Zero-knowledge proofs,in plain Java.

@ZKCircuit(name = "age-check", version = 1)
public class AgeCheck {

    @Prove
    ZkBool prove(@Secret @UInt(bits = 8) ZkUInt age,
                 @Public @UInt(bits = 8) ZkUInt threshold) {
        return age.gte(threshold);   // the statement you prove
    }
}

var circuit = AgeCheckCircuit.build();
var r1cs = circuit.compileR1CS(CurveId.BLS12_381);
var inputs = AgeCheckCircuit.inputs().age(27).threshold(18);
BigInteger[] witness = inputs.calculateWitness(circuit, CurveId.BLS12_381);

// Dev-only single-party setup (-Dzeroj.allowInsecureTrustedSetup=true).
// Real deployments import keys from a multi-party ceremony.
BigInteger tau = PowersOfTauBLS381.generate(4).tauScalar();
try (var keys = Groth16Keys.setupInMemory(
        r1cs.constraints(), r1cs.numWires(), r1cs.numPublicInputs(), tau)) {
    Groth16ProofBLS381 proof = keys.prove(witness, r1cs.constraints());
}

BigInteger[] pub = Arrays.copyOfRange(witness, 1, 1 + r1cs.numPublicInputs());
String vkJson = SnarkjsGroth16Json.verificationKeyJson(keys);
String proofJson = SnarkjsGroth16Json.proofJson(proof);
String publicJson = SnarkjsGroth16Json.publicJson(pub);

CircuitId id = AgeCheckCircuit.circuitId();
var envelope = SnarkjsJsonCodec.toEnvelopeFromJson(proofJson, vkJson, publicJson, id);
var material = VerificationMaterial.of(vkJson.getBytes(UTF_8),
        ProofSystemId.GROTH16, CurveId.BLS12_381, id);

boolean valid = new Groth16BLS12381PureJavaVerifier()
        .verify(envelope, material)
        .proofValid();   // true

var vk = ProverToCardano.compressVk(keys);
var ic = ListPlutusData.of();
vk.ic().forEach(point -> ic.add(new BytesPlutusData(point)));

// The verification key is baked into the script as parameters.
var script = JulcScriptLoader.load(Groth16BLS12381Verifier.class,
        new BytesPlutusData(vk.alpha()), new BytesPlutusData(vk.beta()),
        new BytesPlutusData(vk.gamma()), new BytesPlutusData(vk.delta()), ic);

// Public inputs go in the datum, the compressed proof in the redeemer.
var p = ProverToCardano.compressProof(proof);   // 48 + 96 + 48 bytes