diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 86f2ff040..f2bd0158f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -84,9 +84,6 @@ jobs:
         run: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn --immutable
       - name: Build public packages
         run: yarn build:public
-      - name: Lint viewer-sandbox
-        run: yarn lint:ci
-        working-directory: 'packages/viewer-sandbox'
       - name: Build viewer-sandbox
         run: yarn build
         working-directory: 'packages/viewer-sandbox'
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a355782fb..d1e50b61a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -69,6 +69,7 @@ jobs:
   test-frontend-2:
     name: Frontend
     runs-on: blacksmith
+    if: false # disabled as there is nothing to run
     steps:
       - uses: actions/checkout@v4.2.2
       - uses: useblacksmith/setup-node@v5
@@ -79,9 +80,6 @@ jobs:
         run: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn --immutable
       - name: Build public packages
         run: yarn build:public
-      - name: Lint everything
-        run: yarn lint:ci
-        working-directory: 'packages/frontend-2'
 
   test-viewer:
     name: Viewer
@@ -96,15 +94,9 @@ jobs:
         run: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn --immutable
       - name: Build public packages
         run: yarn build:public
-      - name: Lint viewer
-        run: yarn lint:ci
-        working-directory: 'packages/viewer'
       - name: Run tests
         run: yarn test
         working-directory: 'packages/viewer'
-      - name: Lint viewer-sandbox
-        run: yarn lint:ci
-        working-directory: 'packages/viewer-sandbox'
       - name: Build viewer-sandbox
         run: yarn build
         working-directory: 'packages/viewer-sandbox'
@@ -141,9 +133,6 @@ jobs:
           cache: yarn
       - name: Install dependencies
         run: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn --immutable
-      - name: Lint
-        run: yarn lint:ci
-        working-directory: 'packages/shared'
       - name: Run tests (all FFs)
         run: ENABLE_ALL_FFS=1 yarn test:ci
         working-directory: 'packages/shared'
@@ -179,7 +168,7 @@ jobs:
         run: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn --immutable
       - name: Build public packages
         run: yarn build:public
-      - name: Lint everything
+      - name: Test object sender
         run: yarn test:ci
         working-directory: 'packages/objectsender'
       - uses: codecov/codecov-action@v5
@@ -202,15 +191,6 @@ jobs:
         run: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true yarn --immutable # we need PLAYWRIGHT
       - name: Build public packages
         run: yarn build:public
-      - name: Lint tailwind theme
-        run: yarn lint:ci
-        working-directory: 'packages/tailwind-theme'
-      - name: Lint ui components
-        run: yarn lint:ci
-        working-directory: 'packages/ui-components'
-      - name: Lint component nuxt package
-        run: yarn lint:ci
-        working-directory: 'packages/ui-components-nuxt'
       - name: Test via Storybook
         run: yarn storybook:test:ci
         working-directory: 'packages/ui-components'
@@ -218,6 +198,7 @@ jobs:
   test-preview-service:
     name: Preview service
     runs-on: blacksmith
+    if: false # disabled as there is nothing to run
     steps:
       - uses: actions/checkout@v4.2.2
       - uses: useblacksmith/setup-node@v5
@@ -228,9 +209,6 @@ jobs:
         run: YARN_ENABLE_HARDENED_MODE=0 PUPPETEER_SKIP_DOWNLOAD=true PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 yarn --immutable
       - name: Build public packages
         run: yarn build:public
-      - name: Lint everything
-        run: yarn lint:ci
-        working-directory: 'packages/preview-service'
 
   docker-build-postgres-container:
     runs-on: blacksmith
@@ -319,9 +297,6 @@ jobs:
         run: yarn build:public
       - run: cp .env.test-example .env.test
         working-directory: 'packages/server'
-      - name: 'Lint'
-        run: yarn lint:ci
-        working-directory: 'packages/server'
       - name: 'Run test'
         run: yarn test:report
         working-directory: 'packages/server'
diff --git a/docker-compose-speckle.yml b/docker-compose-speckle.yml
index 18d16e931..e8fb2b8c5 100644
--- a/docker-compose-speckle.yml
+++ b/docker-compose-speckle.yml
@@ -32,6 +32,7 @@ services:
       NUXT_PUBLIC_BACKEND_API_ORIGIN: 'http://speckle-server:3000'
       NUXT_PUBLIC_LOG_LEVEL: 'warn'
       NUXT_REDIS_URL: 'redis://redis'
+      NUXT_PUBLIC_FF_LARGE_FILE_IMPORTS_ENABLED: 'true'
       LOG_LEVEL: 'info'
       LOG_PRETTY: 'true'
     depends_on:
@@ -79,9 +80,11 @@ services:
       REDIS_URL: 'redis://redis'
       PREVIEW_SERVICE_USE_PRIVATE_OBJECTS_SERVER_URL: 'true'
       PREVIEW_SERVICE_REDIS_URL: 'redis://redis'
+      FILEIMPORT_SERVICE_USE_PRIVATE_OBJECTS_SERVER_URL: 'true'
       FILEIMPORT_SERVICE_REDIS_URL: 'redis://redis'
 
       S3_ENDPOINT: 'http://minio:9000'
+      S3_PUBLIC_ENDPOINT: 'http://127.0.0.1:9000'
       S3_ACCESS_KEY: 'minioadmin'
       S3_SECRET_KEY: 'minioadmin'
       S3_BUCKET: 'speckle-server'
@@ -92,6 +95,8 @@ services:
 
       FRONTEND_ORIGIN: 'http://127.0.0.1'
       ONBOARDING_STREAM_URL: 'https://latest.speckle.systems/projects/843d07eb10'
+
+      FF_LARGE_FILE_IMPORTS_ENABLED: 'true'
     depends_on:
       []
       # - minio
diff --git a/packages/fileimport-service/.env.example b/packages/fileimport-service/.env.example
index d162e5f97..0f9bb339f 100644
--- a/packages/fileimport-service/.env.example
+++ b/packages/fileimport-service/.env.example
@@ -4,7 +4,8 @@ POSTGRES_MAX_CONNECTIONS_FILE_IMPORT_SERVICE='1'
 POSTGRES_CONNECTION_ACQUIRE_TIMEOUT_MILLIS='16000'
 POSTGRES_CONNECTION_CREATE_TIMEOUT_MILLIS='5000'
 FF_WORKSPACES_MULTI_REGION_ENABLED=false
-USE_LEGACY_IFC_IMPORTER=true
+FF_LEGACY_IFC_IMPORTER_ENABLED=true
+FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED=false
 # IFC_DOTNET_DLL_PATH='packages/fileimport-service/src/ifc-dotnet/ifc-converter.dll'
 
 ##########################################################
diff --git a/packages/fileimport-service/Dockerfile b/packages/fileimport-service/Dockerfile
index 47bce1ba4..a62a15c72 100644
--- a/packages/fileimport-service/Dockerfile
+++ b/packages/fileimport-service/Dockerfile
@@ -12,6 +12,7 @@ WORKDIR /speckle-server
 
 # configure tini
 ARG TINI_VERSION=v0.19.0
+ARG SPECKLE_IFC_VERSION=0.2.0
 
 # hadolint ignore=DL3008
 RUN apt-get update -y \
@@ -20,6 +21,10 @@ RUN apt-get update -y \
      ca-certificates=20240203 \
      curl=8.5.0-2ubuntu10.6 \
      gosu=1.17-1ubuntu0.24.04.3 \
+    && curl -L -o speckleifc.tar.gz https://github.com/specklesystems/speckleifc/archive/refs/tags/v${SPECKLE_IFC_VERSION}.tar.gz \
+    && mkdir speckleifc \
+    && tar --strip-components=1 -C speckleifc -xzf speckleifc.tar.gz speckleifc-${SPECKLE_IFC_VERSION} \
+    && rm speckleifc.tar.gz \
     && curl -fsSL https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini -o /usr/bin/tini \
     && chmod +x /usr/bin/tini \
     && curl -fsSL https://deb.nodesource.com/setup_22.x -o nodesource_setup.sh \
diff --git a/packages/fileimport-service/requirements.txt b/packages/fileimport-service/requirements.txt
index d5abd71fb..e3d3478b6 100644
--- a/packages/fileimport-service/requirements.txt
+++ b/packages/fileimport-service/requirements.txt
@@ -3,3 +3,4 @@ specklepy==3.0.1
 structlog==23.3.0
 numpy==1.26.4 # not directly required, pinned to avoid a vulnerability in <1.22.2
 python-util==1.2.1 # not directly required, peer dependency of numpy-stl
+ifcopenshell==0.8.2 # required for speckleifc
diff --git a/packages/fileimport-service/src/controller/daemon.ts b/packages/fileimport-service/src/controller/daemon.ts
index bc357cbb6..f14a5f612 100644
--- a/packages/fileimport-service/src/controller/daemon.ts
+++ b/packages/fileimport-service/src/controller/daemon.ts
@@ -5,26 +5,24 @@ import {
   metricOperationErrors
 } from '@/controller/prometheusMetrics.js'
 import { DbClient, getDbClients } from '@/clients/knex.js'
-
 import { downloadFile } from '@/controller/filesApi.js'
 import fs from 'fs'
-
 import { ServerAPI } from '@/controller/api.js'
 import { downloadDependencies } from '@/controller/objDependencies.js'
 import { logger } from '@/observability/logging.js'
 import { Nullable, Scopes, wait, TIME_MS } from '@speckle/shared'
 import { Knex } from 'knex'
-import {
-  getIfcDllPath,
-  isProdEnv,
-  useLegacyIfcImporter
-} from '@/controller/helpers/env.js'
+import { getIfcDllPath, isProdEnv } from '@/controller/helpers/env.js'
 import { isErrorOutput, isSuccessOutput } from '@/common/output.js'
 import { runProcessWithTimeout } from '@/common/processHandling.js'
 import {
   getConnectionSettings,
   obfuscateConnectionString
 } from '@speckle/shared/environment/db'
+import { getFeatureFlags } from '@speckle/shared/environment'
+
+const { FF_LEGACY_IFC_IMPORTER_ENABLED, FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED } =
+  getFeatureFlags()
 
 const HEALTHCHECK_FILE_PATH = '/tmp/last_successful_query'
 
@@ -183,7 +181,7 @@ async function doTask(
     if (info.fileType.toLowerCase() === 'ifc') {
       if (
         info.fileName.toLowerCase().endsWith('.legacyimporter.ifc') ||
-        useLegacyIfcImporter()
+        FF_LEGACY_IFC_IMPORTER_ENABLED
       ) {
         await runProcessWithTimeout(
           taskLogger,
@@ -208,7 +206,10 @@ async function doTask(
           TIME_LIMIT,
           TMP_RESULTS_PATH
         )
-      } else {
+      } else if (
+        info.fileName.toLowerCase().endsWith('.dotnetimporter.ifc') ||
+        !FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED
+      ) {
         await runProcessWithTimeout(
           taskLogger,
           process.env['DOTNET_BINARY_PATH'] || 'dotnet',
@@ -228,6 +229,27 @@ async function doTask(
           TIME_LIMIT,
           TMP_RESULTS_PATH
         )
+      } else {
+        await runProcessWithTimeout(
+          taskLogger,
+          process.env['PYTHON_BINARY_PATH'] || 'python3',
+          [
+            '-m',
+            'speckleifc',
+            TMP_FILE_PATH,
+            TMP_RESULTS_PATH,
+            info.streamId,
+            `File upload: ${info.fileName}`,
+            existingBranch?.id || ''
+          ],
+          {
+            USER_TOKEN: tempUserToken,
+            //speckleifc is not installed to sys (e.g. via pip), so we need to point it to the directory explicitly
+            PYTHONPATH: '/speckle-server/speckleifc/src/'
+          },
+          TIME_LIMIT,
+          TMP_RESULTS_PATH
+        )
       }
     } else if (info.fileType.toLowerCase() === 'stl') {
       await runProcessWithTimeout(
diff --git a/packages/fileimport-service/src/controller/helpers/env.ts b/packages/fileimport-service/src/controller/helpers/env.ts
index 84b224267..07819fa96 100644
--- a/packages/fileimport-service/src/controller/helpers/env.ts
+++ b/packages/fileimport-service/src/controller/helpers/env.ts
@@ -16,10 +16,6 @@ export function isProdEnv() {
 
 export const isDevOrTestEnv = () => isDevEnv() || isTestEnv()
 
