feat: add portfolio valuation history

Reviewed-on: #46

CHANGELOG.md

@@ -1,5 +1,101 @@
 # Changelog
 
+## [Frontend 0.13.0 / Backend 0.12.0 / Shared 0.7.0] - 2026-08-27
+
+### Added
+
+- Added a separate portfolio view with the latest broker and IIS positions and total valuation.
+
+## [Frontend 0.12.0 / Backend 0.11.0 / Shared 0.6.0] - 2026-08-26
+
+### Added
+
+- Import VTB Broker XLSX reports with cash movements, trades, and positions in one operation.
+
+## [Frontend 0.11.3] - 2026-08-26
+
+### Added
+
+- Import broker portfolio JSON files and show their trade and position results.
+
+## [Frontend 0.11.2 / Backend 0.10.5 / Shared 0.5.1] - 2026-08-26
+
+### Added
+
+- Show cashback separately in the cash-flow summary alongside interest income.
+
+## [Backend 0.10.3] - 2026-08-24
+
+### Fixed
+
+- Treat VTB savings-account deposits and closures as internal transfers when importing PDF-to-JSON statements.
+
+## [Backend 0.10.2] - 2026-08-24
+
+### Fixed
+
+- Analytics endpoints now reject invalid account and category filter IDs with a validation error.
+
+## [Frontend 0.11.1] - 2026-08-21
+
+### Fixed
+
+- Preserve the explicit «Без категории» analytics filter value when requesting data.
+
+## [Frontend 0.11.0 / Backend 0.10.1 / Shared 0.5.0] - 2026-08-21
+
+### Fixed
+
+- Corrected analytics period boundaries for partial week/month ranges and added a usable «Без категории» filter with SQL coverage.
+
+## [Backend 0.9.2] - 2026-08-20
+
+### Added
+
+- Extended import integration coverage to verify source positions for same-date operations.
+
+## [Backend 0.9.1] - 2026-08-20
+
+### Added
+
+- Added runnable coverage for date and amount sorting tie-breakers.
+
+## [Backend 0.9.0] - 2026-08-20
+
+### Added
+
+- Preserved source-array transaction positions and used them as stable tie-breakers for same-date history sorting.
+
+## [Backend 0.8.3] - 2026-08-20
+
+### Fixed
+
+- Invalid non-string trade identifiers now return validation errors instead of server errors.
+
+## [Backend 0.8.2] - 2026-08-20
+
+### Added
+
+- Added a database integration test for repeated portfolio imports and trade deduplication.
+
+## [Backend 0.8.1] - 2026-08-20
+
+### Fixed
+
+- Hardened portfolio import validation, preserved decimal precision, added fallback trade keys, and covered validation with a runnable test.
+
+## [Backend 0.8.0 / Shared 0.4.0] - 2026-08-20
+
+### Added
+
+- Added portfolio JSON import for broker reports with idempotent trades, position snapshots, and separate portfolio tables.
+
+## [Backend 0.7.5 / Shared 0.3.1] - 2026-08-20
+
+### Added
+
+- Creating a category rule now applies it atomically to all matching unconfirmed transactions and returns the affected count.
+
 ## [Backend 0.7.4] - 2026-08-20
 
 ### Fixed

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@family-budget/backend",
-  "version": "0.7.4",
+  "version": "0.13.0",
   "private": true,
   "scripts": {
     "dev": "tsx watch src/app.ts",
@@ -9,8 +9,15 @@
     "migrate": "tsx src/db/migrate.ts",
     "migrate:prod": "node dist/db/migrate.js",
     "test:analytics": "tsx src/services/analyticsSemantics.test.ts",
+    "test:analytics:query": "tsx src/routes/analytics.test.ts",
+    "test:portfolio": "tsx src/services/portfolio.test.ts",
+    "test:portfolio:overview": "tsx src/services/portfolioOverview.test.ts",
+    "test:portfolio:db": "NODE_ENV=test tsx src/services/portfolio.integration.test.ts",
+    "test:transactions": "tsx src/services/transactions.test.ts",
     "test:analytics:db": "NODE_ENV=test tsx src/services/analytics.integration.test.ts",
     "test:import:db": "NODE_ENV=test tsx src/services/import.integration.test.ts",
+    "test:import:direction": "tsx src/services/import.test.ts",
+    "test:broker:xlsx": "tsx src/services/vtbBrokerXlsx.test.ts",
     "test:llm": "tsx src/scripts/testLlm.ts"
   },
   "dependencies": {

backend/src/app.ts

@@ -19,6 +19,9 @@ import accountsRouter from './routes/accounts';
 import categoriesRouter from './routes/categories';
 import categoryRulesRouter from './routes/categoryRules';
 import analyticsRouter from './routes/analytics';
+import portfolioRouter from './routes/portfolio';
+import portfolioOverviewRouter from './routes/portfolioOverview';
+import portfolioHistoryRouter from './routes/portfolioHistory';
 
 const app = express();
 app.set('trust proxy', 1);
@@ -43,6 +46,9 @@ app.use('/api/accounts', accountsRouter);
 app.use('/api/categories', categoriesRouter);
 app.use('/api/category-rules', categoryRulesRouter);
 app.use('/api/analytics', analyticsRouter);
+app.use('/api/import/portfolio', portfolioRouter);
+app.use('/api/portfolio', portfolioOverviewRouter);
+app.use('/api/portfolio/history', portfolioHistoryRouter);
 
 app.use(
   (

backend/src/db/migrate.ts

@@ -238,6 +238,64 @@ const migrations: { name: string; sql: string }[] = [
         CHECK (status IN ('active', 'closed'));
     `,
   },
+  {
+    name: '008_portfolio_tables',
+    sql: `
+      CREATE TABLE IF NOT EXISTS portfolio_reports (
+        id BIGSERIAL PRIMARY KEY,
+        account_id BIGINT NOT NULL REFERENCES accounts(id),
+        source_hash TEXT NOT NULL,
+        report_period_from DATE NOT NULL,
+        report_period_to DATE NOT NULL,
+        reported_at TIMESTAMPTZ,
+        imported_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE (account_id, source_hash)
+      );
+      CREATE TABLE IF NOT EXISTS portfolio_positions (
+        id BIGSERIAL PRIMARY KEY,
+        report_id BIGINT NOT NULL REFERENCES portfolio_reports(id) ON DELETE CASCADE,
+        instrument TEXT NOT NULL,
+        isin TEXT,
+        quantity NUMERIC NOT NULL,
+        price NUMERIC,
+        valuation NUMERIC
+      );
+      CREATE TABLE IF NOT EXISTS portfolio_trades (
+        id BIGSERIAL PRIMARY KEY,
+        account_id BIGINT NOT NULL REFERENCES accounts(id),
+        source_id TEXT NOT NULL,
+        operation_id UUID NOT NULL,
+        instrument TEXT NOT NULL,
+        isin TEXT,
+        concluded_at TIMESTAMPTZ NOT NULL,
+        side TEXT NOT NULL,
+        quantity NUMERIC NOT NULL,
+        price_currency TEXT,
+        price NUMERIC,
+        settlement_currency TEXT,
+        settlement_amount NUMERIC,
+        nkd NUMERIC,
+        settlement_commission NUMERIC,
+        trade_commission NUMERIC,
+        order_id TEXT,
+        trade_id TEXT,
+        venue TEXT,
+        comment TEXT,
+        UNIQUE (account_id, source_id)
+      );
+      CREATE INDEX IF NOT EXISTS ix_portfolio_trades_account_date
+        ON portfolio_trades(account_id, concluded_at DESC);
+    `,
+  },
+  {
+    name: '009_transaction_source_position',
+    sql: `
+      ALTER TABLE transactions ADD COLUMN IF NOT EXISTS source_position BIGINT NOT NULL DEFAULT 0;
+      UPDATE transactions SET source_position = id WHERE source_position = 0;
+      CREATE INDEX IF NOT EXISTS ix_transactions_date_position
+        ON transactions(operation_at, source_position, id);
+    `,
+  },
 ];
 
 export async function runMigrations(): Promise<void> {

backend/src/routes/analytics.test.ts

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import { parseOptionalId } from './analytics';
+
+assert.equal(parseOptionalId(undefined, 0), undefined);
+assert.equal(parseOptionalId('0', 0), 0);
+assert.equal(parseOptionalId('1', 1), 1);
+assert.equal(parseOptionalId('0', 1), null);
+assert.equal(parseOptionalId('abc', 0), null);
+assert.equal(parseOptionalId('1.5', 0), null);
+assert.equal(parseOptionalId(['1'], 0), null);
+
+console.log('analytics query validation: OK');

backend/src/routes/analytics.ts

@@ -5,10 +5,34 @@ import type { Granularity } from '@family-budget/shared';
 
 const router = Router();
 
+export function parseOptionalId(value: unknown, minimum: number): number | null | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'string' || !/^\d+$/.test(value)) return null;
+
+  const id = Number(value);
+  return Number.isSafeInteger(id) && id >= minimum ? id : null;
+}
+
+router.use((req, res, next) => {
+  const accountId = parseOptionalId(req.query.accountId, 1);
+  if (accountId === null) {
+    res.status(400).json({ error: 'BAD_REQUEST', message: 'accountId must be a positive integer' });
+    return;
+  }
+
+  const categoryId = parseOptionalId(req.query.categoryId, 0);
+  if (categoryId === null) {
+    res.status(400).json({ error: 'BAD_REQUEST', message: 'categoryId must be a non-negative integer' });
+    return;
+  }
+
+  next();
+});
+
 router.get(
   '/summary',
   asyncHandler(async (req, res) => {
-    const { from, to, accountId, onlyConfirmed } = req.query;
+    const { from, to, accountId, categoryId, onlyConfirmed } = req.query;
     if (!from || !to) {
       res.status(400).json({ error: 'BAD_REQUEST', message: 'from and to are required' });
       return;
@@ -18,6 +42,7 @@ router.get(
       from: from as string,
       to: to as string,
       accountId: accountId ? Number(accountId) : undefined,
+      categoryId: categoryId !== undefined ? Number(categoryId) : undefined,
       onlyConfirmed: onlyConfirmed === 'true',
     });
     res.json(result);
@@ -27,7 +52,7 @@ router.get(
 router.get(
   '/by-category',
   asyncHandler(async (req, res) => {
-    const { from, to, accountId, onlyConfirmed } = req.query;
+    const { from, to, accountId, categoryId, onlyConfirmed } = req.query;
     if (!from || !to) {
       res.status(400).json({ error: 'BAD_REQUEST', message: 'from and to are required' });
       return;
@@ -37,6 +62,7 @@ router.get(
       from: from as string,
       to: to as string,
       accountId: accountId ? Number(accountId) : undefined,
+      categoryId: categoryId !== undefined ? Number(categoryId) : undefined,
       onlyConfirmed: onlyConfirmed === 'true',
     });
     res.json(result);
@@ -62,7 +88,7 @@ router.get(
       from: from as string,
       to: to as string,
       accountId: accountId ? Number(accountId) : undefined,
-      categoryId: categoryId ? Number(categoryId) : undefined,
+      categoryId: categoryId !== undefined ? Number(categoryId) : undefined,
       onlyConfirmed: onlyConfirmed === 'true',
       granularity: granularity as Granularity,
     });

backend/src/routes/import.ts

@@ -1,11 +1,14 @@
 import { Router } from 'express';
 import multer from 'multer';
+import { pool } from '../db/pool';
 import { asyncHandler } from '../utils';
 import { importStatement, isValidationError } from '../services/import';
 import {
   convertPdfToStatement,
   isPdfConversionError,
 } from '../services/pdfToStatement';
+import { importPortfolio } from '../services/portfolio';
+import { convertVtbBrokerXlsx } from '../services/vtbBrokerXlsx';
 
 const upload = multer({
   storage: multer.memoryStorage(),
@@ -28,6 +31,10 @@ function isJsonFile(file: { mimetype: string; originalname: string }): boolean {
   );
 }
 
