keywright-server 0.0.1__py3-none-any.whl

keywright_server/nudges.py

@@ -0,0 +1,121 @@
+"""Nudges: an agent asking for the human in the conversation.
+
+An approval request is the agent asking to *do* something and waiting on the answer. A nudge is the
+opposite shape: the agent has a question only the human can settle, and the answer comes back in the
+conversation, not through Keywright. So a nudge grants nothing, blocks nothing and is never gated by
+policy - it is a push notification plus a card that stays on the dashboard until the human clears it.
+
+What it does need is a limit. A ping costs the human an interruption, so an agent gets one per
+minute and may leave at most a handful outstanding; repeats of the same question are folded into
+the nudge already on the phone rather than buzzing again.
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import timedelta
+from typing import NamedTuple
+
+from sqlalchemy import select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from . import actions, audit, events
+from .config import settings
+from .models import Agent, Nudge, now
+
+log = logging.getLogger("keywright.nudges")
+
+COOLDOWN_S = 60      # between two different pings from one agent
+MAX_OPEN = 5         # outstanding pings one agent may leave on the dashboard
+MAX_MESSAGE = 1000
+MAX_CONTEXT = 200
+DISMISS = "KWN_DISMISS_"  # phone button: KWN_DISMISS_<nudge id>.<mac>
+
+
+class Ping(NamedTuple):
+    """What happened to an attempt to ping the human."""
+
+    nudge: Nudge | None
+    status: str          # sent | duplicate | throttled | backlog
+    retry_after: int = 0
+
+    @property
+    def delivered(self) -> bool:
+        return self.status in ("sent", "duplicate")
+
+
+def dismiss_action(nudge_id: str) -> str:
+    return actions.sign(DISMISS + nudge_id)
+
+
+def parse_dismiss_action(action: str) -> str | None:
+    """The nudge ID a phone button carries, or None if it is not one of ours."""
+    body = actions.verify(action)
+    return body[len(DISMISS):] or None if body and body.startswith(DISMISS) else None
+
+
+async def open_nudges(db: AsyncSession, agent_id: str | None = None) -> list[Nudge]:
+    q = select(Nudge).where(Nudge.cleared_at.is_(None)).order_by(Nudge.created_at.desc())
+    if agent_id:
+        q = q.where(Nudge.agent_id == agent_id)
+    return list((await db.execute(q)).scalars().all())
+
+
+async def create(db: AsyncSession, agent: Agent, session_id: str | None, message: str,
+                 context: str = "") -> Ping:
+    """Ask for the human. Returns what became of the ask; the caller tells the agent."""
+    message = message.strip()[:MAX_MESSAGE]
+    context = context.strip()[:MAX_CONTEXT]
+    if not message:
+        raise ValueError("A nudge needs a message: say what you need from them.")
+    at = now()
+    mine = await open_nudges(db, agent.id)
+    same = next((n for n in mine if n.message == message and n.session_id == session_id), None)
+    if same is not None:
+        # The same question, still on their phone. Buzzing again would not add anything.
+        return Ping(same, "duplicate")
+    if len(mine) >= MAX_OPEN:
+        return Ping(mine[0] if mine else None, "backlog")
+    last = mine[0].created_at if mine else None
+    if last is not None and (at - last).total_seconds() < COOLDOWN_S:
+        return Ping(mine[0], "throttled", int(COOLDOWN_S - (at - last).total_seconds()) + 1)
+
+    nudge = Nudge(agent_id=agent.id, session_id=session_id, message=message, context=context, created_at=at)
+    db.add(nudge)
+    await db.commit()
+    await db.refresh(nudge)
+    await audit.record(db, tool="attention", decision="sent", agent=agent, session_id=session_id,
+                       detail={"nudge_id": nudge.id, "message": message, "context": context})
+    from .notify.manager import manager
+
+    await manager.notify_nudge(nudge, agent)
+    events.publish("nudge.created", id=nudge.id)
+    return Ping(nudge, "sent")
+
+
+async def clear(db: AsyncSession, nudge_id: str, via: str) -> Nudge | None:
+    """Mark a nudge answered and take it off the phone. Idempotent: two taps clear it once."""
