athena-python-docx 0.44.0__tar.gz → 0.45.0__tar.gz

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: athena-python-docx
-Version: 0.44.0
+Version: 0.45.0
 Summary: Drop-in replacement for python-docx that connects to Athena's DOCX Studio collaborative document stack
 Project-URL: Homepage, https://athenaintelligence.ai
 Author-email: Athena Intelligence <engineering@athenaintelligence.ai>

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/docx/__init__.py

@@ -6,7 +6,7 @@ See CLAUDE.md for the API parity contract.
 
 from __future__ import annotations
 
-__version__ = "0.44.0"
+__version__ = "0.45.0"
 
 from docx.api import Document
 from docx._buffer import discard_all, flush_all

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/docx/_asset_token.py

@@ -13,8 +13,9 @@ A call on an existing Word document reaches DOCX Studio with, in this order:
 4. otherwise ``ATHENA_API_KEY`` itself, as before.
 
 Creating a document (``Document.create``, its upload) keeps the key of 1, 2 or
-4: a document that does not exist yet has no token. A token goes only to its
-own document's routes.
+4: a document that does not exist yet has no token. In case 3 Athena's public
+API creates it instead (``docx._public_create``). A token goes only to its own
+document's routes.
 
 A token is minted once per (agora, key, asset, access) for the whole process,
 again 90 seconds before it expires, and once more when the studio answers 401.
@@ -28,7 +29,9 @@ or locally; both work.
 
 Athena's refusals (400, 401, 403, 404, 422) raise at once, without a retry. A
 deployment that signs no asset tokens answers 503: the client then uses the
-studio key when one is set, and otherwise raises an error that names it.
+studio key when one is set, and otherwise raises an error that names it. An
+Athena older than the route answers FastAPI's bare 404 (``{"detail": "Not
+Found"}``): the client then sends ``ATHENA_API_KEY``, as before the route.
 """
 
 from __future__ import annotations
@@ -112,6 +115,26 @@ class SigningUnavailable(Exception):
     """Athena's 503: this deployment signs no asset tokens."""
 
 
+class MintRouteMissing(Exception):
+    """A 404 with FastAPI's bare route-not-found body: the Athena at
+    ``ATHENA_API_URL`` predates the studio-token route (a self-hosted release
+    older than the SDK). The client then sends ``ATHENA_API_KEY``, as before."""
+
+
+#: What FastAPI answers for a path no route matches. Athena's own 404 from the
+#: studio-token route names the asset ("Asset not found."), so the two never mix.
+_ROUTE_NOT_FOUND_BODY = {"detail": "Not Found"}
+
+
+def _is_route_missing(response: requests.Response) -> bool:
+    if response.status_code != 404:
+        return False
+    try:
+        return bool(response.json() == _ROUTE_NOT_FOUND_BODY)
+    except ValueError:
+        return False
+
+
 class _TokenCache:
     """Process-wide tokens by (agora, key, asset, access), least recently used first."""
 
@@ -274,6 +297,8 @@ class TokenMinter:
         status = response.status_code
         if status == 503:
             raise SigningUnavailable(_detail(response) or "This deployment signs no asset tokens.")
+        if _is_route_missing(response):
+            raise MintRouteMissing(f"no studio-token route at {response.url}")
         detail = _detail(response)
         reason = f"(HTTP {status}{': ' + detail if detail else ''})"
         if status == 401:

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/docx/_http.py

@@ -45,8 +45,10 @@ def _resolve_api_key(api_key: str | None) -> str | None:
     makes. Both create paths land outside Athena's public API (docx-studio's
     ``/docs/empty``, agora's ``/api/docx-studio/assets``), and inside an Athena
     session VM or computer ``ATHENA_API_KEY`` is a credential only that public
-    API (``/api/v0``) accepts. ``ATHENA_API_KEY`` stays the fallback for an
-    environment that sets no studio key (local use with one personal key).
+    API (``/api/v0``) accepts: there (neither key set, ``ATHENA_API_URL`` set)
+    Athena's public API creates the document instead (``docx._public_create``).
+    ``ATHENA_API_KEY`` stays the fallback for an environment that sets no
+    studio key and no ``ATHENA_API_URL`` (local use with one personal key).
     The new document is owned by the user the key belongs to.
     """
     return api_key or os.environ.get(_API_KEY_ENV) or os.environ.get("ATHENA_API_KEY")
@@ -137,6 +139,14 @@ def create_empty_document(
             "Pass base_url= to Document.create() or set the env var "
             '(e.g. ATHENA_DOCX_BASE_URL="https://docx-studio.prd.athenaintel.com").',
         )
+    created = _create_through_athena(
+        api_key=api_key,
+        name=name,
+        parent_folder_id=parent_folder_id,
+        workspace_id=workspace_id,
+    )
+    if created is not None:
+        return created
     if not resolved_key:
         raise AuthenticationError(
             f"Missing api_key and {_API_KEY_ENV} env var. "
@@ -221,6 +231,44 @@ def create_empty_document(
     )
 
