There are three classes of package:

• -ha - the "host application". Do NOT include the actual app package name.
• -pp - a "private package", i.e. non-public and/or non-published package. Do NOT include the actual name of any non-public package.
• [pkg name]:X.Y.Z - the name of a public, published package with the version (with truncated zeros, see below)

The hyphen is critical. Since hyphens are not allowed in package names, we make sure we don't have collisions.

To determine if a package can be reported in analytics, look at pubspec.lock

A package is considered public and loggable if an only if:

• source: hosted
• description -> url: "https://pub.dev"

Here's an example entry from a pubspec.lock file.

  args:
    dependency: transitive
    description:
      name: args
      sha256: d0481093c50b1da8910eb0bb301626d4d8eb7284aa739614d2b394ee09e3ea04
      url: "https://pub.dev"
    source: hosted
    version: "2.7.0"

Any analytics reporting should include the package name and version. Because we are limited to 100 characters, we want this to be short. So the predefined values are 3 characters long. There should be no spaces. There should be no duplicate entries. The version should be truncated if the last value is 0. So pkg1 at v1.0.0 should be logged as pkg1:1 and pkg2 at v2.3.0 should be logged as pkg2:2.3.

A sample report could look like:

-ha,-pp,pkg1:1.2.5,pkg2:1,pkg3:1.2

• Update pkg:unified_analytics Add wasm_dry_run_package event to track public package names from wasm dry run findings. dart-lang/tools#2279