feat: rejected and expired recipient filters

Add a Rejected tab and an Expired pseudo-status tab to the documents
list, and an orthogonal hasExpiredRecipients boolean to the public v2
document and envelope find APIs.

- Add shared hasExpiredRecipient EXISTS predicate (expiresAt in the
  past, NOT_SIGNED, role != CC) to find-documents, get-stats and
  find-envelopes
- Surface REJECTED in the documents tabs (backend already wired)
- Add EXPIRED extended status: where-clause branches, stats count
  (excluded from ALL since it overlaps PENDING), status display
  (TimerOff/orange), tabs, and empty-state copy
- Expose hasExpiredRecipients on GET /document and /envelope using an
  enum-transform schema to avoid the coerce "false" -> true footgun
- Document that redistributing renews expired signing links
- Add e2e coverage for the expired filter on both endpoints

packages/lib/server-only/document/find-documents.ts

@@ -36,6 +36,11 @@ export type FindDocumentsOptions = {
   senderIds?: number[];
   query?: string;
   folderId?: string;
+  /**
+   * When true, restrict results to envelopes with at least one recipient whose signing
+   * link has expired. Orthogonal to `status` — applied additively.
+   */
+  hasExpiredRecipients?: boolean;
   /**
    * When true (default), use a windowed count that caps early for faster pagination.
    * When false, use a full COUNT(*) for exact totals — preferred for external API consumers.
@@ -102,6 +107,23 @@ const senderEmailIs = (eb: EnvelopeExpressionBuilder, email: string) =>
       .select(sql.lit(1).as('one')),
   );
 
+/**
+ * Reusable EXISTS subquery: checks that the envelope has at least one recipient whose
+ * signing link has expired — `expiresAt` in the past, still unsigned, and not a CC.
+ * Mirrors `isRecipientExpired` (packages/lib/utils/recipients.ts).
+ */
+const hasExpiredRecipient = (eb: EnvelopeExpressionBuilder) =>
+  eb.exists(
+    eb
+      .selectFrom('Recipient')
+      .whereRef('Recipient.envelopeId', '=', 'Envelope.id')
+      .where('Recipient.expiresAt', 'is not', null)
+      .where('Recipient.expiresAt', '<=', new Date())
+      .where('Recipient.signingStatus', '=', sql.lit(SigningStatus.NOT_SIGNED))
+      .where('Recipient.role', '!=', sql.lit(RecipientRole.CC))
+      .select(sql.lit(1).as('one')),
+  );
+
 export const findDocuments = async ({
   userId,
   teamId,
@@ -115,6 +137,7 @@ export const findDocuments = async ({
   senderIds,
   query = '',
   folderId,
+  hasExpiredRecipients,
   useWindowedCount = true,
 }: FindDocumentsOptions) => {
   const user = await prisma.user.findFirstOrThrow({
@@ -199,6 +222,11 @@ export const findDocuments = async ({
       );
     }
 
+    // Expired recipient filter (orthogonal to status, additive)
+    if (hasExpiredRecipients) {
+      qb = qb.where((eb) => hasExpiredRecipient(eb));
+    }
+
     return qb;
   };
 
@@ -291,6 +319,15 @@ export const findDocuments = async ({
             ]),
           ),
       )
+      .with(ExtendedDocumentStatus.EXPIRED, () =>
+        qb.where((eb) =>
+          eb.and([
+            personalDeletedFilter(eb),
+            hasExpiredRecipient(eb),
+            eb.or([eb('Envelope.userId', '=', user.id), recipientExists(eb, user.email)]),
+          ]),
+        ),
+      )
       .exhaustive();
   };
 
