chore(release): 0.1.0

.ai/CONVENTIONS.md

@@ -12,8 +12,8 @@
 | TS declaration/import/export, domain literals, magic values | [Код](conventions/frontend-ui.md#код-и-components) + [Domain literals](conventions/frontend-ui.md#domain-literals-and-magic-values) |
 | query/mutation, shared/api, server state/cache, generated types, Bearer/refresh | [Data](conventions/frontend-data.md) |
 | Тесты или behavior с testing risk | [Testing](conventions/frontend-testing.md) |
-| Новый abstraction/dependency, refactor или неоднозначный scope | [Общий выбор реализации](../../docs/development/engineering-governance.md#выбор-реализации) |
-| Request/response field, route/status/error shape, OpenAPI snapshot/generated type | [Общий contract workflow](../../docs/development/runtime-openapi-verification.md) |
+| Новый abstraction/dependency, refactor или неоднозначный scope | [Общий выбор реализации](../../AGENTS.md) |
+| Request/response field, route/status/error shape, OpenAPI snapshot/generated type | [Источник HTTP-контракта](../../docs/architecture/http-api.md#источник-контракта) |
 | Login/refresh/logout, token/cookie, auth ownership | Data + [security](../../backend/.ai/conventions/security-auth.md) + Testing |
 | Storybook/theme/tokens/shared UI | UI + точные [источники](SOURCES.md) дизайн-системы/каталога |
 

.ai/SOURCES.md

@@ -3,11 +3,11 @@
 | Что нужно установить | Владелец |
 | --- | --- |
 | Какое implementation-решение принять | [CONVENTIONS](CONVENTIONS.md) |
-| HTTP wire contract и направление генерации | Backend runtime OpenAPI → [snapshot/types workflow](../../docs/development/runtime-openapi-verification.md) |
+| HTTP wire contract и направление генерации | Backend-owned contract → provided snapshot → [Источник HTTP-контракта](../../docs/architecture/http-api.md#источник-контракта) |
 | Error codes/validation/error envelope | [docs: HTTP API](../../docs/architecture/http-api.md) |
 | Auth/session, token storage и refresh | [Аутентификация](../../docs/domains/authentication/overview.md), [подключение брокера](../../docs/integrations/tbank.md) |
 | Значение Money, cached snapshot, account/position/income | [docs: Domain](../../docs/glossary.md) |
-| Mantine/theme/tokens и существующие stories | [Дизайн-система](../../docs/development/design-system.md), [UI-каталог](../../docs/development/ui-catalog.md) |
+| Mantine/theme/tokens и существующие stories | [Дизайн-система](../../docs/design/overview.md), [UI-каталог](../README.md#ui-каталог-storybook) |
 | As-built behavior нужной feature | [docs: Features](../../docs/README.md#предметные-области) |
 | Существующие behavioral requirements, если нужны по задаче | [specs index](../../specs/AI_INDEX.md) |
 | Действующие versions/scripts/check scope | package.json, lockfile, Biome/TS/dependency configs |

.ai/conventions/frontend-architecture.md

@@ -40,7 +40,7 @@ designTokens, color roles, CSSVariablesResolver и base styles. Внешний c
 `shared/ui` содержит StateView/LoadingSkeleton. Existing route-aware AppShell также
 лежит в shared/ui, но не является общим catalog primitive; его расположение не
 служит основанием переносить новую domain/navigation логику в shared.
-Изменяя foundation, прочитай [design system](../../../docs/development/design-system.md).
+Изменяя foundation, прочитай [design system](../../../docs/design/overview.md).
 
 ## Примеры
 

.ai/conventions/frontend-data.md

@@ -14,16 +14,19 @@ pages/features/entities и прямой T-Bank call запрещены. Снач
 
 ## Типы и contract
 
-Backend runtime OpenAPI — source; committed frontend snapshot и generated
-`schema.d.ts` производны. Тип request/response бери из generated `paths`, например:
+Backend-owned OpenAPI contract поступает во frontend как предоставленный
+актуальный snapshot; generated `schema.d.ts` производен от него. Тип
+request/response бери из generated `paths`, например:
 
 ```ts
 type User = paths["/api/v1/auth/me"]["get"]["responses"][200]["content"]["application/json"];
 ```
 
 Domain/UI type допустим, когда он отличается по смыслу, а не копирует transport DTO.
-Generated TS вручную не исправляется. Изменение wire shape/status/route проходит
-[общий contract workflow](../../../docs/development/runtime-openapi-verification.md).
+Generated TS вручную не исправляется. Frontend-команды не читают соседний
+backend checkout и не проверяют backend runtime OpenAPI; изменение wire
+shape/status/route сохраняет
+[границу HTTP-контракта](../../../docs/architecture/http-api.md#источник-контракта).
 Одна UI-модель не требует менять API. `openapi:generate` работает offline от snapshot;
 `openapi:check` генерирует во временный каталог и сравнивает, не меняя tracked files.
 
@@ -53,4 +56,5 @@ Default focus refetch выключен; freshness и retry определяют
 Изменяя header/retry/invalidation, проверяй наблюдаемое поведение через MSW и
 [Testing](frontend-testing.md); не обращайся к реальному T-Bank.
 `npm run openapi:check`, `npm run typecheck` и targeted tests проверяют разные
-части решения. Для API semantics нужны также exact docs и contract gate.
+части решения. Для API semantics нужны exact docs и проверки наблюдаемого
+HTTP-поведения на стороне backend.