+    changed = await db.execute(update(Nudge).where(
+        Nudge.id == nudge_id, Nudge.cleared_at.is_(None),
+    ).values(cleared_at=now(), cleared_via=via).execution_options(synchronize_session=False))
+    await db.commit()
+    nudge = await db.get(Nudge, nudge_id, populate_existing=True)
+    if nudge is None or changed.rowcount != 1:
+        return nudge
+    await audit.record(db, tool="attention.clear", decision="cleared", agent=nudge.agent,
+                       session_id=nudge.session_id, detail={"nudge_id": nudge.id, "via": via})
+    from .notify.manager import manager
+
+    await manager.nudge_cleared(nudge)
+    events.publish("nudge.cleared", id=nudge.id)
+    return nudge
+
+
+async def expire_stale(db: AsyncSession) -> int:
+    """Nobody is still waiting on a day-old question. Clear it so the phone and dashboard agree."""
+    cutoff = now() - timedelta(seconds=settings.nudge_ttl_s)
+    stale = (await db.execute(select(Nudge.id).where(
+        Nudge.cleared_at.is_(None), Nudge.created_at <= cutoff))).scalars().all()
+    for nudge_id in stale:
+        await clear(db, nudge_id, via="expired")
+    return len(stale)

keywright_server/omada.py

@@ -0,0 +1,179 @@
+"""Omada Open API tools, exposed through the existing MCP approval boundary.
+
+Only the broker sees client credentials and access tokens. Endpoints are fixed:
+tool arguments cannot select an origin, API path, HTTP method, or auth headers.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import ssl
+import time
+from collections import OrderedDict
+from typing import Annotated, Any
+from urllib.parse import urlsplit
+
+import httpx
+import mcp_types as types
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
+
+
+class OmadaError(ValueError):
+    """Safe to display or audit; never includes controller response bodies."""
+
+
+Identifier = Annotated[str, Field(strict=True, pattern=r"^[A-Za-z0-9_-]{1,128}$")]
+
+
+class Page(BaseModel):
+    model_config = ConfigDict(extra="forbid", strict=True)
+    page: int = Field(default=1, ge=1)
+    page_size: int = Field(default=100, ge=1, le=1000)
+
+
+class SitePage(Page):
+    site_id: Identifier
+
+
+class APDetails(BaseModel):
+    model_config = ConfigDict(extra="forbid", strict=True)
+    site_id: Identifier
+    ap_mac: Annotated[str, Field(strict=True, pattern=r"^[0-9A-Fa-f]{2}(?:[:-][0-9A-Fa-f]{2}){5}$")]
+
+
+OPERATIONS = {
+    "omada_list_sites": (Page, "sites", "List accessible Omada sites, one page at a time."),
+    "omada_list_devices": (SitePage, "sites/{site_id}/devices",
+                           "List devices (including routers), status and inventory in an Omada site."),
+    "omada_get_ap": (APDetails, "sites/{site_id}/aps/{ap_mac}",
+                     "Read AP details, including its reported wireless mesh uplink."),
+    "omada_list_clients": (SitePage, "sites/{site_id}/clients",
+                           "List clients in an Omada site, one page at a time."),
+}
+
+# Short-lived bearer tokens stay in memory. The fingerprint includes the connection
+# and credentials, so editing a resource never reuses the previous identity's token.
+_tokens: OrderedDict[str, tuple[float, str]] = OrderedDict()
+
+
+def validate_config(config: dict[str, Any]) -> None:
+    url = config.get("url", "")
+    try:
+        parsed = urlsplit(url)
+        valid = (parsed.scheme == "https" and parsed.hostname and parsed.port != 0
+                 and not parsed.username and not parsed.password
+                 and parsed.path in ("", "/") and not parsed.query and not parsed.fragment
+                 and not any(c.isspace() for c in url) and "\\" not in url)
+    except ValueError:
+        valid = False
+    if not valid:
+        raise OmadaError("Use the HTTPS Interface Access Address, including its port, without an API path.")
+    for key, label in (("omada_id", "Omada ID"), ("client_id", "Client ID")):
+        if not re.fullmatch(r"[A-Za-z0-9_-]{1,128}", config.get(key, "")):
+            raise OmadaError(f"{label} must contain only letters, numbers, underscores and hyphens.")
