prisma/migrations/20261031150000_add_instrument_classification/migration.sql

@@ -0,0 +1,11 @@
+CREATE TABLE "TbankInstrumentClassification" (
+    "provider" TEXT NOT NULL,
+    "instrumentKey" TEXT NOT NULL,
+    "sector" TEXT,
+    "sectorFetchedAt" DATETIME,
+    "assetUid" TEXT,
+    "brandUid" TEXT,
+    "brandName" TEXT,
+    "brandFetchedAt" DATETIME,
+    PRIMARY KEY ("provider","instrumentKey")
+);

prisma/schema.prisma

@@ -186,6 +186,20 @@ model TbankInstrumentLookup {
   @@id([provider, identifierType, identifier])
 }
 
+// Public per-instrument classification; no holdings or credentials.
+model TbankInstrumentClassification {
+  provider        String
+  instrumentKey   String
+  sector          String?
+  sectorFetchedAt DateTime?
+  assetUid        String?
+  brandUid        String?
+  brandName       String?
+  brandFetchedAt  DateTime?
+
+  @@id([provider, instrumentKey])
+}
+
 // Source records contain no holdings, personal estimates or credentials errors.
 model TbankInstrumentSource {
   provider String

src/integrations/tbank/tbank.client.spec.ts

@@ -236,6 +236,16 @@ describe('TbankClient metadata retries', () => {
     jest.useRealTimers();
   });
 
+  it.each([
+    ['bondBy', (client: TbankClient, optIn: boolean) => client.getBond('token', 'uid', undefined, optIn)],
+    ['etfBy', (client: TbankClient, optIn: boolean) => client.getEtf('token', 'uid', undefined, optIn)],
+    ['getAssetBy', (client: TbankClient, optIn: boolean) => optIn ? client.getAssetBrand('token', 'uid') : client.getAssetDescription('token', 'uid')],
+  ])('%s reports NOT_FOUND only for classification lookups', async (_method, invoke) => {
+    requestRpc.mockRejectedValue({ code: status.NOT_FOUND });
+    await expect(invoke(client, false)).rejects.toBeInstanceOf(ServiceUnavailableException);
+    await expect(invoke(client, true)).rejects.toBeInstanceOf(NotFoundException);
+  });
+
   it.each([
     status.UNAVAILABLE,
     status.DEADLINE_EXCEEDED,

src/integrations/tbank/tbank.client.ts

@@ -375,18 +375,29 @@ export class TbankClient {
     ).then((response) => response.instruments ?? []);
   }
 
-  getBond(token: string, uid: string): Promise<null | TbankBond> {
+  getBond(token: string, uid: string, idType = InstrumentIdType.Uid, notFound = false): Promise<null | TbankBond> {
     return this.call<{ instrument?: TbankBond }>(
       token,
       this.sparseInstruments,
       'bondBy',
       {
-        idType: InstrumentIdType.Uid,
+        idType,
         id: uid,
       },
+      notFound,
     ).then((response) => response.instrument ?? null);
   }
 
+  getEtf(
+    token: string,
+    id: string,
+    idType = InstrumentIdType.Uid,
+    notFound = false,
+  ): Promise<null | Pick<TbankShare, 'assetUid' | 'figi' | 'sector' | 'uid'>> {
+    return this.call<{ instrument?: TbankShare }>(token, this.sparseInstruments, 'etfBy', { idType, id }, notFound)
+      .then((response) => response.instrument ?? null);
+  }
+
   getBondCoupons(
     token: string,
     uid: string,
@@ -405,18 +416,25 @@ export class TbankClient {
     ).then((response) => response.events ?? []);
   }
 
-  getShare(token: string, uid: string): Promise<null | TbankShare> {
+  getShare(token: string, uid: string, idType = InstrumentIdType.Uid, notFound = false): Promise<null | TbankShare> {
     return this.call<{ instrument?: TbankShare }>(
       token,
       this.instruments,
       'shareBy',
       {
-        idType: InstrumentIdType.Uid,
+        idType,
         id: uid,
       },
+      notFound,
     ).then((response) => response.instrument ?? null);
   }
 
+  getAssetBrand(token: string, assetUid: string): Promise<null | { assetUid?: string; brand?: { name?: string; uid?: string } }> {
+    return this.call<{ asset?: { brand?: { name?: string; uid?: string }; uid?: string } }>(
+      token, this.instruments, 'getAssetBy', { id: assetUid }, true,
+    ).then((response) => response.asset ? { assetUid: response.asset.uid, brand: response.asset.brand } : null);
+  }
+
   getAssetDescription(token: string, assetUid: string): Promise<null | string> {
     return this.call<{ asset?: { description?: string } }>(
       token,
@@ -514,6 +532,7 @@ export class TbankClient {
     client: TbankClientService,
     method: string,
     request: object,
+    notFound = false,
   ): Promise<Response> {
     const metadataCall = method === 'getInstrumentBy';
     for (let attempts = FIRST_ATTEMPT; attempts <= RPC_MAX_ATTEMPTS; attempts += ATTEMPT_INCREMENT) {
@@ -576,7 +595,7 @@ export class TbankClient {
         }
         if (
           grpcCode === status.NOT_FOUND &&
-          (method === 'shareBy' || metadataCall)
+          (notFound || method === 'shareBy' || metadataCall)
         ) {
           throw new NotFoundException();
         }

