vault license inspect /path/to/new_license.hclic | grep -o '{.*}' | jq '{modules: .flags.modules, features: .features}'

cat << 'EOF' > vault_adp_check.sh
#!/bin/bash

# Generate Timestamp: YYYYMMDD_SS
TIMESTAMP=$(date +%Y%m%d_%S)
OUTPUT_FILE=""
DELAY=0.1 
BYPASS_PROMPT=false
CURRENT_COUNT=0

usage() {
    echo "Usage: $0 [-f] [-y] [-d seconds]"
    echo "  -f            Save results to ${TIMESTAMP}_vault_assessment.txt"
    echo "  -y            Bypass the confirmation prompt (Yes to all)"
    echo "  -d seconds    Set custom API delay in seconds [Default: 0.1s]"
    exit 1
}

while getopts "fyd:" opt; do
    case $opt in
        f) OUTPUT_FILE="${TIMESTAMP}_vault_assessment.txt" ;;
        y) BYPASS_PROMPT=true ;;
        d) DELAY=$OPTARG ;;
        *) usage ;;
    esac
done

echo "⏳ Pre-scanning environment for namespace count..."

# Queue-based non-recursive scan for maximum compatibility
ALL_NS=("")
QUEUE=("")
while [ ${#QUEUE[@]} -gt 0 ]; do
    CURRENT_SCAN_NS="${QUEUE[0]}"
    QUEUE=("${QUEUE[@]:1}") # Pop from queue
    
    export VAULT_NAMESPACE="$CURRENT_SCAN_NS"
    CHILDREN=$(vault namespace list -format=json 2>/dev/null | jq -r '.[]' || echo "")
    
    for CHILD in $CHILDREN; do
        FULL_PATH="${CURRENT_SCAN_NS}${CHILD}"
        ALL_NS+=("$FULL_PATH")
        QUEUE+=("$FULL_PATH")
    done
done
TOTAL_NS=${#ALL_NS[@]}
unset VAULT_NAMESPACE

echo "------------------------------------------------"
echo "🔍 Assessment Configuration:"
echo "📊 Total namespaces to check: $TOTAL_NS"
echo "⏱️  Throttling: ${DELAY} seconds delay per namespace"
if [[ -n "$OUTPUT_FILE" ]]; then
    echo "💾 Output file: $OUTPUT_FILE"
fi
echo "------------------------------------------------"

if [ "$BYPASS_PROMPT" = false ]; then
    read -p "Do you want to proceed with the assessment? (y/n): " confirm
    if [[ $confirm != [yY] && $confirm != [yY][eE][sS] ]]; then
        echo "❌ Assessment aborted by user."
        exit 0
    fi
fi

assess_all() {
    local current_ns="$1"
    export VAULT_NAMESPACE="$current_ns"
    ((CURRENT_COUNT++))
    
    local progress="[$CURRENT_COUNT/$TOTAL_NS]"
    sleep $DELAY

    local engines=$(vault secrets list -format=json 2>/dev/null | jq -r 'to_entries[] | select(.value.type=="transform" or .value.type=="kmip" or .value.type=="keymgmt") | "\(.key)|\(.value.type)"')
    
    if [[ -n "$engines" ]]; then
        echo "$progress Namespace: [${current_ns:-root}]"
        echo "$engines" | while IFS='|' read -r p t; do
            local et=0; local label=""; local builtins=0
            case "$t" in 
                transform) 
                    label="custom items"
                    local rc=$(vault list -format=json "${p}role" 2>/dev/null | jq '. | length' || echo 0)
                    local tc=$(vault list -format=json "${p}transformation" 2>/dev/null | jq '. | length' || echo 0)
                    local all_ac=$(vault list -format=json "${p}alphabet" 2>/dev/null | jq '. | length' || echo 0)
                    local custom_ac=$(vault list -format=json "${p}alphabet" 2>/dev/null | jq -r '.[]' | grep -v "builtin/" | wc -l | tr -d ' ')
                    et=$((rc + tc + custom_ac)); builtins=$((all_ac - custom_ac)) ;;
                kmip)      
                    label="scopes/clients"
                    local sc=$(vault list -format=json "${p}scope" 2>/dev/null | jq '. | length' || echo 0)
                    local cc=$(vault list -format=json "${p}client" 2>/dev/null | jq '. | length' || echo 0)
                    et=$((sc + cc)) ;; 
                keymgmt)   
                    label="keys/providers"
                    for sub in "key" "kms" "provider"; do
                        local c=$(vault list -format=json "${p}${sub}" 2>/dev/null | jq '. | length' || echo 0)
                        et=$((et + c))
                    done ;; 
            esac

            if [[ "$et" -gt 0 ]]; then
                echo "  ⚠️ CRITICAL: [/$p] is ACTIVE ($et $label found)"
            elif [[ "$builtins" -gt 0 ]]; then
                echo "  ℹ️ [/$p] is EMPTY ($builtins built-ins detected)"
            else
                echo "  ℹ️ [/$p] is EMPTY"
            fi
        done
    else
        echo "$progress Namespace: [${current_ns:-root}] - No ADP engines."
    fi

    local children=$(vault namespace list -format=json 2>/dev/null | jq -r '.[]' || echo "")
    for child in $children; do
        assess_all "${current_ns}${child}"
    done
}

# Execute
if [[ -n "$OUTPUT_FILE" ]]; then
    assess_all "" | tee "$OUTPUT_FILE"
    echo "------------------------------------------------"
    echo "✅ Assessment Complete. Results: $OUTPUT_FILE"
else
    assess_all ""
    echo "------------------------------------------------"
    echo "✅ Assessment Complete."
    echo "💡 TIP: Use -f to save to file, -d to adjust delay, and -y to skip prompt."
fi
unset VAULT_NAMESPACE
EOF

chmod +x vault_adp_check.sh
./vault_adp_check.sh