Function materialize 

pub async fn materialize(
    store: &TemplateStore,
    id: &str,
    version: u32,
    supplied: &SuppliedParams,
    env_overrides: &BTreeMap<String, String>,
    mode: Materialize,
) -> CliResult<MaterializedConfig>

Available on crate feature templates only.

Fetch a template version and bind the supplied params into a runnable config document.

Ordering mirrors the file-load path: ${env:} / ${file:} / ${secret:} resolve first (with env_overrides taking precedence over the process environment), then ${param.*} binds. A supplied param value is therefore never itself scanned for directives, so a caller cannot use a param to read the server’s environment or secret store.

Under Materialize::Persisted the first step is skipped: the directives stay as tokens and are resolved later by load_submission on whichever instance runs the job. Resolving them here would serialise the values into the body that gets stored in the shared database — which is how a ${env:DB_PASSWORD} in a template body ended up in plaintext there. The trade-off is that a typed (int/float/bool) param whose default is itself a directive cannot be coerced in this mode; it fails loudly at trigger time naming the param, rather than silently.