athena-python-docx 0.44.0__tar.gz → 0.45.1__tar.gz

{athena_python_docx-0.44.0 → athena_python_docx-0.45.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: athena-python-docx
-Version: 0.44.0
+Version: 0.45.1
 Summary: Drop-in replacement for python-docx that connects to Athena's DOCX Studio collaborative document stack
 Project-URL: Homepage, https://athenaintelligence.ai
 Author-email: Athena Intelligence <engineering@athenaintelligence.ai>

{athena_python_docx-0.44.0 → athena_python_docx-0.45.1}/docx/__init__.py

@@ -6,7 +6,7 @@ See CLAUDE.md for the API parity contract.
 
 from __future__ import annotations
 
-__version__ = "0.44.0"
+__version__ = "0.45.1"
 
 from docx.api import Document
 from docx._buffer import discard_all, flush_all

{athena_python_docx-0.44.0 → athena_python_docx-0.45.1}/docx/_asset_token.py

@@ -13,8 +13,17 @@ A call on an existing Word document reaches DOCX Studio with, in this order:
 4. otherwise ``ATHENA_API_KEY`` itself, as before.
 
 Creating a document (``Document.create``, its upload) keeps the key of 1, 2 or
-4: a document that does not exist yet has no token. A token goes only to its
-own document's routes.
+4: a document that does not exist yet has no token. In case 3 Athena's public
+API creates it instead (``docx._public_create``). A token goes only to its own
+document's routes.
+
+An Athena runtime credential (a computer's, a session VM's or a notebook
+kernel's ``ATHENA_API_KEY``: ``athcomp_``, ``athsvm_``, ``athnb_``) is never
+sent to DOCX Studio, which takes none, nor to Athena's older creation routes
+outside its public API: a call that would send one (another document's routes,
+an Athena without the studio-token route, no ``ATHENA_API_URL``, a create or an
+upload Athena's public API cannot take) refuses before any request, naming what
+to set (:func:`is_runtime_credential`).
 
 A token is minted once per (agora, key, asset, access) for the whole process,
 again 90 seconds before it expires, and once more when the studio answers 401.
@@ -28,7 +37,9 @@ or locally; both work.
 
 Athena's refusals (400, 401, 403, 404, 422) raise at once, without a retry. A
 deployment that signs no asset tokens answers 503: the client then uses the
-studio key when one is set, and otherwise raises an error that names it.
+studio key when one is set, and otherwise raises an error that names it. An
+Athena older than the route answers FastAPI's bare 404 (``{"detail": "Not
+Found"}``): the client then sends ``ATHENA_API_KEY``, as before the route.
 """
 
 from __future__ import annotations
@@ -67,6 +78,16 @@ PUBLIC_API_PREFIX = "/api/v0"
 VIEW = "view"
 EDIT = "edit"
 
+#: How the credentials Athena mints for a runtime begin: a computer's, a session
+#: VM's and a notebook kernel's own ``ATHENA_API_KEY``. Only Athena's public API
+#: takes one; a studio never does.
+RUNTIME_CREDENTIAL_PREFIXES = ("athcomp_", "athsvm_", "athnb_")
+
+
+def is_runtime_credential(key: str | None) -> bool:
+    """Whether ``key`` is a credential Athena minted for a runtime, which no studio takes."""
+    return bool(key) and str(key).startswith(RUNTIME_CREDENTIAL_PREFIXES)
+
 #: Minted again this long before Athena's ``expires_at_ms``.
 REFRESH_BEFORE_EXPIRY_SECONDS = 90.0
 #: The longest a token is held, whatever the local clock says (Athena's lifetime).
@@ -112,6 +133,26 @@ class SigningUnavailable(Exception):
     """Athena's 503: this deployment signs no asset tokens."""
 
 
+class MintRouteMissing(Exception):
+    """A 404 with FastAPI's bare route-not-found body: the Athena at
+    ``ATHENA_API_URL`` predates the studio-token route (a self-hosted release
+    older than the SDK). The client then sends ``ATHENA_API_KEY``, as before."""
+
+
+#: What FastAPI answers for a path no route matches. Athena's own 404 from the
+#: studio-token route names the asset ("Asset not found."), so the two never mix.
+_ROUTE_NOT_FOUND_BODY = {"detail": "Not Found"}
+
+
+def _is_route_missing(response: requests.Response) -> bool:
+    if response.status_code != 404:
+        return False
+    try:
+        return bool(response.json() == _ROUTE_NOT_FOUND_BODY)
+    except ValueError:
+        return False
+
+
 class _TokenCache:
     """Process-wide tokens by (agora, key, asset, access), least recently used first."""
 
