@hyperlane-xyz/sdk 41.3.1 → 43.0.0

package/dist/ism/EvmIsmModule.hardhat-test.js

@@ -3,16 +3,18 @@ import chai, { expect } from 'chai';
 import chaiAsPromised from 'chai-as-promised';
 import hre from 'hardhat';
 import sinon from 'sinon';
-import { BlacklistIsm__factory, RateLimitedIsm__factory, StaticAggregationIsm__factory, TestLegacyBlacklistIsm__factory, } from '@hyperlane-xyz/core';
-import { eqAddress, rootLogger } from '@hyperlane-xyz/utils';
+import { BlacklistIsm__factory, DefaultIsm__factory, DelayedFlowRouterHookIsm__factory, HypERC20__factory, NetFlowRateLimitedHookIsm__factory, PausableIsm__factory, RateLimitedIsm__factory, StaticAggregationIsm__factory, TestLegacyBlacklistIsm__factory, } from '@hyperlane-xyz/core';
+import { addressToBytes32, eqAddress, rootLogger, } from '@hyperlane-xyz/utils';
 import { TestChainName, testChains } from '../consts/testChains.js';
 import { TestCoreDeployer } from '../core/TestCoreDeployer.js';
 import { HyperlaneProxyFactoryDeployer } from '../deploy/HyperlaneProxyFactoryDeployer.js';
+import { buildDelayedFlowEnrollmentTxs, } from '../deploy/warp.js';
 import { MultiProvider } from '../providers/MultiProvider.js';
 import { EvmEventLogsReader } from '../rpc/evm/EvmEventLogsReader.js';
 import { randomAddress, randomIsmConfig, randomMultisigIsmConfig, } from '../test/testUtils.js';
-import { normalizeConfig } from '../utils/ism.js';
+import { collectHybridIsmNodes, normalizeConfig } from '../utils/ism.js';
 import { EvmIsmModule } from './EvmIsmModule.js';
+import { EvmIsmReader } from './EvmIsmReader.js';
 import { HyperlaneIsmFactory } from './HyperlaneIsmFactory.js';
 import { IsmType, ModuleType, } from './types.js';
 chai.use(chaiAsPromised);
@@ -31,6 +33,8 @@ describe('EvmIsmModule', async () => {
     const legacyDeploymentBlocks = new Map();
     let legacyExplorerMetadataStub;
     let legacyDeploymentBlockStub;
+    // paired TokenRouter required by the warp-route hybrid hook/ISM constructors
+    let warpRouterAddress;
     before(async () => {
         const [signer, funder] = await hre.ethers.getSigners();
         fundingAccount = funder;
@@ -47,6 +51,7 @@ describe('EvmIsmModule', async () => {
         const legacyIsmFactory = new HyperlaneIsmFactory(contractsMap, multiProvider);
         // mailbox
         mailboxAddress = (await new TestCoreDeployer(multiProvider, legacyIsmFactory).deployApp()).getContracts(chain).mailbox.address;
+        warpRouterAddress = (await new HypERC20__factory(signer).deploy(18, 1, 1, mailboxAddress)).address;
     });
     beforeEach(async () => {
         // Reset the MultiProvider for each test
@@ -153,6 +158,29 @@ describe('EvmIsmModule', async () => {
             },
         });
     }
+    /**
+     * Hybrid hook/ISMs are only valid inside a mandatory aggregation beside an
+     * authenticating ISM, which is also how a warp route always installs them.
+     * The wrapper holds `hybrid` by reference, so tests can keep mutating the
+     * node in place between create and update.