+function isXlsxFile(file: { mimetype: string; originalname: string }): boolean {
+  return file.mimetype === 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' || file.originalname.toLowerCase().endsWith('.xlsx');
+}
+
 const router = Router();
 
 router.post(
@@ -87,4 +94,41 @@ router.post(
   }),
 );
 
+router.post(
+  '/broker',
+  upload.single('file'),
+  asyncHandler(async (req, res) => {
+    const file = req.file;
+    if (!file || !isXlsxFile(file)) {
+      res.status(400).json({ error: 'BAD_REQUEST', message: 'Допустим только XLSX-отчёт ВТБ Брокер' });
+      return;
+    }
+    let converted;
+    try {
+      converted = convertVtbBrokerXlsx(file.buffer);
+    } catch (error) {
+      res.status(422).json({ error: 'VALIDATION_ERROR', message: error instanceof Error ? error.message : 'Не удалось обработать XLSX-отчёт' });
+      return;
+    }
+    const client = await pool.connect();
+    try {
+      await client.query('BEGIN');
+      const portfolio = await importPortfolio(converted.portfolio, pool, client);
+      const cash = await importStatement(converted.cash, pool, client);
+      if (isValidationError(cash)) {
+        await client.query('ROLLBACK');
+        res.status(cash.status).json({ error: cash.error, message: cash.message });
+        return;
+      }
+      await client.query('COMMIT');
+      res.json({ portfolio, cash });
+    } catch (error) {
+      await client.query('ROLLBACK');
+      throw error;
+    } finally {
+      client.release();
+    }
+  }),
+);
+
 export default router;

backend/src/routes/portfolio.ts

@@ -0,0 +1,22 @@
+import { Router } from 'express';
+import { asyncHandler } from '../utils';
+import * as portfolioService from '../services/portfolio';
+
+const router = Router();
+
+router.post(
+  '/',
+  asyncHandler(async (req, res) => {
+    try {
+      res.status(201).json(await portfolioService.importPortfolio(req.body));
+    } catch (error) {
+      if (error instanceof Error && /Invalid|Duplicate|must be|required|numeric/.test(error.message)) {
+        res.status(422).json({ error: 'VALIDATION_ERROR', message: error.message });
+        return;
+      }
+      throw error;
+    }
+  }),
+);
+
+export default router;

backend/src/routes/portfolioHistory.ts

@@ -0,0 +1,14 @@
+import { Router } from 'express';
+import { asyncHandler } from '../utils';
+import { getPortfolioHistory } from '../services/portfolio';
+
+const router = Router();
+
+router.get(
+  '/',
+  asyncHandler(async (_req, res) => {
+    res.json(await getPortfolioHistory());
+  }),
+);
+
+export default router;

backend/src/routes/portfolioOverview.ts

@@ -0,0 +1,14 @@
+import { Router } from 'express';
+import { asyncHandler } from '../utils';
+import { getPortfolioOverview } from '../services/portfolio';
+
+const router = Router();
+
+router.get(
+  '/',
+  asyncHandler(async (_req, res) => {
+    res.json(await getPortfolioOverview());
+  }),
+);
+
+export default router;

backend/src/services/analytics.integration.test.ts

@@ -26,17 +26,39 @@ async function testQueries(): Promise<void> {
       "INSERT INTO transactions (account_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed) VALUES ($1, '2026-07-06T12:00:00+03:00', 1_500, 0, 'Начисление процентов', 'transfer', 'analytics-test-interest', $2, TRUE)",
       [accountId, categoryId.transfer],
     );
+    await client.query(
+      "INSERT INTO transactions (account_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed) VALUES ($1, '2026-07-06T12:00:00+03:00', 0, 200, 'Зачисление кэшбека', 'income', 'analytics-test-cashback', $2, TRUE)",
+      [accountId, categoryId.income],
+    );
     await insert(otherAccountId, '2026-07-01T12:00:00+03:00', -99_000, categoryId.expense, 'analytics-test-6');
     await insert(accountId, '2026-08-01T12:00:00+03:00', -7_000, categoryId.expense, 'analytics-test-7');
+    await client.query(
+      "INSERT INTO transactions (account_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed) VALUES ($1, '2026-07-07T12:00:00+03:00', -2_500, 0, 'uncategorized', 'expense', 'analytics-test-uncategorized', NULL, FALSE)",
+      [accountId],
+    );
 
     const params = { from: '2026-07-01', to: '2026-07-31', accountId, onlyConfirmed: true };
     const summary = await getSummary(params, client);
-    assert.deepEqual({ expense: summary.totalExpense, income: summary.totalIncome, net: summary.net, transferOut: summary.transferOutflow, interest: summary.interestIncome }, { expense: 6_000, income: 15_000, net: 9_000, transferOut: 3_000, interest: 1_500 });
+    assert.deepEqual({ expense: summary.totalExpense, income: summary.totalIncome, net: summary.net, transferOut: summary.transferOutflow, interest: summary.interestIncome, cashback: summary.cashbackIncome }, { expense: 6_000, income: 15_200, net: 9_200, transferOut: 3_000, interest: 1_500, cashback: 200 });
+    const categorySummary = await getSummary({ ...params, categoryId: categoryId.expense }, client);
+    assert.deepEqual({ expense: categorySummary.totalExpense, income: categorySummary.totalIncome }, { expense: 6_000, income: 0 });
+    const uncategorized = await getSummary({ ...params, categoryId: 0, onlyConfirmed: false }, client);
+    assert.equal(uncategorized.totalExpense, 2_500);
+    assert.equal((await getSummary({ ...params, categoryId: 0, onlyConfirmed: true }, client)).totalExpense, 0);
+    assert.deepEqual((await getByCategory({ ...params, categoryId: 0, onlyConfirmed: false }, client)).map((item) => item.amount), [2_500]);
+    assert.deepEqual((await getByCategory({ ...params, categoryId: 0, onlyConfirmed: true }, client)), []);
     assert.equal((await getSummary({ ...params, from: '2026-08-01', to: '2026-08-31' }, client)).totalExpense, 7_000);
     assert.deepEqual((await getByCategory(params, client)).map((item) => item.amount), [6_000]);
     const timeseries = await getTimeseries({ ...params, granularity: 'month' }, client);
     assert.equal(timeseries[0].expenseAmount, 6_000);
     assert.equal(timeseries[0].incomeAmount, 15_000);
+    const partial = await getTimeseries({ ...params, from: '2026-07-02', to: '2026-07-03', granularity: 'month' }, client);
+    assert.equal(partial[0].expenseAmount, 0);
+    assert.equal(partial[0].incomeAmount, 20_000);
+    const uncategorizedSeries = await getTimeseries({ ...params, categoryId: 0, onlyConfirmed: false, granularity: 'month' }, client);
+    assert.equal(uncategorizedSeries[0].expenseAmount, 2_500);
+    const confirmedUncategorizedSeries = await getTimeseries({ ...params, categoryId: 0, onlyConfirmed: true, granularity: 'month' }, client);
+    assert.equal(confirmedUncategorizedSeries[0].expenseAmount, 0);
   } finally {
     await client.query('ROLLBACK');
     client.release();

backend/src/services/analytics.ts

@@ -14,6 +14,7 @@ interface BaseParams {
   from: string;
   to: string;
   accountId?: number;
+  categoryId?: number;
   onlyConfirmed?: boolean;
 }
 
@@ -32,7 +33,11 @@ function analyticsTransactions(where: string): string {
         CASE WHEN a.account_type = 'savings'
                   AND ${effectiveAmount} > 0
                   AND (t.description ILIKE '%процент%' OR t.description ILIKE '%выплата %' OR t.description LIKE '%\%%' ESCAPE '\\')
-             THEN ${effectiveAmount} ELSE 0 END AS interest_income
+             THEN ${effectiveAmount} ELSE 0 END AS interest_income,
+        CASE WHEN t.amount_signed = 0
+                  AND t.commission > 0
+                  AND t.description ILIKE '%зачисление%'
+             THEN t.commission ELSE 0 END AS cashback_income
       FROM transactions t
       LEFT JOIN categories c ON c.id = t.category_id
       LEFT JOIN accounts a ON a.id = t.account_id
@@ -61,6 +66,13 @@ function buildBaseConditions(
     values.push(params.accountId);
     idx++;
   }
+  if (params.categoryId != null) {
+    conditions.push(params.categoryId === 0 ? 't.category_id IS NULL' : `t.category_id = $${idx}`);
+    if (params.categoryId !== 0) {
+      values.push(params.categoryId);
+      idx++;
+    }
+  }
   if (params.onlyConfirmed) {
     conditions.push('t.is_category_confirmed = TRUE');
   }
@@ -79,7 +91,8 @@ export async function getSummary(
     `${analyticsTransactions(where)},
      category_net AS (
        SELECT category_id, category_name, analytic_type, SUM(effective_amount)::bigint AS amount,
-              SUM(interest_income)::bigint AS interest_income
+              SUM(interest_income)::bigint AS interest_income,
+              SUM(cashback_income)::bigint AS cashback_income
        FROM analytics_transactions
        GROUP BY category_id, category_name, analytic_type
      )
@@ -90,7 +103,8 @@ export async function getSummary(
        COALESCE((SELECT SUM(GREATEST(-effective_amount, 0)) FROM analytics_transactions), 0)::bigint AS cash_outflow,
        COALESCE((SELECT SUM(GREATEST(effective_amount, 0)) FROM analytics_transactions WHERE analytic_type = 'transfer'), 0)::bigint AS transfer_inflow,
        COALESCE((SELECT SUM(GREATEST(-effective_amount, 0)) FROM analytics_transactions WHERE analytic_type = 'transfer'), 0)::bigint AS transfer_outflow,
-       COALESCE(SUM(interest_income), 0)::bigint AS interest_income
+       COALESCE(SUM(interest_income), 0)::bigint AS interest_income,
+       COALESCE(SUM(cashback_income), 0)::bigint AS cashback_income
      FROM category_net`,
     values,
   );
@@ -102,6 +116,7 @@ export async function getSummary(
   const transferInflow = Number(totalsResult.rows[0].transfer_inflow);
   const transferOutflow = Number(totalsResult.rows[0].transfer_outflow);
   const interestIncome = Number(totalsResult.rows[0].interest_income);
+  const cashbackIncome = Number(totalsResult.rows[0].cashback_income);
 
   const topResult = await db.query(
     `${analyticsTransactions(where)}
@@ -132,6 +147,7 @@ export async function getSummary(
     transferOutflow,
     cashNet: cashInflow - cashOutflow,
     interestIncome,
+    cashbackIncome,
     topCategories,
   };
 }
@@ -196,6 +212,8 @@ export async function getTimeseries(
   }
 
   const txConditions: string[] = [
+    't.operation_at::date >= $1::date',
+    't.operation_at::date <= $2::date',
     't.operation_at::date >= p.period_start',
     't.operation_at::date <= p.period_end',
   ];
@@ -207,8 +225,11 @@ export async function getTimeseries(
     values.push(params.accountId);
   }
   if (params.categoryId != null) {
-    txConditions.push(`t.category_id = $${idx++}`);
-    values.push(params.categoryId);
+    if (params.categoryId === 0) txConditions.push('t.category_id IS NULL');
+    else {
+      txConditions.push(`t.category_id = $${idx++}`);
+      values.push(params.categoryId);
+    }
   }
   if (params.onlyConfirmed) {
     txConditions.push('t.is_category_confirmed = TRUE');

backend/src/services/categoryRules.ts

@@ -55,22 +55,38 @@ export async function getRules(params: GetCategoryRulesParams): Promise<Category
 
 export async function createRule(
   body: CreateCategoryRuleRequest,
-): Promise<CategoryRule> {
+): Promise<CategoryRule & { applied: number }> {
   const pattern = body.pattern.trim();
   const matchType = body.matchType ?? 'contains';
   const priority = body.priority ?? 100;
   const requiresConfirmation = body.requiresConfirmation ?? false;
 