@@ -274,6 +315,8 @@ class TokenMinter:
         status = response.status_code
         if status == 503:
             raise SigningUnavailable(_detail(response) or "This deployment signs no asset tokens.")
+        if _is_route_missing(response):
+            raise MintRouteMissing(f"no studio-token route at {response.url}")
         detail = _detail(response)
         reason = f"(HTTP {status}{': ' + detail if detail else ''})"
         if status == 401:

{athena_python_docx-0.44.0 → athena_python_docx-0.45.1}/docx/_http.py

@@ -45,13 +45,38 @@ def _resolve_api_key(api_key: str | None) -> str | None:
     makes. Both create paths land outside Athena's public API (docx-studio's
     ``/docs/empty``, agora's ``/api/docx-studio/assets``), and inside an Athena
     session VM or computer ``ATHENA_API_KEY`` is a credential only that public
-    API (``/api/v0``) accepts. ``ATHENA_API_KEY`` stays the fallback for an
-    environment that sets no studio key (local use with one personal key).
+    API (``/api/v0``) accepts: there (neither key set, ``ATHENA_API_URL`` set)
+    Athena's public API creates the document instead (``docx._public_create``).
+    ``ATHENA_API_KEY`` stays the fallback for an environment that sets no
+    studio key and no ``ATHENA_API_URL`` (local use with one personal key).
     The new document is owned by the user the key belongs to.
     """
     return api_key or os.environ.get(_API_KEY_ENV) or os.environ.get("ATHENA_API_KEY")
 
 
+def _refuse_runtime_credential(*, key: str | None, action: str) -> None:
+    """Refuse, before any request, to send an Athena runtime credential where
+    Athena's public API could not take the call.
+
+    A computer's, session VM's or notebook's own ``ATHENA_API_KEY`` is accepted
+    only by Athena's public API (``/api/v0``). Reaching this point means that
+    API could not take the create (no ``ATHENA_API_URL``, or an Athena older
+    than its creation routes), and DOCX Studio and agora's older routes refuse
+    the credential.
+    """
+    from docx._asset_token import is_runtime_credential
+
+    if is_runtime_credential(key):
+        raise AuthenticationError(
+            f"Cannot {action}: ATHENA_API_KEY here is an Athena runtime credential (a "
+            "computer's, session's or notebook's own key), which only Athena's public "
+            "API accepts, and that API could not take this call (ATHENA_API_URL is "
+            "unset, or that Athena predates it). Set ATHENA_API_URL, or set "
+            "ATHENA_DOCX_API_KEY (or pass api_key=) to an Athena API key DOCX Studio "
+            "accepts.",
+        )
+
+
 def _derive_agora_base_url(docx_base_url: str) -> str | None:
     """Best-effort derive an Agora base URL from a docx-studio base URL.
 
@@ -137,12 +162,21 @@ def create_empty_document(
             "Pass base_url= to Document.create() or set the env var "
             '(e.g. ATHENA_DOCX_BASE_URL="https://docx-studio.prd.athenaintel.com").',
         )
+    created = _create_through_athena(
+        api_key=api_key,
+        name=name,
+        parent_folder_id=parent_folder_id,
+        workspace_id=workspace_id,
+    )
+    if created is not None:
+        return created
     if not resolved_key:
         raise AuthenticationError(
             f"Missing api_key and {_API_KEY_ENV} env var. "
             "Pass api_key= to Document.create() or set the env var "
             "(or set ATHENA_API_KEY as a fallback).",
         )
+    _refuse_runtime_credential(key=resolved_key, action="create the document on DOCX Studio")
 
     url: str = resolved_base.rstrip("/") + "/docs/empty"
     # The document is born as its creator's: its first write is signed as the
@@ -221,6 +255,44 @@ def create_empty_document(
     )
 
