diff --git a/applications/tari_app_utilities/src/transaction_executor.rs b/applications/tari_app_utilities/src/transaction_executor.rs
index 86ca6f7a6c..e0e4851ccb 100644
--- a/applications/tari_app_utilities/src/transaction_executor.rs
+++ b/applications/tari_app_utilities/src/transaction_executor.rs
@@ -122,7 +122,7 @@ where TTemplateProvider: TemplateProvider<Template = LoadedTemplate>
             .map(|pk| NonFungibleAddress::from_public_key(*pk))
             .collect();
         let auth_params = AuthParams {
-            initial_ownership_proofs,
+            initial_ownership_proofs: Arc::new(initial_ownership_proofs),
         };
 
         let modules: Vec<Arc<dyn RuntimeModule>> = vec![Arc::new(FeeModule::new(0, self.fee_table.clone()))];
diff --git a/applications/tari_validator_node/src/transaction_validators/network.rs b/applications/tari_validator_node/src/transaction_validators/network.rs
index 258ac39ae4..4c95bd68d6 100644
--- a/applications/tari_validator_node/src/transaction_validators/network.rs
+++ b/applications/tari_validator_node/src/transaction_validators/network.rs
@@ -34,8 +34,8 @@ impl Validator<Transaction> for TransactionNetworkValidator {
         if tx_network != self.network {
             warn!(target: LOG_TARGET, "TransactionNetworkValidator - FAIL: mismatching networks: TX: {} != Current: {}", tx_network, self.network);
             return Err(Self::Error::NetworkMismatch {
-                actual: self.network,
-                expected: tx_network,
+                actual: tx_network,
+                expected: self.network,
             });
         }
 
diff --git a/applications/tari_validator_node_cli/src/command/transaction.rs b/applications/tari_validator_node_cli/src/command/transaction.rs
index 2c14d99fd3..9c98f42318 100644
--- a/applications/tari_validator_node_cli/src/command/transaction.rs
+++ b/applications/tari_validator_node_cli/src/command/transaction.rs
@@ -185,7 +185,7 @@ pub async fn handle_submit(
             args,
         } => Instruction::CallFunction {
             address: template_address.into_inner(),
-            function: function_name,
+            function: function_name.try_into()?,
             args: args
                 .into_iter()
                 .map(|s| {
@@ -205,7 +205,7 @@ pub async fn handle_submit(
                 .as_component_address()
                 .ok_or_else(|| anyhow!("Invalid component address: {}", component_address))?
                 .into(),
-            method: method_name,
+            method: method_name.try_into()?,
             args: args
                 .into_iter()
                 .map(|s| {
diff --git a/applications/tari_wallet_cli/src/command/transaction.rs b/applications/tari_wallet_cli/src/command/transaction.rs
index ac246c86d4..0c8e607ad3 100644
--- a/applications/tari_wallet_cli/src/command/transaction.rs
+++ b/applications/tari_wallet_cli/src/command/transaction.rs
@@ -222,7 +222,7 @@ pub async fn handle_submit(args: SubmitArgs, client: &mut WalletDaemonClient) ->
             args,
         } => Instruction::CallFunction {
             address: template_address.into_inner(),
-            function: function_name,
+            function: function_name.try_into()?,
             args: args.into_iter().map(|s| s.into_arg()).collect(),
         },
         CliInstruction::CallMethod {
@@ -234,7 +234,7 @@ pub async fn handle_submit(args: SubmitArgs, client: &mut WalletDaemonClient) ->
                 .as_component_address()
                 .ok_or_else(|| anyhow!("Invalid component address: {}", component_address))?
                 .into(),
-            method: method_name,
+            method: method_name.try_into()?,
             args: args.into_iter().map(|s| s.into_arg()).collect(),
         },
     };
diff --git a/applications/tari_walletd/src/handlers/accounts.rs b/applications/tari_walletd/src/handlers/accounts.rs
index 8f95ab43ae..6e3d507e1b 100644
--- a/applications/tari_walletd/src/handlers/accounts.rs
+++ b/applications/tari_walletd/src/handlers/accounts.rs
@@ -5,7 +5,7 @@ use std::{collections::HashSet, iter, time::Duration};
 
 use anyhow::{anyhow, Context};
 use axum_extra::headers::authorization::Bearer;
-use indexmap::IndexMap;
+use indexmap::{IndexMap, IndexSet};
 use log::*;
 use rand::rngs::OsRng;
 use tari_crypto::{keys::PublicKey as _, ristretto::RistrettoPublicKey};
@@ -17,12 +17,7 @@ use tari_engine_types::{
     ToByteType,
 };
 use tari_ootle_common_types::{optional::Optional, SubstateRequirement};
-use tari_ootle_wallet_crypto::{
-    memo::Memo,
-    UnblindedOutputWitness,
-    UnblindedStealthInputWitness,
-    UnblindedStealthOutputWitness,
-};
+use tari_ootle_wallet_crypto::{memo::Memo, OutputWitness, SecretStealthOutputStatement, StealthInputWitness};
 use tari_ootle_wallet_sdk::{
     apis::{
         confidential_transfer::ConfidentialTransferParams,
@@ -30,14 +25,15 @@ use tari_ootle_wallet_sdk::{
         stealth_transfer::{StealthTransferParams, TransferOutput},
         substate::ValidatorScanResult,
     },
-    models::{KeyBranch, NewAccountData, TransactionSubmittedEvent},
+    models::{KeyBranch, KeyId, NewAccountData, StealthUtxoSpendKeyId, TransactionSubmittedEvent},
 };
 use tari_template_builtin::ACCOUNT_TEMPLATE_ADDRESS;
 use tari_template_lib::{
     constants::{STEALTH_TARI_RESOURCE_ADDRESS, XTR, XTR_FAUCET_COMPONENT_ADDRESS, XTR_FAUCET_VAULT_ADDRESS},
+    models::SpendCondition,
     types::{Amount, ResourceType},
 };
-use tari_transaction::{args, TransactionSignature};
+use tari_transaction::args;
 use tari_wallet_daemon_client::{
     permissions::JrpcPermission,
     types::{
@@ -436,16 +432,17 @@ pub async fn handle_claim_burn(
     let network = sdk.config_api().get_network()?;
     // We derive secrets directly here because claim burn is a unique case, making it difficult to use the higher
     // level stealth output api that takes care of keys but assumes that this is a regular transfer.
-    let claim_nonce_keypair = sdk
+    let claim_nonce_key = sdk
         .key_manager_api()
-        .derive_keypair(KeyBranch::Nonce, owner_nonce_key_index)?;
+        .get_key(KeyId::derived(KeyBranch::Nonce, owner_nonce_key_index))?;
+    let claim_public_key = claim_nonce_key.to_public_key();
 
     if !sdk.stealth_crypto_api().validate_burn_claim_ownership_proof(
         network,
         &claim_proof.ownership_proof,
         &claim_proof.commitment,
         claim_proof.value,
-        &claim_nonce_keypair.public_key.to_byte_type(),
+        &claim_public_key.to_byte_type(),
     ) {
         return Err(invalid_params(
             "claim_proof.ownership_proof",
@@ -456,7 +453,7 @@ pub async fn handle_claim_burn(
     info!(
         target: LOG_TARGET,
         "ℹ️ Signing claim burn with key {}. NOTE: This must be the same as the claiming key (owner_nonce_key_index) used in the burn transaction for this to succeed.",
-        claim_nonce_keypair.public_key
+        claim_public_key
     );
 
     let reciprocal_claim_public_key_expanded = claim_proof
@@ -466,7 +463,7 @@ pub async fn handle_claim_burn(
     let decrypted = sdk.stealth_crypto_api().decrypt_value_and_mask(
         &claimed_encrypted_data,
         &claim_proof.commitment,
-        claim_nonce_keypair.secret_key(),
+        claim_nonce_key.secret(),
         &reciprocal_claim_public_key_expanded,
         true,
     )?;
@@ -511,8 +508,8 @@ pub async fn handle_claim_burn(
         sdk.stealth_crypto_api()
             .derive_stealth_owner_public_key(network, &account_owner_public_key, &nonce);
 
-    let output_statement = UnblindedStealthOutputWitness {
-        witness: UnblindedOutputWitness {
+    let output_statement = SecretStealthOutputStatement {
+        witness: OutputWitness {
             amount: final_amount,
             mask: mask.key,
             sender_public_nonce: output_public_nonce.clone(),
@@ -520,25 +517,22 @@ pub async fn handle_claim_burn(
             encrypted_data,
             resource_view_key: None,
         },
-        output_owner_public_key: stealth_output_owner_public_key,
+        spend_condition: SpendCondition::Signed(stealth_output_owner_public_key.to_byte_type()),
         tag,
     };
 
-    // Generate the correct secret to spend the claimed output
-    let input = UnblindedStealthInputWitness {
+    // Package the secrets required to spend the claimed output
+    let input = StealthInputWitness {
         mask_and_value: decrypted.into_mask_and_value(),
-        owner_secret: claim_nonce_keypair.secret_key().clone(),
         public_nonce: reciprocal_claim_public_key_expanded,
     };
 
-    let public_signer_key = sdk.key_manager_api().next_public_key(KeyBranch::Nonce)?;
-
     let pay_fee_and_mint_output = sdk.stealth_crypto_api().generate_transfer_statement(
-        iter::once(&input),
+        iter::once(input),
         0,
         iter::once(&output_statement),
         max_fee,
-        public_signer_key.public_key.to_byte_type(),
+        // public_signer_key.public_key.to_byte_type(),
     )?;
     // We'll create an output with the same encrypted data that was used on L1 burn. Note that this is not strictly
     // necessary. The engine will create the output with whatever you give it, so we could reencrypt.
@@ -553,9 +547,10 @@ pub async fn handle_claim_burn(
                 .claim_burn(claim_proof, output_data)
                 .pay_fee_stealth(pay_fee_and_mint_output)
         })
-        .build();
+        .finish();
 
-    let transaction = sdk.signer_api().sign(public_signer_key.key_id, transaction)?;
+    // Add the required spend signature to the transaction
+    let transaction = sdk.signer_api().sign(*claim_nonce_key.key_id(), transaction)?;
 
     let tx_id = context.transaction_service().submit_transaction(transaction).await?;
 
@@ -656,7 +651,7 @@ pub async fn handle_create_free_test_coins(
                 .call_method(*account.component_address(), "pay_fee", args![max_fee])
         })
         .with_inputs(inputs.into_iter().map(|input| input.into_unversioned()))
-        .build();
+        .finish();
 
     let transaction = sdk.signer_api().sign(account_owner_key_id, transaction)?;
 
@@ -846,7 +841,7 @@ pub async fn handle_transfer(
             }
         })
         .with_inputs(inputs.into_iter().map(|req| req.into_unversioned()))
-        .build();
+        .finish();
 
     let transaction = sdk.signer_api().sign(account_owner_key_id, transaction)?;
 
@@ -985,6 +980,7 @@ pub async fn handle_stealth_transfer(
                     blinded_amount: transfer.blinded_output_amount,
                     revealed_amount: transfer.revealed_output_amount,
                     memo: Some(memo),
+                    pay_to: transfer.pay_to,
                 })
             },
             None => Ok(TransferOutput {
@@ -992,6 +988,7 @@ pub async fn handle_stealth_transfer(
                 blinded_amount: transfer.blinded_output_amount,
                 revealed_amount: transfer.revealed_output_amount,
                 memo: transfer.output_memo,
+                pay_to: transfer.pay_to,
             }),
         })
         .collect::<anyhow::Result<_>>()?;
@@ -1019,15 +1016,19 @@ pub async fn handle_stealth_transfer(
         let transaction = transfer.transaction.authorized_sealed_signer();
         let main_pk = transfer.main_signer.public_key().to_byte_type();
 
+        // Signer api which sign transaction types that require the seal signer public key
+        let main_signer = sdk.signer_api().with_context(&main_pk);
         // Add additional signature if needed
-        let additional_sig = transfer
-            .additional_signer
-            .as_ref()
-            .map(|s| sdk.signer_api().get_signature(s.key_id, &main_pk, &transaction))
-            .transpose()?
-            .map(|sig| TransactionSignature::new(sig.public_key.to_byte_type(), sig.signature.to_byte_type()));
+        let transaction = match transfer.additional_signer.as_ref() {
+            Some(s) => main_signer.sign(s.key_id, transaction)?,
+            None => transaction.finish(),
+        };
 
-        let transaction = transaction.build_with_signatures(additional_sig.into_iter().collect());
+        // Add required UTXO spend key signatures
+        let transaction = transfer
+            .utxo_spend_keys
+            .iter()
+            .try_fold(transaction, |tx, key| main_signer.sign_with_stealth_key(key, tx))?;
 
         // Sign and seal the final transaction
         let transaction = sdk.signer_api().sign(transfer.main_signer.key_id, transaction)?;
@@ -1087,6 +1088,7 @@ pub async fn handle_create_stealth_transfer_statement(
     }
 
     let mut required_signers = HashSet::new();
+    let mut utxo_signers = IndexSet::new();
     let lock = sdk.locks_api().create_lock_with_timeout(Duration::from_secs(5 * 60))?;
     let mut statements = Vec::with_capacity(req.requests.len());
     for req in req.requests {
@@ -1133,9 +1135,7 @@ pub async fn handle_create_stealth_transfer_statement(
             sdk.key_manager_api().next_derived_key_id(KeyBranch::Nonce)?.into()
         };
 
-        let required_signer = sdk.key_manager_api().get_public_key(signing_key_id)?;
-        let required_signer = required_signer.public_key.to_byte_type();
-
+        let output_revealed_amount = req.outputs.iter().map(|o| o.revealed_amount).sum();
         let outputs = req
             .outputs
             .iter()
@@ -1146,7 +1146,6 @@ pub async fn handle_create_stealth_transfer_statement(
         let statement = sdk
             .stealth_outputs_api()
             .generate_transfer_statement(TransferStatementParams {
-                spend_key_id: sender_key_id,
                 view_only_key_id: sender_account.view_only_key_id(),
                 resource_address: &req.resource_address,
                 resource_view_key: resource
@@ -1165,10 +1164,14 @@ pub async fn handle_create_stealth_transfer_statement(
                         )
                     })?,
                 outputs,
-                output_revealed_amount: req.outputs.iter().map(|o| o.revealed_amount).sum(),
-                required_signer,
+                output_revealed_amount,
             })?;
 
+        utxo_signers.extend(inputs.iter().flat_map(|i| &i.inputs).map(|i| StealthUtxoSpendKeyId {
+            account_key_id: sender_key_id,
+            public_nonce: i.public_nonce,
+        }));
+
         required_signers.insert(signing_key_id);
         statements.push(statement);
     }
@@ -1180,6 +1183,7 @@ pub async fn handle_create_stealth_transfer_statement(
         statements,
         lock_id,
         signing_keys: required_signers.into_iter().collect(),
+        utxo_signers: utxo_signers.into_iter().collect(),
     })
 }
 
diff --git a/applications/tari_walletd/src/handlers/confidential.rs b/applications/tari_walletd/src/handlers/confidential.rs
index a606d6c08a..7792a97223 100644
--- a/applications/tari_walletd/src/handlers/confidential.rs
+++ b/applications/tari_walletd/src/handlers/confidential.rs
@@ -15,7 +15,7 @@ use tari_engine_types::{
     ToByteType,
 };
 use tari_ootle_common_types::{displayable::Displayable, optional::Optional};
-use tari_ootle_wallet_crypto::{GenerateValueLookup, IoReaderValueLookup, UnblindedOutputWitness};
+use tari_ootle_wallet_crypto::{GenerateValueLookup, IoReaderValueLookup, OutputWitness};
 use tari_ootle_wallet_sdk::models::{ConfidentialOutputModel, KeyBranch, OutputStatus};
 use tari_template_lib::types::Amount;
 use tari_wallet_daemon_client::{
@@ -132,7 +132,7 @@ pub async fn handle_create_transfer_proof(
         ))
     })?;
 
-    let output_statement = UnblindedOutputWitness {
+    let output_statement = OutputWitness {
         amount: confidential_amount,
         mask: output_mask.key,
         sender_public_nonce: public_nonce,
@@ -170,7 +170,7 @@ pub async fn handle_create_transfer_proof(
             lock_id: Some(lock.id()),
         })?;
 
-        Some(UnblindedOutputWitness {
+        Some(OutputWitness {
             amount: change_amount_u64,
             mask: change_mask.key,
             sender_public_nonce: public_nonce,
@@ -285,7 +285,7 @@ pub async fn handle_create_output_proof(
         None,
     )?;
 
-    let statement = UnblindedOutputWitness {
+    let statement = OutputWitness {
         amount: req.amount,
         mask: output_mask.key,
         sender_public_nonce: public_nonce,
diff --git a/applications/tari_walletd/src/handlers/nfts.rs b/applications/tari_walletd/src/handlers/nfts.rs
index d3b764940e..6f4577ef9d 100644
--- a/applications/tari_walletd/src/handlers/nfts.rs
+++ b/applications/tari_walletd/src/handlers/nfts.rs
@@ -119,7 +119,7 @@ pub async fn handle_mint_faucet(
         .with_inputs(inputs.into_iter().map(|input| input.into_unversioned()))
         .add_input(NFT_FAUCET_COMPONENT_ADDRESS)
         .add_input(NFT_FAUCET_RESOURCE_ADDRESS)
-        .build();
+        .finish();
 
     let transaction = sdk.signer_api().sign(account_owner_key_id, transaction)?;
 
@@ -300,15 +300,13 @@ pub async fn handle_transfer(
         // Seal signer is the fee payer account
         .with_authorized_seal_signer()
         .map(|builder| {
-            sdk.signer_api().sign_with_context(
-                account_owner_key_id,
-                &fee_owner_key.public_key().to_byte_type(),
-                builder,
-            )
+            sdk.signer_api()
+                .with_context(&fee_owner_key.public_key().to_byte_type())
+                .sign(account_owner_key_id, builder)
         })?
-        .build();
+        .finish();
 
-    let transaction = sdk.signer_api().sign(account_owner_key_id, transaction)?;
+    let transaction = sdk.signer_api().sign(fee_payer_key_id, transaction)?;
 
     // if dry run, we can return the result immediately
     if req.dry_run {
diff --git a/applications/tari_walletd/src/handlers/stealth_utxos.rs b/applications/tari_walletd/src/handlers/stealth_utxos.rs
index 06808da3e1..671bb9a42e 100644
--- a/applications/tari_walletd/src/handlers/stealth_utxos.rs
+++ b/applications/tari_walletd/src/handlers/stealth_utxos.rs
@@ -50,6 +50,7 @@ pub async fn handle_list(
                 value: o.value.into(),
                 status: o.status,
                 memo: o.memo,
+                spend_condition: o.spend_condition,
                 is_burnt: o.is_burnt,
                 is_frozen: o.is_frozen,
                 is_on_chain: o.is_on_chain,
diff --git a/applications/tari_walletd/src/handlers/transaction.rs b/applications/tari_walletd/src/handlers/transaction.rs
index cd802abb62..ffcbcba391 100644
--- a/applications/tari_walletd/src/handlers/transaction.rs
+++ b/applications/tari_walletd/src/handlers/transaction.rs
@@ -155,12 +155,12 @@ pub async fn handle_submit(
 
     let main_signer = sdk.key_manager_api().get_public_key(req.seal_signer)?;
     let main_signer_pk = main_signer.public_key.to_byte_type();
-    let mut local_signer = sdk.signer_api();
+    let local_signer = sdk.signer_api().with_context(&main_signer_pk);
     for key in req.other_signers {
-        builder = local_signer.sign_with_context(key, &main_signer_pk, builder)?;
+        builder = local_signer.sign(key, builder)?;
     }
 
-    let transaction = local_signer.sign(req.seal_signer, builder.build())?;
+    let transaction = sdk.signer_api().sign(req.seal_signer, builder.finish())?;
 
     let tx_id = transaction.calculate_id();
     for lock_id in req.lock_ids {
@@ -246,7 +246,7 @@ pub async fn handle_submit_dry_run(
         .with_unsigned_transaction(req.transaction)
         .with_inputs(detected_inputs)
         .with_dry_run(true)
-        .build();
+        .finish();
     let transaction = sdk.signer_api().sign(key.key_id, transaction)?;
 
     for lock_id in req.lock_ids {
@@ -330,7 +330,8 @@ pub async fn handle_submit_manifest(
                 Ok(builder)
             } else {
                 sdk.signer_api()
-                    .sign_with_context(signing_key_id, &key.to_public_key().to_byte_type(), builder)
+                    .with_context(&key.to_public_key().to_byte_type())
+                    .sign(signing_key_id, builder)
             }
         })?;
     let signatures = builder.signatures().to_vec();
@@ -344,7 +345,7 @@ pub async fn handle_submit_manifest(
     let transaction = transaction
         .with_inputs(inputs)
         .authorized_sealed_signer()
-        .build_with_signatures(signatures);
+        .with_signatures(signatures);
 
     let transaction = sdk.signer_api().sign(key.key_id, transaction)?;
 
diff --git a/applications/tari_walletd/src/handlers/validator.rs b/applications/tari_walletd/src/handlers/validator.rs
index 55d04a0871..6640d300ff 100644
--- a/applications/tari_walletd/src/handlers/validator.rs
+++ b/applications/tari_walletd/src/handlers/validator.rs
@@ -182,17 +182,18 @@ pub async fn handle_claim_validator_fees(
                     Ok(builder)
                 } else {
                     // If the claim key is different from the account secret, we need to sign with both
-                    sdk.signer_api().sign_with_context(
-                        KeyId::derived(KeyBranch::Account, index),
-                        account.address.account_public_key(),
-                        builder.with_authorized_seal_signer(),
-                    )
+                    sdk.signer_api()
+                        .with_context(account.address.account_public_key())
+                        .sign(
+                            KeyId::derived(KeyBranch::Account, index),
+                            builder.with_authorized_seal_signer(),
+                        )
                 }
             } else {
                 Ok(builder)
             }
         })?
-        .build();
+        .finish();
 
     let transaction = sdk.signer_api().sign(account_key_id, unsigned_transaction)?;
 
diff --git a/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx b/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx
index 78af0e8d53..48b93ebf55 100644
--- a/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx
+++ b/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/StealthUtxoList.tsx
@@ -107,7 +107,7 @@ function StealthUtxoList({ account }: { account: Account }) {
                         {bigintToDecimalString(utxo.value, divisibility)} {currencySymbol}
                       </DataTableCell>
                       <DataTableCell>
-                        <StatusChip status={utxo.status} />
+                        <StatusChip status={utxo.status} tooltip={JSON.stringify(utxo.spend_condition)} />
                       </DataTableCell>
                       <DataTableCell>
                         <Memo memo={utxo.memo} />
diff --git a/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/components/StatusChip.tsx b/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/components/StatusChip.tsx
index 6011a73f82..19cb6d7e62 100644
--- a/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/components/StatusChip.tsx
+++ b/applications/tari_walletd/web_ui/src/routes/StealthUtxoList/components/StatusChip.tsx
@@ -15,6 +15,7 @@ import type { OutputStatus } from "@tari-project/typescript-bindings";
 interface StatusChipProps {
   status: OutputStatus;
   showTitle?: boolean;
+  tooltip?: string;
 }
 
 const colorList: Record<string, string> = {
@@ -25,7 +26,7 @@ const colorList: Record<string, string> = {
   Invalid: "#DB7E7E",
 };
 
-export default function StatusChip({ status, showTitle = true }: StatusChipProps) {
+export default function StatusChip({ status, showTitle = true, tooltip }: StatusChipProps) {
   const theme = useTheme();
 
   const iconList: Record<string, JSX.Element> = {
@@ -44,6 +45,7 @@ export default function StatusChip({ status, showTitle = true }: StatusChipProps
   } else {
     return (
       <Chip
+        title={tooltip}
         avatar={<Avatar sx={{ bgcolor: bgColor, background: background }}>{iconList[status]}</Avatar>}
         label={status}
         style={{ color: colorList[status], borderColor: colorList[status] }}
diff --git a/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts b/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts
index c9354d3ff2..5ae5f6c59d 100644
--- a/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts
+++ b/applications/tari_walletd/web_ui/src/services/api/hooks/useAccounts.ts
@@ -52,6 +52,7 @@ import {
   ResourceAddress,
   ResourceType,
   XTR,
+  PayTo,
 } from "@tari-project/typescript-bindings";
 
 const DEFAULT_MAX_FEE = 2000;
@@ -169,6 +170,7 @@ export const useAccountsTransfer = () => {
               blinded_output_amount: params.output_to_revealed ? 0n : BigInt(params.amount),
               revealed_output_amount: params.output_to_revealed ? params.amount : 0,
               output_memo: params.output_memo || null,
+              pay_to: "StealthPublicKey" as PayTo,
             },
           ],
           max_fee,
diff --git a/bindings/src/index.ts b/bindings/src/index.ts
index 5f38549c8d..e293d3b43c 100644
--- a/bindings/src/index.ts
+++ b/bindings/src/index.ts
@@ -13,6 +13,7 @@ export * from "./types/AuthHook";
 export * from "./types/BlockHeader";
 export * from "./types/Block";
 export * from "./types/BucketId";
+export * from "./types/Bytes";
 export * from "./types/ClaimBurnOutputData";
 export * from "./types/ClaimedOutputTombstoneAddress";
 export * from "./types/ClaimedOutputTombstone";
@@ -107,6 +108,7 @@ export * from "./types/ShardGroupEvidence";
 export * from "./types/ShardGroup";
 export * from "./types/ShardStateVersions";
 export * from "./types/Shard";
+export * from "./types/SpendCondition";
 export * from "./types/StateVersion";
 export * from "./types/StealthInputsStatement";
 export * from "./types/StealthInput";
@@ -177,7 +179,7 @@ export * from "./types/WorkspaceOffsetId";
 export * from "./base-node-client";
 export * from "./tari-indexer-client";
 export * from "./validator-node-client";
-export * from "./wallet-daemon-client";
+export * from "./wallet-types";
 export * from "./helpers/BigAmount";
 export * from "./helpers/consts";
 export * from "./helpers/enum";
diff --git a/bindings/src/tari-indexer-client.ts b/bindings/src/tari-indexer-client.ts
index 1a5087c748..6595834f90 100644
--- a/bindings/src/tari-indexer-client.ts
+++ b/bindings/src/tari-indexer-client.ts
@@ -3,7 +3,6 @@
 
 export * from "./types/tari-indexer-client/IndexerSubmitTransactionResponse";
 export * from "./types/tari-indexer-client/GetTransactionReceiptResponse";
-export * from "./types/tari-indexer-client/GetTemplateDefinitionRequest";
 export * from "./types/tari-indexer-client/TemplateMetadata";
 export * from "./types/tari-indexer-client/GetUtxoUpdatesRequest";
 export * from "./types/tari-indexer-client/ListSubstatesResponse";
diff --git a/bindings/src/types/Account.ts b/bindings/src/types/Account.ts
index 6b487ace3f..9228147df4 100644
--- a/bindings/src/types/Account.ts
+++ b/bindings/src/types/Account.ts
@@ -2,7 +2,7 @@
 import type { ComponentAddress } from "./ComponentAddress";
 import type { Epoch } from "./Epoch";
 import type { RistrettoPublicKeyBytes } from "./RistrettoPublicKeyBytes";
-import type { KeyId } from "./wallet-daemon-client/KeyId";
+import type { KeyId } from "./wallet-types/KeyId";
 
 export type Account = {
   name: string | null;
diff --git a/bindings/src/types/Bytes.ts b/bindings/src/types/Bytes.ts
new file mode 100644
index 0000000000..18c0bc9d2c
--- /dev/null
+++ b/bindings/src/types/Bytes.ts
@@ -0,0 +1,9 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * A wrapper around `Vec<u8>` that serializes to and from bytes efficiently.
+ * Unfortunately, due to some factors (impl serde for Vec<T>, no specialization) ciborium will represent bytes as
+ * `Array(vec![Integer(u8), ....])` instead of `Bytes(vec![u8, ...])`. which results in a significant bloat in size.
+ * This wrapper uses of the `Bytes` variant in ciborium (similar to `serde_as(as = "Bytes")`).
+ */
+export type Bytes = Uint8Array;
diff --git a/bindings/src/types/RequireRule.ts b/bindings/src/types/RequireRule.ts
index f60ab67f4f..e8596f8aa0 100644
--- a/bindings/src/types/RequireRule.ts
+++ b/bindings/src/types/RequireRule.ts
@@ -7,4 +7,5 @@ import type { RuleRequirement } from "./RuleRequirement";
 export type RequireRule =
   | { Require: RuleRequirement }
   | { AnyOf: Array<RuleRequirement> }
-  | { AllOf: Array<RuleRequirement> };
+  | { AllOf: Array<RuleRequirement> }
+  | { MOfN: [number, Array<RuleRequirement>] };
diff --git a/bindings/src/types/SpendCondition.ts b/bindings/src/types/SpendCondition.ts
new file mode 100644
index 0000000000..4840f1b6fb
--- /dev/null
+++ b/bindings/src/types/SpendCondition.ts
@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AccessRule } from "./AccessRule";
+import type { RistrettoPublicKeyBytes } from "./RistrettoPublicKeyBytes";
+
+export type SpendCondition = { Signed: RistrettoPublicKeyBytes } | { AccessRule: AccessRule };
diff --git a/bindings/src/types/StealthInput.ts b/bindings/src/types/StealthInput.ts
index 2c8e5b5e40..fd44d2265e 100644
--- a/bindings/src/types/StealthInput.ts
+++ b/bindings/src/types/StealthInput.ts
@@ -1,18 +1,12 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { PedersenCommitmentBytes } from "./PedersenCommitmentBytes";
-import type { SchnorrSignatureBytes } from "./SchnorrSignatureBytes";
 
 /**
- * A statement for stealth outputs. A statement must contain confidential outputs
+ * A statement for stealth outputs to spend as inputs.
  */
 export type StealthInput = {
   /**
    * The commitment of the unspent output being spent
    */
   commitment: PedersenCommitmentBytes;
-  /**
-   * Signature that proves ownership of the unspent output. This must be signed by the owner_public_key of the
-   * output.
-   */
-  owner_proof: SchnorrSignatureBytes;
 };
diff --git a/bindings/src/types/StealthInputsStatement.ts b/bindings/src/types/StealthInputsStatement.ts
index 6064c8fc78..d6c019d208 100644
--- a/bindings/src/types/StealthInputsStatement.ts
+++ b/bindings/src/types/StealthInputsStatement.ts
@@ -1,6 +1,5 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { Amount } from "./Amount";
-import type { RistrettoPublicKeyBytes } from "./RistrettoPublicKeyBytes";
 import type { StealthInput } from "./StealthInput";
 
 /**
@@ -15,8 +14,4 @@ export type StealthInputsStatement = {
    * The total amount of revealed funds being spent.
    */
   revealed_amount: Amount;
-  /**
-   * The signer that must sign the transaction to allow these inputs to be spent.
-   */
-  required_signer: RistrettoPublicKeyBytes;
 };
diff --git a/bindings/src/types/StealthUnspentOutput.ts b/bindings/src/types/StealthUnspentOutput.ts
index 2208dec2e0..9a5b50b077 100644
--- a/bindings/src/types/StealthUnspentOutput.ts
+++ b/bindings/src/types/StealthUnspentOutput.ts
@@ -1,14 +1,6 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { RistrettoPublicKeyBytes } from "./RistrettoPublicKeyBytes";
+import type { SpendCondition } from "./SpendCondition";
 import type { UnspentOutput } from "./UnspentOutput";
 import type { UtxoTag } from "./UtxoTag";
 
-export type StealthUnspentOutput = {
-  output: UnspentOutput;
-  /**
-   * The public key that must prove ownership of this UTXO. This is typically a one time "stealth" public key
-   * selected by the client.
-   */
-  owner_public_key: RistrettoPublicKeyBytes;
-  tag: UtxoTag;
-};
+export type StealthUnspentOutput = { output: UnspentOutput; spend_condition: SpendCondition; tag: UtxoTag };
diff --git a/bindings/src/types/UtxoOutput.ts b/bindings/src/types/UtxoOutput.ts
index c7f61d1c19..0762212cdf 100644
--- a/bindings/src/types/UtxoOutput.ts
+++ b/bindings/src/types/UtxoOutput.ts
@@ -1,14 +1,6 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { PrivateOutput } from "./PrivateOutput";
-import type { RistrettoPublicKeyBytes } from "./RistrettoPublicKeyBytes";
+import type { SpendCondition } from "./SpendCondition";
 import type { UtxoTag } from "./UtxoTag";
 
-export type UtxoOutput = {
-  output: PrivateOutput;
-  /**
-   * The public key that must prove ownership of this UTXO. This is typically a one time "stealth" public key but is
-   * selected by the client.
-   */
-  owner_public_key: RistrettoPublicKeyBytes;
-  tag: UtxoTag;
-};
+export type UtxoOutput = { output: PrivateOutput; spend_condition: SpendCondition; tag: UtxoTag };
diff --git a/bindings/src/types/WalletTransaction.ts b/bindings/src/types/WalletTransaction.ts
index 83986e03fa..c81d171120 100644
--- a/bindings/src/types/WalletTransaction.ts
+++ b/bindings/src/types/WalletTransaction.ts
@@ -3,7 +3,7 @@ import type { FinalizeResult } from "./FinalizeResult";
 import type { ProposalCertificate } from "./ProposalCertificate";
 import type { Transaction } from "./Transaction";
 import type { TransactionStatus } from "./TransactionStatus";
-import type { NewAccountData } from "./wallet-daemon-client/NewAccountData";
+import type { NewAccountData } from "./wallet-types/NewAccountData";
 
 export type WalletTransaction = {
   id: string;
diff --git a/bindings/src/types/tari-indexer-client/GetTemplateDefinitionRequest.ts b/bindings/src/types/tari-indexer-client/GetTemplateDefinitionRequest.ts
deleted file mode 100644
index a6fda01a7b..0000000000
--- a/bindings/src/types/tari-indexer-client/GetTemplateDefinitionRequest.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Hash } from "../Hash";
-
-export type GetTemplateDefinitionRequest = { template_address: Hash };
diff --git a/bindings/src/types/wallet-daemon-client/AccountGetByKeyIndexRequest.ts b/bindings/src/types/wallet-types/AccountGetByKeyIndexRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountGetByKeyIndexRequest.ts
rename to bindings/src/types/wallet-types/AccountGetByKeyIndexRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountGetDefaultRequest.ts b/bindings/src/types/wallet-types/AccountGetDefaultRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountGetDefaultRequest.ts
rename to bindings/src/types/wallet-types/AccountGetDefaultRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountGetRequest.ts b/bindings/src/types/wallet-types/AccountGetRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountGetRequest.ts
rename to bindings/src/types/wallet-types/AccountGetRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountGetResponse.ts b/bindings/src/types/wallet-types/AccountGetResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountGetResponse.ts
rename to bindings/src/types/wallet-types/AccountGetResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountInfo.ts b/bindings/src/types/wallet-types/AccountInfo.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountInfo.ts
rename to bindings/src/types/wallet-types/AccountInfo.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountOrKeyId.ts b/bindings/src/types/wallet-types/AccountOrKeyId.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountOrKeyId.ts
rename to bindings/src/types/wallet-types/AccountOrKeyId.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountSetDefaultRequest.ts b/bindings/src/types/wallet-types/AccountSetDefaultRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountSetDefaultRequest.ts
rename to bindings/src/types/wallet-types/AccountSetDefaultRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountSetDefaultResponse.ts b/bindings/src/types/wallet-types/AccountSetDefaultResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountSetDefaultResponse.ts
rename to bindings/src/types/wallet-types/AccountSetDefaultResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsAssociateStealthResourceRequest.ts b/bindings/src/types/wallet-types/AccountsAssociateStealthResourceRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsAssociateStealthResourceRequest.ts
rename to bindings/src/types/wallet-types/AccountsAssociateStealthResourceRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsAssociateStealthResourceResponse.ts b/bindings/src/types/wallet-types/AccountsAssociateStealthResourceResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsAssociateStealthResourceResponse.ts
rename to bindings/src/types/wallet-types/AccountsAssociateStealthResourceResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateFreeTestCoinsRequest.ts b/bindings/src/types/wallet-types/AccountsCreateFreeTestCoinsRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateFreeTestCoinsRequest.ts
rename to bindings/src/types/wallet-types/AccountsCreateFreeTestCoinsRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateFreeTestCoinsResponse.ts b/bindings/src/types/wallet-types/AccountsCreateFreeTestCoinsResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateFreeTestCoinsResponse.ts
rename to bindings/src/types/wallet-types/AccountsCreateFreeTestCoinsResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateOrGetRequest.ts b/bindings/src/types/wallet-types/AccountsCreateOrGetRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateOrGetRequest.ts
rename to bindings/src/types/wallet-types/AccountsCreateOrGetRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateOrGetResponse.ts b/bindings/src/types/wallet-types/AccountsCreateOrGetResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateOrGetResponse.ts
rename to bindings/src/types/wallet-types/AccountsCreateOrGetResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateRequest.ts b/bindings/src/types/wallet-types/AccountsCreateRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateRequest.ts
rename to bindings/src/types/wallet-types/AccountsCreateRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateResponse.ts b/bindings/src/types/wallet-types/AccountsCreateResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateResponse.ts
rename to bindings/src/types/wallet-types/AccountsCreateResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateStealthTransferStatementRequest.ts b/bindings/src/types/wallet-types/AccountsCreateStealthTransferStatementRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateStealthTransferStatementRequest.ts
rename to bindings/src/types/wallet-types/AccountsCreateStealthTransferStatementRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsCreateStealthTransferStatementResponse.ts b/bindings/src/types/wallet-types/AccountsCreateStealthTransferStatementResponse.ts
similarity index 63%
rename from bindings/src/types/wallet-daemon-client/AccountsCreateStealthTransferStatementResponse.ts
rename to bindings/src/types/wallet-types/AccountsCreateStealthTransferStatementResponse.ts
index ecce9d6f84..2d5960232e 100644
--- a/bindings/src/types/wallet-daemon-client/AccountsCreateStealthTransferStatementResponse.ts
+++ b/bindings/src/types/wallet-types/AccountsCreateStealthTransferStatementResponse.ts
@@ -1,9 +1,14 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { StealthTransferStatement } from "../StealthTransferStatement";
 import type { KeyId } from "./KeyId";
+import type { StealthUtxoSpendKeyId } from "./StealthUtxoSpendKeyId";
 
 export type AccountsCreateStealthTransferStatementResponse = {
   statements: Array<StealthTransferStatement>;
   lock_id: number;
   signing_keys: Array<KeyId>;
+  /**
+   * Any signatures using a stealth spend key required to spend inputs provided in the statements.
+   */
+  utxo_signers: Array<StealthUtxoSpendKeyId>;
 };
diff --git a/bindings/src/types/wallet-daemon-client/AccountsGetBalancesRequest.ts b/bindings/src/types/wallet-types/AccountsGetBalancesRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsGetBalancesRequest.ts
rename to bindings/src/types/wallet-types/AccountsGetBalancesRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsGetBalancesResponse.ts b/bindings/src/types/wallet-types/AccountsGetBalancesResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsGetBalancesResponse.ts
rename to bindings/src/types/wallet-types/AccountsGetBalancesResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsListRequest.ts b/bindings/src/types/wallet-types/AccountsListRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsListRequest.ts
rename to bindings/src/types/wallet-types/AccountsListRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsListResponse.ts b/bindings/src/types/wallet-types/AccountsListResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsListResponse.ts
rename to bindings/src/types/wallet-types/AccountsListResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsRenameRequest.ts b/bindings/src/types/wallet-types/AccountsRenameRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsRenameRequest.ts
rename to bindings/src/types/wallet-types/AccountsRenameRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsRenameResponse.ts b/bindings/src/types/wallet-types/AccountsRenameResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsRenameResponse.ts
rename to bindings/src/types/wallet-types/AccountsRenameResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsTransferRequest.ts b/bindings/src/types/wallet-types/AccountsTransferRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsTransferRequest.ts
rename to bindings/src/types/wallet-types/AccountsTransferRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AccountsTransferResponse.ts b/bindings/src/types/wallet-types/AccountsTransferResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AccountsTransferResponse.ts
rename to bindings/src/types/wallet-types/AccountsTransferResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthGetAllJwtRequest.ts b/bindings/src/types/wallet-types/AuthGetAllJwtRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthGetAllJwtRequest.ts
rename to bindings/src/types/wallet-types/AuthGetAllJwtRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthGetAllJwtResponse.ts b/bindings/src/types/wallet-types/AuthGetAllJwtResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthGetAllJwtResponse.ts
rename to bindings/src/types/wallet-types/AuthGetAllJwtResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthGetMethodRequest.ts b/bindings/src/types/wallet-types/AuthGetMethodRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthGetMethodRequest.ts
rename to bindings/src/types/wallet-types/AuthGetMethodRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthGetMethodResponse.ts b/bindings/src/types/wallet-types/AuthGetMethodResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthGetMethodResponse.ts
rename to bindings/src/types/wallet-types/AuthGetMethodResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthLoginAcceptRequest.ts b/bindings/src/types/wallet-types/AuthLoginAcceptRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthLoginAcceptRequest.ts
rename to bindings/src/types/wallet-types/AuthLoginAcceptRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthLoginAcceptResponse.ts b/bindings/src/types/wallet-types/AuthLoginAcceptResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthLoginAcceptResponse.ts
rename to bindings/src/types/wallet-types/AuthLoginAcceptResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthLoginDenyRequest.ts b/bindings/src/types/wallet-types/AuthLoginDenyRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthLoginDenyRequest.ts
rename to bindings/src/types/wallet-types/AuthLoginDenyRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthLoginDenyResponse.ts b/bindings/src/types/wallet-types/AuthLoginDenyResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthLoginDenyResponse.ts
rename to bindings/src/types/wallet-types/AuthLoginDenyResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthLoginRequest.ts b/bindings/src/types/wallet-types/AuthLoginRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthLoginRequest.ts
rename to bindings/src/types/wallet-types/AuthLoginRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthLoginResponse.ts b/bindings/src/types/wallet-types/AuthLoginResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthLoginResponse.ts
rename to bindings/src/types/wallet-types/AuthLoginResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthMethod.ts b/bindings/src/types/wallet-types/AuthMethod.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthMethod.ts
rename to bindings/src/types/wallet-types/AuthMethod.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthRevokeTokenRequest.ts b/bindings/src/types/wallet-types/AuthRevokeTokenRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthRevokeTokenRequest.ts
rename to bindings/src/types/wallet-types/AuthRevokeTokenRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthRevokeTokenResponse.ts b/bindings/src/types/wallet-types/AuthRevokeTokenResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthRevokeTokenResponse.ts
rename to bindings/src/types/wallet-types/AuthRevokeTokenResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/AuthoredTemplate.ts b/bindings/src/types/wallet-types/AuthoredTemplate.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/AuthoredTemplate.ts
rename to bindings/src/types/wallet-types/AuthoredTemplate.ts
diff --git a/bindings/src/types/wallet-daemon-client/BadgeUsage.ts b/bindings/src/types/wallet-types/BadgeUsage.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/BadgeUsage.ts
rename to bindings/src/types/wallet-types/BadgeUsage.ts
diff --git a/bindings/src/types/wallet-daemon-client/BalanceEntry.ts b/bindings/src/types/wallet-types/BalanceEntry.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/BalanceEntry.ts
rename to bindings/src/types/wallet-types/BalanceEntry.ts
diff --git a/bindings/src/types/wallet-daemon-client/CallInstructionRequest.ts b/bindings/src/types/wallet-types/CallInstructionRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/CallInstructionRequest.ts
rename to bindings/src/types/wallet-types/CallInstructionRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ClaimBurnProof.ts b/bindings/src/types/wallet-types/ClaimBurnProof.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ClaimBurnProof.ts
rename to bindings/src/types/wallet-types/ClaimBurnProof.ts
diff --git a/bindings/src/types/wallet-daemon-client/ClaimBurnRequest.ts b/bindings/src/types/wallet-types/ClaimBurnRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ClaimBurnRequest.ts
rename to bindings/src/types/wallet-types/ClaimBurnRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ClaimBurnResponse.ts b/bindings/src/types/wallet-types/ClaimBurnResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ClaimBurnResponse.ts
rename to bindings/src/types/wallet-types/ClaimBurnResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/ClaimValidatorFeesRequest.ts b/bindings/src/types/wallet-types/ClaimValidatorFeesRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ClaimValidatorFeesRequest.ts
rename to bindings/src/types/wallet-types/ClaimValidatorFeesRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ClaimValidatorFeesResponse.ts b/bindings/src/types/wallet-types/ClaimValidatorFeesResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ClaimValidatorFeesResponse.ts
rename to bindings/src/types/wallet-types/ClaimValidatorFeesResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/ComponentAddressOrName.ts b/bindings/src/types/wallet-types/ComponentAddressOrName.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ComponentAddressOrName.ts
rename to bindings/src/types/wallet-types/ComponentAddressOrName.ts
diff --git a/bindings/src/types/wallet-daemon-client/ConfidentialCreateOutputProofRequest.ts b/bindings/src/types/wallet-types/ConfidentialCreateOutputProofRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ConfidentialCreateOutputProofRequest.ts
rename to bindings/src/types/wallet-types/ConfidentialCreateOutputProofRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ConfidentialCreateOutputProofResponse.ts b/bindings/src/types/wallet-types/ConfidentialCreateOutputProofResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ConfidentialCreateOutputProofResponse.ts
rename to bindings/src/types/wallet-types/ConfidentialCreateOutputProofResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/ConfidentialTransferRequest.ts b/bindings/src/types/wallet-types/ConfidentialTransferRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ConfidentialTransferRequest.ts
rename to bindings/src/types/wallet-types/ConfidentialTransferRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ConfidentialTransferResponse.ts b/bindings/src/types/wallet-types/ConfidentialTransferResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ConfidentialTransferResponse.ts
rename to bindings/src/types/wallet-types/ConfidentialTransferResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/ConfidentialViewVaultBalanceRequest.ts b/bindings/src/types/wallet-types/ConfidentialViewVaultBalanceRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ConfidentialViewVaultBalanceRequest.ts
rename to bindings/src/types/wallet-types/ConfidentialViewVaultBalanceRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ConfidentialViewVaultBalanceResponse.ts b/bindings/src/types/wallet-types/ConfidentialViewVaultBalanceResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ConfidentialViewVaultBalanceResponse.ts
rename to bindings/src/types/wallet-types/ConfidentialViewVaultBalanceResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/DerivedKeyId.ts b/bindings/src/types/wallet-types/DerivedKeyId.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/DerivedKeyId.ts
rename to bindings/src/types/wallet-types/DerivedKeyId.ts
diff --git a/bindings/src/types/wallet-daemon-client/FeePoolDetails.ts b/bindings/src/types/wallet-types/FeePoolDetails.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/FeePoolDetails.ts
rename to bindings/src/types/wallet-types/FeePoolDetails.ts
diff --git a/bindings/src/types/wallet-daemon-client/GetNftRequest.ts b/bindings/src/types/wallet-types/GetNftRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/GetNftRequest.ts
rename to bindings/src/types/wallet-types/GetNftRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/GetValidatorFeesRequest.ts b/bindings/src/types/wallet-types/GetValidatorFeesRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/GetValidatorFeesRequest.ts
rename to bindings/src/types/wallet-types/GetValidatorFeesRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/GetValidatorFeesResponse.ts b/bindings/src/types/wallet-types/GetValidatorFeesResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/GetValidatorFeesResponse.ts
rename to bindings/src/types/wallet-types/GetValidatorFeesResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/InputSelection.ts b/bindings/src/types/wallet-types/InputSelection.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/InputSelection.ts
rename to bindings/src/types/wallet-types/InputSelection.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeyBranch.ts b/bindings/src/types/wallet-types/KeyBranch.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeyBranch.ts
rename to bindings/src/types/wallet-types/KeyBranch.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeyId.ts b/bindings/src/types/wallet-types/KeyId.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeyId.ts
rename to bindings/src/types/wallet-types/KeyId.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeysCreateRequest.ts b/bindings/src/types/wallet-types/KeysCreateRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeysCreateRequest.ts
rename to bindings/src/types/wallet-types/KeysCreateRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeysCreateResponse.ts b/bindings/src/types/wallet-types/KeysCreateResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeysCreateResponse.ts
rename to bindings/src/types/wallet-types/KeysCreateResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeysListRequest.ts b/bindings/src/types/wallet-types/KeysListRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeysListRequest.ts
rename to bindings/src/types/wallet-types/KeysListRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeysListResponse.ts b/bindings/src/types/wallet-types/KeysListResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeysListResponse.ts
rename to bindings/src/types/wallet-types/KeysListResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeysSetActiveRequest.ts b/bindings/src/types/wallet-types/KeysSetActiveRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeysSetActiveRequest.ts
rename to bindings/src/types/wallet-types/KeysSetActiveRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/KeysSetActiveResponse.ts b/bindings/src/types/wallet-types/KeysSetActiveResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/KeysSetActiveResponse.ts
rename to bindings/src/types/wallet-types/KeysSetActiveResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/ListNftsRequest.ts b/bindings/src/types/wallet-types/ListNftsRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ListNftsRequest.ts
rename to bindings/src/types/wallet-types/ListNftsRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ListNftsResponse.ts b/bindings/src/types/wallet-types/ListNftsResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ListNftsResponse.ts
rename to bindings/src/types/wallet-types/ListNftsResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/MintFaucetNftRequest.ts b/bindings/src/types/wallet-types/MintFaucetNftRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/MintFaucetNftRequest.ts
rename to bindings/src/types/wallet-types/MintFaucetNftRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/MintFaucetNftResponse.ts b/bindings/src/types/wallet-types/MintFaucetNftResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/MintFaucetNftResponse.ts
rename to bindings/src/types/wallet-types/MintFaucetNftResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/NetworkInfo.ts b/bindings/src/types/wallet-types/NetworkInfo.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/NetworkInfo.ts
rename to bindings/src/types/wallet-types/NetworkInfo.ts
diff --git a/bindings/src/types/wallet-daemon-client/NewAccountData.ts b/bindings/src/types/wallet-types/NewAccountData.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/NewAccountData.ts
rename to bindings/src/types/wallet-types/NewAccountData.ts
diff --git a/bindings/src/types/wallet-types/PayTo.ts b/bindings/src/types/wallet-types/PayTo.ts
new file mode 100644
index 0000000000..b36da6b1fc
--- /dev/null
+++ b/bindings/src/types/wallet-types/PayTo.ts
@@ -0,0 +1,4 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AccessRule } from "../AccessRule";
+
+export type PayTo = "StealthPublicKey" | { AccessRule: AccessRule };
diff --git a/bindings/src/types/wallet-daemon-client/ProofsCancelRequest.ts b/bindings/src/types/wallet-types/ProofsCancelRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ProofsCancelRequest.ts
rename to bindings/src/types/wallet-types/ProofsCancelRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ProofsCancelResponse.ts b/bindings/src/types/wallet-types/ProofsCancelResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ProofsCancelResponse.ts
rename to bindings/src/types/wallet-types/ProofsCancelResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/ProofsFinalizeRequest.ts b/bindings/src/types/wallet-types/ProofsFinalizeRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ProofsFinalizeRequest.ts
rename to bindings/src/types/wallet-types/ProofsFinalizeRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ProofsFinalizeResponse.ts b/bindings/src/types/wallet-types/ProofsFinalizeResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ProofsFinalizeResponse.ts
rename to bindings/src/types/wallet-types/ProofsFinalizeResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/ProofsGenerateRequest.ts b/bindings/src/types/wallet-types/ProofsGenerateRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ProofsGenerateRequest.ts
rename to bindings/src/types/wallet-types/ProofsGenerateRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/ProofsGenerateResponse.ts b/bindings/src/types/wallet-types/ProofsGenerateResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/ProofsGenerateResponse.ts
rename to bindings/src/types/wallet-types/ProofsGenerateResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/PublishTemplateRequest.ts b/bindings/src/types/wallet-types/PublishTemplateRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/PublishTemplateRequest.ts
rename to bindings/src/types/wallet-types/PublishTemplateRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/PublishTemplateResponse.ts b/bindings/src/types/wallet-types/PublishTemplateResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/PublishTemplateResponse.ts
rename to bindings/src/types/wallet-types/PublishTemplateResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/SettingsGetResponse.ts b/bindings/src/types/wallet-types/SettingsGetResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/SettingsGetResponse.ts
rename to bindings/src/types/wallet-types/SettingsGetResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/SettingsSetRequest.ts b/bindings/src/types/wallet-types/SettingsSetRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/SettingsSetRequest.ts
rename to bindings/src/types/wallet-types/SettingsSetRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/SettingsSetResponse.ts b/bindings/src/types/wallet-types/SettingsSetResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/SettingsSetResponse.ts
rename to bindings/src/types/wallet-types/SettingsSetResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/StealthTransfer.ts b/bindings/src/types/wallet-types/StealthTransfer.ts
similarity index 88%
rename from bindings/src/types/wallet-daemon-client/StealthTransfer.ts
rename to bindings/src/types/wallet-types/StealthTransfer.ts
index da88384d2f..84aec984ab 100644
--- a/bindings/src/types/wallet-daemon-client/StealthTransfer.ts
+++ b/bindings/src/types/wallet-types/StealthTransfer.ts
@@ -2,10 +2,12 @@
 import type { Amount } from "../Amount";
 import type { Memo } from "../Memo";
 import type { OotleAddress } from "../OotleAddress";
+import type { PayTo } from "./PayTo";
 
