bino registryPublic registry · freePublic and private packages

One reporting standard. Every team, every report.

bino registry stores report definitions as packages: layouts, styles, tables and commentary blocks, each with a version and a digest. One team publishes the standard. Everyone else adds it with one command and gets the same result, on a laptop and in CI.

  • Immutable versions
  • Digest-verified installs
  • Public and private teams
  • bino.lock pins every package

Why it matters

A standard only holds when reusing it is easier than ignoring it

Copied report folders drift apart within a quarter. With a registry, teams use your reporting standard instead of rebuilding it, and you can see which version each report used.

Write the standard once

Your layout, your colour and scenario rules and your recurring commentary blocks become a package. Teams add it with one command instead of copying a folder.

Same inputs, same report

bino.lock pins every resolved version and its digest. The report you signed off in March rebuilds from the same inputs in November, on any machine.

You can check what you use

A published version is never overwritten. bino registry verify hashes every installed file again, compares it with the lockfile, and fails the pipeline on any difference.

Teams own their scope

Each team owns a scope such as @acme and decides who may publish to it. No central queue for every change to a layout.

How it works

Consume, publish, verify

The registry is part of the normal build. Dependencies are declared in bino.toml, pinned in bino.lock and installed under .bino/registry/. Installed packages then behave like local documents.

bino registry add resolves the dependency tree, verifies the digests, writes the files and records the dependency:

bash
# follow the "latest" tag
bino registry add @acme/base-layout

# or pin an exact version
bino registry add @acme/quarterly-report@1.2.3

The result goes into bino.toml. An exact version stays where it is. A tag moves when you run bino registry update:

bino.tomltoml
[dependencies]
"@acme/quarterly-report" = "1.2.3"
"@acme/base-layout"      = "latest"

You reference installed components by their scoped name and pass parameters, like any local document:

pages/commentary.yamlyaml
apiVersion: bino.bi/v1alpha1
kind: LayoutPage
metadata:
  name: commentary-page
spec:
  children:
    - kind: Text
      ref: "@acme/commentary"
      params:
        REGION: EU

Teams & visibility

Public by default. Private where it matters.

Every team owns a scope, the @acme in @acme/base-layout. Visibility is set per package, so one organisation can publish some packages to everyone and keep its internal layouts private.

Public teams

public
  • Anyone can read public packages, without an account.
  • A good place for IBCS starter kits, shared layouts and open templates.
  • Free on registry.bino.bi.

Private teams

private
  • Reading a private package needs at least the viewer role in the owning team.
  • Everyone else gets a 404, so nobody can find out which private packages exist.
  • Publishing needs a personal access token. The CLI works against a private registry without changes.

Team roles

RoleMay
viewerRead the team’s private packages. Nothing else.
memberPublish versions, move tags that are not protected, edit package metadata.
maintainerAll of member, plus deprecate and withdraw versions, manage members, move protected tags.
ownerAll of maintainer, plus manage owners and delete the team.

Running it

Public, or for your organisation

The public registry is free. If your organisation needs private packages on its own instance, we can run a registry for you, or help you run one in your own network.

Community

Public registry

Free

registry.bino.bi: the shared home for public report definitions.

  • Public packages
  • Read access without an account
  • Personal access tokens for CI
  • Sign in without a password
Organisation

Hosted for you

On request

A separate bino registry for your organisation, run by us.

  • Private packages, teams and roles
  • Hosting in the EU
  • Backups, monitoring and updates included
  • Help with your first internal packages
Organisation

In your network

On request

The registry in your own data centre, VPC or air-gapped network.

  • One binary with the web UI included
  • Your report definitions never leave your network
  • Help with the deployment
The client side is open source
bino cli is open source, and it talks to any registry: the public one, one we run for you, or your own. Your reports are not tied to a hosted service.

Technical detail

What your architects will ask

The command reference and every flag are in the docs. This is the shape of the system.

Packages & versions

  • Package names are always @scope/name. The scope belongs to a team.
  • A published version is immutable. It is never overwritten or replaced.
  • No version ranges: either an exact pin (1.2.3) or a tag (latest) that moves on bino registry update.
  • Only the publish flow moves the latest tag.
  • Versions can be deprecated or withdrawn without being deleted.

Integrity

  • bino.lock records the exact version, digest, kind, path and dependencies of every package. Commit it.
  • .bino/registry/ is rebuilt from the lockfile. Add it to .gitignore.
  • Digests are taken over the canonical form of a document, so reformatting a file does not fail a check. Changed content does.
  • bino registry verify works offline and exits non-zero on any difference, so it fits a CI gate.
  • list, remove and verify work without network access.

Publishing rules

  • At most 50 files per package, each at most one folder deep.
  • 1 MB per manifest, 50 MB per resource.
  • Manifests are .yaml/.yml. Resources can be .png .jpg .jpeg .webp .gif .csv .xlsx .parquet.
  • Symlinks, anything under secrets/ or signing/, and ConnectionSecret or SigningProfile documents are rejected, so credentials cannot be published by accident.
  • bino lint runs first but never blocks. The registry validates the upload and has the final word.
  • Exit codes: 0 published, 1 configuration error, 3 registry rejected the upload or could not be reached.

Authentication

  • Personal access tokens (bino_pat_…) are created in the web UI under Settings → Tokens.
  • A token is exchanged for a short-lived session token on every call.
  • bino registry login stores it in ~/.bino/credentials.json (mode 0600), per registry URL.
  • In CI, pass BINO_REGISTRY_TOKEN instead. bino registry login --with-token reads the token from stdin.
  • Public packages need no token at all.

Pointing at a registry

  • Order: the --registry flag, then [registry].url in bino.toml, then BINO_REGISTRY_URL, then ~/.bino/config.toml, then the public default.
  • The public default is https://registry.bino.bi.
  • A project’s bino.toml always wins over the environment and the global config.
  • One line in ~/.bino/config.toml points every project on a machine at your own registry.

A private registry for your organisation?

Tell us how your reporting teams work. We will show you the options: hosted by us, or in your own data centre.