 
+def _create_through_athena(
+    *,
+    api_key: str | None,
+    name: str | None,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+) -> CreateAssetResult | None:
+    """A new document Athena's public API made, or None for docx-studio's path.
+
+    Athena creates it when no ``api_key`` and no ``ATHENA_DOCX_API_KEY`` are set
+    and ``ATHENA_API_KEY`` and ``ATHENA_API_URL`` are (``docx._public_create``).
+    None otherwise, and when that Athena predates the public create.
+    """
+    from docx._public_create import (
+        PublicApi,
+        PublicCreateUnavailable,
+        create_word_document,
+    )
+
+    api = PublicApi.for_creation(api_key=api_key)
+    if api is None:
+        return None
+    try:
+        created = create_word_document(
+            api=api,
+            name=name,
+            parent_folder_id=parent_folder_id,
+            workspace_id=workspace_id or os.environ.get("ATHENA_WORKSPACE_ID"),
+        )
+    except PublicCreateUnavailable:
+        return None
+    return CreateAssetResult(
+        asset_id=created["asset_id"],
+        name=created["title"],
+        workspace_id=created["workspace_id"] or "",
+    )
+
+
 class UploadAssetResult(TypedDict):
     """Parsed response from the create-and-import upload flow."""
 
@@ -228,6 +300,58 @@ class UploadAssetResult(TypedDict):
     name: str
 
 
+def _upload_through_athena(
+    *,
+    docx_path: str,
+    api_key: str | None,
+    name: str | None,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+    source_asset_id: str | None,
+    timeout: float,
+) -> UploadAssetResult | None:
+    """A document Athena made from the ``.docx`` at ``docx_path``, or None.
+
+    Athena's ``POST /api/v0/assets/create-from-file`` makes it in one request
+    when no ``api_key`` and no ``ATHENA_DOCX_API_KEY`` are set and
+    ``ATHENA_API_KEY`` and ``ATHENA_API_URL`` are (``docx._public_create``).
+    None otherwise, and when that Athena predates the route: the upload then
+    goes through agora's docx-studio bridge, as before.
+    """
+    from docx._public_create import (
+        PublicApi,
+        PublicCreateUnavailable,
+        create_word_document_from_file,
+    )
+
+    api = PublicApi.for_creation(api_key=api_key)
+    if api is None:
+        return None
+    if not os.path.exists(docx_path):
+        raise SessionError(f"DOCX file not found: {docx_path}")
+    if not docx_path.lower().endswith(".docx"):
+        raise SessionError(
+            f"Only .docx files are accepted by the upload endpoint (got {docx_path})",
+        )
+    title = name
+    if title is None:
+        base = os.path.basename(docx_path)
+        title = base[:-5] if base.lower().endswith(".docx") else base
+    try:
+        created = create_word_document_from_file(
+            api=api,
+            docx_path=docx_path,
+            title=title,
+            parent_folder_id=parent_folder_id,
+            workspace_id=workspace_id or os.environ.get("ATHENA_WORKSPACE_ID"),
+            source_asset_id=source_asset_id,
+            timeout=timeout,
+        )
+    except PublicCreateUnavailable:
+        return None
+    return UploadAssetResult(asset_id=created["asset_id"], name=created["title"])
+
+
 def upload_document(
     *,
     docx_path: str,
@@ -273,6 +397,18 @@ def upload_document(
     import base64
     import os
 
+    uploaded = _upload_through_athena(
+        docx_path=docx_path,
+        api_key=api_key,
+        name=name,
+        parent_folder_id=parent_folder_id,
+        workspace_id=workspace_id,
+        source_asset_id=source_asset_id,
+        timeout=timeout,
+    )
+    if uploaded is not None:
+        return uploaded
+
     resolved_docx_base: str | None = docx_base_url or os.environ.get(_BASE_URL_ENV)
     resolved_key: str | None = _resolve_api_key(api_key)
     resolved_agora_base: str | None = (
@@ -294,6 +430,7 @@ def upload_document(
             "Pass api_key= to Document.create() or set the env var "
             "(or set ATHENA_API_KEY as a fallback).",
         )
+    _refuse_runtime_credential(key=resolved_key, action="upload the document through agora")
 
     if not os.path.exists(docx_path):
         raise SessionError(f"DOCX file not found: {docx_path}")

