- hoteldesk.hooks.on(name, callback) registers declared lifecycle handlers.
- hoteldesk.rpc.handle(callback) exposes one backend dispatcher to plugin pages.
- hoteldesk.storage.get/set stores JSON-safe plugin-private values.
- hoteldesk.system.hotelInfo() returns permitted hotel identity.
- hoteldesk.database.query/get accepts one parameterized SELECT/CTE.
- hoteldesk.database.run writes only plugin-prefixed tables unless hotel-financial-write authorizes approved hotel tables.
- hoteldesk.database.transaction(callback) groups operations.
The VM disables generated strings/WASM and applies timeouts. Do not depend on Node globals, require, process or unrestricted filesystem/network access.