src/modules/investments/instruments/application/instrument-position.spec.ts

@@ -22,6 +22,8 @@ const row = (
   isin: null,
   ticker: null,
   logoName: null,
+  sector: null,
+  issuer: null,
 });
 const portfolio = (positions: PortfolioPositionDto[]): PortfolioDto => ({
   positions,

src/modules/investments/portfolio/application/portfolio.service.spec.ts

@@ -6,9 +6,10 @@ import { PortfolioDto } from '../presentation/portfolio.dto';
 import { PortfolioService } from './portfolio.service';
 
 describe('persistent portfolio projection', () => {
-  const access = { local: jest.fn(), tokenForAttempt: jest.fn() };
+  const access = { local: jest.fn(), tokenForAttempt: jest.fn(), rejectMembershipToken: jest.fn() };
   const tbank = { getPortfolio: jest.fn(), getPositions: jest.fn() };
   const metadata = { savedMany: jest.fn(), request: jest.fn() };
+  const classification = { refresh: jest.fn() };
   const repository = {
     read: jest.fn(),
     reserve: jest.fn(),
@@ -23,6 +24,7 @@ describe('persistent portfolio projection', () => {
       access as never,
       tbank as never,
       metadata as never,
+      classification as never,
       repository as never,
       { request: jest.fn().mockResolvedValue(null) } as never,
       { event: jest.fn() } as never,
@@ -34,6 +36,7 @@ describe('persistent portfolio projection', () => {
       accounts: [{ accountId: 'a' }, { accountId: 'b' }],
     });
     access.tokenForAttempt.mockResolvedValue('synthetic');
+    access.rejectMembershipToken.mockResolvedValue(undefined);
     repository.reserve.mockResolvedValue(null);
     repository.read.mockResolvedValue({
       membershipAt,
@@ -44,6 +47,37 @@ describe('persistent portfolio projection', () => {
     repository.publish.mockResolvedValue(true);
     metadata.savedMany.mockResolvedValue(new Map());
     metadata.request.mockResolvedValue(null);
+    classification.refresh.mockResolvedValue(new Map());
+  });
+  it('refreshes classification before publishing and passes the hourly walk time', async () => {
+    const walkStartedAt = new Date('2026-10-31T12:00:00Z');
+    const position = { instrumentType: 'share', instrumentUid: 'uid', figi: 'figi', quantity: { units: '1' } };
+    repository.reserve.mockResolvedValue({ launch: true, work: { id: 'work', attemptId: 'attempt' } });
+    tbank.getPortfolio.mockResolvedValue({ positions: [position] });
+    tbank.getPositions.mockResolvedValue({ money: [] });
+    classification.refresh.mockResolvedValue(new Map([[JSON.stringify(['uid', 'figi']), {
+      sector: 'Energy', issuer: { id: 'issuer', name: 'Issuer' },
+    }]]));
+    const handle = await service.request('user', 'private', 'a', true, walkStartedAt);
+    assert(handle);
+    await handle.done;
+    expect(classification.refresh).toHaveBeenCalledWith('synthetic', [position], walkStartedAt);
+    expect(classification.refresh.mock.invocationCallOrder[0]).toBeLessThan(repository.publish.mock.invocationCallOrder[0]);
+    const snapshot = (repository.publish.mock.calls as [unknown, string, PortfolioDto][])[0][2];
+    expect(snapshot.positions[0]).toEqual(expect.objectContaining({
+      sector: 'Energy', issuer: { id: 'issuer', name: 'Issuer' },
+    }));
+  });
+  it('rejects an invalid classification token without publishing the snapshot', async () => {
+    repository.reserve.mockResolvedValue({ launch: true, work: { id: 'work', attemptId: 'attempt' } });
+    tbank.getPortfolio.mockResolvedValue({ positions: [] });
+    tbank.getPositions.mockResolvedValue({ money: [] });
+    classification.refresh.mockRejectedValue(new Error('INVALID_TBANK_TOKEN'));
+    const handle = await service.request('user', 'private', 'a');
+    assert(handle);
+    await handle.done;
+    expect(repository.publish).not.toHaveBeenCalled();
+    expect(access.rejectMembershipToken).toHaveBeenCalled();
   });
   it('normalizes exact signed money, order, UID metadata and unknown types without metadata RPC', async () => {
     repository.reserve.mockResolvedValueOnce({