+     */
+    function hybridAgg(hybrid) {
+        return {
+            type: IsmType.AGGREGATION,
+            threshold: 2,
+            modules: [
+                { type: IsmType.TRUSTED_RELAYER, relayer: mailboxAddress },
+                hybrid,
+            ],
+        };
+    }
+    /** Address of the hybrid leaf inside the module's installed tree. */
+    async function hybridLeaf(ism) {
+        const derived = await new EvmIsmReader(multiProvider, chain).deriveIsmConfig(ism.serialize().deployedIsm);
+        const [leaf] = collectHybridIsmNodes(derived);
+        assert(leaf && 'address' in leaf && typeof leaf.address === 'string', 'expected a deployed hybrid leaf');
+        return leaf.address;
+    }
     describe('create', async () => {
         it('deploys a simple ism', async () => {
             const config = randomMultisigIsmConfig(3, 5);
@@ -241,6 +269,45 @@ describe('EvmIsmModule', async () => {
                 multiProvider,
             })).to.be.rejectedWith(BLACKLIST_COMPOSITION_ERROR);
         });
+        it('deploys a mailbox default ism', async () => {
+            const config = {
+                type: IsmType.MAILBOX_DEFAULT,
+            };
+            await createIsm(config);
+        });
+        it('deploys a net flow rate limited hook ism and transfers ownership to non-deployer', async () => {
+            const owner = randomAddress();
+            const config = {
+                type: IsmType.NET_FLOW_RATE_LIMITED,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 500,
+                duration: 86400n,
+                owner,
+            };
+            const { ism } = await createIsm(hybridAgg(config));
+            const netFlowIsm = NetFlowRateLimitedHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            expect((await netFlowIsm.owner()).toLowerCase()).to.equal(owner.toLowerCase());
+            expect((await netFlowIsm.warpRouter()).toLowerCase()).to.equal(warpRouterAddress.toLowerCase());
+        });
+        it('deploys a delayed flow router hook ism, enrolling routers before transferring ownership', async () => {
+            // owner is a non-deployer EOA: the deploy only succeeds if the
+            // owner-gated enrollment happens BEFORE the ownership transfer
+            const owner = randomAddress();
+            const remoteRouter = addressToBytes32(randomAddress()).toLowerCase();
+            const config = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner,
+                remoteIsms: { [TestChainName.test2]: remoteRouter },
+            };
+            const { ism } = await createIsm(hybridAgg(config));
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            expect(await delayedIsm.routers(multiProvider.getDomainId(TestChainName.test2))).to.equal(remoteRouter);
+            expect((await delayedIsm.owner()).toLowerCase()).to.equal(owner.toLowerCase());
+        });
         for (let i = 0; i < 16; i++) {
             it(`deploys a random ism config #${i}`, async () => {
                 const config = randomIsmConfig();
@@ -253,6 +320,40 @@ describe('EvmIsmModule', async () => {
         });
     });
     describe('update', async () => {
+        it('applies a pausable state change when the signer is the owner', async () => {
+            const config = {
+                type: IsmType.PAUSABLE,
+                owner: await multiProvider.getSignerAddress(chain),
+                paused: false,
+            };
+            const { ism, initialIsmAddress } = await createIsm(config);
+            const pausable = PausableIsm__factory.connect(initialIsmAddress, multiProvider.getProvider(chain));
+            const target = { ...config, paused: true };
+            const txs = await ism.update(target);
+            testConfig = target;
+            expect(txs).to.be.empty;
+            expect(await pausable.paused()).to.be.true;
+        });
+        it('returns a pausable state change when the signer is not the owner', async () => {
+            const owner = randomAddress();
+            const config = {
+                type: IsmType.PAUSABLE,
+                owner,
+                paused: false,
+            };
+            const { ism, initialIsmAddress } = await createIsm(config);
+            const pausable = PausableIsm__factory.connect(initialIsmAddress, multiProvider.getProvider(chain));
+            const target = { ...config, paused: true };
+            const txs = await ism.update(target);
+            expect(txs).to.have.length(1);
+            expect(txs[0].to).to.equal(initialIsmAddress);