 export type StealthTransfer = {
   destination_address: OotleAddress;
   blinded_output_amount: bigint;
   revealed_output_amount: Amount;
   output_memo?: Memo | null;
+  pay_to: PayTo;
 };
diff --git a/bindings/src/types/wallet-daemon-client/StealthTransferRequest.ts b/bindings/src/types/wallet-types/StealthTransferRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/StealthTransferRequest.ts
rename to bindings/src/types/wallet-types/StealthTransferRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/StealthTransferResponse.ts b/bindings/src/types/wallet-types/StealthTransferResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/StealthTransferResponse.ts
rename to bindings/src/types/wallet-types/StealthTransferResponse.ts
diff --git a/bindings/src/types/wallet-types/StealthUtxoSpendKeyId.ts b/bindings/src/types/wallet-types/StealthUtxoSpendKeyId.ts
new file mode 100644
index 0000000000..ab7cb9d2b8
--- /dev/null
+++ b/bindings/src/types/wallet-types/StealthUtxoSpendKeyId.ts
@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { RistrettoPublicKeyBytes } from "../RistrettoPublicKeyBytes";
+import type { KeyId } from "./KeyId";
+
+export type StealthUtxoSpendKeyId = { account_key_id: KeyId; public_nonce: RistrettoPublicKeyBytes };
diff --git a/bindings/src/types/wallet-daemon-client/StealthUtxosDecryptValueRequest.ts b/bindings/src/types/wallet-types/StealthUtxosDecryptValueRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/StealthUtxosDecryptValueRequest.ts
rename to bindings/src/types/wallet-types/StealthUtxosDecryptValueRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/StealthUtxosDecryptValueResponse.ts b/bindings/src/types/wallet-types/StealthUtxosDecryptValueResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/StealthUtxosDecryptValueResponse.ts
rename to bindings/src/types/wallet-types/StealthUtxosDecryptValueResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/StealthUtxosListRequest.ts b/bindings/src/types/wallet-types/StealthUtxosListRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/StealthUtxosListRequest.ts
rename to bindings/src/types/wallet-types/StealthUtxosListRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/StealthUtxosListResponse.ts b/bindings/src/types/wallet-types/StealthUtxosListResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/StealthUtxosListResponse.ts
rename to bindings/src/types/wallet-types/StealthUtxosListResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/SubstatesGetRequest.ts b/bindings/src/types/wallet-types/SubstatesGetRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/SubstatesGetRequest.ts
rename to bindings/src/types/wallet-types/SubstatesGetRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/SubstatesGetResponse.ts b/bindings/src/types/wallet-types/SubstatesGetResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/SubstatesGetResponse.ts
rename to bindings/src/types/wallet-types/SubstatesGetResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/SubstatesListRequest.ts b/bindings/src/types/wallet-types/SubstatesListRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/SubstatesListRequest.ts
rename to bindings/src/types/wallet-types/SubstatesListRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/SubstatesListResponse.ts b/bindings/src/types/wallet-types/SubstatesListResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/SubstatesListResponse.ts
rename to bindings/src/types/wallet-types/SubstatesListResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TemplatesGetRequest.ts b/bindings/src/types/wallet-types/TemplatesGetRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TemplatesGetRequest.ts
rename to bindings/src/types/wallet-types/TemplatesGetRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TemplatesGetResponse.ts b/bindings/src/types/wallet-types/TemplatesGetResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TemplatesGetResponse.ts
rename to bindings/src/types/wallet-types/TemplatesGetResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TemplatesListAuthoredRequest.ts b/bindings/src/types/wallet-types/TemplatesListAuthoredRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TemplatesListAuthoredRequest.ts
rename to bindings/src/types/wallet-types/TemplatesListAuthoredRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TemplatesListAuthoredResponse.ts b/bindings/src/types/wallet-types/TemplatesListAuthoredResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TemplatesListAuthoredResponse.ts
rename to bindings/src/types/wallet-types/TemplatesListAuthoredResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionClaimBurnResponse.ts b/bindings/src/types/wallet-types/TransactionClaimBurnResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionClaimBurnResponse.ts
rename to bindings/src/types/wallet-types/TransactionClaimBurnResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionGetAllRequest.ts b/bindings/src/types/wallet-types/TransactionGetAllRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionGetAllRequest.ts
rename to bindings/src/types/wallet-types/TransactionGetAllRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionGetAllResponse.ts b/bindings/src/types/wallet-types/TransactionGetAllResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionGetAllResponse.ts
rename to bindings/src/types/wallet-types/TransactionGetAllResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionGetRequest.ts b/bindings/src/types/wallet-types/TransactionGetRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionGetRequest.ts
rename to bindings/src/types/wallet-types/TransactionGetRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionGetResponse.ts b/bindings/src/types/wallet-types/TransactionGetResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionGetResponse.ts
rename to bindings/src/types/wallet-types/TransactionGetResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionGetResultRequest.ts b/bindings/src/types/wallet-types/TransactionGetResultRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionGetResultRequest.ts
rename to bindings/src/types/wallet-types/TransactionGetResultRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionGetResultResponse.ts b/bindings/src/types/wallet-types/TransactionGetResultResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionGetResultResponse.ts
rename to bindings/src/types/wallet-types/TransactionGetResultResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionSubmitDryRunResponse.ts b/bindings/src/types/wallet-types/TransactionSubmitDryRunResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionSubmitDryRunResponse.ts
rename to bindings/src/types/wallet-types/TransactionSubmitDryRunResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionSubmitManifestRequest.ts b/bindings/src/types/wallet-types/TransactionSubmitManifestRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionSubmitManifestRequest.ts
rename to bindings/src/types/wallet-types/TransactionSubmitManifestRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionSubmitManifestResponse.ts b/bindings/src/types/wallet-types/TransactionSubmitManifestResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionSubmitManifestResponse.ts
rename to bindings/src/types/wallet-types/TransactionSubmitManifestResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionSubmitRequest.ts b/bindings/src/types/wallet-types/TransactionSubmitRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionSubmitRequest.ts
rename to bindings/src/types/wallet-types/TransactionSubmitRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionSubmitResponse.ts b/bindings/src/types/wallet-types/TransactionSubmitResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionSubmitResponse.ts
rename to bindings/src/types/wallet-types/TransactionSubmitResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionWaitResultRequest.ts b/bindings/src/types/wallet-types/TransactionWaitResultRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionWaitResultRequest.ts
rename to bindings/src/types/wallet-types/TransactionWaitResultRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransactionWaitResultResponse.ts b/bindings/src/types/wallet-types/TransactionWaitResultResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransactionWaitResultResponse.ts
rename to bindings/src/types/wallet-types/TransactionWaitResultResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransferNftRequest.ts b/bindings/src/types/wallet-types/TransferNftRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransferNftRequest.ts
rename to bindings/src/types/wallet-types/TransferNftRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransferNftResponse.ts b/bindings/src/types/wallet-types/TransferNftResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransferNftResponse.ts
rename to bindings/src/types/wallet-types/TransferNftResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/TransferOutput.ts b/bindings/src/types/wallet-types/TransferOutput.ts
similarity index 93%
rename from bindings/src/types/wallet-daemon-client/TransferOutput.ts
rename to bindings/src/types/wallet-types/TransferOutput.ts
index bf74034cc4..e7cea9fa90 100644
--- a/bindings/src/types/wallet-daemon-client/TransferOutput.ts
+++ b/bindings/src/types/wallet-types/TransferOutput.ts
@@ -2,6 +2,7 @@
 import type { Amount } from "../Amount";
 import type { Memo } from "../Memo";
 import type { OotleAddress } from "../OotleAddress";
+import type { PayTo } from "./PayTo";
 
 export type TransferOutput = {
   /**
@@ -21,4 +22,5 @@ export type TransferOutput = {
    * Optional memo to include a memo in the output. This memo is encrypted and can only be read by the recipient.
    */
   memo: Memo | null;
+  pay_to: PayTo;
 };
diff --git a/bindings/src/types/wallet-daemon-client/TransferStatementRequest.ts b/bindings/src/types/wallet-types/TransferStatementRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/TransferStatementRequest.ts
rename to bindings/src/types/wallet-types/TransferStatementRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/UtxoInfo.ts b/bindings/src/types/wallet-types/UtxoInfo.ts
similarity index 83%
rename from bindings/src/types/wallet-daemon-client/UtxoInfo.ts
rename to bindings/src/types/wallet-types/UtxoInfo.ts
index 3edb379b13..59fd87492b 100644
--- a/bindings/src/types/wallet-daemon-client/UtxoInfo.ts
+++ b/bindings/src/types/wallet-types/UtxoInfo.ts
@@ -2,6 +2,7 @@
 import type { Amount } from "../Amount";
 import type { Memo } from "../Memo";
 import type { OutputStatus } from "../OutputStatus";
+import type { SpendCondition } from "../SpendCondition";
 import type { UtxoAddress } from "../UtxoAddress";
 
 export type UtxoInfo = {
@@ -9,6 +10,7 @@ export type UtxoInfo = {
   value: Amount;
   status: OutputStatus;
   memo: Memo | null;
+  spend_condition: SpendCondition;
   is_burnt: boolean;
   is_frozen: boolean;
   is_on_chain: boolean;
diff --git a/bindings/src/types/wallet-daemon-client/WalletGetInfoRequest.ts b/bindings/src/types/wallet-types/WalletGetInfoRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WalletGetInfoRequest.ts
rename to bindings/src/types/wallet-types/WalletGetInfoRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/WalletGetInfoResponse.ts b/bindings/src/types/wallet-types/WalletGetInfoResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WalletGetInfoResponse.ts
rename to bindings/src/types/wallet-types/WalletGetInfoResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/WalletSubstateInfo.ts b/bindings/src/types/wallet-types/WalletSubstateInfo.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WalletSubstateInfo.ts
rename to bindings/src/types/wallet-types/WalletSubstateInfo.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebRtcStart.ts b/bindings/src/types/wallet-types/WebRtcStart.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebRtcStart.ts
rename to bindings/src/types/wallet-types/WebRtcStart.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebRtcStartRequest.ts b/bindings/src/types/wallet-types/WebRtcStartRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebRtcStartRequest.ts
rename to bindings/src/types/wallet-types/WebRtcStartRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebRtcStartResponse.ts b/bindings/src/types/wallet-types/WebRtcStartResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebRtcStartResponse.ts
rename to bindings/src/types/wallet-types/WebRtcStartResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnAlreadyRegisteredRequest.ts b/bindings/src/types/wallet-types/WebauthnAlreadyRegisteredRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnAlreadyRegisteredRequest.ts
rename to bindings/src/types/wallet-types/WebauthnAlreadyRegisteredRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnAlreadyRegisteredResponse.ts b/bindings/src/types/wallet-types/WebauthnAlreadyRegisteredResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnAlreadyRegisteredResponse.ts
rename to bindings/src/types/wallet-types/WebauthnAlreadyRegisteredResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnFinishAuthRequest.ts b/bindings/src/types/wallet-types/WebauthnFinishAuthRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnFinishAuthRequest.ts
rename to bindings/src/types/wallet-types/WebauthnFinishAuthRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnFinishRegisterRequest.ts b/bindings/src/types/wallet-types/WebauthnFinishRegisterRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnFinishRegisterRequest.ts
rename to bindings/src/types/wallet-types/WebauthnFinishRegisterRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnFinishRegisterResponse.ts b/bindings/src/types/wallet-types/WebauthnFinishRegisterResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnFinishRegisterResponse.ts
rename to bindings/src/types/wallet-types/WebauthnFinishRegisterResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnStartAuthRequest.ts b/bindings/src/types/wallet-types/WebauthnStartAuthRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnStartAuthRequest.ts
rename to bindings/src/types/wallet-types/WebauthnStartAuthRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnStartAuthResponse.ts b/bindings/src/types/wallet-types/WebauthnStartAuthResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnStartAuthResponse.ts
rename to bindings/src/types/wallet-types/WebauthnStartAuthResponse.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnStartRegisterRequest.ts b/bindings/src/types/wallet-types/WebauthnStartRegisterRequest.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnStartRegisterRequest.ts
rename to bindings/src/types/wallet-types/WebauthnStartRegisterRequest.ts
diff --git a/bindings/src/types/wallet-daemon-client/WebauthnStartRegisterResponse.ts b/bindings/src/types/wallet-types/WebauthnStartRegisterResponse.ts
similarity index 100%
rename from bindings/src/types/wallet-daemon-client/WebauthnStartRegisterResponse.ts
rename to bindings/src/types/wallet-types/WebauthnStartRegisterResponse.ts
diff --git a/bindings/src/wallet-daemon-client.ts b/bindings/src/wallet-daemon-client.ts
deleted file mode 100644
index 3142c9fd01..0000000000
--- a/bindings/src/wallet-daemon-client.ts
+++ /dev/null
@@ -1,138 +0,0 @@
-//   Copyright 2025 The Tari Project
-//   SPDX-License-Identifier: BSD-3-Clause
-
-export * from "./types/wallet-daemon-client/ProofsFinalizeResponse";
-export * from "./types/wallet-daemon-client/WalletGetInfoResponse";
-export * from "./types/wallet-daemon-client/CallInstructionRequest";
-export * from "./types/wallet-daemon-client/AuthLoginAcceptResponse";
-export * from "./types/wallet-daemon-client/AccountsListRequest";
-export * from "./types/wallet-daemon-client/AuthGetAllJwtResponse";
-export * from "./types/wallet-daemon-client/AuthLoginResponse";
-export * from "./types/wallet-daemon-client/GetValidatorFeesRequest";
-export * from "./types/wallet-daemon-client/StealthUtxosListResponse";
-export * from "./types/wallet-daemon-client/AccountGetDefaultRequest";
-export * from "./types/wallet-daemon-client/AuthGetAllJwtRequest";
-export * from "./types/wallet-daemon-client/KeyBranch";
-export * from "./types/wallet-daemon-client/PublishTemplateResponse";
-export * from "./types/wallet-daemon-client/AccountsAssociateStealthResourceResponse";
-export * from "./types/wallet-daemon-client/WalletSubstateInfo";
-export * from "./types/wallet-daemon-client/WebauthnAlreadyRegisteredResponse";
-export * from "./types/wallet-daemon-client/AccountGetResponse";
-export * from "./types/wallet-daemon-client/SettingsSetRequest";
-export * from "./types/wallet-daemon-client/StealthTransferResponse";
-export * from "./types/wallet-daemon-client/StealthTransferRequest";
-export * from "./types/wallet-daemon-client/GetValidatorFeesResponse";
-export * from "./types/wallet-daemon-client/AccountsCreateStealthTransferStatementResponse";
-export * from "./types/wallet-daemon-client/ClaimBurnProof";
-export * from "./types/wallet-daemon-client/TransactionGetAllRequest";
-export * from "./types/wallet-daemon-client/WebauthnAlreadyRegisteredRequest";
-export * from "./types/wallet-daemon-client/AuthMethod";
-export * from "./types/wallet-daemon-client/AuthLoginDenyResponse";
-export * from "./types/wallet-daemon-client/StealthUtxosDecryptValueResponse";
-export * from "./types/wallet-daemon-client/MintFaucetNftRequest";
-export * from "./types/wallet-daemon-client/AuthLoginDenyRequest";
-export * from "./types/wallet-daemon-client/PublishTemplateRequest";
-export * from "./types/wallet-daemon-client/TransactionSubmitResponse";
-export * from "./types/wallet-daemon-client/StealthTransfer";
-export * from "./types/wallet-daemon-client/ProofsGenerateResponse";
-export * from "./types/wallet-daemon-client/TransactionSubmitManifestResponse";
-export * from "./types/wallet-daemon-client/ListNftsResponse";
-export * from "./types/wallet-daemon-client/ClaimValidatorFeesRequest";
-export * from "./types/wallet-daemon-client/AuthLoginRequest";
-export * from "./types/wallet-daemon-client/AuthGetMethodResponse";
-export * from "./types/wallet-daemon-client/TransactionGetRequest";
-export * from "./types/wallet-daemon-client/AuthRevokeTokenResponse";
-export * from "./types/wallet-daemon-client/ProofsFinalizeRequest";
-export * from "./types/wallet-daemon-client/WebauthnStartRegisterRequest";
-export * from "./types/wallet-daemon-client/FeePoolDetails";
-export * from "./types/wallet-daemon-client/AccountsTransferRequest";
-export * from "./types/wallet-daemon-client/AccountOrKeyId";
-export * from "./types/wallet-daemon-client/DerivedKeyId";
-export * from "./types/wallet-daemon-client/SettingsSetResponse";
-export * from "./types/wallet-daemon-client/WebauthnFinishAuthRequest";
-export * from "./types/wallet-daemon-client/KeysListRequest";
-export * from "./types/wallet-daemon-client/AccountsTransferResponse";
-export * from "./types/wallet-daemon-client/TransactionGetResultResponse";
-export * from "./types/wallet-daemon-client/AccountsAssociateStealthResourceRequest";
-export * from "./types/wallet-daemon-client/ClaimBurnRequest";
-export * from "./types/wallet-daemon-client/KeysListResponse";
-export * from "./types/wallet-daemon-client/KeyId";
-export * from "./types/wallet-daemon-client/SubstatesGetRequest";
-export * from "./types/wallet-daemon-client/TransactionSubmitRequest";
-export * from "./types/wallet-daemon-client/AccountsGetBalancesResponse";
-export * from "./types/wallet-daemon-client/TransactionGetAllResponse";
-export * from "./types/wallet-daemon-client/AccountsCreateFreeTestCoinsResponse";
-export * from "./types/wallet-daemon-client/ListNftsRequest";
-export * from "./types/wallet-daemon-client/TransactionSubmitManifestRequest";
-export * from "./types/wallet-daemon-client/ConfidentialTransferResponse";
-export * from "./types/wallet-daemon-client/TransactionGetResponse";
-export * from "./types/wallet-daemon-client/SubstatesGetResponse";
-export * from "./types/wallet-daemon-client/AccountsRenameRequest";
-export * from "./types/wallet-daemon-client/AuthRevokeTokenRequest";
-export * from "./types/wallet-daemon-client/ProofsGenerateRequest";
-export * from "./types/wallet-daemon-client/MintFaucetNftResponse";
-export * from "./types/wallet-daemon-client/TemplatesListAuthoredRequest";
-export * from "./types/wallet-daemon-client/AccountsListResponse";
-export * from "./types/wallet-daemon-client/WebRtcStartResponse";
-export * from "./types/wallet-daemon-client/TransactionGetResultRequest";
-export * from "./types/wallet-daemon-client/WebauthnFinishRegisterRequest";
-export * from "./types/wallet-daemon-client/ProofsCancelResponse";
-export * from "./types/wallet-daemon-client/AccountsCreateRequest";
-export * from "./types/wallet-daemon-client/TransactionClaimBurnResponse";
-export * from "./types/wallet-daemon-client/TransactionWaitResultRequest";
-export * from "./types/wallet-daemon-client/ClaimValidatorFeesResponse";
-export * from "./types/wallet-daemon-client/ConfidentialCreateOutputProofRequest";
-export * from "./types/wallet-daemon-client/KeysCreateRequest";
-export * from "./types/wallet-daemon-client/WebauthnStartAuthRequest";
-export * from "./types/wallet-daemon-client/NetworkInfo";
-export * from "./types/wallet-daemon-client/TransferStatementRequest";
-export * from "./types/wallet-daemon-client/AccountsCreateOrGetRequest";
-export * from "./types/wallet-daemon-client/SettingsGetResponse";
-export * from "./types/wallet-daemon-client/WebauthnFinishRegisterResponse";
-export * from "./types/wallet-daemon-client/TransactionSubmitDryRunResponse";
-export * from "./types/wallet-daemon-client/WalletGetInfoRequest";
-export * from "./types/wallet-daemon-client/StealthUtxosListRequest";
-export * from "./types/wallet-daemon-client/ClaimBurnResponse";
-export * from "./types/wallet-daemon-client/WebRtcStartRequest";
-export * from "./types/wallet-daemon-client/InputSelection";
-export * from "./types/wallet-daemon-client/ConfidentialViewVaultBalanceResponse";
-export * from "./types/wallet-daemon-client/WebRtcStart";
-export * from "./types/wallet-daemon-client/AccountSetDefaultRequest";
-export * from "./types/wallet-daemon-client/WebauthnStartRegisterResponse";
-export * from "./types/wallet-daemon-client/ConfidentialCreateOutputProofResponse";
-export * from "./types/wallet-daemon-client/AccountsCreateStealthTransferStatementRequest";
-export * from "./types/wallet-daemon-client/TemplatesGetResponse";
-export * from "./types/wallet-daemon-client/AccountsGetBalancesRequest";
-export * from "./types/wallet-daemon-client/AccountsCreateFreeTestCoinsRequest";
-export * from "./types/wallet-daemon-client/AccountGetByKeyIndexRequest";
-export * from "./types/wallet-daemon-client/AccountsRenameResponse";
-export * from "./types/wallet-daemon-client/KeysCreateResponse";
-export * from "./types/wallet-daemon-client/AccountsCreateOrGetResponse";
-export * from "./types/wallet-daemon-client/AccountInfo";
-export * from "./types/wallet-daemon-client/TransferNftResponse";
-export * from "./types/wallet-daemon-client/SubstatesListRequest";
-export * from "./types/wallet-daemon-client/BalanceEntry";
-export * from "./types/wallet-daemon-client/TemplatesGetRequest";
-export * from "./types/wallet-daemon-client/ProofsCancelRequest";
-export * from "./types/wallet-daemon-client/BadgeUsage";
-export * from "./types/wallet-daemon-client/AccountSetDefaultResponse";
-export * from "./types/wallet-daemon-client/GetNftRequest";
-export * from "./types/wallet-daemon-client/SubstatesListResponse";
-export * from "./types/wallet-daemon-client/StealthUtxosDecryptValueRequest";
-export * from "./types/wallet-daemon-client/WebauthnStartAuthResponse";
-export * from "./types/wallet-daemon-client/TransferNftRequest";
-export * from "./types/wallet-daemon-client/KeysSetActiveResponse";
-export * from "./types/wallet-daemon-client/ComponentAddressOrName";
-export * from "./types/wallet-daemon-client/AuthGetMethodRequest";
-export * from "./types/wallet-daemon-client/NewAccountData";
-export * from "./types/wallet-daemon-client/AuthLoginAcceptRequest";
-export * from "./types/wallet-daemon-client/KeysSetActiveRequest";
-export * from "./types/wallet-daemon-client/ConfidentialViewVaultBalanceRequest";
-export * from "./types/wallet-daemon-client/UtxoInfo";
-export * from "./types/wallet-daemon-client/TemplatesListAuthoredResponse";
-export * from "./types/wallet-daemon-client/TransferOutput";
-export * from "./types/wallet-daemon-client/ConfidentialTransferRequest";
-export * from "./types/wallet-daemon-client/AuthoredTemplate";
-export * from "./types/wallet-daemon-client/AccountsCreateResponse";
-export * from "./types/wallet-daemon-client/TransactionWaitResultResponse";
-export * from "./types/wallet-daemon-client/AccountGetRequest";
diff --git a/bindings/src/wallet-types.ts b/bindings/src/wallet-types.ts
new file mode 100644
index 0000000000..9d737c4163
--- /dev/null
+++ b/bindings/src/wallet-types.ts
@@ -0,0 +1,140 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+export * from "./types/wallet-types/ProofsFinalizeResponse";
+export * from "./types/wallet-types/WalletGetInfoResponse";
+export * from "./types/wallet-types/CallInstructionRequest";
+export * from "./types/wallet-types/AuthLoginAcceptResponse";
+export * from "./types/wallet-types/AccountsListRequest";
+export * from "./types/wallet-types/AuthGetAllJwtResponse";
+export * from "./types/wallet-types/AuthLoginResponse";
+export * from "./types/wallet-types/GetValidatorFeesRequest";
+export * from "./types/wallet-types/StealthUtxosListResponse";
+export * from "./types/wallet-types/AccountGetDefaultRequest";
+export * from "./types/wallet-types/AuthGetAllJwtRequest";
+export * from "./types/wallet-types/KeyBranch";
+export * from "./types/wallet-types/PublishTemplateResponse";
+export * from "./types/wallet-types/AccountsAssociateStealthResourceResponse";
+export * from "./types/wallet-types/WalletSubstateInfo";
+export * from "./types/wallet-types/WebauthnAlreadyRegisteredResponse";
+export * from "./types/wallet-types/AccountGetResponse";
+export * from "./types/wallet-types/SettingsSetRequest";
+export * from "./types/wallet-types/StealthTransferResponse";
+export * from "./types/wallet-types/StealthTransferRequest";
+export * from "./types/wallet-types/GetValidatorFeesResponse";
+export * from "./types/wallet-types/StealthUtxoSpendKeyId";
+export * from "./types/wallet-types/AccountsCreateStealthTransferStatementResponse";
+export * from "./types/wallet-types/ClaimBurnProof";
+export * from "./types/wallet-types/TransactionGetAllRequest";
+export * from "./types/wallet-types/WebauthnAlreadyRegisteredRequest";
+export * from "./types/wallet-types/AuthMethod";
+export * from "./types/wallet-types/AuthLoginDenyResponse";
+export * from "./types/wallet-types/StealthUtxosDecryptValueResponse";
+export * from "./types/wallet-types/MintFaucetNftRequest";
+export * from "./types/wallet-types/AuthLoginDenyRequest";
+export * from "./types/wallet-types/PublishTemplateRequest";
+export * from "./types/wallet-types/TransactionSubmitResponse";
+export * from "./types/wallet-types/StealthTransfer";
+export * from "./types/wallet-types/ProofsGenerateResponse";
+export * from "./types/wallet-types/TransactionSubmitManifestResponse";
+export * from "./types/wallet-types/ListNftsResponse";
+export * from "./types/wallet-types/ClaimValidatorFeesRequest";
+export * from "./types/wallet-types/AuthLoginRequest";
+export * from "./types/wallet-types/AuthGetMethodResponse";
+export * from "./types/wallet-types/TransactionGetRequest";
+export * from "./types/wallet-types/AuthRevokeTokenResponse";
+export * from "./types/wallet-types/ProofsFinalizeRequest";
+export * from "./types/wallet-types/WebauthnStartRegisterRequest";
+export * from "./types/wallet-types/FeePoolDetails";
+export * from "./types/wallet-types/AccountsTransferRequest";
+export * from "./types/wallet-types/AccountOrKeyId";
+export * from "./types/wallet-types/DerivedKeyId";
+export * from "./types/wallet-types/SettingsSetResponse";
+export * from "./types/wallet-types/WebauthnFinishAuthRequest";
+export * from "./types/wallet-types/KeysListRequest";
+export * from "./types/wallet-types/AccountsTransferResponse";
+export * from "./types/wallet-types/TransactionGetResultResponse";
+export * from "./types/wallet-types/AccountsAssociateStealthResourceRequest";
+export * from "./types/wallet-types/ClaimBurnRequest";
+export * from "./types/wallet-types/KeysListResponse";
+export * from "./types/wallet-types/KeyId";
+export * from "./types/wallet-types/SubstatesGetRequest";
+export * from "./types/wallet-types/TransactionSubmitRequest";
+export * from "./types/wallet-types/AccountsGetBalancesResponse";
+export * from "./types/wallet-types/TransactionGetAllResponse";
+export * from "./types/wallet-types/AccountsCreateFreeTestCoinsResponse";
+export * from "./types/wallet-types/ListNftsRequest";
+export * from "./types/wallet-types/TransactionSubmitManifestRequest";
+export * from "./types/wallet-types/ConfidentialTransferResponse";
+export * from "./types/wallet-types/TransactionGetResponse";
+export * from "./types/wallet-types/SubstatesGetResponse";
+export * from "./types/wallet-types/AccountsRenameRequest";
+export * from "./types/wallet-types/AuthRevokeTokenRequest";
+export * from "./types/wallet-types/ProofsGenerateRequest";
+export * from "./types/wallet-types/MintFaucetNftResponse";
+export * from "./types/wallet-types/TemplatesListAuthoredRequest";
+export * from "./types/wallet-types/AccountsListResponse";
+export * from "./types/wallet-types/WebRtcStartResponse";
+export * from "./types/wallet-types/TransactionGetResultRequest";
+export * from "./types/wallet-types/WebauthnFinishRegisterRequest";
+export * from "./types/wallet-types/ProofsCancelResponse";
+export * from "./types/wallet-types/AccountsCreateRequest";
+export * from "./types/wallet-types/TransactionClaimBurnResponse";
+export * from "./types/wallet-types/TransactionWaitResultRequest";
+export * from "./types/wallet-types/ClaimValidatorFeesResponse";
+export * from "./types/wallet-types/ConfidentialCreateOutputProofRequest";
+export * from "./types/wallet-types/KeysCreateRequest";
+export * from "./types/wallet-types/WebauthnStartAuthRequest";
+export * from "./types/wallet-types/NetworkInfo";
+export * from "./types/wallet-types/TransferStatementRequest";
+export * from "./types/wallet-types/AccountsCreateOrGetRequest";
+export * from "./types/wallet-types/SettingsGetResponse";
+export * from "./types/wallet-types/WebauthnFinishRegisterResponse";
+export * from "./types/wallet-types/TransactionSubmitDryRunResponse";
+export * from "./types/wallet-types/WalletGetInfoRequest";
+export * from "./types/wallet-types/StealthUtxosListRequest";
+export * from "./types/wallet-types/ClaimBurnResponse";
+export * from "./types/wallet-types/WebRtcStartRequest";
+export * from "./types/wallet-types/InputSelection";
+export * from "./types/wallet-types/ConfidentialViewVaultBalanceResponse";
+export * from "./types/wallet-types/WebRtcStart";
+export * from "./types/wallet-types/AccountSetDefaultRequest";
+export * from "./types/wallet-types/WebauthnStartRegisterResponse";
+export * from "./types/wallet-types/ConfidentialCreateOutputProofResponse";
+export * from "./types/wallet-types/AccountsCreateStealthTransferStatementRequest";
+export * from "./types/wallet-types/TemplatesGetResponse";
+export * from "./types/wallet-types/AccountsGetBalancesRequest";
+export * from "./types/wallet-types/AccountsCreateFreeTestCoinsRequest";
+export * from "./types/wallet-types/AccountGetByKeyIndexRequest";
+export * from "./types/wallet-types/AccountsRenameResponse";
+export * from "./types/wallet-types/KeysCreateResponse";
+export * from "./types/wallet-types/AccountsCreateOrGetResponse";
+export * from "./types/wallet-types/PayTo";
+export * from "./types/wallet-types/AccountInfo";
+export * from "./types/wallet-types/TransferNftResponse";
+export * from "./types/wallet-types/SubstatesListRequest";
+export * from "./types/wallet-types/BalanceEntry";
+export * from "./types/wallet-types/TemplatesGetRequest";
+export * from "./types/wallet-types/ProofsCancelRequest";
+export * from "./types/wallet-types/BadgeUsage";
+export * from "./types/wallet-types/AccountSetDefaultResponse";
+export * from "./types/wallet-types/GetNftRequest";
+export * from "./types/wallet-types/SubstatesListResponse";
+export * from "./types/wallet-types/StealthUtxosDecryptValueRequest";
+export * from "./types/wallet-types/WebauthnStartAuthResponse";
+export * from "./types/wallet-types/TransferNftRequest";
+export * from "./types/wallet-types/KeysSetActiveResponse";
+export * from "./types/wallet-types/ComponentAddressOrName";
+export * from "./types/wallet-types/AuthGetMethodRequest";
+export * from "./types/wallet-types/NewAccountData";
+export * from "./types/wallet-types/AuthLoginAcceptRequest";
+export * from "./types/wallet-types/KeysSetActiveRequest";
+export * from "./types/wallet-types/ConfidentialViewVaultBalanceRequest";
+export * from "./types/wallet-types/UtxoInfo";
+export * from "./types/wallet-types/TemplatesListAuthoredResponse";
+export * from "./types/wallet-types/TransferOutput";
+export * from "./types/wallet-types/ConfidentialTransferRequest";
+export * from "./types/wallet-types/AuthoredTemplate";
+export * from "./types/wallet-types/AccountsCreateResponse";
+export * from "./types/wallet-types/TransactionWaitResultResponse";
+export * from "./types/wallet-types/AccountGetRequest";
diff --git a/clients/wallet_daemon_client/src/component_address.rs b/clients/wallet_daemon_client/src/component_address.rs
index 2144ce2a64..81b59361fb 100644
--- a/clients/wallet_daemon_client/src/component_address.rs
+++ b/clients/wallet_daemon_client/src/component_address.rs
@@ -11,7 +11,7 @@ use serde::{Deserialize, Serialize};
 use tari_template_lib::models::ComponentAddress;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub enum ComponentAddressOrName {
     ComponentAddress(ComponentAddress),
     Name(String),
diff --git a/clients/wallet_daemon_client/src/types.rs b/clients/wallet_daemon_client/src/types.rs
index c584472494..c10dff62b5 100644
--- a/clients/wallet_daemon_client/src/types.rs
+++ b/clients/wallet_daemon_client/src/types.rs
@@ -41,7 +41,7 @@ use tari_ootle_common_types::{
 use tari_ootle_wallet_sdk::{
     apis::{
         confidential_transfer::UtxoInputSelection,
-        stealth_transfer::{BadgeUsage, TransferOutput},
+        stealth_transfer::{BadgeUsage, PayTo, TransferOutput},
     },
     crypto::memo::Memo,
     models::{
@@ -52,6 +52,7 @@ use tari_ootle_wallet_sdk::{
         KeyId,
         NonFungibleToken,
         OutputStatus,
+        StealthUtxoSpendKeyId,
         TransactionStatus,
         WalletLockId,
         WalletTransaction,
@@ -63,6 +64,7 @@ use tari_template_lib::{
         ConfidentialOutputStatement,
         NonFungibleId,
         ResourceAddress,
+        SpendCondition,
         StealthTransferStatement,
         UtxoAddress,
         UtxoId,
@@ -88,7 +90,7 @@ use crate::{
 };
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct CallInstructionRequest {
     pub instructions: Vec<Instruction>,
     #[serde(deserialize_with = "string_or_struct")]
@@ -115,7 +117,7 @@ pub struct CallInstructionRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionSubmitRequest {
     pub transaction: UnsignedTransaction,
     pub seal_signer: KeyId,
@@ -136,7 +138,7 @@ const fn return_true() -> bool {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionSubmitResponse {
     pub transaction_id: TransactionId,
 }
@@ -144,14 +146,14 @@ pub struct TransactionSubmitResponse {
 pub type TransactionSubmitDryRunRequest = TransactionSubmitRequest;
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionSubmitDryRunResponse {
     pub transaction_id: TransactionId,
     pub result: ExecuteResult,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionSubmitManifestRequest {
     pub manifest: String,
     pub variables: HashMap<String, String>,
@@ -162,14 +164,14 @@ pub struct TransactionSubmitManifestRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionSubmitManifestResponse {
     pub transaction_id: TransactionId,
     pub result: Option<ExecuteResult>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct PublishTemplateRequest {
     #[cfg_attr(feature = "ts", ts(type = "string"))]
     #[serde(with = "serde_with::base64")]
@@ -185,7 +187,7 @@ pub struct PublishTemplateRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct PublishTemplateResponse {
     pub transaction_id: TransactionId,
     #[cfg_attr(feature = "ts", ts(type = "number | null"))]
@@ -193,13 +195,13 @@ pub struct PublishTemplateResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionGetRequest {
     pub transaction_id: TransactionId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionGetResponse {
     pub transaction: Transaction,
     pub result: Option<FinalizeResult>,
@@ -210,7 +212,7 @@ pub struct TransactionGetResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionGetAllRequest {
     pub status: Option<TransactionStatus>,
     pub component: Option<ComponentAddress>,
@@ -218,19 +220,19 @@ pub struct TransactionGetAllRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionGetAllResponse {
     pub transactions: Vec<WalletTransaction>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionGetResultRequest {
     pub transaction_id: TransactionId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionGetResultResponse {
     pub transaction_id: TransactionId,
     pub status: TransactionStatus,
@@ -238,7 +240,7 @@ pub struct TransactionGetResultResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionWaitResultRequest {
     pub transaction_id: TransactionId,
     #[cfg_attr(feature = "ts", ts(type = "number | null"))]
@@ -246,7 +248,7 @@ pub struct TransactionWaitResultRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionWaitResultResponse {
     pub transaction_id: TransactionId,
     pub result: Option<FinalizeResult>,
@@ -257,7 +259,7 @@ pub struct TransactionWaitResultResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransactionClaimBurnResponse {
     pub transaction_id: TransactionId,
     pub inputs: Vec<SubstateAddress>,
@@ -265,33 +267,33 @@ pub struct TransactionClaimBurnResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct KeysListRequest {
     pub branch: KeyBranch,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct KeysListResponse {
     /// (KeyId, public key, is_active)
     pub keys: Vec<(KeyId, RistrettoPublicKeyBytes, bool)>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct KeysSetActiveRequest {
     #[cfg_attr(feature = "ts", ts(type = "number"))]
     pub index: u64,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct KeysSetActiveResponse {
     pub public_key: RistrettoPublicKeyBytes,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct KeysCreateRequest {
     pub branch: KeyBranch,
     #[cfg_attr(feature = "ts", ts(type = "number | null"))]
@@ -299,7 +301,7 @@ pub struct KeysCreateRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct KeysCreateResponse {
     #[cfg_attr(feature = "ts", ts(type = "number"))]
     pub id: u64,
@@ -307,7 +309,7 @@ pub struct KeysCreateResponse {
 }
 