src/modules/investments/portfolio/application/portfolio.service.ts

@@ -30,6 +30,7 @@ import {
 } from '../infrastructure/portfolio.repository';
 import { mapPortfolio } from '../infrastructure/tbank-portfolio.mapper';
 import { PortfolioDto } from '../presentation/portfolio.dto';
+import { type Classification, PositionClassificationService } from './position-classification.service';
 
 const MISSING_DATA_REVISION = 0;
 const NO_ACCOUNTS = 0;
@@ -46,6 +47,7 @@ export class PortfolioService {
     private readonly access: TbankAccessService,
     private readonly tbank: TbankClient,
     private readonly metadata: InstrumentMetadataService,
+    private readonly classification: PositionClassificationService,
     private readonly repository: PortfolioRepository,
     private readonly membership: TbankMembershipService,
     private readonly logger: StructuredLogger,
@@ -88,6 +90,11 @@ export class PortfolioService {
           snapshot: account.portfolio
             ? {
                 ...(account.portfolio.payload as unknown as PortfolioDto),
+                positions: (account.portfolio.payload as unknown as PortfolioDto).positions.map((position) => ({
+                  ...position,
+                  sector: position.sector ?? null,
+                  issuer: position.issuer ?? null,
+                })),
                 lastSuccessfulAt: account.portfolio.fetchedAt.toISOString(),
                 isStale:
                   Date.now() - account.portfolio.fetchedAt.valueOf() >=
@@ -231,8 +238,8 @@ export class PortfolioService {
     };
   }
 
-  request(userId: string, revision: string, accountId: string, force = false) {
-    return this.queueSnapshot(userId, revision, accountId, force);
+  request(userId: string, revision: string, accountId: string, force = false, walkStartedAt?: Date) {
+    return this.queueSnapshot(userId, revision, accountId, force, walkStartedAt);
   }
 
   private queueSnapshot(
@@ -240,6 +247,7 @@ export class PortfolioService {
     revision: string,
     accountId: string,
     force = false,
+    walkStartedAt = new Date(),
   ) {
     const reserved = this.reservations.then(async () => {
       const requested = await this.repository.reserve(
@@ -268,9 +276,11 @@ export class PortfolioService {
               this.tbank.getPortfolio(token, accountId),
               this.tbank.getPositions(token, accountId),
             ]);
+            const classifications = await this.classification.refresh(token, portfolio.positions ?? [], walkStartedAt);
             const snapshot = await this.normalize(
               portfolio.positions ?? [],
               positions.money ?? [],
+              classifications,
             );
             const published = await this.repository.publish(
               attempt,
@@ -309,9 +319,10 @@ export class PortfolioService {
   private async normalize(
     upstream: NonNullable<TbankPortfolio['positions']>,
     money: TbankMoney[],
+    classifications: ReadonlyMap<string, Classification>,
   ): Promise<PortfolioDto> {
     const lastSuccessfulAt = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
     const savedMetadata = await this.metadata.savedMany(upstream);
-    return mapPortfolio(upstream, money, savedMetadata, lastSuccessfulAt);
+    return mapPortfolio(upstream, money, savedMetadata, lastSuccessfulAt, classifications);
   }
 }

src/modules/investments/portfolio/application/position-classification.service.spec.ts