.ai/conventions/frontend-testing.md

@@ -2,7 +2,8 @@
 
 ## Выбор проверки
 
-Читай при изменении тестов или behavior с [testing risk](../../../docs/development/engineering-governance.md#risk-based-testing).
+Читай при изменении тестов, доступа, денежных расчётов, восстановления
+интерфейса или исправлении подтверждённой регрессии.
 Выбирай boundary по наблюдаемому исходу, а не внутреннему helper/component state.
 
 | Изменение | Дешёвая надёжная проверка |

.ai/conventions/frontend-ui.md

@@ -13,7 +13,7 @@ Mantine component и общую тему. Для выпадающего выбо
 
 Wrapper нужен для проектной ответственности, а не ради нового имени
 для Button. Локальный CSS module принадлежит component; общий token вводи для
-реально общей роли через [design system](../../../docs/development/design-system.md).
+реально общей роли через [design system](../../../docs/design/overview.md).
 
 | Состояние | Владелец |
 | --- | --- |
@@ -154,5 +154,5 @@ incidental значения с объяснением, например пере
 
 Type/style: `npm run typecheck`, `npm run lint`. Для risk behavior/изменения тестов
 используй [Testing](frontend-testing.md). UI: keyboard, narrow viewport,
-loading/error/empty/loaded и recovery по применимости. [Storybook](../../../docs/development/ui-catalog.md)
+loading/error/empty/loaded и recovery по применимости. [Storybook](../../README.md#ui-каталог-storybook)
 уже установлен; используй его как reference, но сверяй UI с задачей отдельно от build.

.gitea/workflows/commits.yml

@@ -0,0 +1,26 @@
+name: Conventional commits
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+jobs:
+  commits:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - run: npm ci --ignore-scripts
+      - name: Check PR title and commits
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
+          npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"

.gitea/workflows/security.yml

@@ -0,0 +1,33 @@
+name: Frontend security
+
+on:
+  push:
+    branches:
+      - '**'
+  pull_request:
+  schedule:
+    - cron: '17 5 * * *'
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Record checked revision
+        run: git rev-parse HEAD
+      - name: Scan history with Gitleaks 8.30.1
+        run: |
+          curl --fail --location --silent --show-error https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
+          echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tar.gz' | sha256sum --check
+          mkdir -p /tmp/gitleaks-bin
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp/gitleaks-bin gitleaks
+          /tmp/gitleaks-bin/gitleaks git --log-opts=--all --redact=100 --no-banner
+      - uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - name: Verify pre-commit secret blocking and redaction
+        run: PATH=/tmp/gitleaks-bin:$PATH node --test scripts/test-pre-commit.mjs
+      - name: Audit runtime and development dependencies
+        run: npm audit --include=dev --audit-level=low

.gitea/workflows/verify.yml

@@ -0,0 +1,26 @@
+name: Frontend verify
+
+on:
+  push:
+    branches:
+      - '**'
+  pull_request:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      - name: Record checked revision
+        run: git rev-parse HEAD
+      - uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - run: npm ci
+        env:
+          HUSKY: '0'
+      - name: Run all frontend gates
+        run: npm run verify
+        env:
+          # OXC raw transfer allocates a ~6 GiB buffer; use the standard parser in CI.
+          KNIP_DISABLE_RAW_TRANSFER: '1'

.husky/pre-commit

@@ -1,2 +1,3 @@
+gitleaks git --pre-commit --staged --redact=100 --no-banner || exit $?
 npx lint-staged
 npm run deps

.release-it.json

@@ -0,0 +1,106 @@
+{
+	"git": {
+		"requireBranch": "release/*",
+		"requireCleanWorkingDir": true,
+		"requireUpstream": false,
+		"requireCommits": true,
+		"commitMessage": "chore(release): ${version}",
+		"tagName": "v${version}",
+		"tag": false,
+		"push": false
+	},
+	"npm": {
+		"publish": false
+	},
+	"github": {
+		"release": false
+	},
+	"gitlab": {
+		"release": false
+	},
+	"hooks": {
+		"after:git:init": "node scripts/check-release.cjs"
+	},
+	"plugins": {
+		"@release-it/conventional-changelog": {
+			"infile": "CHANGELOG.md",
+			"preset": {
+				"name": "conventionalcommits",
+				"types": [
+					{
+						"type": "chore",
+						"scope": "release",
+						"effect": "hidden"
+					},
+					{
+						"type": "feat",
+						"section": "Features",
+						"effect": "bump"
+					},
+					{
+						"type": "fix",
+						"section": "Bug Fixes",
+						"effect": "bump"
+					},
+					{
+						"type": "perf",
+						"section": "Performance",
+						"effect": "bump"
+					},
+					{
+						"type": "docs",
+						"section": "Documentation",
+						"effect": "bump"
+					},
+					{
+						"type": "spec",
+						"section": "Specifications",
+						"effect": "bump"
+					},
+					{
+						"type": "refactor",
+						"section": "Refactoring",
+						"effect": "bump"
+					},
+					{
+						"type": "build",
+						"section": "Build",
+						"effect": "bump"
+					},
+					{
+						"type": "ci",
+						"section": "CI",
+						"effect": "bump"
+					},
+					{
+						"type": "test",
+						"section": "Tests",
+						"effect": "bump"
+					},
+					{
+						"type": "style",
+						"section": "Styles",
+						"effect": "bump"
+					},
+					{
+						"type": "chore",
+						"section": "Maintenance",
+						"effect": "bump"
+					},
+					{
+						"type": "revert",
+						"section": "Reverts",
+						"effect": "bump"
+					}
+				]
+			},
+			"context": {
+				"host": "https://git.personal.ksv741.ru",
+				"owner": "WealthLedger",
+				"repository": "frontend",
+				"linkReferences": true,
+				"commit": "commit"
+			}
+		}
+	}
+}

AGENTS.md

@@ -12,13 +12,25 @@ React/Vite-клиент; общие правила работы — в root `AGE
 dependency boundaries и сборки приложения/Storybook без backend.
 Точные scripts принадлежат `package.json`; targeted checks — у выбранного convention.
 