+            expect(txs[0].data).to.equal(PausableIsm__factory.createInterface().encodeFunctionData('pause'));
+            expect(await pausable.paused()).to.be.false;
+            const ownerMultiProvider = await impersonateAccount(owner);
+            await ownerMultiProvider.sendTransaction(chain, txs[0]);
+            testConfig = target;
+            expect(await pausable.paused()).to.be.true;
+        });
         for (const type of [IsmType.ROUTING, IsmType.FALLBACK_ROUTING]) {
             beforeEach(() => {
                 exampleRoutingConfig.type = type;
@@ -765,6 +866,414 @@ describe('EvmIsmModule', async () => {
                 expect(blacklistFound).to.be.true;
             });
         });
+        it('no changes to an existing mailbox default ism means no redeployment or updates', async () => {
+            const config = {
+                type: IsmType.MAILBOX_DEFAULT,
+            };
+            const { ism, initialIsmAddress } = await createIsm(config);
+            await expectTxsAndUpdate(ism, config, 0);
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .true;
+        });
+        it('redeploys a mailbox default ism that defers to a different mailbox', async () => {
+            const config = {
+                type: IsmType.MAILBOX_DEFAULT,
+            };
+            const { initialIsmAddress } = await createIsm(config);
+            // A DefaultIsm's mailbox is an immutable constructor arg the reader
+            // omits, so this module — pointed at the same instance but at a
+            // different mailbox — sees an identical `{ type }` config while the
+            // instance routes through the wrong mailbox's default ISM.
+            const otherMailbox = warpRouterAddress;
+            const reboundModule = new EvmIsmModule(multiProvider, {
+                chain,
+                config,
+                addresses: {
+                    ...factoryAddresses,
+                    mailbox: otherMailbox,
+                    deployedIsm: initialIsmAddress,
+                },
+            });
+            // redeploys internally (MAILBOX_DEFAULT is immutable), emitting no txs
+            expect(await reboundModule.update(config)).to.deep.equal([]);
+            const redeployedIsm = reboundModule.serialize().deployedIsm;
+            expect(eqAddress(redeployedIsm, initialIsmAddress)).to.be.false;
+            expect(eqAddress(await DefaultIsm__factory.connect(redeployedIsm, multiProvider.getProvider(chain)).mailbox(), otherMailbox)).to.be.true;
+        });
+        it('redeploys when changing a mailbox default ism to another type', async () => {
+            const { ism, initialIsmAddress } = await createIsm({
+                type: IsmType.MAILBOX_DEFAULT,
+            });
+            const trustedRelayerConfig = {
+                type: IsmType.TRUSTED_RELAYER,
+                relayer: randomAddress(),
+            };
+            // keep testConfig in sync for the afterEach read-back assertion
+            testConfig = trustedRelayerConfig;
+            // update() redeploys internally and emits no txs
+            await expectTxsAndUpdate(ism, trustedRelayerConfig, 0);
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .false;
+        });
+        it('transfers netFlowRateLimitedHookIsm ownership in-place on owner change', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const netFlowConfig = {
+                type: IsmType.NET_FLOW_RATE_LIMITED,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 500,
+                duration: 86400n,
+                owner: signerAddress,
+            };
+            const { ism, initialIsmAddress } = await createIsm(hybridAgg(netFlowConfig));
+            const newOwner = randomAddress();
+            // mutate in-place so testConfig (same reference) stays in sync for afterEach
+            netFlowConfig.owner = newOwner;
+            // NET_FLOW_RATE_LIMITED is mutable — update() transfers ownership in-place (1 tx)
+            await expectTxsAndUpdate(ism, hybridAgg(netFlowConfig), 1);
+            // same contract address — no redeploy
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .true;
+            const netFlowIsm = NetFlowRateLimitedHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            expect((await netFlowIsm.owner()).toLowerCase()).to.equal(newOwner.toLowerCase());
+        });
+        it('redeploys a new netFlowRateLimitedHookIsm on thresholdBps change (immutable)', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const netFlowConfig = {