-export const useLegacyIfcImporter = () => {
-  return ['true', '1'].includes(process.env.USE_LEGACY_IFC_IMPORTER || 'false')
-}
-
 export const getPackageRootDirPath = () => {
   const __filename = url.fileURLToPath(import.meta.url)
   const __dirname = path.dirname(__filename)
diff --git a/packages/fileimport-service/src/nextGen/jobProcessor.ts b/packages/fileimport-service/src/nextGen/jobProcessor.ts
index 289e23f70..b0262d853 100644
--- a/packages/fileimport-service/src/nextGen/jobProcessor.ts
+++ b/packages/fileimport-service/src/nextGen/jobProcessor.ts
@@ -11,6 +11,9 @@ import { DOTNET_BINARY_PATH, RHINO_IMPORTER_PATH } from './config.js'
 import { getIfcDllPath } from '@/controller/helpers/env.js'
 import { z } from 'zod'
 import { TIME_MS } from '@speckle/shared'
+import { getFeatureFlags } from '@speckle/shared/environment'
+
+const { FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED } = getFeatureFlags()
 
 const jobSuccess = z.object({
   success: z.literal(true),
@@ -120,26 +123,55 @@ export const jobProcessor = async ({
     switch (fileType) {
       case 'ifc':
         parserUsed = 'ifc'
-        await runProcessWithTimeout(
-          taskLogger,
-          DOTNET_BINARY_PATH,
-          [
-            getIfcDllPath(),
-            sourceFilePath,
-            resultsPath,
-            job.projectId,
-            `File upload: ${job.fileName}`,
-            job.modelId,
-            'bogus',
-            'regionName'
-          ],
-          {
-            SPECKLE_SERVER_URL: job.serverUrl,
-            USER_TOKEN: job.token
-          },
-          Math.min(timeout, job.timeOutSeconds * TIME_MS.second),
-          resultsPath
-        )
+        const useDotnetIfcImporter =
+          job.fileName.toLowerCase().endsWith('.dotnetimporter.ifc') ||
+          !FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED
+
+        if (useDotnetIfcImporter) {
+          await runProcessWithTimeout(
+            taskLogger,
+            DOTNET_BINARY_PATH,
+            [
+              getIfcDllPath(),
+              sourceFilePath,
+              resultsPath,
+              job.projectId,
+              `File upload: ${job.fileName}`,
+              job.modelId,
+              'bogus',
+              'regionName'
+            ],
+            {
+              SPECKLE_SERVER_URL: job.serverUrl,
+              USER_TOKEN: job.token
+            },
+            Math.min(timeout, job.timeOutSeconds * TIME_MS.second),
+            resultsPath
+          )
+        } else {
+          await runProcessWithTimeout(
+            taskLogger,
+            process.env['PYTHON_BINARY_PATH'] || 'python3',
+            [
+              '-m',
+              'speckleifc',
+              sourceFilePath,
+              resultsPath,
+              job.projectId,
+              `File upload: ${job.fileName}`,
+              job.modelId
+            ],
+            {
+              USER_TOKEN: job.token,
+              SPECKLE_SERVER_URL: job.serverUrl,
+              //speckleifc is not installed to sys (e.g. via pip), so we need to point it to the directory explicitly
+              PYTHONPATH: '/speckle-server/speckleifc/src/'
+            },
+            Math.min(timeout, job.timeOutSeconds * TIME_MS.second),
+            resultsPath
+          )
+        }
+
         break
       case 'stl':
       case 'obj':
diff --git a/packages/frontend-2/components/connectors/Card.vue b/packages/frontend-2/components/connectors/Card.vue
index bb8dd0d55..eba8313b3 100644
--- a/packages/frontend-2/components/connectors/Card.vue
+++ b/packages/frontend-2/components/connectors/Card.vue
@@ -1,8 +1,6 @@
 <template>
   <div>
-    <CommonCard
-      class="flex flex-1 flex-col gap-1 !p-4 !pt-2 !pb-3 h-full hover:bg-foundation"
-    >
+    <CommonCard class="flex flex-1 flex-col gap-1 !p-4 !pt-2 !pb-3 h-full">
       <div class="flex gap-2 items-center">
         <div v-if="connector.images" class="relative flex items-start mr-2">
           <div
@@ -29,20 +27,32 @@
         {{ connector.description }}
       </p>
       <div class="flex gap-1 mt-2">
-        <FormButton
-          color="outline"
-          size="sm"
-          :disabled="enableButton"
-          external
-          :to="latestAvailableVersion?.Url"
-          @click="
-            mixpanel.track('Connector Card Install Clicked', {
-              connector: props.connector.slug
-            })
+        <div
+          v-tippy="
+            canDownload
+              ? undefined
+              : {
+                  content: `Please <a href='${loginRoute}'>login</a> or <a href='${registerRoute}'>register</a> to download connectors`,
+                  allowHTML: true,
+                  interactive: true
+                }
           "
         >
-          {{ connector.isComingSoon ? 'Coming soon' : 'Install for Windows' }}
-        </FormButton>
+          <FormButton
+            color="outline"
+            size="sm"
+            :disabled="enableButton"
+            external
+            :to="canDownload ? latestAvailableVersion?.Url : undefined"
+            @click="
+              mixpanel.track('Connector Card Install Clicked', {
+                connector: props.connector.slug
+              })
+            "
+          >
+            {{ connector.isComingSoon ? 'Coming soon' : 'Install for Windows' }}
+          </FormButton>
+        </div>
         <FormButton
           v-if="connector.url"
           color="subtle"
@@ -66,20 +76,22 @@
 <script setup lang="ts">
 import type { ConnectorItem, Version, Versions } from '~~/lib/dashboard/helpers/types'
 import { useMixpanel } from '~/lib/core/composables/mp'
+import { loginRoute, registerRoute } from '~~/lib/common/helpers/route'
 
 const props = defineProps<{
   connector: ConnectorItem
+  canDownload: boolean
 }>()
 
 const mixpanel = useMixpanel()
 const { data: versionData, status } = useFetch(
   `https://releases.speckle.dev/manager2/feeds/${props.connector.slug}-v3.json`,
   {
-    immediate: !props.connector.isComingSoon
+    immediate: !props.connector.isComingSoon && props.canDownload
   }
 )
 
-const enableButton = computed(() => status.value !== 'success')
+const enableButton = computed(() => status.value !== 'success' || !props.canDownload)
 
 const latestAvailableVersion = computed<Version | null>(() => {
   if (versionData.value) {
diff --git a/packages/frontend-2/components/connectors/Page.vue b/packages/frontend-2/components/connectors/Page.vue
index 23a1ac2c9..1eda5a7c5 100644
--- a/packages/frontend-2/components/connectors/Page.vue
+++ b/packages/frontend-2/components/connectors/Page.vue
@@ -60,6 +60,7 @@
             v-for="connector in filteredConnectors"
             :key="connector.title"
             :connector="connector"
+            :can-download="isLoggedIn"
           />
         </div>
         <p
@@ -96,6 +97,7 @@ const {
 
 const labelId = useId()
 const buttonId = useId()
+const { isLoggedIn } = useActiveUser()
 
 const selectedCategory = ref<CategoryFilter>()
 const connectors = shallowRef<ConnectorItem[]>(connectorItems)
diff --git a/packages/frontend-2/lib/common/generated/gql/graphql.ts b/packages/frontend-2/lib/common/generated/gql/graphql.ts
index 85ba7e6ab..123826ecc 100644
--- a/packages/frontend-2/lib/common/generated/gql/graphql.ts
+++ b/packages/frontend-2/lib/common/generated/gql/graphql.ts
@@ -1000,6 +1000,22 @@ export type EmailVerificationRequestInput = {
   id: Scalars['ID']['input'];
 };
 
+export type EmbedToken = {
+  __typename?: 'EmbedToken';
+  createdAt: Scalars['DateTime']['output'];
+  id: Scalars['String']['output'];
+  lastUsed: Scalars['DateTime']['output'];
+  lifespan: Scalars['BigInt']['output'];
+  modelIds: Scalars['String']['output'];
+  name: Scalars['String']['output'];
+};
+
+export type EmbedTokenCreateInput = {
+  lifespan?: InputMaybe<Scalars['BigInt']['input']>;
+  modelIds: Scalars['String']['input'];
+  projectId: Scalars['String']['input'];
+};
+
 export type FileUpload = {
   __typename?: 'FileUpload';
   branchName: Scalars['String']['output'];
@@ -2095,6 +2111,7 @@ export type Project = {
   description?: Maybe<Scalars['String']['output']>;
   /** Public project-level configuration for embedded viewer */
   embedOptions: ProjectEmbedOptions;
+  embedTokens: Array<EmbedToken>;
   hasAccessToFeature: Scalars['Boolean']['output'];
   id: Scalars['ID']['output'];
   invitableCollaborators: WorkspaceCollaboratorCollection;
@@ -2576,6 +2593,7 @@ export type ProjectMutations = {
   batchDelete: Scalars['Boolean']['output'];
   /** Create new project */
   create: Project;
+  createEmbedToken: Scalars['String']['output'];
   /**
    * Create onboarding/tutorial project. If one is already created for the active user, that
    * one will be returned instead.
@@ -2587,6 +2605,7 @@ export type ProjectMutations = {
   invites: ProjectInviteMutations;
   /** Leave a project. Only possible if you're not the last remaining owner. */
   leave: Scalars['Boolean']['output'];
+  revokeEmbedToken: Scalars['Boolean']['output'];
   /** Updates an existing project */
   update: Project;
   /** Update role for a collaborator */
@@ -2609,6 +2628,11 @@ export type ProjectMutationsCreateArgs = {
 };
 
 
+export type ProjectMutationsCreateEmbedTokenArgs = {
+  token: EmbedTokenCreateInput;
+};
+
+
 export type ProjectMutationsDeleteArgs = {
   id: Scalars['String']['input'];
 };
@@ -2619,6 +2643,11 @@ export type ProjectMutationsLeaveArgs = {
 };
 
 
+export type ProjectMutationsRevokeEmbedTokenArgs = {
+  token: Scalars['String']['input'];
+};
+
+
 export type ProjectMutationsUpdateArgs = {
   update: ProjectUpdateInput;
 };
@@ -7901,6 +7930,7 @@ export type AllObjectTypes = {
   CommitCollection: CommitCollection,
   CountOnlyCollection: CountOnlyCollection,
   CurrencyBasedPrices: CurrencyBasedPrices,
+  EmbedToken: EmbedToken,
   FileUpload: FileUpload,
   FileUploadCollection: FileUploadCollection,
   FileUploadMutations: FileUploadMutations,
@@ -8363,6 +8393,14 @@ export type CurrencyBasedPricesFieldArgs = {
   gbp: {},
   usd: {},
 }
+export type EmbedTokenFieldArgs = {
+  createdAt: {},
+  id: {},
+  lastUsed: {},
+  lifespan: {},
+  modelIds: {},
+  name: {},
+}
 export type FileUploadFieldArgs = {
   branchName: {},
   convertedCommitId: {},
@@ -8656,6 +8694,7 @@ export type ProjectFieldArgs = {
   createdAt: {},
   description: {},
   embedOptions: {},
+  embedTokens: {},
   hasAccessToFeature: ProjectHasAccessToFeatureArgs,
   id: {},
   invitableCollaborators: ProjectInvitableCollaboratorsArgs,
@@ -8762,10 +8801,12 @@ export type ProjectMutationsFieldArgs = {
   automationMutations: ProjectMutationsAutomationMutationsArgs,
   batchDelete: ProjectMutationsBatchDeleteArgs,
   create: ProjectMutationsCreateArgs,
+  createEmbedToken: ProjectMutationsCreateEmbedTokenArgs,
   createForOnboarding: {},
   delete: ProjectMutationsDeleteArgs,
   invites: {},
   leave: ProjectMutationsLeaveArgs,
+  revokeEmbedToken: ProjectMutationsRevokeEmbedTokenArgs,
   update: ProjectMutationsUpdateArgs,
   updateRole: ProjectMutationsUpdateRoleArgs,
 }
@@ -9529,6 +9570,7 @@ export type AllObjectFieldArgTypes = {
   CommitCollection: CommitCollectionFieldArgs,
   CountOnlyCollection: CountOnlyCollectionFieldArgs,
   CurrencyBasedPrices: CurrencyBasedPricesFieldArgs,
+  EmbedToken: EmbedTokenFieldArgs,
   FileUpload: FileUploadFieldArgs,
   FileUploadCollection: FileUploadCollectionFieldArgs,
   FileUploadMutations: FileUploadMutationsFieldArgs,
diff --git a/packages/frontend-2/pages/connectors/index.vue b/packages/frontend-2/pages/connectors/index.vue
index 5890ca117..60217be36 100644
--- a/packages/frontend-2/pages/connectors/index.vue
+++ b/packages/frontend-2/pages/connectors/index.vue
@@ -6,8 +6,4 @@
 useHead({
   title: 'Connectors'
 })
-
-definePageMeta({
-  middleware: ['auth']
-})
 </script>
diff --git a/packages/objectloader2/src/core/objectLoader2.ts b/packages/objectloader2/src/core/objectLoader2.ts
index 934f9c9df..a49b90b60 100644
--- a/packages/objectloader2/src/core/objectLoader2.ts
+++ b/packages/objectloader2/src/core/objectLoader2.ts
@@ -24,6 +24,7 @@ export class ObjectLoader2 {
   #gathered: AsyncGeneratorQueue<Item>
 