-HTTP contract changes дополнительно проходят общий
-[contract workflow](../docs/development/runtime-openapi-verification.md).
+HTTP contract changes используют предоставленный OpenAPI snapshot; frontend
+локально проверяет только соответствие generated types этому snapshot:
+[Источник HTTP-контракта](../docs/architecture/http-api.md#источник-контракта).
 Generated types редактируются через их source; T-Bank доступен только через backend.
 Frontend dependencies используют exact versions. Pre-commit запускает staged
 formatting и FSD checks; сообщения commits — Conventional Commits.
+Если у задачи есть связанная issue этого репозитория, добавляй её номер
+в конец заголовка: `ci: run full frontend verification #1`.
+Без связанной issue номер необязателен: `chore(deps): update non-major dependencies`.
+Формат Conventional Commits проверяет `commitlint.config.cjs`.
 
 Code/style checks автоматические только в scope конфигурации. i18n, props,
 semantic placement и выбор полезных тестов обязательны при review.
 Storybook уже доступен как reference; ожидаемый UI и его состояния определяет
 задача, а визуальное соответствие проверяется отдельно от сборки.
+
+## Ветки и релизы
+
+Работа — в отдельной ветке от `develop`, затем PR в `develop`; в `main` напрямую
+не пушить. Release/hotfix и синхронизация веток — по [root README](../README.md#релизы-и-ветки).
+Commits и заголовки PR — Conventional Commits; для спецификаций допустим `spec:`.
+Перед подготовкой релиза прочитай root README; версии вручную не повышать.

