Open source · Self-hosted

Your private pub.dev,
running on your own stack.

CLUB is a private package repository for Dart and Flutter teams. Same commands your developers already use — dart pub get, dart pub add, dart pub publish — pointed at a server you own.

Get started → View on GitHub

1 · Add to pubspec

dependencies:
  acme_ui:
    hosted: https://club.acme.com
    version: ^2.4.0

2 · Install as usual

$ dart pub get
+ acme_ui 2.4.0 (from club.acme.com)
Changed 1 dependency.

3 · Publish a new version

$ club publish
✓ uploading acme_ui-2.4.1.tar.gz
✓ 2.4.1 live at club.acme.com

Scroll

§ Publish

The commands your team already knows.

CLUB plugs into the workflow dart and flutter developers already have. Point `hosted:` at your server and every command keeps working.

Familiar

Works with dart pub, unchanged

Your team keeps running the commands they already know. dart pub get, dart pub add, dart pub publish — all work, just pointed at your CLUB server.

CLI

A CLI of its own

Log in, publish, add dependencies, manage publishers, and run admin tasks from one club CLI. Pairs with dart pub, doesn't replace it.

CI / CD

CI-ready out of the box

Use the club CLI in any pipeline. A first-party GitHub Action is included for publishing and installing packages from CI.

§ Private by default

Nothing leaves your walls.
Ever.

Your packages, your users, your download counts — all live on infrastructure you control. CLUB has no telemetry, no analytics pixel, no third-party SDK. It is open source, end to end.

Telemetry requests

Not on install, not in the UI, not ever.

Third-party trackers

No cookies, no pixels, no SDKs you didn't invite.

Ads, forever

There is no ad system to turn off.

✓Open source · Apache 2.0 ✓Configurable privacy & terms pages ✓Self-hosted · your TLS, your ingress ✓Audit the code yourself

§ Govern

Admin powers pub.dev
won't give you.

Unlist a version. Retract a mis-publish. Transfer a package. Delete what you don't need. It's your registry — act like it.

Admin — runs the show

Editor — publishes & curates

Viewer — browses & downloads

package acme_ui@2.4.1 admin

✓ 18:14 priya — retracted acme_ui@2.4.1 ✓ 18:15 priya — force-overwrite acme_ui@2.4.1 ✓ 18:18 priya — rotated ci-publisher token

Control

Unlist, discontinue, retract, delete

Full lifecycle control over every version. Mis-publish something sensitive? Fix it. Deprecate a package? Do it. You're actually in charge.

Overwrite

Force-overwrite a version

Sometimes a published tarball is just wrong. CLUB lets you replace a version in place when you need to — with auditability.

Transfers

Clean ownership transfers

Move packages between publishers as teams and projects change. No database surgery, no tickets to the provider.

Privacy

No tracking, no ads, ever

There is no telemetry. No analytics pixels. No third-party SDKs. It's open source — audit the code and see.

Legal

Your privacy and terms

Drop in your own privacy and terms pages and they wire up across the UI automatically. Make it look like your company because it is.

§ Access

Three roles.
Clear boundaries.

No org charts to manage, no custom RBAC to design. Three roles your team already understands — plus named CI tokens for machines.

Admin

Runs the show.

Scope Everything

✓Server settings
✓Users & roles
✓Publishers
✓Publish
✓Unlist · retract
✓Force-overwrite
✓Transfer
✓Delete

Editor

Publishes and curates.

Scope Packages they own

✓Publish new versions
✓Unlist · retract
✓Mark discontinued
✓Manage uploaders
✓Edit metadata

Viewer

Browses and installs.

Scope Read-only

✓Browse packages
✓Search
✓Download
✓Like & favorite

§ Quality

Pub Scoring on every publish.

The actual Dart tooling pub.dev uses to score packages: scored against the same five criteria as pub.dev. Pub points measure what matters — conventions, documentation, platform support, static analysis, and dependency health.

Same tool — pana from the Dart team, versioned alongside the SDK.
Same rubric — 5 criteria, 160 points, no local modifications.
Your server — runs in-process; the report never leaves your infra.

club-server · pana

Scoring package acme_ui...
Running dart analyze...
Running platform detection...
Running dartdoc...
Running dependency check...

Pub Points
Section                                      Grade   Max
✓ Follow Dart file conventions               30      30
✓ Provide documentation                      20      20
✓ Platform support                           20      20
⚠ Pass static analysis                       40      50
  └─ 2 warnings in lib/src/theme.dart
⚠ Support up-to-date dependencies            30      40
  └─ 1 deprecated release in graph

TOTAL                                       140     160

elapsed: 4.7s · package scored
▍

Readme Changelog Example API reference Versions

acme_ui · theme.dart

ThemeTokens class

Typed access to the design-system tokens — colors, spacing, radii, typography.

