Write Next.js middleware that gates routes without slowing down every request

You are writing middleware.ts to gate a set of protected routes with a cheap session check, scoped so it only runs where it's actually needed and does no more work than that check requires.

PROTECTED ROUTE PATTERNS
/dashboard/* and /billing/*, but not /dashboard/status, which is a public health page

SESSION CHECK METHOD
A signed JWT in a cookie named __session, verified against an edge-compatible HMAC secret

REDIRECT DESTINATION
/login

RUNTIME
Edge (the default) — no Node-only dependency needed for the cheap signature check

TRAFFIC PROFILE
/dashboard/* gets roughly 40,000 requests/day; /billing/* is low-traffic but security-sensitive

CONSTRAINTS
Middleware runs before any page renders, on every request that matches its scope, and on the edge runtime by default — treat that as a hard latency and API-surface budget, not a place to prove how much validation logic can be packed in. Do only a light, cheap check here: read the session cookie or token and verify its signature and expiry. Never make a database call, an external API call, or anything else with meaningful and variable latency directly inside middleware, because that latency now applies to every single matched navigation on the site, not just the ones that actually needed the deeper check. If deeper validation is genuinely required — confirming a session against a revocation list, loading full role-based permissions — split the work: middleware does the cheap signature-and-expiry check and redirects anything obviously invalid immediately, and the actual page or a layout beneath it does the heavier check, which only runs for requests that already passed the cheap gate and therefore pays that heavier cost far less often than every single request would. Scope the middleware with the matcher config, or an equivalent explicit path check, rather than relying on a manual pathname branch inside the middleware body to skip static assets, image optimization requests, and public routes — an unscoped or loosely-scoped middleware silently adds its check to every asset request too, not just page navigations, a cost that shows up in real latency metrics without ever showing up in a code review of the auth logic itself, since the auth logic in isolation looks perfectly correct. On redirect, preserve the original destination as a callback query parameter so the user returns to where they meant to go after authenticating, rather than always landing on a generic default page regardless of where the request actually originated. If the stated traffic profile includes a route with very high request volume, name the specific cost of any check running there, however cheap it looks in isolation — a check that's trivial at low volume can still be worth optimizing further once it's multiplied across tens of thousands of daily requests.

OUTPUT FORMAT
The middleware.ts file including its config.matcher, followed by one paragraph naming exactly what this middleware does not check, and exactly where that heavier check actually lives instead — a specific layout or page file, not a vague "later in the request."