CHANGELOG.md

@@ -0,0 +1,118 @@
+# Changelog
+
+## 0.1.0 (2026-09-14)
+
+### Features
+
+* **account-operations:** require explicit ledger filters ([7d748a6](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/7d748a65d384e76220e234aa37a21b05b81e442a))
+* **accounts:** enrich brokerage account list ([fd93133](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/fd93133cfcdfd9372b2630cacaa7f5195f1beb58))
+* **account:** wrap portfolio sections in Mantine Accordion ([c1a8674](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c1a8674f164117018236bf461bd457208ac9ad00))
+* add all-accounts portfolio pages ([daf1dca](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/daf1dca6666035cbca3ba020d8ae0b2a8789dc3a))
+* add authorization ([3448fea](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3448fea1407f246e0b093e64edd7b672ae8992a9))
+* add bond pages and portfolio navigation ([232d7f9](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/232d7f999040e4c91c27d5b382f2fcdfc4542d5a))
+* add breadcrumbs ([719a6ed](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/719a6ed8b73f8a552778a1b78f65776f02d4127c))
+* add brocker account list ([6e89c1a](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/6e89c1a8f765025bd7be37b59c696d092fd4bbe4))
+* add manual bank card screens ([ff4e88e](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ff4e88edbeb9de244c2a6094ab70d9e48a4768a7))
+* add operations page ([4f3ee7d](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/4f3ee7ddb289284f8a6a0677438f270e8756a3fb))
+* add portfolio ([9156f29](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/9156f297073fefa2fe1c5cb9659495e2d532ac89))
+* add stock pages and ticker navigation ([561222e](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/561222e4686bde1dc98454a4216025c4cbc02d65))
+* add Storybook for WealthLedger components ([e63fd89](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/e63fd89a3922cd4dd7f194e33b320b4178985a5f))
+* add tbank tokens ([32e21de](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/32e21de17d00de5b3a4b074a2300e6a29a81e3ae))
+* add агегку events ([da55de5](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/da55de5b5008cce0ea24def664e13f3239174324))
+* animate page transitions with Motion ([c906dfa](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c906dfa2e290164e6b089764be18edc99f10e775))
+* **broker-operation:** show operation type label in ledger entries ([d53ce50](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d53ce50e2842e8d69a709b92417888ba851774b4))
+* **card:** refine header and inline actions ([cf21a5b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/cf21a5bd178a18753321811b6d8ac81ff848d676))
+* **cards:** filter operations by date range ([9bb385b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/9bb385b9f02cc780e27d9da8f30fae374ab0f08c))
+* **cards:** refine controls and modal transitions ([aba4cf1](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/aba4cf1ce83ea62082f35be358c2081d797f6645))
+* **cards:** show operation icons on hover ([dedfec1](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/dedfec10d1e94b76a21e0d9ee90b6cf7fea5a4a9))
+* compact portfolio currency totals ([47fbc21](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/47fbc212831058f1a0f1226dd262bf5c37870e34))
+* consume money projected event amounts ([1fd9a3a](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/1fd9a3a861a8b915b6c64861a018db39e2598a83))
+* enforce frontend quality guardrails ([1fc269a](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/1fc269adec9f0cfeacdc365c6e59a30c4620dba7))
+* establish frontend foundation ([1e13ada](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/1e13adabd32412de9707f452e42d2c65e73c106f))
+* **events:** add date filters to upcoming events ([9469dd2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/9469dd2fdc03df47c202da2afdcdadb49dbb2748))
+* improve bank card expenses summary ([d3ac8c2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d3ac8c242de1d30cd3c4ca8e5850700192c2c259))
+* improve card operations pagination and scroll behavior ([9a65687](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/9a65687d3875d264b6de088d6886e6cb916d3426))
+* improve ledger event rows ([488ccad](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/488ccad540c771e862fb795edf2df6c6cea315af))
+* **income:** add account income analytics ([9364568](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/93645682028947d3fbd212bc9929dd2195715c69))
+* initial commit ([3331b7f](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3331b7f684f2ccc6d3934436d0326d877d1c3899))
+* polish bank operation cards and dates ([6b310db](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/6b310db0b8c37cb4cffe54acf3b7e9799f9f3ea0))
+* polish stock position cards ([273778c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/273778c4cfa6ef8bd3ab421e03c57b6e31f7d925))
+* **portfolio:** add expanded layout for bond position cards ([bcf9369](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/bcf93691aa874114faf75cb9c36d1426dd7b8903))
+* **portfolio:** extend instrument logo rendering to bonds ([c04025a](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c04025a3924ad76ae06e9bbbd32df4d18c85b34a))
+* **portfolio:** show stock tickers ([8f9caa9](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/8f9caa946ee99e2db2b495a384b17a0ce90ddcfd))
+* **portfolio:** visualize asset allocation ([0306526](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/0306526d3330d508d817aedecf74f0b74583dea7))
+* redesign portfolio position cards ([5168870](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/5168870cf2d5ac19a6d08ad8fee35f2952cdda87))
+* redesign year-over-year income comparison ([91eaeb5](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/91eaeb5661706f30171f5f15bf22e419fe2ee57c))
+* render stock logos with signed returns on account page ([a6d3051](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/a6d305127057bf6413825ffddba1c15b53e65a73))
+* replace loading spinners with skeletons ([71a214d](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/71a214d7adfcf5fc57cd5518fb008021d50e7723))
+* replace paired date inputs with range pickers ([24d332e](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/24d332e06341ccfb0d0d7046793ca145669cec44))
+* show page context in browser tab titles ([2580134](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/2580134683cbe036bb07b635aab6262d3702f270))
+* simplify income page filters and payments ([26f229b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/26f229ba3e0f8335dde297bf6c4575f7014e9f28))
+* **ui:** animate navigation and operation icons ([8e58c01](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/8e58c016d2dccfbdc6089480f6ccc113b6719850))
+* **ui:** animate sidebar icons on hover ([ebba6ab](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ebba6ab25dc968c278d525fd2fd4194c8422d8d1))
+* **ui:** establish shared design system foundations ([d762ba5](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d762ba50342cd96e4387a51bac12a0c4c43c648c))
+* unify upcoming event cards across pages ([451400b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/451400b63be0011a7a3b4dfd77e9365f7bcca467))
+
+### Bug Fixes
+