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateRequest {
     pub account_name: Option<String>,
     pub is_default: Option<bool>,
@@ -316,14 +318,14 @@ pub struct AccountsCreateRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateResponse {
     pub account: Account,
     pub address: OotleAddress,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateOrGetRequest {
     pub account: Option<ComponentAddressOrName>,
     pub is_default: Option<bool>,
@@ -332,7 +334,7 @@ pub struct AccountsCreateOrGetRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateOrGetResponse {
     pub account: Account,
     pub address: OotleAddress,
@@ -340,7 +342,7 @@ pub struct AccountsCreateOrGetResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsListRequest {
     #[cfg_attr(feature = "ts", ts(type = "number"))]
     pub offset: u64,
@@ -349,14 +351,14 @@ pub struct AccountsListRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountInfo {
     pub account: Account,
     pub address: OotleAddress,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsListResponse {
     pub accounts: Vec<AccountInfo>,
     #[cfg_attr(feature = "ts", ts(type = "number"))]
@@ -364,7 +366,7 @@ pub struct AccountsListResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsGetBalancesRequest {
     #[serde(deserialize_with = "opt_string_or_struct")]
     pub account: Option<ComponentAddressOrName>,
@@ -373,14 +375,14 @@ pub struct AccountsGetBalancesRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsGetBalancesResponse {
     pub address: ComponentAddress,
     pub balances: Vec<BalanceEntry>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct BalanceEntry {
     pub vault_address: Option<VaultId>,
     pub resource_address: ResourceAddress,
@@ -418,44 +420,44 @@ impl BalanceEntry {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountGetRequest {
     #[serde(deserialize_with = "string_or_struct")]
     pub name_or_address: ComponentAddressOrName,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountGetDefaultRequest {
     // Intentionally empty. Fields may be added in the future.
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountGetByKeyIndexRequest {
     pub key_index: u64,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountGetResponse {
     pub account: Account,
     pub address: OotleAddress,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountSetDefaultRequest {
     #[serde(deserialize_with = "string_or_struct")]
     pub account: ComponentAddressOrName,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountSetDefaultResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsRenameRequest {
     #[serde(deserialize_with = "string_or_struct")]
     pub account: ComponentAddressOrName,
@@ -463,11 +465,11 @@ pub struct AccountsRenameRequest {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsRenameResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsTransferRequest {
     #[serde(deserialize_with = "opt_string_or_struct")]
     pub account: Option<ComponentAddressOrName>,
@@ -481,13 +483,13 @@ pub struct AccountsTransferRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsTransferResponse {
     pub transaction_id: TransactionId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ProofsGenerateRequest {
     pub confidential_amount: Amount,
     pub reveal_amount: Amount,
@@ -500,7 +502,7 @@ pub struct ProofsGenerateRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ProofsGenerateResponse {
     #[cfg_attr(feature = "ts", ts(type = "number"))]
     pub proof_id: WalletLockId,
@@ -508,37 +510,37 @@ pub struct ProofsGenerateResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ProofsFinalizeRequest {
     pub lock_id: WalletLockId,
     pub transaction_id: TransactionId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ProofsFinalizeResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ProofsCancelRequest {
     #[cfg_attr(feature = "ts", ts(type = "number"))]
     pub proof_id: WalletLockId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ConfidentialCreateOutputProofRequest {
     pub amount: u64,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ConfidentialCreateOutputProofResponse {
     pub proof: ConfidentialOutputStatement,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ConfidentialTransferRequest {
     #[serde(deserialize_with = "opt_string_or_struct")]
     pub account: Option<ComponentAddressOrName>,
@@ -556,13 +558,13 @@ pub struct ConfidentialTransferRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ConfidentialTransferResponse {
     pub transaction_id: TransactionId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ConfidentialViewVaultBalanceRequest {
     pub vault_id: VaultId,
     #[cfg_attr(feature = "ts", ts(type = "number | null"))]
@@ -574,14 +576,14 @@ pub struct ConfidentialViewVaultBalanceRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ConfidentialViewVaultBalanceResponse {
     #[cfg_attr(feature = "ts", ts(type = "Record<string, number | null>"))]
     pub balances: HashMap<PedersenCommitmentBytes, Option<u64>>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ClaimBurnRequest {
     pub account: ComponentAddressOrName,
     pub claim_proof: ClaimBurnProof,
@@ -590,7 +592,7 @@ pub struct ClaimBurnRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ClaimBurnProof {
     pub claim_proof: MinotariBurnClaimProof,
     #[cfg_attr(feature = "ts", ts(type = "number"))]
@@ -599,17 +601,17 @@ pub struct ClaimBurnProof {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ClaimBurnResponse {
     pub transaction_id: TransactionId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ProofsCancelResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateFreeTestCoinsRequest {
     pub account: ComponentAddressOrName,
     pub amount: Amount,
@@ -618,7 +620,7 @@ pub struct AccountsCreateFreeTestCoinsRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateFreeTestCoinsResponse {
     pub account: Account,
     pub transaction_id: TransactionId,
@@ -630,13 +632,13 @@ pub struct AccountsCreateFreeTestCoinsResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebRtcStart {
     pub jwt: String,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebRtcStartRequest {
     pub signaling_server_token: String,
     #[cfg_attr(feature = "ts", ts(type = "object"))]
@@ -645,11 +647,11 @@ pub struct WebRtcStartRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebRtcStartResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthLoginRequest {
     pub permissions: Vec<String>,
     #[cfg_attr(feature = "ts", ts(type = "{secs: number, nanos: number} | null"))]
@@ -661,7 +663,7 @@ pub struct AuthLoginRequest {
 pub type EncodedJwtString = Zeroizing<String>;
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthLoginResponse {
     #[cfg_attr(feature = "ts", ts(type = "string"))]
     pub auth_token: EncodedJwtString,
@@ -670,7 +672,7 @@ pub struct AuthLoginResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthLoginAcceptRequest {
     #[cfg_attr(feature = "ts", ts(type = "string"))]
     pub auth_token: EncodedJwtString,
@@ -678,35 +680,35 @@ pub struct AuthLoginAcceptRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthLoginAcceptResponse {
     #[cfg_attr(feature = "ts", ts(type = "string"))]
     pub permissions_token: EncodedJwtString,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthLoginDenyRequest {
     #[cfg_attr(feature = "ts", ts(type = "string"))]
     pub auth_token: EncodedJwtString,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthLoginDenyResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthRevokeTokenRequest {
     pub permission_token_id: i32,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthRevokeTokenResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct MintFaucetNftRequest {
     pub account: ComponentAddressOrName,
     #[cfg_attr(feature = "ts", ts(type = "object"))]
@@ -717,7 +719,7 @@ pub struct MintFaucetNftRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct MintFaucetNftResponse {
     pub transaction_id: TransactionId,
     pub finalize: FinalizeResult,
@@ -725,7 +727,7 @@ pub struct MintFaucetNftResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct GetNftRequest {
     pub resource_address: ResourceAddress,
     pub nft_id: NonFungibleId,
@@ -734,7 +736,7 @@ pub struct GetNftRequest {
 pub type GetNftResponse = NonFungibleToken;
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ListNftsRequest {
     #[serde(deserialize_with = "opt_string_or_struct")]
     pub account: Option<ComponentAddressOrName>,
@@ -745,30 +747,30 @@ pub struct ListNftsRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ListNftsResponse {
     pub nfts: Vec<NonFungibleToken>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthGetAllJwtRequest {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthGetAllJwtResponse {
     pub jwt: Vec<Claims>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct GetValidatorFeesRequest {
     pub account_or_key: AccountOrKeyId,
     pub shard_group: Option<ShardGroup>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub enum AccountOrKeyId {
     /// Query by account. None signifies the default account.
     Account(Option<ComponentAddressOrName>),
@@ -777,13 +779,13 @@ pub enum AccountOrKeyId {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct GetValidatorFeesResponse {
     pub fees: HashMap<Shard, FeePoolDetails>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct FeePoolDetails {
     pub address: ValidatorFeePoolAddress,
     #[cfg_attr(feature = "ts", ts(type = "number"))]
@@ -791,7 +793,7 @@ pub struct FeePoolDetails {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ClaimValidatorFeesRequest {
     #[serde(default, deserialize_with = "opt_string_or_struct")]
     pub account: Option<ComponentAddressOrName>,
@@ -804,7 +806,7 @@ pub struct ClaimValidatorFeesRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct ClaimValidatorFeesResponse {
     pub transaction_id: TransactionId,
     #[cfg_attr(feature = "ts", ts(type = "number"))]
@@ -813,31 +815,31 @@ pub struct ClaimValidatorFeesResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct SettingsSetRequest {
     pub indexer_url: String,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct SettingsSetResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct SettingsGetResponse {
     pub indexer_url: String,
     pub network: NetworkInfo,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct NetworkInfo {
     pub name: String,
     pub byte: u8,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct SubstatesListRequest {
     #[serde(default, deserialize_with = "serde_with::string::option::deserialize")]
     #[cfg_attr(feature = "ts", ts(type = "string | null"))]
@@ -850,20 +852,20 @@ pub struct SubstatesListRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct SubstatesListResponse {
     pub substates: Vec<WalletSubstateInfo>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct SubstatesGetRequest {
     #[cfg_attr(feature = "ts", ts(type = "string"))]
     pub substate_id: SubstateId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct SubstatesGetResponse {
     // NOTE either of these can be None, but never both (instead, NotFound error)
     pub local_record: Option<WalletSubstateInfo>,
@@ -871,7 +873,7 @@ pub struct SubstatesGetResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WalletSubstateInfo {
     pub substate_id: SubstateId,
     pub parent_id: Option<SubstateId>,
@@ -881,19 +883,19 @@ pub struct WalletSubstateInfo {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TemplatesGetRequest {
     pub template_address: TemplateAddress,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TemplatesGetResponse {
     pub template_definition: TemplateDef,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TemplatesListAuthoredRequest {
     #[cfg_attr(feature = "ts", ts(type = "string"))]
     pub author_public_key: RistrettoPublicKeyBytes,
@@ -903,7 +905,7 @@ pub struct TemplatesListAuthoredRequest {
     pub page_size: u64,
 }
 
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct AuthoredTemplate {
     pub author_public_key: RistrettoPublicKeyBytes,
@@ -926,7 +928,7 @@ impl From<&AuthoredTemplateModel> for AuthoredTemplate {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TemplatesListAuthoredResponse {
     pub templates: Vec<AuthoredTemplate>,
     #[cfg_attr(feature = "ts", ts(type = "number"))]
@@ -934,11 +936,11 @@ pub struct TemplatesListAuthoredResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthGetMethodRequest {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 #[serde(rename_all = "lowercase")]
 pub enum AuthMethod {
     None,
@@ -946,31 +948,31 @@ pub enum AuthMethod {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AuthGetMethodResponse {
     pub method: AuthMethod,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnAlreadyRegisteredRequest {
     pub username: String,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnAlreadyRegisteredResponse {
     pub registered: bool,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnStartRegisterRequest {
     pub username: String,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnStartRegisterResponse {
     /// Unique ID of the current registration Session.
     pub session_id: String,
@@ -980,7 +982,7 @@ pub struct WebauthnStartRegisterResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnFinishRegisterRequest {
     /// Session ID received from [`WebauthnStartRegisterResponse`].
     pub session_id: String,
@@ -990,17 +992,17 @@ pub struct WebauthnFinishRegisterRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnFinishRegisterResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnStartAuthRequest {
     pub username: String,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnStartAuthResponse {
     /// Session ID.
     pub session_id: String,
@@ -1010,7 +1012,7 @@ pub struct WebauthnStartAuthResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WebauthnFinishAuthRequest {
     /// Session ID received from [`WebauthnStartAuthResponse`].
     pub session_id: String,
@@ -1020,11 +1022,11 @@ pub struct WebauthnFinishAuthRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WalletGetInfoRequest {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct WalletGetInfoResponse {
     pub version: String,
     pub network: String,
@@ -1032,7 +1034,7 @@ pub struct WalletGetInfoResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransferNftRequest {
     pub resource_address: ResourceAddress,
     pub nfts: Vec<NonFungibleId>,
@@ -1047,7 +1049,7 @@ pub struct TransferNftRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransferNftResponse {
     pub transaction_id: TransactionId,
     #[cfg_attr(feature = "ts", ts(type = "number"))]
@@ -1058,13 +1060,13 @@ pub struct TransferNftResponse {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateStealthTransferStatementRequest {
     pub requests: Vec<TransferStatementRequest>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransferStatementRequest {
     pub sender_account: ComponentAddressOrName,
     pub resource_address: ResourceAddress,
@@ -1082,7 +1084,7 @@ impl TransferStatementRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub enum InputSelection {
     FromBucket { revealed_amount: Amount },
     Selection(UtxoInputSelection),
@@ -1105,15 +1107,17 @@ impl InputSelection {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsCreateStealthTransferStatementResponse {
     pub statements: Vec<StealthTransferStatement>,
     pub lock_id: WalletLockId,
     pub signing_keys: Vec<KeyId>,
+    /// Any signatures using a stealth spend key required to spend inputs provided in the statements.
+    pub utxo_signers: Vec<StealthUtxoSpendKeyId>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct StealthTransferRequest {
     pub owner_account: ComponentAddressOrName,
     pub fee_input_selection: UtxoInputSelection,
@@ -1128,34 +1132,35 @@ pub struct StealthTransferRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct StealthTransfer {
     pub destination_address: OotleAddress,
     pub blinded_output_amount: u64,
     pub revealed_output_amount: Amount,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub output_memo: Option<Memo>,
+    pub pay_to: PayTo,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct StealthTransferResponse {
     pub transaction_id: TransactionId,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsAssociateStealthResourceRequest {
     pub account: ComponentAddressOrName,
     pub resource_address: ResourceAddress,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct AccountsAssociateStealthResourceResponse {}
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct StealthUtxosListRequest {
     pub resource_address: ResourceAddress,
     pub account_address: Option<ComponentAddress>,
@@ -1163,25 +1168,26 @@ pub struct StealthUtxosListRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct StealthUtxosListResponse {
     pub utxos: Vec<UtxoInfo>,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct UtxoInfo {
     pub address: UtxoAddress,
     pub value: Amount,
     pub status: OutputStatus,
     pub memo: Option<Memo>,
+    pub spend_condition: SpendCondition,
     pub is_burnt: bool,
     pub is_frozen: bool,
     pub is_on_chain: bool,
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct StealthUtxosDecryptValueRequest {
     pub resource_address: ResourceAddress,
     pub ids: Vec<UtxoId>,
@@ -1191,7 +1197,7 @@ pub struct StealthUtxosDecryptValueRequest {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct StealthUtxosDecryptValueResponse {
     pub values: HashMap<UtxoId, Option<u64>>,
 }
diff --git a/crates/common_types/src/signable.rs b/crates/common_types/src/signable.rs
index 9db0a2631b..5b2f39e3fe 100644
--- a/crates/common_types/src/signable.rs
+++ b/crates/common_types/src/signable.rs
@@ -6,7 +6,7 @@ use tari_crypto::ristretto::{RistrettoPublicKey, RistrettoSchnorr};
 pub trait Signable<Ctx = ()> {
     type MessageOutput: AsRef<[u8]>;
 
-    fn as_signing_message(&self, context: Ctx) -> Self::MessageOutput;
+    fn to_signing_message(&self, context: Ctx) -> Self::MessageOutput;
 }
 
 pub trait IntoSigned<Ctx = ()>: Signable<Ctx> {
diff --git a/crates/consensus_types/src/certificates/quorum_certificate.rs b/crates/consensus_types/src/certificates/quorum_certificate.rs
index adaf3ae11d..79c62533bc 100644
--- a/crates/consensus_types/src/certificates/quorum_certificate.rs
+++ b/crates/consensus_types/src/certificates/quorum_certificate.rs
@@ -8,7 +8,6 @@ use tari_ootle_common_types::{Epoch, NodeHeight};
 use crate::{ProposalCertificate, QcId, TimeoutCertificate, ValidatorSignatureBytes};
 
 #[derive(Debug, Clone, Serialize, BorshSerialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
 pub enum QuorumCertificateRef<'a> {
     ProposalCertificate(&'a ProposalCertificate),
     TimeoutCertificate(&'a TimeoutCertificate),
diff --git a/crates/engine/src/runtime/actions.rs b/crates/engine/src/runtime/actions.rs
index b3882b2b09..7b5ddb7856 100644
--- a/crates/engine/src/runtime/actions.rs
+++ b/crates/engine/src/runtime/actions.rs
@@ -62,15 +62,17 @@ pub enum NativeAction {
     Component(ComponentAction),
     Resource(ResourceAuthAction),
     Vault(VaultAction),
+    StealthUtxoSpend,
 }
 
 impl Display for NativeAction {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         match self {
-            NativeAction::WithdrawValidatorFunds => write!(f, "withdraw_validator_funds"),
-            NativeAction::Component(action) => write!(f, "component.call_method.{:?}", action),
-            NativeAction::Resource(action) => write!(f, "resource.{:?}", action),
-            NativeAction::Vault(action) => write!(f, "vault.{:?}", action),
+            Self::WithdrawValidatorFunds => write!(f, "withdraw_validator_funds"),
+            Self::Component(action) => write!(f, "component.call_method.{:?}", action),
+            Self::Resource(action) => write!(f, "resource.{:?}", action),
+            Self::Vault(action) => write!(f, "vault.{:?}", action),
+            Self::StealthUtxoSpend => write!(f, "stealth_utxo.spend"),
         }
     }
 }
diff --git a/crates/engine/src/runtime/auth.rs b/crates/engine/src/runtime/auth.rs
index 49ecfe914b..2eb2d8bd65 100644
--- a/crates/engine/src/runtime/auth.rs
+++ b/crates/engine/src/runtime/auth.rs
@@ -3,48 +3,67 @@
 
 use std::{fmt::Display, sync::Arc};
 
-use tari_template_lib::models::{NonFungibleAddress, ProofId};
+use indexmap::IndexSet;
+use tari_template_lib::models::{NonFungibleAddress, ProofId, ResourceAddress};
 
 #[derive(Debug, Clone)]
 pub struct AuthParams {
-    pub initial_ownership_proofs: Vec<NonFungibleAddress>,
+    pub initial_ownership_proofs: Arc<IndexSet<NonFungibleAddress>>,
 }
 
 #[derive(Debug, Clone)]
 pub struct AuthorizationScope {
     /// Virtual proofs are system-issued non-fungibles that exist for no longer than the execution e.g. derived from
     /// the transaction signer public key
-    virtual_proofs: Arc<Vec<NonFungibleAddress>>,
+    virtual_proofs: Arc<IndexSet<NonFungibleAddress>>,
 
     /// Resource-based proofs
-    proofs: Vec<ProofId>,
+    proofs: IndexSet<ProofId>,
 }
 
 impl AuthorizationScope {
-    pub fn new(virtual_proofs: Vec<NonFungibleAddress>) -> Self {
+    pub fn new(virtual_proofs: Arc<IndexSet<NonFungibleAddress>>) -> Self {
         Self {
-            virtual_proofs: Arc::new(virtual_proofs),
-            proofs: vec![],
+            virtual_proofs,
+            proofs: IndexSet::new(),
         }
     }
 
-    pub fn virtual_proofs(&self) -> &[NonFungibleAddress] {
+    pub fn empty() -> Self {
+        Self {
+            virtual_proofs: Arc::new(IndexSet::new()),
+            proofs: IndexSet::new(),
+        }
+    }
+
+    pub fn virtual_proofs(&self) -> &IndexSet<NonFungibleAddress> {
         &self.virtual_proofs
     }
 
-    pub fn proofs(&self) -> &[ProofId] {
+    pub fn contains_badge(&self, nf_address: &NonFungibleAddress) -> bool {
+        self.virtual_proofs.contains(nf_address)
+    }
+
+    pub fn contains_badge_of_resource(&self, resource_address: &ResourceAddress) -> bool {
+        self.virtual_proofs
+            .iter()
+            .any(|badge| badge.resource_address() == resource_address)
+    }
+
+    pub fn proofs(&self) -> &IndexSet<ProofId> {
         &self.proofs
     }
 
     pub fn add_proof(&mut self, proof_id: ProofId) {
-        self.proofs.push(proof_id);
+        self.proofs.insert(proof_id);
     }
 
-    pub fn remove_proof(&mut self, proof_id: &ProofId) -> Option<ProofId> {
-        self.proofs
-            .iter()
-            .position(|p| p == proof_id)
-            .map(|i| self.proofs.remove(i))
+    pub fn remove_proof(&mut self, proof_id: &ProofId) -> bool {
+        self.proofs.swap_remove(proof_id)
+    }
+
+    pub fn contains_proof(&self, proof_id: &ProofId) -> bool {
+        self.proofs.contains(proof_id)
     }
 
     pub(super) fn update_from_child(&mut self, child: AuthorizationScope) {
diff --git a/crates/engine/src/runtime/error.rs b/crates/engine/src/runtime/error.rs
index 27f74c9237..6cebb3bdea 100644
--- a/crates/engine/src/runtime/error.rs
+++ b/crates/engine/src/runtime/error.rs
@@ -45,7 +45,6 @@ use tari_template_lib::{
         ResourceAddress,
         VaultId,
     },
-    prelude::RistrettoPublicKeyBytes,
     types::{Amount, TemplateAddress},
 };
 use tari_transaction::args::{WorkspaceId, WorkspaceOffsetId};
@@ -174,8 +173,6 @@ pub enum RuntimeError {
     AccessDeniedAuthHook { action_ident: ActionIdent, details: String },
     #[error("Access Denied: You must be the owner to perform this action: {action}")]
     AccessDeniedOwnerRequired { action: ActionIdent },
-    #[error("Access Denied: Stealth transfer requires a signer with public key {required_signer}")]
-    AccessDeniedStealthTransferSigner { required_signer: RistrettoPublicKeyBytes },
     #[error("Invalid method address rule for {template_name}: {details}")]
     InvalidMethodAccessRule { template_name: String, details: String },
     #[error("Runtime module error: {0}")]
diff --git a/crates/engine/src/runtime/impl.rs b/crates/engine/src/runtime/impl.rs
index ae08b292c9..a2407aee34 100644
--- a/crates/engine/src/runtime/impl.rs
+++ b/crates/engine/src/runtime/impl.rs
@@ -105,6 +105,7 @@ use tari_template_lib::{
         NotAuthorized,
         ResourceAddress,
         ResourceAddressAllocation,
+        SpendCondition,
         StealthTransferStatement,
         UtxoAddress,
         VaultRef,
@@ -300,7 +301,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
             auth_caller.with_component_state(caller.into_component().state);
         }
 
-        // The signature of a call back is (action: ResourceAuthAction, auth_caller: AuthCaller)
+        // The signature of a call back is (action: ResourceAuthAction, auth_caller: AuthHookCaller)
         let ret = self
             .invoke_component_method(auth_hook.component_address, &auth_hook.method, invoke_args![
                 action,
@@ -1691,9 +1692,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                         container.deposit(withdrawn)?;
                     }
                     if let Some(statement) = arg.statement {
-                        if let Some(revealed) =
-                            state_mut.execute_stealth_transfer(STEALTH_TARI_RESOURCE_ADDRESS.into(), statement, None)?
-                        {
+                        if let Some(revealed) = state_mut.execute_stealth_transfer(XTR.into(), statement, None)? {
                             container.deposit(revealed)?;
                         }
                     }
@@ -2497,7 +2496,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate>> RuntimeInte
                     minimum_value_promise: 0,
                     viewable_balance: None,
                 },
-                owner_public_key: self.seal_signer_public_key,
+                spend_condition: SpendCondition::Signed(self.seal_signer_public_key),
                 tag: UtxoTag::new(0),
             });
 
diff --git a/crates/engine/src/runtime/scope.rs b/crates/engine/src/runtime/scope.rs
index b50ed65568..31cfb227db 100644
--- a/crates/engine/src/runtime/scope.rs
+++ b/crates/engine/src/runtime/scope.rs
@@ -25,23 +25,21 @@ pub struct CallScope {
     referenced: IndexSet<SubstateId>,
     component_lock: Option<LockedSubstate>,
     lock_scope: IndexSet<LockId>,
-    proof_scope: IndexSet<ProofId>,
     bucket_scope: IndexSet<BucketId>,
     auth_scope: AuthorizationScope,
 }
 
 impl CallScope {
     pub fn new() -> Self {
-        // Encountered non-determinism bug when using HashSet.
+        // NOTE: HashSet is not appropriate due to non-determinism
         Self {
             orphans: IndexSet::new(),
             owned: IndexSet::new(),
             referenced: IndexSet::new(),
             component_lock: None,
             lock_scope: IndexSet::new(),
-            proof_scope: IndexSet::new(),
             bucket_scope: IndexSet::new(),
-            auth_scope: AuthorizationScope::new(vec![]),
+            auth_scope: AuthorizationScope::empty(),
         }
     }
 
@@ -63,16 +61,8 @@ impl CallScope {
         &self.lock_scope
     }
 
-    pub fn is_proof_in_scope(&self, proof_id: ProofId) -> bool {
-        self.proof_scope.contains(&proof_id)
-    }
-
-    pub fn proof_scope(&self) -> &IndexSet<ProofId> {
-        &self.proof_scope
-    }
-
-    pub fn bucket_scope(&self) -> &IndexSet<BucketId> {
-        &self.bucket_scope
+    pub fn is_proof_in_scope(&self, proof_id: &ProofId) -> bool {
+        self.auth_scope.contains_proof(proof_id)
     }
 
     pub fn is_bucket_in_scope(&self, bucket_id: BucketId) -> bool {
@@ -111,7 +101,6 @@ impl CallScope {
     }
 
     pub fn add_proof_to_scope(&mut self, proof_id: ProofId) {
-        self.proof_scope.insert(proof_id);
         self.auth_scope_mut().add_proof(proof_id);
     }
 
@@ -198,7 +187,6 @@ impl CallScope {
         for owned in &child.owned {
             self.orphans.swap_remove(owned);
         }
-        self.proof_scope.extend(child.proof_scope);
         self.bucket_scope.extend(child.bucket_scope);
         self.auth_scope.update_from_child(child.auth_scope);
     }
@@ -265,9 +253,9 @@ impl Display for CallScope {
             }
         }
 
-        if !self.proof_scope.is_empty() {
+        if !self.auth_scope.proofs().is_empty() {
             writeln!(f, "Proofs:")?;
-            for proof in &self.proof_scope {
+            for proof in self.auth_scope.proofs() {
                 writeln!(f, "  {}", proof)?;
             }
         }
diff --git a/crates/engine/src/runtime/tracker_auth.rs b/crates/engine/src/runtime/tracker_auth.rs
index 36f3f2a34e..b31f67d2ca 100644
--- a/crates/engine/src/runtime/tracker_auth.rs
+++ b/crates/engine/src/runtime/tracker_auth.rs
@@ -50,27 +50,16 @@ impl<'a> Authorization<'a> {
                 })?;
 
         // Check access rules
-        match component.access_rules().get_method_access_rule(method) {
-            AccessRule::AllowAll => Ok(()),
-            AccessRule::DenyAll => Err(RuntimeError::AccessDenied {
+        let access_rule = component.access_rules().get_method_access_rule(method);
+        if !self.check_access_rule(access_rule)? {
+            return Err(RuntimeError::AccessDenied {
                 action_ident: ActionIdent::ComponentCallMethod {
                     component_address,
                     method: method.to_string(),
                 },
-            }),
-            AccessRule::Restricted(rule) => {
-                if !check_restricted_access_rule(self.state, scope, rule)? {
-                    return Err(RuntimeError::AccessDenied {
-                        action_ident: ActionIdent::ComponentCallMethod {
-                            component_address,
-                            method: method.to_string(),
-                        },
-                    });
-                }
-
-                Ok(())
-            },
+            });
         }
+        Ok(())
     }
 
     pub fn check_resource_access_rules(
@@ -98,6 +87,11 @@ impl<'a> Authorization<'a> {
         Ok(())
     }
 
+    pub fn check_access_rule(&self, rule: &AccessRule) -> Result<bool, RuntimeError> {
+        let scope = self.state.current_call_scope()?.auth_scope();
+        check_access_rule(self.state, scope, rule)
+    }
+
     pub fn require_ownership<A: Into<ActionIdent>>(
         &self,
         action: A,
@@ -121,7 +115,7 @@ fn check_ownership(
                 return Ok(false);
             };
             let owner_proof = NonFungibleAddress::from_public_key(*owner_key);
-            Ok(scope.virtual_proofs().contains(&owner_proof))
+            Ok(scope.contains_badge(&owner_proof))
         },
         OwnerRule::None => Ok(false),
         OwnerRule::ByAccessRule(rule) => check_access_rule(state, scope, rule),
@@ -135,7 +129,7 @@ fn check_ownership(
             }
 
             let owner_proof = NonFungibleAddress::from_public_key(*key);
-            Ok(scope.virtual_proofs().contains(&owner_proof))
+            Ok(scope.contains_badge(&owner_proof))
         },
     }
 }
@@ -203,6 +197,19 @@ fn check_require_rule(
 
             Ok(true)
         },
+        RequireRule::MOfN(n, requirements) => {
+            let mut satisfied = 0;
+            for requirement in requirements {
+                if check_requirement(state, scope, requirement)? {
+                    satisfied += 1;
+                    if satisfied == *n {
+                        return Ok(true);
+                    }
+                }
+            }
+
+            Ok(false)
+        },
     }
 }
 
@@ -213,11 +220,7 @@ fn check_requirement(
 ) -> Result<bool, RuntimeError> {
     match requirement {
         RuleRequirement::Resource(resx) => {
-            if scope
-                .virtual_proofs()
-                .iter()
-                .any(|addr| addr.resource_address() == resx)
-            {
+            if scope.contains_badge_of_resource(resx) {
                 return Ok(true);
             }
 
@@ -231,7 +234,7 @@ fn check_requirement(
             Ok(false)
         },
         RuleRequirement::NonFungibleAddress(addr) => {
-            if scope.virtual_proofs().contains(addr) {
+            if scope.contains_badge(addr) {
                 return Ok(true);
             }
 
diff --git a/crates/engine/src/runtime/working_state.rs b/crates/engine/src/runtime/working_state.rs
index d0fe63288d..178f8e29da 100644
--- a/crates/engine/src/runtime/working_state.rs
+++ b/crates/engine/src/runtime/working_state.rs
@@ -14,7 +14,6 @@ use tari_crypto::ristretto::RistrettoPublicKey;
 use tari_engine_types::{
     bucket::Bucket,
     component::ComponentHeader,
-    crypto::messages,
     events::Event,
     fees::FeeReceipt,
     id_provider::{IdProvider, ObjectIds},
@@ -35,6 +34,7 @@ use tari_engine_types::{
     ConvertFromByteType,
     ToByteType,
     Utxo,
+    UtxoOutput,
     ValidatorFeePoolAddress,
     ValidatorFeeWithdrawal,
 };
@@ -50,6 +50,8 @@ use tari_template_lib::{
         NonFungibleAddress,
         ProofId,
         ResourceAddress,
+        SpendCondition,
+        StealthInput,
         StealthTransferStatement,
         UtxoAddress,
         VaultId,
@@ -272,21 +274,6 @@ impl WorkingState {
         stmt: &StealthTransferStatement,
         view_key: Option<&RistrettoPublicKey>,
     ) -> Result<ValidatedStealthTransfer, RuntimeError> {
-        let required_signer = &stmt.inputs_statement.required_signer;
-
-        // Check that the required_signed is in scope
-        let proofs = self.base_call_scope().auth_scope().virtual_proofs();
-        if proofs
-            .iter()
-            .filter(|p| *p.resource_address() == PUBLIC_IDENTITY_RESOURCE_ADDRESS)
-            .all(|p| p.id().as_u256().map(|b| b.as_slice()) != Some(required_signer.as_bytes()))
-        {
-            return Err(RuntimeError::AccessDeniedStealthTransferSigner {
-                required_signer: *required_signer,
-            });
-        }
-
-        let metadata_hash = messages::stealth_statement_metadata64(&stmt.outputs_statement);
         for input in &stmt.inputs_statement.inputs {
             let address = UtxoAddress::new(resource_address, input.commitment.into());
             let lock_id = self.store.try_lock(&address.clone().into(), LockFlag::Write)?;
@@ -303,13 +290,43 @@ impl WorkingState {
                 details: format!("Utxo {} is burnt", address),
             })?;
 
-            stealth::validate_ownership_proof(output, input, required_signer, &metadata_hash)?;
+            self.validate_spend_condition(output, input)?;
         }
 
         let valid_transfer = stealth::validate_transfer_balance(stmt, view_key)?;
         Ok(valid_transfer)
     }
 
+    fn validate_spend_condition(&self, output: &UtxoOutput, input: &StealthInput) -> Result<(), RuntimeError> {
+        match &output.spend_condition {
+            SpendCondition::Signed(pk) => {
+                if !self
+                    .base_call_scope()
+                    .auth_scope()
+                    .contains_badge(&NonFungibleAddress::from_public_key(*pk))
+                {
+                    return Err(RuntimeError::ResourceError(
+                        ResourceError::RequiredSignatureMissingForStealthUtxo {
+                            commitment: input.commitment,
+                            public_key: *pk,
+                        },
+                    ));
+                }
+
+                Ok(())
+            },
+            SpendCondition::AccessRule(access_rule) => {
+                if !self.authorization().check_access_rule(access_rule)? {
+                    return Err(RuntimeError::AccessDenied {
+                        action_ident: ActionIdent::Native(NativeAction::StealthUtxoSpend),
+                    });
+                }
+
+                Ok(())
+            },
+        }
+    }
+
     pub fn get_non_fungible(&self, locked: &LockedSubstate) -> Result<&NonFungibleContainer, RuntimeError> {
         let (address, value) = self.store.get_locked_substate(locked.lock_id())?;
         let non_fungible = value
@@ -521,7 +538,7 @@ impl WorkingState {
     pub fn drop_proof(&mut self, proof_id: ProofId) -> Result<(), RuntimeError> {
         // Remove it from the auth scope if is in scope
         let call_frame_mut = self.current_call_scope_mut()?;
-        if !call_frame_mut.is_proof_in_scope(proof_id) {
+        if !call_frame_mut.is_proof_in_scope(&proof_id) {
             return Err(RuntimeError::ProofNotFound { proof_id });
         }
         call_frame_mut.auth_scope_mut().remove_proof(&proof_id);
@@ -1248,7 +1265,7 @@ impl WorkingState {
             }
         }
         for proof_id in value.proof_ids() {
-            if !scope.is_proof_in_scope(*proof_id) {
+            if !scope.is_proof_in_scope(proof_id) {
                 return Err(RuntimeError::ValidationFailedProofNotInScope { proof_id: *proof_id });
             }
         }
diff --git a/crates/engine/tests/account.rs b/crates/engine/tests/account.rs
index 39e7e2cb55..275a495a01 100644
--- a/crates/engine/tests/account.rs
+++ b/crates/engine/tests/account.rs
@@ -72,7 +72,7 @@ fn withdraw_from_account_prevented() {
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: faucet_template,
-                function: "mint".to_string(),
+                function: "mint".try_into().unwrap(),
                 args: call_args![initial_supply],
             }],
             vec![template_test.owner_proof()],
diff --git a/crates/engine/tests/asserts.rs b/crates/engine/tests/asserts.rs
index cd48ad3d92..c0adf7999e 100644
--- a/crates/engine/tests/asserts.rs
+++ b/crates/engine/tests/asserts.rs
@@ -34,7 +34,7 @@ fn setup() -> AssertTest {
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: faucet_template,
-                function: "mint".to_string(),
+                function: "mint".try_into().unwrap(),
                 args: call_args![initial_supply],
             }],
             vec![template_test.owner_proof()],
diff --git a/crates/engine/tests/composability.rs b/crates/engine/tests/composability.rs
index b86f875794..a56e0a0812 100644
--- a/crates/engine/tests/composability.rs
+++ b/crates/engine/tests/composability.rs
@@ -41,7 +41,7 @@ fn initialize_composability(test: &mut ComposabilityTest) -> ComposabilityCompon
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: test.composability_template,
-                function: "new".to_string(),
+                function: "new".try_into().unwrap(),
                 args: call_args![test.state_template],
             }],
             vec![],
@@ -77,7 +77,7 @@ fn create_resource_and_fund_account(test: &mut TemplateTest, account: ComponentA
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: faucet_template,
-                function: "mint".to_string(),
+                function: "mint".try_into().unwrap(),
                 args: call_args![initial_supply],
             }],
             vec![],
@@ -139,7 +139,7 @@ fn it_allows_function_to_method_calls() {
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: test.composability_template,
-                function: "new_from_component".to_string(),
+                function: "new_from_component".try_into().unwrap(),
                 args: call_args![composability_component_0],
             }],
             vec![],
diff --git a/crates/engine/tests/events.rs b/crates/engine/tests/events.rs
index d440436fad..0d0fb902b6 100644
--- a/crates/engine/tests/events.rs
+++ b/crates/engine/tests/events.rs
@@ -16,7 +16,7 @@ fn basic_emit_event() {
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: event_emitter_template,
-                function: "test_function".to_string(),
+                function: "test_function".try_into().unwrap(),
                 args: call_args![topic],
             }],
             vec![],
@@ -62,7 +62,7 @@ fn builtin_vault_events() {
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: faucet_template,
-                function: "mint".to_string(),
+                function: "mint".try_into().unwrap(),
                 args: call_args![initial_supply],
             }],
             vec![template_test.owner_proof()],
diff --git a/crates/engine/tests/signature.rs b/crates/engine/tests/signature.rs
index ca54199a25..e974f81107 100644
--- a/crates/engine/tests/signature.rs
+++ b/crates/engine/tests/signature.rs
@@ -22,7 +22,7 @@ use tari_template_lib::{
     },
 };
 use tari_template_test_tooling::{
-    support::{assert_error::assert_reject_reason, stealth},
+    support::{assert_error::assert_reject_reason, stealth, stealth::NO_INPUTS},
     TemplateTest,
 };
 use tari_transaction::{args, Transaction};
@@ -76,13 +76,7 @@ fn claim_with_valid_signature() {
         .as_vault_id()
         .unwrap();
 
-    let transfer = stealth::generate_transfer_data(
-        &[],
-        1_000_000_000_000u64,
-        Some(1_000_000_000_000),
-        0,
-        test.to_public_key_bytes(),
-    );
+    let transfer = stealth::generate_transfer_data(NO_INPUTS, 1_000_000_000_000u64, Some(1_000_000_000_000), 0);
     let signature = sign_it(&s1);
     let result = test.execute_expect_success(
         Transaction::builder()
@@ -110,8 +104,8 @@ fn multi_claim() {
     let p2 = PublicKey::from(p2.to_byte_type());
     let (mut test, faucet) = setup(vec![p1, p2]);
 
-    let transfer1 = stealth::generate_transfer_data(&[], 1000, Some(1000), 0, test.to_public_key_bytes());
-    let transfer2 = stealth::generate_transfer_data(&[], 1000, Some(1000), 0, test.to_public_key_bytes());
+    let transfer1 = stealth::generate_transfer_data(NO_INPUTS, 1000, Some(1000), 0);
+    let transfer2 = stealth::generate_transfer_data(NO_INPUTS, 1000, Some(1000), 0);
     let sig1 = sign_it(&s1);
     let sig2 = sign_it(&s2);
     test.execute_expect_success(
@@ -129,7 +123,7 @@ fn bad_signature() {
     let p1 = PublicKey::from(p1.to_byte_type());
     let (mut test, faucet) = setup(vec![p1]);
 
-    let transfer = stealth::generate_transfer_data(&[], 1000, Some(1000), 0, test.to_public_key_bytes());
+    let transfer = stealth::generate_transfer_data(NO_INPUTS, 1000, Some(1000), 0);
     let sig1 = sign_it_with(&s1, b"A different message");
     let reason = test.execute_expect_failure(
         Transaction::builder()
diff --git a/crates/engine/tests/stealth.rs b/crates/engine/tests/stealth.rs
index a681189ee5..52f4170a67 100644
--- a/crates/engine/tests/stealth.rs
+++ b/crates/engine/tests/stealth.rs
@@ -5,28 +5,26 @@ use std::collections::BTreeMap;
 
 use rand::rngs::OsRng;
 use tari_common_types::types::PrivateKey;
-use tari_crypto::{
-    commitment::HomomorphicCommitmentFactory,
-    keys::{PublicKey, SecretKey},
-    ristretto::{RistrettoPublicKey, RistrettoSecretKey},
-};
-use tari_engine::runtime::RuntimeError;
+use tari_crypto::{commitment::HomomorphicCommitmentFactory, keys::PublicKey, ristretto::RistrettoPublicKey};
+use tari_engine::runtime::{ActionIdent, NativeAction};
 use tari_engine_types::{
     crypto::{get_commitment_factory, ElgamalVerifiableBalance, ValueLookupTable},
     resource_container::ResourceError,
     ToByteType,
     UtxoOutput,
 };
-use tari_ootle_common_types::substate_type::SubstateType;
+use tari_ootle_common_types::{crypto::create_key_pair_from_seed, substate_type::SubstateType};
 use tari_template_lib::{
-    models::{ComponentAddress, ResourceAddress, UtxoAddress, UtxoId},
-    prelude::{PedersenCommitmentBytes, SchnorrSignatureBytes},
+    auth::AccessRule,
+    models::{ComponentAddress, ResourceAddress, SpendCondition, UtxoAddress, UtxoId},
+    prelude::PedersenCommitmentBytes,
+    rule,
 };
 use tari_template_test_tooling::{
     support::{
-        assert_error::assert_reject_reason,
+        assert_error::{assert_access_denied_for_action, assert_reject_reason},
         stealth,
-        stealth::StealthUnblindedTransferData,
+        stealth::{StealthSecretTransferData, NO_INPUTS},
         GenerateValueLookup,
     },
     wallet_crypto::MaskAndValue,
@@ -39,7 +37,7 @@ const TEMPLATE_NAME: &str = "StealthFaucet";
 
 fn setup(
     test: &mut TemplateTest,
-    transfer_data: &StealthUnblindedTransferData,
+    transfer_data: &StealthSecretTransferData,
     view_key: Option<&RistrettoPublicKey>,
 ) -> (ComponentAddress, ResourceAddress) {
     test.enable_auto_add_proofs_from_signers();
@@ -69,7 +67,7 @@ fn setup(
 fn mint_initial_supply() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = vec![100, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
 
     let resource = test.read_only_state_store().get_resource(&faucet_resx).unwrap();
@@ -80,7 +78,7 @@ fn mint_initial_supply() {
 #[test]
 fn mint_more_later() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
-    let mint = stealth::generate_mint_statement([1200], 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement([1200], 0, None);
     let (faucet, faucet_resx) = setup(&mut test, &mint, None);
 
     test.call_method::<()>(faucet, "mint", call_args![11100], vec![]);
@@ -94,22 +92,22 @@ fn mint_more_later() {
 fn basic_transfer() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = vec![100, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
 
     let transfer = stealth::generate_transfer_data(
-        &[MaskAndValue {
+        [MaskAndValue {
             mask: mint.output_masks[0].clone(),
             value: 100,
         }],
         0,
         Some(100),
         0,
-        test.to_public_key_bytes(),
     );
     let result = test.execute_expect_success(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer.statement)
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -127,7 +125,7 @@ fn basic_transfer() {
 fn programmatic_transfer() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = vec![100, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs, 100, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 100, None);
     let (faucet, _faucet_resx) = setup(&mut test, &mint, None);
 
     let vault_id = test
@@ -136,18 +134,18 @@ fn programmatic_transfer() {
         .unwrap();
 
     let transfer = stealth::generate_transfer_data(
-        &[MaskAndValue {
+        [MaskAndValue {
             mask: mint.output_masks[0].clone(),
             value: 100,
         }],
         0,
         Some(75),
         25,
-        test.to_public_key_bytes(),
     );
     let result = test.execute_expect_success(
         Transaction::builder()
             .call_method(faucet, "programmatic_transfer", args![transfer.statement])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -167,25 +165,25 @@ fn programmatic_transfer() {
 fn transfer_with_revealed_outputs() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = [100, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
     let (account, _proof, _sk) = test.create_empty_account();
 
     let transfer = stealth::generate_transfer_data(
-        &[MaskAndValue {
+        [MaskAndValue {
             mask: mint.output_masks[1].clone(),
             value: 1000,
         }],
         0,
         [100, 200],
         700,
-        test.to_public_key_bytes(),
     );
     let result = test.execute_expect_success(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer.statement)
             .put_last_instruction_output_on_workspace("bucket")
             .call_method(account, "deposit", args![Workspace("bucket")])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[1])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -209,11 +207,11 @@ fn transfer_revealed_between_accounts() {
     let (bob, _proof, _sk) = test.create_empty_account();
 
     let outputs = [100, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
 
     let transfer_from_faucet = stealth::generate_transfer_data(
-        &[
+        [
             MaskAndValue {
                 mask: mint.output_masks[2].clone(),
                 value: 10000,
@@ -226,20 +224,22 @@ fn transfer_revealed_between_accounts() {
         0,
         [999, 9901],
         100,
-        alice_proof.to_public_key().unwrap(),
     );
-    let transfer_from_alice_to_bob =
-        stealth::generate_transfer_data(&[], 100, [25, 25, 25], 25, alice_proof.to_public_key().unwrap());
+    let transfer_from_alice_to_bob = stealth::generate_transfer_data(NO_INPUTS, 100, [25, 25, 25], 25);
     let result = test.execute_expect_success(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer_from_faucet.statement)
-            .put_last_instruction_output_on_workspace("bucket")
-            .call_method(alice, "deposit", args![Workspace("bucket")])
+            .put_last_instruction_output_on_workspace("withdrawn_funds_from_stealth_transfer")
+            .call_method(alice, "deposit", args![Workspace(
+                "withdrawn_funds_from_stealth_transfer"
+            )])
             .call_method(alice, "withdraw", args![faucet_resx, 100])
             .put_last_instruction_output_on_workspace("alice_to_bob")
             .stealth_transfer_with_input_bucket(faucet_resx, transfer_from_alice_to_bob.statement, "alice_to_bob")
             .put_last_instruction_output_on_workspace("transfer_to_bob")
             .call_method(bob, "deposit", args![Workspace("transfer_to_bob")])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[1])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[2])
             .build_and_seal(&alice_sk),
         vec![alice_proof],
     );
@@ -263,12 +263,12 @@ fn transfer_revealed_between_accounts() {
 fn transfer_invalid_balance_in_statement() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = [100, 1000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
     let (alice, _proof, _sk) = test.create_empty_account();
 
     let transfer_from_faucet = stealth::generate_transfer_data(
-        &[MaskAndValue {
+        [MaskAndValue {
             mask: mint.output_masks[0].clone(),
             value: 100,
         }],
@@ -276,13 +276,13 @@ fn transfer_invalid_balance_in_statement() {
         [99],
         // Try to skim a little (1) off the top
         2,
-        test.to_public_key_bytes(),
     );
     let reason = test.execute_expect_failure(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer_from_faucet.statement)
             .put_last_instruction_output_on_workspace("bucket")
             .call_method(alice, "deposit", args![Workspace("bucket")])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -293,39 +293,33 @@ fn transfer_invalid_balance_in_statement() {
 }
 