+    if not config.get("client_secret") or config["client_secret"] == "***":
+        raise OmadaError("An Omada Client Secret is required.")
+    if not isinstance(config.get("verify_tls", True), bool):
+        raise OmadaError("TLS verification must be enabled or disabled explicitly.")
+
+
+def list_tools() -> list[types.Tool]:
+    return [types.Tool(name=name, description=description, input_schema=model.model_json_schema(),
+                       annotations=types.ToolAnnotations(read_only_hint=True, destructive_hint=False,
+                                                         idempotent_hint=True))
+            for name, (model, _, description) in OPERATIONS.items()]
+
+
+def _result(response: httpx.Response) -> Any:
+    if not response.is_success:
+        raise OmadaError(f"Omada returned HTTP {response.status_code}; check the address and app permissions.")
+    try:
+        payload = response.json()
+    except ValueError:
+        raise OmadaError("Omada returned invalid JSON; check the Interface Access Address.") from None
+    if not isinstance(payload, dict) or type(payload.get("errorCode")) is not int:
+        raise OmadaError("Omada returned an unexpected API response.")
+    if payload["errorCode"] != 0:
+        raise OmadaError(f"Omada API error {payload['errorCode']}; check app credentials, site privileges "
+                         "and controller API compatibility.")
+    if "result" not in payload:
+        raise OmadaError("Omada response is missing its result.")
+    return payload["result"]
+
+
+async def _token(client: httpx.AsyncClient, config: dict[str, Any], key: str) -> str:
+    cached = _tokens.get(key)
+    if cached and time.monotonic() < cached[0]:
+        _tokens.move_to_end(key)
+        return cached[1]
+    result = _result(await client.post(config["url"].rstrip("/") + "/openapi/authorize/token",
+                                      params={"grant_type": "client_credentials"},
+                                      json={"omadacId": config["omada_id"], "client_id": config["client_id"],
+                                            "client_secret": config["client_secret"]}))
+    if not isinstance(result, dict):
+        raise OmadaError("Omada returned an invalid token response.")
+    token, expires = result.get("accessToken"), result.get("expiresIn")
+    if (not isinstance(token, str) or not token or not token.isascii()
+            or any(c.isspace() or ord(c) < 32 or ord(c) == 127 for c in token)
+            or type(expires) is not int or expires <= 0):
+        raise OmadaError("Omada returned an invalid access token or expiry.")
+    _tokens[key] = (time.monotonic() + max(0, min(expires, 7200) - 30), token)
+    _tokens.move_to_end(key)
+    while len(_tokens) > 128:
+        _tokens.popitem(last=False)
+    return token
+
+
+async def request(config: dict[str, Any], tool: str, arguments: dict[str, Any]) -> Any:
+    if tool not in OPERATIONS:
+        raise OmadaError("Unknown Omada tool.")
+    model, path, _ = OPERATIONS[tool]
+    try:
+        args = model.model_validate(arguments)
+    except ValidationError:
+        raise OmadaError("Invalid Omada arguments; use the tool schema.") from None
+    validate_config(config)
+    verify: bool | ssl.SSLContext = config.get("verify_tls", True)
+    if verify and config.get("ca_bundle"):
+        try:
+            verify = ssl.create_default_context(cafile=config["ca_bundle"])
+        except (OSError, ssl.SSLError):
+            raise OmadaError("Could not load the configured Omada CA certificate bundle.") from None
+    key = hashlib.sha256(json.dumps(config, sort_keys=True).encode()).hexdigest()
+    path_args = args.model_dump()
+    if isinstance(args, APDetails):
+        path_args["ap_mac"] = args.ap_mac.replace(":", "-").upper()
+    params = {"page": args.page, "pageSize": args.page_size} if isinstance(args, Page) else {}
+    url = (config["url"].rstrip("/") + "/openapi/v1/" + config["omada_id"] + "/"
+           + path.format(**path_args))
+    try:
+        async with httpx.AsyncClient(verify=verify, timeout=30, follow_redirects=False, trust_env=False) as client:
+            for attempt in range(2):
+                token = await _token(client, config, key)
+                response = await client.get(url, params=params,
+                                            headers={"Authorization": f"AccessToken={token}"})
+                if response.status_code == 401:
+                    _tokens.pop(key, None)
+                    if attempt == 0:
+                        continue
+                return _result(response)
+    except httpx.HTTPError:
+        raise OmadaError("Could not reach the Omada API; check connectivity and TLS certificate settings.") from None
+
+
+async def call_tool(config: dict[str, Any], tool: str, arguments: dict[str, Any]) -> types.CallToolResult:
+    try:
+        result = await request(config, tool, arguments)
+    except OmadaError as e:
+        return types.CallToolResult(is_error=True, content=[types.TextContent(type="text", text=str(e))])
+    return types.CallToolResult(content=[types.TextContent(type="text", text=json.dumps(result))])
+
+
+async def probe(config: dict[str, Any]) -> tuple[bool, str]:
+    try:
+        await request(config, "omada_list_sites", {"page_size": 1})
+    except OmadaError as e:
+        return False, str(e)
+    return True, "Connected to Omada Open API; site listing succeeded."

