Publishing, review and guidelines

Every version of every plugin, theme, template and skill is reviewed before owners can install it. That includes updates: a new version does not reach existing installs until it is approved.

The lifecycle of a version

check ──▶ upload ──▶ draft ──submit──▶ in_review ──▶ approved ──▶ (superseded by a newer approved version)
              │                                 └──▶ rejected  (read the notes and codes, fix, upload a new version)
              └──▶ dev install on your own app (unreviewed, never billed)

The CLI

dunea-plugin check                                    # the review checklist, offline
dunea-plugin dev --app <appId>                        # upload and install the newest version on your own app
dunea-plugin publish                                  # upload a draft (creates the listing the first time)
dunea-plugin publish --changelog "Adds tracking links"   # upload with a changelog
dunea-plugin publish --submit                         # upload (if needed) and submit for review
dunea-plugin status                                   # versions, review notes, rejection codes, queue position
dunea-plugin release 1.2.0                            # make an approved version current again (rollback)
dunea-plugin analytics --days 30                      # views, installs, uninstalls, revenue and conversion

The CLI reads dunea.plugin.json, dunea.theme.json, dunea.template.json or dunea.skill.json in the current directory (or the file you pass), and commands that take a slug default to the id in that manifest. Every command except validate and check needs DUNEA_DEV_TOKEN. Set DUNEA_API_URL only if you were told to use a different API origin (the default is https://api.dunea.ai).

Check before you upload

dunea-plugin check runs the marketplace's automated review checklist on your machine: the schema, endpoint rules, screenshots, description, permissions, prices, theme contrast and skill instructions. Each finding has a rule id, a level and the field it is about:

✗ dunea.plugin.json: 1 error(s), 2 warning(s)
  ✗ DUN-U001 webhookUrl: http://localhost:8787/dunea must be a public https URL
  ! DUN-L001 screenshots: 1 screenshot(s); 3 or more convert better
  ! DUN-B002 description: Say in the description what is charged in credits: create_label (2 credits per call)

• Errors (✗) block submission. Fix them first.
• Warnings (!) don't block, but reviewers see them too. Fix them, or be ready to explain.

The same check runs in the developer portal and on the server when you upload (POST /api/marketplace/dev/check runs it without saving anything), so what you see locally is what a submission gets. The server adds the checks that need the network or your account: that your webhookUrl, panel.url and icon respond (DUN-U002, DUN-U003), and that payouts are connected for anything paid (DUN-B001).

publish runs check first and stops on errors.

Test on your own app

dunea-plugin dev --app <appId> uploads your manifest and installs its newest version on one of your own apps, before anyone reviews it. The app id is the id in the app's URL.

• A dev install uses the dev channel. It gets every new version you upload: run dev again after each change.
• It is never billed: paid listings install without checkout, and priced tools and usage come back as waived.
• It is never counted in your analytics, and owners never see unreviewed versions.

Use it to go through the whole flow before you submit: plugin.installed, events, AI tools, your panel, a template remix or a skill in use.

Review

When you submit, a version joins the review queue (unless it is fast-tracked). Dunea aims to respond within 3 business days. dunea-plugin status shows your place in the queue (GET /api/marketplace/dev/listings/:slug/review-status):

  1.3.0 is #4 in the review queue (Dunea aims to respond within 3 business days).

A reviewer looks at the version itself: the listing, the permissions it asks for against what it does, the prices, and, for plugins with siteScripts, every script. They install it on a test app and use its main flow. Templates are remixed and skills are read in full. Site scripts always get a manual review.

If a version is rejected, status shows the reviewer's notes and the rule ids it broke.

Fast-track updates

An update to an approved listing is approved automatically, without waiting for a person, when nothing that needs a reviewer has changed. It qualifies when, compared with the current approved version:

• check finds no errors, and every endpoint responds
• the kind and pricing are the same
• for plugins: the same permissions and subscribes, the same origins for webhookUrl and panel.url, the same site script URLs and consent categories, the same AI tools with the same descriptions and inputs (a tool may be removed or get cheaper), and no new or more expensive metered usage
• for themes: the same guide and sections
• skills and templates never qualify: their instructions and snapshot are what review checks

Fixes, listing copy, new screenshots, a moved endpoint path, a removed tool or a lower price all qualify. The first version of a listing is always reviewed by a person, and so is anything that changes what owners approved or pay, or what the Dunea AI reads (tool descriptions, skill instructions, theme guides).

dunea-plugin check tells you whether a version would be fast-tracked, and why not (fastTrackEligible and fastTrackReason). A fast-tracked version has reviewMode: "auto". Dunea can still review it afterwards, and suspend it if it breaks the guidelines.

