fix: make pure calculate() tolerate omitted optional inputs

[dmchaledev]

Problem

index.d.ts declares scan_window and compliance_needs as optional:

export interface VulnInputs {
  target_hosts: number;
  scan_intensity: ...;
  scan_frequency: ...;
  scan_window?: number;          // optional
  compliance_needs?: string[];   // optional
  scanning_tools: string[];
  ...
}

But the pure calculate() API — the headline DOM-free function — crashed or silently produced NaN when those documented-optional fields were omitted. So a TypeScript consumer gets green typechecking, then a runtime failure.

Reproduced against main:

Call	Result on main
omit compliance_needs	❌ throws Cannot read properties of undefined (reading 'length') (in calcAsmResources)
omit scan_window	⚠️ scan_window_utilization = NaN, efficiency rating wrongly reported as "poor" (the rating chain falls through because NaN <= 60 is false)
omit scanning_tools	❌ throws Cannot read properties of undefined (reading 'includes')

The DOM web component never hit this because _collectInputs()/_run() clamp and default everything first — but the exported calculate() had no such guard. (This is the same class of issue that bit the test suite in #8, which had to manually add scan_window.)

Fix

Add a small normalizeInputs() step at the calculation entry point (calculateResources) that defaults the optional fields before they're used:

• scan_window → 8 when missing or non-positive (also avoids a divide-by-zero → Infinity)
• compliance_needs → [] when missing
• scanning_tools → [] when missing/invalid — note an empty array stays a valid zero-cost state, matching the existing empty scanning_tools array does not crash test (the DOM component injects its own UI-only fallback, the pure function should not)
• scan_intensity / scan_frequency → existing defaults made explicit
• non-finite target_hosts → 1 (defensive; prevents NaN propagating through every metric)

No calculation logic changed for already-valid inputs — this only fills in omitted optional values.

Tests

• 5 new tests in test/calculate.test.mjs (Optional input handling block) covering each omitted field, the zero/invalid scan_window case, and a minimal { target_hosts }-only call.
• 1 new smoke test in test/smoke.test.mjs so the regression is actually guarded by CI today — npm test currently runs only the smoke suite, so the full calculate.test.mjs doesn't run in CI until test: run full test suite in CI, not just smoke tests #11/test: run full test suite in npm test (was only smoke tests) #13 land.

npm test  (CI default): 7 tests, 7 pass
full suite:             71 tests, 71 pass

Note (out of scope)

This PR makes the regression visible in CI via the smoke test, but the broader gap — npm test not running calculate.test.mjs at all — is already tracked by open PRs #11 and #13. Worth merging one of those so the full 71-test suite gates every push.

https://claude.ai/code/session_01Aed4GvoDBzgz6fuPXSHHif

---

Generated by Claude Code