import type { ZitadelProject } from "@zitadel/api/config";
import type { NextgenMiddlewareOptions } from "@zitadel/sdk-core/middleware";
import type { NextRequest } from "next/server";
import { NextResponse } from "next/server";
/**
 * Next.js Edge middleware that handles proxying, JWT verification, and route
 * protection in a single pass.
 *
 * Place this in your `middleware.ts` file:
 *
 * ```ts
 * import { nextgenMiddleware } from "@zitadel/sdk-next/middleware";
 * import type { NextRequest } from "next/server";
 *
 * export function middleware(req: NextRequest) {
 *   return nextgenMiddleware(req, {
 *     url: process.env.ZITADEL_URL,
 *     protectedRoutes: ["/profile"],
 *     loginPath: "/login",
 *   });
 * }
 *
 * A session counts only in the app's own project: `projectId`, else
 * `ZITADEL_PROJECT_ID`, else `NEXT_PUBLIC_ZITADEL_PROJECT_ID`.
 *
 * // Every route but Next.js's build files: a protected route the matcher
 * // leaves out never reaches the middleware, and stays public.
 * export const config = {
 *   matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
 * };
 * ```
 *
 * @param req     - The incoming Next.js edge request.
 * @param options - Middleware configuration options.
 * @returns A `NextResponse` or `Response` to continue, redirect, or proxy.
 */
export declare function nextgenMiddleware(req: NextRequest, options?: NextgenMiddlewareOptions): Promise<NextResponse | Response>;
/**
 * Options for {@link createProxy} that are separate from the shared
 * {@link ZitadelConfig}. These configure route protection, login
 * redirects, and JWT verification behaviour.
 *
 * `proxyPath` and `url` are omitted because they come from the
 * {@link ZitadelConfig} passed as the first argument.
 */
export type ProxyOptions = Omit<NextgenMiddlewareOptions, "proxyPath" | "url">;
/**
 * A pre-configured middleware handler returned by {@link createProxy}.
 */
export type ProxyHandler = (req: NextRequest) => Promise<NextResponse | Response>;
/**
 * Creates a pre-configured middleware handler from the SDK config
 * returned by `configureZitadel()`. This is the derived-service
 * derived service pattern:
 *
 * ```ts
 * // src/zitadel.ts
 * import { configureZitadel } from "@zitadel/api/config";
 * import { createProxy } from "@zitadel/sdk-next/middleware";
 *
 * const zitadel = configureZitadel({
 *   projectId: process.env.NEXT_PUBLIC_ZITADEL_PROJECT_ID ?? "",
 *   url: process.env.ZITADEL_URL,
 * });
 *
 * export const proxy = createProxy(zitadel, {
 *   protectedRoutes: ["/admin*"],
 *   loginPath: "/login",
 * });
 * ```
 *
 * Then in middleware.ts:
 *
 * ```ts
 * import { proxy } from "./zitadel";
 * export const middleware = proxy;
 * ```
 *
 * Sessions are held to the handle's project unless `options.projectId` names
 * another. `auth()` runs in the server runtime, where the middleware's handle
 * may not be configured: it reads `ZITADEL_PROJECT_ID` /
 * `NEXT_PUBLIC_ZITADEL_PROJECT_ID`, else a handle configured there. When the
 * project lives only in this handle, pass it as `auth({ projectId })` too.
 *
 * @param config  - The SDK handle from `configureZitadel()`.
 * @param options - Route protection and JWT options.
 * @returns A middleware handler function.
 */
export declare function createProxy(config: ZitadelProject, options?: ProxyOptions): ProxyHandler;