fix: make calculate() tolerate omitted optional inputs

[dmchaledev]

Problem

The exported pure calculate() API crashes or returns garbage when called with the very fields that the published index.d.ts marks as optional:

export interface VulnInputs {
  scan_window?: number;        // optional
  compliance_needs?: string[]; // optional
  ...
}

Verified against the current code:

Input	Result before
calculate({ target_hosts, scan_intensity, scan_frequency, scan_window, scanning_tools }) — omit compliance_needs	throws TypeError: Cannot read properties of undefined (reading 'length') (calcAsmResources → data.compliance_needs.length)
omit scan_window	scan_window_utilization: NaN, efficiency_rating: "poor" (bogus)

So any consumer who follows the published type contract and omits an optional field gets a crash or nonsense output. The DOM path is unaffected because _collectInputs() already fills/clamps these — but the pure function (a documented public export) had no such guard.

Fix

Add a normalizeInputs() step at the entry of the calculation engine that:

• defaults scan_intensity (medium), scan_frequency (weekly), scan_window (8)
• clamps target_hosts to 1–50000 and scan_window to 1–24 — the same limits the form UI already enforces in _collectInputs(), now centralized so the API and UI agree
• coerces non-array scanning_tools / compliance_needs to []
• preserves an empty scanning_tools list as "no tools" → zero tool cost (existing documented behavior; the web component keeps its own openvas fallback in _run())

No behavior change for valid in-range inputs — all 65 pre-existing tests still pass.

Tests

Added 6 regression tests (Input normalization & optional fields) covering omitted compliance_needs/scan_window, non-array values, out-of-range clamping, and a fully empty {} input.

# tests 71
# pass 71
# fail 0

🤖 Generated with Claude Code

https://claude.ai/code/session_01VyuV5gj943Td821veoK9AL

---

Generated by Claude Code