 
+def _create_through_athena(
+    *,
+    api_key: str | None,
+    name: str | None,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+) -> CreateAssetResult | None:
+    """A new document Athena's public API made, or None for docx-studio's path.
+
+    Athena creates it when no ``api_key`` and no ``ATHENA_DOCX_API_KEY`` are set
+    and ``ATHENA_API_KEY`` and ``ATHENA_API_URL`` are (``docx._public_create``).
+    None otherwise, and when that Athena predates the public create.
+    """
+    from docx._public_create import (
+        PublicApi,
+        PublicCreateUnavailable,
+        create_word_document,
+    )
+
+    api = PublicApi.for_creation(api_key=api_key)
+    if api is None:
+        return None
+    try:
+        created = create_word_document(
+            api=api,
+            name=name,
+            parent_folder_id=parent_folder_id,
+            workspace_id=workspace_id or os.environ.get("ATHENA_WORKSPACE_ID"),
+        )
+    except PublicCreateUnavailable:
+        return None
+    return CreateAssetResult(
+        asset_id=created["asset_id"],
+        name=created["title"],
+        workspace_id=created["workspace_id"] or "",
+    )
+
+
 class UploadAssetResult(TypedDict):
     """Parsed response from the create-and-import upload flow."""
 
@@ -228,6 +276,58 @@ class UploadAssetResult(TypedDict):
     name: str
 
 
+def _upload_through_athena(
+    *,
+    docx_path: str,
+    api_key: str | None,
+    name: str | None,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+    source_asset_id: str | None,
+    timeout: float,
+) -> UploadAssetResult | None:
+    """A document Athena made from the ``.docx`` at ``docx_path``, or None.
+
+    Athena's ``POST /api/v0/assets/create-from-file`` makes it in one request
+    when no ``api_key`` and no ``ATHENA_DOCX_API_KEY`` are set and
+    ``ATHENA_API_KEY`` and ``ATHENA_API_URL`` are (``docx._public_create``).
+    None otherwise, and when that Athena predates the route: the upload then
+    goes through agora's docx-studio bridge, as before.
+    """
+    from docx._public_create import (
+        PublicApi,
+        PublicCreateUnavailable,
+        create_word_document_from_file,
+    )
+
+    api = PublicApi.for_creation(api_key=api_key)
+    if api is None:
+        return None
+    if not os.path.exists(docx_path):
+        raise SessionError(f"DOCX file not found: {docx_path}")
+    if not docx_path.lower().endswith(".docx"):
+        raise SessionError(
+            f"Only .docx files are accepted by the upload endpoint (got {docx_path})",
+        )
+    title = name
+    if title is None:
+        base = os.path.basename(docx_path)
+        title = base[:-5] if base.lower().endswith(".docx") else base
+    try:
+        created = create_word_document_from_file(
+            api=api,
+            docx_path=docx_path,
+            title=title,
+            parent_folder_id=parent_folder_id,
+            workspace_id=workspace_id or os.environ.get("ATHENA_WORKSPACE_ID"),
+            source_asset_id=source_asset_id,
+            timeout=timeout,
+        )
+    except PublicCreateUnavailable:
+        return None
+    return UploadAssetResult(asset_id=created["asset_id"], name=created["title"])
+
+
 def upload_document(
     *,
     docx_path: str,
@@ -273,6 +373,18 @@ def upload_document(
     import base64
     import os
 
