The runtime shell exposes a fixed set of functions to the mini-app JavaScript through the SDK — the host bridge. Public functions are available to every approved mini app; restricted functions require an explicit request in the developer portal and admin approval before they are granted.
Deep dive on the checkout function: orderPayment.