fix(release): stop Connect config from requiring macOS passkey signing

Author: rynfar

scripts/build-desktop-artifact.test.ts

@@ -479,6 +479,18 @@ it.layer(NodeServices.layer)("build-desktop-artifact", (it) => {
     assert.isUndefined(resolveMacPasskeySigningConfiguration({}, "0.0.31"));
   });
 
+  // Enabling Connect sets a publishable key on every release build. That alone
+  // is not a request for passkeys, and treating it as one broke macOS signing
+  // the first time Connect was configured.
+  it("signs without passkey entitlements when only Connect is configured", () => {
+    assert.isUndefined(
+      resolveMacPasskeySigningConfiguration(
+        { T3CODE_CLERK_PUBLISHABLE_KEY: `pk_live_${btoa("clerk.pylon-code.com$")}` },
+        "0.0.31",
+      ),
+    );
+  });
+
   // Half-configured passkeys produce an app that looks capable and fails at
   // authentication, so that stays an error rather than degrading.
   it("rejects passkey configuration that is missing a provisioning profile", () => {

scripts/build-desktop-artifact.ts

@@ -804,7 +804,11 @@ export function resolveMacPasskeySigningConfiguration(
   const provisioningProfilePath = env.T3CODE_MACOS_PROVISIONING_PROFILE?.trim() ?? "";
   const configuredRpDomains = env.T3CODE_CLERK_PASSKEY_RP_DOMAINS?.trim();
   const configuredPublishableKey = env.T3CODE_CLERK_PUBLISHABLE_KEY?.trim();
-  if (!provisioningProfilePath && !configuredRpDomains && !configuredPublishableKey) {
+  // A publishable key means Connect is configured, not that passkeys are — it
+  // is only a fallback source for the RP domain once a provisioning profile
+  // exists. Treating it as passkey intent made every Connect-enabled build
+  // demand an Apple Team ID and fail signing outright.
+  if (!provisioningProfilePath && !configuredRpDomains) {
     return undefined;
   }