{athena_python_docx-0.44.0 → athena_python_docx-0.45.1}/docx/_http_doc.py

@@ -47,9 +47,11 @@ from docx._asset_token import (
     EDIT,
     STUDIO_KEY_ENV,
     VIEW,
+    MintRouteMissing,
     SigningUnavailable,
     StudioToken,
     TokenMinter,
+    is_runtime_credential,
 )
 from docx._batching import call_abandoned, note_progress
 from docx._buffer import CommandBuffer, keep_reported_message
@@ -1127,6 +1129,10 @@ class HttpClient:
             token = minter.token(asset_id=asset_id, access=access)
         except SigningUnavailable as exc:
             return self._without_asset_tokens(asset_id=asset_id, reason=str(exc)), None
+        except MintRouteMissing:
+            # The Athena at ATHENA_API_URL predates the route: the key, as before.
+            self._asset_tokens = None
+            return self._api_key, None
         return token.token, (token, access)
 
     def _without_asset_tokens(self, *, asset_id: str, reason: str) -> str:
@@ -1150,6 +1156,15 @@ class HttpClient:
         is sent once more with a newly minted one: docx-studio refused it before
         acting on it, so nothing is applied twice."""
         bearer, grant = self._bearer(asset_id=asset_id, access=access)
+        if grant is None and is_runtime_credential(bearer):
+            raise AuthenticationError(
+                f"DOCX Studio takes no Athena runtime credential, and this client "
+                f"carries no token of {asset_id}. ATHENA_API_KEY here is a computer's, "
+                "session's or notebook's own key, which only Athena's public API "
+                "accepts. Open the document by its asset id (asset_...) with "
+                "ATHENA_API_URL set, or set ATHENA_DOCX_API_KEY (or pass api_key=) to "
+                "an Athena API key DOCX Studio accepts."
+            )
         try:
             return send(bearer)
         except AuthenticationError as exc:
@@ -1160,7 +1175,7 @@ class HttpClient:
             minter.invalidate(token=refused, access=granted_access)
             try:
                 fresh = minter.token(asset_id=asset_id, access=granted_access)
-            except SigningUnavailable:
+            except (SigningUnavailable, MintRouteMissing):
                 raise exc from None
             if fresh.token == refused.token:
                 raise

