fix: limit broker XLSX extraction

Reviewed-on: #45

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.gitignore
+**/.env
+**/.env.*
+**/node_modules
+**/dist
+**/__pycache__
+temp
+*.log

CHANGELOG.md

@@ -1,5 +1,168 @@
 # Changelog
 
+## [Frontend 0.12.0 / Backend 0.11.0 / Shared 0.6.0] - 2026-08-26
+
+### Added
+
+- Import VTB Broker XLSX reports with cash movements, trades, and positions in one operation.
+
+## [Frontend 0.11.3] - 2026-08-26
+
+### Added
+
+- Import broker portfolio JSON files and show their trade and position results.
+
+## [Frontend 0.11.2 / Backend 0.10.5 / Shared 0.5.1] - 2026-08-26
+
+### Added
+
+- Show cashback separately in the cash-flow summary alongside interest income.
+
+## [Backend 0.10.3] - 2026-08-24
+
+### Fixed
+
+- Treat VTB savings-account deposits and closures as internal transfers when importing PDF-to-JSON statements.
+
+## [Backend 0.10.2] - 2026-08-24
+
+### Fixed
+
+- Analytics endpoints now reject invalid account and category filter IDs with a validation error.
+
+## [Frontend 0.11.1] - 2026-08-21
+
+### Fixed
+
+- Preserve the explicit «Без категории» analytics filter value when requesting data.
+
+## [Frontend 0.11.0 / Backend 0.10.1 / Shared 0.5.0] - 2026-08-21
+
+### Fixed
+
+- Corrected analytics period boundaries for partial week/month ranges and added a usable «Без категории» filter with SQL coverage.
+
+## [Backend 0.9.2] - 2026-08-20
+
+### Added
+
+- Extended import integration coverage to verify source positions for same-date operations.
+
+## [Backend 0.9.1] - 2026-08-20
+
+### Added
+
+- Added runnable coverage for date and amount sorting tie-breakers.
+
+## [Backend 0.9.0] - 2026-08-20
+
+### Added
+
+- Preserved source-array transaction positions and used them as stable tie-breakers for same-date history sorting.
+
+## [Backend 0.8.3] - 2026-08-20
+
+### Fixed
+
+- Invalid non-string trade identifiers now return validation errors instead of server errors.
+
+## [Backend 0.8.2] - 2026-08-20
+
+### Added
+
+- Added a database integration test for repeated portfolio imports and trade deduplication.
+
+## [Backend 0.8.1] - 2026-08-20
+
+### Fixed
+
+- Hardened portfolio import validation, preserved decimal precision, added fallback trade keys, and covered validation with a runnable test.
+
+## [Backend 0.8.0 / Shared 0.4.0] - 2026-08-20
+
+### Added
+
+- Added portfolio JSON import for broker reports with idempotent trades, position snapshots, and separate portfolio tables.
+
+## [Backend 0.7.5 / Shared 0.3.1] - 2026-08-20
+
+### Added
+
+- Creating a category rule now applies it atomically to all matching unconfirmed transactions and returns the affected count.
+
+## [Backend 0.7.4] - 2026-08-20
+
+### Fixed
+
+- Corrected database integration test connection ownership during repeated imports.
+
+## [Backend 0.7.3] - 2026-08-20
+
+### Added
+
+- Added a runnable database integration test for preserving account metadata during re-import.
+
+## [Frontend 0.10.2 / Backend 0.7.2] - 2026-08-20
+
+### Fixed
+
+- Existing uncategorized operations become confirmed investments when an investment account is labeled; account selectors use Russian labels.
+
+## [Frontend 0.10.1 / Backend 0.7.1] - 2026-08-20
+
+### Fixed
+
+- Account labels are shown in analytics filters, and account defaults now remain overridable by matching category rules.
+
+## [Frontend 0.10.0 / Backend 0.7.0 / Shared 0.3.0] - 2026-08-20
+
+### Added
+
+- Added account type/status labels, automatic investment classification for brokerage, IIS, and savings accounts, and a separate interest-income metric.
+
+## [Frontend 0.9.3] - 2026-08-20
+
+### Fixed
+
+- Aligned sidebar versions and copyright as separate footer lines and updated the copyright period.
+
+## [Backend 0.6.8] - 2026-08-20
+
+### Fixed
+
+- Docker build context now excludes environment files and other local secret-bearing artifacts.
+
+## [Backend 0.6.7] - 2026-08-20
+
+### Changed
+
+- Docker Compose now injects backend configuration from the untracked `backend/.env`; secrets are no longer hard-coded or copied into the image.
+
+## [Backend 0.6.6] - 2026-08-19
+
+### Fixed
+
+- Re-importing an existing operation UUID now safely skips the row even if other source fields changed.
+
+## [Backend 0.6.5] - 2026-08-19
+
+### Fixed
+
+- Duplicate operation UUIDs in one import file now return a validation error instead of a database failure.
+
+## [Frontend 0.9.2 / Backend 0.6.4 / Shared 0.2.2] - 2026-08-19
+
+### Added
+
+- Added deterministic UUIDs for imported operations and a unique database constraint per account.
+
+## [Frontend 0.9.1 / Backend 0.6.3 / Shared 0.2.1] - 2026-08-19
+
+### Added
+
+- Added a standard-library VTB broker XLSX converter for cash movements and a portfolio/trades sidecar JSON.
+- Added optional source operation IDs so repeated statement imports remain idempotent without collapsing legitimate identical operations.
+
 ## [Frontend 0.9.0 / Backend 0.6.2] - 2026-08-19
 
 ### Changed

Dockerfile.backend

@@ -31,7 +31,6 @@ COPY --from=build /app/backend/dist ./dist
 COPY --from=build /app/backend/package.json ./package.json
 COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/backend/node_modules/ ./node_modules/
-COPY backend/.env .env
 
 EXPOSE 3000
 CMD ["node","dist/app.js"]

backend/README.md

@@ -21,6 +21,8 @@ createdb family_budget
 npm run dev -w backend
 ```
 
+Для Docker Compose production-переменные передаются из `backend/.env`. Файл не хранится в Git и не копируется в Docker image; перед запуском создайте его из `.env.example` и заполните секреты.
+
 Сервер стартует на `http://localhost:3000` (или на порту из `PORT`).
 
 ## Скрипты

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@family-budget/backend",
-  "version": "0.6.2",
+  "version": "0.11.0",
   "private": true,
   "scripts": {
     "dev": "tsx watch src/app.ts",
@@ -9,7 +9,14 @@
     "migrate": "tsx src/db/migrate.ts",
     "migrate:prod": "node dist/db/migrate.js",
     "test:analytics": "tsx src/services/analyticsSemantics.test.ts",
+    "test:analytics:query": "tsx src/routes/analytics.test.ts",
+    "test:portfolio": "tsx src/services/portfolio.test.ts",
+    "test:portfolio:db": "NODE_ENV=test tsx src/services/portfolio.integration.test.ts",
+    "test:transactions": "tsx src/services/transactions.test.ts",
     "test:analytics:db": "NODE_ENV=test tsx src/services/analytics.integration.test.ts",
+    "test:import:db": "NODE_ENV=test tsx src/services/import.integration.test.ts",
+    "test:import:direction": "tsx src/services/import.test.ts",
+    "test:broker:xlsx": "tsx src/services/vtbBrokerXlsx.test.ts",
     "test:llm": "tsx src/scripts/testLlm.ts"
   },
   "dependencies": {

backend/src/app.ts

@@ -19,6 +19,7 @@ import accountsRouter from './routes/accounts';
 import categoriesRouter from './routes/categories';
 import categoryRulesRouter from './routes/categoryRules';
 import analyticsRouter from './routes/analytics';
+import portfolioRouter from './routes/portfolio';
 
 const app = express();
 app.set('trust proxy', 1);
@@ -43,6 +44,7 @@ app.use('/api/accounts', accountsRouter);
 app.use('/api/categories', categoriesRouter);
 app.use('/api/category-rules', categoryRulesRouter);
 app.use('/api/analytics', analyticsRouter);
+app.use('/api/import/portfolio', portfolioRouter);
 
 app.use(
   (

backend/src/db/migrate.ts

@@ -133,6 +133,16 @@ const migrations: { name: string; sql: string }[] = [
         AND NOT EXISTS (SELECT 1 FROM category_rules LIMIT 1);
     `,
   },
+  {
+    name: '006_transaction_operation_uuid',
+    sql: `
+      CREATE EXTENSION IF NOT EXISTS pgcrypto;
+      ALTER TABLE transactions
+        ADD COLUMN IF NOT EXISTS operation_id UUID NOT NULL DEFAULT gen_random_uuid();
+      CREATE UNIQUE INDEX IF NOT EXISTS ux_transactions_account_operation_id
+        ON transactions(account_id, operation_id);
+    `,
+  },
   {
     name: '005_imports_table',
     sql: `
@@ -212,6 +222,80 @@ const migrations: { name: string; sql: string }[] = [
         ADD COLUMN IF NOT EXISTS import_id BIGINT REFERENCES imports(id);
     `,
   },
+  {
+    name: '007_account_metadata',
+    sql: `
+      ALTER TABLE accounts
+        ADD COLUMN IF NOT EXISTS account_type TEXT,
+        ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'active';
+      ALTER TABLE accounts DROP CONSTRAINT IF EXISTS chk_accounts_type;
+      ALTER TABLE accounts
+        ADD CONSTRAINT chk_accounts_type
+        CHECK (account_type IS NULL OR account_type IN ('brokerage', 'iis', 'savings', 'current'));
+      ALTER TABLE accounts DROP CONSTRAINT IF EXISTS chk_accounts_status;
+      ALTER TABLE accounts
+        ADD CONSTRAINT chk_accounts_status
+        CHECK (status IN ('active', 'closed'));
+    `,
+  },
+  {
+    name: '008_portfolio_tables',
+    sql: `
+      CREATE TABLE IF NOT EXISTS portfolio_reports (
+        id BIGSERIAL PRIMARY KEY,
+        account_id BIGINT NOT NULL REFERENCES accounts(id),
+        source_hash TEXT NOT NULL,
+        report_period_from DATE NOT NULL,
+        report_period_to DATE NOT NULL,
+        reported_at TIMESTAMPTZ,
+        imported_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE (account_id, source_hash)
+      );
+      CREATE TABLE IF NOT EXISTS portfolio_positions (
+        id BIGSERIAL PRIMARY KEY,
+        report_id BIGINT NOT NULL REFERENCES portfolio_reports(id) ON DELETE CASCADE,
+        instrument TEXT NOT NULL,
+        isin TEXT,
+        quantity NUMERIC NOT NULL,
+        price NUMERIC,
+        valuation NUMERIC
+      );
+      CREATE TABLE IF NOT EXISTS portfolio_trades (
+        id BIGSERIAL PRIMARY KEY,
+        account_id BIGINT NOT NULL REFERENCES accounts(id),
+        source_id TEXT NOT NULL,
+        operation_id UUID NOT NULL,
+        instrument TEXT NOT NULL,
+        isin TEXT,
+        concluded_at TIMESTAMPTZ NOT NULL,
+        side TEXT NOT NULL,
+        quantity NUMERIC NOT NULL,
+        price_currency TEXT,
+        price NUMERIC,
+        settlement_currency TEXT,
+        settlement_amount NUMERIC,
+        nkd NUMERIC,
+        settlement_commission NUMERIC,
+        trade_commission NUMERIC,
+        order_id TEXT,
+        trade_id TEXT,
+        venue TEXT,
+        comment TEXT,
+        UNIQUE (account_id, source_id)
+      );
+      CREATE INDEX IF NOT EXISTS ix_portfolio_trades_account_date
+        ON portfolio_trades(account_id, concluded_at DESC);
+    `,
+  },
+  {
+    name: '009_transaction_source_position',
+    sql: `
+      ALTER TABLE transactions ADD COLUMN IF NOT EXISTS source_position BIGINT NOT NULL DEFAULT 0;
+      UPDATE transactions SET source_position = id WHERE source_position = 0;
+      CREATE INDEX IF NOT EXISTS ix_transactions_date_position
+        ON transactions(operation_at, source_position, id);
+    `,
+  },
 ];
 
 export async function runMigrations(): Promise<void> {

backend/src/routes/accounts.ts

@@ -21,7 +21,7 @@ router.put(
       return;
     }
 
-    const { alias } = req.body;
+    const { alias, accountType, status } = req.body;
     if (typeof alias !== 'string' || !alias.trim()) {
       res.status(400).json({ error: 'BAD_REQUEST', message: 'alias is required and must be non-empty' });
       return;
@@ -30,8 +30,21 @@ router.put(
       res.status(400).json({ error: 'BAD_REQUEST', message: 'alias must be at most 50 characters' });
       return;
     }
+    if (accountType !== undefined && accountType !== null && !['brokerage', 'iis', 'savings', 'current'].includes(accountType)) {
+      res.status(400).json({ error: 'BAD_REQUEST', message: 'Invalid accountType' });
+      return;
+    }
+    if (status !== undefined && !['active', 'closed'].includes(status)) {
+      res.status(400).json({ error: 'BAD_REQUEST', message: 'Invalid status' });
+      return;
+    }
 
-    const result = await accountService.updateAccountAlias(id, alias.trim());
+    const result = await accountService.updateAccount(
+      id,
+      alias.trim(),
+      accountType,
+      status,
+    );
     if (!result) {
       res.status(404).json({ error: 'NOT_FOUND', message: 'Account not found' });
       return;

backend/src/routes/analytics.test.ts

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import { parseOptionalId } from './analytics';
+
+assert.equal(parseOptionalId(undefined, 0), undefined);
+assert.equal(parseOptionalId('0', 0), 0);
+assert.equal(parseOptionalId('1', 1), 1);
+assert.equal(parseOptionalId('0', 1), null);
+assert.equal(parseOptionalId('abc', 0), null);
+assert.equal(parseOptionalId('1.5', 0), null);
+assert.equal(parseOptionalId(['1'], 0), null);
+
+console.log('analytics query validation: OK');

backend/src/routes/analytics.ts

@@ -5,10 +5,34 @@ import type { Granularity } from '@family-budget/shared';
 
 const router = Router();
 
