Next.js renamed middleware to proxy, and our 22-line version has one regex doing the interesting work

One file runs before every request that is not a static asset or a webhook. The rename is cosmetic, the matcher is not: a negative lookahead decides which requests get a session refresh, and the one path excluded from it is the one nobody is holding a browser for.