athena_python_docx-0.45.1/docx/_public_create.py

@@ -0,0 +1,270 @@
+"""Creating a Word document through Athena's public API when no studio key is set.
+
+``Document.create()`` creates a document with the key every other call sends
+(``api_key``, ``ATHENA_DOCX_API_KEY``, then ``ATHENA_API_KEY``), except when
+neither of the first two is set and ``ATHENA_API_KEY`` and ``ATHENA_API_URL``
+both are. That is a computer's or a session VM's scoped credential, which
+Athena's public API (``/api/v0``) takes and neither docx-studio's ``/docs/empty``
+nor agora's ``/api/docx-studio/assets`` does, so Athena creates the document:
+
+* a document holding Athena's default template:
+  ``POST {ATHENA_API_URL}/api/v0/assets/create`` with
+  ``{"asset_type": "word_document", ...}``;
+* a document holding a local ``.docx`` (``Document.create(docx=...)``):
+  ``POST {ATHENA_API_URL}/api/v0/assets/create-from-file`` (multipart ``file``,
+  query ``title``, ``parent_folder_id``, ``workspace_id``, ``source_asset_id``).
+
+Both send ``X-API-KEY: $ATHENA_API_KEY`` and, inside an agent run, the run's
+``X-Athena-Session-Credential`` (``ATHENA_CLI_SESSION_KEY``), so the document's
+first write records the run. Athena writes it with its own studio credential,
+as the key's user, and answers once the document holds its content; its own
+calls then carry a token minted for it (``docx._asset_token``).
+
+An Athena older than these routes answers 422 naming the asset type, or
+FastAPI's bare 404 or 405: the caller then creates through docx-studio and agora
+with ``ATHENA_API_KEY``, as before (:class:`PublicCreateUnavailable`). Every
+other refusal raises. A create is not resent once its request may have reached
+Athena: a resend could make a second document.
+"""
+
+from __future__ import annotations
+
+import inspect
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, TypedDict
+
+import requests
+from requests.adapters import HTTPAdapter
+from urllib3.util.retry import Retry
+
+from docx._asset_token import API_KEY_ENV, API_URL_ENV, STUDIO_KEY_ENV, public_api_base
+from docx.errors import AuthenticationError, DocxError, SessionError
+
+#: The credential the athena CLI's session VM exports for one ``execute`` call.
+SESSION_CREDENTIAL_ENV = "ATHENA_CLI_SESSION_KEY"
+#: The header Athena reads it from to name the agent run a write belongs to.
+SESSION_CREDENTIAL_HEADER = "X-Athena-Session-Credential"
+#: Athena waits for docx-studio's seed or import before it answers.
+CREATE_TIMEOUT_SECONDS = 120.0
+_DOCX_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
+# What FastAPI answers for a path no route serves (404) or serves with other
+# methods only (405: ``/assets/{asset_id}`` takes GET and PATCH).
+_ROUTE_MISSING_BODIES = ({"detail": "Not Found"}, {"detail": "Method Not Allowed"})
+
+
+class PublicCreateUnavailable(Exception):
+    """The Athena at ``ATHENA_API_URL`` predates creating a Word document through it."""
+
+
+class CreatedDocument(TypedDict):
+    """What Athena answered: the new document's id, title and workspace."""
+
+    asset_id: str
+    title: str
+    workspace_id: str | None
+
+
+@dataclass(frozen=True)
+class PublicApi:
+    """Athena's public API, reached with ``ATHENA_API_KEY``."""
+
+    base: str
+    api_key: str = field(repr=False)
+
+    @classmethod
+    def for_creation(cls, *, api_key: str | None) -> PublicApi | None:
+        """The public API a new document is created through, or None.
+
+        None when the caller passed ``api_key`` or ``ATHENA_DOCX_API_KEY`` is
+        set (they create on docx-studio, as before), or when ``ATHENA_API_KEY``
+        or ``ATHENA_API_URL`` is unset.
+        """
+        if api_key or os.environ.get(STUDIO_KEY_ENV):
+            return None
+        athena_key = os.environ.get(API_KEY_ENV)
+        api_url = os.environ.get(API_URL_ENV)
+        if not athena_key or not api_url or not api_url.strip():
+            return None
+        return cls(base=public_api_base(api_url), api_key=athena_key)
+
+    def headers(self) -> dict[str, str]:
+        from docx import __version__
+
+        headers = {
+            "X-API-KEY": self.api_key,
+            "Accept": "application/json",
+            "User-Agent": f"athena-python-docx/{__version__}",
+        }
+        session_credential = os.environ.get(SESSION_CREDENTIAL_ENV)
+        if session_credential:
+            headers[SESSION_CREDENTIAL_HEADER] = session_credential
+        return headers
+
+
+def _create_session() -> requests.Session:
+    """Connection retries only: a create that may have reached Athena is never resent."""
+    retry_kwargs: dict[str, Any] = {
+        "total": None,
+        "status": 0,
+        "connect": 2,
+        "read": 0,
+        "other": 0,
+        "backoff_factor": 0.5,
+        "allowed_methods": frozenset(["POST"]),
+        "raise_on_status": False,
+    }
+    if "backoff_max" in inspect.signature(Retry).parameters:
+        retry_kwargs["backoff_max"] = 5.0
+    session = requests.Session()
+    adapter = HTTPAdapter(max_retries=Retry(**retry_kwargs))
+    session.mount("http://", adapter)
+    session.mount("https://", adapter)
+    return session
+
+
+def _json(response: requests.Response) -> Any:
+    try:
+        return response.json()
+    except ValueError:
+        return None
+
+
+def _detail(body: Any, response: requests.Response) -> str:
+    """Athena's reason: ``detail`` as text, or the first validation message."""
+    detail = body.get("detail") if isinstance(body, dict) else None
+    if isinstance(detail, str):
+        return detail.strip()
+    if isinstance(detail, list) and detail and isinstance(detail[0], dict):
+        message = detail[0].get("msg")
+        if isinstance(message, str):
+            return message.strip()