 #[test]
-fn transfer_invalid_ownership_proof() {
+fn transfer_fails_if_transaction_is_not_signed_by_utxo_owner() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = [100, 1000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
 
-    let mut transfer_from_faucet = stealth::generate_transfer_data(
-        &[MaskAndValue {
-            mask: mint.output_masks[0].clone(),
-            value: 100,
-        }],
-        0,
-        [99],
-        0,
-        test.to_public_key_bytes(),
-    );
-    // Set an invalid ownership proof
-    let sig = transfer_from_faucet.statement.inputs_statement.inputs[0].owner_proof;
-    let sig = SchnorrSignatureBytes::new(
-        RistrettoPublicKey::from_secret_key(&RistrettoSecretKey::random(&mut OsRng)).to_byte_type(),
-        *sig.signature(),
-    );
-    transfer_from_faucet.statement.inputs_statement.inputs[0].owner_proof = sig;
+    let input = MaskAndValue {
+        mask: mint.output_masks[0].clone(),
+        value: 100,
+    };
+    let commitment = input.to_commitment();
+    let transfer_from_faucet = stealth::generate_transfer_data([input], 0, [100], 0);
 
     let reason = test.execute_expect_failure(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer_from_faucet.statement)
+            // Missing signer
+            // .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
             .build_and_seal(test.secret_key()),
         vec![],
     );
 
-    assert_reject_reason(reason, ResourceError::InvalidSpend {
-        details: "Invalid ownership proof for input with commitment".to_string(),
+    let output_0_pk = RistrettoPublicKey::from_secret_key(&mint.output_masks[0]).to_byte_type();
+
+    assert_reject_reason(reason, ResourceError::RequiredSignatureMissingForStealthUtxo {
+        commitment: commitment.to_byte_type(),
+        public_key: output_0_pk,
     });
 }
 
@@ -333,19 +327,18 @@ fn transfer_invalid_ownership_proof() {
 fn transfer_invalid_range_proof_in_statement() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = [100, 1000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
     let (alice, _proof, _sk) = test.create_empty_account();
 
     let mut transfer_from_faucet = stealth::generate_transfer_data(
-        &[MaskAndValue {
+        [MaskAndValue {
             mask: mint.output_masks[0].clone(),
             value: 100,
         }],
         0,
         [99],
         1,
-        test.to_public_key_bytes(),
     );
     let mut rp = transfer_from_faucet
         .statement
@@ -361,12 +354,12 @@ fn transfer_invalid_range_proof_in_statement() {
             .stealth_transfer(faucet_resx, transfer_from_faucet.statement)
             .put_last_instruction_output_on_workspace("bucket")
             .call_method(alice, "deposit", args![Workspace("bucket")])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
             .build_and_seal(test.secret_key()),
         vec![],
     );
 
-    // The ownership proof fails to validate first due to output malleation so range proof isnt validated.
-    assert_reject_reason(reason, "Invalid ownership proof");
+    assert_reject_reason(reason, "Internal range proof(s) error");
 }
 
 #[test]
@@ -376,7 +369,7 @@ fn many_outputs_in_one_transfer() {
 
     use tari_engine_types::limits;
     let outputs = [1000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs, 0, None);
     let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
 
     let timer = Instant::now();
@@ -387,7 +380,7 @@ fn many_outputs_in_one_transfer() {
         "Balance proof will fail due to rounding. Adjust the test amount to be a multiple of the limit"
     );
     let transfer_from_faucet = stealth::generate_transfer_data(
-        &[MaskAndValue {
+        [MaskAndValue {
             mask: mint.output_masks[0].clone(),
             value: 1000,
         }],
@@ -397,19 +390,18 @@ fn many_outputs_in_one_transfer() {
             limits::STEALTH_LIMITS.max_outputs,
         ),
         0,
-        test.to_public_key_bytes(),
     );
 
-    // Release mode: ± 23s on M1 Mac, 3.7s on Ryzen 5950x (single thread, total test time 6.1s) for 500 outputs - actual
-    // limit is 8
-    // TODO: verification time (depending on hardware) of 2-10+ seconds is still a problem, determine what
-    // the upper bound for utxos should be. Parts of the verification could be parallelized (helps, assuming some
-    // minimum CPU spec for a VN). Note that generation in Debug mode took 16 minutes on Ryzen 5950x !
+    // Release mode: ± 23s on M1 Mac, 3.7s on Ryzen 5950x (single thread, total test time 6.1s) for 500 outputs. Current
+    // limit is 8 TODO: verification time (depending on hardware) of 2-10+ seconds is still a problem, determine
+    // what the upper bound for utxos should be. Parts of the verification could be parallelized (helps, assuming
+    // some minimum CPU spec for a VN). Note that generation in Debug mode took 16 minutes on Ryzen 5950x !
     eprintln!("Generated transfer in {:.2?}", timer.elapsed());
 
     let result = test.execute_expect_success(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer_from_faucet.statement)
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -452,11 +444,11 @@ where
 fn mint_with_view_key() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let (view_key_secret, view_key) = RistrettoPublicKey::random_keypair(&mut OsRng);
-    let mint = stealth::generate_mint_statement([1000], 0, Some(&view_key), test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement([1000], 0, Some(&view_key));
     let (_faucet, faucet_resx) = setup(&mut test, &mint, Some(&view_key));
 
     let withdraw_proof = stealth::generate_transfer_data_with_view_key(
-        &[MaskAndValue {
+        [MaskAndValue {
             mask: mint.output_masks[0].clone(),
             value: 1000,
         }],
@@ -464,11 +456,11 @@ fn mint_with_view_key() {
         [100, 200, 200, 200, 200, 100],
         0,
         &view_key,
-        test.to_public_key_bytes(),
     );
     let result = test.execute_expect_success(
         Transaction::builder()
             .stealth_transfer(faucet_resx, withdraw_proof.statement)
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -495,11 +487,11 @@ fn mint_with_view_key() {
 fn freeze_then_attempt_spend() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = vec![100u64, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs.clone(), 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs.clone(), 0, None);
     let (faucet, faucet_resx) = setup(&mut test, &mint, None);
 
     let transfer = stealth::generate_transfer_data(
-        &[
+        [
             MaskAndValue {
                 mask: mint.output_masks[0].clone(),
                 value: 100,
@@ -512,7 +504,6 @@ fn freeze_then_attempt_spend() {
         0,
         Some(1100),
         0,
-        test.to_public_key_bytes(),
     );
     let owner = test.owner_proof();
     let utxos = mint.output_masks
@@ -536,6 +527,8 @@ fn freeze_then_attempt_spend() {
     let reason = test.execute_expect_failure(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer.statement.clone())
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[1])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -553,6 +546,8 @@ fn freeze_then_attempt_spend() {
     let result = test.execute_expect_success(
         Transaction::builder()
             .stealth_transfer(faucet_resx, transfer.statement)
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[0])
+            .add_signer(&test.to_public_key_bytes(), &mint.output_masks[1])
             .build_and_seal(test.secret_key()),
         vec![],
     );
@@ -570,11 +565,11 @@ fn freeze_then_attempt_spend() {
 fn burn_then_attempt_spend() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
     let outputs = vec![100u64, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs.clone(), 0, None, test.to_public_key_bytes());
+    let mint = stealth::generate_mint_statement(outputs.clone(), 0, None);
     let (faucet, faucet_resx) = setup(&mut test, &mint, None);
 
     let transfer = stealth::generate_transfer_data(
-        &[
+        [
             MaskAndValue {
                 mask: mint.output_masks[0].clone(),
                 value: outputs[0],
@@ -587,7 +582,6 @@ fn burn_then_attempt_spend() {
         0,
         Some(outputs[0] + outputs[1]),
         0,
-        test.to_public_key_bytes(),
     );
     let owner = test.owner_proof();
     let utxos_and_proofs = mint.output_masks
@@ -628,44 +622,163 @@ fn burn_then_attempt_spend() {
 }
 
 #[test]
-fn transfer_fails_if_tx_signed_by_wrong_signer() {
+fn transfer_restricted_by_access_rules_n_of_m() {
     let mut test = TemplateTest::new(TEMPLATE_PATHS);
-    let (alice, alice_proof, _alice_sk) = test.create_empty_account();
+    let (_, pk1) = create_key_pair_from_seed(100);
+    let pk1 = pk1.to_byte_type();
+    let (sk2, pk2) = create_key_pair_from_seed(101);
+    let pk2 = pk2.to_byte_type();
+    let (sk3, pk3) = create_key_pair_from_seed(102);
+    let pk3 = pk3.to_byte_type();
+    let (sk4, pk4) = create_key_pair_from_seed(103);
+    let pk4 = pk4.to_byte_type();
+
+    // 3-of-4 multisig rule
+    let rule = rule!(m_of_n(
+        3,
+        public_key(pk1),
+        public_key(pk2),
+        public_key(pk3),
+        public_key(pk4)
+    ));
+    let outputs = vec![(100u64, SpendCondition::AccessRule(rule))];
+    let mint = stealth::generate_mint_statement(outputs.clone(), 0, None);
+    let (_, faucet_resx) = setup(&mut test, &mint, None);
 
-    let outputs = [100, 1000, 10000];
-    let mint = stealth::generate_mint_statement(outputs, 0, None, test.to_public_key_bytes());
-    let (_faucet, faucet_resx) = setup(&mut test, &mint, None);
+    let transfer = stealth::generate_transfer_data(
+        [MaskAndValue {
+            mask: mint.output_masks[0].clone(),
+            value: outputs[0].0,
+        }],
+        0,
+        [10u64, 90u64],
+        0,
+    );
+    let test_pk = test.to_public_key_bytes();
 
-    // Allows us to manually specify proofs rather than auto-adding from signers
-    test.disable_auto_add_proofs_from_signers();
+    // First try to spend with only 2 of the required 3 signatures
+    let reason = test.execute_expect_failure(
+        Transaction::builder()
+            .stealth_transfer(faucet_resx, transfer.statement.clone())
+            .with_authorized_seal_signer()
+            .finish()
+            .add_signer(&test_pk, &sk2)
+            .add_signer(&test_pk, &sk3)
+            .seal(test.secret_key()),
+        vec![],
+    );
 
-    let transfer_from_faucet = stealth::generate_transfer_data(
-        &[
+    assert_access_denied_for_action(reason, ActionIdent::Native(NativeAction::StealthUtxoSpend));
+
+    let result = test.execute_expect_success(
+        Transaction::builder()
+            .stealth_transfer(faucet_resx, transfer.statement)
+            .with_authorized_seal_signer()
+            .finish()
+            .add_signer(&test_pk, &sk2)
+            .add_signer(&test_pk, &sk3)
+            .add_signer(&test_pk, &sk4)
+            .seal(test.secret_key()),
+        vec![],
+    );
+
+    let diff = result.finalize.any_accept().unwrap();
+    let utxos = diff
+        .up_iter()
+        .filter_map(|(id, substate)| {
+            let addr = id.as_utxo_address()?;
+            let output = substate.substate_value().as_utxo().and_then(|u| u.output())?;
+            Some((addr, output))
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(utxos.len(), 2);
+}
+
+#[test]
+fn transfer_restricted_by_access_rules_component_scope() {
+    let mut test = TemplateTest::new(TEMPLATE_PATHS);
+
+    let outputs = vec![(100u64, SpendCondition::Signed(test.to_public_key_bytes()))];
+    let mint = stealth::generate_mint_statement(outputs.clone(), 0, None);
+    let (component, faucet_resx) = setup(&mut test, &mint, None);
+
+    let component_scope_rule = rule!(component(component));
+    let initial_transfer = stealth::generate_transfer_data(
+        [MaskAndValue {
+            mask: mint.output_masks[0].clone(),
+            value: outputs[0].0,
+        }],
+        0,
+        [
+            (10u64, SpendCondition::AccessRule(component_scope_rule.clone())),
+            (90u64, SpendCondition::AccessRule(component_scope_rule)),
+        ],
+        0,
+    );
+
+    // Create the new outputs with the component-bound spend condition
+    test.execute_expect_success(
+        Transaction::builder()
+            .stealth_transfer(faucet_resx, initial_transfer.statement.clone())
+            .with_authorized_seal_signer()
+            .finish()
+            .seal(test.secret_key()),
+        vec![],
+    );
+
+    let transfer = stealth::generate_transfer_data(
+        [
             MaskAndValue {
-                mask: mint.output_masks[2].clone(),
-                value: 10000,
+                mask: initial_transfer.output_masks[0].clone(),
+                value: 10,
             },
             MaskAndValue {
-                mask: mint.output_masks[1].clone(),
-                value: 1000,
+                mask: initial_transfer.output_masks[1].clone(),
+                value: 90,
             },
         ],
         0,
-        [],
-        11000,
-        // Require alice to sign
-        alice_proof.to_public_key().unwrap(),
+        [
+            // Anyone with the mask and value (i.e. view key) can spend!
+            (99u64, SpendCondition::AccessRule(AccessRule::AllowAll)),
+        ],
+        1, // programmatic transfer in this template requires a revealed output amount
     );
+
+    // First try to spend in a template context
     let reason = test.execute_expect_failure(
         Transaction::builder()
-            .stealth_transfer(faucet_resx, transfer_from_faucet.statement)
-            .put_last_instruction_output_on_workspace("bucket")
-            .call_method(alice, "deposit", args![Workspace("bucket")])
-            .build_and_seal(test.secret_key()), // Signed by test owner, not alice
-        vec![test.owner_proof()],
+            .call_function(
+                test.get_template_address(TEMPLATE_NAME),
+                "static_programmatic_transfer",
+                args![faucet_resx, transfer.statement.clone()],
+            )
+            .with_authorized_seal_signer()
+            .finish()
+            .seal(test.secret_key()),
+        vec![],
     );
 
-    assert_reject_reason(reason, RuntimeError::AccessDeniedStealthTransferSigner {
-        required_signer: alice_proof.to_public_key().unwrap(),
-    });
+    assert_access_denied_for_action(reason, ActionIdent::Native(NativeAction::StealthUtxoSpend));
+
+    // Then, spend in the component context, which succeeds
+    let result = test.execute_expect_success(
+        Transaction::builder()
+            .call_method(component, "programmatic_transfer", args![transfer.statement])
+            .with_authorized_seal_signer()
+            .finish()
+            .seal(test.secret_key()),
+        vec![],
+    );
+
+    let diff = result.finalize.any_accept().unwrap();
+    let utxos = diff
+        .up_iter()
+        .filter_map(|(id, substate)| {
+            let addr = id.as_utxo_address()?;
+            let output = substate.substate_value().as_utxo().and_then(|u| u.output())?;
+            Some((addr, output))
+        })
+        .collect::<Vec<_>>();
+    assert_eq!(utxos.len(), 1);
 }
diff --git a/crates/engine/tests/tariswap.rs b/crates/engine/tests/tariswap.rs
index b535d82402..d1a282181d 100644
--- a/crates/engine/tests/tariswap.rs
+++ b/crates/engine/tests/tariswap.rs
@@ -5,7 +5,7 @@ use tari_ootle_common_types::substate_type::SubstateType;
 use tari_template_lib::{
     models::ComponentAddress,
     prelude::{NonFungibleAddress, ResourceAddress},
-    types::Amount,
+    types::{Amount, FunctionName},
 };
 use tari_template_test_tooling::TemplateTest;
 use tari_transaction::{args, call_args, Instruction, Transaction};
@@ -74,7 +74,7 @@ fn create_tariswap_component(
         .execute_and_commit(
             vec![Instruction::CallFunction {
                 address: tariswap_template,
-                function: "new".to_string(),
+                function: FunctionName::new_checked("new").unwrap(),
                 args: call_args![a_resource, b_resource, fee],
             }],
             vec![],
diff --git a/crates/engine/tests/templates/stealth/src/lib.rs b/crates/engine/tests/templates/stealth/src/lib.rs
index aec6dd581c..572f3d4f55 100644
--- a/crates/engine/tests/templates/stealth/src/lib.rs
+++ b/crates/engine/tests/templates/stealth/src/lib.rs
@@ -68,6 +68,11 @@ mod template {
             self.supply_vault.deposit(bucket);
         }
 
+        pub fn static_programmatic_transfer(resource: ResourceAddress, transfer: StealthTransferStatement) {
+            let manager = ResourceManager::get(resource);
+            manager.stealth_transfer(transfer);
+        }
+
         pub fn mint(&self, amount: Amount) {
             let bucket = self.manager.mint_stealth(amount);
             self.supply_vault.deposit(bucket);
diff --git a/crates/engine/tests/test.rs b/crates/engine/tests/test.rs
index f90024d510..9f557c7cf2 100644
--- a/crates/engine/tests/test.rs
+++ b/crates/engine/tests/test.rs
@@ -364,7 +364,7 @@ mod errors {
                 vec![],
                 vec![Instruction::CallFunction {
                     address: template_test.get_template_address("Errors"),
-                    function: "panic".to_string(),
+                    function: "panic".try_into().unwrap(),
                     args: args![],
                 }],
                 vec![],
@@ -391,7 +391,7 @@ mod errors {
                 vec![],
                 vec![Instruction::CallFunction {
                     address: template_test.get_template_address("Errors"),
-                    function: "please_pass_invalid_args".to_string(),
+                    function: "please_pass_invalid_args".try_into().unwrap(),
                     args: call_args![text],
                 }],
                 vec![],
@@ -450,7 +450,7 @@ mod fungible {
             .execute_and_commit(
                 vec![Instruction::CallFunction {
                     address: faucet_template,
-                    function: "mint".to_string(),
+                    function: "mint".try_into().unwrap(),
                     args: call_args![initial_supply],
                 }],
                 vec![],
diff --git a/crates/engine_types/src/crypto/messages.rs b/crates/engine_types/src/crypto/messages.rs
index 3a9145c580..061eb74616 100644
--- a/crates/engine_types/src/crypto/messages.rs
+++ b/crates/engine_types/src/crypto/messages.rs
@@ -4,7 +4,7 @@
 use tari_crypto::ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey};
 use tari_template_lib::{
     models::{StealthInputsStatement, StealthOutputsStatement, ViewableBalanceProofChallengeFields},
-    prelude::{PedersenCommitmentBytes, RistrettoPublicKeyBytes},
+    prelude::PedersenCommitmentBytes,
     types::Amount,
 };
 
@@ -56,28 +56,6 @@ pub fn stealth_balance_proof64(
         .into()
 }
 
-pub fn stealth_ownership64(
-    commitment: &PedersenCommitmentBytes,
-    public_output_nonce: &RistrettoPublicKeyBytes,
-    required_signer: &RistrettoPublicKeyBytes,
-    metadata_hash: &Hash64,
-) -> Hash64 {
-    engine_hasher64(EngineHashDomainLabel::StealthOwnership)
-        .chain(commitment)
-        .chain(public_output_nonce)
-        .chain(required_signer)
-        .chain(metadata_hash)
-        .result()
-        .into()
-}
-
-pub fn stealth_statement_metadata64(outputs_statement: &StealthOutputsStatement) -> Hash64 {
-    engine_hasher64(EngineHashDomainLabel::StealthOwnership)
-        .chain(outputs_statement)
-        .result()
-        .into()
-}
-
 pub fn value_proof_message(commitment: &PedersenCommitmentBytes, value: &Amount) -> Hash64 {
     engine_hasher64(EngineHashDomainLabel::ValueProof)
         .chain(commitment)
diff --git a/crates/engine_types/src/hashing.rs b/crates/engine_types/src/hashing.rs
index 3585abd49c..3e4fd767b1 100644
--- a/crates/engine_types/src/hashing.rs
+++ b/crates/engine_types/src/hashing.rs
@@ -124,7 +124,6 @@ pub enum EngineHashDomainLabel {
     ViewableBalanceProof,
     UtxoAddress,
     StealthBalanceProof,
-    StealthOwnership,
     ValueProof,
 }
 
@@ -149,7 +148,6 @@ impl EngineHashDomainLabel {
             Self::ViewableBalanceProof => "ViewableBalanceProof",
             Self::UtxoAddress => "UtxoAddress",
             Self::StealthBalanceProof => "StealthBalanceProof",
-            Self::StealthOwnership => "StealthOwnership",
             Self::ValueProof => "ValueProof",
         }
     }
diff --git a/crates/engine_types/src/resource_container.rs b/crates/engine_types/src/resource_container.rs
index f1dea5c78e..178e06e20c 100644
--- a/crates/engine_types/src/resource_container.rs
+++ b/crates/engine_types/src/resource_container.rs
@@ -18,6 +18,7 @@ use tari_template_lib::{
         ResourceAddress,
         UtxoId,
     },
+    prelude::RistrettoPublicKeyBytes,
     types::{crypto::PedersenCommitmentBytes, Amount, ResourceType},
 };
 
@@ -903,6 +904,14 @@ pub enum ResourceError {
     InvalidConfidentialMintWithChange,
     #[error("Invalid spend: {details}")]
     InvalidSpend { details: String },
+    #[error(
+        "The transaction signature with public key {public_key} required to spend the input with commitment \
+         {commitment} was not provided or is not in scope"
+    )]
+    RequiredSignatureMissingForStealthUtxo {
+        commitment: PedersenCommitmentBytes,
+        public_key: RistrettoPublicKeyBytes,
+    },
     #[error("UTXO {id} failed to burn: {details}")]
     UtxoBurnFailed { id: UtxoId, details: String },
 }
diff --git a/crates/engine_types/src/stealth/outputs.rs b/crates/engine_types/src/stealth/outputs.rs
index 9b8218e955..b7e78d2224 100644
--- a/crates/engine_types/src/stealth/outputs.rs
+++ b/crates/engine_types/src/stealth/outputs.rs
@@ -2,27 +2,29 @@
 //   SPDX-License-Identifier: BSD-3-Clause
 
 use tari_crypto::ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey};
-use tari_template_lib::{models::StealthOutputsStatement, types::crypto::UtxoTag};
+use tari_template_lib::{
+    models::{SpendCondition, StealthOutputsStatement},
+    types::crypto::UtxoTag,
+};
 
 use crate::{
     crypto::{range_proof::validate_bullet_proof, validate_elgamal_verifiable_balance_proof, ValidatedPrivateOutput},
     resource_container::ResourceError,
     ConvertFromByteType,
-    ToByteType,
     UtxoOutput,
 };
 
 #[derive(Debug, Clone)]
 pub struct ValidatedStealthOutput {
     pub output: ValidatedPrivateOutput,
-    pub owner_public_key: RistrettoPublicKey,
+    pub spend_condition: SpendCondition,
     pub tag: UtxoTag,
 }
 
 impl ValidatedStealthOutput {
     pub fn to_utxo_output(&self) -> UtxoOutput {
         UtxoOutput {
-            owner_public_key: self.owner_public_key.to_byte_type(),
+            spend_condition: self.spend_condition.clone(),
             output: self.output.to_private_output(),
             tag: self.tag,
         }
@@ -71,11 +73,7 @@ pub fn validate_stealth_outputs_statement(
 
                 Ok(ValidatedStealthOutput {
                     output,
-                    owner_public_key: RistrettoPublicKey::convert_from_byte_type(&statement.owner_public_key).map_err(
-                        |_| ResourceError::InvalidConfidentialProof {
-                            details: "Invalid owner public key".to_string(),
-                        },
-                    )?,
+                    spend_condition: statement.spend_condition.clone(),
                     tag: statement.tag,
                 })
             })
diff --git a/crates/engine_types/src/stealth/transfer.rs b/crates/engine_types/src/stealth/transfer.rs
index 2e06919dfb..f6d15ec1a7 100644
--- a/crates/engine_types/src/stealth/transfer.rs
+++ b/crates/engine_types/src/stealth/transfer.rs
@@ -6,11 +6,7 @@ use tari_crypto::{
     ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey, RistrettoSecretKey},
     tari_utilities::ByteArrayError,
 };
-use tari_template_lib::{
-    models::{StealthInput, StealthTransferStatement},
-    prelude::RistrettoPublicKeyBytes,
-    types::Amount,
-};
+use tari_template_lib::{models::StealthTransferStatement, types::Amount};
 
 use crate::{
     crypto::{commit_amount_checked, messages, try_decode_to_signature},
@@ -18,8 +14,6 @@ use crate::{
     stealth,
     stealth::ValidatedStealthOutput,
     ConvertFromByteType,
-    Hash64,
-    UtxoOutput,
 };
 
 const LOG_TARGET: &str = "tari::engine_types::stealth::transfer";
@@ -142,43 +136,6 @@ pub fn validate_transfer_balance(
     })
 }
 
-pub fn validate_ownership_proof(
-    utxo: &UtxoOutput,
-    input: &StealthInput,
-    required_signer: &RistrettoPublicKeyBytes,
-    metadata_hash: &Hash64,
-) -> Result<(), ResourceError> {
-    if input.owner_proof.public_nonce().is_zero() {
-        return Err(ResourceError::InvalidSpend {
-            details: "Ownership proof public nonce cannot be zero".to_string(),
-        });
-    }
-
-    let owner_proof = try_decode_to_signature(&input.owner_proof).ok_or_else(|| ResourceError::InvalidSpend {
-        details: "Malformed ownership proof".to_string(),
-    })?;
-
-    let signer_pk = RistrettoPublicKey::convert_from_byte_type(&utxo.owner_public_key).map_err(|_| {
-        ResourceError::InvalidSpend {
-            details: "Non-canonical compressed owner public key".to_string(),
-        }
-    })?;
-
-    let message = messages::stealth_ownership64(
-        &input.commitment,
-        &utxo.output.public_nonce,
-        required_signer,
-        metadata_hash,
-    );
-    if !owner_proof.verify(&signer_pk, message) {
-        return Err(ResourceError::InvalidSpend {
-            details: format!("Invalid ownership proof for input with commitment {}", input.commitment),
-        });
-    }
-
-    Ok(())
-}
-
 fn basic_validations(transfer: &StealthTransferStatement) -> Result<(), ResourceError> {
     if transfer.inputs_statement.revealed_amount.is_negative() {
         return Err(ResourceError::InvalidBalanceProof {
diff --git a/crates/engine_types/src/utxo.rs b/crates/engine_types/src/utxo.rs
index 43537cfeff..9239f3c3fa 100644
--- a/crates/engine_types/src/utxo.rs
+++ b/crates/engine_types/src/utxo.rs
@@ -2,7 +2,10 @@
 //    SPDX-License-Identifier: BSD-3-Clause
 
 use tari_bor::{Deserialize, Serialize};
-use tari_template_lib::types::crypto::{RistrettoPublicKeyBytes, UtxoTag};
+use tari_template_lib::{
+    models::SpendCondition,
+    types::crypto::{RistrettoPublicKeyBytes, UtxoTag},
+};
 
 use crate::crypto::PrivateOutput;
 
@@ -17,9 +20,7 @@ pub struct Utxo {
 #[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
 pub struct UtxoOutput {
     pub output: PrivateOutput,
-    /// The public key that must prove ownership of this UTXO. This is typically a one time "stealth" public key but is
-    /// selected by the client.
-    pub owner_public_key: RistrettoPublicKeyBytes,
+    pub spend_condition: SpendCondition,
     pub tag: UtxoTag,
 }
 
@@ -39,8 +40,8 @@ impl Utxo {
         self.output
     }
 
-    pub fn owner_public_key(&self) -> Option<&RistrettoPublicKeyBytes> {
-        self.output().map(|o| &o.owner_public_key)
+    pub fn spender_public_key(&self) -> Option<&RistrettoPublicKeyBytes> {
+        self.output().and_then(|o| o.spend_condition.signed_by())
     }
 
     pub fn freeze(&mut self) {
diff --git a/crates/p2p/proto/common.proto b/crates/p2p/proto/common.proto
index 9c0742558a..3e5653749e 100644
--- a/crates/p2p/proto/common.proto
+++ b/crates/p2p/proto/common.proto
@@ -39,3 +39,12 @@ message CommitmentSignature {
   bytes signature_v = 3;
 }
 
+
+message SubstateRequirement {
+  bytes substate_id = 1;
+  OptionalVersion version = 2;
+}
+
+message OptionalVersion {
+  uint32 version = 1;
+}
diff --git a/crates/p2p/proto/rpc.proto b/crates/p2p/proto/rpc.proto
index cdb6017612..0833ce1922 100644
--- a/crates/p2p/proto/rpc.proto
+++ b/crates/p2p/proto/rpc.proto
@@ -90,7 +90,7 @@ message GetPeersResponse {
 }
 
 message GetSubstateRequest {
-  tari.ootle.transaction.SubstateRequirement substate_requirement = 1;
+  tari.ootle.common.SubstateRequirement substate_requirement = 1;
 }
 
 message GetSubstateResponse {
diff --git a/crates/p2p/proto/transaction.proto b/crates/p2p/proto/transaction.proto
index 090b49d6ba..5aa7f00b29 100644
--- a/crates/p2p/proto/transaction.proto
+++ b/crates/p2p/proto/transaction.proto
@@ -5,246 +5,10 @@ syntax = "proto3";
 
 package tari.ootle.transaction;
 
-import "common.proto";
-
 message NewTransactionMessage {
   Transaction transaction = 1;
 }
 
 message Transaction {
   bytes bor_encoded = 1;
-}
-
-enum AllocatableAddressType {
-  NONE = 0;
-  COMPONENT = 1;
-  RESOURCE = 2;
-}
-
-message Instruction {
-  oneof instruction {
-    CallFunction call_function = 1;
-    CallMethod call_method = 2;
-    uint32 put_last_instruction_output_on_workspace = 3;
-    EmitLog emit_log = 4;
-    ClaimBurn claim_burn = 5;
-    ClaimValidatorFees claim_validator_fees = 6;
-    bool drop_all_proofs_in_workspace = 7;
-    CreateAccount create_account = 8;
-    AssertBucketContains assert_bucket_contains = 9;
-    TakeFromBucket take_from_bucket = 10;
-    PublishTemplate publish_template = 11;
-    AllocateAddress allocate_address = 12;
-    StealthTransfer stealth_transfer = 13;
-    PayFee pay_fee = 14;
-  }
-}
-
-message CallFunction {
-  bytes template_address = 1;
-  string function = 2;
-  repeated Arg args = 3;
-}
-
-message CallMethod {
-  ComponentCall component_call = 1;
-  string method = 2;
-  repeated Arg args = 3;
-}
-
-message ClaimBurn {
-  bytes commitment = 1;
-  uint64 value = 2;
-  tari.ootle.common.Signature proof_of_knowledge = 3;
-  bytes public_key = 4;
-  EncodedMerkleProof encoded_merkle_proof = 5;
-  bytes encrypted_data = 6;
-  AbridgedKernel kernel = 7;
-}
-
-message TakeFromBucket {
-  WorkspaceOffsetId input_bucket = 1;
-  tari.ootle.common.Amount amount = 2;
-  uint32 output_bucket = 3;
-}
-
-message AbridgedKernel {
-  uint32 version = 1;
-  uint64 fee = 2;
-  uint64 lock_height = 3;
-  bytes excess = 4;
-  tari.ootle.common.Signature excess_sig = 5;
-}
-
-message EmitLog {
-  string log_level = 1;
-  string log_message = 2;
-}
-
-message ClaimValidatorFees {
-  bytes fee_pool_address = 1;
-}
-
-message CreateAccount {
-  bytes public_key = 1;
-  OwnerRule owner_rule = 2;
-  AccessRules access_rules = 3;
-  WorkspaceOffsetId workspace_id = 4;
-}
-
-message AssertBucketContains {
-  WorkspaceOffsetId bucket = 1;
-  bytes resource_address = 2;
-  tari.ootle.common.Amount min_amount = 3;
-}
-
-message PublishTemplate {
-  bytes binary = 1;
-}
-
-message AllocateAddress {
-  AllocatableAddressType address_type = 1;
-  uint32 workspace_id = 2;
-}
-
-message StealthTransfer {
-  ResourceAddressRef resource_address = 1;
-  StealthTransferStatement statement = 2;
-  WorkspaceOffsetId revealed_input_bucket = 3;
-}
-
-message PayFee {
-  StealthTransferStatement statement = 1;
-  WorkspaceOffsetId revealed_input_bucket = 2;
-}
-
-message ComponentCall {
-  oneof call {
-    bytes address = 1;
-    uint32 allocation = 2;
-  }
-}
-
-message ResourceAddressRef {
-  oneof inner {
-    bytes address = 1;
-    WorkspaceOffsetId workspace = 2;
-  }
-}
-
-message Arg {
-  oneof arg_value {
-    bytes literal = 1;
-    WorkspaceOffsetId workspace = 2;
-  }
-}
-
-message OptionWorkspaceId {
-  uint32 workspace_id = 1;
-}
-
-message WorkspaceOffsetId {
-  uint32 id = 1;
-  OptionOffset offset = 2;
-}
-
-message OptionOffset {
-  uint64 offset = 1;
-}
-
-message SubstateRequirement {
-  bytes substate_id = 1;
-  OptionalVersion version = 2;
-}
-
-message OptionalVersion {
-  uint32 version = 1;
-}
-
-message VersionedSubstateId {
-  bytes substate_id = 1;
-  uint32 version = 2;
-}
-
-message ConfidentialWithdrawProof {
-  repeated bytes inputs = 1;
-  tari.ootle.common.Amount input_revealed_amount = 2;
-  ConfidentialOutputStatement output_proof = 3;
-  bytes balance_proof = 4;
-}
-
-message ConfidentialOutputStatement {
-  UnspentOutput output_statement = 1;
-  UnspentOutput change_statement = 2;
-  bytes range_proof = 3;
-  tari.ootle.common.Amount output_revealed_amount = 4;
-  tari.ootle.common.Amount change_revealed_amount = 5;
-}
-
-message UnspentOutput {
-  bytes commitment = 1;
-  bytes sender_public_nonce = 2;
-  bytes encrypted_data = 3;
-  uint64 minimum_value_promise = 4;
-  ViewableBalanceProof viewable_balance_proof = 5;
-}
-
-message ViewableBalanceProof {
-  bytes elgamal_encrypted = 1;
-  bytes elgamal_public_nonce = 2;
-  bytes c_prime = 3;
-  bytes e_prime = 4;
-  bytes r_prime = 5;
-  bytes s_v = 6;
-  bytes s_m = 7;
-  bytes s_r = 8;
-}
-
-message OwnerRule {
-  bytes encoded_owner_rule = 1;
-}
-
-message AccessRules {
-  bytes encoded_access_rules = 1;
-}
-
-message StealthTransferStatement {
-  StealthInputsStatement inputs_statement = 1;
-  StealthOutputsStatement outputs_statement = 2;
-  bytes balance_proof = 3;
-}
-
-message StealthOutputsStatement {
-  /// Proof of the confidential resources that are going to be transferred to the receiver
-  repeated StealthUnspentOutput outputs = 1;
-  /// The amount of revealed funds to output. If this is a positive (non-zero) value, a bucket containing the
-  /// revealed stealth funds is created.
-  tari.ootle.common.Amount revealed_output_amount = 2;
-  /// Bulletproof range proof for the output commitments proving that values are in the range
-  /// [minimum_value_promise, 2^64)
-  bytes agg_range_proof = 3;
-}
-
-message StealthUnspentOutput {
-  UnspentOutput output = 1;
-  bytes owner_public_key = 2;
-  uint32 tag_byte = 3;
-}
-
-message StealthInput {
-  bytes commitment = 1;
-  tari.ootle.common.Signature owner_proof = 2;
-}
-
-message StealthInputsStatement {
-  repeated StealthInput inputs = 1;
-  tari.ootle.common.Amount revealed_amount = 2;
-  bytes required_signer = 3;
-}
-
-
-message EncodedMerkleProof {
-  bytes block_hash = 1;
-  bytes encoded_proof = 2;
-  uint64 leaf_index = 3;
 }
\ No newline at end of file
diff --git a/crates/p2p/src/conversions/common.rs b/crates/p2p/src/conversions/common.rs
index 4a5f71ae66..a3edaf86dd 100644
--- a/crates/p2p/src/conversions/common.rs
+++ b/crates/p2p/src/conversions/common.rs
@@ -25,7 +25,8 @@ use std::convert::{TryFrom, TryInto};
 use anyhow::Context;
 use tari_consensus_types::ValidatorSignatureBytes;
 use tari_crypto::tari_utilities::ByteArray;
-use tari_ootle_common_types::{Epoch, SubstateAddress};
+use tari_engine_types::substate::SubstateId;
+use tari_ootle_common_types::{Epoch, SubstateAddress, SubstateRequirement, SubstateRequirementRef};
 use tari_template_lib::{
     prelude::{
         crypto::CommitmentSignatureBytes,
@@ -38,7 +39,7 @@ use tari_template_lib::{
 };
 use tari_transaction::TransactionSignature;
 
-use crate::proto;
+use crate::{proto, proto::common::OptionalVersion};
 
 //---------------------------------- Signature --------------------------------------------//
 impl TryFrom<proto::common::Signature> for SchnorrSignatureBytes {
@@ -204,3 +205,39 @@ impl From<CommitmentSignatureBytes> for proto::common::CommitmentSignature {
         }
     }
 }
+
+// -------------------------------- SubstateRequirement -------------------------------- //
+
+impl TryFrom<proto::common::SubstateRequirement> for SubstateRequirement {
+    type Error = anyhow::Error;
+
+    fn try_from(val: proto::common::SubstateRequirement) -> Result<Self, Self::Error> {
+        let substate_id = SubstateId::from_bytes(&val.substate_id)?;
+        let version = val.version.map(|v| v.version);
+        let substate_specification = SubstateRequirement::new(substate_id, version);
+        Ok(substate_specification)
+    }
+}
+
+impl From<SubstateRequirement> for proto::common::SubstateRequirement {
+    fn from(val: SubstateRequirement) -> Self {
+        (&val).into()
+    }
+}
+
+impl From<&SubstateRequirement> for proto::common::SubstateRequirement {
+    fn from(val: &SubstateRequirement) -> Self {
+        Self {
+            substate_id: val.substate_id().to_bytes(),
+            version: val.version().map(|v| OptionalVersion { version: v }),
+        }
+    }
+}
+impl From<SubstateRequirementRef<'_>> for proto::common::SubstateRequirement {
+    fn from(val: SubstateRequirementRef<'_>) -> Self {
+        Self {
+            substate_id: val.substate_id().to_bytes(),
+            version: val.version().map(|v| OptionalVersion { version: v }),
+        }
+    }
+}
diff --git a/crates/p2p/src/conversions/transaction.rs b/crates/p2p/src/conversions/transaction.rs
index 985963547c..05b9ccb6dd 100644
--- a/crates/p2p/src/conversions/transaction.rs
+++ b/crates/p2p/src/conversions/transaction.rs
@@ -20,51 +20,18 @@
 //  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
 //  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-use std::{
-    convert::{TryFrom, TryInto},
-    num::TryFromIntError,
-};
+use std::convert::{TryFrom, TryInto};
 
-use anyhow::{anyhow, Context};
-use tari_engine_types::{
-    confidential::{AbridgedTransactionKernel, ClaimBurnOutputData, EncodedMerkleProof, MinotariBurnClaimProof},
-    substate::SubstateId,
-};
-use tari_ootle_common_types::{SubstateRequirement, SubstateRequirementRef, VersionedSubstateId};
-use tari_template_lib::{
-    auth::OwnerRule,
-    models::{
-        ComponentAddress,
-        ConfidentialOutputStatement,
-        ConfidentialWithdrawProof,
-        StealthInput,
-        UnspentOutput,
-        ViewableBalanceProof,
-    },
-    prelude::AccessRules,
-    types::{
-        crypto::{BalanceProofSignature, PedersenCommitmentBytes, RangeProofBytes, RistrettoPublicKeyBytes, UtxoTag},
-        EncryptedData,
-        ObjectKey,
-    },
-};
-use tari_transaction::{
-    args::{InstructionArg, WorkspaceId, WorkspaceOffsetId},
-    AllocatableAddressType,
-    ComponentCall,
-    Instruction,
-    ResourceAddressRef,
-    Transaction,
-};
+use anyhow::anyhow;
+use tari_transaction::Transaction;
 
 use crate::{
     encoding::{decode_from_slice, encode_to_vec},
-    proto::{self, transaction::OptionalVersion},
-    utils::checked_copy_fixed,
+    proto::{self},
     NewTransactionMessage,
 };
-// -------------------------------- NewTransactionMessage -------------------------------- //
 