   #root?: Item = undefined
+  #isRootStored = false
 
   constructor(options: ObjectLoader2Options) {
     this.#rootId = options.rootId
@@ -34,8 +35,8 @@ export class ObjectLoader2 {
       maxCacheReadSize: 10_000,
       maxCacheWriteSize: 10_000,
       maxWriteQueueSize: 40_000,
-      maxCacheBatchWriteWait: 3_000,
-      maxCacheBatchReadWait: 3_000
+      maxCacheBatchWriteWait: 100, //100 ms, next to nothing!
+      maxCacheBatchReadWait: 100 //100 ms, next to nothing!
     }
 
     this.#gathered = new AsyncGeneratorQueue()
@@ -56,10 +57,10 @@ export class ObjectLoader2 {
     await Promise.all([
       this.#gathered.disposeAsync(),
       this.#downloader.disposeAsync(),
-      this.#cacheReader.disposeAsync(),
       this.#cacheWriter.disposeAsync()
     ])
     this.#deferments.dispose()
+    this.#cacheReader.dispose()
   }
 
   async getRootObject(): Promise<Item | undefined> {
@@ -67,6 +68,8 @@ export class ObjectLoader2 {
       this.#root = (await this.#database.getAll([this.#rootId]))[0]
       if (!this.#root) {
         this.#root = await this.#downloader.downloadSingle()
+      } else {
+        this.#isRootStored = true
       }
     }
     return this.#root
@@ -114,6 +117,10 @@ export class ObjectLoader2 {
         break
       }
     }
+    if (!this.#isRootStored) {
+      await this.#database.saveBatch({ batch: [rootItem] })
+      this.#isRootStored = true
+    }
   }
 
   static createFromObjects(objects: Base[]): ObjectLoader2 {
diff --git a/packages/objectloader2/src/core/stages/cacheReader.spec.ts b/packages/objectloader2/src/core/stages/cacheReader.spec.ts
index 2b1fbf9db..ec22a4351 100644
--- a/packages/objectloader2/src/core/stages/cacheReader.spec.ts
+++ b/packages/objectloader2/src/core/stages/cacheReader.spec.ts
@@ -30,6 +30,6 @@ describe('CacheReader testing', () => {
     const base = await objPromise
 
     expect(base).toMatchSnapshot()
-    await cacheReader.disposeAsync()
+    cacheReader.dispose()
   })
 })
diff --git a/packages/objectloader2/src/core/stages/cacheReader.ts b/packages/objectloader2/src/core/stages/cacheReader.ts
index 7645af00b..c3a5036c9 100644
--- a/packages/objectloader2/src/core/stages/cacheReader.ts
+++ b/packages/objectloader2/src/core/stages/cacheReader.ts
@@ -31,11 +31,12 @@ export class CacheReader {
     this.#notFoundQueue = notFoundQueue
   }
 
-  async getObject(params: { id: string }): Promise<Base> {
-    if (!this.#defermentManager.isDeferred(params.id)) {
+  getObject(params: { id: string }): Promise<Base> {
+    const [p, b] = this.#defermentManager.defer({ id: params.id })
+    if (!b) {
       this.#requestItem(params.id)
     }
-    return await this.#defermentManager.defer({ id: params.id })
+    return p
   }
 
   #createReadQueue(): void {
@@ -57,10 +58,15 @@ export class CacheReader {
 
   requestAll(keys: string[]): void {
     this.#createReadQueue()
+    for (const key of keys) {
+      this.#defermentManager.trackDefermentRequest(key)
+    }
+
     this.#readQueue?.addAll(keys, keys)
   }
 
   #processBatch = async (batch: string[]): Promise<void> => {
+    const start = performance.now()
     const items = await this.#database.getAll(batch)
     for (let i = 0; i < items.length; i++) {
       const item = items[i]
@@ -71,9 +77,10 @@ export class CacheReader {
         this.#notFoundQueue?.add(batch[i])
       }
     }
+    this.#logger('readBatch: left, time', items.length, performance.now() - start)
   }
 
-  async disposeAsync(): Promise<void> {
-    await this.#readQueue?.disposeAsync()
+  dispose(): void {
+    this.#readQueue?.dispose()
   }
 }
diff --git a/packages/objectloader2/src/core/stages/cacheWriter.ts b/packages/objectloader2/src/core/stages/cacheWriter.ts
index 9387193cd..739fbc750 100644
--- a/packages/objectloader2/src/core/stages/cacheWriter.ts
+++ b/packages/objectloader2/src/core/stages/cacheWriter.ts
@@ -30,17 +30,25 @@ export class CacheWriter implements Queue<Item> {
       this.#writeQueue = new BatchingQueue({
         batchSize: this.#options.maxCacheWriteSize,
         maxWaitTime: this.#options.maxCacheBatchWriteWait,
-        processFunction: (batch: Item[]): Promise<void> =>
-          this.#database.saveBatch({ batch })
+        processFunction: async (batch: Item[]): Promise<void> => {
+          await this.writeAll(batch)
+        }
       })
     }
     this.#defermentManager.undefer(item)
     this.#writeQueue.add(item.baseId, item)
   }
 
+  async writeAll(items: Item[]): Promise<void> {
+    const start = performance.now()
+    await this.#database.saveBatch({ batch: items })
+    this.#logger('writeBatch: left, time', items.length, performance.now() - start)
+  }
+
   async disposeAsync(): Promise<void> {
-    await this.#writeQueue?.disposeAsync()
+    this.#writeQueue?.dispose()
     this.#disposed = true
+    return Promise.resolve()
   }
 
   get isDisposed(): boolean {
diff --git a/packages/objectloader2/src/core/stages/indexedDatabase.ts b/packages/objectloader2/src/core/stages/indexedDatabase.ts
index c10e60447..ad437dd55 100644
--- a/packages/objectloader2/src/core/stages/indexedDatabase.ts
+++ b/packages/objectloader2/src/core/stages/indexedDatabase.ts
@@ -121,7 +121,8 @@ export default class IndexedDatabase implements Database {
   async disposeAsync(): Promise<void> {
     this.#cacheDB?.close()
     this.#cacheDB = undefined
-    await this.#writeQueue?.disposeAsync()
+    this.#writeQueue?.dispose()
     this.#writeQueue = undefined
+    return Promise.resolve()
   }
 }
diff --git a/packages/objectloader2/src/core/stages/serverDownloader.ts b/packages/objectloader2/src/core/stages/serverDownloader.ts
index e0c21e144..77979d770 100644
--- a/packages/objectloader2/src/core/stages/serverDownloader.ts
+++ b/packages/objectloader2/src/core/stages/serverDownloader.ts
@@ -14,6 +14,8 @@ export interface ServerDownloaderOptions {
   fetch?: Fetcher
 }
 
+const MAX_SAFARI_DECODE_BYTES = 2 * 1024 * 1024 * 1024 - 1024 * 1024 // 2GB minus a margin
+
 export default class ServerDownloader implements Downloader {
   #requestUrlRootObj: string
   #requestUrlChildren: string
@@ -24,7 +26,8 @@ export default class ServerDownloader implements Downloader {
   #total?: number
 
   #downloadQueue?: BatchedPool<string>
-  #decoder = new TextDecoder()
+  #decoder = new TextDecoder('utf-8', { fatal: true })
+  #decodedBytesCount = 0
 
   constructor(options: ServerDownloaderOptions) {
     this.#options = options
@@ -89,6 +92,24 @@ export default class ServerDownloader implements Downloader {
     this.#getPool().add(id)
   }
 
+  /*
+  This is the most frequently reported and confirmed reason for this error in Safari. There's a known bug in WebKit (Safari's rendering engine) where TextDecoder can fail or throw a RangeError after decoding around 2GB of data. Chrome and other browsers handle much larger amounts of data without this specific limitation.
+
+Why it happens: It seems to be an internal memory or indexing limitation within Safari's TextDecoder implementation. After a certain threshold of data has been processed by a TextDecoder instance, it starts throwing this error.
+
+Chrome's behavior: Chrome generally handles larger data sizes without this specific RangeError. It might become slow or run out of general memory, but not typically with this specific error.
+  */
+  decodeChunk(chunkBuffer: Uint8Array): string {
+    if (this.#decodedBytesCount + chunkBuffer.byteLength > MAX_SAFARI_DECODE_BYTES) {
+      // Safari is approaching its limit, create a new decoder
+      this.#decoder = new TextDecoder('utf-8', { fatal: true })
+      this.#decodedBytesCount = 0 // Reset counter for the new decoder
+    }
+    const decodedText = this.#decoder.decode(chunkBuffer)
+    this.#decodedBytesCount += chunkBuffer.byteLength
+    return decodedText
+  }
+
   async disposeAsync(): Promise<void> {
     await this.#downloadQueue?.disposeAsync()
   }
@@ -166,16 +187,16 @@ export default class ServerDownloader implements Downloader {
     for (let i = 0; i < line.length; i++) {
       if (line[i] === 0x09) {
         //this is a tab
-        const baseId = this.#decoder.decode(line.subarray(0, i))
+        const baseId = this.decodeChunk(line.subarray(0, i))
         const json = line.subarray(i + 1)
-        const base = this.#decoder.decode(json)
+        const base = this.decodeChunk(json)
         const item = this.#processJson(baseId, base)
         item.size = json.length
         return item
       }
     }
     throw new ObjectLoaderRuntimeError(
-      'Invalid line format: ' + this.#decoder.decode(line)
+      'Invalid line format in response: ' + this.decodeChunk(line)
     )
   }
 
diff --git a/packages/objectloader2/src/deferment/defermentManager.disposal.spec.ts b/packages/objectloader2/src/deferment/defermentManager.disposal.spec.ts
index 30d9f1e6b..1326889b0 100644
--- a/packages/objectloader2/src/deferment/defermentManager.disposal.spec.ts
+++ b/packages/objectloader2/src/deferment/defermentManager.disposal.spec.ts
@@ -10,14 +10,12 @@ describe('DefermentManager disposal', () => {
     base: { id, speckle_type: 'test' }
   })
 
-  it('should throw on get/defer/undefer after dispose', async () => {
+  it('should throw on get/defer/undefer after dispose', () => {
     const manager = new DefermentManager(options)
     manager.dispose()
     expect(() => manager.get('a')).toThrow('DefermentManager is disposed')
     expect(() => manager.undefer(makeItem('a'))).toThrow('DefermentManager is disposed')
-    await expect(manager.defer({ id: 'a' })).rejects.toThrow(
-      'DefermentManager is disposed'
-    )
+    expect(() => manager.defer({ id: 'a' })).toThrow('DefermentManager is disposed')
   })
 
   it('dispose is idempotent', () => {
diff --git a/packages/objectloader2/src/deferment/defermentManager.spec.ts b/packages/objectloader2/src/deferment/defermentManager.spec.ts
index 930e4b0fd..ba08426b3 100644
--- a/packages/objectloader2/src/deferment/defermentManager.spec.ts
+++ b/packages/objectloader2/src/deferment/defermentManager.spec.ts
@@ -6,7 +6,8 @@ import { DefermentManager } from './defermentManager.js'
 describe('deferments', () => {
   test('defer one', async () => {
     const deferments = new DefermentManager({ maxSizeInMb: 1, ttlms: 1 })
-    const x = deferments.defer({ id: 'id' })
+    const [x, alreadyDeferred] = deferments.defer({ id: 'id' })
+    expect(alreadyDeferred).toBeFalsy()
     expect(x).toBeInstanceOf(Promise)
     deferments.undefer({ baseId: 'id', base: { id: 'id', speckle_type: 'type' } })
     const b = await x
@@ -17,7 +18,8 @@ describe('deferments', () => {
     const now = 1
     const deferments = new DefermentManager({ maxSizeInMb: 1, ttlms: 1 })
     deferments['now'] = (): number => now
-    const x = deferments.defer({ id: 'id' })
+    const [x, alreadyDeferred] = deferments.defer({ id: 'id' })
+    expect(alreadyDeferred).toBeFalsy()
     expect(x).toBeInstanceOf(Promise)
     const d = deferments.get('id')
     expect(d).toBeDefined()
diff --git a/packages/objectloader2/src/deferment/defermentManager.ts b/packages/objectloader2/src/deferment/defermentManager.ts
index 3a9404202..4520917e8 100644
--- a/packages/objectloader2/src/deferment/defermentManager.ts
+++ b/packages/objectloader2/src/deferment/defermentManager.ts
@@ -22,23 +22,19 @@ export class DefermentManager {
     return Date.now()
   }
 