@@ -0,0 +1,172 @@
+import { NotFoundException } from '@nestjs/common';
+
+jest.mock('../../../../prisma/prisma.service', () => ({ PrismaService: class {} }));
+import { TbankErrorCode } from '../../../../integrations/tbank/tbank-error-code';
+import { InstrumentIdType } from '../../../../integrations/tbank/tbank-protocol';
+import { PositionClassificationService } from './position-classification.service';
+
+describe('PositionClassificationService', () => {
+  const position = { instrumentType: 'share', instrumentUid: 'uid', figi: 'figi', quantity: { units: 1 } };
+  const saved = { sector: 'Old', sectorFetchedAt: new Date('2026-10-30T12:00:00Z'), assetUid: 'asset', brandUid: 'brand', brandName: 'Old brand', brandFetchedAt: new Date('2026-10-30T12:00:00Z') };
+  const tbank = { getShare: jest.fn(), getAssetBrand: jest.fn(), getBond: jest.fn(), getEtf: jest.fn() };
+  const repository = { read: jest.fn(), save: jest.fn() };
+  const logger = { event: jest.fn() };
+  const service = new PositionClassificationService(tbank as never, repository as never, logger as never);
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    repository.read.mockResolvedValue(saved);
+    repository.save.mockImplementation((_key: string, update: Record<string, unknown>) => Promise.resolve({ ...saved, ...update }));
+    tbank.getAssetBrand.mockResolvedValue({ assetUid: 'asset', brand: { uid: 'new-brand', name: 'New brand' } });
+  });
+
+  it('does not fetch a value at 23:59, and refreshes it at 24:00', async () => {
+    await service.refresh('token', [position], new Date('2026-10-31T11:59:00Z'));
+    expect(tbank.getShare).not.toHaveBeenCalled();
+    tbank.getShare.mockResolvedValue({ uid: 'uid', figi: 'figi', sector: ' Tech ', assetUid: 'asset' });
+    const result = await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(result.values().next().value).toEqual({ sector: 'Tech', issuer: { id: 'new-brand', name: 'New brand' } });
+    expect(repository.save).toHaveBeenCalledWith(expect.any(String), {
+      sector: 'Tech', sectorFetchedAt: new Date('2026-10-31T12:00:00Z'),
+      brandUid: 'new-brand', brandName: 'New brand', brandFetchedAt: new Date('2026-10-31T12:00:00Z'),
+    });
+  });
+
+  it('accepts a matching FIGI after UID NOT_FOUND', async () => {
+    tbank.getShare.mockRejectedValueOnce(new NotFoundException()).mockResolvedValueOnce({ uid: 'different', figi: 'figi', sector: 'Energy', assetUid: 'asset' });
+    const result = await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(tbank.getShare).toHaveBeenNthCalledWith(2, 'token', 'figi', InstrumentIdType.Figi, true);
+    expect(result.values().next().value?.sector).toBe('Energy');
+  });
+
+  it('preserves saved values on mismatched instrument and returns refreshed values on database failure', async () => {
+    tbank.getShare.mockResolvedValue({ uid: 'wrong', sector: 'Energy' });
+    const result = await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(result.values().next().value?.sector).toBe('Old');
+    repository.save.mockRejectedValue(new Error('db unavailable'));
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy', assetUid: 'asset' });
+    const fallback = await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(fallback.values().next().value?.sector).toBe('Energy');
+    expect(logger.event).toHaveBeenCalled();
+  });
+
+  it('does not retain an issuer from a previous asset when the asset changes', async () => {
+    repository.read.mockResolvedValue({ ...saved, brandFetchedAt: new Date('2026-10-31T12:00:00Z') });
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy', assetUid: 'other' });
+    tbank.getAssetBrand.mockResolvedValue({ assetUid: 'other', brand: { uid: 'other-brand', name: 'Other brand' } });
+    const result = await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(tbank.getAssetBrand).toHaveBeenCalledWith('token', 'other');
+    expect(result.values().next().value?.issuer).toEqual({ id: 'other-brand', name: 'Other brand' });
+  });
+
+  it('does not restart the brand clock when the brand fetch fails after an asset change', async () => {
+    repository.read.mockResolvedValue({ ...saved, brandFetchedAt: new Date('2026-10-31T12:00:00Z') });
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy', assetUid: 'other' });
+    tbank.getAssetBrand.mockRejectedValue(new Error('upstream unavailable'));
+    const result = await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(result.values().next().value?.issuer).toBeNull();
+    expect(repository.save).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+      assetUid: 'other', brandUid: null, brandName: null, brandFetchedAt: null,
+    }));
+  });
+
+  it('does not return the previous asset brand when saving a changed asset fails', async () => {
+    repository.save.mockRejectedValue(new Error('db unavailable'));
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy', assetUid: 'other' });
+    tbank.getAssetBrand.mockRejectedValue(new Error('upstream unavailable'));
+    const result = await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(result.values().next().value).toEqual({ sector: 'Energy', issuer: null });
+    expect(repository.save).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+      assetUid: 'other', brandUid: null, brandName: null, brandFetchedAt: null,
+    }));