+export function parseOptionalId(value: unknown, minimum: number): number | null | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'string' || !/^\d+$/.test(value)) return null;
+
+  const id = Number(value);
+  return Number.isSafeInteger(id) && id >= minimum ? id : null;
+}
+
+router.use((req, res, next) => {
+  const accountId = parseOptionalId(req.query.accountId, 1);
+  if (accountId === null) {
+    res.status(400).json({ error: 'BAD_REQUEST', message: 'accountId must be a positive integer' });
+    return;
+  }
+
+  const categoryId = parseOptionalId(req.query.categoryId, 0);
+  if (categoryId === null) {
+    res.status(400).json({ error: 'BAD_REQUEST', message: 'categoryId must be a non-negative integer' });
+    return;
+  }
+
+  next();
+});
+
 router.get(
   '/summary',
   asyncHandler(async (req, res) => {
-    const { from, to, accountId, onlyConfirmed } = req.query;
+    const { from, to, accountId, categoryId, onlyConfirmed } = req.query;
     if (!from || !to) {
       res.status(400).json({ error: 'BAD_REQUEST', message: 'from and to are required' });
       return;
@@ -18,6 +42,7 @@ router.get(
       from: from as string,
       to: to as string,
       accountId: accountId ? Number(accountId) : undefined,
+      categoryId: categoryId !== undefined ? Number(categoryId) : undefined,
       onlyConfirmed: onlyConfirmed === 'true',
     });
     res.json(result);
@@ -27,7 +52,7 @@ router.get(
 router.get(
   '/by-category',
   asyncHandler(async (req, res) => {
-    const { from, to, accountId, onlyConfirmed } = req.query;
+    const { from, to, accountId, categoryId, onlyConfirmed } = req.query;
     if (!from || !to) {
       res.status(400).json({ error: 'BAD_REQUEST', message: 'from and to are required' });
       return;
@@ -37,6 +62,7 @@ router.get(
       from: from as string,
       to: to as string,
       accountId: accountId ? Number(accountId) : undefined,
+      categoryId: categoryId !== undefined ? Number(categoryId) : undefined,
       onlyConfirmed: onlyConfirmed === 'true',
     });
     res.json(result);
@@ -62,7 +88,7 @@ router.get(
       from: from as string,
       to: to as string,
       accountId: accountId ? Number(accountId) : undefined,
-      categoryId: categoryId ? Number(categoryId) : undefined,
+      categoryId: categoryId !== undefined ? Number(categoryId) : undefined,
       onlyConfirmed: onlyConfirmed === 'true',
       granularity: granularity as Granularity,
     });

backend/src/routes/import.ts

@@ -1,11 +1,14 @@
 import { Router } from 'express';
 import multer from 'multer';
+import { pool } from '../db/pool';
 import { asyncHandler } from '../utils';
 import { importStatement, isValidationError } from '../services/import';
 import {
   convertPdfToStatement,
   isPdfConversionError,
 } from '../services/pdfToStatement';
+import { importPortfolio } from '../services/portfolio';
+import { convertVtbBrokerXlsx } from '../services/vtbBrokerXlsx';
 
 const upload = multer({
   storage: multer.memoryStorage(),
@@ -28,6 +31,10 @@ function isJsonFile(file: { mimetype: string; originalname: string }): boolean {
   );
 }
 
+function isXlsxFile(file: { mimetype: string; originalname: string }): boolean {
+  return file.mimetype === 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' || file.originalname.toLowerCase().endsWith('.xlsx');
+}
+
 const router = Router();
 
 router.post(
@@ -87,4 +94,41 @@ router.post(
   }),
 );
 
+router.post(
+  '/broker',
+  upload.single('file'),
+  asyncHandler(async (req, res) => {
+    const file = req.file;
+    if (!file || !isXlsxFile(file)) {
+      res.status(400).json({ error: 'BAD_REQUEST', message: 'Допустим только XLSX-отчёт ВТБ Брокер' });
+      return;
+    }
+    let converted;
+    try {
+      converted = convertVtbBrokerXlsx(file.buffer);
+    } catch (error) {
+      res.status(422).json({ error: 'VALIDATION_ERROR', message: error instanceof Error ? error.message : 'Не удалось обработать XLSX-отчёт' });
+      return;
+    }
+    const client = await pool.connect();
+    try {
+      await client.query('BEGIN');
+      const portfolio = await importPortfolio(converted.portfolio, pool, client);
+      const cash = await importStatement(converted.cash, pool, client);
+      if (isValidationError(cash)) {
+        await client.query('ROLLBACK');
+        res.status(cash.status).json({ error: cash.error, message: cash.message });
+        return;
+      }
+      await client.query('COMMIT');
+      res.json({ portfolio, cash });
+    } catch (error) {
+      await client.query('ROLLBACK');
+      throw error;
+    } finally {
+      client.release();
+    }
+  }),
+);
+
 export default router;

backend/src/routes/portfolio.ts

@@ -0,0 +1,22 @@
+import { Router } from 'express';
+import { asyncHandler } from '../utils';
+import * as portfolioService from '../services/portfolio';
+
+const router = Router();
+
+router.post(
+  '/',
+  asyncHandler(async (req, res) => {
+    try {
+      res.status(201).json(await portfolioService.importPortfolio(req.body));
+    } catch (error) {
+      if (error instanceof Error && /Invalid|Duplicate|must be|required|numeric/.test(error.message)) {
+        res.status(422).json({ error: 'VALIDATION_ERROR', message: error.message });
+        return;
+      }
+      throw error;
+    }
+  }),
+);
+
+export default router;

backend/src/services/accounts.ts

@@ -1,6 +1,6 @@
 import { pool } from '../db/pool';
 import { maskAccountNumber } from '../utils';
-import type { Account } from '@family-budget/shared';
+import type { Account, AccountStatus, AccountType } from '@family-budget/shared';
 
 function toAccount(r: Record<string, unknown>): Account {
   return {
@@ -9,6 +9,8 @@ function toAccount(r: Record<string, unknown>): Account {
     accountNumberMasked: maskAccountNumber(r.account_number as string),
     currency: r.currency as string,
     alias: (r.alias as string) ?? null,
+    accountType: (r.account_type as AccountType) ?? null,
+    status: (r.status as AccountStatus) ?? 'active',
   };
 }
 
@@ -19,14 +21,45 @@ export async function getAccounts(): Promise<Account[]> {
   return rows.map(toAccount);
 }
 
-export async function updateAccountAlias(
+export async function updateAccount(
   id: number,
   alias: string,
+  accountType?: AccountType | null,
+  status?: AccountStatus,
 ): Promise<Account | null> {
-  const { rows } = await pool.query(
-    'UPDATE accounts SET alias = $1 WHERE id = $2 RETURNING *',
-    [alias, id],
-  );
-  if (rows.length === 0) return null;
-  return toAccount(rows[0]);
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const current = await client.query('SELECT account_type, status FROM accounts WHERE id = $1', [id]);
+    if (current.rows.length === 0) {
+      await client.query('ROLLBACK');
+      return null;
+    }
+    const nextType = accountType === undefined ? current.rows[0].account_type : accountType;
+    const nextStatus = status ?? current.rows[0].status ?? 'active';
+    const { rows } = await client.query(
+      'UPDATE accounts SET alias = $1, account_type = $2, status = $3 WHERE id = $4 RETURNING *',
+      [alias, nextType, nextStatus, id],
+    );
+    if (rows.length === 0) {
+      await client.query('ROLLBACK');
+      return null;
+    }
+    if (['brokerage', 'iis', 'savings'].includes(nextType ?? '')) {
+      await client.query(
+        `UPDATE transactions
+         SET category_id = (SELECT id FROM categories WHERE name = 'Инвестиции' AND type = 'transfer' LIMIT 1),
+             direction = 'transfer', is_category_confirmed = TRUE, updated_at = NOW()
+         WHERE account_id = $1 AND category_id IS NULL`,
+        [id],
+      );
+    }
+    await client.query('COMMIT');
+    return toAccount(rows[0]);
+  } catch (error) {
+    await client.query('ROLLBACK');
+    throw error;
+  } finally {
+    client.release();
+  }
 }

backend/src/services/analytics.integration.test.ts

@@ -6,7 +6,7 @@ async function testQueries(): Promise<void> {
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
-    const account = await client.query("INSERT INTO accounts (bank, account_number, currency) VALUES ('TEST', 'analytics-test-1', 'RUB') RETURNING id");
+    const account = await client.query("INSERT INTO accounts (bank, account_number, currency, account_type) VALUES ('TEST', 'analytics-test-1', 'RUB', 'savings') RETURNING id");
     const otherAccount = await client.query("INSERT INTO accounts (bank, account_number, currency) VALUES ('TEST', 'analytics-test-2', 'RUB') RETURNING id");
     const categories = await client.query("INSERT INTO categories (name, type) VALUES ('Тест расход', 'expense'), ('Тест доход', 'income'), ('Тест перевод', 'transfer') RETURNING id, type");
     const accountId = Number(account.rows[0].id);
@@ -22,17 +22,43 @@ async function testQueries(): Promise<void> {
     await insert(accountId, '2026-07-03T12:00:00+03:00', 20_000, categoryId.income, 'analytics-test-3');
     await insert(accountId, '2026-07-04T12:00:00+03:00', -5_000, categoryId.income, 'analytics-test-4');
     await insert(accountId, '2026-07-05T12:00:00+03:00', -3_000, categoryId.transfer, 'analytics-test-5');
+    await client.query(
+      "INSERT INTO transactions (account_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed) VALUES ($1, '2026-07-06T12:00:00+03:00', 1_500, 0, 'Начисление процентов', 'transfer', 'analytics-test-interest', $2, TRUE)",
+      [accountId, categoryId.transfer],
+    );
+    await client.query(
+      "INSERT INTO transactions (account_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed) VALUES ($1, '2026-07-06T12:00:00+03:00', 0, 200, 'Зачисление кэшбека', 'income', 'analytics-test-cashback', $2, TRUE)",
+      [accountId, categoryId.income],
+    );
     await insert(otherAccountId, '2026-07-01T12:00:00+03:00', -99_000, categoryId.expense, 'analytics-test-6');
     await insert(accountId, '2026-08-01T12:00:00+03:00', -7_000, categoryId.expense, 'analytics-test-7');
+    await client.query(
+      "INSERT INTO transactions (account_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed) VALUES ($1, '2026-07-07T12:00:00+03:00', -2_500, 0, 'uncategorized', 'expense', 'analytics-test-uncategorized', NULL, FALSE)",
+      [accountId],
+    );
 
     const params = { from: '2026-07-01', to: '2026-07-31', accountId, onlyConfirmed: true };
     const summary = await getSummary(params, client);
-    assert.deepEqual({ expense: summary.totalExpense, income: summary.totalIncome, net: summary.net, transferOut: summary.transferOutflow }, { expense: 6_000, income: 15_000, net: 9_000, transferOut: 3_000 });
+    assert.deepEqual({ expense: summary.totalExpense, income: summary.totalIncome, net: summary.net, transferOut: summary.transferOutflow, interest: summary.interestIncome, cashback: summary.cashbackIncome }, { expense: 6_000, income: 15_200, net: 9_200, transferOut: 3_000, interest: 1_500, cashback: 200 });
+    const categorySummary = await getSummary({ ...params, categoryId: categoryId.expense }, client);
+    assert.deepEqual({ expense: categorySummary.totalExpense, income: categorySummary.totalIncome }, { expense: 6_000, income: 0 });
+    const uncategorized = await getSummary({ ...params, categoryId: 0, onlyConfirmed: false }, client);
+    assert.equal(uncategorized.totalExpense, 2_500);
+    assert.equal((await getSummary({ ...params, categoryId: 0, onlyConfirmed: true }, client)).totalExpense, 0);
+    assert.deepEqual((await getByCategory({ ...params, categoryId: 0, onlyConfirmed: false }, client)).map((item) => item.amount), [2_500]);
+    assert.deepEqual((await getByCategory({ ...params, categoryId: 0, onlyConfirmed: true }, client)), []);
     assert.equal((await getSummary({ ...params, from: '2026-08-01', to: '2026-08-31' }, client)).totalExpense, 7_000);
     assert.deepEqual((await getByCategory(params, client)).map((item) => item.amount), [6_000]);
     const timeseries = await getTimeseries({ ...params, granularity: 'month' }, client);
     assert.equal(timeseries[0].expenseAmount, 6_000);
     assert.equal(timeseries[0].incomeAmount, 15_000);
+    const partial = await getTimeseries({ ...params, from: '2026-07-02', to: '2026-07-03', granularity: 'month' }, client);
+    assert.equal(partial[0].expenseAmount, 0);
+    assert.equal(partial[0].incomeAmount, 20_000);
+    const uncategorizedSeries = await getTimeseries({ ...params, categoryId: 0, onlyConfirmed: false, granularity: 'month' }, client);
+    assert.equal(uncategorizedSeries[0].expenseAmount, 2_500);
+    const confirmedUncategorizedSeries = await getTimeseries({ ...params, categoryId: 0, onlyConfirmed: true, granularity: 'month' }, client);
+    assert.equal(confirmedUncategorizedSeries[0].expenseAmount, 0);
   } finally {
     await client.query('ROLLBACK');
     client.release();