-  isDeferred(id: string): boolean {
-    return this.deferments.has(id)
-  }
-
   get(id: string): DeferredBase | undefined {
     if (this.disposed) throw new Error('DefermentManager is disposed')
     return this.deferments.get(id)
   }
 
-  async defer(params: { id: string }): Promise<Base> {
+  defer(params: { id: string }): [Promise<Base>, boolean] {
     if (this.disposed) throw new Error('DefermentManager is disposed')
     this.trackDefermentRequest(params.id)
     const now = this.now()
     const deferredBase = this.deferments.get(params.id)
     if (deferredBase) {
       deferredBase.setAccess(now)
-      return deferredBase.getPromise()
+      return [deferredBase.getPromise(), true]
     }
     const notYetFound = new DeferredBase(
       this.options.ttlms,
@@ -46,10 +42,10 @@ export class DefermentManager {
       now + this.options.ttlms
     )
     this.deferments.set(params.id, notYetFound)
-    return notYetFound.getPromise()
+    return [notYetFound.getPromise(), false]
   }
 
-  private trackDefermentRequest(id: string): void {
+  trackDefermentRequest(id: string): void {
     const request = this.totalDefermentRequests.get(id)
     if (request) {
       this.totalDefermentRequests.set(id, request + 1)
@@ -131,7 +127,7 @@ export class DefermentManager {
         //we do not clean it up to allow the requests to resolve
         const requestCount = this.totalDefermentRequests.get(deferredBase.getId())
         if (requestCount && requestCount > 1) {
-          return
+          break
         }
         this.currentSize -= deferredBase.getSize() || 0
         this.deferments.delete(deferredBase.getId())
diff --git a/packages/objectloader2/src/queues/batchingQueue.test.ts b/packages/objectloader2/src/queues/batchingQueue.test.ts
new file mode 100644
index 000000000..a1b39fef9
--- /dev/null
+++ b/packages/objectloader2/src/queues/batchingQueue.test.ts
@@ -0,0 +1,146 @@
+import { describe, test, expect, beforeEach, afterEach, vi } from 'vitest'
+import BatchingQueue from './batchingQueue.js'
+
+describe('BatchingQueue', () => {
+  let queue: BatchingQueue<string>
+
+  beforeEach(() => {
+    queue = new BatchingQueue({
+      batchSize: 3,
+      maxWaitTime: 100,
+      processFunction: async (): Promise<void> => {
+        await new Promise((resolve) => setTimeout(resolve, 0))
+      }
+    })
+  })
+
+  afterEach(() => {
+    queue.dispose()
+  })
+
+  test('should add items and process them in batches', async () => {
+    const processSpy = vi.fn()
+    queue = new BatchingQueue({
+      batchSize: 2,
+      maxWaitTime: 100,
+      processFunction: async (batch: string[]): Promise<void> => {
+        await new Promise((resolve) => setTimeout(resolve, 0))
+        processSpy(batch)
+      }
+    })
+
+    queue.add('key1', 'item1')
+    queue.add('key2', 'item2')
+
+    await new Promise((resolve) => setTimeout(resolve, 200))
+
+    expect(processSpy).toHaveBeenCalledTimes(1)
+    expect(processSpy).toHaveBeenCalledWith(['item1', 'item2'])
+  })
+
+  test('should process items after timeout if batch size is not reached', async () => {
+    const processSpy = vi.fn()
+    queue = new BatchingQueue({
+      batchSize: 5,
+      maxWaitTime: 100,
+      processFunction: async (batch: string[]): Promise<void> => {
+        await new Promise((resolve) => setTimeout(resolve, 0))
+        processSpy(batch)
+      }
+    })
+
+    queue.add('key1', 'item1')
+    queue.add('key2', 'item2')
+
+    await new Promise((resolve) => setTimeout(resolve, 200))
+
+    expect(processSpy).toHaveBeenCalledTimes(1)
+    expect(processSpy).toHaveBeenCalledWith(['item1', 'item2'])
+  })
+
+  test('should not process items if disposed', async () => {
+    const processSpy = vi.fn()
+    queue = new BatchingQueue({
+      batchSize: 2,
+      maxWaitTime: 10000,
+      processFunction: async (batch: string[]): Promise<void> => {
+        await new Promise((resolve) => setTimeout(resolve, 0))
+        processSpy(batch)
+      }
+    })
+
+    queue.add('key1', 'item1')
+    queue.dispose()
+
+    await new Promise((resolve) => setTimeout(resolve, 200))
+
+    expect(processSpy).not.toHaveBeenCalled()
+  })
+
+  test('should handle multiple batches correctly', async () => {
+    const processSpy = vi.fn()
+    queue = new BatchingQueue({
+      batchSize: 2,
+      maxWaitTime: 100,
+      processFunction: async (batch: string[]): Promise<void> => {
+        await new Promise((resolve) => setTimeout(resolve, 0))
+        processSpy(batch)
+      }
+    })
+
+    queue.add('key1', 'item1')
+    queue.add('key2', 'item2')
+    queue.add('key3', 'item3')
+    queue.add('key4', 'item4')
+
+    await new Promise((resolve) => setTimeout(resolve, 200))
+
+    expect(processSpy).toHaveBeenCalledTimes(2)
+    expect(processSpy).toHaveBeenCalledWith(['item1', 'item2'])
+    expect(processSpy).toHaveBeenCalledWith(['item3', 'item4'])
+  })
+
+  test('should retrieve items by key', () => {
+    queue.add('key1', 'item1')
+    queue.add('key2', 'item2')
+
+    expect(queue.get('key1')).toBe('item1')
+    expect(queue.get('key2')).toBe('item2')
+    expect(queue.get('key3')).toBeUndefined()
+  })
+
+  test('should return correct count of items', () => {
+    expect(queue.count()).toBe(0)
+
+    queue.add('key1', 'item1')
+    queue.add('key2', 'item2')
+
+    expect(queue.count()).toBe(2)
+  })
+
+  test('should not process items if already processing', async () => {
+    const processSpy = vi.fn()
+    queue = new BatchingQueue({
+      batchSize: 2,
+      maxWaitTime: 100,
+      processFunction: async (batch: string[]): Promise<void> => {
+        processSpy(batch)
+        await new Promise((resolve) => setTimeout(resolve, 300))
+      }
+    })
+
+    queue.add('key1', 'item1')
+    queue.add('key2', 'item2')
+    queue.add('key3', 'item3')
+
+    await new Promise((resolve) => setTimeout(resolve, 200))
+
+    expect(processSpy).toHaveBeenCalledTimes(1)
+    expect(processSpy).toHaveBeenCalledWith(['item1', 'item2'])
+
+    await new Promise((resolve) => setTimeout(resolve, 200))
+
+    expect(processSpy).toHaveBeenCalledTimes(2)
+    expect(processSpy).toHaveBeenCalledWith(['item3'])
+  })
+})
diff --git a/packages/objectloader2/src/queues/batchingQueue.ts b/packages/objectloader2/src/queues/batchingQueue.ts
index dc9fa0f90..a28a96a45 100644
--- a/packages/objectloader2/src/queues/batchingQueue.ts
+++ b/packages/objectloader2/src/queues/batchingQueue.ts
@@ -1,41 +1,100 @@
+import { CustomLogger } from '../types/functions.js'
 import KeyedQueue from './keyedQueue.js'
 
 export default class BatchingQueue<T> {
   #queue: KeyedQueue<string, T> = new KeyedQueue<string, T>()
   #batchSize: number
   #processFunction: (batch: T[]) => Promise<void>
+  #timeoutId: ReturnType<typeof setTimeout> | null = null
+  #isProcessing = false
+  #logger: CustomLogger
 
-  #baseInterval: number
-  #minInterval: number
-  #maxInterval: number
-
-  #processingLoop: Promise<void>
   #disposed = false
+  #batchTimeout: number
+
+  // Helper methods for cross-environment timeout handling
+  #getSetTimeoutFn(): typeof setTimeout {
+    // First check for window object (browser), then fallback to global (node), then just use setTimeout
+    return typeof window !== 'undefined'
+      ? window.setTimeout.bind(window)
+      : typeof global !== 'undefined'
+      ? global.setTimeout
+      : setTimeout
+  }
+
+  #getClearTimeoutFn(): typeof clearTimeout {
+    // First check for window object (browser), then fallback to global (node), then just use clearTimeout
+    return typeof window !== 'undefined'
+      ? window.clearTimeout.bind(window)
+      : typeof global !== 'undefined'
+      ? global.clearTimeout
+      : clearTimeout
+  }
 
   constructor(params: {
     batchSize: number
-    maxWaitTime?: number
+    maxWaitTime: number
     processFunction: (batch: T[]) => Promise<void>
+    logger?: CustomLogger
   }) {
     this.#batchSize = params.batchSize
-    this.#baseInterval = Math.min(params.maxWaitTime ?? 200, 200) // Initial batch time (ms)
-    this.#minInterval = Math.min(params.maxWaitTime ?? 100, 100) // Minimum batch time
-    this.#maxInterval = Math.min(params.maxWaitTime ?? 3000, 3000) // Maximum batch time
     this.#processFunction = params.processFunction
-    this.#processingLoop = this.#loop()
+    this.#batchTimeout = params.maxWaitTime
+    this.#logger = params.logger || ((): void => {})
   }
 
-  async disposeAsync(): Promise<void> {
+  dispose(): void {
     this.#disposed = true
-    await this.#processingLoop
+    if (this.#timeoutId) {
+      this.#getClearTimeoutFn()(this.#timeoutId)
+    }
   }
 
   add(key: string, item: T): void {
     this.#queue.enqueue(key, item)
+    this.#addCheck()
   }
 
   addAll(keys: string[], items: T[]): void {
     this.#queue.enqueueAll(keys, items)
+    this.#addCheck()
+  }
+
+  #addCheck(): void {
+    if (this.#queue.size >= this.#batchSize) {
+      // Fire and forget, no need to await
+      // eslint-disable-next-line @typescript-eslint/no-floating-promises
+      this.#flush()
+    } else {
+      if (this.#timeoutId) {
+        this.#getClearTimeoutFn()(this.#timeoutId)
+      }
+      // eslint-disable-next-line @typescript-eslint/no-misused-promises
+      this.#timeoutId = this.#getSetTimeoutFn()(() => this.#flush(), this.#batchTimeout)
+    }
+  }
+
+  async #flush(): Promise<void> {
+    if (this.#timeoutId) {
+      this.#getClearTimeoutFn()(this.#timeoutId)
+      this.#timeoutId = null
+    }
+
+    if (this.#isProcessing || this.#queue.size === 0) {
+      return
+    }
+    this.#isProcessing = true
+
+    const batchToProcess = this.#getBatch(this.#batchSize)
+
+    try {
+      await this.#processFunction(batchToProcess)
+    } catch (error) {
+      this.#logger('Batch processing failed:', error)
+    } finally {
+      this.#isProcessing = false
+    }
+    this.#addCheck()
   }
 