+    uploaded = _upload_through_athena(
+        docx_path=docx_path,
+        api_key=api_key,
+        name=name,
+        parent_folder_id=parent_folder_id,
+        workspace_id=workspace_id,
+        source_asset_id=source_asset_id,
+        timeout=timeout,
+    )
+    if uploaded is not None:
+        return uploaded
+
     resolved_docx_base: str | None = docx_base_url or os.environ.get(_BASE_URL_ENV)
     resolved_key: str | None = _resolve_api_key(api_key)
     resolved_agora_base: str | None = (

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/docx/_http_doc.py

@@ -47,6 +47,7 @@ from docx._asset_token import (
     EDIT,
     STUDIO_KEY_ENV,
     VIEW,
+    MintRouteMissing,
     SigningUnavailable,
     StudioToken,
     TokenMinter,
@@ -1127,6 +1128,10 @@ class HttpClient:
             token = minter.token(asset_id=asset_id, access=access)
         except SigningUnavailable as exc:
             return self._without_asset_tokens(asset_id=asset_id, reason=str(exc)), None
+        except MintRouteMissing:
+            # The Athena at ATHENA_API_URL predates the route: the key, as before.
+            self._asset_tokens = None
+            return self._api_key, None
         return token.token, (token, access)
 
     def _without_asset_tokens(self, *, asset_id: str, reason: str) -> str:
@@ -1160,7 +1165,7 @@ class HttpClient:
             minter.invalidate(token=refused, access=granted_access)
             try:
                 fresh = minter.token(asset_id=asset_id, access=granted_access)
-            except SigningUnavailable:
+            except (SigningUnavailable, MintRouteMissing):
                 raise exc from None
             if fresh.token == refused.token:
                 raise