+* **frontend:** complete audit remediation ([9e42148](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/9e42148f6a9ad620b4fc9f6aef9ee2d80d73702b))
+* harden frontend dependency and env hygiene ([826936c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/826936c6a4a7160b07224f0fa94b6d2d941bc6dc))
+* little fixes ([2e32d22](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/2e32d226d321f2d51653f1823ade8bace17fc5e5))
+* preserve cached data during refresh failures ([6d892da](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/6d892da9cec9d8522520cec3c26d343e81f4a51d))
+* remove income analytics period limit ([ab1b536](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ab1b53680d811e5b5f91e8e14a7f219274e57313))
+* separate portfolio cash presentation ([3017fc8](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3017fc810ee10f2790dbc04902ad4e2f2cbadbd4))
+* stabilize frontend query cache contracts ([1250581](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/1250581ee3336e901bd01f757328ae4c4dd091c8))
+* **tbank:** reset connection-derived query cache ([175727b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/175727bc93876f950280d0ad35515a6d4acffbaf))
+* **ui:** align page layouts and add navigation icons ([d7e8963](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d7e8963d1cfabd0900051e30e33ec30284282a7c))
+
+### Documentation
+
+* **agents:** link audit remediation registry ([b285719](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/b285719c1bcea32e490f9d960d7893bd21ba9e81))
+* **agents:** restore openspec authority ([fd72fb2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/fd72fb2239849cb87d441c552b194b6358c9dc8a))
+* **ai:** route frontend conventions by task ([bcc034f](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/bcc034f19839a1aefadad978c5bb3a89d81ebe63))
+* align OpenAPI workflow guidance [#3](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/3) ([7a89356](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/7a89356f8783a14d6dde752358ee995d0dcadd66))
+* define canonical OpenSpec store ([d870d53](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d870d535d7090aa3051de6f1b0fd979eaf6d7154))
+* document runtime OpenAPI verification ([7a3048c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/7a3048c3476675528203fbe74338131723354e1d))
+* refresh frontend onboarding ([be80ef2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/be80ef2f1bffc01867ee97f5f78c0cba7764a24e))
+* remove useless ([7ab043d](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/7ab043dce63a3fbacbfc9ac7d15b00dd714a541f))
+* update routes to system documentation ([a42f104](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/a42f104bed4daf982f2a72f0634887e4ea067dec))
+* update system documentation references ([dc3434c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/dc3434c3716f09cfb1ef4aa3006e9db12f6b3bcf))
+
+### Refactoring
+
+* **account-operations:** split page state views into components ([695cda0](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/695cda0456970fe3a46d09dcec718c741ee6b18d))
+* align frontend ownership boundaries ([c97f62b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c97f62bd983d6b5327132f4ec42e767118720913))
+* centralize frontend auth query gating ([268acdf](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/268acdf2e1057ed0f6c19384bfb6477aff773d1d))
+* enforce account page view model boundary ([fff36f2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/fff36f252aa1a7bb18042c8fc2d06262b687b0b1))
+* enforce semantic values and numeric lint rules ([53c852b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/53c852b437ee1174843a4f959722239132e9150a))
+* little structure refactor ([2cca503](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/2cca503519888762067c770c188ed2d977979cbb))
+* refactor foundation ([da585b1](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/da585b157a5350753a91abb7f10aa00c7e9cf2c3))
+* simplify local design token consumption ([8b29cdf](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/8b29cdfd98790cb3316f1db0f8933c8b6bc4b335))
+* source shared design tokens from JSON ([0f50f15](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/0f50f156584b6b0bf3e473d047c3960284cf0cdd))
+* use Mantine Breadcrumbs for app navigation ([3c459e6](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3c459e66cc640cad58267cbaac2be4fbcaee4fdf))
+
+### CI
+
+* configure Renovate dependency updates [#5](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/5) ([4b97395](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/4b973953853785660b5c34ef96c90d518ab6c561))
+* disable memory-heavy Knip raw transfer [#1](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/1) ([2f26e4f](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/2f26e4fe0d8aa4e693c3ca425db04b04afbba75f))
+* run Biome on branch pushes in Gitea ([ccff422](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ccff422f367bbcf5e19f510119dbe8b63de9b87a))
+* run full frontend verification [#1](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/1) ([22e331e](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/22e331e2ff4c5f68b3273de89fe9968029a1343d))
+
+### Tests
+
+* allow UI scenarios more time in CI [#1](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/1) ([942ed3d](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/942ed3d453d71547dc8883924a9bb2f76f7e997f))
+* keep portfolio metadata authoritative in cards ([427ca23](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/427ca23a433a20be25b1f4373f32c9e1f6f8c400))
+
+### Maintenance
+
+* align SDD routing and instruction commits ([3669832](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/36698322b7273b3a9eae1d078bcc9cddf2c8295b))
+* codify frontend local verification ([11be786](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/11be786943024699a4eccf91a8d1ad32a6d29e5f))
+* codify React component style ([d10e1dd](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d10e1dd1827094e6e52768f0ccd2ea060aef95a1))
+* configure releases and develop workflow ([53b18c6](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/53b18c6e86f433bcb967721232c150fba4f7cc9f))
+* **deps:** update non-major dependencies ([0c6bac8](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/0c6bac8b902b88dc0b447b9198968e938db72c82))
+* make issue references optional and use chore for dependency updates [#5](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/5) ([82b9043](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/82b904393dcf65d9876fd06d1864dddef7d70bdb))
+* save pending changes ([ae06f6e](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ae06f6e6e0f98a2be208d66105ca53ecf2d86bfd))
+* secure hooks and update dependencies [#4](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/4) [#9](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/9) ([3be6e61](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3be6e61b8fc85d4b16199dbe9910b38894159cb8))
+* simplify frontend verification ([f09baa6](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/f09baa68fcecfd210f95a7bfe8a67dc3741abce8))
+* simplify frontend verification ([3d9b619](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3d9b6194c60b373996a590c4bd56653e0935e8c6))
+* upgrade Node to 24 LTS ([117e74c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/117e74cdfc29cbf63f549ea88e8106ab25300541))

