One reporting standard. Every team, every report.
bino registry stores report definitions as packages: layouts, styles, tables and commentary blocks, each with a version and a digest. One team publishes the standard. Everyone else adds it with one command and gets the same result, on a laptop and in CI.
- Immutable versions
- Digest-verified installs
- Public and private teams
- bino.lock pins every package
Why it matters
A standard only holds when reusing it is easier than ignoring it
Copied report folders drift apart within a quarter. With a registry, teams use your reporting standard instead of rebuilding it, and you can see which version each report used.
Write the standard once
Your layout, your colour and scenario rules and your recurring commentary blocks become a package. Teams add it with one command instead of copying a folder.
Same inputs, same report
bino.lock pins every resolved version and its digest. The report you signed off in March rebuilds from the same inputs in November, on any machine.
You can check what you use
A published version is never overwritten. bino registry verify hashes every installed file again, compares it with the lockfile, and fails the pipeline on any difference.
Teams own their scope
Each team owns a scope such as @acme and decides who may publish to it. No central queue for every change to a layout.
How it works
Consume, publish, verify
The registry is part of the normal build. Dependencies are declared in bino.toml, pinned in bino.lock and installed under .bino/registry/. Installed packages then behave like local documents.
bino registry add resolves the dependency tree, verifies the digests, writes the files and records the dependency:
# follow the "latest" tag
bino registry add @acme/base-layout
# or pin an exact version
bino registry add @acme/quarterly-report@1.2.3The result goes into bino.toml. An exact version stays where it is. A tag moves when you run bino registry update:
[dependencies]
"@acme/quarterly-report" = "1.2.3"
"@acme/base-layout" = "latest"You reference installed components by their scoped name and pass parameters, like any local document:
apiVersion: bino.bi/v1alpha1
kind: LayoutPage
metadata:
name: commentary-page
spec:
children:
- kind: Text
ref: "@acme/commentary"
params:
REGION: EUA project can be published once it has a [package] table. include decides what ships:
[package]
name = "@acme/starter-kit"
description = "A reusable kit: an IBCS table, the style it wears and a logo asset."
tags = ["starter", "ibcs"]
category = "components"
visibility = "private"
compat-cli = ">=1.0.0"
include = ["components", "styles", "resources"]# validate the package without creating a version
bino publish --dry-run
# publish a new, immutable version
bino publish --bump patchVersions cannot be changed after publishing, so put --dry-run in front of every automated publish. --visibility public|private applies when the package is first created.
A pipeline installs the locked state and stops if anything differs:
export BINO_REGISTRY_TOKEN="bino_pat_..."
bino registry install
bino registry verify
bino buildTeams & visibility
Public by default. Private where it matters.
Every team owns a scope, the @acme in @acme/base-layout. Visibility is set per package, so one organisation can publish some packages to everyone and keep its internal layouts private.
Public teams
public- Anyone can read public packages, without an account.
- A good place for IBCS starter kits, shared layouts and open templates.
- Free on registry.bino.bi.
Private teams
private- Reading a private package needs at least the viewer role in the owning team.
- Everyone else gets a 404, so nobody can find out which private packages exist.
- Publishing needs a personal access token. The CLI works against a private registry without changes.
Team roles
| Role | May |
|---|---|
viewer | Read the team’s private packages. Nothing else. |
member | Publish versions, move tags that are not protected, edit package metadata. |
maintainer | All of member, plus deprecate and withdraw versions, manage members, move protected tags. |
owner | All of maintainer, plus manage owners and delete the team. |
Running it
Public, or for your organisation
The public registry is free. If your organisation needs private packages on its own instance, we can run a registry for you, or help you run one in your own network.
Public registry
registry.bino.bi: the shared home for public report definitions.
- Public packages
- Read access without an account
- Personal access tokens for CI
- Sign in without a password
Hosted for you
A separate bino registry for your organisation, run by us.
- Private packages, teams and roles
- Hosting in the EU
- Backups, monitoring and updates included
- Help with your first internal packages
In your network
The registry in your own data centre, VPC or air-gapped network.
- One binary with the web UI included
- Your report definitions never leave your network
- Help with the deployment
Technical detail
What your architects will ask
The command reference and every flag are in the docs. This is the shape of the system.
Packages & versions
- Package names are always
@scope/name. The scope belongs to a team. - A published version is immutable. It is never overwritten or replaced.
- No version ranges: either an exact pin (
1.2.3) or a tag (latest) that moves onbino registry update. - Only the publish flow moves the
latesttag. - Versions can be deprecated or withdrawn without being deleted.
Integrity
bino.lockrecords the exact version, digest, kind, path and dependencies of every package. Commit it..bino/registry/is rebuilt from the lockfile. Add it to .gitignore.- Digests are taken over the canonical form of a document, so reformatting a file does not fail a check. Changed content does.
bino registry verifyworks offline and exits non-zero on any difference, so it fits a CI gate.list,removeandverifywork without network access.
Publishing rules
- At most 50 files per package, each at most one folder deep.
- 1 MB per manifest, 50 MB per resource.
- Manifests are
.yaml/.yml. Resources can be.png .jpg .jpeg .webp .gif .csv .xlsx .parquet. - Symlinks, anything under
secrets/orsigning/, andConnectionSecretorSigningProfiledocuments are rejected, so credentials cannot be published by accident. bino lintruns first but never blocks. The registry validates the upload and has the final word.- Exit codes:
0published,1configuration error,3registry rejected the upload or could not be reached.
Authentication
- Personal access tokens (
bino_pat_…) are created in the web UI under Settings → Tokens. - A token is exchanged for a short-lived session token on every call.
bino registry loginstores it in~/.bino/credentials.json(mode 0600), per registry URL.- In CI, pass
BINO_REGISTRY_TOKENinstead.bino registry login --with-tokenreads the token from stdin. - Public packages need no token at all.
Pointing at a registry
- Order: the
--registryflag, then[registry].urlinbino.toml, thenBINO_REGISTRY_URL, then~/.bino/config.toml, then the public default. - The public default is
https://registry.bino.bi. - A project’s
bino.tomlalways wins over the environment and the global config. - One line in
~/.bino/config.tomlpoints every project on a machine at your own registry.
Documentation
Read the reference
Everything on this page is in the docs, with every flag and edge case.
bino registry
The command reference: add, install, update, remove, list, search, info, verify, login, logout.
bino publish
Publishing a version: flags, what ships, validation, limits and exit codes.
Registry and dependencies
The guide: package names, pin vs. tag, the lockfile, CI and authentication.
Project configuration
The [package], [registry] and [dependencies] tables in bino.toml, field by field.
Name scoping
Why @scope/name is a valid document name and how scoped names resolve.
A private registry for your organisation?
Tell us how your reporting teams work. We will show you the options: hosted by us, or in your own data centre.