+                type: IsmType.NET_FLOW_RATE_LIMITED,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 500,
+                duration: 86400n,
+                owner: signerAddress,
+            };
+            const { ism, initialIsmAddress } = await createIsm(hybridAgg(netFlowConfig));
+            // thresholdBps is immutable on-chain; changing it must redeploy
+            netFlowConfig.thresholdBps = 750;
+            // update() redeploys internally and emits no txs
+            await expectTxsAndUpdate(ism, hybridAgg(netFlowConfig), 0);
+            // different contract address — redeployed
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .false;
+            const netFlowIsm = NetFlowRateLimitedHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            expect((await netFlowIsm.thresholdBps()).toString()).to.equal('750');
+        });
+        it('updates netFlowRateLimitedHookIsm owner in-place inside an aggregation ism without redeploying the container', async () => {
+            // the contract mandates composing NetFlowRateLimitedHookIsm under an
+            // authenticating ISM, so aggregation-wrapped is the primary shape
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const netFlowConfig = {
+                type: IsmType.NET_FLOW_RATE_LIMITED,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 500,
+                duration: 86400n,
+                owner: signerAddress,
+            };
+            const aggregationConfig = {
+                type: IsmType.AGGREGATION,
+                modules: [netFlowConfig, randomMultisigIsmConfig(3, 5)],
+                threshold: 2,
+            };
+            const { ism, initialIsmAddress } = await createIsm(aggregationConfig);
+            // mutate in-place so testConfig (same reference) stays in sync for afterEach
+            const newOwner = randomAddress();
+            netFlowConfig.owner = newOwner;
+            // owner is the netFlow's only mutable field: expect a single in-place
+            // transferOwnership tx, with the aggregation container untouched
+            await expectTxsAndUpdate(ism, aggregationConfig, 1);
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .true;
+        });
+        it('no changes to an existing delayedFlowRouterHookIsm means no redeployment or updates', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {
+                    [TestChainName.test2]: addressToBytes32(randomAddress()).toLowerCase(),
+                },
+            };
+            const { ism, initialIsmAddress } = await createIsm(hybridAgg(delayedConfig));
+            await expectTxsAndUpdate(ism, hybridAgg(delayedConfig), 0);
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .true;
+        });
+        it('does not redeploy a delayedFlowRouterHookIsm when the target omits warpRouter', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {},
+            };
+            const { ism, initialIsmAddress } = await createIsm(hybridAgg(delayedConfig));
+            // warp-route-context configs omit warpRouter (implicitly the token);
+            // the update must treat it as unchanged, not as an immutable-field change
+            const targetWithoutWarpRouter = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {},
+            };
+            await expectTxsAndUpdate(ism, hybridAgg(targetWithoutWarpRouter), 0);
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .true;
+        });
+        it('enrolls and unenrolls remote routers on an existing delayedFlowRouterHookIsm', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const test2Router = addressToBytes32(randomAddress()).toLowerCase();
+            const test3Router = addressToBytes32(randomAddress()).toLowerCase();
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: { [TestChainName.test2]: test2Router },
+            };
+            const { ism, initialIsmAddress } = await createIsm(hybridAgg(delayedConfig));
+            // replace test2 with test3: 1 enroll tx + 1 unenroll tx
+            delayedConfig.remoteIsms = { [TestChainName.test3]: test3Router };
+            await expectTxsAndUpdate(ism, hybridAgg(delayedConfig), 2);
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .true;
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            const test3Domain = multiProvider.getDomainId(TestChainName.test3);
+            expect(await delayedIsm.routers(test3Domain)).to.equal(test3Router);
+            const enrolledDomains = await delayedIsm.domains();
+            expect(enrolledDomains.map((domain) => Number(domain))).to.deep.equal([
+                test3Domain,
