I think I found a bug in bolt. I want to enforce receiving a sensitive string with minimum length of 1. Expected it to fail due to s1 requiring length of minimum 1:

plan mysql::test_sensitive (
  Sensitive[String[1]] $s1,
  Sensitive[String] $s2,
  Sensitive $s3,
) {
  without_default_logging() || {
    out::message("s1: ${s1.unwrap}, s2: ${s2.unwrap}, s3: ${s3.unwrap}")
  }
}

$ bolt plan run mysql::test_sensitive s1="" s2="" s3=""
Starting: plan mysql::test_sensitive
s1: , s2: , s3: 
Finished: plan mysql::test_sensitive in 0.01 sec
Plan completed successfully with no result

According to puppet docs https://www.puppet.com/docs/puppet/8/securing-sensitive-data.html#securing_sensitive_data-lookup-options

Note:

Sensitive[String[1]]

means it's a sensitive string with a length of 1 or greater — not empty.

Can someone confirm/deny?

$ bolt --version
3.27.4