Constructors

ThemeTokens(this.colors, this.space, this.radii)

Properties

colors ColorSet final

space SpaceScale final

radii RadiusScale final

Methods

copyWith({ColorSet? colors, SpaceScale? space}) → ThemeTokens

resolve(BuildContext context) → Theme

§ Docs

API reference,
auto-hosted.

Publish a package and CLUB renders its full dartdoc alongside the README — classes, methods, fields, links between them, all on your domain, no extra pipeline to maintain.

GENERATED On every publish

HOSTED Your domain, alongside the README

SEARCH Class & method names indexed

MARKDOWN READMEs, CHANGELOGs, examples — full GFM

§ Storage

Three backends,
all production-ready.

Filesystem, S3, or Firebase Storage (GCS) for package tarballs. Pick one at deploy time with a single environment variable — no code changes, no forks, no vendor lock-in. Filesystem isn't a dev-only fallback; it's a real option for teams who'd rather own their disk. Metadata lives in an embedded SQLite database — no separate service to run.

Your disk

Filesystem

Production-ready — not just for dev.

Perfect for single-server deploys, private clusters, and any environment where you'd rather not run an object store. Block storage, filesystem snapshots, backup tooling — all the disk-level primitives you already use just work.

Good fit for

·Single-server deploys
·Air-gapped environments
·Private clouds
·NFS / EBS / Persistent volumes

env BLOB_BACKEND=fs

Object storage

S3 · S3-compatible

Scale to any capacity.

Any S3-compatible endpoint: AWS S3, Cloudflare R2, MinIO, Wasabi, Backblaze B2 — set the endpoint and credentials and go. Tarballs stream directly to the bucket, no local spool.

Good fit for

·AWS, R2, B2, Wasabi, MinIO
·Multi-region replication
·Teams already on S3
·Thousands of packages

env BLOB_BACKEND=s3

Google Cloud

Firebase Storage (GCS)

Native for GCP shops.

For teams already running on Google Cloud — uses Firebase Storage (which is GCS under the hood) with service-account auth. Same IAM, same monitoring, same billing line.

Good fit for

·GCP-native teams
·Existing GCS buckets
·Workload identity / ADC
·Consolidated GCP billing

env BLOB_BACKEND=gcs

§ Publishers

Publishers,
verified and unverified.

Organize packages under publishers your team owns. Verify them against a domain you control for the verified badge, or skip the ceremony and use an unverified handle for internal-only work.

✓

@acme ✓

example.com · verified publisher

Proven via

dig TXT _club-challenge.example.com

✓Verified badge across the UI
✓Domain-scoped ownership. The badge proves who runs it.
✓Great for partner / SDK-style packages

12 packages acme_ui · acme_theme · acme_motion · …

@tools-team

unverified · internal use

No ceremony

Claim a handle, publish, done.

·No DNS, no domain, no approval flow
·Perfect for internal teams and short-lived orgs
·Promote to verified later. Same handle, new badge.

4 packages feature_flags · log_sink · telemetry · …

Every publisher CRUD members · Promote / demote · Named uploaders per package · Transfer ownership · Invite links

CLI & CI

Publish from the terminal. Ship from CI.

A first-class club CLI, and a GitHub Action that speaks the same protocol. dart pub still works the way it always did.

club CLIlogin, publish, admin

dart pubunchanged, works alongside

GitHub Actionfirst-party, out of the box

Named tokensone per CI pipeline

acme-ui · zsh

$ club login --host=club.acme.com
✓ logged in as mira@acme

$ club publish
Validating package...
  ✓ pubspec.yaml · CHANGELOG.md · README.md
  ✓ dartdoc generated (187 refs)

Uploading acme_ui-2.4.1.tar.gz
  ✓ 184 kB in 0.4s
  ✓ live: club.acme.com/packages/acme_ui/2.4.1▍

§ Compatibility

The commands you already type still type the same.

CLUB implements the same HTTP surface pub.dev does. Your clients don't need to know they're talking to a different host.

Command What it does Works on CLUB? Notes

dart pub get Resolve & fetch deps ✓ Yes Point hosted: at your CLUB server

dart pub add Add a dependency ✓ Yes Supports --hosted-url

dart pub upgrade Bump to latest allowed ✓ Yes Respects constraint solving

dart pub publish Publish a package ✓ Yes OAuth or token auth

dart pub global activate Install a CLI package ✓ Yes Works from CLUB host

dart pub cache Inspect local cache ✓ Yes Client-side, unchanged

club login Log into a CLUB host ✓ Yes CLUB CLI · optional but nicer

club publish CLUB-native publish ✓ Yes Faster UX, richer output

club admin … Admin operations ✓ Yes Unlist, retract, transfer, roles

§ FAQ

Pinned to the board, in case you missed them.

Every question we get asked, with a colored tack so you can skim by topic. No accordions, no clicking — just read.

Basics
Workflow
Admin & control
Run it
Trust

№ 01
What exactly is CLUB?

