Currently the flutter/packages repo tooling has an allow list for any package that's not an sdk: dependency and not from within flutter/packages. However, any package published by flutter.dev or dart.dev publisher accounts is allowed by policy, so it would be simpler (although slightly more fragile from a CI standpoint since it would add more network communication) to query the pub.dev API for the publisher, instead of having to list all of them individually.