backend/src/services/analytics.ts

@@ -14,6 +14,7 @@ interface BaseParams {
   from: string;
   to: string;
   accountId?: number;
+  categoryId?: number;
   onlyConfirmed?: boolean;
 }
 
@@ -28,9 +29,18 @@ function analyticsTransactions(where: string): string {
         COALESCE(c.type, t.direction) AS analytic_type,
         COALESCE(t.category_id, 0) AS category_id,
         COALESCE(c.name, 'Без категории') AS category_name,
-        ${effectiveAmount} AS effective_amount
+        ${effectiveAmount} AS effective_amount,
+        CASE WHEN a.account_type = 'savings'
+                  AND ${effectiveAmount} > 0
+                  AND (t.description ILIKE '%процент%' OR t.description ILIKE '%выплата %' OR t.description LIKE '%\%%' ESCAPE '\\')
+             THEN ${effectiveAmount} ELSE 0 END AS interest_income,
+        CASE WHEN t.amount_signed = 0
+                  AND t.commission > 0
+                  AND t.description ILIKE '%зачисление%'
+             THEN t.commission ELSE 0 END AS cashback_income
       FROM transactions t
       LEFT JOIN categories c ON c.id = t.category_id
+      LEFT JOIN accounts a ON a.id = t.account_id
       ${where}
     )`;
 }
@@ -56,6 +66,13 @@ function buildBaseConditions(
     values.push(params.accountId);
     idx++;
   }
+  if (params.categoryId != null) {
+    conditions.push(params.categoryId === 0 ? 't.category_id IS NULL' : `t.category_id = $${idx}`);
+    if (params.categoryId !== 0) {
+      values.push(params.categoryId);
+      idx++;
+    }
+  }
   if (params.onlyConfirmed) {
     conditions.push('t.is_category_confirmed = TRUE');
   }
@@ -73,7 +90,9 @@ export async function getSummary(
   const totalsResult = await db.query(
     `${analyticsTransactions(where)},
      category_net AS (
-       SELECT category_id, category_name, analytic_type, SUM(effective_amount)::bigint AS amount
+       SELECT category_id, category_name, analytic_type, SUM(effective_amount)::bigint AS amount,
+              SUM(interest_income)::bigint AS interest_income,
+              SUM(cashback_income)::bigint AS cashback_income
        FROM analytics_transactions
        GROUP BY category_id, category_name, analytic_type
      )
@@ -83,7 +102,9 @@ export async function getSummary(
        COALESCE((SELECT SUM(GREATEST(effective_amount, 0)) FROM analytics_transactions), 0)::bigint AS cash_inflow,
        COALESCE((SELECT SUM(GREATEST(-effective_amount, 0)) FROM analytics_transactions), 0)::bigint AS cash_outflow,
        COALESCE((SELECT SUM(GREATEST(effective_amount, 0)) FROM analytics_transactions WHERE analytic_type = 'transfer'), 0)::bigint AS transfer_inflow,
-       COALESCE((SELECT SUM(GREATEST(-effective_amount, 0)) FROM analytics_transactions WHERE analytic_type = 'transfer'), 0)::bigint AS transfer_outflow
+       COALESCE((SELECT SUM(GREATEST(-effective_amount, 0)) FROM analytics_transactions WHERE analytic_type = 'transfer'), 0)::bigint AS transfer_outflow,
+       COALESCE(SUM(interest_income), 0)::bigint AS interest_income,
+       COALESCE(SUM(cashback_income), 0)::bigint AS cashback_income
      FROM category_net`,
     values,
   );
@@ -94,6 +115,8 @@ export async function getSummary(
   const cashOutflow = Number(totalsResult.rows[0].cash_outflow);
   const transferInflow = Number(totalsResult.rows[0].transfer_inflow);
   const transferOutflow = Number(totalsResult.rows[0].transfer_outflow);
+  const interestIncome = Number(totalsResult.rows[0].interest_income);
+  const cashbackIncome = Number(totalsResult.rows[0].cashback_income);
 
   const topResult = await db.query(
     `${analyticsTransactions(where)}
@@ -123,6 +146,8 @@ export async function getSummary(
     transferInflow,
     transferOutflow,
     cashNet: cashInflow - cashOutflow,
+    interestIncome,
+    cashbackIncome,
     topCategories,
   };
 }
@@ -187,6 +212,8 @@ export async function getTimeseries(
   }
 
   const txConditions: string[] = [
+    't.operation_at::date >= $1::date',
+    't.operation_at::date <= $2::date',
     't.operation_at::date >= p.period_start',
     't.operation_at::date <= p.period_end',
   ];
@@ -198,8 +225,11 @@ export async function getTimeseries(
     values.push(params.accountId);
   }
   if (params.categoryId != null) {
-    txConditions.push(`t.category_id = $${idx++}`);
-    values.push(params.categoryId);
+    if (params.categoryId === 0) txConditions.push('t.category_id IS NULL');
+    else {
+      txConditions.push(`t.category_id = $${idx++}`);
+      values.push(params.categoryId);
+    }
   }
   if (params.onlyConfirmed) {
     txConditions.push('t.is_category_confirmed = TRUE');

backend/src/services/categoryRules.ts

@@ -55,22 +55,38 @@ export async function getRules(params: GetCategoryRulesParams): Promise<Category
 
 export async function createRule(
   body: CreateCategoryRuleRequest,
-): Promise<CategoryRule> {
+): Promise<CategoryRule & { applied: number }> {
   const pattern = body.pattern.trim();
   const matchType = body.matchType ?? 'contains';
   const priority = body.priority ?? 100;
   const requiresConfirmation = body.requiresConfirmation ?? false;
 
-  const { rows } = await pool.query(
-    `INSERT INTO category_rules (pattern, match_type, category_id, priority, requires_confirmation)
-     VALUES ($1, $2, $3, $4, $5)
-     RETURNING *`,
-    [pattern, matchType, body.categoryId, priority, requiresConfirmation],
-  );
-
-  const catResult = await pool.query('SELECT name FROM categories WHERE id = $1', [body.categoryId]);
-  rows[0].category_name = catResult.rows[0].name;
-  return toRule(rows[0]);
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const { rows } = await client.query(
+      `INSERT INTO category_rules (pattern, match_type, category_id, priority, requires_confirmation)
+       VALUES ($1, $2, $3, $4, $5) RETURNING *`,
+      [pattern, matchType, body.categoryId, priority, requiresConfirmation],
+    );
+    const match = matchType === 'starts_with'
+      ? `t.description ILIKE $1 || '%'`
+      : `t.description ILIKE '%' || $1 || '%'`;
+    const applied = await client.query(
+      `UPDATE transactions t SET category_id = $2, is_category_confirmed = $3, updated_at = NOW()
+       WHERE (t.category_id IS NULL OR t.is_category_confirmed = FALSE) AND ${match}`,
+      [pattern, body.categoryId, !requiresConfirmation],
+    );
+    const catResult = await client.query('SELECT name FROM categories WHERE id = $1', [body.categoryId]);
+    rows[0].category_name = catResult.rows[0].name;
+    await client.query('COMMIT');
+    return { ...toRule(rows[0]), applied: applied.rowCount ?? 0 };
+  } catch (error) {
+    await client.query('ROLLBACK');
+    throw error;
+  } finally {
+    client.release();
+  }
 }
 
 export async function updateRule(

backend/src/services/import.integration.test.ts

@@ -0,0 +1,66 @@
+import assert from 'node:assert/strict';
+import { pool } from '../db/pool';
+import { importStatement } from './import';
+
+const makeStatement = (sourceIds: string[]) => ({
+  schemaVersion: '1.0', bank: 'TEST',
+  statement: { accountNumber: 'metadata-test', currency: 'RUB', openingBalance: 0, closingBalance: 100, exportedAt: '2026-08-20T12:00:00+03:00' },
+  transactions: sourceIds.map((sourceId) => ({ operationAt: '2026-08-20T10:00:00+03:00', amountSigned: 100, commission: 0, description: 'Пополнение', sourceId })),
+});
+
+const duplicateStatement = {
+  schemaVersion: '1.0', bank: 'TEST',
+  statement: { accountNumber: 'fingerprint-test', currency: 'RUB', openingBalance: 0, closingBalance: 200, exportedAt: '2026-08-20T12:00:00+03:00' },
+  transactions: Array.from({ length: 2 }, () => ({ operationAt: '2026-08-20T00:00:00+03:00', amountSigned: 100, commission: 0, description: 'Пополнение' })),
+};
+const overlapStatement = {
+  ...duplicateStatement,
+  statement: { ...duplicateStatement.statement, accountNumber: 'overlap-test' },
+};
+const singleStatement = {
+  ...overlapStatement,
+  statement: { ...overlapStatement.statement, closingBalance: 100 },
+  transactions: overlapStatement.transactions.slice(0, 1),
+};
+
+async function run(): Promise<void> {
+  try {
+    await importStatement(makeStatement(['first', 'first-second']));
+    const positions = await pool.query("SELECT source_position FROM transactions t JOIN accounts a ON a.id = t.account_id WHERE a.bank = 'TEST' AND a.account_number = 'metadata-test' ORDER BY source_position");
+    assert.deepEqual(positions.rows.map((row) => Number(row.source_position)), [0, 1]);
+    const account = await pool.query("UPDATE accounts SET account_type = 'savings', status = 'closed' WHERE bank = 'TEST' AND account_number = 'metadata-test' RETURNING id");
+    assert.equal(account.rows.length, 1);
+    await importStatement(makeStatement(['second']));
+    const result = await pool.query('SELECT account_type, status FROM accounts WHERE id = $1', [account.rows[0].id]);
+    assert.deepEqual(result.rows[0], { account_type: 'savings', status: 'closed' });
+    const duplicateResult = await importStatement(duplicateStatement);
+    if ('status' in duplicateResult) throw new Error(duplicateResult.message);
+    assert.deepEqual(duplicateResult, {
+      accountId: duplicateResult.accountId,
+      isNewAccount: true,
+      accountNumberMasked: 'fingerp******test',
+      imported: 2,
+      duplicatesSkipped: 0,
+      totalInFile: 2,
+    });
+    await importStatement(singleStatement);
+    const overlapResult = await importStatement(overlapStatement);
+    if ('status' in overlapResult) throw new Error(overlapResult.message);
+    assert.deepEqual(overlapResult, {
+      accountId: overlapResult.accountId,
+      isNewAccount: false,
+      accountNumberMasked: 'overla******test',
+      imported: 1,
+      duplicatesSkipped: 1,
+      totalInFile: 2,
+    });
+    console.log('import metadata SQL: OK');
+  } finally {
+    await pool.query("DELETE FROM transactions WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'TEST' AND account_number IN ('metadata-test', 'fingerprint-test', 'overlap-test'))");
+    await pool.query("DELETE FROM imports WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'TEST' AND account_number IN ('metadata-test', 'fingerprint-test', 'overlap-test'))");
+    await pool.query("DELETE FROM accounts WHERE bank = 'TEST' AND account_number IN ('metadata-test', 'fingerprint-test', 'overlap-test')");
+    await pool.end();
+  }
+}
+
+run();

backend/src/services/import.test.ts

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import { computeFingerprint, determineDirection } from './import';
+
+assert.equal(determineDirection(1, 'Перечисление средств на счет N 123 со счета N 456'), 'transfer');
+assert.equal(determineDirection(1, 'Перечисление средств на вклад N 123'), 'transfer');
+assert.equal(determineDirection(-1, 'Перечисление суммы вклада при закрытии'), 'transfer');
+assert.equal(determineDirection(-1, 'Оплата покупки'), 'expense');
+assert.equal(determineDirection(1, 'Выплата процентов'), 'income');
+const duplicateTransaction = { operationAt: '2026-08-20T00:00:00+03:00', amountSigned: 100, commission: 0, description: 'Пополнение' };
+assert.notEqual(computeFingerprint('fingerprint-test', duplicateTransaction, 0), computeFingerprint('fingerprint-test', duplicateTransaction, 1));
+
+console.log('import direction: OK');

backend/src/services/import.ts

@@ -1,4 +1,5 @@
 import crypto from 'crypto';
+import type { PoolClient } from 'pg';
 import { pool } from '../db/pool';
 import { maskAccountNumber } from '../utils';
 import type { StatementFile, ImportStatementResponse } from '@family-budget/shared';
@@ -6,26 +7,37 @@ import type { StatementFile, ImportStatementResponse } from '@family-budget/shar
 const TRANSFER_PHRASES = [
   'перевод между своими счетами',
   'перевод средств на счет',
+  'перечисление средств на счет',
+  'перечисление средств на вклад',
+  'перечисление суммы вклада при закрытии',
   'внутри втб',
 ];
 const CASHBACK_KEYWORD = 'зачисление';
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
-function computeFingerprint(
+export function computeFingerprint(
   accountNumber: string,
-  tx: { operationAt: string; amountSigned: number; commission: number; description: string },
+  tx: { operationAt: string; amountSigned: number; commission: number; description: string; sourceId?: string },
+  sourcePosition?: number,
 ): string {
+  if (tx.sourceId) {
+    const raw = [accountNumber, tx.sourceId.trim()].join('|');
+    const hash = crypto.createHash('sha256').update(raw, 'utf-8').digest('hex');
+    return `sha256:${hash}`;
+  }
   const raw = [
     accountNumber,
     tx.operationAt,
     String(tx.amountSigned),
     String(tx.commission),
     tx.description.trim(),
+    ...(sourcePosition === undefined ? [] : [String(sourcePosition)]),
   ].join('|');