+    expect(logger.event).toHaveBeenCalled();
+  });
+
+  it('records a fetched brand as null when a fresh instrument has no asset_uid', async () => {
+    repository.read.mockResolvedValue(null);
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy' });
+    await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(repository.save).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+      brandUid: null, brandName: null, brandFetchedAt: new Date('2026-10-31T12:00:00Z'),
+    }));
+  });
+
+  it('treats a NOT_FOUND answer as fetched and does not refetch it an hour later', async () => {
+    tbank.getShare.mockRejectedValue(new NotFoundException());
+    await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(repository.save).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+      sector: null, sectorFetchedAt: new Date('2026-10-31T12:00:00Z'),
+    }));
+    repository.read.mockResolvedValue({ ...saved, sector: null, sectorFetchedAt: new Date('2026-10-31T12:00:00Z'), assetUid: null, brandUid: null, brandName: null, brandFetchedAt: new Date('2026-10-31T12:00:00Z') });
+    tbank.getShare.mockClear();
+    await service.refresh('token', [position], new Date('2026-10-31T13:00:00Z'));
+    expect(tbank.getShare).not.toHaveBeenCalled();
+  });
+
+  it('records a missing brand and restarts its clock when NOT_FOUND has no saved asset UID', async () => {
+    repository.read.mockResolvedValue(null);
+    tbank.getShare.mockRejectedValue(new NotFoundException());
+    const startedAt = new Date('2026-10-31T12:00:00Z');
+    const result = await service.refresh('token', [position], startedAt);
+    expect(result.values().next().value).toEqual({ sector: null, issuer: null });
+    expect(repository.save).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+      brandUid: null, brandName: null, brandFetchedAt: startedAt,
+    }));
+    expect(tbank.getAssetBrand).not.toHaveBeenCalled();
+  });
+
+  it('does not leak one refresh call\'s invalid token into another call', async () => {
+    tbank.getShare.mockRejectedValueOnce(new Error(TbankErrorCode.InvalidToken))
+      .mockResolvedValueOnce({ uid: 'uid', figi: 'figi', sector: 'Energy', assetUid: 'asset' });
+    await expect(service.refresh('first', [position], new Date('2026-10-31T12:00:00Z'))).rejects.toThrow();
+    const result = await service.refresh('second', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(result.values().next().value?.sector).toBe('Energy');
+  });
+
+  it('propagates an invalid token before publishing a classification', async () => {
+    tbank.getShare.mockRejectedValue(new Error(TbankErrorCode.InvalidToken));
+    const result = service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    await expect(result).rejects.toThrow(TbankErrorCode.InvalidToken);
+    expect(repository.save).not.toHaveBeenCalled();
+  });
+
+  it('leaves a fresh brand untouched when the sector refresh finds the same asset', async () => {
+    repository.read.mockResolvedValue({ ...saved, brandFetchedAt: new Date('2026-10-31T12:00:00Z') });
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy', assetUid: 'asset' });
+    await service.refresh('token', [position], new Date('2026-10-31T12:00:00Z'));
+    expect(tbank.getAssetBrand).not.toHaveBeenCalled();
+  });
+
+  it('skips unsupported types, zero-quantity positions, and shares a brand lookup across instruments', async () => {
+    repository.read.mockResolvedValue(null);
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy', assetUid: 'asset' });
+    tbank.getBond.mockResolvedValue({ uid: 'bond', sector: 'Energy', assetUid: 'asset' });
+    const result = await service.refresh('token', [
+      { instrumentType: 'currency', instrumentUid: 'cash', figi: 'cash', quantity: { units: 1 } },
+      { instrumentType: 'share', instrumentUid: 'empty', figi: 'empty', quantity: {} },
+      { instrumentType: 'Share', instrumentUid: 'upper', figi: 'upper', quantity: { units: 1 } },
+      position,
+      { instrumentType: 'bond', instrumentUid: 'bond', figi: 'bond-figi', quantity: { units: 1 } },
+    ], new Date('2026-10-31T12:00:00Z'));
+    expect(result.size).toBe(3);
+    expect(tbank.getAssetBrand).toHaveBeenCalledTimes(1);
+    expect(tbank.getEtf).not.toHaveBeenCalled();
+  });
+
+  it('skips duplicate instrument keys and retries a failed asset lookup for another instrument in the same walk', async () => {
+    repository.read.mockResolvedValue(null);
+    tbank.getShare.mockResolvedValue({ uid: 'uid', sector: 'Energy', assetUid: 'asset' });
+    tbank.getBond.mockResolvedValue({ uid: 'bond', sector: 'Energy', assetUid: 'asset' });
+    tbank.getAssetBrand.mockRejectedValueOnce(new Error('upstream unavailable'))
+      .mockResolvedValueOnce({ assetUid: 'asset', brand: { uid: 'new-brand', name: 'New brand' } });
+    const result = await service.refresh('token', [position, position,
+      { instrumentType: 'bond', instrumentUid: 'bond', figi: 'bond-figi', quantity: { units: 1 } },
+    ], new Date('2026-10-31T12:00:00Z'));
+    expect(result.size).toBe(2);
+    expect(tbank.getShare).toHaveBeenCalledTimes(1);
+    expect(tbank.getAssetBrand).toHaveBeenCalledTimes(2);
+    expect([...result.values()].map(({ issuer }) => issuer)).toEqual([
+      null, { id: 'new-brand', name: 'New brand' },
+    ]);
+  });
+});