-  const { rows } = await pool.query(
-    `INSERT INTO category_rules (pattern, match_type, category_id, priority, requires_confirmation)
-     VALUES ($1, $2, $3, $4, $5)
-     RETURNING *`,
-    [pattern, matchType, body.categoryId, priority, requiresConfirmation],
-  );
-
-  const catResult = await pool.query('SELECT name FROM categories WHERE id = $1', [body.categoryId]);
-  rows[0].category_name = catResult.rows[0].name;
-  return toRule(rows[0]);
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const { rows } = await client.query(
+      `INSERT INTO category_rules (pattern, match_type, category_id, priority, requires_confirmation)
+       VALUES ($1, $2, $3, $4, $5) RETURNING *`,
+      [pattern, matchType, body.categoryId, priority, requiresConfirmation],
+    );
+    const match = matchType === 'starts_with'
+      ? `t.description ILIKE $1 || '%'`
+      : `t.description ILIKE '%' || $1 || '%'`;
+    const applied = await client.query(
+      `UPDATE transactions t SET category_id = $2, is_category_confirmed = $3, updated_at = NOW()
+       WHERE (t.category_id IS NULL OR t.is_category_confirmed = FALSE) AND ${match}`,
+      [pattern, body.categoryId, !requiresConfirmation],
+    );
+    const catResult = await client.query('SELECT name FROM categories WHERE id = $1', [body.categoryId]);
+    rows[0].category_name = catResult.rows[0].name;
+    await client.query('COMMIT');
+    return { ...toRule(rows[0]), applied: applied.rowCount ?? 0 };
+  } catch (error) {
+    await client.query('ROLLBACK');
+    throw error;
+  } finally {
+    client.release();
+  }
 }
 
 export async function updateRule(

backend/src/services/import.integration.test.ts

@@ -2,25 +2,63 @@ import assert from 'node:assert/strict';
 import { pool } from '../db/pool';
 import { importStatement } from './import';
 
-const makeStatement = (sourceId: string) => ({
+const makeStatement = (sourceIds: string[]) => ({
   schemaVersion: '1.0', bank: 'TEST',
   statement: { accountNumber: 'metadata-test', currency: 'RUB', openingBalance: 0, closingBalance: 100, exportedAt: '2026-08-20T12:00:00+03:00' },
-  transactions: [{ operationAt: '2026-08-20T10:00:00+03:00', amountSigned: 100, commission: 0, description: 'Пополнение', sourceId }],
+  transactions: sourceIds.map((sourceId) => ({ operationAt: '2026-08-20T10:00:00+03:00', amountSigned: 100, commission: 0, description: 'Пополнение', sourceId })),
 });
 
+const duplicateStatement = {
+  schemaVersion: '1.0', bank: 'TEST',
+  statement: { accountNumber: 'fingerprint-test', currency: 'RUB', openingBalance: 0, closingBalance: 200, exportedAt: '2026-08-20T12:00:00+03:00' },
+  transactions: Array.from({ length: 2 }, () => ({ operationAt: '2026-08-20T00:00:00+03:00', amountSigned: 100, commission: 0, description: 'Пополнение' })),
+};
+const overlapStatement = {
+  ...duplicateStatement,
+  statement: { ...duplicateStatement.statement, accountNumber: 'overlap-test' },
+};
+const singleStatement = {
+  ...overlapStatement,
+  statement: { ...overlapStatement.statement, closingBalance: 100 },
+  transactions: overlapStatement.transactions.slice(0, 1),
+};
+
 async function run(): Promise<void> {
   try {
-    await importStatement(makeStatement('first'));
+    await importStatement(makeStatement(['first', 'first-second']));
+    const positions = await pool.query("SELECT source_position FROM transactions t JOIN accounts a ON a.id = t.account_id WHERE a.bank = 'TEST' AND a.account_number = 'metadata-test' ORDER BY source_position");
+    assert.deepEqual(positions.rows.map((row) => Number(row.source_position)), [0, 1]);
     const account = await pool.query("UPDATE accounts SET account_type = 'savings', status = 'closed' WHERE bank = 'TEST' AND account_number = 'metadata-test' RETURNING id");
     assert.equal(account.rows.length, 1);
-    await importStatement(makeStatement('second'));
+    await importStatement(makeStatement(['second']));
     const result = await pool.query('SELECT account_type, status FROM accounts WHERE id = $1', [account.rows[0].id]);
     assert.deepEqual(result.rows[0], { account_type: 'savings', status: 'closed' });
+    const duplicateResult = await importStatement(duplicateStatement);
+    if ('status' in duplicateResult) throw new Error(duplicateResult.message);
+    assert.deepEqual(duplicateResult, {
+      accountId: duplicateResult.accountId,
+      isNewAccount: true,
+      accountNumberMasked: 'fingerp******test',
+      imported: 2,
+      duplicatesSkipped: 0,
+      totalInFile: 2,
+    });
+    await importStatement(singleStatement);
+    const overlapResult = await importStatement(overlapStatement);
+    if ('status' in overlapResult) throw new Error(overlapResult.message);
+    assert.deepEqual(overlapResult, {
+      accountId: overlapResult.accountId,
+      isNewAccount: false,
+      accountNumberMasked: 'overla******test',
+      imported: 1,
+      duplicatesSkipped: 1,
+      totalInFile: 2,
+    });
     console.log('import metadata SQL: OK');
   } finally {
-    await pool.query('DELETE FROM transactions WHERE account_id IN (SELECT id FROM accounts WHERE bank = \'TEST\' AND account_number = \'metadata-test\')');
-    await pool.query("DELETE FROM imports WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'TEST' AND account_number = 'metadata-test')");
-    await pool.query("DELETE FROM accounts WHERE bank = 'TEST' AND account_number = 'metadata-test'");
+    await pool.query("DELETE FROM transactions WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'TEST' AND account_number IN ('metadata-test', 'fingerprint-test', 'overlap-test'))");
+    await pool.query("DELETE FROM imports WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'TEST' AND account_number IN ('metadata-test', 'fingerprint-test', 'overlap-test'))");
+    await pool.query("DELETE FROM accounts WHERE bank = 'TEST' AND account_number IN ('metadata-test', 'fingerprint-test', 'overlap-test')");
     await pool.end();
   }
 }

backend/src/services/import.test.ts

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import { computeFingerprint, determineDirection } from './import';
+
+assert.equal(determineDirection(1, 'Перечисление средств на счет N 123 со счета N 456'), 'transfer');
+assert.equal(determineDirection(1, 'Перечисление средств на вклад N 123'), 'transfer');
+assert.equal(determineDirection(-1, 'Перечисление суммы вклада при закрытии'), 'transfer');
+assert.equal(determineDirection(-1, 'Оплата покупки'), 'expense');
+assert.equal(determineDirection(1, 'Выплата процентов'), 'income');
+const duplicateTransaction = { operationAt: '2026-08-20T00:00:00+03:00', amountSigned: 100, commission: 0, description: 'Пополнение' };
+assert.notEqual(computeFingerprint('fingerprint-test', duplicateTransaction, 0), computeFingerprint('fingerprint-test', duplicateTransaction, 1));
+
+console.log('import direction: OK');

backend/src/services/import.ts

@@ -1,4 +1,5 @@
 import crypto from 'crypto';
+import type { PoolClient } from 'pg';
 import { pool } from '../db/pool';
 import { maskAccountNumber } from '../utils';
 import type { StatementFile, ImportStatementResponse } from '@family-budget/shared';
@@ -6,14 +7,18 @@ import type { StatementFile, ImportStatementResponse } from '@family-budget/shar
 const TRANSFER_PHRASES = [
   'перевод между своими счетами',
   'перевод средств на счет',
+  'перечисление средств на счет',
+  'перечисление средств на вклад',
+  'перечисление суммы вклада при закрытии',
   'внутри втб',
 ];
 const CASHBACK_KEYWORD = 'зачисление';
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
-function computeFingerprint(
+export function computeFingerprint(
   accountNumber: string,
   tx: { operationAt: string; amountSigned: number; commission: number; description: string; sourceId?: string },
+  sourcePosition?: number,
 ): string {
   if (tx.sourceId) {
     const raw = [accountNumber, tx.sourceId.trim()].join('|');
@@ -26,12 +31,13 @@ function computeFingerprint(
     String(tx.amountSigned),
     String(tx.commission),
     tx.description.trim(),
+    ...(sourcePosition === undefined ? [] : [String(sourcePosition)]),
   ].join('|');
   const hash = crypto.createHash('sha256').update(raw, 'utf-8').digest('hex');
   return `sha256:${hash}`;
 }
 
-function determineDirection(amountSigned: number, description: string): string {
+export function determineDirection(amountSigned: number, description: string): string {
   const lower = description.toLowerCase();
   for (const phrase of TRANSFER_PHRASES) {
     if (lower.includes(phrase)) return 'transfer';
@@ -136,7 +142,7 @@ function validateSemantics(data: StatementFile): ValidationError | null {
   const operationIds = new Set<string>();
   for (let i = 0; i < data.transactions.length; i++) {
     const fp = computeFingerprint(data.statement.accountNumber, data.transactions[i]);
-    if (fps.has(fp)) {
+    if (data.transactions[i].sourceId && fps.has(fp)) {
       return { status: 422, error: 'VALIDATION_ERROR', message: `Duplicate fingerprint found within file at transaction index ${i}` };
     }
     fps.add(fp);
@@ -155,6 +161,7 @@ function validateSemantics(data: StatementFile): ValidationError | null {
 export async function importStatement(
   body: unknown,
   db: Pick<typeof pool, 'connect'> = pool,
+  transactionClient?: PoolClient,
 ): Promise<ImportStatementResponse | ValidationError> {
   const structErr = validateStructure(body);
   if (structErr) return structErr;
@@ -163,9 +170,10 @@ export async function importStatement(
   const semErr = validateSemantics(data);
   if (semErr) return semErr;
 
-  const client = await db.connect();
+  const client = transactionClient ?? await db.connect();
+  const ownsTransaction = transactionClient == null;
   try {
-    await client.query('BEGIN');
+    if (ownsTransaction) await client.query('BEGIN');
 
     // Find or create account
     let accountId: number;
@@ -218,9 +226,15 @@ export async function importStatement(
 
     // Insert transactions
     const insertedIds: number[] = [];
+    const fallbackFingerprintOccurrences = new Map<string, number>();
 