+            ]);
+        });
+        it('unenrolls a delayed flow domain missing from provider metadata', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {},
+            };
+            const { ism } = await createIsm(hybridAgg(delayedConfig));
+            const leafAddress = await hybridLeaf(ism);
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(leafAddress, multiProvider.getSigner(chain));
+            const unknownDomain = 987654;
+            expect(multiProvider.tryGetChainName(unknownDomain)).to.be.null;
+            await delayedIsm.enrollRemoteRouters([unknownDomain], [addressToBytes32(randomAddress())]);
+            const leafModule = new EvmIsmModule(multiProvider, {
+                chain,
+                config: delayedConfig,
+                addresses: {
+                    ...factoryAddresses,
+                    mailbox: mailboxAddress,
+                    deployedIsm: leafAddress,
+                },
+            });
+            const txs = await leafModule.updateDeployedInstance(delayedConfig);
+            expect(txs).to.have.length(1);
+            for (const tx of txs) {
+                await multiProvider.sendTransaction(chain, tx);
+            }
+            expect(await delayedIsm.domains()).to.deep.equal([]);
+        });
+        it('updateDeployedInstance reconciles the hybrid leaf but rejects a composed tree', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {},
+            };
+            const { ism } = await createIsm(hybridAgg(delayedConfig));
+            // Same module shape buildDelayedFlowEnrollmentTxs builds: pointed at the
+            // deployed hybrid leaf, not at the aggregation above it.
+            const leafModule = new EvmIsmModule(multiProvider, {
+                chain,
+                config: delayedConfig,
+                addresses: {
+                    ...factoryAddresses,
+                    mailbox: mailboxAddress,
+                    deployedIsm: await hybridLeaf(ism),
+                },
+            });
+            // The escape hatch skips the composition rules, so it must not accept a
+            // config that composes anything.
+            await expect(leafModule.updateDeployedInstance(hybridAgg(delayedConfig))).to.be.rejectedWith('composed');
+            // ...while the leaf node it exists for still reconciles.
+            delayedConfig.remoteIsms = {
+                [TestChainName.test2]: addressToBytes32(randomAddress()).toLowerCase(),
+            };
+            const txs = await leafModule.updateDeployedInstance(delayedConfig);
+            expect(txs.length).to.equal(1);
+            for (const tx of txs) {
+                await multiProvider.sendTransaction(chain, tx);
+            }
+        });
+        it('transfers delayedFlowRouterHookIsm ownership after enrollment updates', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {},
+            };
+            const { ism, initialIsmAddress } = await createIsm(hybridAgg(delayedConfig));
+            // enroll a router AND hand over ownership in the same update: the txs
+            // only execute successfully if enrollment (owner-gated) precedes the
+            // ownership transfer
+            const newOwner = randomAddress();
+            delayedConfig.remoteIsms = {
+                [TestChainName.test2]: addressToBytes32(randomAddress()).toLowerCase(),
+            };
+            delayedConfig.owner = newOwner;
+            await expectTxsAndUpdate(ism, hybridAgg(delayedConfig), 2);
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .true;
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            expect((await delayedIsm.owner()).toLowerCase()).to.equal(newOwner.toLowerCase());
+        });
+        it('redeploys a new delayedFlowRouterHookIsm on maxDelay change (immutable)', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {},
+            };
+            const { ism, initialIsmAddress } = await createIsm(hybridAgg(delayedConfig));
+            // maxDelay is immutable on-chain; changing it must redeploy
+            delayedConfig.maxDelay = 7200;
+            // update() redeploys internally and emits no txs
+            await expectTxsAndUpdate(ism, hybridAgg(delayedConfig), 0);
+            // different contract address — redeployed
+            expect(eqAddress(initialIsmAddress, ism.serialize().deployedIsm)).to.be
+                .false;
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            expect(await delayedIsm.maxDelay()).to.equal(7200);
+        });
+    });
+    describe('delayed flow router cross-chain enrollment', async () => {