   get(id: string): T | undefined {
@@ -53,37 +112,4 @@ export default class BatchingQueue<T> {
   #getBatch(batchSize: number): T[] {
     return this.#queue.spliceValues(0, Math.min(batchSize, this.#queue.size))
   }
-
-  async #loop(): Promise<void> {
-    let interval = this.#baseInterval
-    while (!this.#disposed || this.#queue.size > 0) {
-      const startTime = performance.now()
-      if (this.#queue.size > 0) {
-        const batch = this.#getBatch(this.#batchSize)
-        //console.log('running with queue size of ' + this.#queue.length)
-        await this.#processFunction(batch)
-      }
-      if (this.#queue.size < this.#batchSize / 2) {
-        //refigure interval
-        const endTime = performance.now()
-        const duration = endTime - startTime
-        if (duration > interval) {
-          interval = Math.min(interval * 1.5, this.#maxInterval) // Increase if slow or empty
-        } else {
-          interval = Math.max(interval * 0.8, this.#minInterval) // Decrease if fast
-        }
-        /*console.log(
-          'queue is waiting ' +
-            interval / 1000 +
-            ' with queue size of ' +
-            this.#queue.length
-        )*/
-        await this.#delay(interval)
-      }
-    }
-  }
-
-  #delay(ms: number): Promise<void> {
-    return new Promise((resolve) => setTimeout(resolve, ms))
-  }
 }
diff --git a/packages/objectloader2/src/queues/cacheWriter.ts b/packages/objectloader2/src/queues/cacheWriter.ts
deleted file mode 100644
index e104ed529..000000000
--- a/packages/objectloader2/src/queues/cacheWriter.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import { Database } from '../core/interfaces.js'
-import { CacheOptions } from '../core/options.js'
-import { DefermentManager } from '../deferment/defermentManager.js'
-import { Item } from '../types/types.js'
-import BatchingQueue from './batchingQueue.js'
-import Queue from './queue.js'
-
-export class CacheWriter implements Queue<Item> {
-  #writeQueue: BatchingQueue<Item> | undefined
-  #database: Database
-  #defermentManager: DefermentManager
-  #options: CacheOptions
-  #disposed = false
-
-  constructor(
-    database: Database,
-    defermentManager: DefermentManager,
-    options: CacheOptions
-  ) {
-    this.#database = database
-    this.#defermentManager = defermentManager
-    this.#options = options
-  }
-
-  add(item: Item): void {
-    if (!this.#writeQueue) {
-      this.#writeQueue = new BatchingQueue({
-        batchSize: this.#options.maxCacheWriteSize,
-        maxWaitTime: this.#options.maxCacheBatchWriteWait,
-        processFunction: (batch: Item[]): Promise<void> =>
-          this.#database.saveBatch({ batch })
-      })
-    }
-    this.#defermentManager.undefer(item)
-    this.#writeQueue.add(item.baseId, item)
-  }
-
-  async disposeAsync(): Promise<void> {
-    await this.#writeQueue?.disposeAsync()
-    this.#disposed = true
-  }
-
-  get isDisposed(): boolean {
-    return this.#disposed
-  }
-}
diff --git a/packages/server/assets/core/typedefs/apitoken.graphql b/packages/server/assets/core/typedefs/apitoken.graphql
index 90f73cc50..5357cbd4f 100644
--- a/packages/server/assets/core/typedefs/apitoken.graphql
+++ b/packages/server/assets/core/typedefs/apitoken.graphql
@@ -55,6 +55,33 @@ input AppTokenCreateInput {
   limitResources: [TokenResourceIdentifierInput!]
 }
 
+"""
+A token used to enable an embedded viewer for a private project
+"""
+type EmbedToken {
+  tokenId: String!
+  projectId: String!
+  user: LimitedUser
+  resourceIdString: String!
+  createdAt: DateTime!
+  lifespan: BigInt!
+  lastUsed: DateTime!
+}
+
+input EmbedTokenCreateInput {
+  projectId: String!
+  """
+  The model(s) and version(s) string used in the embed url
+  """
+  resourceIdString: String!
+  lifespan: BigInt
+}
+
+type CreateEmbedTokenReturn {
+  token: String!
+  tokenMetadata: EmbedToken!
+}
+
 extend type Mutation {
   """
   Creates an personal api token.
@@ -77,3 +104,21 @@ extend type Mutation {
     @hasServerRole(role: SERVER_USER)
     @hasScope(scope: "tokens:write")
 }
+
+extend type ProjectMutations {
+  createEmbedToken(token: EmbedTokenCreateInput!): CreateEmbedTokenReturn!
+    @hasScope(scope: "tokens:write")
+  revokeEmbedToken(token: String!, projectId: String!): Boolean!
+    @hasScope(scope: "tokens:write")
+  revokeEmbedTokens(projectId: String!): Boolean! @hasScope(scope: "tokens:write")
+}
+
+type EmbedTokenCollection {
+  items: [EmbedToken!]!
+  totalCount: Int!
+  cursor: String
+}
+
+extend type Project {
+  embedTokens(cursor: String, limit: Int): EmbedTokenCollection!
+}
diff --git a/packages/server/assets/core/typedefs/permissions.graphql b/packages/server/assets/core/typedefs/permissions.graphql
index 9861eea99..72b5a17be 100644
--- a/packages/server/assets/core/typedefs/permissions.graphql
+++ b/packages/server/assets/core/typedefs/permissions.graphql
@@ -16,6 +16,9 @@ type ProjectPermissionChecks {
   canPublish: PermissionCheckResult!
   canLoad: PermissionCheckResult!
   canInvite: PermissionCheckResult!
+  canCreateEmbedTokens: PermissionCheckResult!
+  canRevokeEmbedTokens: PermissionCheckResult!
+  canReadEmbedTokens: PermissionCheckResult!
 }
 
 type RootPermissionChecks {
diff --git a/packages/server/codegen.yml b/packages/server/codegen.yml
index ba69456fe..5bd42aa19 100644
--- a/packages/server/codegen.yml
+++ b/packages/server/codegen.yml
@@ -24,6 +24,7 @@ generates:
         ProjectAccessRequestMutations: '@/modules/core/helpers/graphTypes#MutationsObjectGraphQLReturn'
         LimitedUser: '@/modules/core/helpers/graphTypes#LimitedUserGraphQLReturn'
         User: '@/modules/core/helpers/graphTypes#UserGraphQLReturn'
+        EmbedToken: '@/modules/core/helpers/graphTypes#EmbedTokenGraphQLReturn'
         ActiveUserMutations: '@/modules/core/helpers/graphTypes#MutationsObjectGraphQLReturn'
         UserMetaMutations: '@/modules/core/helpers/graphTypes#MutationsObjectGraphQLReturn'
         UserEmailMutations: '@/modules/core/helpers/graphTypes#MutationsObjectGraphQLReturn'
diff --git a/packages/server/modules/accessrequests/graph/resolvers/index.ts b/packages/server/modules/accessrequests/graph/resolvers/index.ts
index 07825f5b8..e60565270 100644
--- a/packages/server/modules/accessrequests/graph/resolvers/index.ts
+++ b/packages/server/modules/accessrequests/graph/resolvers/index.ts
@@ -21,6 +21,7 @@ import { mapStreamRoleToValue } from '@/modules/core/helpers/graphTypes'
 import { Roles } from '@/modules/core/helpers/mainConstants'
 import {
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import { getUserFactory } from '@/modules/core/repositories/users'
@@ -69,6 +70,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
diff --git a/packages/server/modules/accessrequests/tests/projectAccessRequests.spec.ts b/packages/server/modules/accessrequests/tests/projectAccessRequests.spec.ts
index 5cf27f1ab..0dfebe498 100644
--- a/packages/server/modules/accessrequests/tests/projectAccessRequests.spec.ts
+++ b/packages/server/modules/accessrequests/tests/projectAccessRequests.spec.ts
@@ -12,7 +12,9 @@ import {
   requestProjectAccessFactory
 } from '@/modules/accessrequests/services/stream'
 import { StreamActionTypes } from '@/modules/activitystream/helpers/types'
+import { getActivitiesFactory } from '@/modules/activitystream/repositories/index'
 import {
+  Activity,
   ServerAccessRequests,
   StreamActivity,
   Streams,
@@ -24,6 +26,7 @@ import { Roles } from '@/modules/core/helpers/mainConstants'
 import {
   getStreamCollaboratorsFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory,
   revokeStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
@@ -79,15 +82,17 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
-
 const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
+const getActivities = getActivitiesFactory({ db })
 
 const isNotCollaboratorError = (e: unknown) =>
   e instanceof StreamAccessUpdateError &&
@@ -406,7 +411,11 @@ describe('Project access requests', () => {
     let validReqId: string
 
     beforeEach(async () => {
-      await truncateTables([ServerAccessRequests.name, StreamActivity.name])
+      await truncateTables([
+        ServerAccessRequests.name,
+        StreamActivity.name,
+        Activity.name
+      ])
       await removeStreamCollaborator(
         myPrivateStream.id,
         otherGuy.id,
@@ -464,8 +473,8 @@ describe('Project access requests', () => {
 
         // activity stream item should be inserted
         if (accept) {
-          const streamActivity = await getStreamActivities(myPrivateStream.id, {
-            actionType: StreamActionTypes.Stream.PermissionsAdd,
+          const streamActivity = await getActivities({
+            projectId: myPrivateStream.id,
             userId: me.id
           })
           expect(streamActivity).to.have.lengthOf(1)
diff --git a/packages/server/modules/accessrequests/tests/streamAccessRequests.spec.ts b/packages/server/modules/accessrequests/tests/streamAccessRequests.spec.ts
index fdd44568a..c15ec29c3 100644
--- a/packages/server/modules/accessrequests/tests/streamAccessRequests.spec.ts
+++ b/packages/server/modules/accessrequests/tests/streamAccessRequests.spec.ts
@@ -13,7 +13,9 @@ import {
   requestStreamAccessFactory
 } from '@/modules/accessrequests/services/stream'
 import { StreamActionTypes } from '@/modules/activitystream/helpers/types'
+import { getActivitiesFactory } from '@/modules/activitystream/repositories/index'
 import {
+  Activity,
   ServerAccessRequests,
   StreamActivity,
   Streams,
@@ -25,6 +27,7 @@ import { Roles } from '@/modules/core/helpers/mainConstants'
 import {
   getStreamCollaboratorsFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory,
   revokeStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
@@ -82,6 +85,7 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -89,8 +93,10 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
+const getActivities = getActivitiesFactory({ db })
 
 const isNotCollaboratorError = (e: unknown) =>
   e instanceof StreamAccessUpdateError &&
@@ -375,7 +381,11 @@ describe('Stream access requests', () => {
     let validReqId: string
 
     beforeEach(async () => {
-      await truncateTables([ServerAccessRequests.name, StreamActivity.name])
+      await truncateTables([
+        ServerAccessRequests.name,
+        StreamActivity.name,
+        Activity.name
+      ])
       await removeStreamCollaborator(
         myPrivateStream.id,
         otherGuy.id,
@@ -424,9 +434,10 @@ describe('Stream access requests', () => {
 
         // activity stream item should be inserted
         if (accept) {
-          const streamActivity = await getStreamActivities(myPrivateStream.id, {
-            actionType: StreamActionTypes.Stream.PermissionsAdd,
-            userId: me.id
+          const streamActivity = await getActivities({
+            projectId: myPrivateStream.id,
+            userId: me.id,
+            eventType: 'project_role_updated'
           })
           expect(streamActivity).to.have.lengthOf(1)
 
diff --git a/packages/server/modules/activitystream/domain/operations.ts b/packages/server/modules/activitystream/domain/operations.ts
index 3957d85ab..2692483fe 100644
--- a/packages/server/modules/activitystream/domain/operations.ts
+++ b/packages/server/modules/activitystream/domain/operations.ts
@@ -1,4 +1,5 @@
 import {
+  Activity,
   ActivitySummary,
   CommentCreatedActivityInput,
   ReplyCreatedActivityInput,
@@ -7,7 +8,6 @@ import {
   StreamActionType
 } from '@/modules/activitystream/domain/types'
 import {
-  Activity,
   StreamActivityRecord,
   StreamScopeActivity
 } from '@/modules/activitystream/helpers/types'
@@ -32,7 +32,7 @@ import {
 } from '@/modules/core/helpers/types'
 import { Nullable } from '@speckle/shared'
 