+// -------------------------------- NewTransactionMessage -------------------------------- //
 impl From<NewTransactionMessage> for proto::transaction::NewTransactionMessage {
     fn from(msg: NewTransactionMessage) -> Self {
         Self {
@@ -103,947 +70,3 @@ impl From<&Transaction> for proto::transaction::Transaction {
         }
     }
 }
-
-// -------------------------------- AllocatableAddressType -------------------------------- //
-
-impl TryFrom<proto::transaction::AllocatableAddressType> for AllocatableAddressType {
-    type Error = anyhow::Error;
-
-    fn try_from(substate_type: proto::transaction::AllocatableAddressType) -> Result<Self, Self::Error> {
-        match substate_type {
-            proto::transaction::AllocatableAddressType::None => {
-                anyhow::bail!("AllocatableAddressType not provided");
-            },
-            proto::transaction::AllocatableAddressType::Component => Ok(AllocatableAddressType::Component),
-            proto::transaction::AllocatableAddressType::Resource => Ok(AllocatableAddressType::Resource),
-        }
-    }
-}
-
-impl From<AllocatableAddressType> for proto::transaction::AllocatableAddressType {
-    fn from(substate_type: AllocatableAddressType) -> Self {
-        match substate_type {
-            AllocatableAddressType::Component => proto::transaction::AllocatableAddressType::Component,
-            AllocatableAddressType::Resource => proto::transaction::AllocatableAddressType::Resource,
-        }
-    }
-}
-
-// -------------------------------- Instruction -------------------------------- //
-
-impl TryFrom<proto::transaction::Instruction> for Instruction {
-    type Error = anyhow::Error;
-
-    #[allow(clippy::too_many_lines)]
-    fn try_from(value: proto::transaction::Instruction) -> Result<Self, Self::Error> {
-        use proto::transaction::instruction::Instruction::*;
-        match value.instruction {
-            None => Err(anyhow!("instruction not provided")),
-            Some(CallFunction(call_function)) => Ok(Instruction::CallFunction {
-                address: call_function.template_address.try_into()?,
-                function: call_function.function,
-                args: call_function
-                    .args
-                    .into_iter()
-                    .map(|a| a.try_into())
-                    .collect::<Result<_, _>>()?,
-            }),
-            Some(CallMethod(call_method)) => Ok(Instruction::CallMethod {
-                call: call_method
-                    .component_call
-                    .ok_or_else(|| anyhow!("component_call not provided"))?
-                    .try_into()?,
-                method: call_method.method,
-                args: call_method
-                    .args
-                    .into_iter()
-                    .map(|a| a.try_into())
-                    .collect::<Result<_, _>>()?,
-            }),
-            Some(PutLastInstructionOutputOnWorkspace(id)) => Ok(Instruction::PutLastInstructionOutputOnWorkspace {
-                key: u16::try_from(id).context("workspace_put_key overflowed")?,
-            }),
-            Some(EmitLog(emit_log)) => Ok(Instruction::EmitLog {
-                level: emit_log.log_level.parse()?,
-                message: emit_log
-                    .log_message
-                    .try_into()
-                    .map_err(|e| anyhow!("emit_log_message: {}", e))?,
-            }),
-            Some(ClaimBurn(claim_burn)) => Ok(Instruction::ClaimBurn {
-                claim: Box::new(MinotariBurnClaimProof {
-                    burn_public_key: claim_burn
-                        .public_key
-                        .as_slice()
-                        .try_into()
-                        .map_err(|e| anyhow!("claim_burn_public_key: {}", e))?,
-                    commitment: claim_burn
-                        .commitment
-                        .as_slice()
-                        .try_into()
-                        .map_err(|e| anyhow!("claim_burn_commitment_address: {}", e))?,
-                    ownership_proof: claim_burn
-                        .proof_of_knowledge
-                        .ok_or_else(|| anyhow!("claim_burn_proof_of_knowledge not provided"))?
-                        .try_into()
-                        .map_err(|e| anyhow!("claim_burn_proof_of_knowledge: {}", e))?,
-                    encoded_merkle_proof: claim_burn
-                        .encoded_merkle_proof
-                        .ok_or_else(|| anyhow!("claim_burn_encoded_merkle_proof not provided"))?
-                        .try_into()?,
-                    kernel: claim_burn
-                        .kernel
-                        .ok_or_else(|| anyhow!("claim_burn_kernel not provided"))?
-                        .try_into()?,
-                    value: claim_burn.value,
-                }),
-                output_data: ClaimBurnOutputData {
-                    encrypted_data: EncryptedData::try_from(claim_burn.encrypted_data)
-                        .map_err(|len| anyhow!("Invalid length ({len}) of encrypted_value bytes"))?,
-                },
-            }),
-            Some(ClaimValidatorFees(claim_fees)) => Ok(Instruction::ClaimValidatorFees {
-                address: claim_fees
-                    .fee_pool_address
-                    .as_slice()
-                    .try_into()
-                    .map_err(|e| anyhow!("claim_validator_fees_address: {e}"))?,
-            }),
-            Some(DropAllProofsInWorkspace(_)) => Ok(Instruction::DropAllProofsInWorkspace),
-            Some(CreateAccount(create_account)) => Ok(Instruction::CreateAccount {
-                owner_public_key: RistrettoPublicKeyBytes::from_bytes(&create_account.public_key)
-                    .map_err(|e| anyhow!("create_account_public_key: {}", e))?,
-                owner_rule: create_account.owner_rule.map(TryInto::try_into).transpose()?,
-                access_rules: create_account.access_rules.map(TryInto::try_into).transpose()?,
-                workspace_id: create_account
-                    .workspace_id
-                    .map(|offset_id| {
-                        let offset = offset_id.offset.map(|o| usize::try_from(o.offset)).transpose()?;
-                        let id = WorkspaceId::try_from(offset_id.id)?;
-                        Ok::<_, TryFromIntError>(WorkspaceOffsetId::new(id).with_offset_opt(offset))
-                    })
-                    .transpose()
-                    .context("create_account_workspace_id overflowed")?,
-            }),
-            Some(AssertBucketContains(assert_contains)) => {
-                let resource_address = ObjectKey::try_from(assert_contains.resource_address)?.into();
-                Ok(Instruction::AssertBucketContains {
-                    key: assert_contains
-                        .bucket
-                        .ok_or_else(|| anyhow!("assert_bucket_workspace_id not provided"))?
-                        .try_into()?,
-                    resource_address,
-                    min_amount: assert_contains.min_amount.unwrap_or_default().into(),
-                })
-            },
-            Some(TakeFromBucket(take_from_bucket)) => Ok(Instruction::TakeFromBucket {
-                input_bucket: take_from_bucket
-                    .input_bucket
-                    .ok_or_else(|| anyhow!("take_from_bucket_input_bucket not provided"))?
-                    .try_into()?,
-                amount: take_from_bucket.amount.unwrap_or_default().into(),
-                output_bucket: u16::try_from(take_from_bucket.output_bucket)
-                    .context("take_from_bucket_output_bucket overflowed")?,
-            }),
-            Some(PublishTemplate(publish_template)) => Ok(Instruction::PublishTemplate {
-                binary: publish_template
-                    .binary
-                    .try_into()
-                    .map_err(|_| anyhow!("publish_template_binary: binary size too large"))?,
-            }),
-            Some(AllocateAddress(allocate_addr)) => {
-                let address_type = allocate_addr.address_type();
-                Ok(Instruction::AllocateAddress {
-                    allocatable_type: address_type
-                        .try_into()
-                        .map_err(|e| anyhow!("invalid allocatable_address_type {e}"))?,
-                    workspace_id: WorkspaceId::try_from(allocate_addr.workspace_id)
-                        .context("allocate_address_workspace_id overflowed")?,
-                })
-            },
-            Some(StealthTransfer(transfer)) => Ok(Instruction::StealthTransfer {
-                resource_address_ref: transfer
-                    .resource_address
-                    .map(TryInto::try_into)
-                    .transpose()?
-                    .ok_or_else(|| anyhow!("stealth_transfer_resource_address not provided"))?,
-                statement: transfer
-                    .statement
-                    .ok_or_else(|| anyhow!("stealth_transfer_statement not provided"))?
-                    .try_into()
-                    .context("stealth_transfer_statement conversion failed")?,
-                revealed_input_bucket: transfer.revealed_input_bucket.map(TryInto::try_into).transpose()?,
-            }),
-            Some(PayFee(pay_fee)) => Ok(Instruction::PayFee {
-                statement: pay_fee
-                    .statement
-                    .ok_or_else(|| anyhow!("pay_fee_stealth_transfer_statement not provided"))?
-                    .try_into()
-                    .context("pay_fee_stealth_transfer_statement conversion failed")?,
-                revealed_input_bucket: pay_fee.revealed_input_bucket.map(TryInto::try_into).transpose()?,
-            }),
-        }
-    }
-}
-
-impl From<Instruction> for proto::transaction::Instruction {
-    #[allow(clippy::too_many_lines)]
-    fn from(instruction: Instruction) -> Self {
-        match instruction {
-            Instruction::CreateAccount {
-                owner_public_key,
-                owner_rule,
-                access_rules,
-                workspace_id,
-            } => {
-                let owner_rule = owner_rule.map(Into::into);
-                let access_rules = access_rules.map(Into::into);
-                let workspace_id = workspace_id.map(Into::into);
-                proto::transaction::Instruction {
-                    instruction: Some(proto::transaction::instruction::Instruction::CreateAccount(
-                        proto::transaction::CreateAccount {
-                            public_key: owner_public_key.as_bytes().to_vec(),
-                            owner_rule,
-                            access_rules,
-                            workspace_id,
-                        },
-                    )),
-                }
-            },
-            Instruction::CallFunction {
-                address,
-                function,
-                args,
-            } => {
-                let args = args.into_iter().map(Into::into).collect();
-                proto::transaction::Instruction {
-                    instruction: Some(proto::transaction::instruction::Instruction::CallFunction(
-                        proto::transaction::CallFunction {
-                            template_address: address.as_slice().to_vec(),
-                            function,
-                            args,
-                        },
-                    )),
-                }
-            },
-            Instruction::CallMethod { call, method, args } => {
-                let call = Some(call.into());
-                let args = args.into_iter().map(Into::into).collect();
-                proto::transaction::Instruction {
-                    instruction: Some(proto::transaction::instruction::Instruction::CallMethod(
-                        proto::transaction::CallMethod {
-                            component_call: call,
-                            method,
-                            args,
-                        },
-                    )),
-                }
-            },
-            Instruction::PutLastInstructionOutputOnWorkspace { key } => proto::transaction::Instruction {
-                instruction: Some(
-                    proto::transaction::instruction::Instruction::PutLastInstructionOutputOnWorkspace(key.into()),
-                ),
-            },
-            Instruction::EmitLog { level, message } => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::EmitLog(
-                    proto::transaction::EmitLog {
-                        log_level: level.to_string(),
-                        log_message: message.into_string(),
-                    },
-                )),
-            },
-            Instruction::ClaimBurn { claim, output_data } => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::ClaimBurn(
-                    proto::transaction::ClaimBurn {
-                        public_key: claim.burn_public_key.as_bytes().to_vec(),
-                        commitment: claim.commitment.as_bytes().to_vec(),
-                        proof_of_knowledge: Some(claim.ownership_proof.into()),
-                        encoded_merkle_proof: Some(claim.encoded_merkle_proof.into()),
-                        kernel: Some(claim.kernel.into()),
-                        value: claim.value,
-                        encrypted_data: output_data.encrypted_data.as_bytes().to_vec(),
-                    },
-                )),
-            },
-            Instruction::ClaimValidatorFees { address } => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::ClaimValidatorFees(
-                    proto::transaction::ClaimValidatorFees {
-                        fee_pool_address: address.as_slice().to_vec(),
-                    },
-                )),
-            },
-            Instruction::DropAllProofsInWorkspace => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::DropAllProofsInWorkspace(
-                    true,
-                )),
-            },
-            Instruction::AssertBucketContains {
-                key,
-                resource_address,
-                min_amount,
-            } => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::AssertBucketContains(
-                    proto::transaction::AssertBucketContains {
-                        bucket: Some(key.into()),
-                        resource_address: resource_address.as_bytes().to_vec(),
-                        min_amount: Some(min_amount.into()),
-                    },
-                )),
-            },
-
-            Instruction::TakeFromBucket {
-                input_bucket,
-                amount,
-                output_bucket,
-            } => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::TakeFromBucket(
-                    proto::transaction::TakeFromBucket {
-                        input_bucket: Some(input_bucket.into()),
-                        amount: Some(amount.into()),
-                        output_bucket: u32::from(output_bucket),
-                    },
-                )),
-            },
-            Instruction::PublishTemplate { binary } => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::PublishTemplate(
-                    proto::transaction::PublishTemplate {
-                        binary: binary.into_vec(),
-                    },
-                )),
-            },
-            Instruction::AllocateAddress {
-                allocatable_type,
-                workspace_id,
-            } => proto::transaction::Instruction {
-                instruction: Some(proto::transaction::instruction::Instruction::AllocateAddress(
-                    proto::transaction::AllocateAddress {
-                        address_type: proto::transaction::AllocatableAddressType::from(allocatable_type).into(),
-                        workspace_id: u32::from(workspace_id),
-                    },
-                )),
-            },
-            Instruction::StealthTransfer {
-                resource_address_ref,
-                statement,
-                revealed_input_bucket,
-            } => {
-                let revealed_input_bucket = revealed_input_bucket.map(Into::into);
-                proto::transaction::Instruction {
-                    instruction: Some(proto::transaction::instruction::Instruction::StealthTransfer(
-                        proto::transaction::StealthTransfer {
-                            resource_address: Some(resource_address_ref.into()),
-                            statement: Some(statement.into()),
-                            revealed_input_bucket,
-                        },
-                    )),
-                }
-            },
-            Instruction::PayFee {
-                statement,
-                revealed_input_bucket,
-            } => {
-                let revealed_input_bucket = revealed_input_bucket.map(Into::into);
-                proto::transaction::Instruction {
-                    instruction: Some(proto::transaction::instruction::Instruction::PayFee(
-                        proto::transaction::PayFee {
-                            statement: Some(statement.into()),
-                            revealed_input_bucket,
-                        },
-                    )),
-                }
-            },
-        }
-    }
-}
-
-// -------------------------------- Arg -------------------------------- //
-
-impl TryFrom<proto::transaction::Arg> for InstructionArg {
-    type Error = anyhow::Error;
-
-    fn try_from(request: proto::transaction::Arg) -> Result<Self, Self::Error> {
-        let arg_value = request.arg_value.ok_or_else(|| anyhow!("arg_value not provided"))?;
-        match arg_value {
-            proto::transaction::arg::ArgValue::Literal(data) => Ok(InstructionArg::raw_literal_bytes(data)),
-            proto::transaction::arg::ArgValue::Workspace(offset_id) => {
-                let id = u16::try_from(offset_id.id).context("WorkspaceOffsetId id overflowed")?;
-                Ok(InstructionArg::Workspace(
-                    WorkspaceOffsetId::new(id).with_offset_opt(offset_id.offset.map(|o| o.offset as usize)),
-                ))
-            },
-        }
-    }
-}
-
-impl From<InstructionArg> for proto::transaction::Arg {
-    fn from(arg: InstructionArg) -> Self {
-        match arg {
-            InstructionArg::Literal(data) => proto::transaction::Arg {
-                arg_value: Some(proto::transaction::arg::ArgValue::Literal(data.into())),
-            },
-            InstructionArg::Workspace(offset_id) => proto::transaction::Arg {
-                arg_value: Some(proto::transaction::arg::ArgValue::Workspace(
-                    proto::transaction::WorkspaceOffsetId {
-                        id: u32::from(offset_id.id()),
-                        offset: offset_id
-                            .offset()
-                            .map(|o| proto::transaction::OptionOffset { offset: o as u64 }),
-                    },
-                )),
-            },
-        }
-    }
-}
-
-// -------------------------------- ComponentCall -------------------------------- //
-impl TryFrom<proto::transaction::ComponentCall> for ComponentCall {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::ComponentCall) -> Result<Self, Self::Error> {
-        match value.call {
-            Some(proto::transaction::component_call::Call::Address(address)) => {
-                let address = ComponentAddress::from(ObjectKey::try_from(address)?);
-                Ok(ComponentCall::Address(address))
-            },
-            Some(proto::transaction::component_call::Call::Allocation(key)) => Ok(ComponentCall::Workspace(
-                key.try_into().context("ComponentCall::Allocation key overflowed")?,
-            )),
-            None => Err(anyhow!("ComponentCall must have a call specified")),
-        }
-    }
-}
-
-impl From<ComponentCall> for proto::transaction::ComponentCall {
-    fn from(call: ComponentCall) -> Self {
-        match call {
-            ComponentCall::Address(address) => proto::transaction::ComponentCall {
-                call: Some(proto::transaction::component_call::Call::Address(
-                    address.as_bytes().to_vec(),
-                )),
-            },
-            ComponentCall::Workspace(id) => proto::transaction::ComponentCall {
-                call: Some(proto::transaction::component_call::Call::Allocation(u32::from(id))),
-            },
-        }
-    }
-}
-
-// -------------------------------- ResourceAddressRef -------------------------------- //
-impl TryFrom<proto::transaction::ResourceAddressRef> for ResourceAddressRef {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::ResourceAddressRef) -> Result<Self, Self::Error> {
-        let inner = val
-            .inner
-            .ok_or_else(|| anyhow!("ResourceAddressRef inner not provided"))?;
-        match inner {
-            proto::transaction::resource_address_ref::Inner::Address(address) => {
-                Ok(ResourceAddressRef::Address(ObjectKey::try_from_slice(&address)?.into()))
-            },
-            proto::transaction::resource_address_ref::Inner::Workspace(workspace_id) => {
-                Ok(ResourceAddressRef::Workspace(
-                    workspace_id
-                        .try_into()
-                        .context("ResourceAddressRef::Workspace conversion failed")?,
-                ))
-            },
-        }
-    }
-}
-
-impl From<ResourceAddressRef> for proto::transaction::ResourceAddressRef {
-    fn from(val: ResourceAddressRef) -> Self {
-        match val {
-            ResourceAddressRef::Address(address) => proto::transaction::ResourceAddressRef {
-                inner: Some(proto::transaction::resource_address_ref::Inner::Address(
-                    address.as_bytes().to_vec(),
-                )),
-            },
-            ResourceAddressRef::Workspace(workspace_id) => proto::transaction::ResourceAddressRef {
-                inner: Some(proto::transaction::resource_address_ref::Inner::Workspace(
-                    proto::transaction::WorkspaceOffsetId {
-                        id: u32::from(workspace_id.id()),
-                        offset: workspace_id
-                            .offset()
-                            .map(|o| proto::transaction::OptionOffset { offset: o as u64 }),
-                    },
-                )),
-            },
-        }
-    }
-}
-
-// -------------------------------- SubstateRequirement -------------------------------- //
-impl TryFrom<proto::transaction::SubstateRequirement> for SubstateRequirement {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::SubstateRequirement) -> Result<Self, Self::Error> {
-        let substate_id = SubstateId::from_bytes(&val.substate_id)?;
-        let version = val.version.map(|v| v.version);
-        let substate_specification = SubstateRequirement::new(substate_id, version);
-        Ok(substate_specification)
-    }
-}
-
-impl From<SubstateRequirement> for proto::transaction::SubstateRequirement {
-    fn from(val: SubstateRequirement) -> Self {
-        (&val).into()
-    }
-}
-
-impl From<&SubstateRequirement> for proto::transaction::SubstateRequirement {
-    fn from(val: &SubstateRequirement) -> Self {
-        Self {
-            substate_id: val.substate_id().to_bytes(),
-            version: val.version().map(|v| OptionalVersion { version: v }),
-        }
-    }
-}
-impl From<SubstateRequirementRef<'_>> for proto::transaction::SubstateRequirement {
-    fn from(val: SubstateRequirementRef<'_>) -> Self {
-        Self {
-            substate_id: val.substate_id().to_bytes(),
-            version: val.version().map(|v| OptionalVersion { version: v }),
-        }
-    }
-}
-
-// -------------------------------- VersionedSubstate -------------------------------- //
-
-impl TryFrom<proto::transaction::VersionedSubstateId> for VersionedSubstateId {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::VersionedSubstateId) -> Result<Self, Self::Error> {
-        let substate_id = SubstateId::from_bytes(&val.substate_id)?;
-        let substate_specification = VersionedSubstateId::new(substate_id, val.version);
-        Ok(substate_specification)
-    }
-}
-
-impl From<VersionedSubstateId> for proto::transaction::VersionedSubstateId {
-    fn from(val: VersionedSubstateId) -> Self {
-        (&val).into()
-    }
-}
-
-impl From<&VersionedSubstateId> for proto::transaction::VersionedSubstateId {
-    fn from(val: &VersionedSubstateId) -> Self {
-        Self {
-            substate_id: val.substate_id().to_bytes(),
-            version: val.version(),
-        }
-    }
-}
-
-// // -------------------------------- ConfidentialWithdrawProof -------------------------------- //
-
-impl TryFrom<proto::transaction::ConfidentialWithdrawProof> for ConfidentialWithdrawProof {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::ConfidentialWithdrawProof) -> Result<Self, Self::Error> {
-        Ok(ConfidentialWithdrawProof {
-            inputs: val
-                .inputs
-                .into_iter()
-                .map(|v| {
-                    PedersenCommitmentBytes::from_bytes(&v).map_err(|e| anyhow!("Invalid input commitment bytes: {e}"))
-                })
-                .collect::<Result<_, _>>()?,
-            input_revealed_amount: val.input_revealed_amount.unwrap_or_default().into(),
-            output_proof: val
-                .output_proof
-                .ok_or_else(|| anyhow!("output_proof is missing"))?
-                .try_into()?,
-            balance_proof: BalanceProofSignature::from_bytes(&val.balance_proof)
-                .map_err(|e| anyhow!("Invalid balance proof signature: {}", e))?,
-        })
-    }
-}
-
-impl From<ConfidentialWithdrawProof> for proto::transaction::ConfidentialWithdrawProof {
-    fn from(val: ConfidentialWithdrawProof) -> Self {
-        Self {
-            inputs: val.inputs.iter().map(|v| v.as_bytes().to_vec()).collect(),
-            input_revealed_amount: Some(val.input_revealed_amount.into()),
-            output_proof: Some(val.output_proof.into()),
-            balance_proof: val.balance_proof.to_bytes(),
-        }
-    }
-}
-
-// -------------------------------- ConfidentialOutputStatement -------------------------------- //
-
-impl TryFrom<proto::transaction::ConfidentialOutputStatement> for ConfidentialOutputStatement {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::ConfidentialOutputStatement) -> Result<Self, Self::Error> {
-        Ok(ConfidentialOutputStatement {
-            output: val.output_statement.map(TryInto::try_into).transpose()?,
-            change_statement: val.change_statement.map(TryInto::try_into).transpose()?,
-            range_proof: RangeProofBytes::try_from(val.range_proof).context("Invalid range proof")?,
-            output_revealed_amount: val.output_revealed_amount.unwrap_or_default().into(),
-            change_revealed_amount: val.change_revealed_amount.unwrap_or_default().into(),
-        })
-    }
-}
-
-impl From<ConfidentialOutputStatement> for proto::transaction::ConfidentialOutputStatement {
-    fn from(val: ConfidentialOutputStatement) -> Self {
-        Self {
-            output_statement: val.output.map(Into::into),
-            change_statement: val.change_statement.map(Into::into),
-            range_proof: val.range_proof.into_vec(),
-            output_revealed_amount: Some(val.output_revealed_amount.into()),
-            change_revealed_amount: Some(val.change_revealed_amount.into()),
-        }
-    }
-}
-
-// -------------------------------- UnspentOutput -------------------------------- //
-
-impl TryFrom<proto::transaction::UnspentOutput> for UnspentOutput {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::UnspentOutput) -> Result<Self, Self::Error> {
-        let sender_public_nonce = Some(val.sender_public_nonce)
-            .filter(|v| !v.is_empty())
-            .map(|v| RistrettoPublicKeyBytes::from_bytes(&v).map_err(|e| anyhow!("Invalid sender_public_nonce: {}", e)))
-            .transpose()?
-            .ok_or_else(|| anyhow!("sender_public_nonce is missing"))?;
-
-        Ok(UnspentOutput {
-            commitment: checked_copy_fixed(&val.commitment)
-                .ok_or_else(|| anyhow!("Invalid length of commitment bytes"))?,
-            sender_public_nonce,
-            encrypted_data: EncryptedData::try_from(val.encrypted_data)
-                .map_err(|len| anyhow!("Invalid length ({len}) of encrypted_value bytes"))?,
-            minimum_value_promise: val.minimum_value_promise,
-            viewable_balance_proof: val.viewable_balance_proof.map(TryInto::try_into).transpose()?,
-        })
-    }
-}
-
-impl From<UnspentOutput> for proto::transaction::UnspentOutput {
-    fn from(val: UnspentOutput) -> Self {
-        Self {
-            commitment: val.commitment.to_vec(),
-            sender_public_nonce: val.sender_public_nonce.as_bytes().to_vec(),
-            encrypted_data: val.encrypted_data.as_ref().to_vec(),
-            minimum_value_promise: val.minimum_value_promise,
-            viewable_balance_proof: val.viewable_balance_proof.map(Into::into),
-        }
-    }
-}
-
-// -------------------------------- StealthUnspentOutput -------------------------------- //
-impl TryFrom<proto::transaction::StealthUnspentOutput> for tari_template_lib::models::StealthUnspentOutput {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::StealthUnspentOutput) -> Result<Self, Self::Error> {
-        let output = val
-            .output
-            .ok_or_else(|| anyhow!("stealth unspent output not provided"))?
-            .try_into()?;
-        let owner_public_key = RistrettoPublicKeyBytes::from_bytes(&val.owner_public_key)
-            .map_err(|e| anyhow!("Invalid owner public key: {}", e))?;
-
-        Ok(tari_template_lib::models::StealthUnspentOutput {
-            output,
-            owner_public_key,
-            tag: UtxoTag::new(val.tag_byte),
-        })
-    }
-}
-
-impl From<tari_template_lib::models::StealthUnspentOutput> for proto::transaction::StealthUnspentOutput {
-    fn from(val: tari_template_lib::models::StealthUnspentOutput) -> Self {
-        Self {
-            output: Some(val.output.into()),
-            owner_public_key: val.owner_public_key.as_bytes().to_vec(),
-            tag_byte: val.tag.value(),
-        }
-    }
-}
-
-// -------------------------------- ViewableBalanceProof -------------------------------- //
-
-impl TryFrom<proto::transaction::ViewableBalanceProof> for ViewableBalanceProof {
-    type Error = anyhow::Error;
-
-    fn try_from(val: proto::transaction::ViewableBalanceProof) -> Result<Self, Self::Error> {
-        Ok(ViewableBalanceProof {
-            elgamal_encrypted: val.elgamal_encrypted.as_slice().try_into()?,
-            elgamal_public_nonce: val.elgamal_public_nonce.as_slice().try_into()?,
-            c_prime: val.c_prime.as_slice().try_into()?,
-            e_prime: val.e_prime.as_slice().try_into()?,
-            r_prime: val.r_prime.as_slice().try_into()?,
-            s_v: val.s_v.as_slice().try_into()?,
-            s_m: val.s_m.as_slice().try_into()?,
-            s_r: val.s_r.as_slice().try_into()?,
-        })
-    }
-}
-
-impl From<ViewableBalanceProof> for proto::transaction::ViewableBalanceProof {
-    fn from(val: ViewableBalanceProof) -> Self {
-        Self {
-            elgamal_encrypted: val.elgamal_encrypted.as_bytes().to_vec(),
-            elgamal_public_nonce: val.elgamal_public_nonce.as_bytes().to_vec(),
-            c_prime: val.c_prime.as_bytes().to_vec(),
-            e_prime: val.e_prime.as_bytes().to_vec(),
-            r_prime: val.r_prime.as_bytes().to_vec(),
-            s_v: val.s_v.as_bytes().to_vec(),
-            s_m: val.s_m.as_bytes().to_vec(),
-            s_r: val.s_r.as_bytes().to_vec(),
-        }
-    }
-}
-
-//---------------------------------- StealthTransferStatement --------------------------------------------//
-
-impl TryFrom<proto::transaction::StealthTransferStatement> for tari_template_lib::models::StealthTransferStatement {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::StealthTransferStatement) -> Result<Self, Self::Error> {
-        Ok(Self {
-            inputs_statement: value
-                .inputs_statement
-                .ok_or_else(|| anyhow!("Inputs statement not provided"))?
-                .try_into()?,
-            outputs_statement: value
-                .outputs_statement
-                .ok_or_else(|| anyhow!("output_statement not provided"))?
-                .try_into()?,
-            balance_proof: Some(&value.balance_proof)
-                .filter(|b| !b.is_empty())
-                .map(|b| BalanceProofSignature::from_bytes(b))
-                .transpose()
-                .context("Invalid balance proof signature")?,
-        })
-    }
-}
-
-impl From<tari_template_lib::models::StealthTransferStatement> for proto::transaction::StealthTransferStatement {
-    fn from(value: tari_template_lib::models::StealthTransferStatement) -> Self {
-        Self {
-            inputs_statement: Some(value.inputs_statement.into()),
-            outputs_statement: Some(value.outputs_statement.into()),
-            balance_proof: value.balance_proof.as_ref().map(|b| b.to_bytes()).unwrap_or_default(),
-        }
-    }
-}
-
-// -------------------------------- StealthInputsStatement -------------------------------- //
-impl TryFrom<proto::transaction::StealthInputsStatement> for tari_template_lib::models::StealthInputsStatement {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::StealthInputsStatement) -> Result<Self, Self::Error> {
-        let inputs = value
-            .inputs
-            .into_iter()
-            .map(|input| input.try_into().context("Invalid stealth input"))
-            .collect::<Result<Vec<_>, _>>()?;
-
-        Ok(Self {
-            inputs,
-            revealed_amount: value.revealed_amount.unwrap_or_default().into(),
-            required_signer: RistrettoPublicKeyBytes::from_bytes(&value.required_signer)
-                .context("Invalid required signer")?,
-        })
-    }
-}
-
-impl From<tari_template_lib::models::StealthInputsStatement> for proto::transaction::StealthInputsStatement {
-    fn from(value: tari_template_lib::models::StealthInputsStatement) -> Self {
-        Self {
-            inputs: value.inputs.iter().map(Into::into).collect(),
-            revealed_amount: Some(value.revealed_amount.into()),
-            required_signer: value.required_signer.as_bytes().to_vec(),
-        }
-    }
-}
-
-// -------------------------------- StealthInput -------------------------------- //
-
-impl TryFrom<proto::transaction::StealthInput> for StealthInput {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::StealthInput) -> Result<Self, Self::Error> {
-        let commitment =
-            PedersenCommitmentBytes::from_bytes(&value.commitment).context("Invalid input commitment bytes")?;
-        let owner_proof = value
-            .owner_proof
-            .ok_or_else(|| anyhow!("owner_proof not provided"))?
-            .try_into()
-            .context("Invalid owner proof commitment signature")?;
-
-        Ok(Self {
-            commitment,
-            owner_proof,
-        })
-    }
-}
-
-impl From<&StealthInput> for proto::transaction::StealthInput {
-    fn from(value: &StealthInput) -> Self {
-        Self {
-            commitment: value.commitment.as_bytes().to_vec(),
-            owner_proof: Some((&value.owner_proof).into()),
-        }
-    }
-}
-
-//---------------------------------- StealthOutputStatement --------------------------------------------//
-
-impl TryFrom<proto::transaction::StealthOutputsStatement> for tari_template_lib::models::StealthOutputsStatement {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::StealthOutputsStatement) -> Result<Self, Self::Error> {
-        let outputs = value
-            .outputs
-            .into_iter()
-            .map(|output| output.try_into().context("Invalid unspent output"))
-            .collect::<Result<Vec<_>, _>>()?;
-
-        Ok(Self {
-            outputs,
-            revealed_output_amount: value.revealed_output_amount.unwrap_or_default().into(),
-            agg_range_proof: RangeProofBytes::try_from(value.agg_range_proof)
-                .context("Invalid aggregate range proof")?,
-        })
-    }
-}
-
-impl From<tari_template_lib::models::StealthOutputsStatement> for proto::transaction::StealthOutputsStatement {
-    fn from(value: tari_template_lib::models::StealthOutputsStatement) -> Self {
-        Self {
-            outputs: value.outputs.into_iter().map(Into::into).collect(),
-            revealed_output_amount: Some(value.revealed_output_amount.into()),
-            agg_range_proof: value.agg_range_proof.into_vec(),
-        }
-    }
-}
-
-// -------------------------------- OwnerRule -------------------------------- //
-
-impl From<OwnerRule> for proto::transaction::OwnerRule {
-    fn from(value: OwnerRule) -> Self {
-        Self {
-            // TODO: no panic
-            encoded_owner_rule: encode_to_vec(&value).unwrap(),
-        }
-    }
-}
-
-impl TryFrom<proto::transaction::OwnerRule> for OwnerRule {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::OwnerRule) -> Result<Self, Self::Error> {
-        decode_from_slice(&value.encoded_owner_rule)
-    }
-}
-
-// -------------------------------- AccessRules -------------------------------- //
-
-impl From<AccessRules> for proto::transaction::AccessRules {
-    fn from(value: AccessRules) -> Self {
-        Self {
-            // TODO: no panic
-            encoded_access_rules: encode_to_vec(&value).unwrap(),
-        }
-    }
-}
-
-impl TryFrom<proto::transaction::AccessRules> for AccessRules {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::AccessRules) -> Result<Self, Self::Error> {
-        decode_from_slice(&value.encoded_access_rules)
-    }
-}
-
-// -------------------------------- WorkspaceOffsetId -------------------------------- //
-
-impl TryFrom<proto::transaction::WorkspaceOffsetId> for WorkspaceOffsetId {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::WorkspaceOffsetId) -> Result<Self, Self::Error> {
-        let id = WorkspaceId::try_from(value.id).context("WorkspaceOffsetId id overflowed")?;
-        let offset = value
-            .offset
-            .map(|o| usize::try_from(o.offset).context("WorkspaceOffsetId offset overflowed"))
-            .transpose()?;
-        Ok(Self::new(id).with_offset_opt(offset))
-    }
-}
-
-impl From<WorkspaceOffsetId> for proto::transaction::WorkspaceOffsetId {
-    fn from(value: WorkspaceOffsetId) -> Self {
-        Self {
-            id: u32::from(value.id()),
-            offset: value.offset().map(|o| proto::transaction::OptionOffset {
-                offset: u64::try_from(o).expect("WorkspaceOffsetId offset overflowed"),
-            }),
-        }
-    }
-}
-
-// -------------------------------- EncodedMerkleProof -------------------------------- //
-
-impl TryFrom<proto::transaction::EncodedMerkleProof> for EncodedMerkleProof {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::EncodedMerkleProof) -> Result<Self, Self::Error> {
-        Ok(Self {
-            block_hash: value.block_hash.try_into().context("Invalid block hash")?,
-            encoded_merkle_proof: value
-                .encoded_proof
-                .try_into()
-                .map_err(|e| anyhow!("Invalid encoded merkle proof: {}", e))?,
-            leaf_index: value.leaf_index,
-        })
-    }
-}
-
-impl From<EncodedMerkleProof> for proto::transaction::EncodedMerkleProof {
-    fn from(value: EncodedMerkleProof) -> Self {
-        Self {
-            block_hash: value.block_hash.as_slice().to_vec(),
-            encoded_proof: value.encoded_merkle_proof.to_vec(),
-            leaf_index: value.leaf_index,
-        }
-    }
-}
-
-// -------------------------------- AbridgedKernel -------------------------------- //
-
-impl TryFrom<proto::transaction::AbridgedKernel> for AbridgedTransactionKernel {
-    type Error = anyhow::Error;
-
-    fn try_from(value: proto::transaction::AbridgedKernel) -> Result<Self, Self::Error> {
-        Ok(Self {
-            version: u8::try_from(value.version).map_err(|e| anyhow!("Invalid kernel version: {}", e))?,
-            fee: value.fee,
-            lock_height: value.lock_height,
-            excess: PedersenCommitmentBytes::from_bytes(&value.excess)
-                .map_err(|e| anyhow!("Invalid excess commitment: {}", e))?,
-            excess_sig: value
-                .excess_sig
-                .ok_or_else(|| anyhow!("excess_sig not provided"))?
-                .try_into()
-                .map_err(|e| anyhow!("Invalid excess signature: {}", e))?,
-        })
-    }
-}
-
-impl From<AbridgedTransactionKernel> for proto::transaction::AbridgedKernel {
-    fn from(value: AbridgedTransactionKernel) -> Self {
-        Self {
-            version: value.version.into(),
-            fee: value.fee,
-            lock_height: value.lock_height,
-            excess: value.excess.as_bytes().to_vec(),
-            excess_sig: Some(value.excess_sig.into()),
-        }
-    }
-}
diff --git a/crates/p2p/src/lib.rs b/crates/p2p/src/lib.rs
index 5579920d40..4d2a04d578 100644
--- a/crates/p2p/src/lib.rs
+++ b/crates/p2p/src/lib.rs
@@ -12,4 +12,4 @@ mod message_spec;
 pub use message_spec::*;
 
 mod encoding;
-mod utils;
+// mod utils;
diff --git a/crates/template_builtin/templates/faucet/src/lib.rs b/crates/template_builtin/templates/faucet/src/lib.rs
index c70622e8e8..b8655b4549 100644
--- a/crates/template_builtin/templates/faucet/src/lib.rs
+++ b/crates/template_builtin/templates/faucet/src/lib.rs
@@ -21,8 +21,7 @@ mod template {
                 FAUCET_MAX
             );
             debug!("Withdrawing {} coins from faucet", amount);
-            let signer = CallerContext::transaction_signer_public_key();
-            emit_event("take", [("amount", amount.to_string()), ("signer", signer.to_string())]);
+            emit_event("take", [("amount", amount.to_string())]);
             self.vault.withdraw(amount)
         }
 
@@ -38,10 +37,9 @@ mod template {
                 amount,
                 FAUCET_MAX
             );
-            let signer = CallerContext::transaction_signer_public_key();
             let revealed_bucket = self.vault.withdraw(amount);
             let transfer = StealthTransferStatement {
-                inputs_statement: StealthInputsStatement::new_revealed_only(amount, signer),
+                inputs_statement: StealthInputsStatement::new_revealed_only(amount),
                 outputs_statement: output,
                 balance_proof,
             };
@@ -50,7 +48,6 @@ mod template {
             emit_event("take", [
                 ("amount", amount.to_string()),
                 ("confidential", "true".to_string()),
-                ("signer", signer.to_string()),
             ]);
 
             self.vault
diff --git a/crates/template_lib/src/auth/access_rules.rs b/crates/template_lib/src/auth/access_rules.rs
index e70b5148f9..7f53197cfd 100644
--- a/crates/template_lib/src/auth/access_rules.rs
+++ b/crates/template_lib/src/auth/access_rules.rs
@@ -50,18 +50,18 @@ pub enum RestrictedAccessRule {
     /// Requires a specific condition to be met
     Require(RequireRule),
     /// Requires any of the specified conditions to be met (logical OR)
-    AnyOf(Vec<RestrictedAccessRule>),
+    AnyOf(Box<[RestrictedAccessRule]>),
     /// Requires all of the specified conditions to be met (logical AND)
-    AllOf(Vec<RestrictedAccessRule>),
+    AllOf(Box<[RestrictedAccessRule]>),
 }
 
 impl RestrictedAccessRule {
     pub fn and(self, other: Self) -> Self {
-        Self::AllOf(vec![self, other])
+        Self::AllOf(Box::new([self, other]))
     }
 
     pub fn or(self, other: Self) -> Self {
-        Self::AnyOf(vec![self, other])
+        Self::AnyOf(Box::new([self, other]))
     }
 }
 
@@ -70,9 +70,9 @@ impl RestrictedAccessRule {
 #[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
 #[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
 pub enum RuleRequirement {
-    /// Requires ownership of a specific resource
+    /// Requires a proof of a specific resource
     Resource(ResourceAddress),
-    /// Requires ownership of a specific non-fungible token
+    /// Requires a proof of a specific non-fungible token
     NonFungibleAddress(NonFungibleAddress),
     /// Requires execution within a specific component
     ScopedToComponent(ComponentAddress),
@@ -112,9 +112,11 @@ pub enum RequireRule {
     /// Requires a specific condition to be met
     Require(RuleRequirement),
     /// Requires any of the specified conditions to be met (logical OR)
-    AnyOf(Vec<RuleRequirement>),
+    AnyOf(Box<[RuleRequirement]>),
     /// Requires all of the specified conditions to be met (logical AND)
-    AllOf(Vec<RuleRequirement>),
+    AllOf(Box<[RuleRequirement]>),
+    /// Requires N of the specified conditions to be met
+    MOfN(u16, Box<[RuleRequirement]>),
 }
 
 /// Information needed to specify access rules to methods of a component
@@ -322,8 +324,8 @@ impl Default for ResourceAccessRules {
 
 /// A macro to build access rules for components and resources.
 ///
-/// It allows for defining rules such as `allow_all`, `deny_all`, and more complex rules using `any_of` and `all_of`
-/// constructs.
+/// It allows for defining rules such as `allow_all`, `deny_all`, and more complex rules using `any_of`, `all_of` and
+/// `n_of` constructs.
 ///
 /// # Examples:
 ///
@@ -351,11 +353,14 @@ impl Default for ResourceAccessRules {
 ///     tari_template_lib::types::crypto::RistrettoPublicKeyBytes::default(),
 /// );
 /// let non_fungible_rule = rule!(non_fungible(non_fungible_address));
-/// // Complex rules using `any_of` and `all_of`
+/// // Complex rules using `any_of`, `all_of` and `n_of`
 /// let complex_rule = rule!(any_of(
 ///     component(component_address),
 ///     resource(resource_address)
 /// ));
+/// # let pk1 = tari_template_lib::types::crypto::RistrettoPublicKeyBytes::default();
+/// # let pk2 = tari_template_lib::types::crypto::RistrettoPublicKeyBytes::default();
+/// let n_of_rule = rule!(m_of_n(2, public_key(pk1), public_key(pk2)));
 /// ```
 #[macro_export]
 macro_rules! rule {
@@ -373,23 +378,26 @@ macro_rules! rule {
 #[macro_export]
 macro_rules! __restricted_access_rule {
     (any_of($($tail:tt)*)) => {
-        $crate::auth::RestrictedAccessRule::AnyOf($crate::__build_vec!(@ {__restricted_access_rule} $($tail)*))
+        $crate::auth::RestrictedAccessRule::AnyOf($crate::__build_vec!(@ {__restricted_access_rule} $($tail)*).into_boxed_slice())
     };
     (all_of($($tail:tt)*)) => {
-        $crate::auth::RestrictedAccessRule::AllOf($crate::__build_vec!(@ {__restricted_access_rule} $($tail)*))
+        $crate::auth::RestrictedAccessRule::AllOf($crate::__build_vec!(@ {__restricted_access_rule} $($tail)*).into_boxed_slice())
     };
-    ($a:ident($b:expr)) => {
-        $crate::auth::RestrictedAccessRule::Require($crate::__require_rule!($a($b)))
+    ($a:ident($($tail:tt)*)) => {
+        $crate::auth::RestrictedAccessRule::Require($crate::__require_rule!($a($($tail)*)))
     };
 }
 
 #[macro_export]
 macro_rules! __require_rule {
     (any_of($($tail:tt)*)) => {
-        $crate::auth::RequireRule::AnyOf($crate::__build_vec!(@ {__rule_requirement} $($tail)*))
+        $crate::auth::RequireRule::AnyOf($crate::__build_vec!(@ {__rule_requirement} $($tail)*).into_boxed_slice())
     };
     (all_of($($tail:tt)*)) => {
-        $crate::auth::RequireRule::AllOf($crate::__build_vec!(@ {__rule_requirement} $($tail)*))
+        $crate::auth::RequireRule::AllOf($crate::__build_vec!(@ {__rule_requirement} $($tail)*).into_boxed_slice())
+    };
+    (m_of_n($n:literal, $($tail:tt)*)) => {
+        $crate::auth::RequireRule::MOfN($n, $crate::__build_vec!(@ {__rule_requirement} $($tail)*).into_boxed_slice())
     };
     ($a:ident($b:expr)) => {
         $crate::auth::RequireRule::Require($crate::__rule_requirement!($a($b)))
@@ -404,6 +412,9 @@ macro_rules! __rule_requirement {
     (non_fungible($x: expr)) => {
         $crate::auth::RuleRequirement::NonFungibleAddress($x)
     };
+    (public_key($x: expr)) => {
+        $crate::auth::RuleRequirement::NonFungibleAddress($crate::models::NonFungibleAddress::from_public_key($x))
+    };
     (component($x: expr)) => {
         $crate::auth::RuleRequirement::ScopedToComponent($x)
     };
@@ -493,23 +504,35 @@ mod tests {
         let rule = rule!(any_of(component(component_address), resource(resource_address)));
         assert_eq!(
             rule,
-            AccessRule::Restricted(RestrictedAccessRule::AnyOf(vec![
+            AccessRule::Restricted(RestrictedAccessRule::AnyOf(Box::new([
                 RestrictedAccessRule::Require(RequireRule::Require(RuleRequirement::ScopedToComponent(
                     component_address
                 ))),
                 RestrictedAccessRule::Require(RequireRule::Require(RuleRequirement::Resource(resource_address))),
-            ]))
+            ])))
         );
 
         let rule = rule!(all_of(component(component_address), resource(resource_address)));
         assert_eq!(
             rule,
-            AccessRule::Restricted(RestrictedAccessRule::AllOf(vec![
+            AccessRule::Restricted(RestrictedAccessRule::AllOf(Box::new([
                 RestrictedAccessRule::Require(RequireRule::Require(RuleRequirement::ScopedToComponent(
                     component_address
                 ))),
                 RestrictedAccessRule::Require(RequireRule::Require(RuleRequirement::Resource(resource_address))),
-            ]))
+            ])))
+        );
+
+        let rule = rule!(m_of_n(1, component(component_address), resource(resource_address)));
+        assert_eq!(
+            rule,
+            AccessRule::Restricted(RestrictedAccessRule::Require(RequireRule::MOfN(
+                1,
+                Box::new([
+                    RuleRequirement::ScopedToComponent(component_address),
+                    RuleRequirement::Resource(resource_address),
+                ])
+            )))
         );
     }
 
diff --git a/crates/template_lib/src/models/component.rs b/crates/template_lib/src/models/component.rs
index ee443fde8d..567da534e2 100644
--- a/crates/template_lib/src/models/component.rs
+++ b/crates/template_lib/src/models/component.rs
@@ -43,8 +43,8 @@ pub struct ComponentAddress(#[cfg_attr(feature = "ts", ts(type = "string"))] Bor
 
 impl ComponentAddress {
     /// Creates a new `ComponentAddress` from an `ObjectKey`. For internal use only.
-    pub const fn new(substate_key: ObjectKey) -> Self {
-        Self(BorTag::new(substate_key))
+    pub const fn new(object_key: ObjectKey) -> Self {
+        Self(BorTag::new(object_key))
     }
 
     /// Returns the underlying `ObjectKey` of this `ComponentAddress`.
@@ -72,6 +72,11 @@ impl ComponentAddress {
     pub fn entity_id(&self) -> EntityId {
         self.0.inner().as_entity_id()
     }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, KeyParseError> {
+        let key = ObjectKey::try_from(bytes)?;
+        Ok(Self::new(key))
+    }
 }
 
 impl FromStr for ComponentAddress {
diff --git a/crates/template_lib/src/models/stealth.rs b/crates/template_lib/src/models/stealth.rs
index caacd73c05..9aa1cb6473 100644
--- a/crates/template_lib/src/models/stealth.rs
+++ b/crates/template_lib/src/models/stealth.rs
@@ -3,13 +3,7 @@
 
 use serde::{Deserialize, Serialize};
 use tari_template_lib_types::{
-    crypto::{
-        BalanceProofSignature,
-        PedersenCommitmentBytes,
-        RangeProofBytes,
-        RistrettoPublicKeyBytes,
-        SchnorrSignatureBytes,
-    },
+    crypto::{BalanceProofSignature, PedersenCommitmentBytes, RangeProofBytes},
     Amount,
 };
 
@@ -41,17 +35,15 @@ impl StealthOutputsStatement {
     }
 }
 
-/// A statement for stealth outputs. A statement must contain confidential outputs
+/// A statement for stealth outputs to spend as inputs.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
 #[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
 pub struct StealthInput {
     /// The commitment of the unspent output being spent
     pub commitment: PedersenCommitmentBytes,
-    /// Signature that proves ownership of the unspent output. This must be signed by the owner_public_key of the
-    /// output.
-    pub owner_proof: SchnorrSignatureBytes,
 }
+
 /// A statement for stealth outputs. A statement must contain confidential outputs
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
@@ -61,12 +53,10 @@ pub struct StealthInputsStatement {
     pub inputs: Vec<StealthInput>,
     /// The total amount of revealed funds being spent.
     pub revealed_amount: Amount,
-    /// The signer that must sign the transaction to allow these inputs to be spent.
-    pub required_signer: RistrettoPublicKeyBytes,
 }
 
 impl StealthInputsStatement {
-    pub fn new(inputs: Vec<StealthInput>, revealed_amount: Amount, required_signer: RistrettoPublicKeyBytes) -> Self {
+    pub fn new(inputs: Vec<StealthInput>, revealed_amount: Amount) -> Self {
         assert!(!revealed_amount.is_negative(), "Revealed amount must be non-negative");
         assert!(
             !inputs.is_empty() || !revealed_amount.is_zero(),
@@ -75,13 +65,12 @@ impl StealthInputsStatement {
         Self {
             inputs,
             revealed_amount,
-            required_signer,
         }
     }
 
     /// Create a new input statement with no stealth inputs, only a revealed amount.
-    pub fn new_revealed_only(amount: Amount, required_signer: RistrettoPublicKeyBytes) -> Self {
-        Self::new(vec![], amount, required_signer)
+    pub fn new_revealed_only(amount: Amount) -> Self {
+        Self::new(vec![], amount)
     }
 }
 
@@ -97,13 +86,9 @@ pub struct StealthTransferStatement {
 }
 
 impl StealthTransferStatement {
-    pub fn revealed_only(
-        input_amount: Amount,
-        output_amount: Amount,
-        required_signer: RistrettoPublicKeyBytes,
-    ) -> Self {
+    pub fn revealed_only(input_amount: Amount, output_amount: Amount) -> Self {
         Self {
-            inputs_statement: StealthInputsStatement::new_revealed_only(input_amount, required_signer),
+            inputs_statement: StealthInputsStatement::new_revealed_only(input_amount),
             outputs_statement: StealthOutputsStatement::new_revealed_only(output_amount),
             balance_proof: None,
         }
diff --git a/crates/template_lib/src/models/unspent_output.rs b/crates/template_lib/src/models/unspent_output.rs
index 1ea5153c57..e70388d7d0 100644
--- a/crates/template_lib/src/models/unspent_output.rs
+++ b/crates/template_lib/src/models/unspent_output.rs
@@ -7,7 +7,7 @@ use tari_template_lib_types::{
     EncryptedData,
 };
 
-use crate::models::ViewableBalanceProof;
+use crate::{auth::AccessRule, models::ViewableBalanceProof};
 