athena_python_docx-0.45.0/docx/_public_create.py

@@ -0,0 +1,270 @@
+"""Creating a Word document through Athena's public API when no studio key is set.
+
+``Document.create()`` creates a document with the key every other call sends
+(``api_key``, ``ATHENA_DOCX_API_KEY``, then ``ATHENA_API_KEY``), except when
+neither of the first two is set and ``ATHENA_API_KEY`` and ``ATHENA_API_URL``
+both are. That is a computer's or a session VM's scoped credential, which
+Athena's public API (``/api/v0``) takes and neither docx-studio's ``/docs/empty``
+nor agora's ``/api/docx-studio/assets`` does, so Athena creates the document:
+
+* a document holding Athena's default template:
+  ``POST {ATHENA_API_URL}/api/v0/assets/create`` with
+  ``{"asset_type": "word_document", ...}``;
+* a document holding a local ``.docx`` (``Document.create(docx=...)``):
+  ``POST {ATHENA_API_URL}/api/v0/assets/create-from-file`` (multipart ``file``,
+  query ``title``, ``parent_folder_id``, ``workspace_id``, ``source_asset_id``).
+
+Both send ``X-API-KEY: $ATHENA_API_KEY`` and, inside an agent run, the run's
+``X-Athena-Session-Credential`` (``ATHENA_CLI_SESSION_KEY``), so the document's
+first write records the run. Athena writes it with its own studio credential,
+as the key's user, and answers once the document holds its content; its own
+calls then carry a token minted for it (``docx._asset_token``).
+
+An Athena older than these routes answers 422 naming the asset type, or
+FastAPI's bare 404 or 405: the caller then creates through docx-studio and agora
+with ``ATHENA_API_KEY``, as before (:class:`PublicCreateUnavailable`). Every
+other refusal raises. A create is not resent once its request may have reached
+Athena: a resend could make a second document.
+"""
+
+from __future__ import annotations
+
+import inspect
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, TypedDict
+
+import requests
+from requests.adapters import HTTPAdapter
+from urllib3.util.retry import Retry
+
+from docx._asset_token import API_KEY_ENV, API_URL_ENV, STUDIO_KEY_ENV, public_api_base
+from docx.errors import AuthenticationError, DocxError, SessionError
+
+#: The credential the athena CLI's session VM exports for one ``execute`` call.
+SESSION_CREDENTIAL_ENV = "ATHENA_CLI_SESSION_KEY"
+#: The header Athena reads it from to name the agent run a write belongs to.
+SESSION_CREDENTIAL_HEADER = "X-Athena-Session-Credential"
+#: Athena waits for docx-studio's seed or import before it answers.
+CREATE_TIMEOUT_SECONDS = 120.0
+_DOCX_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+# What FastAPI answers for a path no route serves (404) or serves with other
+# methods only (405: ``/assets/{asset_id}`` takes GET and PATCH).
+_ROUTE_MISSING_BODIES = ({"detail": "Not Found"}, {"detail": "Method Not Allowed"})
+
+
+class PublicCreateUnavailable(Exception):
+    """The Athena at ``ATHENA_API_URL`` predates creating a Word document through it."""
+
+
+class CreatedDocument(TypedDict):
+    """What Athena answered: the new document's id, title and workspace."""
+
+    asset_id: str
+    title: str
+    workspace_id: str | None
+
+
+@dataclass(frozen=True)
+class PublicApi:
+    """Athena's public API, reached with ``ATHENA_API_KEY``."""
+
+    base: str
+    api_key: str = field(repr=False)
+
+    @classmethod
+    def for_creation(cls, *, api_key: str | None) -> PublicApi | None:
+        """The public API a new document is created through, or None.
+
+        None when the caller passed ``api_key`` or ``ATHENA_DOCX_API_KEY`` is
+        set (they create on docx-studio, as before), or when ``ATHENA_API_KEY``
+        or ``ATHENA_API_URL`` is unset.
+        """
+        if api_key or os.environ.get(STUDIO_KEY_ENV):
+            return None
+        athena_key = os.environ.get(API_KEY_ENV)
+        api_url = os.environ.get(API_URL_ENV)
+        if not athena_key or not api_url or not api_url.strip():
+            return None
+        return cls(base=public_api_base(api_url), api_key=athena_key)
+
+    def headers(self) -> dict[str, str]:
+        from docx import __version__
+
+        headers = {
+            "X-API-KEY": self.api_key,
+            "Accept": "application/json",
+            "User-Agent": f"athena-python-docx/{__version__}",
+        }
+        session_credential = os.environ.get(SESSION_CREDENTIAL_ENV)
+        if session_credential:
+            headers[SESSION_CREDENTIAL_HEADER] = session_credential
+        return headers
+
+
+def _create_session() -> requests.Session:
+    """Connection retries only: a create that may have reached Athena is never resent."""
+    retry_kwargs: dict[str, Any] = {
+        "total": None,
+        "status": 0,
+        "connect": 2,
+        "read": 0,
+        "other": 0,
+        "backoff_factor": 0.5,
+        "allowed_methods": frozenset(["POST"]),
+        "raise_on_status": False,
+    }
+    if "backoff_max" in inspect.signature(Retry).parameters:
+        retry_kwargs["backoff_max"] = 5.0
+    session = requests.Session()
+    adapter = HTTPAdapter(max_retries=Retry(**retry_kwargs))
+    session.mount("http://", adapter)
+    session.mount("https://", adapter)
