# 共享函数：密码只通过环境传入进程，SQL 通过标准输入传入，避免出现在命令行。
function Invoke-TPlusContainerSql {
    param(
        [string]$ContainerName,
        [string]$Sql,
        [SecureString]$SaPassword
    )
    $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($SaPassword)
    $previousPassword = [Environment]::GetEnvironmentVariable("SQLCMDPASSWORD", "Process")
    try {
        $env:SQLCMDPASSWORD = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)
        $OutputEncoding = [Text.UTF8Encoding]::new($false)
        $Sql | docker exec -i --env SQLCMDPASSWORD $ContainerName /opt/mssql-tools18/bin/sqlcmd `
            -S localhost -U sa -C -b -t 0 -w 65535 -W -s "|"
        if ($LASTEXITCODE -ne 0) { throw "SQL Server 命令失败，请检查已脱敏的核验结果。" }
    } finally {
        [Environment]::SetEnvironmentVariable("SQLCMDPASSWORD", $previousPassword, "Process")
        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr)
    }
}