"""Render a captured ``NotificationEnvelope`` the way a reader receives it.

Tests that assert on ``env.body_text`` were reading the *producer's* literal.
That worked while producers composed the whole body themselves — and stopped
being the truth on 2026-08-17, when the last unregistered ``template_key``s
were given real templates: those producers now pass the ``(see template)``
sentinel and put the data on ``context``, and the copy a recipient actually
sees is assembled by ``NotificationService`` from the template in THEIR
language.

Asserting on the sentinel would prove nothing, and asserting on raw context
would drop the prose. So render, in one named language, exactly as the send
path does — template body + ``_safe_format`` over the envelope context.
"""
from __future__ import annotations

from app.core.locale import pick_localized
from app.notifications.service import _DEFAULT_TEMPLATES, _safe_format


def rendered_body(env, lang: str = "zh") -> str:
    """The body text a ``lang`` reader gets for this envelope.

    Falls back to ``env.body_text`` when the envelope carries no template —
    the same degradation ``_render_for_recipient`` performs — so the helper
    is safe to use on both templated and direct envelopes.
    """
    tmpl = _DEFAULT_TEMPLATES.get(env.template_key or "")
    if tmpl is None:
        return env.body_text
    body = pick_localized(tmpl, "body_text", lang) or env.body_text
    context = dict(env.context or {})
    # Injected by the renderer, not by producers (see ``_render_for_recipient``).
    context.setdefault("cta_line", "")
    context.setdefault("portal_url", "https://helix.example/x")
    return _safe_format(body, context)