+    return session
+
+
+def _json(response: requests.Response) -> Any:
+    try:
+        return response.json()
+    except ValueError:
+        return None
+
+
+def _detail(body: Any, response: requests.Response) -> str:
+    """Athena's reason: ``detail`` as text, or the first validation message."""
+    detail = body.get("detail") if isinstance(body, dict) else None
+    if isinstance(detail, str):
+        return detail.strip()
+    if isinstance(detail, list) and detail and isinstance(detail[0], dict):
+        message = detail[0].get("msg")
+        if isinstance(message, str):
+            return message.strip()
+    return " ".join((response.text or "").split())[:200]
+
+
+def _is_unavailable(*, status: int, body: Any) -> bool:
+    """An Athena that predates the route, or the ``word_document`` asset type."""
+    if status in (404, 405) and body in _ROUTE_MISSING_BODIES:
+        return True
+    if status != 422 or not isinstance(body, dict):
+        return False
+    errors = body.get("detail")
+    return isinstance(errors, list) and any(
+        isinstance(error, dict)
+        and "asset_type" in (error.get("loc") or [])
+        and "Unsupported asset type" in str(error.get("msg", ""))
+        for error in errors
+    )
+
+
+def _created(response: requests.Response, *, what: str) -> CreatedDocument:
+    status = response.status_code
+    body = _json(response)
+    if _is_unavailable(status=status, body=body):
+        raise PublicCreateUnavailable(f"{response.url} answered HTTP {status}")
+    if status == 200 and isinstance(body, dict):
+        asset_id = body.get("asset_id")
+        title = body.get("title")
+        workspace_id = body.get("workspace_id")
+        if (
+            isinstance(asset_id, str)
+            and asset_id.startswith("asset_")
+            and isinstance(title, str)
+            and (workspace_id is None or isinstance(workspace_id, str))
+        ):
+            return CreatedDocument(asset_id=asset_id, title=title, workspace_id=workspace_id)
+    detail = _detail(body, response)
+    if status in (401, 403):
+        raise AuthenticationError(
+            f"Athena refused to create {what} with ATHENA_API_KEY (HTTP {status})"
+            f"{': ' + detail if detail else ''}",
+        )
+    if status == 200:
+        raise SessionError(f"Athena's answer to creating {what} is not one this SDK can use: {detail}")
+    raise DocxError(f"Athena could not create {what} (HTTP {status}){': ' + detail if detail else ''}")
+
+
+def _post(
+    *,
+    session: requests.Session,
+    url: str,
+    what: str,
+    **kwargs: Any,
+) -> CreatedDocument:
+    try:
+        response = session.post(url, **kwargs)
+    except requests.RequestException as exc:
+        raise SessionError(f"Unable to reach Athena at {url} to create {what}: {exc}") from exc
+    try:
+        return _created(response, what=what)
+    finally:
+        response.close()
+
+
+def create_word_document(
+    *,
+    api: PublicApi,
+    name: str | None,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+) -> CreatedDocument:
+    """Have Athena create a Word document holding its default template."""
+    payload: dict[str, str] = {"asset_type": "word_document"}
+    if name is not None:
+        payload["title"] = name
+    if parent_folder_id is not None:
+        payload["parent_folder_id"] = parent_folder_id
+    if workspace_id is not None:
+        payload["workspace_id"] = workspace_id
+    session = _create_session()
+    try:
+        return _post(
+            session=session,
+            url=f"{api.base}/assets/create",
+            what="a Word document",
+            json=payload,
+            headers=api.headers(),
+            timeout=CREATE_TIMEOUT_SECONDS,
+        )
+    finally:
+        session.close()
+
+
+def create_word_document_from_file(
+    *,
+    api: PublicApi,
+    docx_path: str,
+    title: str,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+    source_asset_id: str | None,
+    timeout: float,
+) -> CreatedDocument:
+    """Have Athena create a Word document holding the ``.docx`` at ``docx_path``.
+
+    Athena answers once the file is imported, and leaves nothing behind when the
+    import fails.
+    """
+    params: dict[str, str] = {"title": title}
+    if parent_folder_id is not None:
+        params["parent_folder_id"] = parent_folder_id
+    if workspace_id is not None:
+        params["workspace_id"] = workspace_id
+    if source_asset_id is not None:
+        params["source_asset_id"] = source_asset_id
+    file_path = Path(docx_path)
+    session = _create_session()
+    try:
+        with file_path.open("rb") as handle:
+            return _post(
+                session=session,
+                url=f"{api.base}/assets/create-from-file",
+                what=f"a Word document from {file_path.name}",
+                params=params,
+                files={"file": (file_path.name, handle, _DOCX_CONTENT_TYPE)},
+                headers=api.headers(),
+                timeout=max(timeout, CREATE_TIMEOUT_SECONDS),
+            )
+    finally:
+        session.close()

