# Changelog

> What has shipped on Private Pub, newest first.

## Service accounts

October 13, 2026

Create a machine principal (e.g. GitHub Actions), give it reader or writer on any teams you own, and use one `sa_` token in CI: `dart pub token add https://your-root-url --env-var PRIVATE_PUB_TOKEN`.

- Existing team keys keep working. Owners can convert a key without changing the secret already in CI.

## Private Pub is public

October 13, 2026

Publish Dart and Flutter packages that only your team can install, with the dart pub commands you already use.

- Packages belong to a team. Anyone who is not on it gets a 404, on the site and from dart pub, as if the package did not exist.
- pub.dev packages can come through the same server. Each archive is checked against the checksum pub.dev publishes before it is kept.
- Stock dart pub is enough. Add a token with `dart pub token add`, set `publish_to` to publish, and mark a dependency `hosted` to install it.
- Teams have owner, writer and reader roles. Owners run the team, writers publish, and readers install.
- Each person creates their own token on the account page. It stays there, so they can copy it again, and replace it if it leaks.
- CI uses a team key instead of a personal token. A reader key installs the team's packages, and a writer key can publish.
- A new package name has to be free on pub.dev. Names that only look like one already taken are rejected too, so a private package can't be mistaken for a public one.
- The setup guide covers Claude Code, and `/llms.txt` tells other agents how the server works.
- Every team starts free, with up to 10 packages. Premium is $10 a month or $100 a year per team, for unlimited packages, however many people are on it.