-    for (const tx of data.transactions) {
-      const fp = computeFingerprint(data.statement.accountNumber, tx);
+    for (const [sourcePosition, tx] of data.transactions.entries()) {
+      const fallbackFingerprint = computeFingerprint(data.statement.accountNumber, tx);
+      const occurrence = fallbackFingerprintOccurrences.get(fallbackFingerprint) ?? 0;
+      fallbackFingerprintOccurrences.set(fallbackFingerprint, occurrence + 1);
+      const fp = !tx.sourceId && occurrence > 0
+        ? computeFingerprint(data.statement.accountNumber, tx, occurrence)
+        : fallbackFingerprint;
       const isCashbackCommissionImport =
         tx.amountSigned === 0 &&
         tx.commission > 0 &&
@@ -235,11 +249,11 @@ export async function importStatement(
 
       const result = await client.query(
         `INSERT INTO transactions
-           (account_id, operation_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed, import_id)
-         VALUES ($1, COALESCE($2::uuid, gen_random_uuid()), $3, $4, $5, $6, $7, $8, $9, $10, $11)
+           (account_id, operation_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed, import_id, source_position)
+         VALUES ($1, COALESCE($2::uuid, gen_random_uuid()), $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
          ON CONFLICT DO NOTHING
          RETURNING id`,
-        [accountId, tx.operationId ?? null, tx.operationAt, tx.amountSigned, tx.commission, tx.description, dir, fp, categoryId, isCategoryConfirmed, importId],
+        [accountId, tx.operationId ?? null, tx.operationAt, tx.amountSigned, tx.commission, tx.description, dir, fp, categoryId, isCategoryConfirmed, importId, sourcePosition],
       );
 
       if (result.rows.length > 0) {
@@ -289,7 +303,7 @@ export async function importStatement(
       }
     }
 
-    await client.query('COMMIT');
+    if (ownsTransaction) await client.query('COMMIT');
 
     return {
       accountId,
@@ -300,10 +314,10 @@ export async function importStatement(
       totalInFile: data.transactions.length,
     };
   } catch (err) {
-    await client.query('ROLLBACK');
+    if (ownsTransaction) await client.query('ROLLBACK');
     throw err;
   } finally {
-    client.release();
+    if (ownsTransaction) client.release();
   }
 }
 

backend/src/services/portfolio.integration.test.ts

@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import { pool } from '../db/pool';
+import { importPortfolio } from './portfolio';
+
+const payload = {
+  schemaVersion: 'broker-portfolio-1.0', bank: 'PORTFOLIO_TEST', accountNumber: 'portfolio-test',
+  reportPeriod: { from: '2026-08-01', to: '2026-08-20' }, reportedAt: '2026-08-20T00:00:00+03:00',
+  positions: [{ instrument: 'Test Bond', isin: 'RU0000000001', quantity: '1.000', price: '100.123456', valuation: '100.123456' }],
+  trades: [{ instrument: 'Test Bond', isin: 'RU0000000001', concludedAt: '2026-08-10T10:00:00+03:00', side: 'Покупка', quantity: '1.000', settlementAmount: '100.123456' }],
+};
+
+async function run(): Promise<void> {
+  try {
+    const first = await importPortfolio(payload);
+    const second = await importPortfolio(payload);
+    assert.equal(first.importedTrades, 1);
+    assert.equal(second.duplicateTrades, 1);
+    const rows = await pool.query('SELECT COUNT(*)::int AS count FROM portfolio_trades WHERE account_id = $1', [first.accountId]);
+    assert.equal(rows.rows[0].count, 1);
+    console.log('portfolio import SQL: OK');
+  } finally {
+    await pool.query("DELETE FROM portfolio_trades WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'PORTFOLIO_TEST' AND account_number = 'portfolio-test')");
+    await pool.query("DELETE FROM portfolio_reports WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'PORTFOLIO_TEST' AND account_number = 'portfolio-test')");
+    await pool.query("DELETE FROM accounts WHERE bank = 'PORTFOLIO_TEST' AND account_number = 'portfolio-test'");
+    await pool.end();
+  }
+}
+
+run();

backend/src/services/portfolio.test.ts

@@ -0,0 +1,13 @@
+import assert from 'node:assert/strict';
+import { deriveTradeSourceId, validatePortfolio } from './portfolio';
+
+const trade = {
+  instrument: 'Bond', isin: 'RU0000000001', concludedAt: '2026-08-20T10:00:00+03:00',
+  side: 'Покупка', quantity: '1.000', settlementAmount: '1234.50',
+};
+
+assert.equal(deriveTradeSourceId(trade), 'RU0000000001|2026-08-20T10:00:00+03:00|Покупка|1.000|1234.50');
+assert.throws(() => validatePortfolio(null), /object/);
+assert.throws(() => validatePortfolio({ schemaVersion: 'broker-portfolio-1.0', bank: 'B', accountNumber: 'A', reportPeriod: { from: '2026-08-20', to: '2026-08-20' }, reportedAt: null, positions: [], trades: [{ ...trade, sourceId: 42 }] }), /sourceId/);
+assert.throws(() => validatePortfolio({ ...{ schemaVersion: 'broker-portfolio-1.0', bank: 'B', accountNumber: 'A', reportPeriod: { from: '2026-08-21', to: '2026-08-20' }, reportedAt: null, positions: [], trades: [] } }), /period/);
+console.log('portfolio validation: OK');

backend/src/services/portfolio.ts

@@ -0,0 +1,214 @@
+import crypto from 'crypto';
+import type { PoolClient } from 'pg';
+import { pool } from '../db/pool';
+import { maskAccountNumber } from '../utils';
+import type { ImportPortfolioResponse, PortfolioFile, PortfolioHistoryResponse, PortfolioOverviewResponse, PortfolioTrade } from '@family-budget/shared';
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+type PortfolioOverviewRow = {
+  account_id: number | string;
+  alias: string | null;
+  bank: string;
+  account_number: string;
+  report_period_to: string;
+  total_valuation: string | number | null;
+  instrument: string | null;
+  isin: string | null;
+  quantity: string | number | null;
+  price: string | number | null;
+  valuation: string | number | null;
+};
+
+type PortfolioHistoryRow = {
+  account_id: number | string;
+  alias: string | null;
+  bank: string;
+  account_number: string;
+  report_period_to: string;
+  total_valuation: string | number | null;
+};
+
+function decimalValue(value: unknown, field: string, required = false): string | null {
+  if (value == null || value === '') {
+    if (required) throw new Error(`${field} is required`);
+    return null;
+  }
+  const result = String(value).replace(/\s/g, '').replace(',', '.');
+  if (!/^-?(?:\d+\.?\d*|\.\d+)$/.test(result)) throw new Error(`${field} must be numeric`);
+  return result;
+}
+
+export function deriveTradeSourceId(trade: PortfolioTrade): string {
+  if (trade.sourceId?.trim()) return trade.sourceId.trim();
+  return [trade.isin || trade.instrument, trade.concludedAt, trade.side, decimalValue(trade.quantity, 'quantity', true), decimalValue(trade.settlementAmount, 'settlementAmount') || ''].join('|');
+}
+
+export function validatePortfolio(body: unknown): asserts body is PortfolioFile {
+  if (!body || typeof body !== 'object') throw new Error('Portfolio file must be an object');
+  const data = body as PortfolioFile;
+  if (data.schemaVersion !== 'broker-portfolio-1.0' || typeof data.bank !== 'string' || !data.bank.trim() || typeof data.accountNumber !== 'string' || !data.accountNumber.trim()) throw new Error('Invalid portfolio file');
+  if (!data.reportPeriod?.from || !data.reportPeriod?.to || Number.isNaN(Date.parse(data.reportPeriod.from)) || Number.isNaN(Date.parse(data.reportPeriod.to)) || data.reportPeriod.from > data.reportPeriod.to) throw new Error('Invalid report period');
+  if (data.reportedAt !== null && (typeof data.reportedAt !== 'string' || Number.isNaN(Date.parse(data.reportedAt)))) throw new Error('Invalid reportedAt');
+  if (!Array.isArray(data.positions) || !Array.isArray(data.trades)) throw new Error('positions and trades must be arrays');
+  const sourceIds = new Set<string>();
+  for (const trade of data.trades) {
+    if (!trade || typeof trade.instrument !== 'string' || !trade.instrument.trim() || typeof trade.concludedAt !== 'string' || Number.isNaN(Date.parse(trade.concludedAt)) || typeof trade.side !== 'string' || !trade.side.trim()) throw new Error('Invalid trade');
+    if (trade.sourceId !== undefined && typeof trade.sourceId !== 'string') throw new Error('sourceId must be a string');
+    if (trade.operationId !== undefined && typeof trade.operationId !== 'string') throw new Error('operationId must be a string');
+    const sourceId = deriveTradeSourceId(trade);
+    if (sourceIds.has(sourceId)) throw new Error(`Duplicate sourceId: ${sourceId}`);
+    sourceIds.add(sourceId);
+    if (trade.operationId && !UUID_RE.test(trade.operationId)) throw new Error(`Invalid operationId: ${trade.sourceId}`);
+    decimalValue(trade.quantity, 'quantity', true);
+  }
+  for (const position of data.positions) {
+    if (!position || typeof position.instrument !== 'string' || !position.instrument.trim()) throw new Error('Invalid position');
+    decimalValue(position.quantity, 'position.quantity', true);
+    decimalValue(position.price, 'position.price');
+    decimalValue(position.valuation, 'position.valuation');
+  }
+}
+
+export async function importPortfolio(body: unknown, db: Pick<typeof pool, 'connect'> = pool, transactionClient?: PoolClient): Promise<ImportPortfolioResponse> {
+  validatePortfolio(body);
+  const data = body;
+  const sourceHash = crypto.createHash('sha256').update(JSON.stringify(data)).digest('hex');
+  const client = transactionClient ?? await db.connect();
+  const ownsTransaction = transactionClient == null;
+  try {
+    if (ownsTransaction) await client.query('BEGIN');
+    const accountResult = await client.query(
+      `INSERT INTO accounts (bank, account_number, currency, account_type)
+       VALUES ($1, $2, 'RUB', 'brokerage')
+       ON CONFLICT (bank, account_number) DO UPDATE SET account_type = COALESCE(accounts.account_type, 'brokerage')
+       RETURNING id`,
+      [data.bank, data.accountNumber],
+    );
+    const accountId = Number(accountResult.rows[0].id);
+    const reportResult = await client.query(
+      `INSERT INTO portfolio_reports (account_id, source_hash, report_period_from, report_period_to, reported_at)
+       VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (account_id, source_hash) DO NOTHING
+       RETURNING id`,
+      [accountId, sourceHash, data.reportPeriod.from, data.reportPeriod.to, data.reportedAt],
+    );
+    if (reportResult.rows.length === 0) {
+      const existing = await client.query('SELECT id FROM portfolio_reports WHERE account_id = $1 AND source_hash = $2', [accountId, sourceHash]);
+      if (ownsTransaction) await client.query('COMMIT');
+      return { accountId, reportId: Number(existing.rows[0].id), importedTrades: 0, duplicateTrades: data.trades.length, positions: 0 };
+    }
+    const reportId = Number(reportResult.rows[0].id);
+    for (const position of data.positions) {
+      await client.query(
+        `INSERT INTO portfolio_positions (report_id, instrument, isin, quantity, price, valuation)
+         VALUES ($1, $2, $3, $4, $5, $6)`,
+        [reportId, position.instrument, position.isin ?? null, decimalValue(position.quantity, 'position.quantity', true), decimalValue(position.price, 'position.price'), decimalValue(position.valuation, 'position.valuation')],
+      );
+    }
+    let importedTrades = 0;
+    for (const trade of data.trades) {
+      const sourceId = deriveTradeSourceId(trade);
+      const result = await client.query(
+        `INSERT INTO portfolio_trades
+         (account_id, source_id, operation_id, instrument, isin, concluded_at, side, quantity, price_currency, price, settlement_currency, settlement_amount, nkd, settlement_commission, trade_commission, order_id, trade_id, venue, comment)
+         VALUES ($1, $2, COALESCE($3::uuid, gen_random_uuid()), $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)
+         ON CONFLICT (account_id, source_id) DO NOTHING`,
+        [accountId, sourceId, trade.operationId ?? null, trade.instrument, trade.isin ?? null, trade.concludedAt, trade.side, decimalValue(trade.quantity, 'quantity', true), trade.priceCurrency ?? null, decimalValue(trade.price, 'price'), trade.settlementCurrency ?? null, decimalValue(trade.settlementAmount, 'settlementAmount'), decimalValue(trade.nkd, 'nkd'), decimalValue(trade.settlementCommission, 'settlementCommission'), decimalValue(trade.tradeCommission, 'tradeCommission'), trade.orderId ?? null, trade.tradeId ?? null, trade.venue ?? null, trade.comment ?? null],
+      );
+      importedTrades += result.rowCount ?? 0;
+    }
+    if (ownsTransaction) await client.query('COMMIT');
+    return { accountId, reportId, importedTrades, duplicateTrades: data.trades.length - importedTrades, positions: data.positions.length };
+  } catch (error) {
+    if (ownsTransaction) await client.query('ROLLBACK');
+    throw error;
+  } finally {
+    if (ownsTransaction) client.release();
+  }
+}
+
+export function toPortfolioOverview(rows: PortfolioOverviewRow[]): PortfolioOverviewResponse {
+  const accounts = new Map<number, PortfolioOverviewResponse['accounts'][number]>();
+  for (const row of rows) {
+    const accountId = Number(row.account_id);
+    let account = accounts.get(accountId);
+    if (!account) {
+      account = {
+        accountId,
+        accountName: row.alias || `${row.bank} · ${maskAccountNumber(row.account_number)}`,
+        reportPeriodTo: row.report_period_to,
+        totalValuation: row.total_valuation === null ? null : String(row.total_valuation),
+        positions: [],
+      };
+      accounts.set(accountId, account);
+    }
+    if (row.instrument !== null) {
+      const valuation = row.valuation === null ? null : String(row.valuation);
+      account.positions.push({
+        instrument: row.instrument,
+        isin: row.isin,
+        quantity: String(row.quantity),
+        price: row.price === null ? null : String(row.price),
+        valuation,
+      });
+    }
+  }
+  return { accounts: [...accounts.values()] };
+}
+
+export async function getPortfolioOverview(): Promise<PortfolioOverviewResponse> {
+  const { rows } = await pool.query<PortfolioOverviewRow>(
+    `SELECT a.id AS account_id, a.alias, a.bank, a.account_number,
+            r.report_period_to,
+            SUM(p.valuation) OVER (PARTITION BY a.id) AS total_valuation,
+            p.instrument, p.isin, p.quantity, p.price, p.valuation
+     FROM accounts a
+     JOIN LATERAL (
+       SELECT id, report_period_to, reported_at, imported_at
+       FROM portfolio_reports
+       WHERE account_id = a.id
+       ORDER BY report_period_to DESC, imported_at DESC, id DESC
+       LIMIT 1
+     ) r ON TRUE
+     LEFT JOIN portfolio_positions p ON p.report_id = r.id
+     WHERE a.account_type IN ('brokerage', 'iis')
+     ORDER BY a.id, p.valuation DESC NULLS LAST, p.id`,
+  );
+  return toPortfolioOverview(rows);
+}
+
+export function toPortfolioHistory(rows: PortfolioHistoryRow[]): PortfolioHistoryResponse {
+  const accounts = new Map<number, PortfolioHistoryResponse['accounts'][number]>();
+  for (const row of rows) {
+    const accountId = Number(row.account_id);
+    let account = accounts.get(accountId);
+    if (!account) {
+      account = {
+        accountId,
+        accountName: row.alias || `${row.bank} · ${maskAccountNumber(row.account_number)}`,
+        points: [],
+      };
+      accounts.set(accountId, account);
+    }
+    account.points.push({
+      reportPeriodTo: row.report_period_to,
+      totalValuation: row.total_valuation === null ? null : String(row.total_valuation),
+    });
+  }
+  return { accounts: [...accounts.values()] };
+}
+
+export async function getPortfolioHistory(): Promise<PortfolioHistoryResponse> {
+  const { rows } = await pool.query<PortfolioHistoryRow>(
+    `SELECT a.id AS account_id, a.alias, a.bank, a.account_number,
+            r.report_period_to, SUM(p.valuation) AS total_valuation
+     FROM accounts a
+     JOIN portfolio_reports r ON r.account_id = a.id
+     LEFT JOIN portfolio_positions p ON p.report_id = r.id
+     WHERE a.account_type IN ('brokerage', 'iis')
+     GROUP BY a.id, a.alias, a.bank, a.account_number, r.id, r.report_period_to, r.reported_at, r.imported_at
+     ORDER BY a.id, r.report_period_to, r.reported_at, r.imported_at, r.id`,
+  );
+  return toPortfolioHistory(rows);
+}

