Add Fanavaran-only flow-test script and document how to run it.

Track the tester and env template in git so a new tenant can be exercised without a YARA claim; keep filled client env files (secrets, national codes) ignored.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitignore

@@ -16,6 +16,7 @@ pids
 *.pid
 *.seed
 *.pid.lock
+files/fanavaran-auth/
 
 # Directory for instrumented libs generated by jscoverage/JSCover
 lib-cov
@@ -80,6 +81,9 @@ web_modules/
 .env.production.local
 .env.local
 .env.development.env
+scripts/data/fanavaran-flow.*.env
+!scripts/data/fanavaran-flow.env.example
+files/fanavaran-flow/
 # parcel-bundler cache (https://parceljs.org/)
 .cache
 .parcel-cache
@@ -143,4 +147,40 @@ dist
 /docker
 .development.env
 *.env
+!scripts/data/fanavaran-flow.env.example
 /files
+
+*.jpg
+*.jpeg
+*.png
+*.gif
+*.bmp
+*.tiff
+*.ico
+*.webp
+*.svg
+*.heic
+*.heif
+*.heif-srgb
+*.heif-srgb-alpha
+*.heif-srgb-alpha-heic
+
+*.mp3
+*.mp4
+*.wav
+*.ogg
+*.flac
+*.aac
+*.m4a
+*.m4v
+*.m4b
+*.m4p
+*.m4r
+*.m4w
+*.m4x
+*.txt
+*.md
+*.sh
+!scripts/fanavaran-flow-test.sh
+!scripts/fanavaran-auth.sh
+*.json