   const hash = crypto.createHash('sha256').update(raw, 'utf-8').digest('hex');
   return `sha256:${hash}`;
 }
 
-function determineDirection(amountSigned: number, description: string): string {
+export function determineDirection(amountSigned: number, description: string): string {
   const lower = description.toLowerCase();
   for (const phrase of TRANSFER_PHRASES) {
     if (lower.includes(phrase)) return 'transfer';
@@ -91,6 +103,12 @@ function validateStructure(body: unknown): ValidationError | null {
     if (typeof t.description !== 'string' || !t.description) {
       return { status: 400, error: 'BAD_REQUEST', message: `transactions[${i}].description must be a non-empty string` };
     }
+    if (t.sourceId !== undefined && (typeof t.sourceId !== 'string' || !t.sourceId.trim())) {
+      return { status: 400, error: 'BAD_REQUEST', message: `transactions[${i}].sourceId must be a non-empty string when provided` };
+    }
+    if (t.operationId !== undefined && (typeof t.operationId !== 'string' || !UUID_RE.test(t.operationId))) {
+      return { status: 400, error: 'BAD_REQUEST', message: `transactions[${i}].operationId must be a valid UUID when provided` };
+    }
     if (typeof t.amountSigned !== 'number' || !Number.isInteger(t.amountSigned)) {
       return { status: 400, error: 'BAD_REQUEST', message: `transactions[${i}].amountSigned must be an integer` };
     }
@@ -121,12 +139,20 @@ function validateSemantics(data: StatementFile): ValidationError | null {
   }
 
   const fps = new Set<string>();
+  const operationIds = new Set<string>();
   for (let i = 0; i < data.transactions.length; i++) {
     const fp = computeFingerprint(data.statement.accountNumber, data.transactions[i]);
-    if (fps.has(fp)) {
+    if (data.transactions[i].sourceId && fps.has(fp)) {
       return { status: 422, error: 'VALIDATION_ERROR', message: `Duplicate fingerprint found within file at transaction index ${i}` };
     }
     fps.add(fp);
+    const operationId = data.transactions[i].operationId;
+    if (operationId) {
+      if (operationIds.has(operationId.toLowerCase())) {
+        return { status: 422, error: 'VALIDATION_ERROR', message: `Duplicate operationId found within file at transaction index ${i}` };
+      }
+      operationIds.add(operationId.toLowerCase());
+    }
   }
 
   return null;
@@ -134,6 +160,8 @@ function validateSemantics(data: StatementFile): ValidationError | null {
 
 export async function importStatement(
   body: unknown,
+  db: Pick<typeof pool, 'connect'> = pool,
+  transactionClient?: PoolClient,
 ): Promise<ImportStatementResponse | ValidationError> {
   const structErr = validateStructure(body);
   if (structErr) return structErr;
@@ -142,16 +170,17 @@ export async function importStatement(
   const semErr = validateSemantics(data);
   if (semErr) return semErr;
 
-  const client = await pool.connect();
+  const client = transactionClient ?? await db.connect();
+  const ownsTransaction = transactionClient == null;
   try {
-    await client.query('BEGIN');
+    if (ownsTransaction) await client.query('BEGIN');
 
     // Find or create account
     let accountId: number;
     let isNewAccount = false;
 
     const accResult = await client.query(
-      'SELECT id FROM accounts WHERE bank = $1 AND account_number = $2',
+      'SELECT id, account_type FROM accounts WHERE bank = $1 AND account_number = $2',
       [data.bank, data.statement.accountNumber],
     );
 
@@ -186,29 +215,45 @@ export async function importStatement(
       throw new Error("Category 'Поступления' is missing");
     }
     const incomeCategoryId = Number(incomeCategoryResult.rows[0].id);
+    const accountType = accResult.rows[0]?.account_type ?? null;
+    const investmentCategoryResult = await client.query(
+      `SELECT id FROM categories WHERE name = 'Инвестиции' AND type = 'transfer' AND is_active = TRUE LIMIT 1`,
+    );
+    const investmentCategoryId = investmentCategoryResult.rows[0]
+      ? Number(investmentCategoryResult.rows[0].id)
+      : null;
+    const isInvestmentAccount = ['brokerage', 'iis', 'savings'].includes(accountType);
 
     // Insert transactions
     const insertedIds: number[] = [];
+    const fallbackFingerprintOccurrences = new Map<string, number>();
 
-    for (const tx of data.transactions) {
-      const fp = computeFingerprint(data.statement.accountNumber, tx);
+    for (const [sourcePosition, tx] of data.transactions.entries()) {
+      const fallbackFingerprint = computeFingerprint(data.statement.accountNumber, tx);
+      const occurrence = fallbackFingerprintOccurrences.get(fallbackFingerprint) ?? 0;
+      fallbackFingerprintOccurrences.set(fallbackFingerprint, occurrence + 1);
+      const fp = !tx.sourceId && occurrence > 0
+        ? computeFingerprint(data.statement.accountNumber, tx, occurrence)
+        : fallbackFingerprint;
       const isCashbackCommissionImport =
         tx.amountSigned === 0 &&
         tx.commission > 0 &&
         tx.description.toLowerCase().includes(CASHBACK_KEYWORD);
       const dir = isCashbackCommissionImport
         ? 'income'
-        : determineDirection(tx.amountSigned, tx.description);
-      const categoryId = isCashbackCommissionImport ? incomeCategoryId : null;
+        : isInvestmentAccount ? 'transfer' : determineDirection(tx.amountSigned, tx.description);
+      const categoryId = isCashbackCommissionImport
+        ? incomeCategoryId
+        : isInvestmentAccount ? investmentCategoryId : null;
       const isCategoryConfirmed = isCashbackCommissionImport;
 
       const result = await client.query(
         `INSERT INTO transactions
-           (account_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed, import_id)
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
-         ON CONFLICT (account_id, fingerprint) DO NOTHING
+           (account_id, operation_id, operation_at, amount_signed, commission, description, direction, fingerprint, category_id, is_category_confirmed, import_id, source_position)
+         VALUES ($1, COALESCE($2::uuid, gen_random_uuid()), $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+         ON CONFLICT DO NOTHING
          RETURNING id`,
-        [accountId, tx.operationAt, tx.amountSigned, tx.commission, tx.description, dir, fp, categoryId, isCategoryConfirmed, importId],
+        [accountId, tx.operationId ?? null, tx.operationAt, tx.amountSigned, tx.commission, tx.description, dir, fp, categoryId, isCategoryConfirmed, importId, sourcePosition],
       );
 
       if (result.rows.length > 0) {
@@ -243,14 +288,22 @@ export async function importStatement(
                OR (cr.match_type = 'starts_with' AND t2.description ILIKE cr.pattern || '%')
              )
            WHERE t2.id = ANY($1::bigint[])
+             AND t2.is_category_confirmed = FALSE
            ORDER BY t2.id, cr.priority DESC, cr.id ASC
          ) sub
          WHERE t.id = sub.tx_id`,
         [insertedIds],
       );
+      if (isInvestmentAccount && investmentCategoryId != null) {
+        await client.query(
+          `UPDATE transactions SET is_category_confirmed = TRUE, updated_at = NOW()
+           WHERE id = ANY($1::bigint[]) AND category_id = $2 AND is_category_confirmed = FALSE`,
+          [insertedIds, investmentCategoryId],
+        );
+      }
     }
 
-    await client.query('COMMIT');
+    if (ownsTransaction) await client.query('COMMIT');
 
     return {
       accountId,
@@ -261,10 +314,10 @@ export async function importStatement(
       totalInFile: data.transactions.length,
     };
   } catch (err) {
-    await client.query('ROLLBACK');
+    if (ownsTransaction) await client.query('ROLLBACK');
     throw err;
   } finally {
-    client.release();
+    if (ownsTransaction) client.release();
   }
 }
 

backend/src/services/portfolio.integration.test.ts

@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import { pool } from '../db/pool';
+import { importPortfolio } from './portfolio';
+
+const payload = {
+  schemaVersion: 'broker-portfolio-1.0', bank: 'PORTFOLIO_TEST', accountNumber: 'portfolio-test',
+  reportPeriod: { from: '2026-08-01', to: '2026-08-20' }, reportedAt: '2026-08-20T00:00:00+03:00',
+  positions: [{ instrument: 'Test Bond', isin: 'RU0000000001', quantity: '1.000', price: '100.123456', valuation: '100.123456' }],
+  trades: [{ instrument: 'Test Bond', isin: 'RU0000000001', concludedAt: '2026-08-10T10:00:00+03:00', side: 'Покупка', quantity: '1.000', settlementAmount: '100.123456' }],
+};
+
+async function run(): Promise<void> {
+  try {
+    const first = await importPortfolio(payload);
+    const second = await importPortfolio(payload);
+    assert.equal(first.importedTrades, 1);
+    assert.equal(second.duplicateTrades, 1);
+    const rows = await pool.query('SELECT COUNT(*)::int AS count FROM portfolio_trades WHERE account_id = $1', [first.accountId]);
+    assert.equal(rows.rows[0].count, 1);
+    console.log('portfolio import SQL: OK');
+  } finally {
+    await pool.query("DELETE FROM portfolio_trades WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'PORTFOLIO_TEST' AND account_number = 'portfolio-test')");
+    await pool.query("DELETE FROM portfolio_reports WHERE account_id IN (SELECT id FROM accounts WHERE bank = 'PORTFOLIO_TEST' AND account_number = 'portfolio-test')");
+    await pool.query("DELETE FROM accounts WHERE bank = 'PORTFOLIO_TEST' AND account_number = 'portfolio-test'");
+    await pool.end();
+  }
+}
+
+run();

backend/src/services/portfolio.test.ts

@@ -0,0 +1,13 @@
+import assert from 'node:assert/strict';
+import { deriveTradeSourceId, validatePortfolio } from './portfolio';
+
+const trade = {
+  instrument: 'Bond', isin: 'RU0000000001', concludedAt: '2026-08-20T10:00:00+03:00',
+  side: 'Покупка', quantity: '1.000', settlementAmount: '1234.50',
+};
+
+assert.equal(deriveTradeSourceId(trade), 'RU0000000001|2026-08-20T10:00:00+03:00|Покупка|1.000|1234.50');
+assert.throws(() => validatePortfolio(null), /object/);
+assert.throws(() => validatePortfolio({ schemaVersion: 'broker-portfolio-1.0', bank: 'B', accountNumber: 'A', reportPeriod: { from: '2026-08-20', to: '2026-08-20' }, reportedAt: null, positions: [], trades: [{ ...trade, sourceId: 42 }] }), /sourceId/);
+assert.throws(() => validatePortfolio({ ...{ schemaVersion: 'broker-portfolio-1.0', bank: 'B', accountNumber: 'A', reportPeriod: { from: '2026-08-21', to: '2026-08-20' }, reportedAt: null, positions: [], trades: [] } }), /period/);
+console.log('portfolio validation: OK');

backend/src/services/portfolio.ts

@@ -0,0 +1,105 @@
+import crypto from 'crypto';
+import type { PoolClient } from 'pg';
+import { pool } from '../db/pool';
+import type { ImportPortfolioResponse, PortfolioFile, PortfolioTrade } from '@family-budget/shared';
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function decimalValue(value: unknown, field: string, required = false): string | null {
+  if (value == null || value === '') {
+    if (required) throw new Error(`${field} is required`);
+    return null;
+  }
+  const result = String(value).replace(/\s/g, '').replace(',', '.');
+  if (!/^-?(?:\d+\.?\d*|\.\d+)$/.test(result)) throw new Error(`${field} must be numeric`);
+  return result;
+}
+
+export function deriveTradeSourceId(trade: PortfolioTrade): string {
+  if (trade.sourceId?.trim()) return trade.sourceId.trim();
+  return [trade.isin || trade.instrument, trade.concludedAt, trade.side, decimalValue(trade.quantity, 'quantity', true), decimalValue(trade.settlementAmount, 'settlementAmount') || ''].join('|');
+}
+
+export function validatePortfolio(body: unknown): asserts body is PortfolioFile {
+  if (!body || typeof body !== 'object') throw new Error('Portfolio file must be an object');
+  const data = body as PortfolioFile;
+  if (data.schemaVersion !== 'broker-portfolio-1.0' || typeof data.bank !== 'string' || !data.bank.trim() || typeof data.accountNumber !== 'string' || !data.accountNumber.trim()) throw new Error('Invalid portfolio file');
+  if (!data.reportPeriod?.from || !data.reportPeriod?.to || Number.isNaN(Date.parse(data.reportPeriod.from)) || Number.isNaN(Date.parse(data.reportPeriod.to)) || data.reportPeriod.from > data.reportPeriod.to) throw new Error('Invalid report period');
+  if (data.reportedAt !== null && (typeof data.reportedAt !== 'string' || Number.isNaN(Date.parse(data.reportedAt)))) throw new Error('Invalid reportedAt');
+  if (!Array.isArray(data.positions) || !Array.isArray(data.trades)) throw new Error('positions and trades must be arrays');
+  const sourceIds = new Set<string>();
+  for (const trade of data.trades) {
+    if (!trade || typeof trade.instrument !== 'string' || !trade.instrument.trim() || typeof trade.concludedAt !== 'string' || Number.isNaN(Date.parse(trade.concludedAt)) || typeof trade.side !== 'string' || !trade.side.trim()) throw new Error('Invalid trade');