@@ -429,6 +466,18 @@ export const findDocuments = async ({
           return eb.and([teamDeletedFilter(eb), visibilityFilter(eb), eb.or(accessBranches)]);
         }),
       )
+      .with(ExtendedDocumentStatus.EXPIRED, () =>
+        qb.where((eb) => {
+          const accessBranches = [eb('Envelope.teamId', '=', teamData.id)];
+
+          if (teamEmail) {
+            accessBranches.push(senderEmailIs(eb, teamEmail));
+            accessBranches.push(recipientExists(eb, teamEmail));
+          }
+
+          return eb.and([teamDeletedFilter(eb), visibilityFilter(eb), hasExpiredRecipient(eb), eb.or(accessBranches)]);
+        }),
+      )
       .exhaustive();
   };
 

packages/lib/server-only/document/get-stats.ts

@@ -51,6 +51,23 @@ const senderEmailIs = (eb: EnvelopeExpressionBuilder, email: string) =>
       .select(sql.lit(1).as('one')),
   );
 
+/**
+ * Reusable EXISTS subquery: checks that the envelope has at least one recipient whose
+ * signing link has expired — `expiresAt` in the past, still unsigned, and not a CC.
+ * Mirrors `isRecipientExpired` (packages/lib/utils/recipients.ts).
+ */
+const hasExpiredRecipient = (eb: EnvelopeExpressionBuilder) =>
+  eb.exists(
+    eb
+      .selectFrom('Recipient')
+      .whereRef('Recipient.envelopeId', '=', 'Envelope.id')
+      .where('Recipient.expiresAt', 'is not', null)
+      .where('Recipient.expiresAt', '<=', new Date())
+      .where('Recipient.signingStatus', '=', sql.lit(SigningStatus.NOT_SIGNED))
+      .where('Recipient.role', '!=', sql.lit(RecipientRole.CC))
+      .select(sql.lit(1).as('one')),
+  );
+
 export type GetStatsInput = {
   userId: number;
   teamId: number;
@@ -239,6 +256,19 @@ export const getStats = async ({ userId, teamId, period, search = '', folderId,
       return eb.and([teamDeletedFilter(eb), visibilityFilter(eb), eb.or(accessBranches)]);
     });
 
+  // EXPIRED: docs visible to the team/user with at least one expired, unsigned recipient.
+  // Access control mirrors the EXPIRED branch in findDocuments so the count matches the listing.
+  const expiredQuery = buildBaseQuery().where((eb) => {
+    const accessBranches = [eb('Envelope.teamId', '=', team.id)];
+
+    if (teamEmail) {
+      accessBranches.push(senderEmailIs(eb, teamEmail));
+      accessBranches.push(recipientExists(eb, teamEmail));
+    }
+
+    return eb.and([teamDeletedFilter(eb), visibilityFilter(eb), hasExpiredRecipient(eb), eb.or(accessBranches)]);
+  });
+
   // INBOX: non-draft docs where team email is a NOT_SIGNED, non-CC recipient
   // Returns 0 if the team has no team email.
   const inboxQuery = teamEmail
@@ -260,14 +290,16 @@ export const getStats = async ({ userId, teamId, period, search = '', folderId,
 
   // ─── Execute all counts in parallel ──────────────────────────────────
 
-  const [draft, pending, completed, rejected, inbox] = await Promise.all([
+  const [draft, pending, completed, rejected, expired, inbox] = await Promise.all([
     cappedCount(draftQuery),
     cappedCount(pendingQuery),
     cappedCount(completedQuery),
     cappedCount(rejectedQuery),
+    cappedCount(expiredQuery),
     inboxQuery ? cappedCount(inboxQuery) : Promise.resolve(0),
   ]);
 
+  // `expired` is intentionally excluded from `all` — it overlaps PENDING.
   const all = Math.min(draft + pending + completed + rejected + inbox, STATS_COUNT_CAP);
 
   const stats: Record<ExtendedDocumentStatus, number> = {
@@ -275,6 +307,7 @@ export const getStats = async ({ userId, teamId, period, search = '', folderId,
     [ExtendedDocumentStatus.PENDING]: pending,
     [ExtendedDocumentStatus.COMPLETED]: completed,
     [ExtendedDocumentStatus.REJECTED]: rejected,
+    [ExtendedDocumentStatus.EXPIRED]: expired,
     [ExtendedDocumentStatus.INBOX]: inbox,
     [ExtendedDocumentStatus.ALL]: all,
   };