backend/src/services/portfolioOverview.test.ts

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import { toPortfolioHistory, toPortfolioOverview } from './portfolio';
+
+const result = toPortfolioOverview([
+  { account_id: '1', alias: 'ИИС', bank: 'ВТБ', account_number: '123456', report_period_to: '2026-08-26', total_valuation: '150.50', instrument: 'Облигация', isin: 'RU0000000001', quantity: '1', price: '100', valuation: '100' },
+  { account_id: '1', alias: 'ИИС', bank: 'ВТБ', account_number: '123456', report_period_to: '2026-08-26', total_valuation: '150.50', instrument: 'Фонд', isin: null, quantity: '2', price: '25.25', valuation: '50.50' },
+]);
+
+assert.equal(result.accounts[0].accountName, 'ИИС');
+assert.equal(result.accounts[0].totalValuation, '150.50');
+assert.equal(result.accounts[0].positions.length, 2);
+console.log('portfolio overview: OK');
+
+const history = toPortfolioHistory([
+  { account_id: '1', alias: 'ИИС', bank: 'ВТБ', account_number: '123456', report_period_to: '2026-08-20', total_valuation: '100' },
+  { account_id: '1', alias: 'ИИС', bank: 'ВТБ', account_number: '123456', report_period_to: '2026-08-26', total_valuation: '150.50' },
+]);
+assert.deepEqual(history.accounts[0].points.map((point) => point.totalValuation), ['100', '150.50']);
+console.log('portfolio history: OK');

backend/src/services/transactions.test.ts

@@ -0,0 +1,13 @@
+import assert from 'node:assert/strict';
+import { transactionOrderBy } from './transactions';
+
+assert.equal(
+  transactionOrderBy('date', 'desc'),
+  't.operation_at DESC, t.source_position ASC, t.id ASC',
+);
+assert.equal(
+  transactionOrderBy('date', 'asc'),
+  't.operation_at ASC, t.source_position DESC, t.id DESC',
+);
+assert.match(transactionOrderBy('amount', 'desc'), /t\.amount_signed DESC.*t\.operation_at DESC.*t\.source_position ASC.*t\.id DESC/);
+console.log('transaction ordering: OK');

backend/src/services/transactions.ts

@@ -7,13 +7,18 @@ import type {
   UpdateTransactionRequest,
 } from '@family-budget/shared';
 
+export function transactionOrderBy(sortBy: 'date' | 'amount', sortOrder: 'asc' | 'desc'): string {
+  const direction = sortOrder === 'asc' ? 'ASC' : 'DESC';
+  if (sortBy === 'amount') return `t.amount_signed ${direction}, t.operation_at DESC, t.source_position ASC, t.id DESC`;
+  return `t.operation_at ${direction}, t.source_position ${direction === 'ASC' ? 'DESC' : 'ASC'}, t.id ${direction === 'ASC' ? 'DESC' : 'ASC'}`;
+}
+
 export async function getTransactions(
   params: GetTransactionsParams,
 ): Promise<PaginatedResponse<Transaction>> {
   const page = params.page ?? 1;
   const pageSize = [10, 50, 100].includes(params.pageSize ?? 50) ? (params.pageSize ?? 50) : 50;
-  const sortBy = params.sortBy === 'amount' ? 't.amount_signed' : 't.operation_at';
-  const sortOrder = params.sortOrder === 'asc' ? 'ASC' : 'DESC';
+  const orderBy = transactionOrderBy(params.sortBy === 'amount' ? 'amount' : 'date', params.sortOrder === 'asc' ? 'asc' : 'desc');
 
   const conditions: string[] = [];
   const values: unknown[] = [];
@@ -84,7 +89,7 @@ export async function getTransactions(
      JOIN accounts a ON a.id = t.account_id
      LEFT JOIN categories c ON c.id = t.category_id
      ${where}
-     ORDER BY ${sortBy} ${sortOrder}
+     ORDER BY ${orderBy}
      LIMIT $${idx++} OFFSET $${idx++}`,
     [...values, pageSize, offset],
   );

backend/src/services/vtbBrokerXlsx.test.ts

@@ -0,0 +1,45 @@
+import assert from 'node:assert/strict';
+import zlib from 'zlib';
+import { convertVtbBrokerXlsx } from './vtbBrokerXlsx';
+
+function zip(files: Record<string, string>): Buffer {
+  let offset = 0;
+  const locals: Buffer[] = [];
+  const central: Buffer[] = [];
+  for (const [name, value] of Object.entries(files)) {
+    const nameBuffer = Buffer.from(name);
+    const data = zlib.deflateRawSync(Buffer.from(value));
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0); local.writeUInt16LE(20, 4); local.writeUInt16LE(8, 8);
+    local.writeUInt32LE(data.length, 18); local.writeUInt32LE(Buffer.byteLength(value), 22);
+    local.writeUInt16LE(nameBuffer.length, 26);
+    const header = Buffer.alloc(46);
+    header.writeUInt32LE(0x02014b50, 0); header.writeUInt16LE(20, 4); header.writeUInt16LE(20, 6); header.writeUInt16LE(8, 10);
+    header.writeUInt32LE(data.length, 20); header.writeUInt32LE(Buffer.byteLength(value), 24); header.writeUInt16LE(nameBuffer.length, 28); header.writeUInt32LE(offset, 42);
+    locals.push(local, nameBuffer, data);
+    central.push(header, nameBuffer);
+    offset += local.length + nameBuffer.length + data.length;
+  }
+  const centralBuffer = Buffer.concat(central);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0); end.writeUInt16LE(Object.keys(files).length, 8); end.writeUInt16LE(Object.keys(files).length, 10); end.writeUInt32LE(centralBuffer.length, 12); end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...locals, centralBuffer, end]);
+}
+
+const strings = ['Период с 01.08.2026 по 31.08.2026', '12345678901234567890 (RUR)', 'Дата формирования отчета', 'Движение денежных средств', 'Пополнение', 'Отчёт об остатках ценных бумаг', 'Движение ценных бумаг', 'Отчёт об остатках денежных средств', 'Заключенные в отчетном периоде сделки с ценными бумагами', 'Bond, RU0000000001', 'Покупка', 'Завершенные в отчетном периоде сделки с ценными бумагами'];
+const shared = `<sst>${strings.map((value) => `<si><t>${value}</t></si>`).join('')}</sst>`;
+const cell = (ref: string, value: string | number, sharedString = false) => `<c r="${ref}"${sharedString ? ' t="s"' : ''}><v>${value}</v></c>`;
+const row = (number: number, cells: string[]) => `<row r="${number}">${cells.join('')}</row>`;
+const sheet = `<worksheet><sheetData>${[
+  row(1, [cell('A1', 0, true)]), row(2, [cell('A2', 1, true)]), row(3, [cell('A3', 2, true), cell('B3', 45900)]),
+  row(10, [cell('A10', 3, true)]), row(11, [cell('B11', 45900), cell('C11', 1), cell('J11', 4, true)]),
+  row(12, [cell('A12', 5, true)]), row(13, [cell('A13', 6, true)]), row(15, [cell('A15', 7, true)]), row(16, []), row(17, []), row(18, [cell('L18', 0), cell('AF18', 1)]),
+  row(20, [cell('A20', 8, true)]), row(21, [cell('B21', 9, true), cell('C21', 45900), cell('F21', 10, true), cell('H21', 1)]), row(22, [cell('A22', 11, true)]),
+].join('')}</sheetData></worksheet>`;
+
+const result = convertVtbBrokerXlsx(zip({ 'xl/sharedStrings.xml': shared, 'xl/worksheets/sheet1.xml': sheet }));
+assert.equal(result.cash.transactions.length, 1);
+assert.equal(result.cash.statement.closingBalance, 100);
+assert.equal(result.portfolio.trades.length, 1);
+assert.throws(() => convertVtbBrokerXlsx(Buffer.from('not a zip')), /XLSX/);
+console.log('VTB broker XLSX: OK');