 /// An unspent output that does not reveal the value and the owner of the coin it represents.
 ///
@@ -38,8 +38,32 @@ pub struct UnspentOutput {
 #[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
 pub struct StealthUnspentOutput {
     pub output: UnspentOutput,
-    /// The public key that must prove ownership of this UTXO. This is typically a one time "stealth" public key
-    /// selected by the client.
-    pub owner_public_key: RistrettoPublicKeyBytes,
+    pub spend_condition: SpendCondition,
     pub tag: UtxoTag,
 }
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
+pub enum SpendCondition {
+    /// The public key that must prove ownership of this UTXO. This is typically a one time "stealth" public key but is
+    /// selected by the client.
+    Signed(RistrettoPublicKeyBytes),
+    AccessRule(AccessRule),
+}
+
+impl SpendCondition {
+    pub const fn signed_by(&self) -> Option<&RistrettoPublicKeyBytes> {
+        match self {
+            Self::Signed(pk) => Some(pk),
+            _ => None,
+        }
+    }
+
+    pub const fn as_type_str(&self) -> &'static str {
+        match self {
+            Self::Signed(_) => "SignedBy",
+            Self::AccessRule(_) => "AccessRule",
+        }
+    }
+}
diff --git a/crates/template_lib_types/src/bytes.rs b/crates/template_lib_types/src/bytes.rs
index d94403881a..8b33409248 100644
--- a/crates/template_lib_types/src/bytes.rs
+++ b/crates/template_lib_types/src/bytes.rs
@@ -12,12 +12,25 @@ use crate::serde_helpers::BytesVisitor;
 #[derive(Debug, Clone, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 #[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize, borsh::BorshDeserialize))]
 #[serde(transparent)]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, type = "Uint8Array"))]
 pub struct Bytes(#[serde(with = "self")] Box<[u8]>);
 
 impl Bytes {
     pub fn from_vec(data: Vec<u8>) -> Self {
         Self(data.into_boxed_slice())
     }
+
+    pub fn into_vec(self) -> Vec<u8> {
+        self.0.into_vec()
+    }
+
+    pub fn into_boxed(self) -> Box<[u8]> {
+        self.0
+    }
+
+    pub fn as_slice(&self) -> &[u8] {
+        &self.0
+    }
 }
 
 impl Deref for Bytes {
@@ -52,6 +65,7 @@ impl AsRef<[u8]> for Bytes {
     }
 }
 
+/// Serialize using the optimal byte format. i.e. `Bytes` in ciborium instead of `Array(Integer(u8), ....])`
 pub fn serialize<S: serde::Serializer, T: AsRef<[u8]>>(v: &T, s: S) -> Result<S::Ok, S::Error> {
     s.serialize_bytes(v.as_ref())
 }
diff --git a/crates/template_lib_types/src/lib.rs b/crates/template_lib_types/src/lib.rs
index b2527cbb31..2eb7ef912a 100644
--- a/crates/template_lib_types/src/lib.rs
+++ b/crates/template_lib_types/src/lib.rs
@@ -14,6 +14,8 @@ mod hash;
 pub mod hex;
 mod max_bytes;
 mod max_string;
+mod max_vec;
+mod misc;
 mod resource_type;
 pub mod serde_helpers;
 
@@ -24,6 +26,8 @@ pub use error::*;
 pub use hash::*;
 pub use max_bytes::MaxBytes;
 pub use max_string::MaxString;
+pub use max_vec::*;
+pub use misc::*;
 pub use resource_type::*;
 
 /// The address of a Template
diff --git a/crates/template_lib_types/src/max_bytes.rs b/crates/template_lib_types/src/max_bytes.rs
index 0aa3e70510..e36e1f7a74 100644
--- a/crates/template_lib_types/src/max_bytes.rs
+++ b/crates/template_lib_types/src/max_bytes.rs
@@ -1,7 +1,7 @@
 //   Copyright 2025 The Tari Project
 //   SPDX-License-Identifier: BSD-3-Clause
 
-use std::ops::{Deref, DerefMut};
+use tari_template_abi::rust::ops::{Deref, DerefMut};
 
 use crate::{
     hex::{bytes_from_hex, bytes_to_hex},
diff --git a/crates/template_lib_types/src/max_string.rs b/crates/template_lib_types/src/max_string.rs
index c26fa8c1e6..f376099559 100644
--- a/crates/template_lib_types/src/max_string.rs
+++ b/crates/template_lib_types/src/max_string.rs
@@ -8,6 +8,7 @@ use tari_template_abi::rust::{
 };
 
 #[derive(Debug, Clone, PartialEq, Eq)]
+#[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
 pub struct MaxString<const N: usize> {
     s: Box<str>,
 }
@@ -21,8 +22,8 @@ impl<const N: usize> Deref for MaxString<N> {
 }
 
 impl<const N: usize> MaxString<N> {
-    pub fn new_checked(bytes: impl Into<Box<str>>) -> Option<Self> {
-        let s = bytes.into();
+    pub fn new_checked(s: impl Into<Box<str>>) -> Option<Self> {
+        let s = s.into();
         if s.len() <= N {
             Some(Self { s })
         } else {
@@ -60,7 +61,7 @@ impl<'de, const N: usize> serde::Deserialize<'de> for MaxString<N> {
     where D: serde::Deserializer<'de> {
         let s = String::deserialize(deserializer)?;
         let len = s.len();
-        MaxString::new_checked(s)
+        Self::new_checked(s)
             .ok_or_else(|| serde::de::Error::custom(format!("string length exceeds maximum of {}: got {}", N, len)))
     }
 }
@@ -69,7 +70,31 @@ impl<const N: usize> TryFrom<String> for MaxString<N> {
     type Error = MaxStringError<N>;
 
     fn try_from(value: String) -> Result<Self, Self::Error> {
-        MaxString::new_checked(value).ok_or(MaxStringError)
+        Self::new_checked(value).ok_or(MaxStringError)
+    }
+}
+
+impl<const N: usize> TryFrom<&String> for MaxString<N> {
+    type Error = MaxStringError<N>;
+
+    fn try_from(value: &String) -> Result<Self, Self::Error> {
+        Self::new_checked(value.as_str()).ok_or(MaxStringError)
+    }
+}
+
+impl<const N: usize> TryFrom<&str> for MaxString<N> {
+    type Error = MaxStringError<N>;
+
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        Self::new_checked(value).ok_or(MaxStringError)
+    }
+}
+
+impl<const N: usize> TryFrom<Box<str>> for MaxString<N> {
+    type Error = MaxStringError<N>;
+
+    fn try_from(value: Box<str>) -> Result<Self, Self::Error> {
+        Self::new_checked(value).ok_or(MaxStringError)
     }
 }
 
@@ -87,31 +112,18 @@ impl<const N: usize> Display for MaxStringError<N> {
     }
 }
 
-#[cfg(feature = "borsh")]
-mod borsh_impl {
-    use borsh::io::{Error, ErrorKind, Read, Result, Write};
+#[cfg(feature = "std")]
+mod std_impl {
+    use std::fmt;
 
     use super::*;
 
-    impl<const N: usize> borsh::BorshSerialize for MaxString<N> {
-        fn serialize<W: Write>(&self, writer: &mut W) -> Result<()> {
-            self.s.serialize(writer)
-        }
-    }
-
-    impl<const N: usize> borsh::BorshDeserialize for MaxString<N> {
-        fn deserialize_reader<R: Read>(reader: &mut R) -> Result<Self> {
-            let s = Box::<str>::deserialize_reader(reader)?;
-            if s.len() <= N {
-                Ok(Self { s })
-            } else {
-                Err(Error::new(
-                    ErrorKind::InvalidData,
-                    format!("string length exceeds maximum of {}: got {}", N, s.len()),
-                ))
-            }
+    impl<const N: usize> fmt::Debug for MaxStringError<N> {
+        fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+            write!(f, "MaxStringError<{}>", N)
         }
     }
+    impl<const N: usize> std::error::Error for MaxStringError<N> {}
 }
 
 #[cfg(test)]
diff --git a/crates/template_lib_types/src/max_vec.rs b/crates/template_lib_types/src/max_vec.rs
new file mode 100644
index 0000000000..a34b32b77a
--- /dev/null
+++ b/crates/template_lib_types/src/max_vec.rs
@@ -0,0 +1,172 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use tari_template_abi::rust::ops::{Deref, DerefMut};
+
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+#[cfg_attr(feature = "borsh", derive(borsh::BorshSerialize))]
+#[serde(transparent)]
+pub struct MaxVec<const N: usize, T> {
+    elems: Box<[T]>,
+}
+
+impl<const N: usize, T> Deref for MaxVec<N, T> {
+    type Target = [T];
+
+    fn deref(&self) -> &Self::Target {
+        &self.elems
+    }
+}
+
+impl<const N: usize, T> MaxVec<N, T> {
+    pub fn new_checked(elems: impl Into<Box<[T]>>) -> Option<Self> {
+        let elems = elems.into();
+        if elems.len() <= N {
+            Some(Self { elems })
+        } else {
+            None
+        }
+    }
+
+    /// Constructs a new `MaxVec<N>` without checking the length of the input.
+    /// This is the only way to break the invariant guarantees of `MaxVec<N>`.
+    /// NOTE: this exists for testing purposes and should not be used in general.
+    ///
+    /// # Safety
+    /// The caller must ensure that the length of `elems` is less than or equal to `N`.
+    pub unsafe fn new_unchecked(elems: impl Into<Box<[T]>>) -> Self {
+        Self { elems: elems.into() }
+    }
+
+    pub fn into_elems(self) -> Box<[T]> {
+        self.elems
+    }
+
+    pub fn into_vec(self) -> Vec<T> {
+        self.into_elems().into_vec()
+    }
+
+    pub fn empty() -> Self {
+        Self { elems: Box::new([]) }
+    }
+
+    pub fn as_slice(&self) -> &[T] {
+        &self.elems
+    }
+}
+
+impl<const N: usize, T> AsRef<[T]> for MaxVec<N, T> {
+    fn as_ref(&self) -> &[T] {
+        &self.elems
+    }
+}
+
+impl<const N: usize, T> DerefMut for MaxVec<N, T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        // Mutable but not resizeable
+        &mut self.elems
+    }
+}
+
+impl<const N: usize, T> Default for MaxVec<N, T> {
+    fn default() -> Self {
+        Self::empty()
+    }
+}
+
+impl<const N: usize, T> TryFrom<Vec<T>> for MaxVec<N, T> {
+    type Error = ();
+
+    fn try_from(value: Vec<T>) -> Result<Self, Self::Error> {
+        Self::new_checked(value).ok_or(())
+    }
+}
+
+impl<const N: usize, T> TryFrom<Box<[T]>> for MaxVec<N, T> {
+    type Error = ();
+
+    fn try_from(value: Box<[T]>) -> Result<Self, Self::Error> {
+        Self::new_checked(value).ok_or(())
+    }
+}
+
+impl<const N: usize, T> From<MaxVec<N, T>> for Vec<T> {
+    fn from(value: MaxVec<N, T>) -> Self {
+        value.into_vec()
+    }
+}
+
+impl<'de, const N: usize, T: serde::Deserialize<'de>> serde::Deserialize<'de> for MaxVec<N, T> {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where D: serde::Deserializer<'de> {
+        let elems: Vec<T> = serde::Deserialize::deserialize(deserializer)?;
+        let len = elems.len();
+        Self::new_checked(elems)
+            .ok_or_else(|| serde::de::Error::custom(format!("sequence length exceeds maximum of {}: got {}", N, len)))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    mod new_checked {
+        use super::*;
+
+        #[test]
+        fn it_returns_some_if_data_le_size() {
+            let b = vec![1, 2, 3];
+            let mb = MaxVec::<5, _>::new_checked(b).unwrap();
+            assert_eq!(mb.len(), 3);
+            assert_eq!(&mb[..], &[1, 2, 3]);
+        }
+
+        #[test]
+        fn it_returns_none_if_data_gt_size() {
+            let b = vec![1; 6];
+            let mb = MaxVec::<5, _>::new_checked(b);
+            assert!(mb.is_none());
+        }
+    }
+
+    mod serde_impl {
+        use tari_bor::Value;
+
+        use super::*;
+
+        #[test]
+        fn it_serializes_and_deserializes() {
+            let original = MaxVec::<5, _>::new_checked(vec![1, 2, 3, 4, 5]).unwrap();
+            let serialized = tari_bor::encode(&original).unwrap();
+            // Assert that it encodes to a BOR bytes value using the Bytes variant
+            let val: Value = tari_bor::decode(&serialized).unwrap();
+            assert_eq!(
+                val,
+                Value::Array(vec![
+                    Value::Integer(1.into()),
+                    Value::Integer(2.into()),
+                    Value::Integer(3.into()),
+                    Value::Integer(4.into()),
+                    Value::Integer(5.into()),
+                ])
+            );
+            // Now decode it back
+            let deserialized: MaxVec<5, _> = tari_bor::decode(&serialized).unwrap();
+            assert_eq!(original, deserialized);
+        }
+
+        #[test]
+        fn it_fails_to_deserialize_if_length_is_too_large() {
+            let json = "[1,2,3,4,5,6]"; // 6 elems, max is 5
+            let err: serde_json::Error = serde_json::from_str::<MaxVec<5, u8>>(json).unwrap_err();
+            assert!(err.to_string().contains("sequence length exceeds maximum"));
+
+            let bytes = MaxVec::<5, u8> {
+                elems: vec![1; 6].into_boxed_slice(),
+            };
+            let serialized = tari_bor::encode(&bytes).unwrap();
+            let err = tari_bor::decode::<MaxVec<5, u8>>(&serialized).unwrap_err();
+            assert!(err.to_string().contains("sequence length exceeds maximum"));
+        }
+    }
+}
diff --git a/crates/template_lib_types/src/misc.rs b/crates/template_lib_types/src/misc.rs
new file mode 100644
index 0000000000..70d95ddf5d
--- /dev/null
+++ b/crates/template_lib_types/src/misc.rs
@@ -0,0 +1,6 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use crate::MaxString;
+
+pub type FunctionName = MaxString<256>;
diff --git a/crates/template_test_tooling/src/read_only_state_store.rs b/crates/template_test_tooling/src/read_only_state_store.rs
index 17d2ae51f2..c5993d5276 100644
--- a/crates/template_test_tooling/src/read_only_state_store.rs
+++ b/crates/template_test_tooling/src/read_only_state_store.rs
@@ -92,6 +92,17 @@ impl<'a> ReadOnlyStateStore<'a> {
         Ok(substate.into_substate_value().into_utxo().unwrap())
     }
 
+    pub fn get_all_utxos(&self) -> Result<Vec<(UtxoAddress, Utxo)>, StateStoreError> {
+        let mut utxos = Vec::new();
+        self.with_substates(|id, substate| {
+            if let SubstateId::Utxo(utxo_addr) = id {
+                let utxo = substate.substate_value().as_utxo().unwrap();
+                utxos.push((utxo_addr.clone(), utxo.clone()));
+            }
+        })?;
+        Ok(utxos)
+    }
+
     pub fn inspect_component(&self, component_address: ComponentAddress) -> Result<IndexedValue, StateStoreError> {
         let component = self.get_component(component_address)?;
         Ok(IndexedValue::from_value(component.into_state()).unwrap())
diff --git a/crates/template_test_tooling/src/support/confidential.rs b/crates/template_test_tooling/src/support/confidential.rs
index 6dbaf8c32e..06b6312caa 100644
--- a/crates/template_test_tooling/src/support/confidential.rs
+++ b/crates/template_test_tooling/src/support/confidential.rs
@@ -8,7 +8,7 @@ use tari_crypto::{
     ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey},
 };
 use tari_engine_types::crypto::commit_amount_checked;
-use tari_ootle_wallet_crypto::{confidential, MaskAndValue, UnblindedOutputWitness};
+use tari_ootle_wallet_crypto::{confidential, MaskAndValue, OutputWitness};
 use tari_template_lib::{
     models::{ConfidentialOutputStatement, ConfidentialWithdrawProof},
     types::{Amount, EncryptedData},
@@ -35,7 +35,7 @@ fn generate_confidential_proof_internal(
     view_key: Option<RistrettoPublicKey>,
 ) -> (ConfidentialOutputStatement, PrivateKey, Option<PrivateKey>) {
     let mask = PrivateKey::random(&mut OsRng);
-    let output_statement = UnblindedOutputWitness {
+    let output_statement = OutputWitness {
         amount: output_amount,
         mask: mask.clone(),
         sender_public_nonce: Default::default(),
@@ -45,7 +45,7 @@ fn generate_confidential_proof_internal(
     };
 
     let change_mask = PrivateKey::random(&mut OsRng);
-    let change_statement = change.map(|amount| UnblindedOutputWitness {
+    let change_statement = change.map(|amount| OutputWitness {
         amount,
         mask: change_mask.clone(),
         sender_public_nonce: Default::default(),
@@ -152,7 +152,7 @@ fn generate_withdraw_proof_internal(
     };
     let change_mask = change_amount.map(|_| PrivateKey::random(&mut OsRng));
 
-    let output_proof = UnblindedOutputWitness {
+    let output_proof = OutputWitness {
         amount: output_amount,
         mask: output_mask.clone(),
         sender_public_nonce: Default::default(),
@@ -160,7 +160,7 @@ fn generate_withdraw_proof_internal(
         encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
         resource_view_key: view_key.clone(),
     };
-    let change_proof = change_amount.map(|amount| UnblindedOutputWitness {
+    let change_proof = change_amount.map(|amount| OutputWitness {
         amount,
         mask: change_mask.clone().unwrap(),
         sender_public_nonce: Default::default(),
diff --git a/crates/template_test_tooling/src/support/mod.rs b/crates/template_test_tooling/src/support/mod.rs
index 36021c3fef..1b495cd816 100644
--- a/crates/template_test_tooling/src/support/mod.rs
+++ b/crates/template_test_tooling/src/support/mod.rs
@@ -3,6 +3,7 @@
 
 pub mod assert_error;
 pub mod confidential;
+pub mod spec;
 pub mod stealth;
 
 pub use tari_ootle_wallet_crypto::GenerateValueLookup;
diff --git a/crates/template_test_tooling/src/support/spec.rs b/crates/template_test_tooling/src/support/spec.rs
new file mode 100644
index 0000000000..65f4909560
--- /dev/null
+++ b/crates/template_test_tooling/src/support/spec.rs
@@ -0,0 +1,67 @@
+//   Copyright 2025 The Tari Project
+//   SPDX-License-Identifier: BSD-3-Clause
+
+use tari_ootle_wallet_crypto::MaskAndValue;
+use tari_template_lib::models::SpendCondition;
+
+pub struct OutputSpec {
+    value: u64,
+    spend_condition_spec: SpendConditionSpec,
+}
+
+impl OutputSpec {
+    pub fn signed_by(value: u64) -> Self {
+        Self {
+            value,
+            spend_condition_spec: SpendConditionSpec::SignedBy,
+        }
+    }
+
+    pub fn value(&self) -> u64 {
+        self.value
+    }
+
+    pub fn spend_condition_spec(&self) -> &SpendConditionSpec {
+        &self.spend_condition_spec
+    }
+}
+
+impl From<u64> for OutputSpec {
+    fn from(amount: u64) -> Self {
+        Self::signed_by(amount)
+    }
+}
+
+impl From<(u64, SpendCondition)> for OutputSpec {
+    fn from((value, spend_condition): (u64, SpendCondition)) -> Self {
+        Self {
+            value,
+            spend_condition_spec: SpendConditionSpec::Specified(spend_condition),
+        }
+    }
+}
+
+pub enum SpendConditionSpec {
+    SignedBy,
+    Specified(SpendCondition),
+}
+
+pub struct InputSpec {
+    mask_and_value: MaskAndValue,
+}
+
+impl InputSpec {
+    pub fn new(mask_and_value: MaskAndValue) -> Self {
+        Self { mask_and_value }
+    }
+
+    pub fn mask_and_value(&self) -> &MaskAndValue {
+        &self.mask_and_value
+    }
+}
+
+impl From<MaskAndValue> for InputSpec {
+    fn from(mask_and_value: MaskAndValue) -> Self {
+        Self::new(mask_and_value)
+    }
+}
diff --git a/crates/template_test_tooling/src/support/stealth.rs b/crates/template_test_tooling/src/support/stealth.rs
index 94420fab53..aa8cc6f03a 100644
--- a/crates/template_test_tooling/src/support/stealth.rs
+++ b/crates/template_test_tooling/src/support/stealth.rs
@@ -1,6 +1,8 @@
 //   Copyright 2025 The Tari Project
 //   SPDX-License-Identifier: BSD-3-Clause
 
+use std::iter;
+
 use rand::rngs::OsRng;
 use tari_crypto::{
     keys::{PublicKey, SecretKey},
@@ -13,12 +15,12 @@ use tari_engine_types::{
 use tari_ootle_wallet_crypto::{
     stealth,
     MaskAndValue,
-    UnblindedOutputWitness,
-    UnblindedStealthInputWitness,
-    UnblindedStealthOutputWitness,
+    OutputWitness,
+    SecretStealthOutputStatement,
+    StealthInputWitness,
 };
 use tari_template_lib::{
-    models::{StealthOutputsStatement, StealthTransferStatement},
+    models::{SpendCondition, StealthOutputsStatement, StealthTransferStatement},
     prelude::{crypto::ValueKnowledgeProof, RistrettoPublicKeyBytes},
     types::{
         crypto::{StealthValueProof, UtxoTag},
@@ -27,6 +29,8 @@ use tari_template_lib::{
     },
 };
 
+use crate::support::spec::{InputSpec, OutputSpec, SpendConditionSpec};
+
 pub fn generate_stealth_output_statement<I: IntoIterator<Item = u64>, A: Into<Amount>>(
     output_amounts: I,
     revealed_output_amount: A,
@@ -38,31 +42,31 @@ pub fn generate_stealth_output_statement<I: IntoIterator<Item = u64>, A: Into<Am
     )
 }
 
-pub fn generate_mint_statement<I: IntoIterator<Item = u64>, A: Into<Amount> + Copy>(
+pub fn generate_mint_statement<I: IntoIterator<Item = OS>, OS: Into<OutputSpec>, A: Into<Amount> + Copy>(
     stealth_output_amounts: I,
     revealed_output_amount: A,
     view_key: Option<&RistrettoPublicKey>,
-    required_signer: RistrettoPublicKeyBytes,
-) -> StealthUnblindedTransferData {
-    let stealth_output_amounts = stealth_output_amounts.into_iter().collect::<Vec<_>>();
-    let total_revealed_inputs =
-        stealth_output_amounts.iter().copied().map(Amount::from).sum::<Amount>() + revealed_output_amount.into();
+) -> StealthSecretTransferData {
+    let stealth_output_amounts = stealth_output_amounts.into_iter().map(Into::into).collect::<Vec<_>>();
+    let total_revealed_inputs = stealth_output_amounts
+        .iter()
+        .map(|os| Amount::from(os.value()))
+        .sum::<Amount>() +
+        revealed_output_amount.into();
     match view_key {
         Some(view_key) => generate_transfer_data_with_view_key(
-            &[],
+            iter::empty::<InputSpec>(),
             total_revealed_inputs,
             stealth_output_amounts,
             revealed_output_amount.into(),
             view_key,
-            required_signer,
         ),
 
         None => generate_transfer_data(
-            &[],
+            iter::empty::<InputSpec>(),
             total_revealed_inputs,
             stealth_output_amounts,
             revealed_output_amount.into(),
-            required_signer,
         ),
     }
 }
@@ -91,8 +95,8 @@ fn generate_stealth_statement_internal(
     let output_statements = output_amounts
         .iter()
         .zip(&masks)
-        .map(|(amount, mask)| UnblindedStealthOutputWitness {
-            witness: UnblindedOutputWitness {
+        .map(|(amount, mask)| SecretStealthOutputStatement {
+            witness: OutputWitness {
                 amount: *amount,
                 mask: mask.clone(),
                 sender_public_nonce: test_sender_public_nonce(),
@@ -100,7 +104,7 @@ fn generate_stealth_statement_internal(
                 encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
                 resource_view_key: view_key.clone(),
             },
-            output_owner_public_key: RistrettoPublicKey::from_secret_key(mask),
+            spend_condition: SpendCondition::Signed(RistrettoPublicKey::from_secret_key(mask).to_byte_type()),
             tag: UtxoTag::new(0),
         })
         .collect::<Vec<_>>();
@@ -109,47 +113,50 @@ fn generate_stealth_statement_internal(
     (stmt, masks)
 }
 
-pub struct StealthUnblindedTransferData {
+pub struct StealthSecretTransferData {
     pub output_masks: Vec<RistrettoSecretKey>,
     pub statement: StealthTransferStatement,
 }
 
-pub fn generate_transfer_data<O, A>(
-    inputs: &[MaskAndValue],
+pub const NO_INPUTS: iter::Empty<MaskAndValue> = iter::empty();
+pub fn generate_transfer_data<O, A, OS, IS, II>(
+    inputs: II,
     revealed_input_amount: A,
-    output_amounts: O,
+    outputs: O,
     revealed_output_amount: A,
-    required_signer: RistrettoPublicKeyBytes,
-) -> StealthUnblindedTransferData
+) -> StealthSecretTransferData
 where
-    O: IntoIterator<Item = u64>,
+    O: IntoIterator<Item = OS>,
+    OS: Into<OutputSpec>,
     A: Into<Amount>,
+    II: IntoIterator<Item = IS>,
+    II::IntoIter: ExactSizeIterator,
+    IS: Into<InputSpec>,
 {
-    generate_transfer_data_internal(
-        inputs,
-        revealed_input_amount,
-        output_amounts,
-        revealed_output_amount,
-        None,
-        required_signer,
-    )
+    generate_transfer_data_internal(inputs, revealed_input_amount, outputs, revealed_output_amount, None)
 }
 
-pub fn generate_transfer_data_with_view_key<I: IntoIterator<Item = u64>, A: Into<Amount>>(
-    inputs: &[MaskAndValue],
+pub fn generate_transfer_data_with_view_key<IO, OS, A, II, IS>(
+    inputs: II,
     revealed_input_amount: A,
-    output_amounts: I,
+    outputs: IO,
     revealed_output_amount: A,
     view_key: &RistrettoPublicKey,
-    required_signer: RistrettoPublicKeyBytes,
-) -> StealthUnblindedTransferData {
+) -> StealthSecretTransferData
+where
+    IO: IntoIterator<Item = OS>,
+    OS: Into<OutputSpec>,
+    A: Into<Amount>,
+    II: IntoIterator<Item = IS>,
+    II::IntoIter: ExactSizeIterator,
+    IS: Into<InputSpec>,
+{
     generate_transfer_data_internal(
         inputs,
         revealed_input_amount,
-        output_amounts,
+        outputs,
         revealed_output_amount,
         Some(view_key.clone()),
-        required_signer,
     )
 }
 
@@ -164,24 +171,30 @@ pub fn test_sender_public_nonce() -> RistrettoPublicKey {
     test_sender_nonce_keypair().1
 }
 
-fn generate_transfer_data_internal<I: IntoIterator<Item = u64>, A: Into<Amount>>(
-    inputs: &[MaskAndValue],
+fn generate_transfer_data_internal<IO, OS, A, II, IS>(
+    inputs: II,
     revealed_input_amount: A,
-    output_amounts: I,
+    outputs: IO,
     revealed_output_amount: A,
     view_key: Option<RistrettoPublicKey>,
-    required_signer: RistrettoPublicKeyBytes,
-) -> StealthUnblindedTransferData {
-    let outputs = output_amounts
+) -> StealthSecretTransferData
+where
+    IO: IntoIterator<Item = OS>,
+    OS: Into<OutputSpec>,
+    A: Into<Amount>,
+    II: IntoIterator<Item = IS>,
+    II::IntoIter: ExactSizeIterator,
+    IS: Into<InputSpec>,
+{
+    let outputs = outputs
         .into_iter()
-        .filter(|&a| a > 0)
-        .map(|amount| {
+        .map(Into::into)
+        .filter(|os| os.value() > 0)
+        .map(|spec| {
             let output_mask = RistrettoSecretKey::random(&mut OsRng);
-            // For testing purposes, we use the mask as the owner key
-            let output_owner_public_key = RistrettoPublicKey::from_secret_key(&output_mask);
-            let statement = UnblindedOutputWitness {
-                amount,
-                mask: output_mask,
+            let statement = OutputWitness {
+                amount: spec.value(),
+                mask: output_mask.clone(),
                 resource_view_key: view_key.clone(),
                 // This is client/wallet on-chain data and not required for spending in tests
                 sender_public_nonce: test_sender_public_nonce(),
@@ -189,37 +202,40 @@ fn generate_transfer_data_internal<I: IntoIterator<Item = u64>, A: Into<Amount>>
                 encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
             };
 
-            UnblindedStealthOutputWitness {
+            let spend_condition = match spec.spend_condition_spec() {
+                SpendConditionSpec::SignedBy => {
+                    // For testing purposes, we use the mask as the owner key
+                    let output_owner_public_key = RistrettoPublicKey::from_secret_key(&output_mask);
+                    SpendCondition::Signed(output_owner_public_key.to_byte_type())
+                },
+                SpendConditionSpec::Specified(cond) => cond.clone(),
+            };
+
+            SecretStealthOutputStatement {
                 witness: statement,
-                output_owner_public_key,
+                spend_condition,
                 tag: UtxoTag::new(0),
             }
         })
         .collect::<Vec<_>>();
 
-    let inputs = inputs
-        .iter()
-        .map(|input| {
-            let mask_and_value = input.clone();
-            UnblindedStealthInputWitness {
-                mask_and_value,
-                // For testing purposes, we use the mask as the owner key
-                owner_secret: input.mask.clone(),
-                public_nonce: test_sender_public_nonce(),
-            }
-        })
-        .collect::<Vec<_>>();
+    let inputs = inputs.into_iter().map(Into::into).map(|input| {
+        let mask_and_value = input.mask_and_value().clone();
+        StealthInputWitness {
+            mask_and_value,
+            public_nonce: test_sender_public_nonce(),
+        }
+    });
 
     let transfer = stealth::create_transfer_statement(
-        inputs.iter(),
+        inputs,
         revealed_input_amount.into(),
         outputs.iter(),
         revealed_output_amount.into(),
-        required_signer,
     )
     .unwrap();
 
-    StealthUnblindedTransferData {
+    StealthSecretTransferData {
         output_masks: outputs.into_iter().map(|m| m.witness.mask).collect(),
         statement: transfer,
     }
diff --git a/crates/template_test_tooling/src/template_test.rs b/crates/template_test_tooling/src/template_test.rs
index c3b4987d31..d039efc399 100644
--- a/crates/template_test_tooling/src/template_test.rs
+++ b/crates/template_test_tooling/src/template_test.rs
@@ -352,7 +352,7 @@ impl TemplateTest {
             .execute_and_commit(
                 vec![Instruction::CallFunction {
                     address: self.get_template_address(template_name),
-                    function: func_name.to_owned(),
+                    function: func_name.to_string().try_into().unwrap(),
                     args,
                 }],
                 proofs,
@@ -382,7 +382,7 @@ impl TemplateTest {
             .execute_and_commit(
                 vec![Instruction::CallMethod {
                     call: component_address.into(),
-                    method: method_name.to_owned(),
+                    method: method_name.try_into().unwrap(),
                     args,
                 }],
                 proofs,
@@ -588,7 +588,7 @@ impl TemplateTest {
         }
 
         let auth_params = AuthParams {
-            initial_ownership_proofs: proofs,
+            initial_ownership_proofs: Arc::new(proofs.into_iter().collect()),
         };
 
         let processor = TransactionProcessor::new(
diff --git a/crates/transaction/Cargo.toml b/crates/transaction/Cargo.toml
index 13506e6156..69afab9ed9 100644
--- a/crates/transaction/Cargo.toml
+++ b/crates/transaction/Cargo.toml
@@ -11,7 +11,7 @@ license.workspace = true
 tari_engine_types = { workspace = true }
 tari_ootle_common_types = { workspace = true }
 tari_crypto = { workspace = true, features = ["borsh"] }
-tari_template_lib = { workspace = true }
+tari_template_lib = { workspace = true, features = ["std"] }
 tari_bor = { workspace = true }
 tari_hashing = { workspace = true }
 
diff --git a/crates/transaction/src/builder/mod.rs b/crates/transaction/src/builder/mod.rs
index 9c1d4e1c6a..f90fd5eb8b 100644
--- a/crates/transaction/src/builder/mod.rs
+++ b/crates/transaction/src/builder/mod.rs
@@ -22,7 +22,7 @@ use tari_template_lib::{
     auth::OwnerRule,
     models::{ResourceAddress, StealthTransferStatement},
     prelude::AccessRules,
-    types::{crypto::RistrettoPublicKeyBytes, Amount, TemplateAddress},
+    types::{crypto::RistrettoPublicKeyBytes, Amount, FunctionName, TemplateAddress},
 };
 
 use crate::{
@@ -87,7 +87,7 @@ impl TransactionBuilder {
 
     pub fn with_authorized_seal_signer(mut self) -> Self {
         self.unsigned_transaction = self.unsigned_transaction.authorized_sealed_signer();
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
@@ -108,7 +108,7 @@ impl TransactionBuilder {
     ) -> Self {
         self.add_fee_instruction(Instruction::CallMethod {
             call: call.into(),
-            method: "pay_fee".to_string(),
+            method: "pay_fee".try_into().expect("Method name is longer than the limit"),
             args: call_args![max_fee.into().non_negative_checked().expect("Negative fee not allowed")],
         })
     }
@@ -123,7 +123,9 @@ impl TransactionBuilder {
     ) -> Self {
         self.add_fee_instruction(Instruction::CallMethod {
             call: call.into(),
-            method: "pay_fee_stealth".to_string(),
+            method: "pay_fee_stealth"
+                .try_into()
+                .expect("Method name is longer than the limit"),
             args: call_args![statement],
         })
     }
@@ -167,31 +169,34 @@ impl TransactionBuilder {
         })
     }
 
-    pub fn call_function<T: Into<String>>(
-        self,
-        template_address: TemplateAddress,
-        function: T,
-        args: Vec<NamedArg>,
-    ) -> Self {
+    pub fn call_function<T>(self, template_address: TemplateAddress, function: T, args: Vec<NamedArg>) -> Self
+    where
+        T: TryInto<FunctionName>,
+        <T as TryInto<FunctionName>>::Error: std::fmt::Debug,
+    {
         let args = self.resolve_args(args).expect("Invalid named arguments");
         self.add_instruction(Instruction::CallFunction {
             address: template_address,
-            function: function.into(),
+            function: function
+                .try_into()
+                .expect("Oops! The provided function name is longer than the limit"),
             args,
         })
     }
 
-    pub fn call_method<A: Into<NamedComponentCall>, T: Into<String>>(
-        self,
-        call: A,
-        method: T,
-        args: Vec<NamedArg>,
-    ) -> Self {
+    pub fn call_method<A, T>(self, call: A, method: T, args: Vec<NamedArg>) -> Self
+    where
+        A: Into<NamedComponentCall>,
+        T: TryInto<FunctionName>,
+        <T as TryInto<FunctionName>>::Error: std::fmt::Debug,
+    {
         let call = self.resolve_call(call.into());
         let args = self.resolve_args(args).expect("Invalid named arguments");
         self.add_instruction(Instruction::CallMethod {
             call,
-            method: method.into(),
+            method: method
+                .try_into()
+                .expect("Oops! The provided method name is longer than the limit"),
             args,
         })
     }
@@ -306,7 +311,9 @@ impl TransactionBuilder {
         // We may want to make this a native instruction
         self.add_instruction(Instruction::CallMethod {
             call: account.into(),
-            method: "create_proof_for_resource".to_string(),
+            method: "create_proof_for_resource"
+                .try_into()
+                .expect("Method name is longer than the limit"),
             args: call_args![resource_addr],
         })
     }
@@ -314,7 +321,7 @@ impl TransactionBuilder {
     pub fn with_fee_instructions<I: IntoIterator<Item = Instruction>>(mut self, instructions: I) -> Self {
         self.unsigned_transaction.fee_instructions_mut().extend(instructions);
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
@@ -324,29 +331,28 @@ impl TransactionBuilder {
         self.unsigned_transaction
             .fee_instructions_mut()
             .extend(builder.unsigned_transaction.into_instructions());
-        // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
     pub fn add_fee_instruction(mut self, instruction: Instruction) -> Self {
         self.unsigned_transaction.fee_instructions_mut().push(instruction);
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
     pub fn add_instruction(mut self, instruction: Instruction) -> Self {
         self.unsigned_transaction.instructions_mut().push(instruction);
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
     pub fn with_instructions<I: IntoIterator<Item = Instruction>>(mut self, instructions: I) -> Self {
         self.unsigned_transaction.instructions_mut().extend(instructions);
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
@@ -354,14 +360,14 @@ impl TransactionBuilder {
     pub fn add_input<I: Into<SubstateRequirement>>(mut self, input_object: I) -> Self {
         self.unsigned_transaction.inputs_mut().insert(input_object.into());
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
     pub fn with_inputs<I: IntoIterator<Item = SubstateRequirement>>(mut self, inputs: I) -> Self {
         self.unsigned_transaction = self.unsigned_transaction.with_inputs(inputs);
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
@@ -372,14 +378,14 @@ impl TransactionBuilder {
     pub fn with_min_epoch(mut self, min_epoch: Option<Epoch>) -> Self {
         self.unsigned_transaction.set_min_epoch(min_epoch);
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
     pub fn with_max_epoch(mut self, max_epoch: Option<Epoch>) -> Self {
         self.unsigned_transaction.set_max_epoch(max_epoch);
         // Reset the signatures as they are no longer valid
-        self.clear_signatures();
+        self.panic_if_signed();
         self
     }
 
@@ -427,11 +433,16 @@ impl TransactionBuilder {
         &self.signatures
     }
 
-    fn clear_signatures(&mut self) {
-        self.signatures = vec![];
+    #[track_caller]
+    fn panic_if_signed(&mut self) {
+        // TODO: use the type system to prevent this. Right now, IMO (debatable) it's better to panic than to allow the
+        // builder to potentially produce invalid transactions or unexpected results.
+        if !self.signatures.is_empty() {
+            panic!("Cannot modify a TransactionBuilder after signatures have been added");
+        }
     }
 
-    pub fn build(self) -> UnsealedTransactionV1 {
+    pub fn finish(self) -> UnsealedTransactionV1 {
         let builder = self.then(|builder| {
             // This is so that we dont have to add this in a lot of places - TODO: this is an assumption that may not
             // apply to all transactions
@@ -442,11 +453,11 @@ impl TransactionBuilder {
             }
         });
 
-        builder.unsigned_transaction.build_with_signatures(builder.signatures)
+        builder.unsigned_transaction.with_signatures(builder.signatures)
     }
 
     pub fn build_and_seal(self, secret_key: &RistrettoSecretKey) -> Transaction {
-        self.build().seal(secret_key)
+        self.finish().seal(secret_key)
     }
 
     fn resolve_call(&self, call: NamedComponentCall) -> ComponentCall {
@@ -505,8 +516,8 @@ impl TransactionBuilder {
 impl Signable<&RistrettoPublicKeyBytes> for TransactionBuilder {
     type MessageOutput = [u8; 64];
 
-    fn as_signing_message(&self, sealed_signer: &RistrettoPublicKeyBytes) -> Self::MessageOutput {
-        self.unsigned_transaction.as_signing_message(sealed_signer)
+    fn to_signing_message(&self, sealed_signer: &RistrettoPublicKeyBytes) -> Self::MessageOutput {
+        self.unsigned_transaction.to_signing_message(sealed_signer)
     }
 }
 
diff --git a/crates/transaction/src/builder/tests.rs b/crates/transaction/src/builder/tests.rs
index b8e9d6166f..d7200c15ab 100644
--- a/crates/transaction/src/builder/tests.rs
+++ b/crates/transaction/src/builder/tests.rs
@@ -44,7 +44,7 @@ fn it_converts_workspace_names_to_ids() {
     });
     assert_eq!(transaction.instructions()[3], Instruction::CallFunction {
         address: TemplateAddress::default(),
-        function: "do_something".to_string(),
+        function: "do_something".try_into().unwrap(),
         args: vec![
             InstructionArg::Workspace(WorkspaceOffsetId::new(0)),
             InstructionArg::from_type(&"thing2").unwrap(),
@@ -54,7 +54,7 @@ fn it_converts_workspace_names_to_ids() {
     });
     assert_eq!(transaction.instructions()[4], Instruction::CallMethod {
         call: ComponentCall::Workspace(2),
-        method: "do_something_else".to_string(),
+        method: "do_something_else".try_into().unwrap(),
         args: vec![InstructionArg::Workspace(WorkspaceOffsetId::new(0))]
     });
 }
diff --git a/crates/transaction/src/unsigned_transaction.rs b/crates/transaction/src/unsigned_transaction.rs
index a20b06dbdc..68c71d2af9 100644
--- a/crates/transaction/src/unsigned_transaction.rs
+++ b/crates/transaction/src/unsigned_transaction.rs
@@ -5,8 +5,9 @@ use std::collections::HashSet;
 
 use indexmap::IndexSet;
 use serde::{Deserialize, Serialize};
-use tari_engine_types::{indexed_value::IndexedValueError, substate::SubstateId};
-use tari_ootle_common_types::{Epoch, Signable, SubstateRequirement};
+use tari_crypto::ristretto::{RistrettoPublicKey, RistrettoSchnorr, RistrettoSecretKey};
+use tari_engine_types::{indexed_value::IndexedValueError, substate::SubstateId, ToByteType};
+use tari_ootle_common_types::{Epoch, IntoSigned, Signable, SubstateRequirement};
 use tari_template_lib::{models::ComponentAddress, prelude::RistrettoPublicKeyBytes};
 
 use crate::{Instruction, TransactionSignature, UnsealedTransactionV1, UnsignedTransactionV1};
@@ -129,15 +130,31 @@ impl UnsignedTransaction {
         self
     }
 
-    pub fn build_with_signatures(self, signatures: Vec<TransactionSignature>) -> UnsealedTransactionV1 {
+    pub fn add_signer(
+        mut self,
+        seal_signer: &RistrettoPublicKeyBytes,
+        key: &RistrettoSecretKey,
+    ) -> UnsealedTransactionV1 {
+        match &mut self {
+            Self::V1(tx) => UnsealedTransactionV1::new(tx.clone(), vec![]).add_signer(seal_signer, key),
+        }
+    }
+
+    pub fn add_signature(mut self, signature: TransactionSignature) -> UnsealedTransactionV1 {
+        match &mut self {
+            Self::V1(tx) => UnsealedTransactionV1::new(tx.clone(), vec![signature]),
+        }
+    }
+
+    pub fn with_signatures(self, signatures: Vec<TransactionSignature>) -> UnsealedTransactionV1 {
         // Obviously this will not work if we have more than one version - dealing with that is left for another time
         match self {
             UnsignedTransaction::V1(tx) => UnsealedTransactionV1::new(tx, signatures),
         }
     }
 
-    pub fn build(self) -> UnsealedTransactionV1 {
-        self.build_with_signatures(vec![])
+    pub fn finish(self) -> UnsealedTransactionV1 {
+        self.with_signatures(vec![])
     }
 
     pub(crate) fn inputs_mut(&mut self) -> &mut IndexSet<SubstateRequirement> {
@@ -162,9 +179,20 @@ impl Default for UnsignedTransaction {
 impl Signable<&RistrettoPublicKeyBytes> for UnsignedTransaction {
     type MessageOutput = [u8; 64];
 
-    fn as_signing_message(&self, sealed_signer: &RistrettoPublicKeyBytes) -> Self::MessageOutput {
+    fn to_signing_message(&self, sealed_signer: &RistrettoPublicKeyBytes) -> Self::MessageOutput {
         match &self {
-            Self::V1(tx) => tx.as_signing_message(sealed_signer),
+            Self::V1(tx) => tx.to_signing_message(sealed_signer),
         }
     }
 }
+
+impl IntoSigned<&RistrettoPublicKeyBytes> for UnsignedTransaction {
+    type SignedOutput = UnsealedTransactionV1;
+
+    fn into_signed(self, public_key: RistrettoPublicKey, signature: RistrettoSchnorr) -> Self::SignedOutput {
+        self.add_signature(TransactionSignature::new(
+            public_key.to_byte_type(),
+            signature.to_byte_type(),
+        ))
+    }
+}
diff --git a/crates/transaction/src/v1/instruction.rs b/crates/transaction/src/v1/instruction.rs
index fe81a139e6..aa0068ba88 100644
--- a/crates/transaction/src/v1/instruction.rs
+++ b/crates/transaction/src/v1/instruction.rs
@@ -16,7 +16,7 @@ use tari_template_lib::{
     auth::OwnerRule,
     models::{ResourceAddress, StealthTransferStatement},
     prelude::{AccessRules, Amount},
-    types::{crypto::RistrettoPublicKeyBytes, MaxString, TemplateAddress},
+    types::{crypto::RistrettoPublicKeyBytes, FunctionName, MaxString, TemplateAddress},
 };
 
 use crate::{
@@ -37,14 +37,16 @@ pub enum Instruction {
     },
     CallFunction {
         address: TemplateAddress,
-        function: String,
+        #[cfg_attr(feature = "ts", ts(type = "string"))]
+        function: FunctionName,
         #[serde(deserialize_with = "crate::special_json_arg_syntax::json_deserialize")]
         #[cfg_attr(feature = "ts", ts(type = "Array<any>"))]
         args: Vec<InstructionArg>,
     },
     CallMethod {
         call: ComponentCall,
-        method: String,
+        #[cfg_attr(feature = "ts", ts(type = "string"))]
+        method: FunctionName,
         // TODO: remove this as it causes tricky issues that are hard to track down (typically Signature errors).
         // Rather have clients provide raw arguments using CBOR.
         #[serde(deserialize_with = "crate::special_json_arg_syntax::json_deserialize")]
@@ -259,7 +261,7 @@ mod tests {
     fn decode_encode() {
         let instruction = Instruction::CallFunction {
             address: Default::default(),
-            function: "test".to_string(),
+            function: "test".try_into().unwrap(),
             args: call_args![("A", "B"), 123u64, true, vec![1, 2, 3]],
         };
         let json = serde_json::to_string(&instruction).unwrap();
diff --git a/crates/transaction/src/v1/signature.rs b/crates/transaction/src/v1/signature.rs
index 0037c6821b..c7f5f49e1f 100644
--- a/crates/transaction/src/v1/signature.rs
+++ b/crates/transaction/src/v1/signature.rs
@@ -89,7 +89,7 @@ impl TransactionSignature {
         transaction: &UnsignedTransactionV1,
     ) -> Self {
         let public_key = RistrettoPublicKey::from_secret_key(secret_key);
-        let message = Self::create_message(1, seal_signer, transaction);
+        let message = Self::create_message_v1(1, seal_signer, transaction);
 
