Issues I have:

1. my pulumi preview continuously shows some differences to the outputs (https://gitlab.com/-/snippets/2101279#LC1) - but in the diff there are no properties changed
2. I cannot see userId and password outputs (specified as outputs of my dynamic resource) to be included in the outputs (https://gitlab.com/-/snippets/2101279#LC20)
3. I am not sure how I should declare that the User.password output property is a secret - shall I use additionalSecretOutputs in the provider opts to the User super constructor call (at https://gitlab.com/-/snippets/2101279#LC124)?

I've found causes of my issues:

1. https://github.com/pulumi/pulumi/issues/6718 - when a resource object is exported directly it contains some "hidden" properties that cause differences but these properties are not shown in the output (properties like __aliases, __provider etc.)

2. Resource args passed to the dynamic resource super constructor must include entries for the resource output properties (in my case userId and password), e.g. {userId: undefined, password: undefined, ...args}:

   Incorrect:

   constructor(resourceName: string, args: UserArgs, opts?: pulumi.CustomResourceOptions) {
       super(userProvider, `mycorp:mysystem:User:${resourceName}`, args, opts);
   }

   Correct:

   constructor(resourceName: string, args: UserArgs, opts?: pulumi.CustomResourceOptions) {
       super(userProvider, `mycorp:mysystem:User:${resourceName}`, {userId: undefined, password: undefined, ...args}, opts);
   }

3. I used additionalSecretOutputs entry in the CustomResourceOptions opts passed to the super constructor: {...opts, additionalSecretOutputs: ['password']}

Fixed version of the User resource class:

export class User extends pulumi.dynamic.Resource {
    public readonly userId: pulumi.Output<string>
    public readonly password: pulumi.Output<string>

    constructor(resourceName: string, args: UserArgs, opts?: pulumi.CustomResourceOptions) {
        super(userProvider, `mycorp:mysystem:User:${resourceName}`,
            {userId: undefined, password: undefined, ...args},
            {...opts, additionalSecretOutputs: ['password']});        
    }
}