+    return " ".join((response.text or "").split())[:200]
+
+
+def _is_unavailable(*, status: int, body: Any) -> bool:
+    """An Athena that predates the route, or the ``word_document`` asset type."""
+    if status in (404, 405) and body in _ROUTE_MISSING_BODIES:
+        return True
+    if status != 422 or not isinstance(body, dict):
+        return False
+    errors = body.get("detail")
+    return isinstance(errors, list) and any(
+        isinstance(error, dict)
+        and "asset_type" in (error.get("loc") or [])
+        and "Unsupported asset type" in str(error.get("msg", ""))
+        for error in errors
+    )
+
+
+def _created(response: requests.Response, *, what: str) -> CreatedDocument:
+    status = response.status_code
+    body = _json(response)
+    if _is_unavailable(status=status, body=body):
+        raise PublicCreateUnavailable(f"{response.url} answered HTTP {status}")
+    if status == 200 and isinstance(body, dict):
+        asset_id = body.get("asset_id")
+        title = body.get("title")
+        workspace_id = body.get("workspace_id")
+        if (
+            isinstance(asset_id, str)
+            and asset_id.startswith("asset_")
+            and isinstance(title, str)
+            and (workspace_id is None or isinstance(workspace_id, str))
+        ):
+            return CreatedDocument(asset_id=asset_id, title=title, workspace_id=workspace_id)
+    detail = _detail(body, response)
+    if status in (401, 403):
+        raise AuthenticationError(
+            f"Athena refused to create {what} with ATHENA_API_KEY (HTTP {status})"
+            f"{': ' + detail if detail else ''}",
+        )
+    if status == 200:
+        raise SessionError(f"Athena's answer to creating {what} is not one this SDK can use: {detail}")
+    raise DocxError(f"Athena could not create {what} (HTTP {status}){': ' + detail if detail else ''}")
+
+
+def _post(
+    *,
+    session: requests.Session,
+    url: str,
+    what: str,
+    **kwargs: Any,
+) -> CreatedDocument:
+    try:
+        response = session.post(url, **kwargs)
+    except requests.RequestException as exc:
+        raise SessionError(f"Unable to reach Athena at {url} to create {what}: {exc}") from exc
+    try:
+        return _created(response, what=what)
+    finally:
+        response.close()
+
+
+def create_word_document(
+    *,
+    api: PublicApi,
+    name: str | None,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+) -> CreatedDocument:
+    """Have Athena create a Word document holding its default template."""
+    payload: dict[str, str] = {"asset_type": "word_document"}
+    if name is not None:
+        payload["title"] = name
+    if parent_folder_id is not None:
+        payload["parent_folder_id"] = parent_folder_id
+    if workspace_id is not None:
+        payload["workspace_id"] = workspace_id
+    session = _create_session()
+    try:
+        return _post(
+            session=session,
+            url=f"{api.base}/assets/create",
+            what="a Word document",
+            json=payload,
+            headers=api.headers(),
+            timeout=CREATE_TIMEOUT_SECONDS,
+        )
+    finally:
+        session.close()
+
+
+def create_word_document_from_file(
+    *,
+    api: PublicApi,
+    docx_path: str,
+    title: str,
+    parent_folder_id: str | None,
+    workspace_id: str | None,
+    source_asset_id: str | None,
+    timeout: float,
+) -> CreatedDocument:
+    """Have Athena create a Word document holding the ``.docx`` at ``docx_path``.
+
+    Athena answers once the file is imported, and leaves nothing behind when the
+    import fails.
+    """
+    params: dict[str, str] = {"title": title}
+    if parent_folder_id is not None:
+        params["parent_folder_id"] = parent_folder_id
+    if workspace_id is not None:
+        params["workspace_id"] = workspace_id
+    if source_asset_id is not None:
+        params["source_asset_id"] = source_asset_id
+    file_path = Path(docx_path)
+    session = _create_session()
+    try:
+        with file_path.open("rb") as handle:
+            return _post(
+                session=session,
+                url=f"{api.base}/assets/create-from-file",
+                what=f"a Word document from {file_path.name}",
+                params=params,
+                files={"file": (file_path.name, handle, _DOCX_CONTENT_TYPE)},
+                headers=api.headers(),
+                timeout=max(timeout, CREATE_TIMEOUT_SECONDS),
+            )
+    finally:
+        session.close()

{athena_python_docx-0.44.0 → athena_python_docx-0.45.1}/docx/document.py

@@ -282,7 +282,11 @@ class Document:
             api_key: Athena API key (PropelAuth user API key) or
                 access token. Falls back to ``$ATHENA_DOCX_API_KEY``, then
                 ``$ATHENA_API_KEY``, as every other call does; the upload path
-                (``docx=``) sends the same key to agora.
+                (``docx=``) sends the same key to agora. With neither of the
+                first two set and both ``$ATHENA_API_KEY`` and
+                ``$ATHENA_API_URL`` set (a computer's or session VM's scoped
+                key), Athena's public API creates the document instead, from
+                the template or from ``docx`` (``docx._public_create``).
             parent_folder_id: Optional parent folder; defaults to
                 the source document's folder when source_asset_id is set,
                 otherwise workspace root.

{athena_python_docx-0.44.0 → athena_python_docx-0.45.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "athena-python-docx"
-version = "0.44.0"
+version = "0.45.1"
 description = "Drop-in replacement for python-docx that connects to Athena's DOCX Studio collaborative document stack"
 readme = "README.md"
 license = "MIT"