         Self {
             signature: RistrettoSchnorr::sign(secret_key, message, &mut OsRng)
@@ -100,7 +100,7 @@ impl TransactionSignature {
     }
 
     pub fn verify_v1(&self, seal_signer: &RistrettoPublicKeyBytes, transaction: &UnsignedTransactionV1) -> bool {
-        let message = Self::create_message(1, seal_signer, transaction);
+        let message = Self::create_message_v1(1, seal_signer, transaction);
         let Ok(public_key) = self.public_key.try_from_byte_type() else {
             return false;
         };
@@ -118,7 +118,7 @@ impl TransactionSignature {
         &self.public_key
     }
 
-    pub fn create_message(
+    pub fn create_message_v1(
         schema_version: u16,
         seal_signer: &RistrettoPublicKeyBytes,
         transaction: &UnsignedTransactionV1,
diff --git a/crates/transaction/src/v1/unsealed.rs b/crates/transaction/src/v1/unsealed.rs
index 21f1c847fe..93e6cec987 100644
--- a/crates/transaction/src/v1/unsealed.rs
+++ b/crates/transaction/src/v1/unsealed.rs
@@ -8,7 +8,11 @@ use serde::{Deserialize, Serialize};
 use tari_crypto::ristretto::{RistrettoPublicKey, RistrettoSchnorr, RistrettoSecretKey};
 use tari_engine_types::{indexed_value::IndexedValueError, substate::SubstateId, ToByteType};
 use tari_ootle_common_types::{Epoch, IntoSigned, Signable, SubstateRequirement};
-use tari_template_lib::{models::ComponentAddress, types::crypto::RistrettoPublicKeyBytes};
+use tari_template_lib::{
+    models::ComponentAddress,
+    prelude::SchnorrSignatureBytes,
+    types::crypto::RistrettoPublicKeyBytes,
+};
 
 use crate::{
     v1::{signature::TransactionSignature, transaction::TransactionV1, unsigned::UnsignedTransactionV1},
@@ -47,12 +51,17 @@ impl UnsealedTransactionV1 {
         TransactionV1::new(self, signature).into()
     }
 
-    pub fn add_signature(mut self, seal_signer: &RistrettoPublicKeyBytes, secret: &RistrettoSecretKey) -> Self {
+    pub fn add_signer(mut self, seal_signer: &RistrettoPublicKeyBytes, secret: &RistrettoSecretKey) -> Self {
         let sig = TransactionSignature::sign_v1(secret, seal_signer, &self.transaction);
         self.signatures.push(sig);
         self
     }
 
+    pub fn add_signature(mut self, public_key: RistrettoPublicKeyBytes, signature: SchnorrSignatureBytes) -> Self {
+        self.signatures.push(TransactionSignature::new(public_key, signature));
+        self
+    }
+
     pub fn is_dry_run(&self) -> bool {
         self.transaction.dry_run
     }
@@ -122,11 +131,19 @@ impl UnsealedTransactionV1 {
 impl Signable for UnsealedTransactionV1 {
     type MessageOutput = [u8; 64];
 
-    fn as_signing_message(&self, _context: ()) -> Self::MessageOutput {
+    fn to_signing_message(&self, _context: ()) -> Self::MessageOutput {
         TransactionSealSignature::create_message(self)
     }
 }
 
+impl Signable<&RistrettoPublicKeyBytes> for UnsealedTransactionV1 {
+    type MessageOutput = [u8; 64];
+
+    fn to_signing_message(&self, context: &RistrettoPublicKeyBytes) -> Self::MessageOutput {
+        TransactionSignature::create_message_v1(1, context, &self.transaction)
+    }
+}
+
 impl IntoSigned for UnsealedTransactionV1 {
     type SignedOutput = Transaction;
 
@@ -137,3 +154,11 @@ impl IntoSigned for UnsealedTransactionV1 {
         ))
     }
 }
+
+impl IntoSigned<&RistrettoPublicKeyBytes> for UnsealedTransactionV1 {
+    type SignedOutput = Self;
+
+    fn into_signed(self, public_key: RistrettoPublicKey, signature: RistrettoSchnorr) -> Self::SignedOutput {
+        self.add_signature(public_key.to_byte_type(), signature.to_byte_type())
+    }
+}
diff --git a/crates/transaction/src/v1/unsigned.rs b/crates/transaction/src/v1/unsigned.rs
index b74da0b7a0..e8ebfe357e 100644
--- a/crates/transaction/src/v1/unsigned.rs
+++ b/crates/transaction/src/v1/unsigned.rs
@@ -178,7 +178,7 @@ impl UnsignedTransactionV1 {
 impl Signable<&RistrettoPublicKeyBytes> for UnsignedTransactionV1 {
     type MessageOutput = [u8; 64];
 
-    fn as_signing_message(&self, seal_signer: &RistrettoPublicKeyBytes) -> Self::MessageOutput {
-        TransactionSignature::create_message(1, seal_signer, self)
+    fn to_signing_message(&self, seal_signer: &RistrettoPublicKeyBytes) -> Self::MessageOutput {
+        TransactionSignature::create_message_v1(1, seal_signer, self)
     }
 }
diff --git a/crates/transaction_manifest/src/generator.rs b/crates/transaction_manifest/src/generator.rs
index 8f17b2264e..8f1a5d47ed 100644
--- a/crates/transaction_manifest/src/generator.rs
+++ b/crates/transaction_manifest/src/generator.rs
@@ -90,7 +90,12 @@ impl ManifestInstructionGenerator {
                     .expect("AST parse should have failed: no template ident for TemplateInvoke statement");
                 let mut instructions = vec![Instruction::CallFunction {
                     address: self.get_imported_template(template_ident)?,
-                    function: function_name.to_string(),
+                    function: function_name
+                        .to_string()
+                        .try_into()
+                        .map_err(|e| ManifestError::InvalidInstruction {
+                            reason: format!("Function name is too long: {}", e),
+                        })?,
                     args: self.process_args(arguments)?,
                 }];
                 if let Some(var_name) = output_variable {
@@ -122,7 +127,12 @@ impl ManifestInstructionGenerator {
                     })?;
                 let mut instructions = vec![Instruction::CallMethod {
                     call: component_address.into(),
-                    method: function_name.to_string(),
+                    method: function_name
+                        .to_string()
+                        .try_into()
+                        .map_err(|e| ManifestError::InvalidInstruction {
+                            reason: format!("Method name is too long: {}", e),
+                        })?,
                     args: self.process_args(arguments)?,
                 }];
                 if let Some(var_name) = output_variable {
diff --git a/crates/transaction_manifest/tests/parser.rs b/crates/transaction_manifest/tests/parser.rs
index 5bda15b824..509b1a6528 100644
--- a/crates/transaction_manifest/tests/parser.rs
+++ b/crates/transaction_manifest/tests/parser.rs
@@ -62,24 +62,24 @@ fn manifest_smoke_test() {
     let expected = vec![
         Instruction::CallFunction {
             address: picture_seller_template,
-            function: "new".to_string(),
+            function: "new".try_into().unwrap(),
             args: call_args![1_000u64],
         },
         Instruction::PutLastInstructionOutputOnWorkspace { key: 0 },
         Instruction::CallMethod {
             call: test_faucet_component.into(),
-            method: "take_free_coins".to_string(),
+            method: "take_free_coins".try_into().unwrap(),
             args: call_args![1000],
         },
         Instruction::PutLastInstructionOutputOnWorkspace { key: 1 },
         Instruction::CallMethod {
             call: account_component.into(),
-            method: "deposit".to_string(),
+            method: "deposit".try_into().unwrap(),
             args: call_args![Workspace(1)],
         },
         Instruction::CallMethod {
             call: account_component.into(),
-            method: "set_public_key".to_string(),
+            method: "set_public_key".try_into().unwrap(),
             args: call_args![
                 RistrettoPublicKeyBytes::from_hex("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
                     .unwrap(),
@@ -92,19 +92,19 @@ fn manifest_smoke_test() {
         },
         Instruction::CallMethod {
             call: account_component.into(),
-            method: "withdraw".to_string(),
+            method: "withdraw".try_into().unwrap(),
             args: call_args![XTR, 1_000],
         },
         Instruction::PutLastInstructionOutputOnWorkspace { key: 2 },
         Instruction::CallMethod {
             call: picture_seller_component.into(),
-            method: "buy".to_string(),
+            method: "buy".try_into().unwrap(),
             args: call_args![Workspace(2)],
         },
         Instruction::PutLastInstructionOutputOnWorkspace { key: 3 },
         Instruction::CallMethod {
             call: account_component.into(),
-            method: "deposit".to_string(),
+            method: "deposit".try_into().unwrap(),
             args: call_args![Workspace(3)],
         },
     ];
diff --git a/crates/wallet/crypto/src/balance_proof.rs b/crates/wallet/crypto/src/balance_proof.rs
index b20e749bd8..00d421ef1c 100644
--- a/crates/wallet/crypto/src/balance_proof.rs
+++ b/crates/wallet/crypto/src/balance_proof.rs
@@ -6,10 +6,10 @@ use tari_crypto::{
     keys::PublicKey,
     ristretto::{RistrettoPublicKey, RistrettoSecretKey},
 };
-use tari_engine_types::{crypto::messages, hashing::EngineSchnorrSignature, Hash64, ToByteType};
+use tari_engine_types::{crypto::messages, hashing::EngineSchnorrSignature, ToByteType};
 use tari_template_lib::{
     models::{StealthInputsStatement, StealthOutputsStatement},
-    prelude::{Amount, BalanceProofSignature, PedersenCommitmentBytes, RistrettoPublicKeyBytes, SchnorrSignatureBytes},
+    prelude::{Amount, BalanceProofSignature},
 };
 
 pub(crate) fn generate_confidential_balance_proof(
@@ -53,15 +53,3 @@ pub fn generate_stealth_balance_proof_signature(
     let sig = EngineSchnorrSignature::sign_raw_uniform(&secret_excess, nonce, &message).unwrap();
     sig.to_byte_type()
 }
-
-pub(crate) fn generate_stealth_owner_proof_signature(
-    secret_key: &RistrettoSecretKey,
-    public_output_nonce: &RistrettoPublicKeyBytes,
-    commitment: &PedersenCommitmentBytes,
-    required_signer: &RistrettoPublicKeyBytes,
-    metadata_hash: &Hash64,
-) -> SchnorrSignatureBytes {
-    let message = messages::stealth_ownership64(commitment, public_output_nonce, required_signer, metadata_hash);
-    let sig = EngineSchnorrSignature::sign(secret_key, message, &mut OsRng).unwrap();
-    sig.to_byte_type()
-}
diff --git a/crates/wallet/crypto/src/bullet_proof.rs b/crates/wallet/crypto/src/bullet_proof.rs
index 8abff27630..07cdb452c7 100644
--- a/crates/wallet/crypto/src/bullet_proof.rs
+++ b/crates/wallet/crypto/src/bullet_proof.rs
@@ -15,9 +15,9 @@ use tari_crypto::{
 use tari_engine_types::crypto::{get_static_range_proof_service, MAX_LAZY_BP_AGG_FACTORS};
 use tari_template_lib::types::crypto::RangeProofBytes;
 
-use crate::UnblindedOutputWitness;
+use crate::OutputWitness;
 
-pub fn generate_extended_bullet_proof<'a, I: IntoIterator<Item = &'a UnblindedOutputWitness>>(
+pub fn generate_extended_bullet_proof<'a, I: IntoIterator<Item = &'a OutputWitness>>(
     statements: I,
 ) -> Result<RangeProofBytes, RangeProofError> {
     let mut extended_witnesses = statements
diff --git a/crates/wallet/crypto/src/confidential.rs b/crates/wallet/crypto/src/confidential.rs
index d3a133b7db..ffae3c99f6 100644
--- a/crates/wallet/crypto/src/confidential.rs
+++ b/crates/wallet/crypto/src/confidential.rs
@@ -14,16 +14,16 @@ use crate::{
     error::ConfidentialProofError,
     viewable_balance_proof::create_viewable_balance_proof,
     MaskAndValue,
-    UnblindedOutputWitness,
+    OutputWitness,
     WalletCryptoError,
 };
 
 pub fn create_withdraw_proof(
     inputs: &[MaskAndValue],
     input_revealed_amount: Amount,
-    output_statement: Option<&UnblindedOutputWitness>,
+    output_statement: Option<&OutputWitness>,
     output_revealed_amount: Amount,
-    change_statement: Option<&UnblindedOutputWitness>,
+    change_statement: Option<&OutputWitness>,
     change_revealed_amount: Amount,
 ) -> Result<ConfidentialWithdrawProof, WalletCryptoError> {
     let output_proof = create_output_statement(
@@ -68,9 +68,9 @@ pub fn create_withdraw_proof(
 }
 
 pub fn create_output_statement(
-    output_statement: Option<&UnblindedOutputWitness>,
+    output_statement: Option<&OutputWitness>,
     output_revealed_amount: Amount,
-    change_statement: Option<&UnblindedOutputWitness>,
+    change_statement: Option<&OutputWitness>,
     change_revealed_amount: Amount,
 ) -> Result<ConfidentialOutputStatement, ConfidentialProofError> {
     let proof_change_statement = change_statement
@@ -138,7 +138,7 @@ mod tests {
     fn create_valid_proof(amount: u64, minimum_value_promise: u64) -> ConfidentialOutputStatement {
         let mask = RistrettoSecretKey::random(&mut OsRng);
         create_output_statement(
-            Some(&UnblindedOutputWitness {
+            Some(&OutputWitness {
                 amount,
                 minimum_value_promise,
                 mask,
diff --git a/crates/wallet/crypto/src/stealth.rs b/crates/wallet/crypto/src/stealth.rs
index 7f55871758..b1f78fb64a 100644
--- a/crates/wallet/crypto/src/stealth.rs
+++ b/crates/wallet/crypto/src/stealth.rs
@@ -2,7 +2,7 @@
 //   SPDX-License-Identifier: BSD-3-Clause
 
 use tari_crypto::ristretto::RistrettoSecretKey;
-use tari_engine_types::{crypto::messages, ToByteType};
+use tari_engine_types::ToByteType;
 use tari_template_lib::{
     models::{
         StealthInput,
@@ -12,17 +12,16 @@ use tari_template_lib::{
         StealthUnspentOutput,
         UnspentOutput,
     },
-    prelude::RistrettoPublicKeyBytes,
     types::Amount,
 };
 
 use crate::{
-    balance_proof::{generate_stealth_balance_proof_signature, generate_stealth_owner_proof_signature},
+    balance_proof::generate_stealth_balance_proof_signature,
     bullet_proof::generate_extended_bullet_proof,
     error::ConfidentialProofError,
     viewable_balance_proof::create_viewable_balance_proof,
-    UnblindedStealthInputWitness,
-    UnblindedStealthOutputWitness,
+    SecretStealthOutputStatement,
+    StealthInputWitness,
     WalletCryptoError,
 };
 
@@ -31,11 +30,12 @@ pub fn create_transfer_statement<'a, Inputs, Outputs>(
     revealed_input_amount: Amount,
     output_statements: Outputs,
     revealed_output_amount: Amount,
-    required_signer: RistrettoPublicKeyBytes,
 ) -> Result<StealthTransferStatement, WalletCryptoError>
 where
-    Inputs: IntoIterator<Item = &'a UnblindedStealthInputWitness> + ExactSizeIterator,
-    Outputs: IntoIterator<Item = &'a UnblindedStealthOutputWitness> + ExactSizeIterator + Clone,
+    Inputs: IntoIterator<Item = StealthInputWitness>,
+    Inputs::IntoIter: ExactSizeIterator,
+    Outputs: IntoIterator<Item = &'a SecretStealthOutputStatement> + Clone,
+    Outputs::IntoIter: ExactSizeIterator,
 {
     if revealed_input_amount.is_negative() {
         return Err(WalletCryptoError::InvalidArgument {
@@ -50,41 +50,30 @@ where
         });
     }
 
+    let mut inputs = inputs.into_iter();
     let num_inputs = inputs.len();
-    let num_outputs = output_statements.len();
 
     let outputs_statement = create_outputs_statement(output_statements.clone(), revealed_output_amount)?;
-    let outputs_statement_hash = messages::stealth_statement_metadata64(&outputs_statement);
+    let output_statements = output_statements.into_iter();
+    let num_outputs = output_statements.len();
 
-    let (inputs_to_spend, agg_input_mask) = inputs.into_iter().try_fold(
+    let (inputs_to_spend, agg_input_mask) = inputs.try_fold(
         (Vec::with_capacity(num_inputs), RistrettoSecretKey::default()),
         |(mut inputs, agg_input), input| {
-            let commitment = input.mask_and_value.to_commitment();
-
-            let signature = generate_stealth_owner_proof_signature(
-                &input.owner_secret,
-                &input.public_nonce.to_byte_type(),
-                &commitment.to_byte_type(),
-                &required_signer,
-                &outputs_statement_hash,
-            );
             inputs.push(StealthInput {
-                commitment: commitment.to_byte_type(),
-                owner_proof: signature,
+                commitment: input.mask_and_value.to_commitment().to_byte_type(),
             });
             Ok::<_, WalletCryptoError>((inputs, agg_input + &input.mask_and_value.mask))
         },
     )?;
 
     let agg_output_mask = output_statements
-        .into_iter()
         .map(|stmt| &stmt.witness.mask)
         .fold(RistrettoSecretKey::default(), |agg, mask| agg + mask);
 
     let inputs_statement = StealthInputsStatement {
         inputs: inputs_to_spend.clone(),
         revealed_amount: revealed_input_amount,
-        required_signer,
     };
 
     let balance_proof = if num_outputs == 0 && num_inputs == 0 {
@@ -102,14 +91,13 @@ where
         inputs_statement: StealthInputsStatement {
             inputs: inputs_to_spend,
             revealed_amount: revealed_input_amount,
-            required_signer,
         },
         outputs_statement,
         balance_proof,
     })
 }
 
-pub fn create_outputs_statement<'a, Outputs: IntoIterator<Item = &'a UnblindedStealthOutputWitness> + Clone>(
+pub fn create_outputs_statement<'a, Outputs: IntoIterator<Item = &'a SecretStealthOutputStatement> + Clone>(
     output_statements: Outputs,
     revealed_output_amount: Amount,
 ) -> Result<StealthOutputsStatement, ConfidentialProofError> {
@@ -136,7 +124,7 @@ pub fn create_outputs_statement<'a, Outputs: IntoIterator<Item = &'a UnblindedSt
 
             Ok::<_, ConfidentialProofError>(StealthUnspentOutput {
                 output,
-                owner_public_key: output_stmt.output_owner_public_key.to_byte_type(),
+                spend_condition: output_stmt.spend_condition.clone(),
                 tag: output_stmt.tag,
             })
         })
@@ -154,21 +142,22 @@ pub fn create_outputs_statement<'a, Outputs: IntoIterator<Item = &'a UnblindedSt
 #[cfg(test)]
 mod tests {
     use rand::rngs::OsRng;
-    use tari_crypto::{
-        keys::SecretKey,
-        ristretto::{RistrettoPublicKey, RistrettoSecretKey},
-    };
+    use tari_crypto::{keys::SecretKey, ristretto::RistrettoSecretKey};
     use tari_engine_types::stealth::validate_stealth_outputs_statement;
-    use tari_template_lib::types::{crypto::UtxoTag, Amount, EncryptedData};
+    use tari_template_lib::{
+        models::SpendCondition,
+        prelude::RistrettoPublicKeyBytes,
+        types::{crypto::UtxoTag, Amount, EncryptedData},
+    };
 
     use super::*;
-    use crate::UnblindedOutputWitness;
+    use crate::OutputWitness;
 
     fn create_valid_proof(amount: u64, minimum_value_promise: u64) -> StealthOutputsStatement {
         let mask = RistrettoSecretKey::random(&mut OsRng);
         create_outputs_statement(
-            &[UnblindedStealthOutputWitness {
-                witness: UnblindedOutputWitness {
+            &[SecretStealthOutputStatement {
+                witness: OutputWitness {
                     amount,
                     minimum_value_promise,
                     mask,
@@ -176,7 +165,7 @@ mod tests {
                     encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
                     resource_view_key: None,
                 },
-                output_owner_public_key: RistrettoPublicKey::default(),
+                spend_condition: SpendCondition::Signed(RistrettoPublicKeyBytes::default()),
                 tag: UtxoTag::new(0),
             }],
             Amount::zero(),
diff --git a/crates/wallet/crypto/src/unblinded_statement.rs b/crates/wallet/crypto/src/unblinded_statement.rs
index b5a75aeaf3..37ded2acb0 100644
--- a/crates/wallet/crypto/src/unblinded_statement.rs
+++ b/crates/wallet/crypto/src/unblinded_statement.rs
@@ -3,12 +3,15 @@
 
 use tari_crypto::ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey, RistrettoSecretKey};
 use tari_engine_types::crypto::commit_u64_amount;
-use tari_template_lib::types::{crypto::UtxoTag, EncryptedData};
+use tari_template_lib::{
+    models::SpendCondition,
+    types::{crypto::UtxoTag, EncryptedData},
+};
 
 use crate::memo::Memo;
 
 #[derive(Debug, Clone)]
-pub struct UnblindedOutputWitness {
+pub struct OutputWitness {
     pub amount: u64,
     pub mask: RistrettoSecretKey,
     pub sender_public_nonce: RistrettoPublicKey,
@@ -17,16 +20,16 @@ pub struct UnblindedOutputWitness {
     pub resource_view_key: Option<RistrettoPublicKey>,
 }
 
-impl UnblindedOutputWitness {
+impl OutputWitness {
     pub fn to_commitment(&self) -> PedersenCommitment {
         commit_u64_amount(&self.mask, self.amount)
     }
 }
 
 #[derive(Debug, Clone)]
-pub struct UnblindedStealthOutputWitness {
-    pub witness: UnblindedOutputWitness,
-    pub output_owner_public_key: RistrettoPublicKey,
+pub struct SecretStealthOutputStatement {
+    pub witness: OutputWitness,
+    pub spend_condition: SpendCondition,
     pub tag: UtxoTag,
 }
 
@@ -75,8 +78,7 @@ impl DecryptedData {
 }
 
 #[derive(Debug, Clone)]
-pub struct UnblindedStealthInputWitness {
+pub struct StealthInputWitness {
     pub mask_and_value: MaskAndValue,
-    pub owner_secret: RistrettoSecretKey,
     pub public_nonce: RistrettoPublicKey,
 }
diff --git a/crates/wallet/crypto/tests/stealth_transfer_statement.rs b/crates/wallet/crypto/tests/stealth_transfer_statement.rs
index 0078cf2370..550659e5a2 100644
--- a/crates/wallet/crypto/tests/stealth_transfer_statement.rs
+++ b/crates/wallet/crypto/tests/stealth_transfer_statement.rs
@@ -8,28 +8,17 @@ use tari_crypto::{
     keys::{PublicKey, SecretKey},
     ristretto::{RistrettoPublicKey, RistrettoSecretKey},
 };
-use tari_engine_types::{
-    crypto::{messages, PrivateOutput},
-    resource_container::ResourceError,
-    stealth,
-    ToByteType,
-    UtxoOutput,
-};
+use tari_engine_types::{stealth, ToByteType};
 use tari_ootle_common_types::crypto::create_key_pair_from_seed;
 use tari_ootle_wallet_crypto::{
-    balance_proof::generate_stealth_balance_proof_signature,
     confidential,
-    stealth::{create_outputs_statement, create_transfer_statement},
+    stealth::create_transfer_statement,
     MaskAndValue,
-    UnblindedOutputWitness,
-    UnblindedStealthInputWitness,
-    UnblindedStealthOutputWitness,
-};
-use tari_template_lib::types::{
-    crypto::{RistrettoPublicKeyBytes, UtxoTag},
-    Amount,
-    EncryptedData,
+    OutputWitness,
+    SecretStealthOutputStatement,
+    StealthInputWitness,
 };
+use tari_template_lib::types::{crypto::UtxoTag, Amount, EncryptedData};
 
 #[test]
 fn it_create_a_valid_revealed_only_proof() {
@@ -41,18 +30,14 @@ fn it_create_a_valid_revealed_only_proof() {
 }
 
 mod stealth_tests {
+    use tari_template_lib::models::SpendCondition;
+
     use super::*;
 
     #[test]
     fn it_errors_for_noop_transfer() {
-        let statement = create_transfer_statement(
-            iter::empty(),
-            Amount::zero(),
-            iter::empty(),
-            Amount::zero(),
-            RistrettoPublicKeyBytes::zero(),
-        )
-        .unwrap();
+        let statement =
+            create_transfer_statement(iter::empty(), Amount::zero(), iter::empty(), Amount::zero()).unwrap();
         stealth::validate_transfer_balance(&statement, None).unwrap_err();
     }
 
@@ -65,11 +50,10 @@ mod stealth_tests {
         let revealed_output_amount = Amount::from(0);
 
         let statement = create_transfer_statement(
-            inputs.iter(),
+            inputs,
             revealed_input_amount,
             output_statements.iter(),
             revealed_output_amount,
-            RistrettoPublicKeyBytes::zero(),
         )
         .unwrap();
 
@@ -85,11 +69,10 @@ mod stealth_tests {
         let revealed_output_amount = Amount::from(6000 + 6000 - 100 - 200 - 300);
 
         let statement = create_transfer_statement(
-            inputs.iter(),
+            inputs,
             revealed_input_amount,
             output_statements.iter(),
             revealed_output_amount,
-            RistrettoPublicKeyBytes::zero(),
         )
         .unwrap();
 
@@ -105,7 +88,6 @@ mod stealth_tests {
             revealed_input_amount,
             iter::empty(),
             revealed_output_amount,
-            RistrettoPublicKeyBytes::zero(),
         )
         .unwrap();
         stealth::validate_transfer_balance(&statement, None).unwrap();
@@ -117,94 +99,25 @@ mod stealth_tests {
             revealed_input_amount,
             iter::empty(),
             revealed_output_amount,
-            RistrettoPublicKeyBytes::zero(),
         )
         .unwrap();
         stealth::validate_transfer_balance(&statement, None).unwrap_err(); // Invalid, output is less than input
     }
 
-    #[test]
-    fn it_fails_to_validate_if_outputs_are_replaced() {
-        let required_signer = RistrettoPublicKeyBytes::zero();
-        let inputs = make_input_statements(&[(1, 1000), (2, 2000), (3, 3000)]);
-        let revealed_input_amount = Amount::from(6000);
-
-        let output_statements = make_output_statements(&[100, 200, 300]);
-        let revealed_output_amount = Amount::from(6000 + 6000 - 100 - 200 - 300);
-
-        let mut statement = create_transfer_statement(
-            inputs.iter(),
-            revealed_input_amount,
-            output_statements.iter(),
-            revealed_output_amount,
-            required_signer,
-        )
-        .unwrap();
-
-        // Make new output statements
-        let output_statements = make_output_statements(&[100, 200, 300]);
-
-        // Recreate the output statement and balance proof
-        let agg_output_mask = output_statements
-            .iter()
-            .map(|stmt| &stmt.witness.mask)
-            .fold(RistrettoSecretKey::default(), |agg, mask| agg + mask);
-
-        let agg_input_mask = inputs
-            .iter()
-            .map(|stmt| &stmt.mask_and_value.mask)
-            .fold(RistrettoSecretKey::default(), |agg, mask| agg + mask);
-
-        statement.outputs_statement =
-            create_outputs_statement(output_statements.iter(), revealed_output_amount).unwrap();
-
-        statement.balance_proof = Some(generate_stealth_balance_proof_signature(
-            &agg_input_mask,
-            &agg_output_mask,
-            &statement.inputs_statement,
-            &statement.outputs_statement,
-        ));
-
-        // This passes because we recreated the balance proof correctly
-        stealth::validate_transfer_balance(&statement, None).unwrap();
-
-        let metadata_hash = messages::stealth_statement_metadata64(&statement.outputs_statement);
-        for (i, input) in statement.inputs_statement.inputs.iter().enumerate() {
-            let original_input = &inputs.get(i).expect("input index out of range");
-            // Convert the input into a UTXO to spend
-            let utxo = UtxoOutput {
-                output: PrivateOutput {
-                    public_nonce: original_input.public_nonce.to_byte_type(),
-                    // Encrypted data is not needed for ownership proof validation
-                    encrypted_data: EncryptedData::empty(),
-                    minimum_value_promise: 0,
-                    viewable_balance: None,
-                },
-                owner_public_key: RistrettoPublicKey::from_secret_key(&original_input.owner_secret).to_byte_type(),
-                tag: UtxoTag::new(0),
-            };
-
-            // This fails because the outputs have been malleated
-            let err = stealth::validate_ownership_proof(&utxo, input, &required_signer, &metadata_hash).unwrap_err();
-            assert!(matches!(err, ResourceError::InvalidSpend { .. }));
-        }
-    }
-
-    fn make_input_statements(amounts: &[(u8, u64)]) -> Vec<UnblindedStealthInputWitness> {
+    fn make_input_statements(amounts: &[(u8, u64)]) -> Vec<StealthInputWitness> {
         amounts
             .iter()
             .map(|&(seed, amount)| {
                 let (mask, public_key) = create_key_pair_from_seed(seed);
-                UnblindedStealthInputWitness {
+                StealthInputWitness {
                     mask_and_value: MaskAndValue::new(amount, mask.clone()),
-                    owner_secret: mask,
                     public_nonce: public_key,
                 }
             })
             .collect()
     }
 
-    fn make_output_statements(amounts: &[u64]) -> Vec<UnblindedStealthOutputWitness> {
+    fn make_output_statements(amounts: &[u64]) -> Vec<SecretStealthOutputStatement> {
         amounts
             .iter()
             .filter(|amount| **amount > 0)
@@ -212,7 +125,7 @@ mod stealth_tests {
                 let output_mask = RistrettoSecretKey::random(&mut OsRng);
                 // For testing purposes, we use the mask as the owner key
                 let output_owner_public_key = RistrettoPublicKey::from_secret_key(&output_mask);
-                let statement = UnblindedOutputWitness {
+                let statement = OutputWitness {
                     amount,
                     mask: output_mask,
                     resource_view_key: None,
@@ -222,12 +135,12 @@ mod stealth_tests {
                         pk
                     },
                     minimum_value_promise: 0,
-                    encrypted_data: EncryptedData::try_from(vec![0; EncryptedData::min_size()]).unwrap(),
+                    encrypted_data: EncryptedData::empty(),
                 };
 
-                UnblindedStealthOutputWitness {
+                SecretStealthOutputStatement {
                     witness: statement,
-                    output_owner_public_key,
+                    spend_condition: SpendCondition::Signed(output_owner_public_key.to_byte_type()),
                     tag: UtxoTag::new(0),
                 }
             })
diff --git a/crates/wallet/crypto/tests/viewable_balance_proof.rs b/crates/wallet/crypto/tests/viewable_balance_proof.rs
index dfe8bcaecd..6d96460245 100644
--- a/crates/wallet/crypto/tests/viewable_balance_proof.rs
+++ b/crates/wallet/crypto/tests/viewable_balance_proof.rs
@@ -9,16 +9,16 @@ use tari_crypto::{
     ristretto::{pedersen::PedersenCommitment, RistrettoPublicKey, RistrettoSecretKey},
 };
 use tari_engine_types::crypto::validate_elgamal_verifiable_balance_proof;
-use tari_ootle_wallet_crypto::{confidential, GenerateValueLookup, UnblindedOutputWitness};
+use tari_ootle_wallet_crypto::{confidential, GenerateValueLookup, OutputWitness};
 use tari_template_lib::{
     template_dependencies::{decode_exact, encode_with_len},
     types::{Amount, EncryptedData},
 };
 use tari_utilities::ByteArray;
 
-fn create_output_statement(value: u64, view_key: &RistrettoPublicKey) -> UnblindedOutputWitness {
+fn create_output_statement(value: u64, view_key: &RistrettoPublicKey) -> OutputWitness {
     let mask = RistrettoSecretKey::random(&mut OsRng);
-    UnblindedOutputWitness {
+    OutputWitness {
         amount: value,
         mask,
         sender_public_nonce: Default::default(),
diff --git a/crates/wallet/sdk/src/apis/confidential_crypto.rs b/crates/wallet/sdk/src/apis/confidential_crypto.rs
index cfdb479176..15845bdfc6 100644
--- a/crates/wallet/sdk/src/apis/confidential_crypto.rs
+++ b/crates/wallet/sdk/src/apis/confidential_crypto.rs
@@ -11,7 +11,7 @@ use tari_ootle_wallet_crypto::{
     ConfidentialProofError,
     DecryptedData,
     MaskAndValue,
-    UnblindedOutputWitness,
+    OutputWitness,
     WalletCryptoError,
 };
 use tari_template_lib::{
@@ -39,9 +39,9 @@ impl ConfidentialCryptoApi {
         &self,
         inputs: &[MaskAndValue],
         input_revealed_amount: A,
-        output_statement: Option<&UnblindedOutputWitness>,
+        output_statement: Option<&OutputWitness>,
         output_revealed_amount: A,
-        change_statement: Option<&UnblindedOutputWitness>,
+        change_statement: Option<&OutputWitness>,
         change_revealed_amount: A,
     ) -> Result<ConfidentialWithdrawProof, ConfidentialCryptoApiError> {
         let proof = confidential::create_withdraw_proof(
@@ -90,7 +90,7 @@ impl ConfidentialCryptoApi {
 
     pub fn generate_output_proof<A: Into<Amount>>(
         &self,
-        statement: &UnblindedOutputWitness,
+        statement: &OutputWitness,
         revealed_amount: A,
     ) -> Result<ConfidentialOutputStatement, ConfidentialCryptoApiError> {
         let proof = confidential::create_output_statement(
diff --git a/crates/wallet/sdk/src/apis/confidential_transfer.rs b/crates/wallet/sdk/src/apis/confidential_transfer.rs
index 73226f4709..694e654378 100644
--- a/crates/wallet/sdk/src/apis/confidential_transfer.rs
+++ b/crates/wallet/sdk/src/apis/confidential_transfer.rs
@@ -10,7 +10,7 @@ use tari_crypto::{keys::PublicKey, ristretto::RistrettoPublicKey};
 use tari_engine_types::{FromByteType, ToByteType};
 use tari_ootle_address::OotleAddress;
 use tari_ootle_common_types::{optional::IsNotFoundError, SubstateRequirement};
-use tari_ootle_wallet_crypto::{memo::Memo, MaskAndValue, UnblindedOutputWitness};
+use tari_ootle_wallet_crypto::{memo::Memo, MaskAndValue, OutputWitness};
 use tari_template_lib::{
     models::{ComponentAddress, ResourceAddress, VaultId},
     types::Amount,
@@ -427,7 +427,7 @@ where TSpec: WalletSdkSpec
         confidential_amount: Amount,
         resource_view_key: Option<RistrettoPublicKey>,
         memo: Option<&Memo>,
-    ) -> Result<UnblindedOutputWitness, ConfidentialTransferApiError> {
+    ) -> Result<OutputWitness, ConfidentialTransferApiError> {
         if !confidential_amount.is_positive() {
             return Err(ConfidentialTransferApiError::InvalidParameter {
                 param: "confidential_amount",
@@ -451,7 +451,7 @@ where TSpec: WalletSdkSpec
             self.crypto_api
                 .encrypt_value_and_mask(amount, &mask.key, dest_public_key, &nonce, memo)?;
 
-        Ok(UnblindedOutputWitness {
+        Ok(OutputWitness {
             amount,
             mask: mask.key,
             sender_public_nonce: public_nonce,
diff --git a/crates/wallet/sdk/src/apis/key_manager.rs b/crates/wallet/sdk/src/apis/key_manager.rs
index 265e5b5fd2..448c057aca 100644
--- a/crates/wallet/sdk/src/apis/key_manager.rs
+++ b/crates/wallet/sdk/src/apis/key_manager.rs
@@ -5,20 +5,26 @@ use rand::rngs::OsRng;
 use tari_common_types::seeds::cipher_seed;
 use tari_crypto::{
     keys::{PublicKey as _, SecretKey},
-    ristretto::{RistrettoPublicKey, RistrettoSecretKey},
+    ristretto::{RistrettoPublicKey, RistrettoSchnorr, RistrettoSecretKey},
     tari_utilities::ByteArray,
 };
+use tari_engine_types::FromByteType;
 use tari_ootle_address::RistrettoOotleAddress;
 use tari_ootle_common_types::{
     optional::{IsNotFoundError, Optional},
     Epoch,
     Network,
+    Signable,
 };
 use tari_ootle_wallet_crypto::encryption::{decrypt_with_password, encrypt_with_password, CipherError};
+use tari_template_lib::prelude::RistrettoPublicKeyBytes;
 
 use crate::{
-    apis::password_manager::{PasswordManagerApi, PasswordManagerApiError},
-    key_managers::WalletKeyStore,
+    apis::{
+        password_manager::{PasswordManagerApi, PasswordManagerApiError},
+        stealth_crypto::StealthCryptoApi,
+    },
+    key_managers::{SignatureOutput, WalletKeyStore},
     models::{
         DerivedKeyId,
         DerivedKeyIndex,
@@ -30,6 +36,7 @@ use crate::{
         KeyBranch,
         KeyId,
         KeyType,
+        StealthUtxoSpendKeyId,
         WalletKeyRecord,
         WalletOotleAddressWithKeyIds,
         WalletPublicKey,
@@ -51,6 +58,7 @@ pub struct KeyManagerApi<'a, TSpec: WalletSdkSpec> {
     store: &'a TSpec::Store,
     key_store: &'a TSpec::KeyStore,
     password_manager: PasswordManagerApi<'a, TSpec::Store>,
+    crypto_api: StealthCryptoApi,
     epoch_birthday: EpochBirthday,
 }
 
@@ -67,6 +75,7 @@ impl<'a, TSpec: WalletSdkSpec> KeyManagerApi<'a, TSpec> {
             store,
             key_store,
             password_manager,
+            crypto_api: StealthCryptoApi::new(),
             epoch_birthday,
         }
     }
@@ -83,7 +92,7 @@ impl<'a, TSpec: WalletSdkSpec> KeyManagerApi<'a, TSpec> {
             let key = self
                 .key_store
                 .derive_secret(branch.as_str(), index)
-                .map_err(|e| KeyManagerApiError::KeyStoreError { source: e.into() })?;
+                .map_err(KeyManagerApiError::key_store_error)?;
             let pk = RistrettoPublicKey::from_secret_key(&key);
             keys.push(WalletKeyRecord {
                 key_id: KeyId::derived(branch, index),
@@ -179,13 +188,29 @@ impl<'a, TSpec: WalletSdkSpec> KeyManagerApi<'a, TSpec> {
         let secret = self
             .key_store
             .derive_secret(branch.as_str(), index)
-            .map_err(|e| KeyManagerApiError::KeyStoreError { source: e.into() })?;
+            .map_err(KeyManagerApiError::key_store_error)?;
         Ok(DerivedWalletKey {
             key: secret,
             derived_key_id: DerivedKeyId { branch, index },
         })
     }
 
+    pub(crate) fn generate_stealth_owner_key(
+        &self,
+        key_id: KeyId,
+        public_nonce: &RistrettoPublicKeyBytes,
+    ) -> Result<RistrettoSecretKey, KeyManagerApiError> {
+        let public_nonce = public_nonce
+            .try_from_byte_type()
+            .map_err(|e| KeyManagerApiError::InvalidKeyId {
+                details: format!("Failed to convert public nonce to RistrettoPublicKey: {}", e),
+            })?;
+        let account_key = self.get_key(key_id)?;
+        Ok(self
+            .crypto_api
+            .derive_stealth_owner_secret(self.network, account_key.secret(), &public_nonce))
+    }
+
     pub fn derive_keypair(
         &self,
         branch: KeyBranch,
@@ -313,7 +338,7 @@ impl<'a, TSpec: WalletSdkSpec> KeyManagerApi<'a, TSpec> {
         let birthday = self
             .key_store
             .key_birthday()
-            .map_err(|e| KeyManagerApiError::KeyStoreError { source: e.into() })?;
+            .map_err(KeyManagerApiError::key_store_error)?;
         let Some(birthday) = birthday else {
             return Ok(Epoch::zero());
         };
@@ -323,6 +348,50 @@ impl<'a, TSpec: WalletSdkSpec> KeyManagerApi<'a, TSpec> {
 
         Ok(epoch)
     }
+
+    pub fn sign_with_stealth_key<T: Signable<C>, C>(
+        &self,
+        key_id: &StealthUtxoSpendKeyId,
+        context: C,
+        item: &T,
+    ) -> Result<SignatureOutput, KeyManagerApiError> {
+        let stealth_secret = self.generate_stealth_owner_key(key_id.account_key_id, &key_id.public_nonce)?;
+        self.sign_with_explicit_key(&stealth_secret, context, item)
+    }
+
+    pub fn sign_with_context<T: Signable<C>, C>(
+        &self,
+        key_id: KeyId,
+        context: C,
+        item: &T,
+    ) -> Result<SignatureOutput, KeyManagerApiError> {
+        match &key_id {
+            // Use the key store implementation to sign with derived keys
+            KeyId::Derived { key_branch, index } => {
+                let output = self
+                    .key_store()
+                    .sign(key_branch.as_str(), *index, context, item)
+                    .map_err(KeyManagerApiError::key_store_error)?;
+                Ok(output)
+            },
+            _ => {
+                let key = self.get_key(key_id)?;
+                self.sign_with_explicit_key(key.secret(), context, item)
+            },
+        }
+    }
+
+    pub fn sign_with_explicit_key<T: Signable<C>, C>(
+        &self,
+        secret_key: &RistrettoSecretKey,
+        context: C,
+        item: &T,
+    ) -> Result<SignatureOutput, KeyManagerApiError> {
+        let signature = RistrettoSchnorr::sign(secret_key, item.to_signing_message(context), &mut OsRng)
+            .expect("RistrettoSchnorr::sign is infallible as it internally hashes the message into canonical form");
+        let public_key = RistrettoPublicKey::from_secret_key(secret_key);
+        Ok(SignatureOutput { public_key, signature })
+    }
 }
 
 impl<TSpec: WalletSdkSpec> Clone for KeyManagerApi<'_, TSpec> {
@@ -332,6 +401,7 @@ impl<TSpec: WalletSdkSpec> Clone for KeyManagerApi<'_, TSpec> {
             store: self.store,
             key_store: self.key_store,
             password_manager: self.password_manager.clone(),
+            crypto_api: self.crypto_api,
             epoch_birthday: self.epoch_birthday,
         }
     }
@@ -351,10 +421,20 @@ pub enum KeyManagerApiError {
     PasswordManagerApiError(#[from] PasswordManagerApiError),
     #[error("Key manager is in read only mode")]
     ReadOnlyMode,
+    #[error("Invalid key id: {details}")]
+    InvalidKeyId { details: String },
     #[error("Cipher error: {0}")]
     CipherError(#[from] CipherError),
 }
 
+impl KeyManagerApiError {
+    pub fn key_store_error<E: std::error::Error + Send + Sync + 'static>(source: E) -> Self {
+        KeyManagerApiError::KeyStoreError {
+            source: Box::new(source),
+        }
+    }
+}
+
 impl IsNotFoundError for KeyManagerApiError {
     fn is_not_found_error(&self) -> bool {
         matches!(self, KeyManagerApiError::KeyNotFound { .. }) ||
diff --git a/crates/wallet/sdk/src/apis/signer.rs b/crates/wallet/sdk/src/apis/signer.rs
index 0e6d8752fd..3e3791b66a 100644
--- a/crates/wallet/sdk/src/apis/signer.rs
+++ b/crates/wallet/sdk/src/apis/signer.rs
@@ -3,89 +3,104 @@
 
 use std::fmt;
 
+use tari_crypto::ristretto::RistrettoSecretKey;
 use tari_ootle_common_types::{IntoSigned, Signable};
 
 use crate::{
     apis::key_manager::{KeyManagerApi, KeyManagerApiError},
-    key_managers::{SignatureOutput, WalletKeyStore},
-    models::KeyId,
+    key_managers::SignatureOutput,
+    models::{KeyId, StealthUtxoSpendKeyId},
     spec::KeyStoreError,
     storage::WalletStorageError,
     WalletSdkSpec,
 };
 
-pub struct SignerApi<'a, TSpec: WalletSdkSpec> {
+pub struct SignerApi<'a, TSpec: WalletSdkSpec, Ctx = ()> {
     key_manager: KeyManagerApi<'a, TSpec>,
+    context: Ctx,
 }
 
-impl<'a, TSpec: WalletSdkSpec> SignerApi<'a, TSpec> {
+impl<'a, TSpec: WalletSdkSpec> SignerApi<'a, TSpec, ()> {
     pub fn new(key_manager: KeyManagerApi<'a, TSpec>) -> Self {
-        Self { key_manager }
+        Self {
+            key_manager,
+            context: (),
+        }
+    }
+
+    pub fn with_context<Ctx>(self, context: Ctx) -> SignerApi<'a, TSpec, Ctx> {
+        SignerApi {
+            key_manager: self.key_manager,
+            context,
+        }
     }
+}
 