+    if (trade.sourceId !== undefined && typeof trade.sourceId !== 'string') throw new Error('sourceId must be a string');
+    if (trade.operationId !== undefined && typeof trade.operationId !== 'string') throw new Error('operationId must be a string');
+    const sourceId = deriveTradeSourceId(trade);
+    if (sourceIds.has(sourceId)) throw new Error(`Duplicate sourceId: ${sourceId}`);
+    sourceIds.add(sourceId);
+    if (trade.operationId && !UUID_RE.test(trade.operationId)) throw new Error(`Invalid operationId: ${trade.sourceId}`);
+    decimalValue(trade.quantity, 'quantity', true);
+  }
+  for (const position of data.positions) {
+    if (!position || typeof position.instrument !== 'string' || !position.instrument.trim()) throw new Error('Invalid position');
+    decimalValue(position.quantity, 'position.quantity', true);
+    decimalValue(position.price, 'position.price');
+    decimalValue(position.valuation, 'position.valuation');
+  }
+}
+
+export async function importPortfolio(body: unknown, db: Pick<typeof pool, 'connect'> = pool, transactionClient?: PoolClient): Promise<ImportPortfolioResponse> {
+  validatePortfolio(body);
+  const data = body;
+  const sourceHash = crypto.createHash('sha256').update(JSON.stringify(data)).digest('hex');
+  const client = transactionClient ?? await db.connect();
+  const ownsTransaction = transactionClient == null;
+  try {
+    if (ownsTransaction) await client.query('BEGIN');
+    const accountResult = await client.query(
+      `INSERT INTO accounts (bank, account_number, currency, account_type)
+       VALUES ($1, $2, 'RUB', 'brokerage')
+       ON CONFLICT (bank, account_number) DO UPDATE SET account_type = COALESCE(accounts.account_type, 'brokerage')
+       RETURNING id`,
+      [data.bank, data.accountNumber],
+    );
+    const accountId = Number(accountResult.rows[0].id);
+    const reportResult = await client.query(
+      `INSERT INTO portfolio_reports (account_id, source_hash, report_period_from, report_period_to, reported_at)
+       VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (account_id, source_hash) DO NOTHING
+       RETURNING id`,
+      [accountId, sourceHash, data.reportPeriod.from, data.reportPeriod.to, data.reportedAt],
+    );
+    if (reportResult.rows.length === 0) {
+      const existing = await client.query('SELECT id FROM portfolio_reports WHERE account_id = $1 AND source_hash = $2', [accountId, sourceHash]);
+      if (ownsTransaction) await client.query('COMMIT');
+      return { accountId, reportId: Number(existing.rows[0].id), importedTrades: 0, duplicateTrades: data.trades.length, positions: 0 };
+    }
+    const reportId = Number(reportResult.rows[0].id);
+    for (const position of data.positions) {
+      await client.query(
+        `INSERT INTO portfolio_positions (report_id, instrument, isin, quantity, price, valuation)
+         VALUES ($1, $2, $3, $4, $5, $6)`,
+        [reportId, position.instrument, position.isin ?? null, decimalValue(position.quantity, 'position.quantity', true), decimalValue(position.price, 'position.price'), decimalValue(position.valuation, 'position.valuation')],
+      );
+    }
+    let importedTrades = 0;
+    for (const trade of data.trades) {
+      const sourceId = deriveTradeSourceId(trade);
+      const result = await client.query(
+        `INSERT INTO portfolio_trades
+         (account_id, source_id, operation_id, instrument, isin, concluded_at, side, quantity, price_currency, price, settlement_currency, settlement_amount, nkd, settlement_commission, trade_commission, order_id, trade_id, venue, comment)
+         VALUES ($1, $2, COALESCE($3::uuid, gen_random_uuid()), $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)
+         ON CONFLICT (account_id, source_id) DO NOTHING`,
+        [accountId, sourceId, trade.operationId ?? null, trade.instrument, trade.isin ?? null, trade.concludedAt, trade.side, decimalValue(trade.quantity, 'quantity', true), trade.priceCurrency ?? null, decimalValue(trade.price, 'price'), trade.settlementCurrency ?? null, decimalValue(trade.settlementAmount, 'settlementAmount'), decimalValue(trade.nkd, 'nkd'), decimalValue(trade.settlementCommission, 'settlementCommission'), decimalValue(trade.tradeCommission, 'tradeCommission'), trade.orderId ?? null, trade.tradeId ?? null, trade.venue ?? null, trade.comment ?? null],
+      );
+      importedTrades += result.rowCount ?? 0;
+    }
+    if (ownsTransaction) await client.query('COMMIT');
+    return { accountId, reportId, importedTrades, duplicateTrades: data.trades.length - importedTrades, positions: data.positions.length };
+  } catch (error) {
+    if (ownsTransaction) await client.query('ROLLBACK');
+    throw error;
+  } finally {
+    if (ownsTransaction) client.release();
+  }
+}

backend/src/services/transactions.test.ts

@@ -0,0 +1,13 @@
+import assert from 'node:assert/strict';
+import { transactionOrderBy } from './transactions';
+
+assert.equal(
+  transactionOrderBy('date', 'desc'),
+  't.operation_at DESC, t.source_position ASC, t.id ASC',
+);
+assert.equal(
+  transactionOrderBy('date', 'asc'),
+  't.operation_at ASC, t.source_position DESC, t.id DESC',
+);
+assert.match(transactionOrderBy('amount', 'desc'), /t\.amount_signed DESC.*t\.operation_at DESC.*t\.source_position ASC.*t\.id DESC/);
+console.log('transaction ordering: OK');

backend/src/services/transactions.ts

@@ -7,13 +7,18 @@ import type {
   UpdateTransactionRequest,
 } from '@family-budget/shared';
 
+export function transactionOrderBy(sortBy: 'date' | 'amount', sortOrder: 'asc' | 'desc'): string {
+  const direction = sortOrder === 'asc' ? 'ASC' : 'DESC';
+  if (sortBy === 'amount') return `t.amount_signed ${direction}, t.operation_at DESC, t.source_position ASC, t.id DESC`;
+  return `t.operation_at ${direction}, t.source_position ${direction === 'ASC' ? 'DESC' : 'ASC'}, t.id ${direction === 'ASC' ? 'DESC' : 'ASC'}`;
+}
+
 export async function getTransactions(
   params: GetTransactionsParams,
 ): Promise<PaginatedResponse<Transaction>> {
   const page = params.page ?? 1;
   const pageSize = [10, 50, 100].includes(params.pageSize ?? 50) ? (params.pageSize ?? 50) : 50;
-  const sortBy = params.sortBy === 'amount' ? 't.amount_signed' : 't.operation_at';
-  const sortOrder = params.sortOrder === 'asc' ? 'ASC' : 'DESC';
+  const orderBy = transactionOrderBy(params.sortBy === 'amount' ? 'amount' : 'date', params.sortOrder === 'asc' ? 'asc' : 'desc');
 
   const conditions: string[] = [];
   const values: unknown[] = [];
@@ -84,7 +89,7 @@ export async function getTransactions(
      JOIN accounts a ON a.id = t.account_id
      LEFT JOIN categories c ON c.id = t.category_id
      ${where}
-     ORDER BY ${sortBy} ${sortOrder}
+     ORDER BY ${orderBy}
      LIMIT $${idx++} OFFSET $${idx++}`,
     [...values, pageSize, offset],
   );

backend/src/services/vtbBrokerXlsx.test.ts

@@ -0,0 +1,45 @@
+import assert from 'node:assert/strict';
+import zlib from 'zlib';
+import { convertVtbBrokerXlsx } from './vtbBrokerXlsx';
+
+function zip(files: Record<string, string>): Buffer {
+  let offset = 0;
+  const locals: Buffer[] = [];
+  const central: Buffer[] = [];
+  for (const [name, value] of Object.entries(files)) {
+    const nameBuffer = Buffer.from(name);
+    const data = zlib.deflateRawSync(Buffer.from(value));
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0); local.writeUInt16LE(20, 4); local.writeUInt16LE(8, 8);
+    local.writeUInt32LE(data.length, 18); local.writeUInt32LE(Buffer.byteLength(value), 22);
+    local.writeUInt16LE(nameBuffer.length, 26);
+    const header = Buffer.alloc(46);
+    header.writeUInt32LE(0x02014b50, 0); header.writeUInt16LE(20, 4); header.writeUInt16LE(20, 6); header.writeUInt16LE(8, 10);
+    header.writeUInt32LE(data.length, 20); header.writeUInt32LE(Buffer.byteLength(value), 24); header.writeUInt16LE(nameBuffer.length, 28); header.writeUInt32LE(offset, 42);
+    locals.push(local, nameBuffer, data);
+    central.push(header, nameBuffer);
+    offset += local.length + nameBuffer.length + data.length;
+  }
+  const centralBuffer = Buffer.concat(central);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0); end.writeUInt16LE(Object.keys(files).length, 8); end.writeUInt16LE(Object.keys(files).length, 10); end.writeUInt32LE(centralBuffer.length, 12); end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...locals, centralBuffer, end]);
+}
+
+const strings = ['Период с 01.08.2026 по 31.08.2026', '12345678901234567890 (RUR)', 'Дата формирования отчета', 'Движение денежных средств', 'Пополнение', 'Отчёт об остатках ценных бумаг', 'Движение ценных бумаг', 'Отчёт об остатках денежных средств', 'Заключенные в отчетном периоде сделки с ценными бумагами', 'Bond, RU0000000001', 'Покупка', 'Завершенные в отчетном периоде сделки с ценными бумагами'];
+const shared = `<sst>${strings.map((value) => `<si><t>${value}</t></si>`).join('')}</sst>`;
+const cell = (ref: string, value: string | number, sharedString = false) => `<c r="${ref}"${sharedString ? ' t="s"' : ''}><v>${value}</v></c>`;
+const row = (number: number, cells: string[]) => `<row r="${number}">${cells.join('')}</row>`;
+const sheet = `<worksheet><sheetData>${[
+  row(1, [cell('A1', 0, true)]), row(2, [cell('A2', 1, true)]), row(3, [cell('A3', 2, true), cell('B3', 45900)]),
+  row(10, [cell('A10', 3, true)]), row(11, [cell('B11', 45900), cell('C11', 1), cell('J11', 4, true)]),
+  row(12, [cell('A12', 5, true)]), row(13, [cell('A13', 6, true)]), row(15, [cell('A15', 7, true)]), row(16, []), row(17, []), row(18, [cell('L18', 0), cell('AF18', 1)]),
+  row(20, [cell('A20', 8, true)]), row(21, [cell('B21', 9, true), cell('C21', 45900), cell('F21', 10, true), cell('H21', 1)]), row(22, [cell('A22', 11, true)]),
+].join('')}</sheetData></worksheet>`;
+
+const result = convertVtbBrokerXlsx(zip({ 'xl/sharedStrings.xml': shared, 'xl/worksheets/sheet1.xml': sheet }));
+assert.equal(result.cash.transactions.length, 1);
+assert.equal(result.cash.statement.closingBalance, 100);
+assert.equal(result.portfolio.trades.length, 1);
+assert.throws(() => convertVtbBrokerXlsx(Buffer.from('not a zip')), /XLSX/);
+console.log('VTB broker XLSX: OK');

backend/src/services/vtbBrokerXlsx.ts

@@ -0,0 +1,167 @@
+import crypto from 'crypto';
+import zlib from 'zlib';
+import type { PortfolioFile, StatementFile } from '@family-budget/shared';
+
+type Row = [number, Record<string, string>];
+const MAX_XLSX_UNCOMPRESSED_BYTES = 30 * 1024 * 1024;
+
+function xmlText(value: string): string {
+  return value.replace(/<[^>]+>/g, '').replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&#(d+);/g, (_, code) => String.fromCharCode(Number(code))).replace(/\s+/g, ' ').trim();
+}
+
+function zipFiles(buffer: Buffer): Map<string, Buffer> {
+  const end = buffer.lastIndexOf(Buffer.from([0x50, 0x4b, 0x05, 0x06]));
+  if (end < 0) throw new Error('Файл не является XLSX-архивом');
+  const files = new Map<string, Buffer>();
+  let offset = buffer.readUInt32LE(end + 16);
+  const count = buffer.readUInt16LE(end + 10);
+  let totalSize = 0;
+  for (let i = 0; i < count; i++) {
+    if (buffer.readUInt32LE(offset) !== 0x02014b50) throw new Error('Повреждён XLSX-архив');
+    const method = buffer.readUInt16LE(offset + 10);
+    const compressedSize = buffer.readUInt32LE(offset + 20);
+    const nameLength = buffer.readUInt16LE(offset + 28);
+    const extraLength = buffer.readUInt16LE(offset + 30);
+    const commentLength = buffer.readUInt16LE(offset + 32);
+    const localOffset = buffer.readUInt32LE(offset + 42);
+    const name = buffer.subarray(offset + 46, offset + 46 + nameLength).toString('utf8');
+    if (buffer.readUInt32LE(localOffset) !== 0x04034b50) throw new Error('Повреждён XLSX-архив');
+    const localNameLength = buffer.readUInt16LE(localOffset + 26);
+    const localExtraLength = buffer.readUInt16LE(localOffset + 28);
+    const data = buffer.subarray(localOffset + 30 + localNameLength + localExtraLength, localOffset + 30 + localNameLength + localExtraLength + compressedSize);
+    let content: Buffer;
+    try {
+      content = method === 0 ? data : method === 8 ? zlib.inflateRawSync(data, { maxOutputLength: MAX_XLSX_UNCOMPRESSED_BYTES - totalSize }) : (() => { throw new Error('Неподдерживаемое сжатие XLSX'); })();
+    } catch (error) {
+      if (error instanceof Error && /maxOutputLength|larger than/i.test(error.message)) throw new Error('XLSX-отчёт слишком большой после распаковки');
+      throw error;
+    }
+    totalSize += content.length;
+    if (totalSize > MAX_XLSX_UNCOMPRESSED_BYTES) throw new Error('XLSX-отчёт слишком большой после распаковки');
+    files.set(name, content);
+    offset += 46 + nameLength + extraLength + commentLength;
+  }
+  return files;
+}
+
+function readRows(buffer: Buffer): Row[] {
