"""Application-level Starlette middlewares.

Each middleware is a :class:`starlette.middleware.base.BaseHTTPMiddleware`
subclass wired up in :mod:`app.main`. They are kept in their own package
(rather than buried in ``app/main.py``) because Phase 6 introduced two
cross-cutting middlewares — security headers and access logging — that
benefit from isolated unit tests and clear homes for future additions
(rate-limit re-shaping, request-id propagation, etc.).

Public surface:

- :class:`SecurityHeadersMiddleware` — per-request CSP nonce + strict
  response headers. See :mod:`app.middleware.security_headers`.
- :class:`AccessLogMiddleware` — structured ``http_request`` log line
  after every response. See :mod:`app.middleware.access_log`.
"""

from __future__ import annotations

from app.middleware.access_log import AccessLogMiddleware
from app.middleware.security_headers import SecurityHeadersMiddleware

__all__ = [
    "AccessLogMiddleware",
    "SecurityHeadersMiddleware",
]