+        const remoteChain = TestChainName.test2;
+        const manualChain = TestChainName.test3;
+        function registryAddresses() {
+            return { [chain]: { ...factoryAddresses, mailbox: mailboxAddress } };
+        }
+        async function enrollmentTxs(allTargets) {
+            return buildDelayedFlowEnrollmentTxs({
+                chain,
+                multiProvider,
+                registryAddresses: registryAddresses(),
+                warpRouter: warpRouterAddress,
+                target: allTargets[chain],
+                allTargets,
+            });
+        }
+        async function applyTxs(txs) {
+            for (const tx of txs) {
+                await multiProvider.sendTransaction(chain, tx);
+            }
+        }
+        it('enrolls the pairing derived from the route and converges on re-run', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+            };
+            const { ism } = await createIsm(hybridAgg(delayedConfig));
+            const remoteIsmAddress = randomAddress();
+            const allTargets = {
+                [chain]: {
+                    ismAddress: await hybridLeaf(ism),
+                    userNode: delayedConfig,
+                },
+                [remoteChain]: {
+                    ismAddress: remoteIsmAddress,
+                    userNode: delayedConfig,
+                },
+            };
+            const txs = await enrollmentTxs(allTargets);
+            expect(txs.length).to.equal(1);
+            await applyTxs(txs);
+            expect((await enrollmentTxs(allTargets)).length).to.equal(0);
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            expect(await delayedIsm.domains()).to.deep.equal([
+                multiProvider.getDomainId(remoteChain),
+            ]);
+            // keep testConfig (same reference) in sync for the afterEach read-back
+            delayedConfig.remoteIsms = {
+                [remoteChain]: addressToBytes32(remoteIsmAddress).toLowerCase(),
+            };
+        });
+        it('enrolls a configured external remoteIsms alongside the derived pairing and converges on re-run', async () => {
+            const signerAddress = await multiProvider.getSignerAddress(chain);
+            const delayedConfig = {
+                type: IsmType.DELAYED_FLOW_ROUTER,
+                warpRouter: warpRouterAddress,
+                thresholdBps: 10000,
+                maxDelay: 3600,
+                duration: 86400n,
+                owner: signerAddress,
+                remoteIsms: {},
+            };
+            const { ism } = await createIsm(hybridAgg(delayedConfig));
+            // An operator-authored pairing names a chain the route never derives.
+            // It is retained alongside the route-managed counterpart.
+            const manualRouter = addressToBytes32(randomAddress()).toLowerCase();
+            delayedConfig.remoteIsms = { [manualChain]: manualRouter };
+            const derivedRouterAddress = randomAddress();
+            const derivedRouter = addressToBytes32(derivedRouterAddress).toLowerCase();
+            const allTargets = {
+                [chain]: {
+                    ismAddress: await hybridLeaf(ism),
+                    userNode: delayedConfig,
+                },
+                [remoteChain]: {
+                    ismAddress: derivedRouterAddress,
+                    userNode: delayedConfig,
+                },
+            };
+            const txs = await enrollmentTxs(allTargets);
+            expect(txs.length).to.equal(1);
+            await applyTxs(txs);
+            expect((await enrollmentTxs(allTargets)).length).to.equal(0);
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(await hybridLeaf(ism), multiProvider.getProvider(chain));
+            const manualDomain = multiProvider.getDomainId(manualChain);
+            const derivedDomain = multiProvider.getDomainId(remoteChain);
+            expect(await delayedIsm.domains()).to.have.members([
+                manualDomain,
+                derivedDomain,
+            ]);
+            expect(await delayedIsm.routers(manualDomain)).to.equal(manualRouter);
+            expect(await delayedIsm.routers(derivedDomain)).to.equal(derivedRouter);
+            // keep testConfig (same reference) in sync for the afterEach read-back
+            delayedConfig.remoteIsms = {
+                [manualChain]: manualRouter,
+                [remoteChain]: derivedRouter,
+            };
+        });
     });
 });
 //# sourceMappingURL=EvmIsmModule.hardhat-test.js.map