reviewed by Cursor Bugbot for commit 780fbcf. Configure here.}

[github-actions]

Privacy Review task: https://app.asana.com/0/69071770703008/1218323434068368