By default, dependencies resolve to Pub but you can override that to import packages from URLs, git and local path.
For instance, the following is the syntax for importing a local package:
dependencies:
transmogrify:
path: /Users/me/transmogrify
See Pub Dependencies for more info.
As far as the other part of your question, I don't see how A, B, and C can logically be public packages and rely on a private package. I would publish all of the packages and just include in the description of D that is not meant as a standalone package and is only intended as a helper package for A, B, and C.
You could also publish A, B, and C to Pub and host D on github or a public URL and specify the relevant URL dependency in the pubspec for A, B, and C (see the above link for the proper syntax). This might make the differentiation between D and the other libraries a bit clearer, though in practice they will all still be publicly available packages.