Listing status

Your listing as a whole is draft (nothing approved yet), listed (visible in the marketplace), delisted (no longer offered to new installs) or suspended (removed by Dunea, for example after a policy breach).

Rolling back

If an approved version has a problem, make an earlier approved version current again:

dunea-plugin release 1.2.0

New installs get 1.2.0 from then on. Installs that already granted that version's permissions move to it; the rest are asked first. Rolling back does not need review, because the version was already approved. Then fix the problem and ship it as a new, higher version.

Analytics

dunea-plugin analytics (or the developer portal) shows how each listing is doing over the last 1 to 365 days, 30 by default (GET /api/marketplace/dev/listings/:slug/analytics?days=30):

A daily breakdown is in daily. A high same-day churn usually means the first run is confusing: check what an owner sees right after installing.

Before you submit

Use this checklist for every version, alongside the review checklist.

Listing

• name, tagline and description say plainly what the owner gets, who it is for and what it costs. No claims you cannot back up.
• icon and screenshots are your own, load over HTTPS, and show the real product.
• developer.supportEmail reaches a person who answers.
• developer.privacyUrl explains what data you receive from Dunea apps, what you do with it and how long you keep it.
• categories fit what the listing actually does.
• pricing matches what the description says, including any trial.
• dunea-plugin check shows no errors, and you've read every warning.

Plugins

• permissions lists only what the current version uses.
• Your webhook endpoint verifies dunea-signature on every request and rejects stale timestamps.
• It dedupes events on the envelope id, and returns a non-2xx status when it could not process an event.
• plugin.installed stores the access token encrypted. plugin.uninstalled deletes it.
• mode: "test" events and tool calls do not trigger real-world actions (charges, shipments, emails to buyers).
• AI tools answer within 15 seconds, have clear descriptions, and return readable errors.
• Priced tools and usage are disclosed in the description, and usage reports use idempotency keys.
• The panel verifies the session token on your server before returning data.
• test-webhook deliveries reach your endpoint and return 200.
• You've tried it end to end with dunea-plugin dev.

Site scripts

• Each script's consent category matches what it does.
• The script loads only what the listing describes, and does not read the site's forms, cookies or storage.

Themes

• Text, muted text and button text pass contrast checks on their backgrounds.
• The guide gives concrete direction (layout, type, colour, imagery, motion, tone) and leads with what matters most.
• Screenshots show the theme applied to a realistic site.

Templates

• The source project contains no secrets, real customer data or anyone else's work.
• previewUrl is live and shows the same site as the snapshot.
• pages lists the pages the template really has, and firstPrompt tells the owner what to change first.
• The price, if any, is one-time.

Skills

• The instructions are on one subject and lead with what matters most.
• Triggers are phrases an owner would actually use.
• Nothing in the instructions asks the AI to get around Dunea's rules (DUN-K001).

Guidelines

Reviewers reject versions that:

• Ask for permissions the plugin does not use
• Collect buyer or visitor data the listing and privacy policy do not mention
• Put a tracking script under the necessary consent category
• Misrepresent what the listing does, who makes it, or what it costs, including the price of paid tools and usage
• Copy another creator's listing, brand, theme or template
• Use an AI tool description to instruct the Dunea AI to do anything other than use the tool (for example, to change unrelated parts of the app)
• Put non-design instructions in a theme guide
• Use a skill to change what the AI is allowed to do, rather than how well it does it

Dunea can suspend a listing that is already live if it breaks these guidelines, stops working, or puts owners or their visitors at risk.

After approval

• Owner reviews. Owners who installed your listing can rate and review it. You can reply to each review from the developer portal.
• Badges. Listings earn badges shown on cards and listing pages: new for the first 90 days after the first approval, and verified once a listing has at least 10 active installs, 3 reviews and a rating of 4.3 or more. Dunea may also feature a listing.
• Verified developers. Dunea may mark a developer as verified after identity and quality checks. The badge shows on your listings and profile.
• Your public profile at dunea.ai/creators/<handle> lists your listings and total installs. Every listing also has a public page at dunea.ai/marketplace/<slug>. Add ?ref=<your referral code> when you share either, and signups through it are attributed to you.
• Delivery log. Watch failed and dead deliveries for each listing in the developer portal; see Webhooks and signatures.