src/modules/investments/portfolio/application/position-classification.service.ts

@@ -0,0 +1,184 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+
+import { isZero } from '../../../../common/decimal';
+import { StructuredLogger } from '../../../../common/logging/structured-logger.service';
+import { MILLISECONDS_PER_DAY } from '../../../../common/time';
+import { decimal } from '../../../../integrations/tbank/decimal';
+import { isTbankErrorCode, TbankErrorCode } from '../../../../integrations/tbank/tbank-error-code';
+import { InstrumentIdType } from '../../../../integrations/tbank/tbank-protocol';
+import { metadataKey, TbankClient, type TbankPortfolio } from '../../../../integrations/tbank/tbank.api';
+import { PositionClassificationRepository } from '../infrastructure/position-classification.repository';
+
+export type Classification = { issuer: null | { id: string; name: string }; sector: null | string };
+type Position = NonNullable<TbankPortfolio['positions']>[number];
+type Instrument = { assetUid?: string; figi?: string; sector?: string; uid?: string };
+type Row = NonNullable<Awaited<ReturnType<PositionClassificationRepository['read']>>>;
+type Update = Parameters<PositionClassificationRepository['save']>[1];
+
+@Injectable()
+export class PositionClassificationService {
+  constructor(
+    private readonly tbank: TbankClient,
+    private readonly repository: PositionClassificationRepository,
+    private readonly logger: StructuredLogger,
+  ) {}
+
+  async refresh(token: string, positions: Position[], walkStartedAt: Date): Promise<Map<string, Classification>> {
+    const result = new Map<string, Classification>();
+    const inFlight = new Map<string, Promise<unknown>>();
+    for (const position of positions) {
+      if (!['bond', 'etf', 'share'].includes((position.instrumentType ?? '').toLowerCase())) continue;
+      if (isZero(decimal(position.quantity ?? {}))) continue;
+      const key = metadataKey(position);
+      if (result.has(key)) continue;
+      result.set(key, await this.refreshOne(token, position, key, walkStartedAt, inFlight));
+    }
+    return result;
+  }
+
+  private async refreshOne(token: string, position: Position, key: string, startedAt: Date,
+    inFlight: Map<string, Promise<unknown>>): Promise<Classification> {
+    let saved: null | Row = null;
+    const update: Update = {};
+    try {
+      saved = await this.repository.read(key);
+      const due = (at: Date | null | undefined) => !at || startedAt.valueOf() - at.valueOf() >= MILLISECONDS_PER_DAY;
+      const sectorDue = due(saved?.sectorFetchedAt);
+      const brandDue = due(saved?.brandFetchedAt);
+      let assetUid = saved?.assetUid ?? null;
+      let instrumentFresh = false;
+      if (sectorDue || (brandDue && !saved?.assetUid)) {
+        const instrument = await this.refreshInstrument(token, position, sectorDue, assetUid, update, startedAt);
+        assetUid = instrument.assetUid;
+        instrumentFresh = instrument.fresh;
+      }
+      const assetChanged = 'assetUid' in update && update.assetUid !== saved?.assetUid;
+      if (assetChanged) {
+        update.brandUid = null;
+        update.brandName = null;
+        update.brandFetchedAt = null;
+      }
+      if (brandDue || assetChanged) {
+        await this.refreshBrand(token, assetUid, update, startedAt, inFlight, instrumentFresh);
+      }
+      if (Object.keys(update).length) saved = await this.repository.save(key, update);
+    } catch (error) {
+      if (this.invalidToken(error)) throw error;
+      this.failed(error);
+    }
+    const current = { ...saved, ...update };
+    return {
+      issuer: current.brandUid && current.brandName ? { id: current.brandUid, name: current.brandName } : null,
+      sector: current.sector ?? null,
+    };
+  }
+
+  private async refreshInstrument(token: string, position: Position, sectorDue: boolean, savedUid: null | string,
+    update: Update, startedAt: Date): Promise<{ assetUid: null | string; fresh: boolean }> {
+    try {
+      const lookup = await this.instrument(token, position);
+      if (lookup && !this.matches(lookup)) return { assetUid: savedUid, fresh: false };
+      if (lookup) return { assetUid: this.acceptInstrument(lookup.found, savedUid, sectorDue, update, startedAt), fresh: true };
+      if (sectorDue) this.clearSector(update, startedAt);
+    } catch (error) {
+      if (this.invalidToken(error)) throw error;
+      if (error instanceof NotFoundException) {
+        if (sectorDue) this.clearSector(update, startedAt);
+      } else this.failed(error);
+    }
+    return { assetUid: savedUid, fresh: false };
+  }
+
+  private clearSector(update: Update, startedAt: Date) {
+    update.sector = null;
+    update.sectorFetchedAt = startedAt;
+  }
+
+  private acceptInstrument(found: Instrument, savedUid: null | string, sectorDue: boolean, update: Update, startedAt: Date) {
+    const assetUid = found.assetUid?.trim() || null;
+    if (assetUid !== savedUid) update.assetUid = assetUid;
+    if (sectorDue) this.setSector(update, found.sector, startedAt);
+    return assetUid;
+  }
+
+  private setSector(update: Update, sector: string | undefined, startedAt: Date) {
+    update.sector = sector?.trim() || null;
+    update.sectorFetchedAt = startedAt;
+  }
+
+  private async refreshBrand(token: string, assetUid: null | string, update: Update, startedAt: Date,
+    inFlight: Map<string, Promise<unknown>>, instrumentFresh: boolean) {
+    if (!assetUid) {
+      if (instrumentFresh || 'assetUid' in update || 'sectorFetchedAt' in update) this.clearBrand(update, startedAt);
+      return;
+    }
+    try {
+      const asset = await this.dedupe(inFlight, assetUid, () => this.tbank.getAssetBrand(token, assetUid));
+      if (asset && asset.assetUid !== assetUid) return;
+      const uid = asset?.brand?.uid?.trim() || null;
+      const name = asset?.brand?.name?.trim() || null;
+      update.brandUid = uid && name ? uid : null;
+      update.brandName = uid && name ? name : null;
+      update.brandFetchedAt = startedAt;
+    } catch (error) {
+      if (this.invalidToken(error)) throw error;
+      if (error instanceof NotFoundException) this.clearBrand(update, startedAt);
+      else this.failed(error);
+    }
+  }
+
+  private clearBrand(update: Update, startedAt: Date) {
+    update.brandUid = null;
+    update.brandName = null;
+    update.brandFetchedAt = startedAt;
+  }
+
+  private matches(lookup: { found: Instrument; id: string; idType: InstrumentIdType }) {
+    return (lookup.idType === InstrumentIdType.Uid ? lookup.found.uid : lookup.found.figi) === lookup.id;
+  }
+
+  private invalidToken(error: unknown) {
+    return error instanceof Error && isTbankErrorCode(error.message, TbankErrorCode.InvalidToken);
+  }
+
+  private async instrument(token: string, position: Position) {
+    const type = (position.instrumentType ?? '').toLowerCase();
+    const lookup = (id: string, idType: InstrumentIdType) => {
+      switch (type) {
+        case 'bond': return this.tbank.getBond(token, id, idType, true);
+        case 'share': return this.tbank.getShare(token, id, idType, true);
+        default: return this.tbank.getEtf(token, id, idType, true);
+      }
+    };
+    const uid = position.instrumentUid?.trim();
+    const figi = position.figi?.trim();
+    if (uid) {
+      try {
+        const found = await lookup(uid, InstrumentIdType.Uid);
+        if (found) return { found, id: uid, idType: InstrumentIdType.Uid };
+      } catch (error) {
+        if (!(error instanceof NotFoundException)) throw error;
+      }
+    }
+    if (figi) {
+      const found = await lookup(figi, InstrumentIdType.Figi);
+      return found ? { found, id: figi, idType: InstrumentIdType.Figi } : null;
+    }
+    return null;
+  }
+
+  private dedupe<T>(map: Map<string, Promise<unknown>>, key: string, run: () => Promise<T>): Promise<T> {
+    const pending = map.get(key);
+    if (pending) return pending as Promise<T>;
+    const promise = run().catch((error: unknown) => {
+      map.delete(key);
+      throw error;
+    });
+    map.set(key, promise);
+    return promise;
+  }
+
+  private failed(error: unknown) {
+    this.logger.event('warn', 'portfolio.classification.failed', { code: error instanceof Error ? error.name : 'Unknown' });
+  }
+}