-export type GetActivity = (
+export type GetUserStreamActivity = (
   streamId: string,
   start: Date,
   end: Date,
@@ -281,3 +281,12 @@ export type SaveActivity = <
 >(
   args: Omit<Activity<T, R>, 'createdAt' | 'id'>
 ) => Promise<Activity<T, R>>
+
+type GetActivitiesArgs = Partial<{
+  workspaceId: string
+  projectId: string
+  eventType: string
+  userId: string
+}>
+
+export type GetActivities = (filters: GetActivitiesArgs) => Promise<Activity[]>
diff --git a/packages/server/modules/activitystream/domain/types.ts b/packages/server/modules/activitystream/domain/types.ts
index 277ee4208..f355d67e0 100644
--- a/packages/server/modules/activitystream/domain/types.ts
+++ b/packages/server/modules/activitystream/domain/types.ts
@@ -23,6 +23,23 @@ export type ResourceEventsToPayloadMap = {
     workspace_seat_updated: z.infer<typeof WorkspaceSeatUpdatedActivity>
     workspace_seat_deleted: z.infer<typeof WorkspaceSeatDeletedActivity>
   }
+  project: {
+    project_role_updated: z.infer<typeof ProjectRoleUpdatedActivity>
+    project_role_deleted: z.infer<typeof ProjectRoleDeletedActivity>
+  }
+}
+
+export interface Activity<
+  T extends keyof ResourceEventsToPayloadMap = keyof ResourceEventsToPayloadMap,
+  R extends keyof ResourceEventsToPayloadMap[T] = keyof ResourceEventsToPayloadMap[T]
+> {
+  id: string
+  contextResourceId: string
+  contextResourceType: T
+  eventType: R
+  userId: string | null
+  payload: ResourceEventsToPayloadMap[T][R]
+  createdAt: Date
 }
 
 const workspacePlan = z.object({
@@ -56,6 +73,12 @@ const workspaceSubscription = z.object({
   totalEditorSeats: z.number()
 })
 
+const projectRole = z.union([
+  z.literal('stream:owner'),
+  z.literal('stream:contributor'),
+  z.literal('stream:reviewer')
+])
+
 export const WorkspacePlanCreatedActivity = z.object({
   version: z.literal('1'),
   new: workspacePlan
@@ -84,6 +107,19 @@ export const WorkspaceSeatDeletedActivity = z.object({
   old: workspaceSeat
 })
 
+export const ProjectRoleUpdatedActivity = z.object({
+  version: z.literal('1'),
+  userId: z.string(),
+  new: projectRole,
+  old: z.nullable(projectRole)
+})
+
+export const ProjectRoleDeletedActivity = z.object({
+  version: z.literal('1'),
+  userId: z.string(),
+  old: projectRole
+})
+
 // Stream Activity
 
 export type StreamActionType =
diff --git a/packages/server/modules/activitystream/events/accessRequestListeners.ts b/packages/server/modules/activitystream/events/accessRequestListeners.ts
index 7931463fb..921139106 100644
--- a/packages/server/modules/activitystream/events/accessRequestListeners.ts
+++ b/packages/server/modules/activitystream/events/accessRequestListeners.ts
@@ -19,13 +19,13 @@ import {
  */
 const addStreamAccessRequestedActivityFactory =
   ({
-    saveActivity
+    saveStreamActivity
   }: {
-    saveActivity: SaveStreamActivity
+    saveStreamActivity: SaveStreamActivity
   }): AddStreamAccessRequestedActivity =>
   async (params: { streamId: string; requesterId: string }) => {
     const { streamId, requesterId } = params
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Stream,
       resourceId: streamId,
@@ -41,13 +41,13 @@ const addStreamAccessRequestedActivityFactory =
  */
 const addStreamAccessRequestDeclinedActivityFactory =
   ({
-    saveActivity
+    saveStreamActivity
   }: {
-    saveActivity: SaveStreamActivity
+    saveStreamActivity: SaveStreamActivity
   }): AddStreamAccessRequestDeclinedActivity =>
   async (params: { streamId: string; requesterId: string; declinerId: string }) => {
     const { streamId, requesterId, declinerId } = params
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Stream,
       resourceId: streamId,
@@ -104,7 +104,8 @@ const onServerAccessRequestFinalizedFactory =
   }
 
 export const reportAccessRequestActivityFactory =
-  (deps: { eventListen: EventBusListen; saveActivity: SaveStreamActivity }) => () => {
+  (deps: { eventListen: EventBusListen; saveStreamActivity: SaveStreamActivity }) =>
+  () => {
     const addStreamAccessRequestedActivity =
       addStreamAccessRequestedActivityFactory(deps)
     const addStreamAccessRequestDeclinedActivity =
diff --git a/packages/server/modules/activitystream/events/branchListeners.ts b/packages/server/modules/activitystream/events/branchListeners.ts
index 9a1bad24d..537688ad5 100644
--- a/packages/server/modules/activitystream/events/branchListeners.ts
+++ b/packages/server/modules/activitystream/events/branchListeners.ts
@@ -16,11 +16,15 @@ import { EventBusListen } from '@/modules/shared/services/eventBus'
  * Save "branch created" activity
  */
 const addBranchCreatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddBranchCreatedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddBranchCreatedActivity =>
   async (params) => {
     const { branch } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId: branch.streamId,
       resourceType: StreamResourceTypes.Branch,
       resourceId: branch.id,
@@ -32,12 +36,16 @@ const addBranchCreatedActivityFactory =
   }
 
 const addBranchUpdatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddBranchUpdatedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddBranchUpdatedActivity =>
   async (params) => {
     const { update, userId, oldBranch } = params
 
     const streamId = isBranchUpdateInput(update) ? update.streamId : update.projectId
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Branch,
       resourceId: update.id,
@@ -49,13 +57,17 @@ const addBranchUpdatedActivityFactory =
   }
 
 const addBranchDeletedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddBranchDeletedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddBranchDeletedActivity =>
   async (params) => {
     const { input, userId, branchName } = params
 
     const streamId = isBranchDeleteInput(input) ? input.streamId : input.projectId
     await Promise.all([
-      saveActivity({
+      saveStreamActivity({
         streamId,
         resourceType: StreamResourceTypes.Branch,
         resourceId: input.id,
@@ -68,7 +80,8 @@ const addBranchDeletedActivityFactory =
   }
 
 export const reportBranchActivityFactory =
-  (deps: { eventListen: EventBusListen; saveActivity: SaveStreamActivity }) => () => {
+  (deps: { eventListen: EventBusListen; saveStreamActivity: SaveStreamActivity }) =>
+  () => {
     const addBranchCreatedActivity = addBranchCreatedActivityFactory(deps)
     const addBranchUpdatedActivity = addBranchUpdatedActivityFactory(deps)
     const addBranchDeletedActivity = addBranchDeletedActivityFactory(deps)
diff --git a/packages/server/modules/activitystream/events/commentListeners.ts b/packages/server/modules/activitystream/events/commentListeners.ts
index e588d7e75..44b004933 100644
--- a/packages/server/modules/activitystream/events/commentListeners.ts
+++ b/packages/server/modules/activitystream/events/commentListeners.ts
@@ -19,11 +19,15 @@ import { has } from 'lodash'
 import { OverrideProperties } from 'type-fest'
 
 const addThreadCreatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddThreadCreatedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddThreadCreatedActivity =>
   async (params) => {
     const { input, comment } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       resourceId: comment.id,
       streamId: comment.streamId,
       resourceType: StreamResourceTypes.Comment,
@@ -39,14 +43,18 @@ const isLegacyReplyCreateInput = (
 ): i is ReplyCreateInput => has(i, 'streamId')
 
 const addReplyAddedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddReplyAddedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddReplyAddedActivity =>
   async (params) => {
     const { input, reply } = params
 
     const parentCommentId = isLegacyReplyCreateInput(input)
       ? input.parentComment
       : input.threadId
-    await saveActivity({
+    await saveStreamActivity({
       streamId: reply.streamId,
       resourceType: StreamResourceTypes.Comment,
       resourceId: parentCommentId,
@@ -59,14 +67,14 @@ const addReplyAddedActivityFactory =
 
 const addCommentArchivedActivityFactory =
   ({
-    saveActivity
+    saveStreamActivity
   }: {
-    saveActivity: SaveStreamActivity
+    saveStreamActivity: SaveStreamActivity
   }): AddCommentArchivedActivity =>
   async (params) => {
     const { userId, input, comment } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId: comment.streamId,
       resourceType: StreamResourceTypes.Comment,
       resourceId: comment.id,
@@ -100,7 +108,8 @@ const isThreadCreatedPayload = (
 }
 
 export const reportCommentActivityFactory =
-  (deps: { eventListen: EventBusListen; saveActivity: SaveStreamActivity }) => () => {
+  (deps: { eventListen: EventBusListen; saveStreamActivity: SaveStreamActivity }) =>
+  () => {
     const addThreadCreatedActivity = addThreadCreatedActivityFactory(deps)
     const addReplyAddedActivity = addReplyAddedActivityFactory(deps)
     const addCommentArchivedActivity = addCommentArchivedActivityFactory(deps)
diff --git a/packages/server/modules/activitystream/events/commitListeners.ts b/packages/server/modules/activitystream/events/commitListeners.ts
index fb3ddd9a5..6bd25752a 100644
--- a/packages/server/modules/activitystream/events/commitListeners.ts
+++ b/packages/server/modules/activitystream/events/commitListeners.ts
@@ -18,7 +18,11 @@ import { MaybeNullOrUndefined } from '@speckle/shared'
  * Save "new commit created" activity item
  */
 const addCommitCreatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddCommitCreatedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddCommitCreatedActivity =>
   async (params: {
     commitId: string
     streamId: string
@@ -29,7 +33,7 @@ const addCommitCreatedActivityFactory =
     commit: CommitRecord
   }) => {
     const { commitId, input, streamId, userId, branchName, commit, modelId } = params
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Commit,
       resourceId: commitId,
@@ -49,11 +53,15 @@ const addCommitCreatedActivityFactory =
   }
 
 const addCommitUpdatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddCommitUpdatedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddCommitUpdatedActivity =>
   async (params) => {
     const { commitId, streamId, userId, originalCommit, update } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Commit,
       resourceId: commitId,
@@ -65,7 +73,7 @@ const addCommitUpdatedActivityFactory =
   }
 
 const addCommitMovedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
+  ({ saveStreamActivity }: { saveStreamActivity: SaveStreamActivity }) =>
   async (params: {
     commitId: string
     streamId: string
@@ -75,7 +83,7 @@ const addCommitMovedActivityFactory =
     commit: CommitRecord
   }) => {
     const { commitId, streamId, userId, originalBranchId, newBranchId } = params
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Commit,
       resourceId: commitId,
@@ -87,7 +95,11 @@ const addCommitMovedActivityFactory =
   }
 
 const addCommitDeletedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddCommitDeletedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddCommitDeletedActivity =>
   async (params: {
     commitId: string
     streamId: string
@@ -96,7 +108,7 @@ const addCommitDeletedActivityFactory =
     branchId: string
   }) => {
     const { commitId, streamId, userId, commit } = params
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Commit,
       resourceId: commitId,
@@ -108,7 +120,7 @@ const addCommitDeletedActivityFactory =
   }
 
 const addCommitReceivedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
+  ({ saveStreamActivity }: { saveStreamActivity: SaveStreamActivity }) =>
   async (params: {
     streamId: string
     commitId: string
@@ -117,7 +129,7 @@ const addCommitReceivedActivityFactory =
     message: MaybeNullOrUndefined<string>
   }) => {
     const { streamId, commitId, userId, sourceApplication, message } = params
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Commit,
       resourceId: commitId,
@@ -132,7 +144,8 @@ const addCommitReceivedActivityFactory =
   }
 
 export const reportCommitActivityFactory =
-  (deps: { eventListen: EventBusListen; saveActivity: SaveStreamActivity }) => () => {
+  (deps: { eventListen: EventBusListen; saveStreamActivity: SaveStreamActivity }) =>
+  () => {
     const addCommitCreatedActivity = addCommitCreatedActivityFactory(deps)
     const addCommitUpdatedActivity = addCommitUpdatedActivityFactory(deps)
     const addCommitMovedActivity = addCommitMovedActivityFactory(deps)
diff --git a/packages/server/modules/activitystream/events/streamInviteListeners.ts b/packages/server/modules/activitystream/events/streamInviteListeners.ts
index 35b27da81..fb2d35741 100644
--- a/packages/server/modules/activitystream/events/streamInviteListeners.ts
+++ b/packages/server/modules/activitystream/events/streamInviteListeners.ts
@@ -18,7 +18,7 @@ import { Roles } from '@speckle/shared'
  */
 const addStreamInviteSentOutActivityFactory =
   (deps: {
-    saveActivity: SaveStreamActivity
+    saveStreamActivity: SaveStreamActivity
     getProjectInviteProject: GetProjectInviteProject
   }) =>
   async (payload: EventPayload<typeof ServerInvitesEvents.Created>) => {
@@ -29,7 +29,7 @@ const addStreamInviteSentOutActivityFactory =
     const userTarget = resolveTarget(invite.target)
     const targetDisplay = userTarget.userId || userTarget.userEmail
 