keywright_server/policy.py

@@ -0,0 +1,265 @@
+"""The decision engine.
+
+For every required pattern, in order:
+  1. a matching `deny` policy            -> denied
+  2. an active grant for this agent      -> allowed (once-grants are consumed in the same transaction)
+  3. a matching `allow` policy           -> allowed
+  4. the resource's default mode         -> open: allowed / locked: locked / approval: needs a request
+
+An operation flagged high or critical by `hazards` skips 3 and 4 and, in 2, accepts only a once
+grant bound to this exact operation: whatever standing access exists, a human has to approve that
+command line, and the approval is used up by it. Critical operations never reach here; the tool
+layer refuses them before asking.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime
+
+from keywright import patterns as pat
+from keywright.hazards import blocks, worst
+from sqlalchemy import select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from . import llm
+from .access import binds_operation, constraint_label, grant_constraints, operation_matches, target_of
+from .models import AccessRequest, Agent, Grant, Policy, Resource, now
+
+
+@dataclass
+class Verdict:
+    allowed: bool = False
+    status: str = "pending"  # allow | deny | locked | pending | unknown
+    missing: list[str] = field(default_factory=list)  # patterns needing approval
+    denied: list[str] = field(default_factory=list)
+    locked: list[str] = field(default_factory=list)
+    unknown: list[str] = field(default_factory=list)  # no such resource
+    consumed_grants: list[str] = field(default_factory=list)
+    matched: dict[str, str] = field(default_factory=dict)  # pattern -> what allowed it
+    bound: dict[str, str] = field(default_factory=dict)  # pattern -> how far that grant or rule reaches
+    request_ids: list[str] = field(default_factory=list)
+    hazard: str | None = None  # worst hazard level of the operation, if any
+
+
+async def evaluate(
+    db: AsyncSession,
+    agent: Agent,
+    session_id: str | None,
+    required: list[str],
+    *,
+    consume: bool = True,
+    operation: dict | None = None,
+    discovery: bool = False,
+) -> Verdict:
+    """Evaluate `required` for `agent`. With consume=True, matching once-grants are decremented
+    and the transaction is committed when everything is allowed."""
+    at = now()
+    if discovery and consume:
+        raise ValueError("Discovery cannot consume grants")
+    expected_hash = agent.token_hash
+    current = await db.get(Agent, agent.id, populate_existing=True)
+    if current is None or current.disabled or current.token_hash != expected_hash:
+        return Verdict(status="deny", denied=list(required))
+    policies = (
+        await db.execute(select(Policy).execution_options(populate_existing=True).where(
+            (Policy.agent_id == agent.id) | Policy.agent_id.is_(None)))
+    ).scalars().all()
+    grants = (
+        await db.execute(select(Grant).execution_options(populate_existing=True).where(
+            Grant.agent_id == agent.id, Grant.revoked_at.is_(None)))
+    ).scalars().all()
+    resources = {r.path_prefix: r for r in (await db.execute(
+        select(Resource).execution_options(populate_existing=True))).scalars().all()}
+    request_ids = {g.request_id for g in grants if g.scope == "once" and g.request_id}
+    requests = {r.id: r for r in (await db.execute(
+        select(AccessRequest).where(AccessRequest.id.in_(request_ids)))).scalars().all()} if request_ids else {}
+
+    v, to_consume = decide(
+        agent, session_id, required, policies=policies, grants=grants, resources=resources,
+        requests=requests, at=at, operation=operation, discovery=discovery,
+    )
+    if v.allowed and consume and to_consume:
+        # Conditional updates serialize competing calls in the database, across workers too.
