Review checklist

Every listing version is checked against one public checklist. Each rule has a stable id. dunea-plugin check reports findings with these ids, the marketplace stores them with each version, and a reviewer who rejects a version cites them, so a rejection always says exactly what to fix.

The rules come from REVIEW_RULES in @dunea/plugin-sdk:

import { REVIEW_RULES } from '@dunea/plugin-sdk';

REVIEW_RULES['DUN-P001']; // 'Ask only for the permissions the listing actually uses'

The rules

Checked by says where a rule is caught first:

• check: dunea-plugin check finds it on your machine, and the marketplace runs the same check when you upload. Errors block submission; warnings are for you and the reviewer to weigh.
• upload: the marketplace checks it when you upload (it needs the network or your account).
• reviewer: a person checks it during review.

Every rule can also be cited by a reviewer.

Some rules are warnings in check and decided by the reviewer. For example, fewer than 3 screenshots is a warning, and no screenshots is an error for plugins and templates (DUN-L001); a description that doesn't mention credits when a tool is priced is a warning (DUN-B002); a new permission in an update is flagged so you know every owner will be asked again (DUN-P002).

Notes on the rules

• DUN-U001. localhost, private network addresses and bare IP addresses are rejected for webhookUrl, panel.url, site scripts and previewUrl. Use a public hostname with a valid certificate.
• DUN-L002. Say what it does, who it is for and what it costs in the first lines of description. If the listing is paid, or has paid tools or usage, the description has to say so.
• DUN-P001. Reviewers compare every permission with what the plugin does. "We might need it later" is a rejection; add the permission in the version that uses it.
• DUN-B002. Disclose each paid tool's price and the usage price in the description. See Priced tools and metered usage.
• DUN-S001, DUN-S002. Every site script is reviewed by hand. See Site scripts and consent.
• DUN-T001, DUN-T002. Contrast is checked for text on background and surface, and primaryText on primary, in both palettes if you have darkColors. muted text below 4.5:1 is a warning. See Themes.
• DUN-T003, DUN-T004. See Templates.
• DUN-K001. See Skills for what the check looks for.
• DUN-Q001. Reviewers install every plugin on a test app (templates are remixed, themes and skills applied) and use its main flow. Make sure that works without special setup, or explain the setup in the version's changelog.

Rejections

A rejected version has reviewNotes from the reviewer and rejectionCodes: each rule id it broke, with the rule's text. dunea-plugin status prints both:

Order Alerts (order-alerts) — listed, 42 active installs
  1.3.0      rejected    reviewed 2026-11-03T10:12:00.000Z
    review notes: customers:read is not used by any event or tool. The description doesn't say create_label costs 2 credits.
    DUN-P001: Ask only for the permissions the listing actually uses
    DUN-B002: Tool prices must be disclosed in the description and match real value
  1.2.0      approved    reviewed 2026-10-20T08:40:00.000Z

Fix every cited rule, bump version, and submit again. If you think a rejection is wrong, reply with the listing slug, the version and the rule id; see Community and help.