README.md

@@ -17,6 +17,12 @@ npm run dev
 
 `VITE_API_BASE_URL` по умолчанию указывает на `http://localhost:3000`.
 
+Для commits установите [Gitleaks](https://github.com/gitleaks/gitleaks/releases/tag/v8.30.1)
+8.30.1 в `PATH` (macOS: `brew install gitleaks`). Pre-commit сначала проверяет
+staged diff с полной редакцией секретов, затем запускает formatting и FSD checks.
+Находка или отсутствие Gitleaks блокирует commit.
+Проверка этого поведения: `node --test scripts/test-pre-commit.mjs`.
+
 ## Проверка
 
 ```bash
@@ -27,10 +33,30 @@ npm run verify
 Команда проверяет, что generated OpenAPI types соответствуют committed snapshot,
 затем запускает strict TypeScript, Biome, один coverage-backed запуск Vitest,
 Knip, dependency rules приложения и stories, сборки приложения и Storybook.
+Отдельный CI workflow `Frontend security` на push, pull request и ежедневно
+проверяет полную доступную историю Gitleaks 8.30.1 и выполняет
+`npm audit --include=dev --audit-level=low`. Любой advisory блокирует security job;
+исключений frontend нет. Локально можно выполнить те же команды:
+`gitleaks git --log-opts=--all --redact=100 --no-banner` и
+`npm audit --include=dev --audit-level=low`. Audit требует доступа к npm registry;
+проверка секретов выполняется локально и не выводит их значения.
+
+TypeScript остаётся на 5.9.3: `openapi-typescript@7.13.0` требует peer `^5.x`.
+Обновление до TypeScript 7 из Renovate dashboard откладывается до совместимого
+релиза генератора; `--force`/`--legacy-peer-deps` для обхода этого ограничения
+не используются.
 Если backend-контракт изменился,
 обновите `src/shared/api/spec/openapi.json` копированием backend OpenAPI
 document и затем выполните `npm run openapi:generate`.
 
+## UI-каталог Storybook
+
+После `nvm use --silent` выполните `npm run dev:catalog`; статическая сборка —
+`npm run build:catalog`. Каталог использует общую тему приложения, вымышленные
+данные и локальные действия без application API. Примеры не доказывают
+восстановление реального запроса. Визуальные роли описаны в
+[дизайн-системе](../docs/design/overview.md).
+
 ## Документация
 
 - [Router conventions](.ai/CONVENTIONS.md) и [источники](.ai/SOURCES.md)
@@ -38,15 +64,17 @@ document и затем выполните `npm run openapi:generate`.
 - [UI, state, формы и компоненты](.ai/conventions/frontend-ui.md)
 - [Data/API/cache](.ai/conventions/frontend-data.md)
 - [Testing](.ai/conventions/frontend-testing.md)
-- [Поставленный UI-каталог Storybook](../docs/development/ui-catalog.md)
+- [UI-каталог Storybook](#ui-каталог-storybook)
 - [Обзор поставленной системы](../docs/overview.md)
-- [Engineering governance и risk-based testing](../docs/development/engineering-governance.md)
 - [Карта проектных фактов](../docs/README.md)
-- [Границы проверки интерфейса](../docs/development/verification.md#интерфейс)
-- [Remediation registry](../docs/development/audit-remediation.md)
 
 Runtime OpenAPI backend сверяется с frontend snapshot отдельной read-only
 backend командой `npm run test:openapi-contract`.
 Разработка идёт напрямую по задаче пользователя. Каждый affected repo проходит
 свой verify; при изменении wire contract дополнительно выполняется contract check.
 Обязательного OpenSpec/SDD lifecycle нет.
+
+Версии и ветки: [процесс релиза](../README.md#релизы-и-ветки).
+
+Knip исключает `conventional-changelog-conventionalcommits`: release-it загружает
+preset по имени из `.release-it.json`. Версия preset закреплена напрямую.

commitlint.config.cjs

@@ -1 +1,23 @@
-module.exports = { extends: ["@commitlint/config-conventional"] };
+module.exports = {
+	extends: ["@commitlint/config-conventional"],
+	rules: {
+		"type-enum": [
+			2,
+			"always",
+			[
+				"feat",
+				"fix",
+				"perf",
+				"docs",
+				"spec",
+				"refactor",
+				"build",
+				"ci",
+				"test",
+				"style",
+				"chore",
+				"revert",
+			],
+		],
+	},
+};

knip.json

@@ -1,3 +1,4 @@
 {
-	"project": ["src/**/*.{ts,tsx}", "!src/shared/api/generated/**"]
+	"project": ["src/**/*.{ts,tsx}", "!src/shared/api/generated/**"],
+	"ignoreDependencies": ["conventional-changelog-conventionalcommits"]
 }

package.json

@@ -1,10 +1,10 @@
 {
 	"name": "wealth-ledger-frontend",
 	"private": true,
-	"version": "0.0.0",
+	"version": "0.1.0",
 	"type": "module",
 	"engines": {
-		"node": "24.x"
+		"node": "24.21.0"
 	},
 	"scripts": {
 		"dev": "vite",
@@ -24,59 +24,65 @@
 		"verify": "npm run openapi:check && npm run typecheck && npm run lint && npm run test:coverage && npm run knip && npm run deps && npm run deps:storybook && npm run build && npm run build:catalog",
 		"prepare": "husky",
 		"preview": "vite preview",
-		"deps:storybook": "depcruise src .storybook/preview.tsx --config .storybook/dependency-cruiser.cjs --output-type err-long"
+		"deps:storybook": "depcruise src .storybook/preview.tsx --config .storybook/dependency-cruiser.cjs --output-type err-long",
+		"release:preview": "release-it --dry-run --ci",
+		"release:prepare": "release-it --ci",
+		"commitlint": "commitlint"
 	},
 	"lint-staged": {
 		"*.{css,html,json,md,ts,tsx}": "biome format --write --no-errors-on-unmatched"
 	},
 	"dependencies": {
-		"@hookform/resolvers": "5.7.1",
-		"@mantine/charts": "9.5.1",
-		"@mantine/core": "9.5.1",
-		"@mantine/dates": "9.5.1",
-		"@mantine/hooks": "9.5.1",
-		"@tanstack/react-query": "5.101.4",
+		"@hookform/resolvers": "5.9.1",
+		"@mantine/charts": "9.6.1",
+		"@mantine/core": "9.6.1",
+		"@mantine/dates": "9.6.1",
+		"@mantine/hooks": "9.6.1",
+		"@tanstack/react-query": "5.102.8",
 		"dayjs": "1.11.23",
-		"i18next": "26.0.2",
+		"i18next": "26.4.2",
 		"motion": "13.2.0",
 		"openapi-fetch": "0.17.0",
 		"openapi-react-query": "0.5.4",
-		"react": "19.2.8",