backend/src/services/vtbBrokerXlsx.ts

@@ -0,0 +1,167 @@
+import crypto from 'crypto';
+import zlib from 'zlib';
+import type { PortfolioFile, StatementFile } from '@family-budget/shared';
+
+type Row = [number, Record<string, string>];
+const MAX_XLSX_UNCOMPRESSED_BYTES = 30 * 1024 * 1024;
+
+function xmlText(value: string): string {
+  return value.replace(/<[^>]+>/g, '').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&#(d+);/g, (_, code) => String.fromCharCode(Number(code))).replace(/\s+/g, ' ').trim();
+}
+
+function zipFiles(buffer: Buffer): Map<string, Buffer> {
+  const end = buffer.lastIndexOf(Buffer.from([0x50, 0x4b, 0x05, 0x06]));
+  if (end < 0) throw new Error('Файл не является XLSX-архивом');
+  const files = new Map<string, Buffer>();
+  let offset = buffer.readUInt32LE(end + 16);
+  const count = buffer.readUInt16LE(end + 10);
+  let totalSize = 0;
+  for (let i = 0; i < count; i++) {
+    if (buffer.readUInt32LE(offset) !== 0x02014b50) throw new Error('Повреждён XLSX-архив');
+    const method = buffer.readUInt16LE(offset + 10);
+    const compressedSize = buffer.readUInt32LE(offset + 20);
+    const nameLength = buffer.readUInt16LE(offset + 28);
+    const extraLength = buffer.readUInt16LE(offset + 30);
+    const commentLength = buffer.readUInt16LE(offset + 32);
+    const localOffset = buffer.readUInt32LE(offset + 42);
+    const name = buffer.subarray(offset + 46, offset + 46 + nameLength).toString('utf8');
+    if (buffer.readUInt32LE(localOffset) !== 0x04034b50) throw new Error('Повреждён XLSX-архив');
+    const localNameLength = buffer.readUInt16LE(localOffset + 26);
+    const localExtraLength = buffer.readUInt16LE(localOffset + 28);
+    const data = buffer.subarray(localOffset + 30 + localNameLength + localExtraLength, localOffset + 30 + localNameLength + localExtraLength + compressedSize);
+    let content: Buffer;
+    try {
+      content = method === 0 ? data : method === 8 ? zlib.inflateRawSync(data, { maxOutputLength: MAX_XLSX_UNCOMPRESSED_BYTES - totalSize }) : (() => { throw new Error('Неподдерживаемое сжатие XLSX'); })();
+    } catch (error) {
+      if (error instanceof Error && /maxOutputLength|larger than/i.test(error.message)) throw new Error('XLSX-отчёт слишком большой после распаковки');
+      throw error;
+    }
+    totalSize += content.length;
+    if (totalSize > MAX_XLSX_UNCOMPRESSED_BYTES) throw new Error('XLSX-отчёт слишком большой после распаковки');
+    files.set(name, content);
+    offset += 46 + nameLength + extraLength + commentLength;
+  }
+  return files;
+}
+
+function readRows(buffer: Buffer): Row[] {
+  const files = zipFiles(buffer);
+  const sharedXml = files.get('xl/sharedStrings.xml')?.toString('utf8');
+  const sheetXml = files.get('xl/worksheets/sheet1.xml')?.toString('utf8');
+  if (!sharedXml || !sheetXml) throw new Error('В XLSX не найдены данные отчёта');
+  const shared = [...sharedXml.matchAll(/<si>([\s\S]*?)<\/si>/g)].map((match) => xmlText(match[1]));
+  return [...sheetXml.matchAll(/<row[^>]*\br="(\d+)"[^>]*>([\s\S]*?)<\/row>/g)].map((row) => {
+    const cells: Record<string, string> = {};
+    for (const cell of row[2].matchAll(/<c[^>]*\br="([A-Z]+)\d+"([^>]*)>([\s\S]*?)<\/c>/g)) {
+      const value = cell[3].match(/<v>([\s\S]*?)<\/v>/)?.[1] ?? '';
+      cells[cell[1]] = /\bt="s"/.test(cell[2]) && value ? shared[Number(value)] : xmlText(value);
+    }
+    return [Number(row[1]), cells];
+  });
+}
+
+function text(value: unknown): string {
+  return String(value ?? '').replace(/\s+/g, ' ').trim();
+}
+
+function rowText(cells: Record<string, string>): string {
+  return text(Object.values(cells).join(' '));
+}
+
+function findRow(rows: Row[], phrase: string, start = 0): number {
+  const index = rows.findIndex(([, cells], i) => i >= start && rowText(cells).toLowerCase().includes(phrase.toLowerCase()));
+  if (index < 0) throw new Error(`Не найден раздел: ${phrase}`);
+  return index;
+}
+
+function excelDate(value: string | undefined): string | null {
+  if (!value) return null;
+  const date = new Date(Date.UTC(1899, 11, 30) + Number(value) * 86_400_000);
+  if (Number.isNaN(date.valueOf())) return null;
+  return `${date.toISOString().slice(0, 19)}+03:00`;
+}
+
+function kopecks(value: string | undefined): number {
+  return value ? Math.round(Number(value.replace(',', '.')) * 100) : 0;
+}
+
+function metadata(rows: Row[]): { account: string; period: [string, string]; reportedAt: string | null } {
+  const period = rows.map(([, cells]) => rowText(cells)).join(' ').match(/период с (\d{2}\.\d{2}\.\d{4}) по (\d{2}\.\d{2}\.\d{4})/i);
+  let account: string | null = null;
+  let reportedAt: string | null = null;
+  for (const [, cells] of rows.slice(0, 35)) {
+    const joined = rowText(cells);
+    account ??= joined.match(/(\d{20})\s*\(RUR\)/)?.[1] ?? null;
+    if (joined.includes('Дата формирования отчета')) {
+      reportedAt ??= Object.values(cells).map(excelDate).find(Boolean) ?? null;
+    }
+  }
+  if (!account || !period) throw new Error('Не удалось определить счёт или период отчёта');
+  return { account, period: [period[1], period[2]], reportedAt };
+}
+
+function isoDate(value: string): string {
+  const [day, month, year] = value.split('.');
+  return `${year}-${month}-${day}`;
+}
+
+export function convertVtbBrokerXlsx(buffer: Buffer): { cash: StatementFile; portfolio: PortfolioFile } {
+  const rows = readRows(buffer);
+  const { account, period, reportedAt } = metadata(rows);
+  const holdingsStart = findRow(rows, 'Отчёт об остатках ценных бумаг');
+  const movementStart = findRow(rows, 'Движение ценных бумаг', holdingsStart);
+  const cashStart = findRow(rows, 'Движение денежных средств');
+  const tradesStart = findRow(rows, 'Заключенные в отчетном периоде сделки с ценными бумагами');
+  const tradesEnd = findRow(rows, 'Завершенные в отчетном периоде сделки с ценными бумагами', tradesStart + 1);
+  const occurrences = new Map<string, number>();
+  const transactions = rows.slice(cashStart + 1, holdingsStart).flatMap(([, cells]) => {
+    if (!cells.B || !cells.C || !cells.J) return [];
+    const operationAt = excelDate(cells.B);
+    if (!operationAt) return [];
+    const amountSigned = kopecks(cells.C);
+    const description = text(`${text(cells.J)}. ${text(cells.P)}`.replace(/\. $/, ''));
+    const digest = crypto.createHash('sha256').update(`${operationAt}|${amountSigned}|${description}`).digest('hex').slice(0, 16);
+    const occurrence = (occurrences.get(digest) ?? 0) + 1;
+    occurrences.set(digest, occurrence);
+    return [{ operationAt, amountSigned, commission: 0, description, sourceId: `vtb-broker-cash:${digest}:${occurrence}` }];
+  });
+  if (!transactions.length) throw new Error('Операции движения денежных средств не найдены');
+  const balanceStart = findRow(rows, 'Отчёт об остатках денежных средств');
+  const openingBalance = kopecks(rows[balanceStart + 3]?.[1].L);
+  const closingBalance = kopecks(rows[balanceStart + 3]?.[1].AF);
+  if (openingBalance + transactions.reduce((sum, tx) => sum + tx.amountSigned, 0) !== closingBalance) throw new Error('Баланс cash-операций не сходится с отчётом');
+  const positions = rows.slice(holdingsStart + 1, movementStart).flatMap(([, cells]) => {
+    const instrument = text(cells.B);
+    if (!instrument || instrument.toLowerCase().startsWith('итого') || !/RU[A-Z0-9]{10}/.test(instrument)) return [];
+    return [{ instrument, isin: instrument.split(', ').find((part) => /^RU[A-Z0-9]{10}$/.test(part)) ?? null, quantity: cells.L || cells.M || cells.I || cells.J, price: cells.P || null, valuation: cells.AF || cells.AJ || null }];
+  });
+  const trades = rows.slice(tradesStart + 1, tradesEnd).flatMap(([number, cells]) => {
+    if (!cells.B || !cells.C || !cells.F) return [];
+    const concludedAt = excelDate(cells.C);
+    if (!concludedAt) return [];
+    const tradeId = text(cells.Z);
+    return [{
+      sourceId: `vtb-broker-trade:${tradeId || number}`,
+      instrument: text(cells.B),
+      isin: text(cells.B).split(', ').find((part) => /^RU[A-Z0-9]{10}$/.test(part)) ?? null,
+      concludedAt,
+      side: text(cells.F),
+      quantity: text(cells.H),
+      priceCurrency: text(cells.I) || null,
+      price: text(cells.J) || null,
+      settlementCurrency: text(cells.L) || null,
+      settlementAmount: text(cells.M) || null,
+      nkd: text(cells.O) || null,
+      settlementCommission: text(cells.P) || null,
+      tradeCommission: text(cells.R) || null,
+      orderId: text(cells.W) || null,
+      tradeId: tradeId || null,
+      venue: text(cells.AK) || null,
+      comment: text(cells.AN) || null,
+    }];
+  });
+  return {
+    cash: { schemaVersion: '1.0', bank: 'VTB_BROKER', statement: { accountNumber: account, currency: 'RUB', openingBalance, closingBalance, exportedAt: reportedAt ?? transactions[transactions.length - 1].operationAt }, transactions },
+    portfolio: { schemaVersion: 'broker-portfolio-1.0', bank: 'VTB_BROKER', accountNumber: account, reportPeriod: { from: isoDate(period[0]), to: isoDate(period[1]) }, reportedAt, positions, trades },
+  };
+}

docs/backlog/api_import.md

@@ -91,7 +91,7 @@
 
 - `statement.currency` соответствует допустимому коду валюты (MVP: `"RUB"`).
 - `operationAt` у всех транзакций — валидная дата (парсится без ошибок).
-- Отсутствуют дубликаты fingerprint внутри одного файла.
+- Повторяющиеся `sourceId` внутри одного файла отклоняются; одинаковые операции без `sourceId` различаются по позиции в массиве `transactions`.
 
