fix: make calculate() tolerant of omitted optional inputs

[dmchaledev]

Problem

The public, exported calculate() function contradicts its own published type declarations. index.d.ts marks scan_window, compliance_needs, scan_intensity, scan_frequency, and scanning_tools as optional, but the runtime requires several of them:

• Omitting compliance_needs throws TypeError: Cannot read properties of undefined (reading 'length') (e.g. hailbytes-vuln-calculator.js:76).
• Omitting scan_window silently corrupts the result — scan_window_utilization becomes NaN and the efficiency rating falls through to a bogus "poor".

Reproduction (with the test suite's DOM shim):

calculate({ target_hosts: 1000, scan_intensity: 'medium', scan_frequency: 'weekly', scanning_tools: ['hailbytes_asm'] });
// → THREW: Cannot read properties of undefined (reading 'length')

calculate({ target_hosts: 1000, scan_intensity: 'medium', scan_frequency: 'weekly', scanning_tools: ['openvas'], compliance_needs: [] });
// → scan_window_utilization: NaN, efficiency_rating: "poor"

Anyone using the documented programmatic API (import { calculate }) per the TS types hits this immediately.

Fix

Add a single normalizeInputs() step at the top of the calculation engine that applies the same defaults and range clamps the web component's _collectInputs() already uses:

• target_hosts → clamped 1–50,000 (default 1000)
• scan_window → clamped 1–24 (default 8)
• scan_intensity → default medium, scan_frequency → default weekly
• scanning_tools / compliance_needs → default to [] when missing or non-array

The Shadow DOM UI path is unaffected, since _collectInputs() already supplies complete, clamped values — normalization is a no-op for it.

Tests

Adds 5 regression tests (omitted compliance_needs, omitted scan_window → finite utilization, default-equivalence with explicit 8, a bare { target_hosts } input, and clamping of out-of-range values). Full suite: 70 passing (was 65).

Also updates the README input schema (notes which fields are optional + the defaults) and the CHANGELOG.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Egbm6uvXq2wZHw4Pbdg7c8

---

Generated by Claude Code