over nostr, nip04 encrypted payloads

it doesn't expose any direct APIs because the whole point was to be able to run it behind a firewall without doing any holepunching tricks (other than left-side-of-the-curve "just use nostr" holepunching)