Your application requires provisioning resources that Pulumi does not have a native provider for, such as an internal company API or a legacy system. How do you build a Pulumi dynamic provider?

import * as pulumi from "@pulumi/pulumi";
import axios from "axios";

// Dynamic provider for an internal service registry
interface ServiceRegistryInputs {
  serviceName: string;
  serviceUrl: string;
  healthCheckPath: string;
  team: string;
  environment: string;
}

const serviceRegistryProvider: pulumi.dynamic.ResourceProvider = {
  async create(inputs: ServiceRegistryInputs): Promise<pulumi.dynamic.CreateResult> {
    // Call internal API to register service
    const response = await axios.post("https://registry.internal.acme.com/api/v1/services", {
      name: inputs.serviceName,
      url: inputs.serviceUrl,
      health_check: inputs.healthCheckPath,
      team: inputs.team,
      environment: inputs.environment,
    }, {
      headers: { "Authorization": `Bearer ${process.env.REGISTRY_TOKEN}` },
    });
    return {
      id: response.data.id,
      outs: {
        ...inputs,
        registryId: response.data.id,
        registeredAt: response.data.created_at,
      },
    };
  },

  async read(id: string, props: any): Promise<pulumi.dynamic.ReadResult> {
    const response = await axios.get(
      `https://registry.internal.acme.com/api/v1/services/${id}`,
      { headers: { "Authorization": `Bearer ${process.env.REGISTRY_TOKEN}` } }
    );
    return {
      id: id,
      props: {
        serviceName: response.data.name,
        serviceUrl: response.data.url,
        healthCheckPath: response.data.health_check,
        team: response.data.team,
        environment: response.data.environment,
        registryId: id,
        registeredAt: response.data.created_at,
      },
    };
  },

  async update(id: string, olds: any, news: ServiceRegistryInputs): Promise<pulumi.dynamic.UpdateResult> {
    await axios.put(`https://registry.internal.acme.com/api/v1/services/${id}`, {
      name: news.serviceName,
      url: news.serviceUrl,
      health_check: news.healthCheckPath,
      team: news.team,
    }, {
      headers: { "Authorization": `Bearer ${process.env.REGISTRY_TOKEN}` },
    });
    return { outs: { ...news, registryId: id } };
  },

  async delete(id: string, props: any): Promise<void> {
    await axios.delete(
      `https://registry.internal.acme.com/api/v1/services/${id}`,
      { headers: { "Authorization": `Bearer ${process.env.REGISTRY_TOKEN}` } }
    );
  },
};

// Resource class using the dynamic provider
class ServiceRegistration extends pulumi.dynamic.Resource {
  public readonly registryId!: pulumi.Output<string>;
  public readonly registeredAt!: pulumi.Output<string>;

  constructor(name: string, args: ServiceRegistryInputs, opts?: pulumi.CustomResourceOptions) {
    super(serviceRegistryProvider, name, { ...args, registryId: undefined, registeredAt: undefined }, opts);
  }
}

// Usage
const registration = new ServiceRegistration("order-service-reg", {
  serviceName: "order-service",
  serviceUrl: "https://orders.internal.acme.com",
  healthCheckPath: "/health",
  team: "commerce",
  environment: pulumi.getStack(),
});