+        # Consume each grant once per operation, even if it covers multiple required paths.
+        for gid in sorted({g.id for g in to_consume}):
+            changed = await db.execute(update(Grant).where(
+                Grant.id == gid, Grant.revoked_at.is_(None), Grant.uses_remaining > 0,
+                (Grant.expires_at.is_(None)) | (Grant.expires_at > now()),
+            ).values(uses_remaining=Grant.uses_remaining - 1).execution_options(synchronize_session=False))
+            if changed.rowcount != 1:
+                await db.rollback()
+                await db.refresh(agent)
+                return Verdict(status="pending", missing=list(required))
+            v.consumed_grants.append(gid)
+        await db.commit()
+    return v
+
+
+def decide(
+    agent: Agent,
+    session_id: str | None,
+    required: list[str],
+    *,
+    policies: list[Policy],
+    grants: list[Grant],
+    resources: dict[str, Resource],
+    requests: dict[str, AccessRequest],
+    at: datetime,
+    operation: dict | None = None,
+    discovery: bool = False,
+) -> tuple[Verdict, list[Grant]]:
+    """Pure decision shared by live enforcement and history previews.
+
+    Inputs are the current agent's applicable policies/grants and a resource snapshot.
+    The returned grant list is a consumption plan; only evaluate() can spend it.
+    """
+    if agent.disabled:
+        return Verdict(status="deny", denied=list(required)), []
+    v = Verdict(hazard=worst(operation.get("hazards")) if operation else None)
+    fresh_only = blocks(v.hazard)
+
+    def eligible(g: Grant, op: dict) -> bool:
+        req = requests.get(g.request_id)
+        if req and req.session_id and req.session_id != session_id:
+            return False
+        return discovery or operation_matches(grant_constraints(g, req), op)
+
+    to_consume: list[Grant] = []
+    for path in required:
+        rp = pat.resource_of(path)
+        res = resources.get(f"{rp[0]}/{rp[1]}") if rp else None
+        if res is None:
+            v.unknown.append(path)
+            continue
+        # Without an operation, rules bound to this target still apply; exact-operation rules do not.
+        op = operation if operation is not None else target_of(res)
+        deny_matches = pat.overlaps if "*" in path else pat.matches
+        allow_matches = pat.covers if "*" in path else pat.matches
+        if any(p.effect == "deny" and deny_matches(p.pattern, path)
+               and operation_matches(p.constraints, op) for p in policies):
+            v.denied.append(path)
+            continue
+        active = [g for g in grants if g.is_active(at, session_id)
+                  and allow_matches(g.pattern, path) and eligible(g, op)
+                  and (not fresh_only or (g.scope == "once" and binds_operation(grant_constraints(g, requests.get(g.request_id)))))]
+        if active:
+            # prefer grants that don't get used up, then the most specific one
+            active.sort(key=lambda g: (g.scope == "once", -pat.specificity(g.pattern)))
+            g = active[0]
+            v.matched[path] = f"grant:{g.id}"
+            v.bound[path] = constraint_label(grant_constraints(g, requests.get(g.request_id)))
+            if g.request_id and g.request_id not in v.request_ids:
+                v.request_ids.append(g.request_id)
+            if g.scope == "once":
+                to_consume.append(g)
+            continue
+        if fresh_only:
+            v.missing.append(path)
+            continue
+        allow = [p for p in policies if p.effect == "allow" and allow_matches(p.pattern, path)
+                 and (discovery or operation_matches(p.constraints, op))]
+        if allow:
+            v.matched[path] = f"policy:{allow[0].id}"
+            v.bound[path] = constraint_label(allow[0].constraints)
+            if allow[0].request_id and allow[0].request_id not in v.request_ids:
+                v.request_ids.append(allow[0].request_id)
+            continue
+        if res.default_mode == "open":
+            v.matched[path] = "resource:open"
+        elif res.default_mode == "locked":
+            v.locked.append(path)
+        else:
+            v.missing.append(path)
+
+    if v.denied:
+        v.status = "deny"
+    elif v.unknown:
+        v.status = "unknown"
+    elif v.locked:
+        v.status = "locked"
+    elif v.missing:
+        v.status = "pending"
+    else:
+        v.status = "allow"
+        v.allowed = True
+    return v, to_consume
+
+
+async def effective_access(db: AsyncSession, agent: Agent, session_id: str | None) -> list[dict]:
+    """What `access_list_resources` shows: per resource, the agent's current standing."""