-    pub fn get_signature<T, CTX>(
-        &mut self,
-        key_id: KeyId,
-        context: CTX,
+impl<'a, TSpec: WalletSdkSpec, Ctx: Copy> SignerApi<'a, TSpec, Ctx> {
+    pub fn generate_signature<T>(&self, key_id: KeyId, item: &T) -> Result<SignatureOutput, SignerApiError<TSpec>>
+    where T: Signable<Ctx> {
+        let output = self.key_manager.sign_with_context(key_id, self.context, item)?;
+        Ok(output)
+    }
+
+    pub fn generate_stealth_key_signature<T>(
+        &self,
+        key_id: &StealthUtxoSpendKeyId,
         item: &T,
     ) -> Result<SignatureOutput, SignerApiError<TSpec>>
     where
-        T: Signable<CTX>,
+        T: Signable<Ctx>,
     {
-        match key_id {
-            KeyId::Derived { key_branch, index } => {
-                let output = self
-                    .key_manager
-                    .key_store()
-                    .sign(key_branch.as_str(), index, context, item)
-                    // NOTE: Cannot implement From due to rust bug/limitation
-                    .map_err(SignerApiError::KeyStoreError)?;
-                Ok(output)
-            },
-            KeyId::Imported { local_key_id } => {
-                // TODO: do we actually need to support signing from an imported key? Typically these are view-only
-                // keys. If we removed support for this, we'd just need the key store as a dependency of the signing api
-                // instead of the key manager api.
-                let key = self.key_manager.get_key(KeyId::imported(local_key_id))?;
-                let sig = key.sign(context, item);
-                Ok(SignatureOutput {
-                    public_key: key.to_public_key(),
-                    signature: sig,
-                })
-            },
-        }
+        let output = self.key_manager.sign_with_stealth_key(key_id, self.context, item)?;
+        Ok(output)
+    }
+
+    pub fn sign<T>(&self, key_id: KeyId, item: T) -> Result<T::SignedOutput, SignerApiError<TSpec>>
+    where T: IntoSigned<Ctx> {
+        let output = self.generate_signature(key_id, &item)?;
+        let output = item.into_signed(output.public_key, output.signature);
+        Ok(output)
     }
 
-    pub fn sign_with_context<T, Ctx>(
-        &mut self,
-        key_id: KeyId,
-        context: Ctx,
+    pub fn sign_with_stealth_key<T>(
+        &self,
+        key_id: &StealthUtxoSpendKeyId,
         item: T,
     ) -> Result<T::SignedOutput, SignerApiError<TSpec>>
     where
         T: IntoSigned<Ctx>,
     {
-        let output = self.get_signature(key_id, context, &item)?;
+        let output = self.generate_stealth_key_signature(key_id, &item)?;
         let output = item.into_signed(output.public_key, output.signature);
         Ok(output)
     }
 
-    pub fn sign<T>(&mut self, key_id: KeyId, item: T) -> Result<T::SignedOutput, SignerApiError<TSpec>>
-    where T: IntoSigned<()> {
-        let output = self.get_signature(key_id, (), &item)?;
+    pub fn sign_with_explicit_key<T>(
+        &self,
+        secret_key: &RistrettoSecretKey,
+        item: T,
+    ) -> Result<T::SignedOutput, SignerApiError<TSpec>>
+    where
+        T: IntoSigned<Ctx>,
+    {
+        let output = self
+            .key_manager
+            .sign_with_explicit_key(secret_key, self.context, &item)?;
         let output = item.into_signed(output.public_key, output.signature);
         Ok(output)
     }
 }
 
-impl<TSpec> Clone for SignerApi<'_, TSpec>
+impl<TSpec, Ctx> Clone for SignerApi<'_, TSpec, Ctx>
 where
     TSpec: WalletSdkSpec,
     TSpec::KeyStore: Clone,
+    Ctx: Clone,
 {
     fn clone(&self) -> Self {
         Self {
             key_manager: self.key_manager.clone(),
+            context: self.context.clone(),
         }
     }
 }
diff --git a/crates/wallet/sdk/src/apis/stealth_crypto.rs b/crates/wallet/sdk/src/apis/stealth_crypto.rs
index e2700487a9..24fd5c85f2 100644
--- a/crates/wallet/sdk/src/apis/stealth_crypto.rs
+++ b/crates/wallet/sdk/src/apis/stealth_crypto.rs
@@ -16,9 +16,9 @@ use tari_ootle_wallet_crypto::{
     stealth,
     ConfidentialProofError,
     DecryptedData,
-    UnblindedOutputWitness,
-    UnblindedStealthInputWitness,
-    UnblindedStealthOutputWitness,
+    OutputWitness,
+    SecretStealthOutputStatement,
+    StealthInputWitness,
     WalletCryptoError,
 };
 use tari_template_lib::{
@@ -33,7 +33,7 @@ const LOG_TARGET: &str = "tari::ootle::wallet::sdk::stealth_crypto";
 pub struct StealthCryptoApi;
 
 impl StealthCryptoApi {
-    pub(crate) fn new() -> Self {
+    pub(crate) const fn new() -> Self {
         Self
     }
 
@@ -51,12 +51,13 @@ impl StealthCryptoApi {
         input_revealed_amount: A,
         output_statements: Outputs,
         output_revealed_amount: A,
-        required_signer: RistrettoPublicKeyBytes,
     ) -> Result<StealthTransferStatement, StealthCryptoApiError>
     where
         A: Into<Amount>,
-        Inputs: IntoIterator<Item = &'a UnblindedStealthInputWitness> + ExactSizeIterator,
-        Outputs: IntoIterator<Item = &'a UnblindedStealthOutputWitness> + ExactSizeIterator + Clone,
+        Inputs: IntoIterator<Item = StealthInputWitness>,
+        Inputs::IntoIter: ExactSizeIterator,
+        Outputs: IntoIterator<Item = &'a SecretStealthOutputStatement> + Clone,
+        Outputs::IntoIter: ExactSizeIterator,
     {
         let stmt = stealth::create_transfer_statement(
             inputs,
@@ -69,7 +70,6 @@ impl StealthCryptoApi {
                 .into()
                 .non_negative_checked()
                 .ok_or(StealthCryptoApiError::NegativeAmount)?,
-            required_signer,
         )?;
         Ok(stmt)
     }
@@ -117,7 +117,7 @@ impl StealthCryptoApi {
 
     pub fn generate_output_proof<A: Into<Amount>>(
         &self,
-        statement: &UnblindedOutputWitness,
+        statement: &OutputWitness,
         revealed_amount: A,
     ) -> Result<ConfidentialOutputStatement, StealthCryptoApiError> {
         let proof = confidential::create_output_statement(
diff --git a/crates/wallet/sdk/src/apis/stealth_outputs.rs b/crates/wallet/sdk/src/apis/stealth_outputs.rs
index 4647c0fb38..8b9868456f 100644
--- a/crates/wallet/sdk/src/apis/stealth_outputs.rs
+++ b/crates/wallet/sdk/src/apis/stealth_outputs.rs
@@ -19,20 +19,22 @@ use tari_engine_types::{
 };
 use tari_ootle_address::RistrettoOotleAddress;
 use tari_ootle_common_types::{
+    displayable::Displayable,
     optional::{IsNotFoundError, Optional},
     Network,
 };
 use tari_ootle_wallet_crypto::{
     memo::Memo,
     DecryptedData,
-    UnblindedOutputWitness,
-    UnblindedStealthInputWitness,
-    UnblindedStealthOutputWitness,
+    OutputWitness,
+    SecretStealthOutputStatement,
+    StealthInputWitness,
 };
 use tari_template_builtin::ACCOUNT_TEMPLATE_ADDRESS;
 use tari_template_lib::{
-    models::{ComponentAddress, ResourceAddress, StealthTransferStatement, UtxoAddress},
-    prelude::{PedersenCommitmentBytes, RistrettoPublicKeyBytes},
+    auth::AccessRule,
+    models::{ComponentAddress, ResourceAddress, SpendCondition, StealthTransferStatement, UtxoAddress},
+    prelude::PedersenCommitmentBytes,
     types::{Amount, EncryptedData},
 };
 
@@ -42,7 +44,7 @@ use crate::{
         config::{ConfigApi, ConfigApiError},
         key_manager::{KeyManagerApi, KeyManagerApiError},
         stealth_crypto::{StealthCryptoApi, StealthCryptoApiError},
-        stealth_transfer::{StealthOutputToCreate, UnblindedInputToSpend},
+        stealth_transfer::{PayTo, StealthOutputToCreate, UnblindedInputToSpend},
     },
     models::{
         input_selection,
@@ -223,7 +225,7 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
                 // using SmallestFirst.
                 let result = input_selection::branch_and_bound::select(&inputs, amount, INPUT_LIMIT).ok_or(
                     StealthOutputsApiError::InputSelectionFailed {
-                        details: "Failed to select inputs using branch and bound algorithm".to_string(),
+                        details: "Failed to select inputs (branch and bound algorithm)".to_string(),
                     },
                 )?;
 
@@ -253,15 +255,28 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
         Ok(())
     }
 
+    pub fn is_spendable_condition(&self, spend_condition: &SpendCondition) -> bool {
+        match spend_condition {
+            SpendCondition::Signed(_) => true,
+            SpendCondition::AccessRule(rule) => self.is_spendable_access_rule(rule),
+        }
+    }
+
+    pub fn is_spendable_access_rule(&self, access_rule: &AccessRule) -> bool {
+        match access_rule {
+            AccessRule::AllowAll => true,
+            AccessRule::DenyAll => false,
+            // TODO: for now we'll mark complex access rules as unspendable (cant be selected as inputs), in future we
+            // may have a good way to evaluate this
+            AccessRule::Restricted(_) => false,
+        }
+    }
+
     fn resolve_output_masks_for_spending(
         &self,
-        owner_key_id: KeyId,
         view_only_key_id: KeyId,
         inputs: &[InputSpendData],
     ) -> Result<Vec<UnblindedInputToSpend>, StealthOutputsApiError> {
-        let network = self.config_api.get_network()?;
-
-        let owner_key_part = self.key_manager_api.get_key(owner_key_id)?;
         let mut inputs_with_masks = Vec::with_capacity(inputs.len());
         for input in inputs {
             // Derive the decryption key from the DHKE(sender's public nonce, encryption secret key);
@@ -284,14 +299,9 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
                 true,
             )?;
 
-            let stealth_secret = self
-                .crypto_api
-                .derive_stealth_owner_secret(network, &owner_key_part.secret, &nonce);
-
             inputs_with_masks.push(UnblindedInputToSpend {
-                witness: UnblindedStealthInputWitness {
+                witness: StealthInputWitness {
                     mask_and_value: decrypted.mask_and_value,
-                    owner_secret: stealth_secret,
                     public_nonce: nonce,
                 },
             });
@@ -572,15 +582,19 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
                             &owner_key.secret,
                             &output_stealth_public_nonce,
                         );
-                        let stealth_address = RistrettoPublicKey::from_secret_key(&stealth_secret);
-                        if output.owner_public_key == stealth_address.to_byte_type() {
+                        let stealth_address = RistrettoPublicKey::from_secret_key(&stealth_secret).to_byte_type();
+                        if output
+                            .spend_condition
+                            .signed_by()
+                            .is_none_or(|pk| *pk == stealth_address)
+                        {
                             (decrypted.value(), decrypted.memo, OutputStatus::Unspent)
                         } else {
                             warn!(
                                 target: LOG_TARGET,
                                 "⚠️ Output owner public key does not match the expected stealth address. (expected: {}, actual: {}). Utxo cannot be spent by this wallet and will be stored as invalid.",
                                 stealth_address,
-                                output.owner_public_key
+                                output.spend_condition.signed_by().display()
                             );
                             (decrypted.value(), decrypted.memo, OutputStatus::Invalid)
                         }
@@ -628,11 +642,13 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
                 encrypted_data: output.output.encrypted_data.clone(),
                 tag_byte: output.tag,
                 memo,
+                spend_condition: output.spend_condition.clone(),
                 minimum_value_promise: output.output.minimum_value_promise,
                 status,
                 is_burnt: false,
                 is_frozen,
                 is_on_chain: true,
+                is_condition_spendable: self.is_spendable_condition(&output.spend_condition),
                 lock_id: None,
             }));
         }
@@ -647,7 +663,8 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
         resource_address: &ResourceAddress,
         resource_view_key: Option<RistrettoPublicKey>,
         memo: Option<&Memo>,
-    ) -> Result<UnblindedStealthOutputWitness, StealthOutputsApiError> {
+        pay_to: PayTo,
+    ) -> Result<SecretStealthOutputStatement, StealthOutputsApiError> {
         let mask = self.key_manager_api.next_key(KeyBranch::StealthMask)?;
 
         let (nonce_secret, public_nonce) = RistrettoPublicKey::random_keypair(&mut OsRng);
@@ -659,14 +676,21 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
             memo,
         )?;
 
-        // Create stealth address - used during spend time
-        let output_owner_public_key = self.crypto_api.derive_stealth_owner_public_key(
-            destination.network(),
-            destination.account_key(),
-            &nonce_secret,
-        );
+        let spend_condition = match pay_to {
+            PayTo::StealthPublicKey => {
+                // Create stealth address that the destination can use at spend time
+                let output_owner_public_key = self.crypto_api.derive_stealth_owner_public_key(
+                    destination.network(),
+                    destination.account_key(),
+                    &nonce_secret,
+                );
+
+                SpendCondition::Signed(output_owner_public_key.to_byte_type())
+            },
+            PayTo::AccessRule(access_rule) => SpendCondition::AccessRule(access_rule),
+        };
 
-        let witness = UnblindedOutputWitness {
+        let witness = OutputWitness {
             amount,
             mask: mask.key,
             sender_public_nonce: public_nonce,
@@ -682,22 +706,21 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
             resource_address,
         );
 
-        Ok(UnblindedStealthOutputWitness {
+        Ok(SecretStealthOutputStatement {
             witness,
-            output_owner_public_key,
+            spend_condition,
             tag: derived_tag,
         })
     }
 
-    pub fn generate_transfer_statement<I>(
+    pub fn generate_transfer_statement<'i, I>(
         &self,
-        params: TransferStatementParams<'_, I>,
+        params: TransferStatementParams<'i, I>,
     ) -> Result<StealthTransferStatement, StealthOutputsApiError>
     where
-        I: IntoIterator<Item = StealthOutputToCreate<'a>>,
+        I: IntoIterator<Item = StealthOutputToCreate<'i>>,
     {
-        let unblinded_inputs =
-            self.resolve_output_masks_for_spending(params.spend_key_id, params.view_only_key_id, params.inputs)?;
+        let unblinded_inputs = self.resolve_output_masks_for_spending(params.view_only_key_id, params.inputs)?;
         let outputs = params
             .outputs
             .into_iter()
@@ -708,6 +731,7 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
                     params.resource_address,
                     params.resource_view_key.clone(),
                     output.memo,
+                    output.pay_to,
                 )
             })
             .collect::<Result<Vec<_>, _>>()?;
@@ -726,11 +750,10 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
         }
 
         let statement = self.crypto_api.generate_transfer_statement(
-            unblinded_inputs.iter().map(|i| &i.witness),
+            unblinded_inputs.into_iter().map(|i| i.witness),
             params.input_revealed_amount,
             outputs.iter(),
             params.output_revealed_amount,
-            params.required_signer,
         )?;
         Ok(statement)
     }
@@ -771,7 +794,6 @@ impl<'a, TSpec: WalletSdkSpec> StealthOutputsApi<'a, TSpec> {
 }
 
 pub struct TransferStatementParams<'a, I> {
-    pub spend_key_id: KeyId,
     pub view_only_key_id: KeyId,
     pub resource_address: &'a ResourceAddress,
     pub resource_view_key: Option<RistrettoPublicKey>,
@@ -779,7 +801,6 @@ pub struct TransferStatementParams<'a, I> {
     pub input_revealed_amount: Amount,
     pub outputs: I,
     pub output_revealed_amount: Amount,
-    pub required_signer: RistrettoPublicKeyBytes,
 }
 
 #[derive(Debug, thiserror::Error)]
diff --git a/crates/wallet/sdk/src/apis/stealth_transfer/api.rs b/crates/wallet/sdk/src/apis/stealth_transfer/api.rs
index b6f1487557..677eb3d2ce 100644
--- a/crates/wallet/sdk/src/apis/stealth_transfer/api.rs
+++ b/crates/wallet/sdk/src/apis/stealth_transfer/api.rs
@@ -5,7 +5,7 @@ use std::{cmp, collections::HashSet, time::Duration};
 
 use log::*;
 use tari_crypto::ristretto::RistrettoPublicKey;
-use tari_engine_types::{substate::SubstateId, ConvertFromByteType, FromByteType, ToByteType};
+use tari_engine_types::{substate::SubstateId, ConvertFromByteType, FromByteType};
 use tari_ootle_address::RistrettoOotleAddress;
 use tari_ootle_common_types::{displayable::Displayable, optional::Optional, Network, SubstateRequirement};
 use tari_ootle_wallet_crypto::memo::Memo;
@@ -29,6 +29,7 @@ use super::{
     params::StealthTransferParams,
     types::{InputsToSpend, StealthOutputToCreate, StealthTransferOutput},
     BadgeUsage,
+    PayTo,
     TransferOutput,
 };
 use crate::{
@@ -38,10 +39,18 @@ use crate::{
         config::ConfigApi,
         key_manager::KeyManagerApi,
         locks::LocksApi,
-        stealth_outputs::{StealthOutputsApi, TransferStatementParams},
+        stealth_outputs::{StealthOutputsApi, StealthOutputsApiError, TransferStatementParams},
         substate::{SubstatesApi, ValidatorScanResult},
     },
-    models::{AccountWithAddress, KeyBranch, OutputStatus, StealthOutputModel, WalletLockDropGuard, WalletLockId},
+    models::{
+        AccountWithAddress,
+        KeyBranch,
+        OutputStatus,
+        StealthOutputModel,
+        StealthUtxoSpendKeyId,
+        WalletLockDropGuard,
+        WalletLockId,
+    },
     WalletSdkSpec,
 };
 
@@ -289,7 +298,7 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
         let network = self.config_api.get_network()?;
         params.validate(network)?;
 
-        let Some(owner_key_id) = owner_account.owner_key_id() else {
+        let Some(account_key_id) = owner_account.owner_key_id() else {
             return Err(StealthTransferApiError::InvalidParameter {
                 param: "owner_account",
                 reason: format!(
@@ -373,6 +382,7 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
                 owner_address: owner_address.clone(),
                 amount: fee_stealth_change_amt,
                 memo: None,
+                pay_to: PayTo::StealthPublicKey,
             })
             .filter(|o| o.amount > 0);
 
@@ -380,17 +390,14 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
             // withdraw auth signature, then we can use a nonce key.
             let must_sign_with_account_key = fee_inputs_to_spend.revealed.is_positive();
             let signing_key_id = if must_sign_with_account_key {
-                owner_key_id
+                account_key_id
             } else {
                 self.key_manager_api.next_derived_key_id(KeyBranch::Nonce)?.into()
             };
-            let required_signer = self.key_manager_api.get_public_key(signing_key_id)?;
-            let required_signer_pk = required_signer.public_key.to_byte_type();
-            let fee_signer = required_signer;
+            let fee_signer = self.key_manager_api.get_public_key(signing_key_id)?;
 
             // Generate fee transfer statement
             let fee_transfer_statement = self.outputs_api.generate_transfer_statement(TransferStatementParams {
-                spend_key_id: owner_key_id,
                 view_only_key_id: owner_account.view_only_key_id(),
                 resource_address: &params.resource_address,
                 resource_view_key: None,
@@ -398,7 +405,6 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
                 input_revealed_amount: fee_inputs_to_spend.revealed,
                 outputs: fee_change_output,
                 output_revealed_amount: Amount::from(params.max_fee),
-                required_signer: required_signer_pk,
             })?;
 
             // Add the unconfirmed fee change output to the wallet store
@@ -433,17 +439,18 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
             // Signing key for main transfer intent
             let must_sign_with_account_key = !params.badge_usage.is_none() || inputs_to_spend.revealed.is_positive();
             let signing_key_id = if must_sign_with_account_key {
-                owner_key_id
+                account_key_id
             } else {
                 self.key_manager_api.next_derived_key_id(KeyBranch::Nonce)?.into()
             };
-            let main_signer = if fee_signer.key_id() == signing_key_id {
+
+            // No need to add another signature if the fee signer is the same as the main signer
+            let main_intent_signer = if fee_signer.key_id() == signing_key_id {
                 None
             } else {
                 let required_signer = self.key_manager_api.get_public_key(signing_key_id)?;
                 Some(required_signer)
             };
-            let required_signer_pk = main_signer.as_ref().unwrap_or(&fee_signer).public_key().to_byte_type();
 
             // If we're spending from the owner account, add the inputs
             if inputs_to_spend.revealed.is_positive() || fee_inputs_to_spend.revealed.is_positive() {
@@ -492,16 +499,17 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
                         details: "Change amount exceeds u64".to_string(),
                     })?,
                 memo: None,
+                pay_to: PayTo::StealthPublicKey,
             });
 
+            let output_revealed_amount = params.total_revealed_output_amount();
             let outputs_to_create = params
                 .outputs
                 .iter()
                 .map(TryInto::try_into)
-                .collect::<Result<Vec<StealthOutputToCreate>, StealthTransferApiError>>()?;
+                .collect::<Result<Vec<_>, StealthOutputsApiError>>()?;
 
             let transfer_statement = self.outputs_api.generate_transfer_statement(TransferStatementParams {
-                spend_key_id: owner_key_id,
                 view_only_key_id: owner_account.view_only_key_id(),
                 resource_address: &params.resource_address,
                 resource_view_key,
@@ -511,8 +519,7 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
                     .into_iter()
                     .chain(change_output)
                     .filter(|o| o.amount > 0),
-                output_revealed_amount: params.total_revealed_output_amount(),
-                required_signer: required_signer_pk,
+                output_revealed_amount,
             })?;
 
             // Add the unconfirmed change output to the wallet store
@@ -576,6 +583,18 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
                 substate_inputs.push(SubstateRequirement::unversioned(badge_vault.id));
             }
 
+            // We assume that all inputs being spent require a signature. This is fine because we currently filter out
+            // inputs that have complex access rules from input selection.
+            let utxo_spend_keys = inputs_to_spend
+                .inputs
+                .iter()
+                .chain(&fee_inputs_to_spend.inputs)
+                .map(|i| StealthUtxoSpendKeyId {
+                    account_key_id,
+                    public_nonce: i.public_nonce,
+                })
+                .collect();
+
             let transaction = self.generate_transfer_transaction(
                 network,
                 &owner_account,
@@ -590,7 +609,8 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
                 transaction,
                 fee_inputs: fee_inputs_to_spend,
                 transfer_inputs: inputs_to_spend,
-                additional_signer: main_signer,
+                utxo_spend_keys,
+                additional_signer: main_intent_signer,
                 main_signer: fee_signer,
             }))
         })
@@ -830,12 +850,14 @@ impl<'a, TSpec: WalletSdkSpec> StealthTransferApi<'a, TSpec> {
             encrypted_data: output.output.encrypted_data.clone(),
             status: OutputStatus::LockedUnconfirmed,
             memo,
+            spend_condition: output.spend_condition.clone(),
             minimum_value_promise: output.output.minimum_value_promise,
             tag_byte: output.tag,
             lock_id: Some(lock_id),
             is_burnt: false,
             is_frozen: false,
             is_on_chain: false,
+            is_condition_spendable: self.outputs_api.is_spendable_condition(&output.spend_condition),
         })?;
         Ok(())
     }
diff --git a/crates/wallet/sdk/src/apis/stealth_transfer/params.rs b/crates/wallet/sdk/src/apis/stealth_transfer/params.rs
index 6458eef51f..ca64a4bbd5 100644
--- a/crates/wallet/sdk/src/apis/stealth_transfer/params.rs
+++ b/crates/wallet/sdk/src/apis/stealth_transfer/params.rs
@@ -7,12 +7,14 @@ use tari_ootle_address::OotleAddress;
 use tari_ootle_common_types::Network;
 use tari_ootle_wallet_crypto::memo::Memo;
 use tari_template_lib::{
+    auth::AccessRule,
     models::{NonFungibleAddress, ResourceAddress},
     prelude::Amount,
 };
 
 use crate::apis::{
     confidential_transfer::UtxoInputSelection,
+    stealth_outputs::StealthOutputsApiError,
     stealth_transfer::{StealthOutputToCreate, StealthTransferApiError},
 };
 
@@ -100,7 +102,7 @@ impl StealthTransferParams {
 }
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct TransferOutput {
     /// Destination address used to derive the UTXO encryption keys, owner signature and the account in which to
     /// deposit revealed funds
@@ -111,6 +113,7 @@ pub struct TransferOutput {
     pub blinded_amount: u64,
     /// Optional memo to include a memo in the output. This memo is encrypted and can only be read by the recipient.
     pub memo: Option<Memo>,
+    pub pay_to: PayTo,
 }
 
 impl TransferOutput {
@@ -120,24 +123,32 @@ impl TransferOutput {
 }
 
 impl<'a> TryFrom<&'a TransferOutput> for StealthOutputToCreate<'a> {
-    type Error = StealthTransferApiError;
+    type Error = StealthOutputsApiError;
 
     fn try_from(value: &'a TransferOutput) -> Result<Self, Self::Error> {
         Ok(Self {
             owner_address: value.address.try_from_byte_type().map_err(|e| {
-                StealthTransferApiError::InvalidParameter {
+                StealthOutputsApiError::InvalidParameter {
                     param: "destination_address",
                     reason: format!("Invalid destination address: {}", e),
                 }
             })?,
             amount: value.blinded_amount,
             memo: value.memo.as_ref(),
+            pay_to: value.pay_to.clone(),
         })
     }
 }
 
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
+pub enum PayTo {
+    StealthPublicKey,
+    AccessRule(AccessRule),
+}
+
 #[derive(Debug, Clone, Deserialize, Serialize, Default)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub enum BadgeUsage {
     /// Do not use a badge
     #[default]
diff --git a/crates/wallet/sdk/src/apis/stealth_transfer/types.rs b/crates/wallet/sdk/src/apis/stealth_transfer/types.rs
index 731ef6647d..9377ebd656 100644
--- a/crates/wallet/sdk/src/apis/stealth_transfer/types.rs
+++ b/crates/wallet/sdk/src/apis/stealth_transfer/types.rs
@@ -2,26 +2,30 @@
 //   SPDX-License-Identifier: BSD-3-Clause
 
 use tari_ootle_address::RistrettoOotleAddress;
-use tari_ootle_wallet_crypto::{memo::Memo, UnblindedStealthInputWitness};
+use tari_ootle_wallet_crypto::{memo::Memo, StealthInputWitness};
 use tari_template_lib::{
     models::{ComponentAddress, VaultId},
     prelude::Amount,
 };
 use tari_transaction::UnsignedTransaction;
 
-use crate::models::{InputSpendData, WalletPublicKey};
+use crate::{
+    apis::stealth_transfer::PayTo,
+    models::{InputSpendData, StealthUtxoSpendKeyId, WalletPublicKey},
+};
 
 pub struct StealthTransferOutput {
     pub transaction: UnsignedTransaction,
     pub fee_inputs: InputsToSpend,
     pub transfer_inputs: InputsToSpend,
+    pub utxo_spend_keys: Vec<StealthUtxoSpendKeyId>,
     pub additional_signer: Option<WalletPublicKey>,
     pub main_signer: WalletPublicKey,
 }
 
 #[derive(Debug)]
 pub struct UnblindedInputToSpend {
-    pub witness: UnblindedStealthInputWitness,
+    pub witness: StealthInputWitness,
 }
 
 impl UnblindedInputToSpend {
@@ -33,6 +37,7 @@ impl UnblindedInputToSpend {
 #[derive(Debug, Clone)]
 pub struct StealthOutputToCreate<'a> {
     pub owner_address: RistrettoOotleAddress,
+    pub pay_to: PayTo,
     pub amount: u64,
     pub memo: Option<&'a Memo>,
 }
diff --git a/crates/wallet/sdk/src/key_managers/backend.rs b/crates/wallet/sdk/src/key_managers/backend.rs
index 3db1d1b882..abe4e65c12 100644
--- a/crates/wallet/sdk/src/key_managers/backend.rs
+++ b/crates/wallet/sdk/src/key_managers/backend.rs
@@ -30,7 +30,7 @@ pub trait WalletKeyStore {
         message: &M,
     ) -> Result<SignatureOutput, Self::Error> {
         let secret = self.derive_secret(key_branch, index)?;
-        let signature = RistrettoSchnorr::sign(&secret, message.as_signing_message(context), &mut OsRng)
+        let signature = RistrettoSchnorr::sign(&secret, message.to_signing_message(context), &mut OsRng)
             .expect("RistrettoSchnorr::sign is infallible as it internally hashes the message into canonical form");
         Ok(SignatureOutput {
             signature,
diff --git a/crates/wallet/sdk/src/models/account.rs b/crates/wallet/sdk/src/models/account.rs
index 7b62eac1bc..3623ae56ec 100644
--- a/crates/wallet/sdk/src/models/account.rs
+++ b/crates/wallet/sdk/src/models/account.rs
@@ -126,7 +126,7 @@ impl Display for AccountWithAddress {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct NewAccountData {
     pub address: ComponentAddress,
 }
diff --git a/crates/wallet/sdk/src/models/key.rs b/crates/wallet/sdk/src/models/key.rs
index f99136c6ff..5a39b12e9c 100644
--- a/crates/wallet/sdk/src/models/key.rs
+++ b/crates/wallet/sdk/src/models/key.rs
@@ -15,7 +15,7 @@ use tari_ootle_common_types::Signable;
 use tari_template_lib::prelude::RistrettoPublicKeyBytes;
 
 #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, Hash)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 #[serde(rename_all = "snake_case")]
 pub enum KeyBranch {
     /// The account key branch, used for deriving account keys.
@@ -176,7 +176,7 @@ impl WalletSecretKey {
     }
 
     pub fn sign<T: Signable<C>, C>(&self, context: C, item: &T) -> RistrettoSchnorr {
-        let message = item.as_signing_message(context);
+        let message = item.to_signing_message(context);
         RistrettoSchnorr::sign(&self.secret, message.as_ref(), &mut OsRng)
             .expect("message is hashed internally into canonical form, so signing is infallible")
     }
@@ -299,7 +299,7 @@ impl From<RistrettoPublicKeyBytes> for KeyIdOrPublicKey {
 }
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Hash)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub struct DerivedKeyId {
     pub branch: KeyBranch,
     pub index: DerivedKeyIndex,
@@ -332,13 +332,20 @@ impl TryFrom<KeyId> for DerivedKeyId {
                 branch: key_branch,
                 index,
             }),
-            KeyId::Imported { .. } => Err(anyhow!("Cannot convert Imported KeyId to DerivedKeyId")),
+            _ => Err(anyhow!("Cannot convert Imported KeyId to DerivedKeyId")),
         }
     }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, serde::Serialize, serde::Deserialize)]
-#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-daemon-client/"))]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
+pub struct StealthUtxoSpendKeyId {
+    pub account_key_id: KeyId,
+    pub public_nonce: RistrettoPublicKeyBytes,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, serde::Serialize, serde::Deserialize)]
+#[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export, export_to = "wallet-types/"))]
 pub enum KeyId {
     /// Derived from the seed key
     Derived {
diff --git a/crates/wallet/sdk/src/models/stealth_output.rs b/crates/wallet/sdk/src/models/stealth_output.rs
index b0fa7bbab8..692d0cb462 100644
--- a/crates/wallet/sdk/src/models/stealth_output.rs
+++ b/crates/wallet/sdk/src/models/stealth_output.rs
@@ -3,7 +3,7 @@
 
 use tari_ootle_wallet_crypto::memo::Memo;
 use tari_template_lib::{
-    models::{ComponentAddress, UtxoAddress},
+    models::{ComponentAddress, SpendCondition, UtxoAddress},
     prelude::{PedersenCommitmentBytes, ResourceAddress, RistrettoPublicKeyBytes},
     types::{crypto::UtxoTag, Amount, EncryptedData},
 };
@@ -11,6 +11,7 @@ use tari_template_lib::{
 use crate::models::{KeyId, OutputStatus, WalletLockId};
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+#[allow(clippy::struct_excessive_bools)]
 pub struct StealthOutputModel {
     pub owner_account: ComponentAddress,
     pub resource_address: ResourceAddress,
@@ -24,11 +25,13 @@ pub struct StealthOutputModel {
     pub encrypted_data: EncryptedData,
     pub tag_byte: UtxoTag,
     pub memo: Option<Memo>,
+    pub spend_condition: SpendCondition,
     pub minimum_value_promise: u64,
     pub status: OutputStatus,
     pub is_burnt: bool,
     pub is_frozen: bool,
     pub is_on_chain: bool,
+    pub is_condition_spendable: bool,
     pub lock_id: Option<WalletLockId>,
 }
 
diff --git a/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql b/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql
index 2c9e6cc5eb..c493c8bb02 100644
--- a/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql
+++ b/crates/wallet/storage_sqlite/migrations/2023-02-08-122514_initial/up.sql
@@ -246,27 +246,29 @@ CREATE TABLE webauthn_registration_passkeys
 -- Stealth Outputs
 CREATE TABLE stealth_outputs
 (
-    id                    INTEGER  NOT NULL PRIMARY KEY AUTOINCREMENT,
-    owner_account_id      INTEGER  NOT NULL REFERENCES accounts (id),
-    resource_address      TEXT     NOT NULL,
-    commitment            TEXT     NOT NULL,
-    value                 BIGINT   NOT NULL,
-    sender_public_nonce   TEXT     NOT NULL,
+    id                     INTEGER  NOT NULL PRIMARY KEY AUTOINCREMENT,
+    owner_account_id       INTEGER  NOT NULL REFERENCES accounts (id),
+    resource_address       TEXT     NOT NULL,
+    commitment             TEXT     NOT NULL,
+    value                  BIGINT   NOT NULL,
+    sender_public_nonce    TEXT     NOT NULL,
     -- Status can be "Unspent", "Spent", "Locked", "LockedUnconfirmed", "Invalid"
-    status                TEXT     NOT NULL,
-    locked_at             DATETIME NULL,
-    lock_id               INTEGER  NULL,
-    view_only_key_id      TEXT     NOT NULL,
-    owner_key_id          TEXT     NULL,
-    encrypted_data        BLOB     NOT NULL DEFAULT '',
-    tag_byte              INTEGER  NOT NULL,
-    memo_json             TEXT     NULL,
-    minimum_value_promise BIGINT   NOT NULL,
-    is_burnt              BOOLEAN  NOT NULL DEFAULT 0,
-    is_frozen             BOOLEAN  NOT NULL DEFAULT 0,
-    is_on_chain           BOOLEAN  NOT NULL,
-    created_at            DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at            DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+    status                 TEXT     NOT NULL,
+    locked_at              DATETIME NULL,
+    lock_id                INTEGER  NULL,
+    view_only_key_id       TEXT     NOT NULL,
+    owner_key_id           TEXT     NULL,
+    encrypted_data         BLOB     NOT NULL DEFAULT '',
+    tag_byte               INTEGER  NOT NULL,
+    memo_json              TEXT     NULL,
+    spend_condition        TEXT     NOT NULL,
+    minimum_value_promise  BIGINT   NOT NULL,
+    is_burnt               BOOLEAN  NOT NULL DEFAULT 0,
+    is_frozen              BOOLEAN  NOT NULL DEFAULT 0,
+    is_on_chain            BOOLEAN  NOT NULL,
+    is_condition_spendable BOOLEAN  NOT NULL,
+    created_at             DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at             DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 
 CREATE UNIQUE INDEX stealth_outputs_uniq_resource_addr_commitment ON stealth_outputs (resource_address, commitment);
diff --git a/crates/wallet/storage_sqlite/src/models/stealth_output.rs b/crates/wallet/storage_sqlite/src/models/stealth_output.rs
index ad3b0ea2e6..7022fea8d0 100644
--- a/crates/wallet/storage_sqlite/src/models/stealth_output.rs
+++ b/crates/wallet/storage_sqlite/src/models/stealth_output.rs
@@ -22,6 +22,7 @@ use crate::{
 
 #[derive(Debug, Clone, Identifiable, Queryable)]
 #[diesel(table_name = stealth_outputs)]
+#[allow(clippy::struct_excessive_bools)]
 pub struct StealthOutput {
     pub id: i32,
     pub owner_account_id: i32,
@@ -37,10 +38,12 @@ pub struct StealthOutput {
     pub encrypted_data: Vec<u8>,
     pub tag_byte: i32,
     pub memo_json: Option<String>,
+    pub spend_condition: String,
     pub minimum_value_promise: i64,
     pub is_burnt: bool,
     pub is_frozen: bool,
     pub is_on_chain: bool,
+    pub is_condition_spendable: bool,
     pub created_at: PrimitiveDateTime,
     pub updated_at: PrimitiveDateTime,
 }
@@ -84,6 +87,7 @@ impl StealthOutput {
             })?,
             tag_byte: UtxoTag::new(self.tag_byte as u32),
             memo: self.memo_json.as_ref().map(deserialize_json).transpose()?,
+            spend_condition: deserialize_json(&self.spend_condition)?,
             minimum_value_promise: self.minimum_value_promise as u64,
             status: self.status.parse().map_err(|_| WalletStorageError::DecodingError {
                 operation: "try_into_output",
@@ -93,6 +97,7 @@ impl StealthOutput {
             is_burnt: self.is_burnt,
             is_frozen: self.is_frozen,
             is_on_chain: self.is_on_chain,
+            is_condition_spendable: self.is_condition_spendable,
             lock_id: self.locked_by_proof,
         })
     }
diff --git a/crates/wallet/storage_sqlite/src/reader.rs b/crates/wallet/storage_sqlite/src/reader.rs
index 9206c945c8..5b69a2b0d2 100644
--- a/crates/wallet/storage_sqlite/src/reader.rs
+++ b/crates/wallet/storage_sqlite/src/reader.rs
@@ -986,6 +986,7 @@ impl WalletStoreReader for ReadTransaction<'_> {
             )
             .filter(stealth_outputs::owner_key_id.is_not_null())
             .filter(stealth_outputs::is_burnt.eq(false))
+            .filter(stealth_outputs::is_condition_spendable.eq(true))
             .filter(stealth_outputs::is_frozen.eq(false))
             .load_iter::<models::StealthOutput, _>(self.connection())
             .map_err(|e| WalletStorageError::general(OPERATION, e))?;
diff --git a/crates/wallet/storage_sqlite/src/schema.rs b/crates/wallet/storage_sqlite/src/schema.rs
index ee96478a9a..af8c0fb159 100644
--- a/crates/wallet/storage_sqlite/src/schema.rs
+++ b/crates/wallet/storage_sqlite/src/schema.rs
@@ -163,10 +163,12 @@ diesel::table! {
         encrypted_data -> Binary,
         tag_byte -> Integer,
         memo_json -> Nullable<Text>,
+        spend_condition -> Text,
         minimum_value_promise -> BigInt,
         is_burnt -> Bool,
         is_frozen -> Bool,
         is_on_chain -> Bool,
+        is_condition_spendable -> Bool,
         created_at -> Timestamp,
         updated_at -> Timestamp,
     }
diff --git a/crates/wallet/storage_sqlite/src/writer.rs b/crates/wallet/storage_sqlite/src/writer.rs
index 50c441ecd2..3b2766a61a 100644
--- a/crates/wallet/storage_sqlite/src/writer.rs
+++ b/crates/wallet/storage_sqlite/src/writer.rs
@@ -1229,6 +1229,7 @@ impl WalletStoreWriter for WriteTransaction<'_> {
             .filter(stealth_outputs::owner_key_id.is_not_null())
             .filter(stealth_outputs::is_burnt.eq(false))
             .filter(stealth_outputs::is_frozen.eq(false))
+            .filter(stealth_outputs::is_condition_spendable.eq(true))
             .order_by(stealth_outputs::value.asc())
             .first::<models::StealthOutput>(self.connection())
             .optional()
@@ -1314,11 +1315,13 @@ impl WalletStoreWriter for WriteTransaction<'_> {
                 stealth_outputs::encrypted_data.eq(output.encrypted_data.as_ref()),
                 stealth_outputs::tag_byte.eq(output.tag_byte.value() as i32),
                 stealth_outputs::memo_json.eq(output.memo.as_ref().map(serialize_json).transpose()?),
+                stealth_outputs::spend_condition.eq(serialize_json(&output.spend_condition)?),
                 stealth_outputs::minimum_value_promise.eq(output.minimum_value_promise as i64),
                 stealth_outputs::is_on_chain.eq(output.is_on_chain),
                 stealth_outputs::status.eq(output.status.as_key_str()),
                 stealth_outputs::is_burnt.eq(output.is_burnt),
                 stealth_outputs::is_frozen.eq(output.is_frozen),
+                stealth_outputs::is_condition_spendable.eq(output.is_condition_spendable),
                 stealth_outputs::lock_id.eq(output.lock_id),
             ))
             .execute(self.connection())
diff --git a/integration_tests/src/wallet_daemon_client.rs b/integration_tests/src/wallet_daemon_client.rs
index 6142e3f429..a51dc4a00d 100644
--- a/integration_tests/src/wallet_daemon_client.rs
+++ b/integration_tests/src/wallet_daemon_client.rs
@@ -28,7 +28,10 @@ use tari_engine_types::substate::SubstateId;
 use tari_ootle_address::OotleAddress;
 use tari_ootle_common_types::{Epoch, SubstateRequirement};
 use tari_ootle_wallet_sdk::{
-    apis::{confidential_transfer::UtxoInputSelection, stealth_transfer::BadgeUsage},
+    apis::{
+        confidential_transfer::UtxoInputSelection,
+        stealth_transfer::{BadgeUsage, PayTo},
+    },
     models::{Account, AccountWithAddress, NonFungibleToken},
 };
 use tari_template_lib::{
@@ -130,6 +133,7 @@ pub async fn transfer_stealth(
                 blinded_output_amount: amount,
                 revealed_output_amount: Default::default(),
                 output_memo: None,
+                pay_to: PayTo::StealthPublicKey,
             }],
             max_fee: 2000,
             dry_run: false,
@@ -651,7 +655,7 @@ pub async fn create_component(
 
     let transaction = transaction_builder()
         .fee_transaction_pay_from_component(account.component_address, 5000)
-        .call_function(template_address, &function_call, args)
+        .call_function(template_address, function_call, args)
         .with_min_epoch(min_epoch)
         .with_max_epoch(max_epoch)
         .build_unsigned_transaction();
diff --git a/utilities/tariswap_test_bench/src/accounts.rs b/utilities/tariswap_test_bench/src/accounts.rs
index b8662963dc..1840531cc2 100644
--- a/utilities/tariswap_test_bench/src/accounts.rs
+++ b/utilities/tariswap_test_bench/src/accounts.rs
@@ -43,7 +43,7 @@ impl Runner {
                 SubstateRequirement::unversioned(XTR_FAUCET_COMPONENT_ADDRESS),
                 SubstateRequirement::unversioned(XTR_FAUCET_VAULT_ADDRESS),
             ])
-            .build();
+            .finish();
 
         let transaction = self.sdk.signer_api().sign(owner_key.key_id, transaction)?;
 
@@ -115,7 +115,7 @@ impl Runner {
                 SubstateRequirement::unversioned(pay_fee_vault.id),
                 SubstateRequirement::unversioned(pay_fee_vault.resource_address),
             ])
-            .build();
+            .finish();
 
         let transaction = self.sdk.signer_api().sign(key.key_id, transaction)?;
 
diff --git a/utilities/tariswap_test_bench/src/tariswap.rs b/utilities/tariswap_test_bench/src/tariswap.rs
index 4cbbab2129..344e110384 100644
--- a/utilities/tariswap_test_bench/src/tariswap.rs
+++ b/utilities/tariswap_test_bench/src/tariswap.rs
@@ -149,13 +149,12 @@ impl Runner {
                     .with_authorized_seal_signer()
                     .map(|builder| {
                         // First sign with the account key to authorize the use of the account component
-                        self.sdk.signer_api().sign_with_context(
-                            account.owner_key_id.expect("no owner key id"),
-                            &primary_account_pk,
-                            builder,
-                        )
+                        self.sdk
+                            .signer_api()
+                            .with_context(&primary_account_pk)
+                            .sign(account.owner_key_id.expect("no owner key id"), builder)
                     })?
-                    .build();
+                    .finish();
 
                 // Then sign with the primary account key to pay the fee
                 let transaction = self.sdk.signer_api().sign(primary_account_key.key_id(), transaction)?;
@@ -277,16 +276,16 @@ impl Runner {
                     .call_method(account.component_address, "deposit", args![Workspace("swapped")])
                     .with_authorized_seal_signer();
 
-                let transaction = self.sdk.signer_api().sign_with_context(
-                    account.owner_key_id.expect("no owner key id"),
-                    &primary_account_pk,
-                    transaction,
-                )?;
+                let transaction = self
+                    .sdk
+                    .signer_api()
+                    .with_context(&primary_account_pk)
+                    .sign(account.owner_key_id.expect("no owner key id"), transaction)?;
 
                 let transaction = self
                     .sdk
                     .signer_api()
-                    .sign(primary_account_key.key_id(), transaction.build())?;
+                    .sign(primary_account_key.key_id(), transaction.finish())?;
 
                 tx_ids.push(self.submit_transaction(transaction).await?);
             }
@@ -350,7 +349,7 @@ impl Runner {
                     .put_last_instruction_output_on_workspace("swapped")
                     .call_method(account.component_address, "deposit", args![Workspace("swapped")])
                     .with_authorized_seal_signer()
-                    .build();
+                    .finish();
 
                 let transaction = self
                     .sdk
diff --git a/utilities/traffic-sim/src/sim.rs b/utilities/traffic-sim/src/sim.rs
index e3854825e8..3e757524af 100644
--- a/utilities/traffic-sim/src/sim.rs
+++ b/utilities/traffic-sim/src/sim.rs
@@ -18,7 +18,10 @@ use tari_ootle_common_types::{
     Network,
 };
 use tari_ootle_wallet_sdk::{
-    apis::{confidential_transfer::UtxoInputSelection, stealth_transfer::TransferOutput},
+    apis::{
+        confidential_transfer::UtxoInputSelection,
+        stealth_transfer::{PayTo, TransferOutput},
+    },
     crypto::memo::Memo,
     models::{AccountWithAddress, KeyBranch},
 };
@@ -232,6 +235,7 @@ impl TrafficSim {
                     blinded_output_amount: amount_to_send,
                     revealed_output_amount: Default::default(),
                     output_memo: Some(Memo::new_message(format!("Transfer {id}: {amount_to_send}")).unwrap()),
+                    pay_to: PayTo::StealthPublicKey,
                 }],
                 max_fee: 1000,
                 dry_run: false,
@@ -457,6 +461,7 @@ impl TrafficSim {
                             revealed_amount: Amount::zero(),
                             blinded_amount: fund_amount,
                             memo: Some(Memo::new_message(format!("Initial Funding: {fund_amount}")).unwrap()),
+                            pay_to: PayTo::StealthPublicKey,
                         }],
                     }],
                 })