-		"react-dom": "19.2.8",
-		"react-hook-form": "7.85.0",
-		"react-i18next": "16.3.5",
-		"react-is": "19.2.8",
-		"react-router": "7.18.2",
+		"react": "19.3.0",
+		"react-dom": "19.3.0",
+		"react-hook-form": "7.88.0",
+		"react-i18next": "17.0.14",
+		"react-is": "19.3.0",
+		"react-router": "8.3.1",
 		"recharts": "3.10.1",
-		"zod": "3.25.76"
+		"zod": "4.6.4"
 	},
 	"devDependencies": {
-		"@babel/core": "7.29.7",
-		"@biomejs/biome": "2.5.8",
+		"@babel/core": "8.0.5",
+		"@biomejs/biome": "2.5.13",
 		"@commitlint/cli": "21.2.2",
 		"@commitlint/config-conventional": "21.2.2",
-		"@rolldown/plugin-babel": "0.2.3",
+		"@release-it/conventional-changelog": "12.0.0",
+		"@rolldown/plugin-babel": "0.2.4",
 		"@storybook/addon-docs": "10.6.0",
 		"@storybook/react-vite": "10.6.0",
-		"@testing-library/jest-dom": "6.9.1",
-		"@testing-library/react": "16.3.0",
-		"@types/node": "24.13.3",
-		"@types/react": "19.2.17",
-		"@types/react-dom": "19.2.3",
-		"@vitejs/plugin-react": "6.0.4",
-		"@vitest/coverage-v8": "4.1.10",
+		"@testing-library/jest-dom": "7.0.1",
+		"@testing-library/react": "16.3.3",
+		"@types/node": "24.13.4",
+		"@types/react": "19.3.0",
+		"@types/react-dom": "19.3.0",
+		"@vitejs/plugin-react": "6.1.1",
+		"@vitest/coverage-v8": "5.0.0",
 		"babel-plugin-react-compiler": "1.0.0",
+		"conventional-changelog-conventionalcommits": "10.4.0",
 		"dependency-cruiser": "18.2.0",
 		"husky": "9.1.7",
-		"jsdom": "27.4.0",
-		"knip": "6.32.2",
-		"lint-staged": "16.2.7",
+		"jsdom": "30.0.1",
+		"knip": "6.35.1",
+		"lint-staged": "17.5.1",
 		"msw": "2.15.0",
 		"openapi-typescript": "7.13.0",
+		"release-it": "21.0.2",
 		"storybook": "10.6.0",
 		"typescript": "5.9.3",
-		"vite": "8.2.0",
-		"vitest": "4.1.10"
+		"vite": "8.3.0",
+		"vitest": "5.0.0"
 	},
 	"allowScripts": {
 		"esbuild@0.28.2": true,

renovate.json

@@ -0,0 +1,19 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": ["config:recommended", ":semanticCommitTypeAll(chore)"],
+	"timezone": "Europe/Moscow",
+	"labels": ["dependencies"],
+	"dependencyDashboard": true,
+	"rangeStrategy": "pin",
+	"packageRules": [
+		{
+			"matchUpdateTypes": ["minor", "patch"],
+			"groupName": "non-major dependencies"
+		},
+		{
+			"matchUpdateTypes": ["major"],
+			"dependencyDashboardApproval": true
+		}
+	],
+	"baseBranchPatterns": ["develop"]
+}

scripts/check-release.cjs

@@ -0,0 +1,25 @@
+const assert = require("node:assert/strict");
+const { execFileSync } = require("node:child_process");
+const { version } = require("../package.json");
+const git = (...args) => execFileSync("git", args, { encoding: "utf8" }).trim();
+
+assert.equal(
+	git("status", "--porcelain"),
+	"",
+	"Commit all changes before preparing a release",
+);
+const tags = git(
+	"tag",
+	"--merged",
+	"HEAD",
+	"--list",
+	"v[0-9]*",
+	"--sort=-version:refname",
+)
+	.split("\n")
+	.filter((tag) => /^v\d+\.\d+\.\d+$/.test(tag));
+assert.equal(
+	version,
+	tags[0]?.slice(1) ?? "0.0.0",
+	"Version is already prepared or release tags are missing. Fetch tags; finish the existing release before preparing another.",
+);

scripts/test-pre-commit.mjs

@@ -0,0 +1,61 @@
+import assert from "node:assert/strict";
+import { execFileSync, spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import {
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	rmSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, join, resolve } from "node:path";
+import { test } from "node:test";
+
+const GITHUB_TOKEN_RANDOM_BYTES = 18;
+
+test("pre-commit scans the index, redacts findings and fails closed", () => {
+	const hook = resolve(".husky/pre-commit");
+	const cwd = mkdtempSync(join(tmpdir(), "frontend-hook-"));
+	const bin = join(cwd, "bin");
+	const marker = join(cwd, "downstream");
+	const token = `ghp_${randomBytes(GITHUB_TOKEN_RANDOM_BYTES).toString("hex")}`;
+	const git = (...args) => execFileSync("git", args, { cwd, stdio: "pipe" });
+	const run = (path = `${bin}${delimiter}${process.env.PATH}`) =>
+		spawnSync("/bin/sh", ["-e", hook], {
+			cwd,
+			env: { ...process.env, PATH: path },
+			encoding: "utf8",
+		});
+	try {
+		mkdirSync(bin);
+		for (const command of ["npx", "npm"]) {
+			writeFileSync(join(bin, command), "#!/bin/sh\necho ran >> downstream\n", {
+				mode: 0o755,
+			});
+		}
+		git("init", "--quiet");
+		writeFileSync(join(cwd, "sample.txt"), "safe staged content\n");
+		git("add", "sample.txt");
+		// An unstaged secret must not be mistaken for the index being committed.
+		writeFileSync(join(cwd, "sample.txt"), `token=${token}\n`);
+		let result = run();
+		assert.equal(
+			result.status,
+			0,
+			"clean index must pass; install Gitleaks first",
+		);
+		assert.ok(existsSync(marker));
+		rmSync(marker);
+		git("add", "sample.txt");
+		result = run();
+		assert.equal(result.status, 1, "staged secret must block commit");
+		assert.ok(!`${result.stdout}${result.stderr}`.includes(token));
+		assert.ok(!existsSync(marker), "formatting/dependency checks must not run");
+		result = run(bin);
+		assert.notEqual(result.status, 0, "missing Gitleaks must block commit");
+		assert.ok(!existsSync(marker));
+	} finally {
+		rmSync(cwd, { recursive: true, force: true });
+	}
+});

src/entities/bank-card/model/form-validation.ts

@@ -38,18 +38,24 @@ function moneyCents(value: string): bigint | null {
 const MIN_BALANCE_KOPECKS = -9_223_372_036_854_775_808n;
 const MAX_BALANCE_KOPECKS = 9_223_372_036_854_775_807n;
 
-const moneySchema = z.string().refine((value) => {
-	const cents = moneyCents(value);
-	return (
-		cents !== null &&
-		cents >= MIN_BALANCE_KOPECKS &&
-		cents <= MAX_BALANCE_KOPECKS
-	);
-}, validationMessage("bank.validation.money"));