 Ответ при ошибке:
 
@@ -120,10 +120,11 @@
 Для каждой транзакции вычисляется SHA-256 от полей, соединённых разделителем `|`:
 
 ```text
-accountNumber|operationAt|amountSigned|commission|normalizedDescription
+accountNumber|operationAt|amountSigned|commission|normalizedDescription[|sourcePosition]
 ```
 
 - `normalizedDescription` — `description` после `trim`.
+- `sourcePosition` — порядковый номер повторяющейся операции в массиве `transactions`; добавляется, только если одинаковые операции без `sourceId` повторяются в одном файле.
 - Суммы подставляются в том виде, в котором пришли в JSON (числовое представление).
 - Разделитель `|` исключает коллизии при склейке полей разной длины.
 

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@family-budget/frontend",
-  "version": "0.10.2",
+  "version": "0.14.0",
   "private": true,
   "type": "module",
   "scripts": {

frontend/src/App.tsx

@@ -5,6 +5,7 @@ import { LoginPage } from './pages/LoginPage';
 import { HistoryPage } from './pages/HistoryPage';
 import { AnalyticsPage } from './pages/AnalyticsPage';
 import { SettingsPage } from './pages/SettingsPage';
+import { PortfolioPage } from './pages/PortfolioPage';
 
 export function App() {
   const { user, loading } = useAuth();
@@ -23,6 +24,7 @@ export function App() {
         <Route path="/" element={<Navigate to="/history" replace />} />
         <Route path="/history" element={<HistoryPage />} />
         <Route path="/analytics" element={<AnalyticsPage />} />
+        <Route path="/portfolio" element={<PortfolioPage />} />
         <Route path="/settings" element={<SettingsPage />} />
         <Route path="*" element={<Navigate to="/history" replace />} />
       </Routes>

frontend/src/api/portfolio.ts

@@ -0,0 +1,20 @@
+import type { ImportBrokerReportResponse, ImportPortfolioResponse, PortfolioFile, PortfolioHistoryResponse, PortfolioOverviewResponse } from '@family-budget/shared';
+import { api } from './client';
+
+export function importPortfolio(data: PortfolioFile): Promise<ImportPortfolioResponse> {
+  return api.post('/api/import/portfolio', data);
+}
+
+export function importBrokerReport(file: File): Promise<ImportBrokerReportResponse> {
+  const formData = new FormData();
+  formData.append('file', file);
+  return api.postFormData('/api/import/broker', formData);
+}
+
+export function getPortfolioOverview(): Promise<PortfolioOverviewResponse> {
+  return api.get('/api/portfolio');
+}
+
+export function getPortfolioHistory(): Promise<PortfolioHistoryResponse> {
+  return api.get('/api/portfolio/history');
+}

frontend/src/api/rules.ts

@@ -1,5 +1,6 @@
 import type {
   CategoryRule,
+  CreateCategoryRuleResponse,
   GetCategoryRulesParams,
   CreateCategoryRuleRequest,
   UpdateCategoryRuleRequest,
@@ -24,8 +25,8 @@ export async function getCategoryRules(
 
 export async function createCategoryRule(
   data: CreateCategoryRuleRequest,
-): Promise<CategoryRule> {
-  return api.post<CategoryRule>('/api/category-rules', data);
+): Promise<CreateCategoryRuleResponse> {
+  return api.post<CreateCategoryRuleResponse>('/api/category-rules', data);
 }
 
 export async function updateCategoryRule(

frontend/src/components/ImportModal.tsx

@@ -1,6 +1,7 @@
 import { useState, useRef } from 'react';
-import type { ImportStatementResponse } from '@family-budget/shared';
+import type { ImportBrokerReportResponse, ImportPortfolioResponse, ImportStatementResponse, PortfolioFile } from '@family-budget/shared';
 import { importStatement } from '../api/import';
+import { importBrokerReport, importPortfolio } from '../api/portfolio';
 import { updateAccount } from '../api/accounts';
 
 interface Props {
@@ -9,7 +10,7 @@ interface Props {
 }
 
 export function ImportModal({ onClose, onDone }: Props) {
-  const [result, setResult] = useState<ImportStatementResponse | null>(null);
+  const [result, setResult] = useState<ImportStatementResponse | ImportPortfolioResponse | ImportBrokerReportResponse | null>(null);
   const [error, setError] = useState('');
   const [loading, setLoading] = useState(false);
   const [alias, setAlias] = useState('');
@@ -26,9 +27,10 @@ export function ImportModal({ onClose, onDone }: Props) {
     const type = file.type;
     const isPdf = type === 'application/pdf' || name.endsWith('.pdf');
     const isJson = type === 'application/json' || name.endsWith('.json');
+    const isXlsx = type === 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' || name.endsWith('.xlsx');
 
-    if (!isPdf && !isJson) {
-      setError('Допустимы только файлы PDF или JSON');
+    if (!isPdf && !isJson && !isXlsx) {
+      setError('Допустимы только файлы PDF, JSON или XLSX');
       return;
     }
 
@@ -37,7 +39,12 @@ export function ImportModal({ onClose, onDone }: Props) {
     setResult(null);
 
     try {
-      const resp = await importStatement(file);
+      const data = isJson ? JSON.parse(await file.text()) : null;
+      const resp = isXlsx
+        ? await importBrokerReport(file)
+        : data?.schemaVersion === 'broker-portfolio-1.0'
+        ? await importPortfolio(data as PortfolioFile)
+        : await importStatement(file);
       setResult(resp);
     } catch (err: unknown) {
       const msg =
@@ -49,7 +56,7 @@ export function ImportModal({ onClose, onDone }: Props) {
   };
 
   const handleSaveAlias = async () => {
-    if (!result || !alias.trim()) return;
+    if (!result || 'reportId' in result || 'cash' in result || !alias.trim()) return;
     try {
       await updateAccount(result.accountId, { alias: alias.trim() });
       setAliasSaved(true);
@@ -58,6 +65,9 @@ export function ImportModal({ onClose, onDone }: Props) {
     }
   };
 
+  const isPortfolioResult = result != null && 'reportId' in result;
+  const isBrokerResult = result != null && 'cash' in result;
+
   return (
     <div
       className="modal"
@@ -79,12 +89,12 @@ export function ImportModal({ onClose, onDone }: Props) {
           {!result && (
             <div className="import-upload">
               <p className="import-upload__description">
-                Выберите файл выписки (PDF или JSON, формат 1.0)
+                Выберите PDF/JSON выписки, JSON портфеля или XLSX-отчёт ВТБ Брокер
               </p>
               <input
                 ref={fileRef}
                 type="file"
-                accept=".pdf,.json,application/pdf,application/json"
+                accept=".pdf,.json,.xlsx,application/pdf,application/json,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
                 onChange={handleFileChange}
                 className="import-upload__input"
               />
@@ -97,33 +107,69 @@ export function ImportModal({ onClose, onDone }: Props) {
           {result && (
             <div className="import-result">
               <div className="import-result__icon" aria-hidden="true">✓</div>
-              <h3 className="import-result__title">Импорт завершён</h3>
+              <h3 className="import-result__title">{isBrokerResult ? 'Импорт брокерского отчёта завершён' : isPortfolioResult ? 'Импорт портфеля завершён' : 'Импорт завершён'}</h3>
               <table className="import-result__stats">
                 <tbody className="import-result__stats-body">
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Счёт</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.accountNumberMasked}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Новый счёт</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.isNewAccount ? 'Да' : 'Нет'}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.imported}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов пропущено</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.duplicatesSkipped}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Всего в файле</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.totalInFile}</td>
-                  </tr>
+                  {isBrokerResult ? <>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано cash-операций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.cash.imported}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов cash-операций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.cash.duplicatesSkipped}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.portfolio.importedTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.portfolio.duplicateTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Позиций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.portfolio.positions}</td>
+                    </tr>
+                  </> : isPortfolioResult ? <>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.importedTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.duplicateTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Позиций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.positions}</td>
+                    </tr>
+                  </> : <>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Счёт</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.accountNumberMasked}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Новый счёт</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.isNewAccount ? 'Да' : 'Нет'}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.imported}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов пропущено</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.duplicatesSkipped}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Всего в файле</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.totalInFile}</td>
+                    </tr>
+                  </>}
                 </tbody>
               </table>
 
-              {result.isNewAccount && !aliasSaved && (
+              {!isPortfolioResult && !isBrokerResult && result.isNewAccount && !aliasSaved && (
                 <div className="import-result__alias">
                   <label className="import-result__alias-label">Алиас для нового счёта</label>
                   <div className="import-result__alias-row">

frontend/src/components/Layout.tsx

@@ -63,6 +63,21 @@ export function Layout({ children }: { children: ReactNode }) {
             Операции
           </NavLink>
 
+          <NavLink
+            to="/portfolio"
+            className={({ isActive }) =>
+              `sidebar__nav-link${isActive ? ' sidebar__nav-link--active' : ''}`
+            }
+            onClick={closeDrawer}
+          >
+            <svg className="sidebar__nav-icon" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round">
+              <path d="M3 21h18" />
+              <path d="M5 21V10l7-5 7 5v11" />
+              <path d="M9 21v-6h6v6" />
+            </svg>
+            Портфель
+          </NavLink>
+
           <NavLink
             to="/analytics"
             className={({ isActive }) =>

frontend/src/components/SummaryCards.tsx

@@ -41,6 +41,7 @@ export function SummaryCards({ summary }: Props) {
         <div className="summary__subvalue">Поступило: {formatAmount(summary.cashInflow)}</div>
         <div className="summary__subvalue">Списано: {formatAmount(summary.cashOutflow)}</div>
         <div className="summary__subvalue">Доход от процентов: {formatAmount(summary.interestIncome)}</div>
+        <div className="summary__subvalue">Кэшбек: {formatAmount(summary.cashbackIncome)}</div>
         {(summary.transferInflow > 0 || summary.transferOutflow > 0) && (
           <div className="summary__subvalue">
             Переводы: {formatAmount(summary.transferInflow)} / {formatAmount(summary.transferOutflow)}

frontend/src/pages/AnalyticsPage.tsx

@@ -1,12 +1,14 @@
 import { useState, useEffect, useCallback } from 'react';
 import type {
   Account,
+  Category,
   AnalyticsSummaryResponse,
   ByCategoryItem,
   TimeseriesItem,
   Granularity,
 } from '@family-budget/shared';
 import { getAccounts } from '../api/accounts';
+import { getCategories } from '../api/categories';
 import { getSummary, getByCategory, getTimeseries } from '../api/analytics';
 import {
   PeriodSelector,
@@ -29,8 +31,10 @@ function getDefaultPeriod(): PeriodState {
 export function AnalyticsPage() {
   const [period, setPeriod] = useState<PeriodState>(getDefaultPeriod);
   const [accountId, setAccountId] = useState<string>('');
+  const [categoryId, setCategoryId] = useState<string>('');
   const [onlyConfirmed, setOnlyConfirmed] = useState(false);
   const [accounts, setAccounts] = useState<Account[]>([]);
+  const [categories, setCategories] = useState<Category[]>([]);
   const [summary, setSummary] = useState<AnalyticsSummaryResponse | null>(
     null,
   );
@@ -40,6 +44,7 @@ export function AnalyticsPage() {
 
   useEffect(() => {
     getAccounts().then(setAccounts).catch(() => {});
+    getCategories({ isActive: true }).then(setCategories).catch(() => {});
   }, []);
 
   const fetchAll = useCallback(async () => {
@@ -63,6 +68,7 @@ export function AnalyticsPage() {
       from: period.from,
       to: period.to,
       ...(accountId ? { accountId: Number(accountId) } : {}),
+      ...(categoryId !== '' ? { categoryId: Number(categoryId) } : {}),
       ...(onlyConfirmed ? { onlyConfirmed: true } : {}),
     };
 