docs/fanavaran/10-testing.md

@@ -1,5 +1,5 @@
 ---
-last_updated: 2026-08-08
+last_updated: 2026-08-17
 tags: [fanavaran, testing]
 source: fanavaran-module-docs
 ---
@@ -22,6 +22,96 @@ source files/fanavaran-auth/parsian/tokens.env
 # then curl a lookup — see docs/external-api-curls.md
 ```
 
+## Manual Fanavaran flow test (no YARA)
+
+Use this when there is **no YARA claim** and you need to prove a tenant (Parsian / Tejaratno / Moallem) against Fanavaran with the **same stage order as the app**.
+
+Files in git:
+
+| Path | Role |
+|------|------|
+| `scripts/fanavaran-flow-test.sh` | Standalone tester |
+| `scripts/data/fanavaran-flow.env.example` | Template env (section A = you fill, section B = script fills) |
+
+Do **not** commit a filled copy (`fanavaran-flow.moallem.env` and similar). It contains national codes, plate data, and secrets. Copy the example on the machine that runs the test.
+
+### 1. Copy and fill the env
+
+```bash
+cp scripts/data/fanavaran-flow.env.example scripts/data/fanavaran-flow.<client>.env
+```
+
+Fill **section A** before the first run:
+
+- Tenant: `FANAVARAN_CLIENT`, optional auth overrides (`APP_NAME`, `CORP_ID`, `LOCATION`, …)
+- Lookup ids **from that tenant** (`files/fanavaran-lookups/<client>/`): `CLAIM_EXPERT_ID`, `EXPERTISE_CLAIM_EXPERT_ID`, `CLAIM_FILE_TYPE_ID`, `VEHICLE_KIND_ID`, `DMG_SECTION_ID`
+- `INSURANCE_CORP_ID`: Persian caption **or** numeric Fanavaran Id
+- Case data: guilty national code, driver national code + Jalali birthday, plate/chassis/VIN if you have them
+- `ATTACHMENT_FILE`: absolute path(s) to image(s) **on the host that runs the script** (comma-separated for several files)
+- Leave **section B empty** (`POLICY_ID`, `CLAIM_ID`, …)
+
+Lookup ids from Tejaratno/Parsian files are invalid for Moallem (Fanavaran returns `نوع خودرو یافت نشد` and similar). Fetch Moallem lookups first (`GET /lookups/vehicle-kinds` with `FANAVARAN_CLIENT=moallem`, or curl Fanavaran with that tenant’s token).
+
+### 2. Network / IP whitelist
+
+Fanavaran Login is IP-restricted. From a **whitelisted server**, run with no proxy. From **localhost**, Termius dynamic port forwarding does **not** apply automatically — set:
+
+```env
+CURL_PROXY=socks5h://127.0.0.1:<termius-socks-port>
+```
+
+Error `کاربر … مجاز به لاگین با آی پی … نمیباشد` means curl is still using your home IP.
+
+### 3. Run (same sequence as the app)
+
+```text
+auth (cached until Tehran midnight)
+  → policy inquiry → GEN.03 base
+  → driver inquiry + insurance-corp
+  → GEN.12 damage
+  → GEN.07 attachments (one request per file)
+  → GEN.08 expertise
+```
+
+From repo root (`bash`, `curl`, `node`, `awk` required):
+
+```bash
+chmod +x scripts/fanavaran-flow-test.sh
+
+# Full flow (confirms before each POST)
+./scripts/fanavaran-flow-test.sh --env scripts/data/fanavaran-flow.moallem.env
+
+# One or more stages
+./scripts/fanavaran-flow-test.sh --env scripts/data/fanavaran-flow.moallem.env --stages base,damage
+./scripts/fanavaran-flow-test.sh --env scripts/data/fanavaran-flow.moallem.env --stages attachments
+./scripts/fanavaran-flow-test.sh --env scripts/data/fanavaran-flow.moallem.env --stages expertise
+
+# Build payloads / inquiries only
+./scripts/fanavaran-flow-test.sh --env scripts/data/fanavaran-flow.moallem.env --preview-only
+```
+
+Missing section-A fields can be typed when prompted; they are written back into the env file.
+
+### 4. Token cache (do not Login every run)
+
+`authenticationToken` is stored in `files/fanavaran-auth/<client>/tokens.env` until **Asia/Tehran midnight** (same as Nest). Later runs print `Reusing cached authenticationToken`. Use `--force-login` only when you must mint a new token.
+
+Repeated Login causes Fanavaran `لطفا پس از چند لحظه مجدد تلاش فرمایید`.
+
+### 5. Resume after a stage succeeds
+
+Section B is updated in the **same env file**. Re-run; stages with `CLAIM_ID` / `DMG_CASE_ID` already set are skipped (soft-skip). Payloads and HTTP bodies also land under `files/fanavaran-flow/<client>/<timestamp>/` (gitignored).
+
+### 6. Typical failures
+
+| Message | What to do |
+|---------|------------|
+| Login IP not allowed | Run on the tenant server, or set `CURL_PROXY` to Termius SOCKS |
+| Try again later | Wait; reuse cache; do not `--force-login` |
+| `نوع خودرو یافت نشد` | Set `VEHICLE_KIND_ID` from **this** tenant’s `vehicle-kinds` lookup |
+| File type lookup mismatch | Set `CLAIM_FILE_TYPE_ID` from this tenant’s `file-types` |