+  const files = zipFiles(buffer);
+  const sharedXml = files.get('xl/sharedStrings.xml')?.toString('utf8');
+  const sheetXml = files.get('xl/worksheets/sheet1.xml')?.toString('utf8');
+  if (!sharedXml || !sheetXml) throw new Error('В XLSX не найдены данные отчёта');
+  const shared = [...sharedXml.matchAll(/<si>([\s\S]*?)<\/si>/g)].map((match) => xmlText(match[1]));
+  return [...sheetXml.matchAll(/<row[^>]*\br="(\d+)"[^>]*>([\s\S]*?)<\/row>/g)].map((row) => {
+    const cells: Record<string, string> = {};
+    for (const cell of row[2].matchAll(/<c[^>]*\br="([A-Z]+)\d+"([^>]*)>([\s\S]*?)<\/c>/g)) {
+      const value = cell[3].match(/<v>([\s\S]*?)<\/v>/)?.[1] ?? '';
+      cells[cell[1]] = /\bt="s"/.test(cell[2]) && value ? shared[Number(value)] : xmlText(value);
+    }
+    return [Number(row[1]), cells];
+  });
+}
+
+function text(value: unknown): string {
+  return String(value ?? '').replace(/\s+/g, ' ').trim();
+}
+
+function rowText(cells: Record<string, string>): string {
+  return text(Object.values(cells).join(' '));
+}
+
+function findRow(rows: Row[], phrase: string, start = 0): number {
+  const index = rows.findIndex(([, cells], i) => i >= start && rowText(cells).toLowerCase().includes(phrase.toLowerCase()));
+  if (index < 0) throw new Error(`Не найден раздел: ${phrase}`);
+  return index;
+}
+
+function excelDate(value: string | undefined): string | null {
+  if (!value) return null;
+  const date = new Date(Date.UTC(1899, 11, 30) + Number(value) * 86_400_000);
+  if (Number.isNaN(date.valueOf())) return null;
+  return `${date.toISOString().slice(0, 19)}+03:00`;
+}
+
+function kopecks(value: string | undefined): number {
+  return value ? Math.round(Number(value.replace(',', '.')) * 100) : 0;
+}
+
+function metadata(rows: Row[]): { account: string; period: [string, string]; reportedAt: string | null } {
+  const period = rows.map(([, cells]) => rowText(cells)).join(' ').match(/период с (\d{2}\.\d{2}\.\d{4}) по (\d{2}\.\d{2}\.\d{4})/i);
+  let account: string | null = null;
+  let reportedAt: string | null = null;
+  for (const [, cells] of rows.slice(0, 35)) {
+    const joined = rowText(cells);
+    account ??= joined.match(/(\d{20})\s*\(RUR\)/)?.[1] ?? null;
+    if (joined.includes('Дата формирования отчета')) {
+      reportedAt ??= Object.values(cells).map(excelDate).find(Boolean) ?? null;
+    }
+  }
+  if (!account || !period) throw new Error('Не удалось определить счёт или период отчёта');
+  return { account, period: [period[1], period[2]], reportedAt };
+}
+
+function isoDate(value: string): string {
+  const [day, month, year] = value.split('.');
+  return `${year}-${month}-${day}`;
+}
+
+export function convertVtbBrokerXlsx(buffer: Buffer): { cash: StatementFile; portfolio: PortfolioFile } {
+  const rows = readRows(buffer);
+  const { account, period, reportedAt } = metadata(rows);
+  const holdingsStart = findRow(rows, 'Отчёт об остатках ценных бумаг');
+  const movementStart = findRow(rows, 'Движение ценных бумаг', holdingsStart);
+  const cashStart = findRow(rows, 'Движение денежных средств');
+  const tradesStart = findRow(rows, 'Заключенные в отчетном периоде сделки с ценными бумагами');
+  const tradesEnd = findRow(rows, 'Завершенные в отчетном периоде сделки с ценными бумагами', tradesStart + 1);
+  const occurrences = new Map<string, number>();
+  const transactions = rows.slice(cashStart + 1, holdingsStart).flatMap(([, cells]) => {
+    if (!cells.B || !cells.C || !cells.J) return [];
+    const operationAt = excelDate(cells.B);
+    if (!operationAt) return [];
+    const amountSigned = kopecks(cells.C);
+    const description = text(`${text(cells.J)}. ${text(cells.P)}`.replace(/\. $/, ''));
+    const digest = crypto.createHash('sha256').update(`${operationAt}|${amountSigned}|${description}`).digest('hex').slice(0, 16);
+    const occurrence = (occurrences.get(digest) ?? 0) + 1;
+    occurrences.set(digest, occurrence);
+    return [{ operationAt, amountSigned, commission: 0, description, sourceId: `vtb-broker-cash:${digest}:${occurrence}` }];
+  });
+  if (!transactions.length) throw new Error('Операции движения денежных средств не найдены');
+  const balanceStart = findRow(rows, 'Отчёт об остатках денежных средств');
+  const openingBalance = kopecks(rows[balanceStart + 3]?.[1].L);
+  const closingBalance = kopecks(rows[balanceStart + 3]?.[1].AF);
+  if (openingBalance + transactions.reduce((sum, tx) => sum + tx.amountSigned, 0) !== closingBalance) throw new Error('Баланс cash-операций не сходится с отчётом');
+  const positions = rows.slice(holdingsStart + 1, movementStart).flatMap(([, cells]) => {
+    const instrument = text(cells.B);
+    if (!instrument || instrument.toLowerCase().startsWith('итого') || !/RU[A-Z0-9]{10}/.test(instrument)) return [];
+    return [{ instrument, isin: instrument.split(', ').find((part) => /^RU[A-Z0-9]{10}$/.test(part)) ?? null, quantity: cells.L || cells.M || cells.I || cells.J, price: cells.P || null, valuation: cells.AF || cells.AJ || null }];
+  });
+  const trades = rows.slice(tradesStart + 1, tradesEnd).flatMap(([number, cells]) => {
+    if (!cells.B || !cells.C || !cells.F) return [];
+    const concludedAt = excelDate(cells.C);
+    if (!concludedAt) return [];
+    const tradeId = text(cells.Z);
+    return [{
+      sourceId: `vtb-broker-trade:${tradeId || number}`,
+      instrument: text(cells.B),
+      isin: text(cells.B).split(', ').find((part) => /^RU[A-Z0-9]{10}$/.test(part)) ?? null,
+      concludedAt,
+      side: text(cells.F),
+      quantity: text(cells.H),
+      priceCurrency: text(cells.I) || null,
+      price: text(cells.J) || null,
+      settlementCurrency: text(cells.L) || null,
+      settlementAmount: text(cells.M) || null,
+      nkd: text(cells.O) || null,
+      settlementCommission: text(cells.P) || null,
+      tradeCommission: text(cells.R) || null,
+      orderId: text(cells.W) || null,
+      tradeId: tradeId || null,
+      venue: text(cells.AK) || null,
+      comment: text(cells.AN) || null,
+    }];
+  });
+  return {
+    cash: { schemaVersion: '1.0', bank: 'VTB_BROKER', statement: { accountNumber: account, currency: 'RUB', openingBalance, closingBalance, exportedAt: reportedAt ?? transactions[transactions.length - 1].operationAt }, transactions },
+    portfolio: { schemaVersion: 'broker-portfolio-1.0', bank: 'VTB_BROKER', accountNumber: account, reportPeriod: { from: isoDate(period[0]), to: isoDate(period[1]) }, reportedAt, positions, trades },
+  };
+}

docker-compose.yml

@@ -7,13 +7,8 @@ services:
       context: .
       dockerfile: Dockerfile.backend
     container_name: family-budget-backend
-    environment:
-      # Имя контейнера/сервиса PostgreSQL — postgres или postgres_budget
-      - DB_HOST=postgres_budget
-      - DB_PORT=5432
-      - DB_NAME=family_budget
-      - DB_USER=budget_user
-      - DB_PASSWORD=difficult_Paaaaaasword
+    env_file:
+      - ./backend/.env
     ports:
       - "3000:3000"
     restart: unless-stopped

docs/backlog/api_import.md

@@ -91,7 +91,7 @@
 
 - `statement.currency` соответствует допустимому коду валюты (MVP: `"RUB"`).
 - `operationAt` у всех транзакций — валидная дата (парсится без ошибок).
-- Отсутствуют дубликаты fingerprint внутри одного файла.
+- Повторяющиеся `sourceId` внутри одного файла отклоняются; одинаковые операции без `sourceId` различаются по позиции в массиве `transactions`.
 
 Ответ при ошибке:
 
@@ -120,10 +120,11 @@
 Для каждой транзакции вычисляется SHA-256 от полей, соединённых разделителем `|`:
 
 ```text
-accountNumber|operationAt|amountSigned|commission|normalizedDescription
+accountNumber|operationAt|amountSigned|commission|normalizedDescription[|sourcePosition]
 ```
 
 - `normalizedDescription` — `description` после `trim`.
+- `sourcePosition` — порядковый номер повторяющейся операции в массиве `transactions`; добавляется, только если одинаковые операции без `sourceId` повторяются в одном файле.
 - Суммы подставляются в том виде, в котором пришли в JSON (числовое представление).
 - Разделитель `|` исключает коллизии при склейке полей разной длины.
 

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@family-budget/frontend",
-  "version": "0.9.0",
+  "version": "0.12.0",
   "private": true,
   "type": "module",
   "scripts": {

frontend/src/api/portfolio.ts

@@ -0,0 +1,12 @@
+import type { ImportBrokerReportResponse, ImportPortfolioResponse, PortfolioFile } from '@family-budget/shared';
+import { api } from './client';
+
+export function importPortfolio(data: PortfolioFile): Promise<ImportPortfolioResponse> {
+  return api.post('/api/import/portfolio', data);
+}
+
+export function importBrokerReport(file: File): Promise<ImportBrokerReportResponse> {
+  const formData = new FormData();
+  formData.append('file', file);
+  return api.postFormData('/api/import/broker', formData);
+}

frontend/src/api/rules.ts

@@ -1,5 +1,6 @@
 import type {
   CategoryRule,
+  CreateCategoryRuleResponse,
   GetCategoryRulesParams,
   CreateCategoryRuleRequest,
   UpdateCategoryRuleRequest,
@@ -24,8 +25,8 @@ export async function getCategoryRules(
 
 export async function createCategoryRule(
   data: CreateCategoryRuleRequest,
-): Promise<CategoryRule> {
-  return api.post<CategoryRule>('/api/category-rules', data);
+): Promise<CreateCategoryRuleResponse> {
+  return api.post<CreateCategoryRuleResponse>('/api/category-rules', data);
 }
 
 export async function updateCategoryRule(

frontend/src/components/AccountsList.tsx

@@ -7,6 +7,8 @@ export function AccountsList() {
   const [loading, setLoading] = useState(true);
   const [editingId, setEditingId] = useState<number | null>(null);
   const [editAlias, setEditAlias] = useState('');
+  const [editAccountType, setEditAccountType] = useState<Account['accountType']>(null);
+  const [editStatus, setEditStatus] = useState<Account['status']>('active');
 
   useEffect(() => {
     setLoading(true);
@@ -19,12 +21,16 @@ export function AccountsList() {
   const handleEdit = (account: Account) => {
     setEditingId(account.id);
     setEditAlias(account.alias || '');
+    setEditAccountType(account.accountType);
+    setEditStatus(account.status);
   };
 
   const handleSave = async (id: number) => {
     try {
       const updated = await updateAccount(id, {
         alias: editAlias.trim(),
+        accountType: editAccountType,
+        status: editStatus,
       });
       setAccounts((prev) =>
         prev.map((a) => (a.id === id ? updated : a)),
@@ -48,6 +54,8 @@ export function AccountsList() {
             <th className="data-table__head-cell">Номер счёта</th>
             <th className="data-table__head-cell">Валюта</th>
             <th className="data-table__head-cell">Алиас</th>
+            <th className="data-table__head-cell">Тип</th>
+            <th className="data-table__head-cell">Статус</th>
             <th className="data-table__head-cell"></th>
           </tr>
         </thead>
@@ -76,6 +84,25 @@ export function AccountsList() {
                   )
                 )}
               </td>
+              <td className="data-table__cell">
+                {editingId === a.id ? (
+                  <select value={editAccountType ?? ''} onChange={(e) => setEditAccountType((e.target.value || null) as Account['accountType'])}>
+                    <option value="">Не указан</option>
+                    <option value="brokerage">Брокерский</option>
+                    <option value="iis">ИИС</option>
+                    <option value="savings">Накопительный</option>
+                    <option value="current">Текущий</option>
+                  </select>
+                ) : (({ brokerage: 'Брокерский', iis: 'ИИС', savings: 'Накопительный', current: 'Текущий' } as Record<string, string>)[a.accountType ?? ''] || 'не указан')}
+              </td>
+              <td className="data-table__cell">
+                {editingId === a.id ? (
+                  <select value={editStatus} onChange={(e) => setEditStatus(e.target.value as Account['status'])}>
+                    <option value="active">Действующий</option>
+                    <option value="closed">Закрытый</option>
+                  </select>
+                ) : (a.status === 'closed' ? 'Закрытый' : 'Действующий')}
+              </td>
               <td className="data-table__cell">
                 {editingId === a.id ? (
                   <div className="button-group">
@@ -105,7 +132,7 @@ export function AccountsList() {
           ))}
           {accounts.length === 0 && (
             <tr className="data-table__row">
-              <td colSpan={5} className="data-table__cell data-table__cell--center text text--muted">
+              <td colSpan={7} className="data-table__cell data-table__cell--center text text--muted">
                 Нет счетов. Импортируйте выписку.
