Middleware

dygo.WithMiddleware(
    middleware.RequestID(),
    middleware.Logger(log),
    middleware.SecureHeaders(middleware.SecureHeadersOptions{}), // Helmet defaults for an API
    middleware.CORS(middleware.CORSOptions{AllowOrigins: cfg.Origins, AllowCredentials: true}),
    middleware.CSRF(middleware.CSRFOptions{Secure: true}),       // only for cookie sessions
    middleware.Compress(),                                       // gzip bodies of 1 KiB or more; SSE streams are left alone
)

The first middleware is the outermost. They are plain func(http.Handler) http.Handler, so any Go middleware mixes in.