CLUB is an open-source, self-hosted Dart and Flutter package repository. It implements the full Pub Spec v2 API, so any client that talks to pub.dev — including dart pub itself — works against your CLUB server unchanged.
Basics
№ 02
How is this different from pub.dev?

pub.dev is the public Dart registry, run by the Dart team. CLUB is software you run yourself. Same shape, your hardware, your packages, your rules. You can use both at once: public deps from pub.dev, private deps from CLUB.
Basics
№ 03
Is it really open source?

Yes — Apache 2.0. The whole server, web UI, CLI, and storage backends are in the open. There is no closed-core, no enterprise SKU, no telemetry. Read the code, fork it, ship it.
Basics
№ 04
Do my developers have to install anything new?

No. They keep using dart pub get, dart pub add, and dart pub publish. The only difference is the hosted: URL in pubspec.yaml points at your CLUB server instead of pub.dev.
Workflow
№ 05
How does publishing from CI work?

Use the club CLI (or our GitHub Action) with a per-package upload token. Tokens are scoped to the package, not the user — rotate without touching any human accounts.
Workflow
№ 06
Does it handle pub scoring and dartdoc?

Yes. Every published version is scored with the same pana engine pub.dev uses, and the API reference is generated and hosted automatically alongside the README. No extra pipeline to wire up.
Workflow
№ 07
Can I unlist or remove a published version?

Yes — that's a big part of why people self-host. You can unlist, retract, force-overwrite, or fully delete versions. All of it is audit-logged and gated behind the Admin role.
Admin & control
№ 08
How does access control work?

Three roles — Admin, Editor, Viewer — applied at the publisher level. Admins do everything, Editors publish and curate, Viewers read and download. Tokens for CI are separate and scoped per-package.
Admin & control
№ 09
Can I move packages between publishers?

Yes. Publishers map to teams, and ownership transfers are a first-class action — no database surgery, no support ticket. Old uploaders are revoked, new ones are issued.
Admin & control
№ 10
What does it take to run CLUB?

One container. Multi-arch (linux/amd64 + linux/arm64), with the server, web UI, and dartdoc generation bundled in. SQLite + filesystem works out of the box for small teams; swap to S3 or GCS with an env var when you scale.
Run it
№ 11
Which storage backends are supported?

Filesystem (default — great for dev and small deployments), Amazon S3, and Google Cloud Storage / Firebase Storage. The blob store is an interface — bringing another backend is a few hundred lines.
Run it
№ 12
Is it production-ready?

Yes. CLUB is built on shelf, drift/SQLite, and bcrypt + JWT — the same boring, audited primitives you'd reach for yourself. Stand up TLS at your ingress and you're done.
Run it
№ 13
Does CLUB phone home?

No telemetry. No analytics pixel. No third-party SDK. The only network calls the server makes are to your storage backend and to whatever you configure for SMTP. Audit the source if you want to verify.
Trust
№ 14
Can I use my own privacy policy and terms?

Yes — drop in your /privacy and /terms pages and they wire into the UI automatically. Pair that with your TLS cert and your DNS, and the whole thing reads like your company. Because it is.
Trust

§ If you'd like

Only if you feel like it.

CLUB is free and will stay that way. If it's been useful and you'd like to say thanks, here are two easy ways — pick whichever fits, skip both with zero guilt.

RECURRING

Sponsor on GitHub

Monthly support from $5. The tier that actually changes how much time the project gets. Cancel anytime.

GitHub Sponsors →

ONE-TIME

Buy me a coffee

A quick thank-you. No account, no recurring charge — just a tip if CLUB helped you out today.

Buy Me a Coffee →

✓ 100% goes to maintenance ✓ No perks, no unlocks ✓ Apache 2.0 forever

Private pub.dev · Apache 2.0

Host your own

One container. Your cloud. Five minutes to see it running, an afternoon to roll it out for the team.

Read the quick start →

› CLUB

pub.

Runtime1 × Docker

Archamd64 · arm64

LicenseApache 2.0

GitHub

Your private pub.dev, running on your own stack.

The commands your team already knows.

Works with dart pub, unchanged

A CLI of its own

CI-ready out of the box

Admin powers pub.devwon't give you.

Unlist, discontinue, retract, delete

Force-overwrite a version

Clean ownership transfers

No tracking, no ads, ever

Your privacy and terms

Admin

Editor

Viewer

Pub Scoring on every publish.

ThemeTokens class

API reference, auto-hosted.

Publish from the terminal. Ship from CI.

What exactly is CLUB?

How is this different from pub.dev?

Is it really open source?

Do my developers have to install anything new?

How does publishing from CI work?

Does it handle pub scoring and dartdoc?

Can I unlist or remove a published version?

How does access control work?

Can I move packages between publishers?

What does it take to run CLUB?

Which storage backends are supported?

Is it production-ready?

Does CLUB phone home?

Can I use my own privacy policy and terms?

Host your own

pub.

Your private pub.dev,
running on your own stack.

Admin powers pub.dev
won't give you.

API reference,
auto-hosted.