               </td>
             </tr>

frontend/src/components/ImportModal.tsx

@@ -1,6 +1,7 @@
 import { useState, useRef } from 'react';
-import type { ImportStatementResponse } from '@family-budget/shared';
+import type { ImportBrokerReportResponse, ImportPortfolioResponse, ImportStatementResponse, PortfolioFile } from '@family-budget/shared';
 import { importStatement } from '../api/import';
+import { importBrokerReport, importPortfolio } from '../api/portfolio';
 import { updateAccount } from '../api/accounts';
 
 interface Props {
@@ -9,7 +10,7 @@ interface Props {
 }
 
 export function ImportModal({ onClose, onDone }: Props) {
-  const [result, setResult] = useState<ImportStatementResponse | null>(null);
+  const [result, setResult] = useState<ImportStatementResponse | ImportPortfolioResponse | ImportBrokerReportResponse | null>(null);
   const [error, setError] = useState('');
   const [loading, setLoading] = useState(false);
   const [alias, setAlias] = useState('');
@@ -26,9 +27,10 @@ export function ImportModal({ onClose, onDone }: Props) {
     const type = file.type;
     const isPdf = type === 'application/pdf' || name.endsWith('.pdf');
     const isJson = type === 'application/json' || name.endsWith('.json');
+    const isXlsx = type === 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' || name.endsWith('.xlsx');
 
-    if (!isPdf && !isJson) {
-      setError('Допустимы только файлы PDF или JSON');
+    if (!isPdf && !isJson && !isXlsx) {
+      setError('Допустимы только файлы PDF, JSON или XLSX');
       return;
     }
 
@@ -37,7 +39,12 @@ export function ImportModal({ onClose, onDone }: Props) {
     setResult(null);
 
     try {
-      const resp = await importStatement(file);
+      const data = isJson ? JSON.parse(await file.text()) : null;
+      const resp = isXlsx
+        ? await importBrokerReport(file)
+        : data?.schemaVersion === 'broker-portfolio-1.0'
+        ? await importPortfolio(data as PortfolioFile)
+        : await importStatement(file);
       setResult(resp);
     } catch (err: unknown) {
       const msg =
@@ -49,7 +56,7 @@ export function ImportModal({ onClose, onDone }: Props) {
   };
 
   const handleSaveAlias = async () => {
-    if (!result || !alias.trim()) return;
+    if (!result || 'reportId' in result || 'cash' in result || !alias.trim()) return;
     try {
       await updateAccount(result.accountId, { alias: alias.trim() });
       setAliasSaved(true);
@@ -58,6 +65,9 @@ export function ImportModal({ onClose, onDone }: Props) {
     }
   };
 
+  const isPortfolioResult = result != null && 'reportId' in result;
+  const isBrokerResult = result != null && 'cash' in result;
+
   return (
     <div
       className="modal"
@@ -79,12 +89,12 @@ export function ImportModal({ onClose, onDone }: Props) {
           {!result && (
             <div className="import-upload">
               <p className="import-upload__description">
-                Выберите файл выписки (PDF или JSON, формат 1.0)
+                Выберите PDF/JSON выписки, JSON портфеля или XLSX-отчёт ВТБ Брокер
               </p>
               <input
                 ref={fileRef}
                 type="file"
-                accept=".pdf,.json,application/pdf,application/json"
+                accept=".pdf,.json,.xlsx,application/pdf,application/json,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
                 onChange={handleFileChange}
                 className="import-upload__input"
               />
@@ -97,33 +107,69 @@ export function ImportModal({ onClose, onDone }: Props) {
           {result && (
             <div className="import-result">
               <div className="import-result__icon" aria-hidden="true">✓</div>
-              <h3 className="import-result__title">Импорт завершён</h3>
+              <h3 className="import-result__title">{isBrokerResult ? 'Импорт брокерского отчёта завершён' : isPortfolioResult ? 'Импорт портфеля завершён' : 'Импорт завершён'}</h3>
               <table className="import-result__stats">
                 <tbody className="import-result__stats-body">
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Счёт</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.accountNumberMasked}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Новый счёт</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.isNewAccount ? 'Да' : 'Нет'}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.imported}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов пропущено</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.duplicatesSkipped}</td>
-                  </tr>
-                  <tr className="import-result__stat-row">
-                    <td className="import-result__stat-cell import-result__stat-cell--label">Всего в файле</td>
-                    <td className="import-result__stat-cell import-result__stat-cell--value">{result.totalInFile}</td>
-                  </tr>
+                  {isBrokerResult ? <>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано cash-операций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.cash.imported}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов cash-операций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.cash.duplicatesSkipped}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.portfolio.importedTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.portfolio.duplicateTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Позиций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.portfolio.positions}</td>
+                    </tr>
+                  </> : isPortfolioResult ? <>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.importedTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов сделок</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.duplicateTrades}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Позиций</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.positions}</td>
+                    </tr>
+                  </> : <>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Счёт</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.accountNumberMasked}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Новый счёт</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.isNewAccount ? 'Да' : 'Нет'}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Импортировано</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.imported}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Дубликатов пропущено</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.duplicatesSkipped}</td>
+                    </tr>
+                    <tr className="import-result__stat-row">
+                      <td className="import-result__stat-cell import-result__stat-cell--label">Всего в файле</td>
+                      <td className="import-result__stat-cell import-result__stat-cell--value">{result.totalInFile}</td>
+                    </tr>
+                  </>}
                 </tbody>
               </table>
 
-              {result.isNewAccount && !aliasSaved && (
+              {!isPortfolioResult && !isBrokerResult && result.isNewAccount && !aliasSaved && (
                 <div className="import-result__alias">
                   <label className="import-result__alias-label">Алиас для нового счёта</label>
                   <div className="import-result__alias-row">

frontend/src/components/Layout.tsx

@@ -104,7 +104,7 @@ export function Layout({ children }: { children: ReactNode }) {
             <span className="sidebar__version">
               FE {__FE_VERSION__} · BE {beVersion ?? '…'}
             </span>
-            <span className="sidebar__copyright">© 2025 Семейный бюджет</span>
+            <span className="sidebar__copyright">© 2025–2026 Семейный бюджет</span>
           </div>
         </div>
       </aside>

frontend/src/components/SummaryCards.tsx

@@ -40,6 +40,8 @@ export function SummaryCards({ summary }: Props) {
         </div>
         <div className="summary__subvalue">Поступило: {formatAmount(summary.cashInflow)}</div>
         <div className="summary__subvalue">Списано: {formatAmount(summary.cashOutflow)}</div>
+        <div className="summary__subvalue">Доход от процентов: {formatAmount(summary.interestIncome)}</div>
+        <div className="summary__subvalue">Кэшбек: {formatAmount(summary.cashbackIncome)}</div>
         {(summary.transferInflow > 0 || summary.transferOutflow > 0) && (
           <div className="summary__subvalue">
             Переводы: {formatAmount(summary.transferInflow)} / {formatAmount(summary.transferOutflow)}

frontend/src/components/TransactionFilters.tsx

@@ -187,7 +187,7 @@ export function TransactionFilters({
             <option value="">Все счета</option>
             {accounts.map((a) => (
               <option key={a.id} value={a.id}>
-                {a.alias || a.accountNumberMasked}
+                {[a.alias || a.accountNumberMasked, ({ brokerage: 'Брокерский', iis: 'ИИС', savings: 'Накопительный', current: 'Текущий' } as Record<string, string>)[a.accountType ?? ''], a.status === 'closed' ? 'закрытый' : 'действующий'].filter(Boolean).join(' · ')}
               </option>
             ))}
           </select>

frontend/src/pages/AnalyticsPage.tsx

@@ -1,12 +1,14 @@
 import { useState, useEffect, useCallback } from 'react';
 import type {
   Account,
+  Category,
   AnalyticsSummaryResponse,
   ByCategoryItem,
   TimeseriesItem,
   Granularity,
 } from '@family-budget/shared';
 import { getAccounts } from '../api/accounts';
+import { getCategories } from '../api/categories';
 import { getSummary, getByCategory, getTimeseries } from '../api/analytics';
 import {
   PeriodSelector,
@@ -29,8 +31,10 @@ function getDefaultPeriod(): PeriodState {
 export function AnalyticsPage() {
   const [period, setPeriod] = useState<PeriodState>(getDefaultPeriod);
   const [accountId, setAccountId] = useState<string>('');
+  const [categoryId, setCategoryId] = useState<string>('');
   const [onlyConfirmed, setOnlyConfirmed] = useState(false);
   const [accounts, setAccounts] = useState<Account[]>([]);
+  const [categories, setCategories] = useState<Category[]>([]);
   const [summary, setSummary] = useState<AnalyticsSummaryResponse | null>(
     null,
   );
@@ -40,6 +44,7 @@ export function AnalyticsPage() {
 
   useEffect(() => {
     getAccounts().then(setAccounts).catch(() => {});
+    getCategories({ isActive: true }).then(setCategories).catch(() => {});
   }, []);
 
   const fetchAll = useCallback(async () => {
@@ -63,6 +68,7 @@ export function AnalyticsPage() {
       from: period.from,
       to: period.to,
       ...(accountId ? { accountId: Number(accountId) } : {}),
+      ...(categoryId !== '' ? { categoryId: Number(categoryId) } : {}),
       ...(onlyConfirmed ? { onlyConfirmed: true } : {}),
     };
 
@@ -80,7 +86,7 @@ export function AnalyticsPage() {
     } finally {
       setLoading(false);
     }
-  }, [period, accountId, onlyConfirmed]);
+  }, [period, accountId, categoryId, onlyConfirmed]);
 
   useEffect(() => {
     fetchAll();
@@ -107,7 +113,7 @@ export function AnalyticsPage() {
               <option value="">Все счета</option>
               {accounts.map((a) => (
                 <option key={a.id} value={a.id}>
-                  {a.alias || a.accountNumberMasked}
+                  {[a.alias || a.accountNumberMasked, ({ brokerage: 'Брокерский', iis: 'ИИС', savings: 'Накопительный', current: 'Текущий' } as Record<string, string>)[a.accountType ?? ''], a.status === 'closed' ? 'закрытый' : 'действующий'].filter(Boolean).join(' · ')}
                 </option>
               ))}
             </select>
@@ -122,6 +128,14 @@ export function AnalyticsPage() {
               Только подтверждённые
             </label>
           </div>
+          <div className="field">
+            <label className="field__label">Категория</label>
+            <select value={categoryId} onChange={(e) => setCategoryId(e.target.value)}>
+              <option value="">Все категории</option>
+              <option value="0">Без категории</option>
+              {categories.map((c) => <option key={c.id} value={c.id}>{c.name}</option>)}
+            </select>
+          </div>
         </div>
       </div>
 

frontend/src/styles/index.css

@@ -242,6 +242,12 @@ button {
   gap: 10px;
 }
 
+.sidebar__meta {
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 4px;
+}
+
 .sidebar__user {
   min-width: 0;
   overflow: hidden;

scripts/convert_vtb_broker_xlsx.py

@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+"""Convert a VTB broker XLSX report to the import JSON formats.
+
+Only the cash-movement section is sent to the existing statement importer.
+Securities are written to a sidecar file for the future portfolio importer.
