Allow resource provider to automatically set protect Resource option about pulumi HOT 1 OPEN

for example by having an "auto protect" mode that automatically starts off stateful resources as protected.

I think if we could update "protect" in the state file and grpc layer to be a ti-state (true/false/not-set) this would be pretty easy.
By default everything would be 'not-set', treated the same as "false" for handling deletes. But a provider could return "protect by default" flag from Create at which point state would be updated to be "true" unless the program had explicitly said "false".
If state is then fixed to "true" from a default protect and the user hasn't set Protect in their program we then get a registration of "not-set" and so leave protect as true. That keeps going till the user either runs unprotect or explicitly sets Protect=false in their program.

In fact not even sure the tri-state in state is needed for this, probably just for the resource registration.

from pulumi.