@@ -80,7 +86,7 @@ export function AnalyticsPage() {
     } finally {
       setLoading(false);
     }
-  }, [period, accountId, onlyConfirmed]);
+  }, [period, accountId, categoryId, onlyConfirmed]);
 
   useEffect(() => {
     fetchAll();
@@ -122,6 +128,14 @@ export function AnalyticsPage() {
               Только подтверждённые
             </label>
           </div>
+          <div className="field">
+            <label className="field__label">Категория</label>
+            <select value={categoryId} onChange={(e) => setCategoryId(e.target.value)}>
+              <option value="">Все категории</option>
+              <option value="0">Без категории</option>
+              {categories.map((c) => <option key={c.id} value={c.id}>{c.name}</option>)}
+            </select>
+          </div>
         </div>
       </div>
 

frontend/src/pages/PortfolioPage.tsx

@@ -0,0 +1,80 @@
+import { useEffect, useState } from 'react';
+import { LineChart, Line, XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContainer } from 'recharts';
+import type { PortfolioHistoryResponse, PortfolioOverviewResponse } from '@family-budget/shared';
+import { getPortfolioHistory, getPortfolioOverview } from '../api/portfolio';
+import { formatDate } from '../utils/format';
+
+const money = new Intl.NumberFormat('ru-RU', { style: 'currency', currency: 'RUB', minimumFractionDigits: 2 });
+const number = new Intl.NumberFormat('ru-RU', { maximumFractionDigits: 6 });
+
+export function PortfolioPage() {
+  const [data, setData] = useState<PortfolioOverviewResponse | null>(null);
+  const [history, setHistory] = useState<PortfolioHistoryResponse | null>(null);
+
+  useEffect(() => {
+    getPortfolioOverview().then(setData).catch(() => {});
+    getPortfolioHistory().then(setHistory).catch(() => {});
+  }, []);
+
+  return (
+    <div className="page">
+      <div className="page__header">
+        <div>
+          <p className="page__eyebrow">Инвестиции</p>
+          <h1 className="page__title">Портфель</h1>
+        </div>
+      </div>
+
+      {!data ? <div className="state">Загрузка...</div> : data.accounts.length === 0 ? (
+        <div className="state state--empty">Портфель пока пуст. Загрузите XLSX-отчёт брокера в разделе «Операции».</div>
+      ) : data.accounts.map((account) => (
+        <section className="portfolio" key={account.accountId} aria-labelledby={`portfolio-${account.accountId}`}>
+          <div className="portfolio__header">
+            <div>
+              <h2 id={`portfolio-${account.accountId}`} className="portfolio__title">{account.accountName}</h2>
+              <p className="portfolio__meta">Состояние на {formatDate(account.reportPeriodTo)}</p>
+            </div>
+            {account.totalValuation !== null && <strong className="portfolio__total">{money.format(Number(account.totalValuation))}</strong>}
+          </div>
+          {account.positions.length === 0 ? <div className="state state--empty">В последнем отчёте нет открытых позиций.</div> : (
+            <div className="table-shell">
+              <table className="data-table">
+                <thead><tr><th className="data-table__head-cell" scope="col">Инструмент</th><th className="data-table__head-cell" scope="col">Количество</th><th className="data-table__head-cell" scope="col">Цена</th><th className="data-table__head-cell" scope="col">Стоимость</th></tr></thead>
+                <tbody className="data-table__body">
+                  {account.positions.map((position, index) => <tr className="data-table__row" key={`${position.isin ?? position.instrument}-${index}`}>
+                    <td className="data-table__cell"><div className="data-table__description">{position.instrument}</div>{position.isin && <div className="data-table__subtext">{position.isin}</div>}</td>
+                    <td className="data-table__cell data-table__cell--nowrap">{number.format(Number(position.quantity))}</td>
+                    <td className="data-table__cell data-table__cell--nowrap">{position.price === null ? '—' : money.format(Number(position.price))}</td>
+                    <td className="data-table__cell data-table__cell--nowrap money-amount">{position.valuation === null ? '—' : money.format(Number(position.valuation))}</td>
+                  </tr>)}
+                </tbody>
+              </table>
+            </div>
+          )}
+        </section>
+      ))}
+
+      {history?.accounts.map((account) => account.points.length > 1 && (
+        <section className="portfolio" key={`history-${account.accountId}`} aria-labelledby={`history-${account.accountId}`}>
+          <div className="portfolio__header">
+            <div>
+              <h2 id={`history-${account.accountId}`} className="portfolio__title">Динамика · {account.accountName}</h2>
+              <p className="portfolio__meta">Стоимость по загруженным отчётам</p>
+            </div>
+          </div>
+          <div className="chart-card portfolio__chart">
+            <ResponsiveContainer width="100%" height={280}>
+              <LineChart data={account.points.map((point) => ({ date: point.reportPeriodTo, value: point.totalValuation === null ? null : Number(point.totalValuation) }))}>
+                <CartesianGrid strokeDasharray="3 3" stroke="var(--color-border)" vertical={false} />
+                <XAxis dataKey="date" tickFormatter={(value: string) => formatDate(value)} fontSize={12} stroke="var(--color-text-secondary)" tickLine={false} axisLine={false} />
+                <YAxis tickFormatter={(value: number) => `${Math.round(value / 1000)}к`} fontSize={12} stroke="var(--color-text-secondary)" tickLine={false} axisLine={false} />
+                <Tooltip labelFormatter={(value) => formatDate(String(value))} formatter={(value) => value == null ? '—' : money.format(Number(value))} />
+                <Line type="monotone" dataKey="value" name="Стоимость" stroke="var(--color-primary)" strokeWidth={2} dot={{ r: 3 }} connectNulls />
+              </LineChart>
+            </ResponsiveContainer>
+          </div>
+        </section>
+      ))}
+    </div>
+  );
+}

frontend/src/styles/index.css

@@ -341,6 +341,38 @@ button {
   color: var(--color-text-muted);
 }
 
+.portfolio {
+  margin-bottom: 20px;
+}
+
+.portfolio__header {
+  display: flex;
+  align-items: flex-end;
+  justify-content: space-between;
+  gap: 16px;
+  margin-bottom: 12px;
+}
+
+.portfolio__title {
+  font-size: 18px;
+  font-weight: 850;
+}
+
+.portfolio__meta {
+  margin-top: 3px;
+  color: var(--color-text-secondary);
+}
+
+.portfolio__total {
+  font-size: 20px;
+  font-variant-numeric: tabular-nums;
+}
+
+.portfolio__chart {
+  min-height: 280px;
+  padding: 16px;
+}
+
 /* ================================================================
    Forms, buttons, badges
    ================================================================ */
@@ -1462,6 +1494,11 @@ input[type="checkbox"] {
     width: 100%;
   }
 
+  .portfolio__header {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
   .filters__row,
   .analytics-panel__filters {
     align-items: stretch;

shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@family-budget/shared",
-  "version": "0.3.0",
+  "version": "0.8.0",
   "private": true,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

shared/src/types/analytics.ts

@@ -4,6 +4,7 @@ export interface AnalyticsSummaryParams {
   from: string;
   to: string;
   accountId?: number;
+  categoryId?: number;
   onlyConfirmed?: boolean;
 }
 
@@ -24,6 +25,7 @@ export interface AnalyticsSummaryResponse {
   transferOutflow: number;
   cashNet: number;
   interestIncome: number;
+  cashbackIncome: number;
   topCategories: TopCategory[];
 }
 
@@ -31,6 +33,7 @@ export interface ByCategoryParams {
   from: string;
   to: string;
   accountId?: number;
+  categoryId?: number;
   onlyConfirmed?: boolean;
 }
 

shared/src/types/category-rule.ts

@@ -26,6 +26,10 @@ export interface CreateCategoryRuleRequest {
   requiresConfirmation?: boolean;
 }
 
+export interface CreateCategoryRuleResponse extends CategoryRule {
+  applied: number;
+}
+
 export interface UpdateCategoryRuleRequest {
   pattern?: string;
   categoryId?: number;

shared/src/types/import.ts

@@ -46,3 +46,90 @@ export interface ImportStatementResponse {
   duplicatesSkipped: number;
   totalInFile: number;
 }
+
+export interface PortfolioFile {
+  schemaVersion: 'broker-portfolio-1.0';
+  bank: string;
+  accountNumber: string;
+  reportPeriod: { from: string; to: string };
+  reportedAt: string | null;
+  positions: PortfolioPosition[];
+  trades: PortfolioTrade[];
+}
+
+export interface PortfolioPosition {
+  instrument: string;
+  isin?: string | null;
+  quantity: string | number;
+  price?: string | number | null;
+  valuation?: string | number | null;
+}
+
+export interface PortfolioTrade {
+  sourceId?: string;
+  operationId?: string;
+  instrument: string;
+  isin?: string | null;
+  concludedAt: string;
+  side: string;
+  quantity: string | number;
+  priceCurrency?: string | null;
+  price?: string | number | null;
+  settlementCurrency?: string | null;
+  settlementAmount?: string | number | null;
+  nkd?: string | number | null;
+  settlementCommission?: string | number | null;
+  tradeCommission?: string | number | null;
+  orderId?: string | null;
+  tradeId?: string | null;
+  venue?: string | null;
+  comment?: string | null;
+}
+
+export interface ImportPortfolioResponse {
+  accountId: number;
+  reportId: number;
+  importedTrades: number;
+  duplicateTrades: number;
+  positions: number;
+}
+
+export interface ImportBrokerReportResponse {
+  cash: ImportStatementResponse;
+  portfolio: ImportPortfolioResponse;
+}
+
+export interface PortfolioOverviewPosition {
+  instrument: string;
+  isin: string | null;
+  quantity: string;
+  price: string | null;
+  valuation: string | null;
+}
+
+export interface PortfolioOverviewAccount {
+  accountId: number;
+  accountName: string;
+  reportPeriodTo: string;
+  totalValuation: string | null;
+  positions: PortfolioOverviewPosition[];
+}
+
+export interface PortfolioOverviewResponse {
+  accounts: PortfolioOverviewAccount[];
+}
+
+export interface PortfolioHistoryPoint {
+  reportPeriodTo: string;
+  totalValuation: string | null;
+}
+
+export interface PortfolioHistoryAccount {
+  accountId: number;
+  accountName: string;
+  points: PortfolioHistoryPoint[];
+}
+
+export interface PortfolioHistoryResponse {
+  accounts: PortfolioHistoryAccount[];
+}

shared/src/types/index.ts

@@ -24,6 +24,7 @@ export type {
 
 export type {
   CategoryRule,
+  CreateCategoryRuleResponse,
   GetCategoryRulesParams,
   CreateCategoryRuleRequest,
   UpdateCategoryRuleRequest,
@@ -38,6 +39,17 @@ export type {
   StatementTransaction,
   ImportStatementResponse,
   Import,
+  PortfolioFile,
+  PortfolioPosition,
+  PortfolioTrade,
+  ImportPortfolioResponse,
+  ImportBrokerReportResponse,
+  PortfolioOverviewPosition,
+  PortfolioOverviewAccount,
+  PortfolioOverviewResponse,
+  PortfolioHistoryPoint,
+  PortfolioHistoryAccount,
+  PortfolioHistoryResponse,
 } from './import';
 
 export type {