-    await deps.saveActivity({
+    await deps.saveStreamActivity({
       streamId: project.id,
       resourceType: StreamResourceTypes.Stream,
       resourceId: project.id,
@@ -48,7 +48,7 @@ const addStreamInviteSentOutActivityFactory =
  */
 const addStreamInviteAcceptedActivityFactory =
   (deps: {
-    saveActivity: SaveStreamActivity
+    saveStreamActivity: SaveStreamActivity
     getProjectInviteProject: GetProjectInviteProject
   }) =>
   async (payload: EventPayload<typeof ServerInvitesEvents.Finalized>) => {
@@ -63,7 +63,7 @@ const addStreamInviteAcceptedActivityFactory =
 
     const differentFinalizer = trueFinalizerUserId !== userTarget.userId
 
-    await deps.saveActivity({
+    await deps.saveStreamActivity({
       streamId: project.id,
       resourceType: StreamResourceTypes.Stream,
       resourceId: project.id,
@@ -81,7 +81,7 @@ const addStreamInviteAcceptedActivityFactory =
  */
 const addStreamInviteDeclinedActivityFactory =
   (deps: {
-    saveActivity: SaveStreamActivity
+    saveStreamActivity: SaveStreamActivity
     getProjectInviteProject: GetProjectInviteProject
   }) =>
   async (payload: EventPayload<typeof ServerInvitesEvents.Finalized>) => {
@@ -90,7 +90,7 @@ const addStreamInviteDeclinedActivityFactory =
     if (!project) return
 
     const userTarget = resolveTarget(invite.target)
-    await deps.saveActivity({
+    await deps.saveStreamActivity({
       streamId: project.id,
       resourceType: StreamResourceTypes.Stream,
       resourceId: project.id,
@@ -104,7 +104,7 @@ const addStreamInviteDeclinedActivityFactory =
 export const reportStreamInviteActivityFactory =
   (deps: {
     eventListen: EventBusListen
-    saveActivity: SaveStreamActivity
+    saveStreamActivity: SaveStreamActivity
     getProjectInviteProject: GetProjectInviteProject
   }) =>
   () => {
diff --git a/packages/server/modules/activitystream/events/streamListeners.ts b/packages/server/modules/activitystream/events/streamListeners.ts
index b93b15db2..b9124eafd 100644
--- a/packages/server/modules/activitystream/events/streamListeners.ts
+++ b/packages/server/modules/activitystream/events/streamListeners.ts
@@ -1,6 +1,7 @@
 import {
   AddStreamDeletedActivity,
   AddStreamUpdatedActivity,
+  SaveActivity,
   SaveStreamActivity
 } from '@/modules/activitystream/domain/operations'
 import {
@@ -13,14 +14,54 @@ import {
   StreamCreateInput
 } from '@/modules/core/graph/generated/graphql'
 import { StreamRecord } from '@/modules/core/helpers/types'
-import { EventBusListen } from '@/modules/shared/services/eventBus'
-import { StreamRoles } from '@speckle/shared'
+import { EventBusListen, EventPayload } from '@/modules/shared/services/eventBus'
+
+// Activity
+
+const addProjectPermissionsAddedActivityFactory =
+  ({ saveActivity }: { saveActivity: SaveActivity }) =>
+  async ({
+    payload: { activityUserId, project, role, targetUserId, previousRole }
+  }: EventPayload<typeof ProjectEvents.PermissionsAdded>) => {
+    await saveActivity({
+      contextResourceId: project.id,
+      contextResourceType: 'project',
+      eventType: 'project_role_updated',
+      userId: activityUserId,
+      payload: {
+        version: '1',
+        userId: targetUserId,
+        new: role,
+        old: previousRole
+      }
+    })
+  }
+
+const addProjectPermissionsRevokedActivityFactory =
+  ({ saveActivity }: { saveActivity: SaveActivity }) =>
+  async ({
+    payload: { activityUserId, project, removedUserId, role }
+  }: EventPayload<typeof ProjectEvents.PermissionsRevoked>) => {
+    await saveActivity({
+      contextResourceId: project.id,
+      contextResourceType: 'project',
+      eventType: 'project_role_deleted',
+      userId: activityUserId,
+      payload: {
+        version: '1',
+        userId: removedUserId,
+        old: role
+      }
+    })
+  }
+
+// Stream activity
 
 /**
  * Save "user created stream" activity item
  */
 const addStreamCreatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
+  ({ saveStreamActivity }: { saveStreamActivity: SaveStreamActivity }) =>
   async (params: {
     streamId: string
     creatorId: string
@@ -29,7 +70,7 @@ const addStreamCreatedActivityFactory =
   }) => {
     const { streamId, creatorId, input } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Stream,
       resourceId: streamId,
@@ -44,11 +85,15 @@ const addStreamCreatedActivityFactory =
  * Save "stream updated" activity
  */
 const addStreamUpdatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddStreamUpdatedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddStreamUpdatedActivity =>
   async (params) => {
     const { streamId, updaterId, oldStream, update } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Stream,
       resourceId: streamId,
@@ -63,11 +108,15 @@ const addStreamUpdatedActivityFactory =
  * Save "stream deleted" activity
  */
 const addStreamDeletedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }): AddStreamDeletedActivity =>
+  ({
+    saveStreamActivity
+  }: {
+    saveStreamActivity: SaveStreamActivity
+  }): AddStreamDeletedActivity =>
   async (params) => {
     const { streamId, deleterId } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId,
       resourceType: StreamResourceTypes.Stream,
       resourceId: streamId,
@@ -82,7 +131,7 @@ const addStreamDeletedActivityFactory =
  * Save "user cloned stream X" activity item
  */
 const addStreamClonedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
+  ({ saveStreamActivity }: { saveStreamActivity: SaveStreamActivity }) =>
   async (params: {
     sourceStreamId: string
     newStream: StreamRecord
@@ -91,7 +140,7 @@ const addStreamClonedActivityFactory =
     const { sourceStreamId, newStream, clonerId } = params
     const newStreamId = newStream.id
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId: newStreamId,
       resourceType: StreamResourceTypes.Stream,
       resourceId: newStreamId,
@@ -102,68 +151,31 @@ const addStreamClonedActivityFactory =
     })
   }
 
-/**
- * Save "stream permissions granted to user" activity item
- */
-const addStreamPermissionsAddedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
-  async (params: {
-    streamId: string
-    activityUserId: string
-    targetUserId: string
-    role: StreamRoles
-  }) => {
-    const { streamId, activityUserId, targetUserId, role } = params
-    await saveActivity({
-      streamId,
-      resourceType: StreamResourceTypes.Stream,
-      resourceId: streamId,
-      actionType: StreamActionTypes.Stream.PermissionsAdd,
-      userId: activityUserId,
-      info: { targetUser: targetUserId, role },
-      message: `Permission granted to user ${targetUserId} (${role})`
-    })
-  }
-
-/**
- * Save "stream permissions revoked for user" activity item
- */
-const addStreamPermissionsRevokedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
-  async (params: {
-    streamId: string
-    activityUserId: string
-    removedUserId: string
-    stream: StreamRecord
-  }) => {
-    const { streamId, activityUserId, removedUserId } = params
-    const isVoluntaryLeave = activityUserId === removedUserId
-
-    await saveActivity({
-      streamId,
-      resourceType: StreamResourceTypes.Stream,
-      resourceId: streamId,
-      actionType: StreamActionTypes.Stream.PermissionsRemove,
-      userId: activityUserId,
-      info: { targetUser: removedUserId },
-      message: isVoluntaryLeave
-        ? `User ${removedUserId} left the stream`
-        : `Permission revoked for user ${removedUserId}`
-    })
-  }
-
 export const reportStreamActivityFactory =
-  (deps: { eventListen: EventBusListen; saveActivity: SaveStreamActivity }) => () => {
+  (deps: {
+    eventListen: EventBusListen
+    saveActivity: SaveActivity
+    saveStreamActivity: SaveStreamActivity
+  }) =>
+  () => {
+    const addProjectPermissionsAddedActivity =
+      addProjectPermissionsAddedActivityFactory(deps)
+    const addProjectPermissionsRevokedActivity =
+      addProjectPermissionsRevokedActivityFactory(deps)
     const addStreamCreatedActivity = addStreamCreatedActivityFactory(deps)
     const addStreamUpdatedActivity = addStreamUpdatedActivityFactory(deps)
     const addStreamDeletedActivity = addStreamDeletedActivityFactory(deps)
     const addStreamClonedActivity = addStreamClonedActivityFactory(deps)
-    const addStreamPermissionsAddedActivity =
-      addStreamPermissionsAddedActivityFactory(deps)
-    const addStreamPermissionsRevokedActivity =
-      addStreamPermissionsRevokedActivityFactory(deps)
 
     const quitters = [
+      deps.eventListen(
+        ProjectEvents.PermissionsAdded,
+        addProjectPermissionsAddedActivity
+      ),
+      deps.eventListen(
+        ProjectEvents.PermissionsRevoked,
+        addProjectPermissionsRevokedActivity
+      ),
       deps.eventListen(ProjectEvents.Created, async ({ payload }) => {
         await addStreamCreatedActivity({
           stream: payload.project,
@@ -194,22 +206,6 @@ export const reportStreamActivityFactory =
           newStream: payload.newProject,
           clonerId: payload.clonerId
         })
-      }),
-      deps.eventListen(ProjectEvents.PermissionsAdded, async ({ payload }) => {
-        await addStreamPermissionsAddedActivity({
-          streamId: payload.project.id,
-          activityUserId: payload.activityUserId,
-          targetUserId: payload.targetUserId,
-          role: payload.role
-        })
-      }),
-      deps.eventListen(ProjectEvents.PermissionsRevoked, async ({ payload }) => {
-        await addStreamPermissionsRevokedActivity({
-          streamId: payload.project.id,
-          activityUserId: payload.activityUserId,
-          removedUserId: payload.removedUserId,
-          stream: payload.project
-        })
       })
     ]
 
diff --git a/packages/server/modules/activitystream/events/userListeners.ts b/packages/server/modules/activitystream/events/userListeners.ts
index 3280ad3e3..e9f2ae6e7 100644
--- a/packages/server/modules/activitystream/events/userListeners.ts
+++ b/packages/server/modules/activitystream/events/userListeners.ts
@@ -9,11 +9,11 @@ import { EventBusListen, EventPayload } from '@/modules/shared/services/eventBus
 import { UserEvents } from '@/modules/core/domain/users/events'
 
 const addUserCreatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
+  ({ saveStreamActivity }: { saveStreamActivity: SaveStreamActivity }) =>
   async (payload: EventPayload<typeof UserEvents.Created>) => {
     const { user } = payload.payload
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId: null,
       resourceType: StreamResourceTypes.User,
       resourceId: user.id,
@@ -25,7 +25,7 @@ const addUserCreatedActivityFactory =
   }
 
 const addUserUpdatedActivityFactory =
-  ({ saveActivity }: { saveActivity: SaveStreamActivity }) =>
+  ({ saveStreamActivity }: { saveStreamActivity: SaveStreamActivity }) =>
   async (params: {
     oldUser: UserRecord
     update: UserUpdateInput
@@ -33,7 +33,7 @@ const addUserUpdatedActivityFactory =
   }) => {
     const { oldUser, update, updaterId } = params
 
-    await saveActivity({
+    await saveStreamActivity({
       streamId: null,
       resourceType: StreamResourceTypes.User,
       resourceId: oldUser.id,
@@ -45,11 +45,11 @@ const addUserUpdatedActivityFactory =
   }
 
 const addUserDeletedActivityFactory =
-  (deps: { saveActivity: SaveStreamActivity }) =>
+  (deps: { saveStreamActivity: SaveStreamActivity }) =>
   async (params: { targetUserId: string; invokerUserId: string }) => {
     const { targetUserId, invokerUserId } = params
 