+| No `authenticationToken` | Read `login.body.json` in the run folder — Fanavaran `Message` is the real error |
+
 ## Unit / service specs
 
 | Spec | Focus |
@@ -31,7 +121,7 @@ source files/fanavaran-auth/parsian/tokens.env
 
 Prefer mocks for Fanavaran HTTP in unit tests; use live calls only in controlled integration.
 
-## Manual E2E (Parsian template)
+## Manual E2E (Parsian template — via YARA)
 
 1. Create THIRD_PARTY claim with guilty party national code that has an **active** Fanavaran policy.
 2. Confirm history `FANAVARAN_EARLY_AUTO_SUBMIT_SUCCEEDED` and `claimId`/`claimNo`.

docs/fanavaran/README.md

@@ -1,5 +1,5 @@
 ---
-last_updated: 2026-08-08
+last_updated: 2026-08-17
 tags: [fanavaran, documentation, parsian, third-party-claim]
 source: fanavaran-module-docs
 ---
@@ -32,7 +32,7 @@ source: fanavaran-module-docs
 | 7 | [07-data-mapping.md](./07-data-mapping.md) | YARA field → Fanavaran field |
 | 8 | [08-dependencies.md](./08-dependencies.md) | Mongo, files, env, SMS, audit |
 | 9 | [09-error-handling.md](./09-error-handling.md) | Errors, retry, backoff, logging |
-| 10 | [10-testing.md](./10-testing.md) | Test scenarios, scripts, proven case |
+| 10 | [10-testing.md](./10-testing.md) | Test scenarios, **manual flow-test script**, proven case |
 | 11 | [11-onboard-new-client.md](./11-onboard-new-client.md) | Checklist to add a new insurer |
 
 ## Related sources (code)
@@ -47,6 +47,8 @@ source: fanavaran-module-docs
 | `.agents/skills/fanavaran-apis/references/third-party-cases.md` | Agent-oriented implementation rules |
 | `docs/external-api-curls.md` | Ready-to-run curl sequences |
 | `scripts/fanavaran-auth.sh` | Token helper |
+| `scripts/fanavaran-flow-test.sh` | Manual Fanavaran-only staged submit (see [10-testing.md](./10-testing.md)) |
+| `scripts/data/fanavaran-flow.env.example` | Env template for the flow-test script |
 
 ## Architecture (one glance)
 

scripts/data/fanavaran-flow.env.example

@@ -0,0 +1,91 @@
+# Fanavaran flow test — copy this file, fill section A, then run:
+#
+#   cp scripts/data/fanavaran-flow.env.example scripts/data/fanavaran-flow.moallem.env
+#   ./scripts/fanavaran-flow-test.sh --env scripts/data/fanavaran-flow.moallem.env
+#
+# Section A  = you fill before (or when the script asks).
+# Section B  = leave empty. The script writes Fanavaran ids here after each stage
+#              so you can stop, re-run, or continue without copying ids by hand.
+#
+# Do not commit real secrets or national codes.
+
+# =============================================================================
+# A) FILL BEFORE RUN
+# =============================================================================
+
+# --- tenant ---
+FANAVARAN_CLIENT=moallem
+
+# Localhost only: route curl through Termius SOCKS (Dynamic Port Forwarding).
+# Example: CURL_PROXY=socks5h://127.0.0.1:1080
+# Or run the script on the Moallem server (no proxy needed).
+# CURL_PROXY=
+
+# Optional auth overrides (omit to use built-in seeds for this client)
+# APP_NAME=ItTalie
+# APP_SECRET=
+# FANAVARAN_USERNAME=
+# FANAVARAN_PASSWORD=
+# CORP_ID=
+# CONTRACT_ID=
+# LOCATION=
+
+# --- tenant lookup ids (from this insurer's Fanavaran lookups) ---
+CLAIM_EXPERT_ID=
+EXPERTISE_CLAIM_EXPERT_ID=
+CLAIM_FILE_TYPE_ID=
+VEHICLE_KIND_ID=
+DMG_SECTION_ID=
+
+# Persian caption OR numeric Fanavaran Id
+INSURANCE_CORP_ID=
+
+# --- GEN.03 case ---
+GUILTY_NATIONAL_CODE=
+ACCIDENT_DATE=1404/05/20
+ACCIDENT_TIME=12:00
+
+# --- GEN.12 case ---
+DRIVER_NATIONAL_CODE=
+DRIVER_BIRTH_YEAR=1370
+DRIVER_BIRTH_MONTH=1
+DRIVER_BIRTH_DAY=1
+DRIVER_IS_INSURER=0
+LICENCE_NO=
+DESC=سپر عقب
+
+# Optional vehicle / plate / policy document (leave empty if unknown)
+# PLAQUE_LEFT_NO=
+# PLAQUE_RIGHT_NO=
+# PLAQUE_SERIAL=
+# PLAQUE_MIDDLE_CODE_ID=
+# PLAQUE_NO=
+# CHASSIS_NO=
+# MOTOR_NO=
+# VIN=
+# POLICY_NO=
+# POLICY_CI_NUMBER=
+# BEGIN_DATE=
+# END_DATE=
+# BUILT_YEAR=
+
+# --- GEN.07 ---
+ATTACHMENT_FILE=
+
+# --- GEN.08 ---
+DMG_ASSESSMENT_DATE=1404/05/20
+INSPECTION_TIME=12:00
+REPAIR_WAGE=0
+COMPONENT_REPLACEMENT_COST=0
+WASTE_VALUE=0
+
+# =============================================================================
+# B) FILLED BY SCRIPT  (do not set these before the first run)
+# =============================================================================
+POLICY_ID=
+CLAIM_ID=
+CLAIM_NO=
+DRIVER_ID=
+INSURANCE_CORP_ID_NUM=
+DMG_CASE_ID=
+EXPERTISE_ID=