This add-on is built with a bundler (WXT, Vite + Svelte), so
the submitted .xpi/.zip contains minified output. Below are the exact steps
to reproduce the submitted artifact from the accompanying source archive.


| Tool | Version |
|------|---------|
| Node.js | 22.20.0 (any 22.x LTS works) |
| npm | 10.9.3 |
| WXT | 0.20.27 (pinned in package-lock.json) |
| Svelte | 5.53.x |
| OS | Built on macOS (arm64); OS-independent — Linux/Windows produce the same output |

The build is deterministic: package-lock.json is included, so npm install
installs the exact dependency versions used to produce the submitted package.


# 1. Unzip the submitted source archive and enter it
unzip locklove-extension-1.0.0-sources.zip -d locklove-extension
cd locklove-extension

# 2. Install the exact locked dependencies
npm install

# 3. Build the Firefox package (production mode)
npm run zip:firefox


The reviewable, unpacked build is written to:

.output/firefox-mv2/ # the extension files the .zip contains
.output/locklove-extension-1.0.0-firefox.zip # identical to the submitted package


To inspect the build without zipping:

npm run build:firefox # → .output/firefox-mv2/


• npm run zip:firefox runs wxt zip -b firefox, which builds the Firefox
  MV2 output and packages it. npm run build:firefox (wxt -b firefox) produces
  the same unpacked output without zipping.
• Entry points live under src/entrypoints/ (background.ts,
  sidepanel/). WXT generates the manifest.json from wxt.config.ts +
  package.json at build time.
• No remote code. All JavaScript is bundled from src/. The only runtime
  network calls are to Firebase (Firestore/Storage/Cloud Functions/Auth) using
  the Firebase JS SDK, which is bundled (see src/lib/firebase.ts /
  firebase-config.ts). Fonts and icons are bundled local assets — nothing is
  fetched from a CDN.
• Permissions. storage (session/theme/locale state), contextMenus
  (the right-click "send image" entry), notifications (delivery toasts),
  clipboardRead (paste an image into the composer), and <all_urls>
  host permission — needed so the background script can fetch the bytes of an
  image the user right-clicks on any page and send it to their partner. No page
  content is read or transmitted beyond the single image the user explicitly
  chooses.
• Data. The add-on signs the user in to their existing LockLove Firebase
  account (via a QR device-link approved on their phone) and sends the wallpaper
  they compose to their partner. This is declared in the manifest's
  data_collection_permissions (authenticationInfo, personalCommunications).

Contact for review questions: hello@locklove.app