import { headers } from "next/headers";

/** Best-effort client IP from proxy headers. Falls back to "unknown" (e.g. plain local dev), which still rate-limits fine as a single shared bucket. */
export async function getClientIp(): Promise<string> {
  const h = await headers();
  const forwarded = h.get("x-forwarded-for");
  if (forwarded) return forwarded.split(",")[0].trim();
  return h.get("x-real-ip") ?? "unknown";
}