Firebase triggers only fire inside the project that holds the data. So once your data lives in your cloud, something in your project has to tell the platform about writes — that is the shim: four small Cloud Functions (Node 22), one per data root, that forward writes to the platform's logic.
| Function | Fires on | Forwards |
|---|---|---|
shimStoreWritten |
any document under store/{project}/… |
every write |
shimStockWritten |
stock/… |
the stock ledgers and their records |
shimPromoWritten |
promo/{project}/… |
credits records and deleted coupon batches (other promo writes are dropped in your project, never sent) |
shimPaymentWritten |
payments/… |
payment records |
The platform deploys it#
You run nothing. As soon as the key holds the deploy roles and Firestore answers, the platform deploys the shim into your project through your key — press Deploy the shim on the card, or just Re-check. The build runs in your project for a few minutes; the card shows Deploying… and refreshes itself when it is done. The platform then reads the functions back to prove they run and forward to it.
The shim key (a secret only your space and the platform share) is stored in your project's Secret Manager, or — when the key may not manage secrets — as the functions' environment variable; the card says which.
What it sends#
Each forward carries the path, the document before and after the write (the platform's order and stock logic works on the change), and a signature over the event, the path and the body. The platform accepts a forward only for projects of your own space bound to that very Firebase project. The shim does nothing else: no business logic, no reads, and nothing it forwards can affect billing.
Updates#
When the platform releases a new shim, the card shows Update the shim. Updates run in the background and are paced across all clouds, so they never block the page. An update replaces functions of an older shim before the new ones start, so no write is ever forwarded twice. Your data is not touched by an update.
Deploying it yourself#
Advanced: a client who prefers to deploy the functions under their own Firebase login can use the drop-core-shim CLI — ask the platform for the deploy line and the shim key. A self-deployed shim reports a heartbeat every ten minutes instead of being read back, and is updated by re-running the CLI. When the platform later takes the shim over (a key with the deploy roles), it removes the CLI-only heartbeat function itself.