src/modules/investments/portfolio/domain/portfolio-structure.spec.ts

@@ -14,6 +14,8 @@ const position = (
   isin: null,
   ticker: null,
   logoName: null,
+  sector: null,
+  issuer: null,
   absoluteReturn: null,
   averagePurchasePrice: null,
 });

src/modules/investments/portfolio/infrastructure/position-classification.repository.ts

@@ -0,0 +1,29 @@
+import { Injectable } from '@nestjs/common';
+
+import { PrismaService } from '../../../../prisma/prisma.service';
+
+@Injectable()
+export class PositionClassificationRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  read(key: string) {
+    return this.prisma.tbankInstrumentClassification.findUnique({
+      where: { provider_instrumentKey: { provider: 'tbank', instrumentKey: key } },
+    });
+  }
+
+  save(key: string, data: {
+    assetUid?: null | string;
+    brandFetchedAt?: Date | null;
+    brandName?: null | string;
+    brandUid?: null | string;
+    sector?: null | string;
+    sectorFetchedAt?: Date;
+  }) {
+    return this.prisma.tbankInstrumentClassification.upsert({
+      where: { provider_instrumentKey: { provider: 'tbank', instrumentKey: key } },
+      create: { provider: 'tbank', instrumentKey: key, ...data },
+      update: data,
+    });
+  }
+}

src/modules/investments/portfolio/infrastructure/tbank-portfolio.mapper.ts

@@ -1,4 +1,5 @@
 import type { Money } from '../../../../common/money.types';
+import type { Classification } from '../application/position-classification.service';
 import type { PortfolioDto, PortfolioPositionDto } from '../presentation/portfolio.dto';
 
 import {
@@ -35,9 +36,10 @@ function mapPortfolio(
   cash: TbankMoney[],
   metadata: ReadonlyMap<string, { data?: null | TbankInstrument }>,
   lastSuccessfulAt: string,
+  classification: ReadonlyMap<string, Classification> = new Map(),
 ): PortfolioDto {
   const positions = upstream
-    .map((position) => mapPosition(position, metadata.get(metadataKey(position))?.data ?? null))
+    .map((position) => mapPosition(position, metadata.get(metadataKey(position))?.data ?? null, classification.get(metadataKey(position))))
     .filter((position): position is PortfolioPositionDto => position !== null);
   const balances = new Map<string, ReturnType<typeof decimal>>();
   for (const value of cash) {
@@ -63,6 +65,7 @@ function mapPortfolio(
 function mapPosition(
   position: NonNullable<TbankPortfolio['positions']>[number],
   metadata: null | TbankInstrument,
+  classification?: Classification,
 ): null | PortfolioPositionDto {
   const quantity = decimal(position.quantity ?? {});
   if (isZero(quantity)) return null;
@@ -96,6 +99,8 @@ function mapPosition(
     isin: metadata?.isin?.trim() || null,
     ticker: metadata?.ticker?.trim() || null,
     logoName: metadata?.brand?.logoName?.trim() || null,
+    sector: classification?.sector ?? null,
+    issuer: classification?.issuer ?? null,
   };
 }
 