+    at = now()
+    out = []
+    resources = (await db.execute(select(Resource).order_by(Resource.kind, Resource.name))).scalars().all()
+    policies = (
+        await db.execute(select(Policy).execution_options(populate_existing=True).where(
+            (Policy.agent_id == agent.id) | Policy.agent_id.is_(None)))
+    ).scalars().all()
+    grants = (
+        await db.execute(select(Grant).execution_options(populate_existing=True).where(
+            Grant.agent_id == agent.id, Grant.revoked_at.is_(None)))
+    ).scalars().all()
+    legacy_ids = {g.request_id for g in grants if g.scope == "once" and not g.constraints and g.request_id}
+    legacy_requests = {r.id: r for r in (await db.execute(select(AccessRequest).where(
+        AccessRequest.id.in_(legacy_ids)))).scalars().all()} if legacy_ids else {}
+    for r in resources:
+        if r.config.get("adapter") == "knowledge":
+            # Collection names/descriptions are knowledge metadata too. Discover only collections
+            # with an available tool; every actual call is still gated independently.
+            from .knowledge_mcp import OPERATIONS
+            visible = False
+            for tool in OPERATIONS:
+                verdict = await evaluate(db, agent, session_id, [f"mcp/{r.name}/tools/{tool}"],
+                                         consume=False, discovery=True)
+                if verdict.status not in ("deny", "locked", "unknown"):
+                    visible = True
+                    break
+            if not visible:
+                continue
+        prefix = r.path_prefix
+        entry = {
+            "resource": prefix,
+            "kind": r.kind,
+            "default": r.default_mode,
+            "description": r.description,
+            **({"argument_keys": list(r.config.get("arg_keys") or []),
+                "bundles": {n: [f"mcp/{r.name}/{e}" for e in es] for n, es in (r.config.get("bundles") or {}).items()}}
+               if r.kind == "mcp" else {}),
+            **({"models": llm.model_paths(r), "limits_per_lease": llm.limits_of(r.config),
+                "agent_budget": llm.agent_budget_of(r.config),
+                "budgets_enforced": llm.enforces_budgets(r.config.get("health")),
+                "note": "Ask for llm/<gateway>/model/<model> patterns with access_request; an approval is a timed "
+                        "lease with a spend ceiling, never once or always."}
+               if r.kind == "llm" else {}),
+            "allow_rules": sorted({p.pattern for p in policies if p.effect == "allow" and not p.constraints
+                                   and _touches(p.pattern, prefix)}),
+            "deny_rules": sorted({p.pattern for p in policies if p.effect == "deny" and not p.constraints
+                                  and _touches(p.pattern, prefix)}),
+            "constrained_rules": [
+                {"pattern": p.pattern, "effect": p.effect, "constraints": p.constraints}
+                for p in policies if p.constraints and _touches(p.pattern, prefix)
+            ],
+            "grants": [
+                {
+                    "pattern": g.pattern,
+                    "scope": g.scope,
+                    "expires_at": _iso(g.expires_at),
+                    "uses_remaining": g.uses_remaining,
+                    "constraints": grant_constraints(g, legacy_requests.get(g.request_id)),
+                }
+                for g in grants
+                if g.is_active(at, session_id) and _touches(g.pattern, prefix)
+            ],
+        }
+        out.append(entry)
+    return out
+
+
+def _touches(pattern: str, prefix: str) -> bool:
+    p = pattern.split("/")
+    q = prefix.split("/")
+    return all(a in ("*", "**") or a == b for a, b in zip(p[:2], q, strict=False)) or p[0] == "**"
+
+
+def _iso(d: datetime | None) -> str | None:
+    return d.isoformat() if d else None