param([Parameter(Mandatory=$true)][string]$OutputDirectory,[int]$RetentionDays=30)
$ErrorActionPreference='Stop'
if(-not $env:DATABASE_URL){throw 'DATABASE_URL is required'}
$uri=[Uri]$env:DATABASE_URL
if($uri.Scheme -ne 'mysql'){throw 'DATABASE_URL must use mysql'}
$database=$uri.AbsolutePath.TrimStart('/')
if(-not $database){throw 'database name is required'}
$resolved=[IO.Path]::GetFullPath($OutputDirectory)
New-Item -ItemType Directory -Force -Path $resolved | Out-Null
$stamp=(Get-Date).ToUniversalTime().ToString('yyyyMMddTHHmmssZ')
$target=Join-Path $resolved "$database-$stamp.sql"
$credential=$uri.UserInfo.Split(':',2)
$env:MYSQL_PWD=[Uri]::UnescapeDataString($credential[1])
& mysqldump --single-transaction --set-gtid-purged=OFF --host $uri.Host --port $uri.Port --user ([Uri]::UnescapeDataString($credential[0])) --result-file $target $database
if($LASTEXITCODE -ne 0){throw 'mysqldump failed'}
$hash=(Get-FileHash -Algorithm SHA256 -LiteralPath $target).Hash.ToLowerInvariant()
Set-Content -LiteralPath "$target.sha256" -Value "$hash  $([IO.Path]::GetFileName($target))"
Get-ChildItem -LiteralPath $resolved -File | Where-Object {$_.LastWriteTimeUtc -lt (Get-Date).ToUniversalTime().AddDays(-$RetentionDays) -and ($_.Extension -eq '.sql' -or $_.Name.EndsWith('.sql.sha256'))} | Remove-Item -Force
Write-Output $target