function computeRisk(signal, user, primaryKnown) {

    let risk = 0;
    let reasons = [];

    const total = user.totalEvents || 1;

    // ✅ PRIMARY SIGNATURE
    if (!primaryKnown) {
        risk += 40;
        reasons.push("New device-location combination");
    }

    // ✅ COUNTRY DEVIATION
    const countryCount = user.countryCounts.get(signal.country) || 0;
    if (countryCount / total < 0.05) {
        risk += 25;
        reasons.push("Rare country");
    }

    // ✅ DEVICE RARITY
    const deviceCount = user.userAgentCounts.get(signal.userAgentCategory) || 0;
    if (deviceCount / total < 0.05) {
        risk += 20;
        reasons.push("Uncommon device");
    }

    // ✅ ODD TIME
    if (signal.timeBucket === "Night") {
        risk += 10;
        reasons.push("Odd access time");
    }

    // ✅ BURST DETECTION (Staged Dynamic Thresholds to Detect Proxy Cascades & Intruders)
    const tenMinutesAgo = new Date(Date.now() - 10 * 60 * 1000);

    const recentBurst = user.recentOpens.filter(
        entry => entry.timestamp > tenMinutesAgo
    ).length;

    if (recentBurst >= 13) {
        // Tier 3: Aggressive automated scraping or rapid Google Proxy cascades
        risk += 60;
        reasons.push("Critical automated burst activity");
    } else if (recentBurst >= 9) {
        // Tier 2: Heavy intruder inspection / Fast thread reading
        risk += 50;
        reasons.push("High-volume abnormal burst activity");
    } else if (recentBurst >= 7) {
        // Tier 1: Initial automated trigger or suspicious fast navigation
        risk += 30;
        reasons.push("Abnormal burst activity");
    }


    return { risk, reasons };
}

module.exports = { computeRisk };