+"""
+import hashlib
+import json
+import re
+import sys
+import uuid
+from collections import defaultdict
+from datetime import datetime, timedelta
+from decimal import Decimal, ROUND_HALF_UP
+from pathlib import Path
+from zipfile import ZipFile
+from xml.etree import ElementTree as ET
+
+NS = {'m': 'http://schemas.openxmlformats.org/spreadsheetml/2006/main'}
+EPOCH = datetime(1899, 12, 30)
+COLS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+OPERATION_NAMESPACE = uuid.UUID('7a4a1c7d-7d3c-4f53-9f45-5e7dbb2c6f31')
+
+
+def excel_date(value):
+    if value in (None, ''):
+        return None
+    number = float(value)
+    date = EPOCH + timedelta(days=number)
+    return date.isoformat(timespec='seconds') + '+03:00'
+
+
+def excel_day(value):
+    return excel_date(value)[:10] if excel_date(value) else None
+
+
+def kopecks(value):
+    if value in (None, ''):
+        return 0
+    return int((Decimal(str(value)).quantize(Decimal('0.01'), rounding=ROUND_HALF_UP)) * 100)
+
+
+def text(value):
+    return re.sub(r'\s+', ' ', str(value or '')).strip()
+
+
+def read_rows(path):
+    with ZipFile(path) as book:
+        shared_root = ET.fromstring(book.read('xl/sharedStrings.xml'))
+        shared = [text(''.join(node.itertext())) for node in shared_root.findall('m:si', NS)]
+        root = ET.fromstring(book.read('xl/worksheets/sheet1.xml'))
+        rows = []
+        for row in root.findall('.//m:sheetData/m:row', NS):
+            cells = {}
+            for cell in row.findall('m:c', NS):
+                ref = cell.attrib.get('r', '')
+                col = re.match(r'[A-Z]+', ref).group(0)
+                value = cell.find('m:v', NS)
+                raw = value.text if value is not None else ''
+                if cell.attrib.get('t') == 's' and raw:
+                    raw = shared[int(raw)]
+                cells[col] = raw
+            rows.append((int(row.attrib['r']), cells))
+        return rows
+
+
+def row_text(cells):
+    return text(' '.join(str(value) for value in cells.values()))
+
+
+def find_row(rows, phrase, start=0):
+    for index in range(start, len(rows)):
+        if phrase.lower() in row_text(rows[index][1]).lower():
+            return index
+    raise ValueError(f'Не найден раздел: {phrase}')
+
+
+def metadata(rows):
+    account = None
+    period = re.search(r'период с (\d{2}\.\d{2}\.\d{4}) по (\d{2}\.\d{2}\.\d{4})', row_text(dict(rows)))
+    report_date = None
+    for _, cells in rows[:35]:
+        joined = row_text(cells)
+        match = re.search(r'(\d{20})\s*\(RUR\)', joined)
+        account = account or (match.group(1) if match else None)
+        if 'Дата формирования отчета' in joined:
+            for value in cells.values():
+                if value and re.fullmatch(r'\d+(?:\.\d+)?', str(value)):
+                    report_date = excel_day(value)
+    if not account or not period:
+        raise ValueError('Не удалось определить счёт или период отчёта')
+    return account, period.groups(), report_date
+
+
+def cash_transactions(rows, start, end):
+    transactions = []
+    occurrences = defaultdict(int)
+    for number, cells in rows[start + 1:end]:
+        if not cells.get('B') or not cells.get('C') or not cells.get('J'):
+            continue
+        try:
+            operation_at = excel_date(cells['B'])
+            amount = kopecks(cells['C'])
+        except (TypeError, ValueError):
+            continue
+        operation = text(cells.get('J'))
+        comment = text(cells.get('P'))
+        description = text(f'{operation}. {comment}'.strip('. '))
+        digest = hashlib.sha256(f'{operation_at}|{amount}|{description}'.encode()).hexdigest()[:16]
+        occurrences[digest] += 1
+        source_id = f'vtb-broker-cash:{digest}:{occurrences[digest]}'
+        transactions.append({
+            'operationAt': operation_at,
+            'amountSigned': amount,
+            'commission': 0,
+            'description': description,
+            'sourceId': source_id,
+            'operationId': str(uuid.uuid5(OPERATION_NAMESPACE, source_id)),
+            '_sourceRow': number,
+        })
+    if not transactions:
+        raise ValueError('Операции движения денежных средств не найдены')
+    return transactions
+
+
+def portfolio(rows, holdings_start, movement_start, trades_start, trades_end, account, period, report_date):
+    positions = []
+    for number, cells in rows[holdings_start + 1:movement_start]:
+        instrument = text(cells.get('B'))
+        if not instrument or instrument.lower().startswith('итого') or not re.search(r'RU[A-Z0-9]{10}', instrument):
+            continue
+        positions.append({
+            'sourceRow': number,
+            'instrument': instrument,
+            'isin': next((part for part in instrument.split(', ') if re.fullmatch(r'RU[A-Z0-9]{10}', part)), None),
+            'quantity': cells.get('L') or cells.get('M') or cells.get('I') or cells.get('J'),
+            'price': cells.get('P'),
+            'valuation': cells.get('AF') or cells.get('AJ'),
+        })
+    trades = []
+    columns = {'instrument': 'B', 'concludedAt': 'C', 'side': 'F', 'quantity': 'H',
+               'priceCurrency': 'I', 'price': 'J', 'settlementCurrency': 'L',
+               'settlementAmount': 'M', 'nkd': 'O', 'settlementCommission': 'P',
+               'tradeCommission': 'R', 'plannedDeliveryDate': 'S', 'plannedPaymentDate': 'T',
+               'orderId': 'W', 'tradeId': 'Z', 'organizerTradeId': 'AC', 'venue': 'AK',
+               'comment': 'AN'}
+    for number, cells in rows[trades_start + 1:trades_end]:
+        if not cells.get('B') or not cells.get('C') or not cells.get('F'):
+            continue
+        try:
+            concluded_at = excel_date(cells['C'])
+        except (TypeError, ValueError):
+            continue
+        item = {key: text(cells.get(col)) for key, col in columns.items()}
+        item['sourceRow'] = number
+        item['concludedAt'] = concluded_at
+        item['sourceId'] = f"vtb-broker-trade:{item['tradeId'] or number}"
+        item['operationId'] = str(uuid.uuid5(OPERATION_NAMESPACE, item['sourceId']))
+        trades.append(item)
+    return {
+        'schemaVersion': 'broker-portfolio-1.0',
+        'bank': 'VTB_BROKER',
+        'accountNumber': account,
+        'reportPeriod': {'from': datetime.strptime(period[0], '%d.%m.%Y').date().isoformat(),
+                         'to': datetime.strptime(period[1], '%d.%m.%Y').date().isoformat()},
+        'reportedAt': report_date + 'T00:00:00+03:00' if report_date else None,
+        'positions': positions,
+        'trades': trades,
+    }
+
+
+def main():
+    if len(sys.argv) not in (3, 4):
+        raise SystemExit('usage: convert_vtb_broker_xlsx.py INPUT_XLSX CASH_JSON [PORTFOLIO_JSON]')
+    input_path, cash_path = map(Path, sys.argv[1:3])
+    portfolio_path = Path(sys.argv[3]) if len(sys.argv) == 4 else None
+    rows = read_rows(input_path)
+    account, period, report_date = metadata(rows)
+    holdings_start = find_row(rows, 'Отчёт об остатках ценных бумаг')
+    movement_start = find_row(rows, 'Движение ценных бумаг', holdings_start)
+    cash_start = find_row(rows, 'Движение денежных средств')
+    trades_start = find_row(rows, 'Заключенные в отчетном периоде сделки с ценными бумагами')
+    trades_end = find_row(rows, 'Завершенные в отчетном периоде сделки с ценными бумагами', trades_start + 1)
+    transactions = cash_transactions(rows, cash_start, holdings_start)
+    assert len({item['sourceId'] for item in transactions}) == len(transactions), 'sourceId операции не уникальны'
+    opening = kopecks(rows[find_row(rows, 'Отчёт об остатках денежных средств') + 3][1].get('L'))
+    balance_row = rows[find_row(rows, 'Отчёт об остатках денежных средств') + 3][1]
+    closing = kopecks(balance_row.get('AF'))
+    cash = {'schemaVersion': '1.0', 'bank': 'VTB_BROKER',
+            'statement': {'accountNumber': account, 'currency': 'RUB',
+                          'openingBalance': opening, 'closingBalance': closing,
+                          'exportedAt': (report_date or transactions[-1]['operationAt'][:10]) + 'T00:00:00+03:00'},
+            'transactions': [{key: value for key, value in item.items() if not key.startswith('_')}
+                             for item in transactions]}
+    calculated_closing = opening + sum(item['amountSigned'] for item in transactions)
+    if calculated_closing != closing:
+        raise ValueError(f'Баланс не сходится: операции дают {calculated_closing}, XLSX содержит {closing}')
+    cash_path.parent.mkdir(parents=True, exist_ok=True)
+    cash_path.write_text(json.dumps(cash, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
+    duplicate_candidates = len(transactions) - len({item['sourceId'].rsplit(':', 1)[0] for item in transactions})
+    if portfolio_path:
+        portfolio_path.parent.mkdir(parents=True, exist_ok=True)
+        portfolio_path.write_text(json.dumps(portfolio(rows, holdings_start, movement_start, trades_start, trades_end, account, period, report_date), ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
+    print(json.dumps({'transactions': len(transactions), 'cashNet': sum(item['amountSigned'] for item in transactions),
+                      'openingBalance': opening, 'closingBalance': closing, 'duplicateCandidates': duplicate_candidates,
+                      'cashJson': str(cash_path), 'portfolioJson': str(portfolio_path) if portfolio_path else None}, ensure_ascii=False))
+
+
+if __name__ == '__main__':
+    main()

shared/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@family-budget/shared",
-  "version": "0.2.0",
+  "version": "0.6.0",
   "private": true,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

shared/src/types/account.ts

@@ -1,11 +1,18 @@
+export type AccountType = 'brokerage' | 'iis' | 'savings' | 'current';
+export type AccountStatus = 'active' | 'closed';
+
 export interface Account {
   id: number;
   bank: string;
   accountNumberMasked: string;
   currency: string;
   alias: string | null;
+  accountType: AccountType | null;
+  status: AccountStatus;
 }
 
 export interface UpdateAccountRequest {
   alias: string;
+  accountType?: AccountType | null;
+  status?: AccountStatus;
 }

shared/src/types/analytics.ts

@@ -4,6 +4,7 @@ export interface AnalyticsSummaryParams {
   from: string;
   to: string;
   accountId?: number;
+  categoryId?: number;
   onlyConfirmed?: boolean;
 }
 
@@ -23,6 +24,8 @@ export interface AnalyticsSummaryResponse {
   transferInflow: number;
   transferOutflow: number;
   cashNet: number;
+  interestIncome: number;
+  cashbackIncome: number;
   topCategories: TopCategory[];
 }
 
@@ -30,6 +33,7 @@ export interface ByCategoryParams {
   from: string;
   to: string;
   accountId?: number;
+  categoryId?: number;
   onlyConfirmed?: boolean;
 }
 

shared/src/types/category-rule.ts

@@ -26,6 +26,10 @@ export interface CreateCategoryRuleRequest {
   requiresConfirmation?: boolean;
 }
 
+export interface CreateCategoryRuleResponse extends CategoryRule {
+  applied: number;
+}
+
 export interface UpdateCategoryRuleRequest {
   pattern?: string;
   categoryId?: number;

shared/src/types/import.ts

@@ -32,6 +32,10 @@ export interface StatementTransaction {
   amountSigned: number;
   commission: number;
   description: string;
+  /** Stable source-row identity used to make repeated imports idempotent. */
+  sourceId?: string;
+  /** Stable operation UUID emitted by source-specific converters. */
+  operationId?: string;
 }
 
 export interface ImportStatementResponse {
@@ -42,3 +46,55 @@ export interface ImportStatementResponse {
   duplicatesSkipped: number;
   totalInFile: number;
 }
+
+export interface PortfolioFile {
+  schemaVersion: 'broker-portfolio-1.0';
+  bank: string;
+  accountNumber: string;
+  reportPeriod: { from: string; to: string };
+  reportedAt: string | null;
+  positions: PortfolioPosition[];
+  trades: PortfolioTrade[];
+}
+
+export interface PortfolioPosition {
+  instrument: string;
+  isin?: string | null;
+  quantity: string | number;
+  price?: string | number | null;
+  valuation?: string | number | null;
+}
+
+export interface PortfolioTrade {
+  sourceId?: string;
+  operationId?: string;
+  instrument: string;
+  isin?: string | null;
+  concludedAt: string;
+  side: string;
+  quantity: string | number;
+  priceCurrency?: string | null;
+  price?: string | number | null;
+  settlementCurrency?: string | null;
+  settlementAmount?: string | number | null;
+  nkd?: string | number | null;
+  settlementCommission?: string | number | null;
+  tradeCommission?: string | number | null;
+  orderId?: string | null;
+  tradeId?: string | null;
+  venue?: string | null;
+  comment?: string | null;
+}
+
+export interface ImportPortfolioResponse {
+  accountId: number;
+  reportId: number;
+  importedTrades: number;
+  duplicateTrades: number;
+  positions: number;
+}
+
+export interface ImportBrokerReportResponse {
+  cash: ImportStatementResponse;
+  portfolio: ImportPortfolioResponse;
+}

shared/src/types/index.ts

@@ -9,7 +9,7 @@ export type {
   ApiError,
 } from './common';
 
-export type { Account, UpdateAccountRequest } from './account';
+export type { Account, AccountType, AccountStatus, UpdateAccountRequest } from './account';
 
 export type {
   Category,
@@ -24,6 +24,7 @@ export type {
 
 export type {
   CategoryRule,
+  CreateCategoryRuleResponse,
   GetCategoryRulesParams,
   CreateCategoryRuleRequest,
   UpdateCategoryRuleRequest,
@@ -38,6 +39,11 @@ export type {
   StatementTransaction,
   ImportStatementResponse,
   Import,
+  PortfolioFile,
+  PortfolioPosition,
+  PortfolioTrade,
+  ImportPortfolioResponse,
+  ImportBrokerReportResponse,
 } from './import';
 
 export type {