Templates

rflow ships a first-party template registry: 27 productized recipes that turn "I want to watch a Safe / relay deposits / page on dead-letters" into a validated, production-shaped project in one command. A template is not a snippet — it knows rflow semantics end to end: typed inputs, networks, contracts, packaged ABIs, relayers, notification channels, secrets, safety defaults, replay fixtures, a docs recipe and snapshot tests.

rflow templates ls                    # browse (filter: --category, --risk, --json)
rflow new --template safe-monitor     # scaffold a complete project
rflow add workflow workflow-error-pager   # compose into an EXISTING rflow.yaml

See Using templates for the full command walkthrough, Creating templates to add your own, and the use-case recipes for one page per template. The runnable walkthrough lives at examples/template-gallery (make run-template-gallery from the repo root).

Beyond the builtin set there is a community registry: templates submitted by PR into the rflow repo, fetched SHA-pinned and hash-verified at install time (rflow templates ls --community, rflow new --template community/<id>) — merged today, installable today by every existing binary.

The registry

id	category	risk	summary
`aave-health-guardian`	keeper	`money_moving`	Poll an Aave v3 position's health factor and park an approval-gated repay when it drops
`bridge-message-watch`	bridge-ops	`monitor_only`	Cross-reference a bridge's MessageSent/MessageReceived by nonce and alert on missed delivery
`chainlink-deviation-alert`	monitoring	`monitor_only`	Cron-compare two Chainlink feeds and alert when they disagree beyond a basis-point threshold
`chainlink-oracle-staleness`	monitoring	`monitor_only`	Poll a Chainlink feed's `latestRoundData` and alert when `updatedAt` goes stale
`command-decision`	examples	`monitor_only`	Cron reads a token supply on-chain, a project-owned script decides a severity, rflow reports it
`command-trade-prep`	relayers	`money_moving`	A deposit event fires a project-owned quote script; rflow signs, simulates, rechecks and sends the trade
`cron-http-report`	offchain	`monitor_only`	A cron POSTs an HMAC-signed JSON heartbeat report to an HTTP endpoint
`erc4626-vault-monitor`	monitoring	`monitor_only`	Alert on large ERC-4626 deposits/withdrawals and when the share price drops below a floor
`erc721-floor-sweep-watch`	monitoring	`monitor_only`	Index an ERC-721 collection's Transfers and alert when one wallet sweeps many in a window
`erc7683-solver`	intents	`money_moving`	Fill ERC-7683 intents: Open event, profitability quote, race check, fill
`large-transfer-alert`	monitoring	`monitor_only`	Alert a notification channel when an ERC20 transfer crosses a threshold
`liquidation-keeper`	keeper	`money_moving`	Poll a borrower's health factor and fire a simulated, gas-capped liquidation
`native-spend-report`	treasury	`monitor_only`	Cron-aggregate the journal's send history into an HMAC-signed HTTP + chat spend report
`price-alert-stream`	monitoring	`monitor_only`	Subscribe to a public price WebSocket feed, filter by symbol + threshold, and notify
`proxy-upgrade-alert`	security	`monitor_only`	Alert when an ERC1967 proxy emits Upgraded — with the old and new implementation
`relayer-low-balance-alert`	relayers	`monitor_only`	Poll a relayer wallet's native balance and alert once when it crosses under a floor
`safe-monitor`	security	`monitor_only`	Watch a Safe for owner/threshold changes and successful executions — notify
`safe-owner-change-alert`	security	`monitor_only`	Watch a Safe for AddedOwner/RemovedOwner/ChangedThreshold and report the new threshold
`security-advisory-watch`	security	`monitor_only`	Poll an RSS/Atom security feed (trigger.web) and page on every NEW matching advisory — deduped by link
`solver-inventory-rebalance`	intents	`money_moving`	Poll a solver wallet's ERC20 inventory and top it up from a funding wallet behind approval
`solver-pnl-report`	intents	`monitor_only`	Cron-summarize a solver's fill workflow from the journal: filled, skipped/raced, failed, native spend
`timelock-monitor`	governance	`monitor_only`	Watch an OpenZeppelin TimelockController for scheduled/executed/cancelled operations
`token-deposit-relay`	relayers	`money_moving`	ERC20 deposits into a watched address trigger a gated, relayed payout
`treasury-sweep-approval`	treasury	`money_moving`	Cron reads a hot wallet ERC20 balance and parks a sweep behind approval
`uniswap-v3-lp-monitor`	monitoring	`monitor_only`	Alert when a Uniswap v3 pool's price tick leaves an LP range — on Swap events and a slot0 poll
`webhook-idempotent-handler`	offchain	`prepares_tx`	An HMAC-authenticated webhook with a native idempotency_key feeds a command step that validates, dedupe-keys and prepares a transfer; rflow notifies
`workflow-error-pager`	monitoring	`monitor_only`	Page pagerduty or telegram when ANY workflow's run dead-letters or fails

Risk labels

Every template carries an honest risk label — filter with rflow templates ls --risk <label>:

monitor_only — no signer, no relayer, no transactions. The generated project physically cannot move money.
prepares_tx — creates transaction data (calldata, dedupe keys) but never broadcasts; there is no signer in the project.
money_moving — sends transactions through the embedded relayer.
admin — contract ownership / proxy / pause / timelock actions.
experimental — useful, but not a recommended production starting point.

(No bundled template is currently admin or experimental.)

Safety defaults on money templates

Every money_moving template renders the full set of rails — they are in the generated YAML, not implied by the runtime:

pre-broadcast simulation with assert_sim: ["${{ sim.ok }}"] and gas.limit_from_simulation
a gas price/cost cap (gas.max_price / max_cost)
a recheck: re-evaluated immediately before broadcast wherever a time-varying guard exists (erc7683-solver's fill deadline, command-trade-prep's quote freshness) — flows whose only broadcast-time guard is the fresh simulation ship none rather than a recheck that only re-tests journaled constants
trigger-level confirmations + run_on: confirmed — a reorged deposit never even creates a run
wait_for: confirmed on the send and on_failure: dead_letter on the workflow
a concurrency group (queue for event relays, skip for keepers)
an approval: gate on treasury/admin flows (treasury-sweep-approval parks behind a human rflow approve)

What every template package guarantees

rflow templates doctor --all enforces, for each of the 27 packages: the manifest parses strictly, the declared output files match the packaged files, required ABIs are packaged, all inputs are well-formed, the sample answers render a project that passes rflow validate, the committed snapshot matches, and the docs page exists. Installs are recorded in .rflow/template-lock.yaml.