You are never trapped.

// A Lambda you write. Deployed alongside Functory, inside the same CDK
// stack, reading from the same DynamoDB table. Functory never sees the
// source — it's your code on your infrastructure.

import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
import type { DynamoDBStreamHandler } from "aws-lambda";

const ddb = new DynamoDBClient({});
const TABLE = process.env.FUNCTORY_ENTITIES_TABLE!;

export const handler: DynamoDBStreamHandler = async (event) => {
  for (const record of event.Records) {
    if (record.eventName !== "INSERT") continue;
    const kind = record.dynamodb?.NewImage?.kind?.S;
    if (kind !== "Reservation") continue;

    // Your business logic. Anything. Enrich, dual-write, audit, route.
    await yourCrmClient.enqueue(record.dynamodb!.NewImage);
  }
};

// Your bootstrapped customer CDK app — provisioned alongside the
// Functory-owned CDK stack. Functory's stack is sealed (you don't edit it);
// your stack is yours, and it can read outputs from Functory's to plug into
// the same table, event bus, and IAM roles.

import { CustomerCdkApp } from "@functory/customer-cdk";
import { Function as Lambda, Runtime, Code } from "aws-cdk-lib/aws-lambda";

const app = new CustomerCdkApp("acme-prod-customer");
const functoryOutputs = app.importFunctoryOutputs(); // table ARNs, topics, roles

const enrich = new Lambda(app, "EnrichReservation", {
  runtime: Runtime.NODEJS_20_X,
  code: Code.fromAsset("lambdas/enrich-reservation"),
  handler: "index.handler",
  environment: {
    FUNCTORY_ENTITIES_TABLE: functoryOutputs.entitiesTable.tableName,
  },
});

functoryOutputs.entitiesTable.grantStreamRead(enrich);