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/docx/document.py

@@ -282,7 +282,11 @@ class Document:
             api_key: Athena API key (PropelAuth user API key) or
                 access token. Falls back to ``$ATHENA_DOCX_API_KEY``, then
                 ``$ATHENA_API_KEY``, as every other call does; the upload path
-                (``docx=``) sends the same key to agora.
+                (``docx=``) sends the same key to agora. With neither of the
+                first two set and both ``$ATHENA_API_KEY`` and
+                ``$ATHENA_API_URL`` set (a computer's or session VM's scoped
+                key), Athena's public API creates the document instead, from
+                the template or from ``docx`` (``docx._public_create``).
             parent_folder_id: Optional parent folder; defaults to
                 the source document's folder when source_asset_id is set,
                 otherwise workspace root.

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "athena-python-docx"
-version = "0.44.0"
+version = "0.45.0"
 description = "Drop-in replacement for python-docx that connects to Athena's DOCX Studio collaborative document stack"
 readme = "README.md"
 license = "MIT"

{athena_python_docx-0.44.0 → athena_python_docx-0.45.0}/tests/test_asset_tokens.py

@@ -3,9 +3,9 @@
 Order for a call on an existing Word document: ``api_key=``;
 ``ATHENA_DOCX_API_KEY``; a token minted from Athena's public API with
 ``ATHENA_API_KEY`` (when ``ATHENA_API_URL`` is set too); else ``ATHENA_API_KEY``
-itself. Creating a document keeps the key. Nothing here reaches a real
-service: every request goes through ``requests.Session.request`` (or, for the
-create path, ``urllib``), faked below.
+itself. Creating a document in the token case goes through Athena's public
+API (``test_public_create.py``). Nothing here reaches a real service: every
+request goes through ``requests.Session.request``, faked below.
 """
 
 from __future__ import annotations
@@ -256,29 +256,22 @@ def test_athena_api_url_works_with_and_without_the_public_api_prefix(
     assert [call.url for call in world.mint_calls()] == [MINT_URL]
 
 
-def test_creating_a_document_keeps_athena_api_key_and_mints_nothing(world: _World) -> None:
-    sent: list[Any] = []
-
-    class _Created:
-        def __enter__(self) -> _Created:
-            return self
-
-        def __exit__(self, *_: object) -> None:
-            return None
-
-        def read(self) -> bytes:
-            return json.dumps(
-                {"assetId": ASSET, "name": "Doc", "workspaceId": "ws_1"}
-            ).encode()
-
-    def _capture(request: Any, **_: Any) -> _Created:
-        sent.append(request)
-        return _Created()
+def test_creating_a_document_goes_through_athena_and_mints_nothing(world: _World) -> None:
+    # A document that does not exist has no token, and docx-studio refuses the
+    # scoped key: Athena's public API creates it (docx._public_create).
+    world.studio.append(
+        _response(200, {"asset_id": ASSET, "title": "Doc", "workspace_id": "ws_1"})
+    )
 
-    with patch("docx._http.urllib.request.urlopen", side_effect=_capture):
-        create_empty_document(name="Doc")
+    with patch("docx._http.urllib.request.urlopen") as urlopen:
+        created = create_empty_document(name="Doc")
 
-    assert [request.get_header("Authorization") for request in sent] == [f"Bearer {SCOPED_KEY}"]
+    urlopen.assert_not_called()
+    assert created == {"asset_id": ASSET, "name": "Doc", "workspace_id": "ws_1"}
+    [call] = world.calls
+    assert (call.method, call.url) == ("POST", f"{AGORA}/api/v0/assets/create")
+    assert call.headers["X-API-KEY"] == SCOPED_KEY
+    assert call.bearer is None
     assert world.mint_calls() == []
 
 
@@ -459,6 +452,28 @@ def test_a_503_falls_back_to_a_studio_key_set_since(
     assert len(world.mint_calls()) == 1
 
 
+def test_an_athena_without_the_mint_route_gets_athena_api_key_as_before(world: _World) -> None:
+    # An Athena older than the route: FastAPI's bare 404 for a path no route matches.
+    world.mints.append(_response(404, {"detail": "Not Found"}))
+    world.studio.extend([_response(200, {"pageCount": 1, "pages": []}), _applied()])
+    client = _client()
+
+    client.get_layout(ASSET)
+    _batch(client)
+
+    assert len(world.mint_calls()) == 1
+    assert [call.bearer for call in world.studio_calls()] == [SCOPED_KEY, SCOPED_KEY]
+
+
+def test_athenas_own_asset_not_found_stays_final(world: _World) -> None:
+    world.mints.append(_response(404, {"detail": "Asset not found."}))
+
+    with pytest.raises(NotFoundError, match="Asset not found"):
+        _batch(_client())
+
+    assert world.studio_calls() == []
+
+
 def test_an_asset_another_studio_edits_is_never_sent_its_token(world: _World) -> None:
     world.mints.append(world.mint_ok(audience="xlsx-studio"))