The engine doesn't compile to a declarative template. It's a common misconception, however because the user's program runs concurrently with the Pulumi engine, fully dynamic resource graphs are possible, including those inexpressible using templates.

This is Pulumi pseudocode:

    const group = new ldap.DirectoryGroup("$saas-users);

    // or any other runtime query:
    for (const member of group.getMembers()) {
      new saas.User(member.id, {
          email: member.email,
          name: member.fullName,
      });

      // could also do some other dynamic action, such as 
      // calling a webhook to complete user setup

(n.b.: this is a simplified, illustrative example that the program drives the graph using its own using loops or other control flow.)