-const positiveMoneySchema = moneySchema.refine((value) => {
-	const cents = moneyCents(value);
-	return cents === null || cents > 0n;
-}, validationMessage("bank.validation.positive"));
+const moneySchema = z.string().refine(
+	(value) => {
+		const cents = moneyCents(value);
+		return (
+			cents !== null &&
+			cents >= MIN_BALANCE_KOPECKS &&
+			cents <= MAX_BALANCE_KOPECKS
+		);
+	},
+	{ error: validationMessage("bank.validation.money") },
+);
+const positiveMoneySchema = moneySchema.refine(
+	(value) => {
+		const cents = moneyCents(value);
+		return cents === null || cents > 0n;
+	},
+	{ error: validationMessage("bank.validation.positive") },
+);
 const bankDateSchema = z
 	.string()
 	.refine(
@@ -59,7 +65,7 @@ const bankDateSchema = z
 			!Number.isNaN(Date.parse(`${value}T00:00:00Z`)) &&
 			new Date(`${value}T00:00:00Z`).toISOString().slice(0, 10) === value &&
 			value <= bankToday(),
-		validationMessage("bank.validation.date"),
+		{ error: validationMessage("bank.validation.date") },
 	);
 const bankCardSchema = z.object({
 	name: z
@@ -77,15 +83,12 @@ const bankCardSchema = z.object({
 			MAX_CARD_NAME_LENGTH,
 			validationMessage("bank.validation.bankName")(undefined),
 		),
-	lastFour: z
-		.string()
-		.refine(
-			(value) => !value || /^\d{4}$/.test(value),
-			validationMessage("bank.validation.lastFour"),
-		),
+	lastFour: z.string().refine((value) => !value || /^\d{4}$/.test(value), {
+		error: validationMessage("bank.validation.lastFour"),
+	}),
 	paymentSystem: z
 		.enum(["", "mir", "visa", "mastercard"], {
-			errorMap: validationMessage("bank.validation.paymentSystem"),
+			error: validationMessage("bank.validation.paymentSystem"),
 		})
 		.optional(),
 	openingBalance: moneySchema,

src/entities/bank-card/ui/CategoryManager.tsx

@@ -71,7 +71,7 @@ const CategoryManager: FC<CategoryManagerProps> = (props) => {
 					.refine(
 						(value) =>
 							value.length > 0 && value.length <= MAX_CATEGORY_NAME_LENGTH,
-						validationMessage("bank.validation.category"),
+						{ error: validationMessage("bank.validation.category") },
 					)
 					.refine(
 						(value) =>
@@ -81,7 +81,7 @@ const CategoryManager: FC<CategoryManagerProps> = (props) => {
 									c.name.toLocaleLowerCase("ru-RU") ===
 										value.toLocaleLowerCase("ru-RU"),
 							),
-						validationMessage("bank.validation.duplicate"),
+						{ error: validationMessage("bank.validation.duplicate") },
 					),
 			}),
 		),

src/features/auth/model/validation.ts

@@ -25,7 +25,7 @@ const email = z
 			value.split("@").length === 2 &&
 			value.split("@").every(Boolean) &&
 			!value.split("").some(isEmailCharacterInvalid),
-		validationMessage("auth.validation.invalidEmail"),
+		{ error: validationMessage("auth.validation.invalidEmail") },
 	);
 const password = z
 	.string()
@@ -33,7 +33,7 @@ const password = z
 		(value) =>
 			new TextEncoder().encode(value).length >= MIN_PASSWORD_BYTES &&
 			new TextEncoder().encode(value).length <= MAX_PASSWORD_BYTES,
-		validationMessage("auth.validation.invalidPasswordLength"),
+		{ error: validationMessage("auth.validation.invalidPasswordLength") },
 	);
 
 const loginSchema = z.object({
@@ -43,10 +43,10 @@ const loginSchema = z.object({
 });
 const registerSchema = loginSchema.refine(
 	(value) => value.password === value.passwordConfirmation,
-	(value) => ({
+	{
 		path: ["passwordConfirmation"],
-		...validationMessage("auth.validation.passwordsDoNotMatch")(value),
-	}),
+		error: validationMessage("auth.validation.passwordsDoNotMatch"),
+	},
 );
 
 type AuthFormValues = z.input<typeof loginSchema>;

src/pages/account-income/ui/AccountIncomePage.vm.ts

@@ -44,14 +44,16 @@ type AccountIncomePageViewModel =
 const datePattern = /^\d{4}-\d{2}-\d{2}$/;
 const draftDate = z
 	.string()
+	.refine((value) => parseDraftDate(value) !== null, {
+		error: validationMessage("income.validation.date"),
+	})
 	.refine(
-		(value) => parseDraftDate(value) !== null,
-		validationMessage("income.validation.date"),
-	)
-	.refine((value) => {
-		const date = parseDraftDate(value);
-		return !date || date <= moscowDate(new Date());
-	}, validationMessage("income.validation.future"));
+		(value) => {
+			const date = parseDraftDate(value);
+			return !date || date <= moscowDate(new Date());
+		},
+		{ error: validationMessage("income.validation.future") },
+	);
 const incomeFormSchema = z.object({ from: draftDate, to: draftDate }).refine(
 	({ from, to }) => {
 		const start = parseDraftDate(from);

src/test/setup.ts

@@ -1,10 +1,13 @@
 import "@testing-library/jest-dom/vitest";
-import { cleanup } from "@testing-library/react";
+import { cleanup, configure } from "@testing-library/react";
 import { afterAll, afterEach, beforeAll } from "vitest";
 import { configureAuthClient } from "@/shared/api";
 import "../shared/i18n";
 import { server } from "./server";
 
+// Allow async UI updates on the slower CI runner; local waits stay unchanged.
+if (process.env.CI) configure({ asyncUtilTimeout: 5_000 });
+
 beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
 afterEach(() => {
 	cleanup();

vitest.config.ts

@@ -2,10 +2,14 @@ import { fileURLToPath, URL } from "node:url";
 import react from "@vitejs/plugin-react";
 import { configDefaults, defineConfig } from "vitest/config";
 
+const CI_TEST_TIMEOUT_MS = 15_000;
+
 export default defineConfig({
 	plugins: [react()],
 	resolve: { alias: { "@": fileURLToPath(new URL("./src", import.meta.url)) } },
 	test: {
+		// CI runs the UI scenarios with coverage on a slower runner.
+		testTimeout: process.env.CI ? CI_TEST_TIMEOUT_MS : undefined,
 		environment: "jsdom",
 		exclude: configDefaults.exclude,
 		setupFiles: "./src/test/setup.ts",