src/modules/investments/portfolio/portfolio.module.ts

@@ -5,8 +5,10 @@ import { AuthModule } from '../../auth/auth.module';
 import { TbankSyncRepositoryModule } from '../tbank-sync/tbank-sync-repository.module';
 import { ForecastService } from './application/forecast.service';
 import { PortfolioService } from './application/portfolio.service';
+import { PositionClassificationService } from './application/position-classification.service';
 import { ForecastRepository } from './infrastructure/forecast.repository';
 import { PortfolioRepository } from './infrastructure/portfolio.repository';
+import { PositionClassificationRepository } from './infrastructure/position-classification.repository';
 import { PortfolioController } from './presentation/portfolio.controller';
 
 @Module({
@@ -15,6 +17,8 @@ import { PortfolioController } from './presentation/portfolio.controller';
   providers: [
     PortfolioService,
     PortfolioRepository,
+    PositionClassificationService,
+    PositionClassificationRepository,
     ForecastService,
     ForecastRepository,
   ],

src/modules/investments/portfolio/presentation/portfolio.dto.ts

@@ -4,6 +4,14 @@ import { MoneyDto } from '../../../../common/money.dto';
 import { AccountReferenceDto } from '../../account-reference.dto';
 import { InvestmentResourceMetaDto } from '../../investment-resource.dto';
 
+export class PortfolioIssuerDto {
+  @ApiProperty()
+  declare id: string;
+
+  @ApiProperty()
+  declare name: string;
+}
+
 export class PortfolioPositionDto {
   @ApiPropertyOptional({ type: String, nullable: true })
   instrumentUid?: null | string;
@@ -52,6 +60,12 @@ export class PortfolioPositionDto {
 
   @ApiProperty({ type: String, nullable: true })
   declare logoName: null | string;
+
+  @ApiProperty({ type: String, nullable: true })
+  declare sector: null | string;
+
+  @ApiProperty({ type: PortfolioIssuerDto, nullable: true })
+  declare issuer: null | PortfolioIssuerDto;
 }
 
 export class PortfolioStructureCategoryDto {

src/modules/investments/tbank-sync/tbank-hourly.scheduler.ts

@@ -132,6 +132,7 @@ export class TbankHourlyScheduler implements OnModuleDestroy, OnModuleInit {
   // upstream call inside one. The attempt outcome is derived from durable
   // step rows by the repository, never from walk-local state.
   private async walk(attempt: TbankSyncAttempt) {
+    const walkStartedAt = new Date();
     this.active.add(attempt.attemptId);
     try {
       const { userId, revision } = attempt;
@@ -155,6 +156,7 @@ export class TbankHourlyScheduler implements OnModuleDestroy, OnModuleInit {
         accounts,
         dispatch,
         dispatchProblems,
+        walkStartedAt,
       );
       await this.waitWorks(userId, children.map((child) => child.id));
       for (const account of accounts) {
@@ -239,6 +241,7 @@ export class TbankHourlyScheduler implements OnModuleDestroy, OnModuleInit {
     accounts: Accounts,
     dispatch: DispatchStep,
     dispatchProblems: HourlySection[],
+    walkStartedAt: Date,
   ) {
     for (const account of accounts) {
       await this.dispatchPortfolio(
@@ -247,6 +250,7 @@ export class TbankHourlyScheduler implements OnModuleDestroy, OnModuleInit {
         account.accountId,
         dispatch,
         dispatchProblems,
+        walkStartedAt,
       );
     }
     for (const account of accounts) {
@@ -274,10 +278,11 @@ export class TbankHourlyScheduler implements OnModuleDestroy, OnModuleInit {
     accountId: string,
     dispatch: DispatchStep,
     dispatchProblems: HourlySection[],
+    walkStartedAt: Date,
   ) {
     try {
       const work = await this.withBound(
-        this.portfolio.request(userId, revision, accountId, true),
+        this.portfolio.request(userId, revision, accountId, true, walkStartedAt),
       );
       if (work && work !== BOUND_EXPIRED) {
         await dispatch({ accountId, id: work.id, section: 'portfolio' });

test/tbank-value-history.e2e-spec.ts

@@ -298,6 +298,8 @@ describe('T-Bank value history persistence and visibility (SQLite)', () => {
             isin: null,
             ticker: null,
             logoName: null,
+            sector: null,
+            issuer: null,
           },
         ],
         cashBalances: [{ currency: 'USD', value: '50' }],