Production session minting

Use the hardened Next.js example#

The Next.js production example authenticates the application user, requires same-origin Fetch Metadata, validates a double-submit CSRF token, applies a per-tenant quota before calling Ox, returns no-store JSON, and logs only request/session identifiers. Replace its explicit auth and quota adapters with your own durable implementations. Never log Authorization, cookies, CSRF values, session descriptors, tool arguments/results, or audio.