# Public portfolio sample — sanitized source-code triage
# Illustrative reconstruction of a read-only repository audit workflow.
# No HID control, device interaction, network requests, AI API calls, or code execution.
[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)]
    [ValidateScript({ Test-Path -LiteralPath $_ -PathType Container })]
    [string]$ProjectRoot,

    [ValidateRange(1024, 1048576)]
    [int]$MaxFileBytes = 131072,

    [ValidateRange(1, 10000)]
    [int]$MaxFiles = 1000
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

$root = (Resolve-Path -LiteralPath $ProjectRoot).ProviderPath.TrimEnd('\', '/')
$ignoredDirectories = @('.git', 'node_modules', '.venv', 'venv', 'dist', 'build', '_audit')
$allowedExtensions = @('.py', '.ps1', '.sh', '.ts', '.tsx', '.js', '.json', '.yaml', '.yml', '.md', '.txt', '.service', '.conf')
$categories = [ordered]@{
    'Image processing' = '(?i)\b(ocr|tesseract|opencv|grayscale|threshold)\b'
    'Device integration' = '(?i)\b(hid|usb|device|raspberry\s*pi)\b'
    'Remote operations' = '(?i)\b(ssh|scp|sftp|systemd|service)\b'
    'Decision pipeline' = '(?i)\b(inference|decision|model|pipeline)\b'
}

# Directory pruning happens BEFORE enumeration of children.
$queue = New-Object 'System.Collections.Generic.Queue[string]'
$queue.Enqueue($root)
$results = New-Object 'System.Collections.Generic.List[object]'
$skipped = New-Object 'System.Collections.Generic.List[object]'
$scanned = 0

while ($queue.Count -gt 0 -and $scanned -lt $MaxFiles) {
    $current = $queue.Dequeue()
    try {
        $entries = @(Get-ChildItem -LiteralPath $current -Force -ErrorAction Stop)
    }
    catch {
        $skipped.Add([pscustomobject]@{ Reason = 'Cannot enumerate directory' })
        continue
    }

    foreach ($entry in $entries) {
        if ($entry.Attributes -band [IO.FileAttributes]::ReparsePoint) {
            $skipped.Add([pscustomobject]@{ Reason = 'Reparse point' })
            continue
        }
        if ($entry.PSIsContainer) {
            if ($ignoredDirectories -notcontains $entry.Name) { $queue.Enqueue($entry.FullName) }
            continue
        }
        if ($scanned -ge $MaxFiles) { break }
        if ($allowedExtensions -notcontains $entry.Extension.ToLowerInvariant()) { continue }
        if ($entry.Length -gt $MaxFileBytes) {
            $skipped.Add([pscustomobject]@{ Reason = 'File exceeds size limit' })
            continue
        }

        $scanned++
        try {
            $content = Get-Content -LiteralPath $entry.FullName -Raw -ErrorAction Stop
            $matches = @(
                foreach ($label in $categories.Keys) {
                    if ($content -match $categories[$label]) { $label }
                }
            )
            if ($matches.Count -eq 0) { continue }

            # Intentionally output NO source text, absolute paths, or credentials.
            $relativePath = $entry.FullName.Substring($root.Length).TrimStart('\', '/')
            $results.Add([pscustomobject]@{
                RelativePath = $relativePath
                Categories   = ($matches -join '; ')
                Bytes        = $entry.Length
            })
        }
        catch {
            $skipped.Add([pscustomobject]@{ Reason = 'Cannot read file' })
        }
    }
}

Write-Output 'PUBLIC SOURCE AUDIT — SUMMARY'
Write-Output ('Files reviewed: {0}' -f $scanned)
Write-Output ('Files with signals: {0}' -f $results.Count)
Write-Output ('Skipped items: {0}' -f $skipped.Count)
if ($scanned -ge $MaxFiles) { Write-Warning 'File limit reached; results are incomplete.' }
$results | Sort-Object RelativePath | Format-Table -AutoSize | Out-String -Width 180 | Write-Output

# This script intentionally does not infer system architecture or completion status.
# A human must inspect the original evidence and validate any architectural claim.