-    await deps.saveActivity({
+    await deps.saveStreamActivity({
       streamId: null,
       resourceType: 'user',
       resourceId: targetUserId,
@@ -61,7 +61,8 @@ const addUserDeletedActivityFactory =
   }
 
 export const reportUserActivityFactory =
-  (deps: { eventListen: EventBusListen; saveActivity: SaveStreamActivity }) => () => {
+  (deps: { eventListen: EventBusListen; saveStreamActivity: SaveStreamActivity }) =>
+  () => {
     const addUserDeletedActivity = addUserDeletedActivityFactory(deps)
     const addUserUpdatedActivity = addUserUpdatedActivityFactory(deps)
     const addUserCreatedActivity = addUserCreatedActivityFactory(deps)
diff --git a/packages/server/modules/activitystream/helpers/types.ts b/packages/server/modules/activitystream/helpers/types.ts
index 6d8fa9944..a633e0fdd 100644
--- a/packages/server/modules/activitystream/helpers/types.ts
+++ b/packages/server/modules/activitystream/helpers/types.ts
@@ -1,18 +1,4 @@
 import { Nullable } from '@/modules/shared/helpers/typeHelper'
-import { ResourceEventsToPayloadMap } from '@/modules/activitystream/domain/types'
-
-export interface Activity<
-  T extends keyof ResourceEventsToPayloadMap,
-  R extends keyof ResourceEventsToPayloadMap[T]
-> {
-  id: string
-  contextResourceId: string
-  contextResourceType: T
-  eventType: R
-  userId: string | null
-  payload: ResourceEventsToPayloadMap[T][R]
-  createdAt: Date
-}
 
 export type StreamActivityRecord = {
   streamId: Nullable<string>
diff --git a/packages/server/modules/activitystream/index.ts b/packages/server/modules/activitystream/index.ts
index e36dba0b8..7b4ee02f4 100644
--- a/packages/server/modules/activitystream/index.ts
+++ b/packages/server/modules/activitystream/index.ts
@@ -44,45 +44,47 @@ const initializeEventListeners = ({
   eventBus: EventBus
   db: Knex
 }) => {
+  const saveActivity = saveActivityFactory({ db })
   const saveStreamActivity = saveStreamActivityFactory({ db })
   const reportUserActivity = reportUserActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveStreamActivity
+    saveStreamActivity
   })
   const reportAccessRequestActivity = reportAccessRequestActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveStreamActivity
+    saveStreamActivity
   })
   const reportBranchActivity = reportBranchActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveStreamActivity
+    saveStreamActivity
   })
   const reportCommitActivity = reportCommitActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveStreamActivity
+    saveStreamActivity
   })
   const reportCommentActivity = reportCommentActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveStreamActivity
+    saveStreamActivity
   })
   const reportStreamInviteActivity = reportStreamInviteActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveStreamActivity,
+    saveStreamActivity,
     getProjectInviteProject: getProjectInviteProjectFactory({
       getStream: getStreamFactory({ db })
     })
   })
   const reportStreamActivity = reportStreamActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveStreamActivity
+    saveActivity,
+    saveStreamActivity
   })
   const reportGatekeeperActivity = reportGatekeeperActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveActivityFactory({ db })
+    saveActivity
   })
   const reportWorkspaceActivity = reportWorkspaceActivityFactory({
     eventListen: eventBus.listen,
-    saveActivity: saveActivityFactory({ db })
+    saveActivity
   })
 
   const quitCbs = [
diff --git a/packages/server/modules/activitystream/repositories/index.ts b/packages/server/modules/activitystream/repositories/index.ts
index 68a8178ce..04c7cd7eb 100644
--- a/packages/server/modules/activitystream/repositories/index.ts
+++ b/packages/server/modules/activitystream/repositories/index.ts
@@ -1,5 +1,6 @@
 import {
   GetActiveUserStreams,
+  GetActivities,
   GetActivityCountByResourceId,
   GetActivityCountByStreamId,
   GetActivityCountByUserId,
@@ -15,7 +16,11 @@ import {
   StreamActivityRecord,
   StreamScopeActivity
 } from '@/modules/activitystream/helpers/types'
-import { Activity, StreamAcl, StreamActivity } from '@/modules/core/dbSchema'
+import {
+  Activity as ActivityModel,
+  StreamAcl,
+  StreamActivity
+} from '@/modules/core/dbSchema'
 import { Roles } from '@/modules/core/helpers/mainConstants'
 import { StreamAclRecord } from '@/modules/core/helpers/types'
 import {
@@ -29,6 +34,7 @@ import { getUserFactory } from '@/modules/core/repositories/users'
 import { getServerInfoFactory } from '@/modules/core/repositories/server'
 import { getProjectDbClient } from '@/modules/multiregion/utils/dbSelector'
 import cryptoRandomString from 'crypto-random-string'
+import { Activity } from '@/modules/activitystream/domain/types'
 
 const tables = {
   streamActivity: <T extends object = StreamActivityRecord>(db: Knex) =>
@@ -36,7 +42,7 @@ const tables = {
   streamAcl: (db: Knex) => db<StreamAclRecord>(StreamAcl.name)
 }
 
-export const getActivityFactory =
+export const geUserStreamActivityFactory =
   ({ db }: { db: Knex }) =>
   async (
     streamId: string,
@@ -280,8 +286,40 @@ export const saveActivityFactory =
     const createdAt = new Date()
 
     const [result] = await db<typeof activity & { id: string; createdAt: Date }>(
-      Activity.name
+      ActivityModel.name
     ).insert({ ...activity, id, createdAt }, '*')
 
     return result
   }
+
+export const getActivitiesFactory =
+  ({ db }: { db: Knex }): GetActivities =>
+  async (filters = {}): Promise<Activity[]> => {
+    const { workspaceId, projectId, eventType, userId } = filters
+
+    const q = db<Activity>(ActivityModel.name).select('*')
+
+    if (projectId) {
+      q.where(ActivityModel.col.contextResourceId, projectId).andWhere(
+        ActivityModel.col.contextResourceType,
+        'project'
+      )
+    }
+
+    if (workspaceId) {
+      q.where(ActivityModel.col.contextResourceId, workspaceId).andWhere(
+        ActivityModel.col.contextResourceType,
+        'workspace'
+      )
+    }
+
+    if (eventType) {
+      q.andWhere(ActivityModel.col.eventType, eventType)
+    }
+
+    if (userId) {
+      q.andWhere(ActivityModel.col.userId, userId)
+    }
+
+    return await q
+  }
diff --git a/packages/server/modules/activitystream/services/summary.ts b/packages/server/modules/activitystream/services/summary.ts
index ef777b10a..15d6270ca 100644
--- a/packages/server/modules/activitystream/services/summary.ts
+++ b/packages/server/modules/activitystream/services/summary.ts
@@ -5,7 +5,7 @@ import {
 import {
   CreateActivitySummary,
   GetActiveUserStreams,
-  GetActivity
+  GetUserStreamActivity
 } from '@/modules/activitystream/domain/operations'
 import { GetStream } from '@/modules/core/domain/streams/operations'
 import { GetUser } from '@/modules/core/domain/users/operations'
@@ -17,7 +17,7 @@ export const createActivitySummaryFactory =
     getUser
   }: {
     getStream: GetStream
-    getActivity: GetActivity
+    getActivity: GetUserStreamActivity
     getUser: GetUser
   }): CreateActivitySummary =>
   async ({
diff --git a/packages/server/modules/activitystream/tests/integration/activity.graph.spec.ts b/packages/server/modules/activitystream/tests/integration/activity.graph.spec.ts
index b79c3d238..1cf74a434 100644
--- a/packages/server/modules/activitystream/tests/integration/activity.graph.spec.ts
+++ b/packages/server/modules/activitystream/tests/integration/activity.graph.spec.ts
@@ -12,7 +12,10 @@ import {
   addOrUpdateStreamCollaboratorFactory
 } from '@/modules/core/services/streams/access'
 import { authorizeResolver } from '@/modules/shared'
-import { grantStreamPermissionsFactory } from '@/modules/core/repositories/streams'
+import {
+  getStreamRolesFactory,
+  grantStreamPermissionsFactory
+} from '@/modules/core/repositories/streams'
 import {
   getUserFactory,
   storeUserFactory,
@@ -49,6 +52,7 @@ import { getEventBus } from '@/modules/shared/services/eventBus'
 import type http from 'node:http'
 import { BasicTestStream, createTestStream } from '@/test/speckle-helpers/streamHelper'
 import { BasicTestBranch, createTestBranch } from '@/test/speckle-helpers/branchHelper'
+import { getActivitiesFactory } from '@/modules/activitystream/repositories/index'
 
 const getUser = getUserFactory({ db })
 const getUserActivity = getUserActivityFactory({ db })
@@ -57,6 +61,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -100,6 +105,8 @@ const createObject = createObjectFactory({
   storeSingleObjectIfNotFoundFactory: storeSingleObjectIfNotFoundFactory({ db })
 })
 
+const getActivities = getActivitiesFactory({ db })
+
 let server: http.Server
 let sendRequest: Awaited<ReturnType<typeof initializeTestServer>>['sendRequest']
 
@@ -265,11 +272,37 @@ describe('Activity @activity', () => {
     expect(activityC.length).to.equal(3)
     expect(activityC[0].actionType).to.equal('commit_create')
 
-    const { items: activityI } = await getUserActivity({ userId: userIz.id })
+    const activityI = await getUserActivity({ userId: userIz.id })
 
-    // iz1 to iz4 + user created + user added as collaborator
-    expect(activityI.length).to.equal(6)
-    expect(activityI[0].actionType).to.equal('stream_permissions_add')
+    expect(activityI.items.length).to.equal(4)
+    expect(activityI).to.nested.include({
+      'items[0].actionType': 'commit_create',
+      'items[1].actionType': 'branch_create',
+      'items[2].actionType': 'stream_create',
+      'items[3].actionType': 'user_create'
+    })
+
+    const activity = { items: await getActivities({ userId: userIz.id }) }
+
+    expect(activity.items.length).to.equal(3)
+    expect(activity).to.nested.include({
+      'items[0].eventType': 'project_role_updated',
+      'items[0].payload.new': 'stream:owner',
+      'items[0].payload.old': null,
+      'items[0].userId': userIz.id, // created branch
+
+      'items[1].eventType': 'project_role_updated',
+      'items[1].payload.new': 'stream:reviewer',
+      'items[1].payload.old': null,
+      'items[1].payload.userId': userCr.id,
+      'items[1].userId': userIz.id, // added user
+
+      'items[2].eventType': 'project_role_updated',
+      'items[2].payload.new': 'stream:contributor',
+      'items[2].payload.old': 'stream:reviewer',
+      'items[2].payload.userId': userCr.id,
+      'items[2].userId': userIz.id // made him a contibutor
+    })
   })
 
   after(async () => {
@@ -283,9 +316,9 @@ describe('Activity @activity', () => {
     expect(noErrors(res))
     const activity = res.body.data.activeUser.activity
 
-    expect(activity.items.length).to.equal(6)
-    expect(activity.totalCount).to.equal(6)
-    expect(activity.items[0].actionType).to.equal('stream_permissions_add')
+    expect(activity.items.length).to.equal(4)
+    expect(activity.totalCount).to.equal(4)
+    expect(activity.items[0].actionType).to.equal('commit_create')
     expect(activity.items[activity.totalCount - 1].actionType).to.equal('user_create')
   })
 
@@ -303,8 +336,8 @@ describe('Activity @activity', () => {
       query: `query {otherUser(id:"${userCr.id}") { name timeline { totalCount items {id streamId resourceType resourceId actionType userId message time}}} }`
     })
     expect(noErrors(res))
-    expect(res.body.data.otherUser.timeline.items.length).to.equal(7) // sum of all actions in before hook
-    expect(res.body.data.otherUser.timeline.totalCount).to.equal(7)
+    expect(res.body.data.otherUser.timeline.items.length).to.equal(5) // sum of all actions in before hook
+    expect(res.body.data.otherUser.timeline.totalCount).to.equal(5)
   })
 
   it("Should get a stream's activity", async () => {
@@ -313,8 +346,8 @@ describe('Activity @activity', () => {
     })
     expect(noErrors(res))
     const activity = res.body.data.stream.activity
-    expect(activity.items.length).to.equal(5)
-    expect(activity.totalCount).to.equal(5)
+    expect(activity.items.length).to.equal(3)
+    expect(activity.totalCount).to.equal(3)
     expect(activity.items[activity.totalCount - 1].actionType).to.equal('stream_create')
   })
 
diff --git a/packages/server/modules/activitystream/tests/integration/activitySummary.spec.ts b/packages/server/modules/activitystream/tests/integration/activitySummary.spec.ts
index 617beb5e2..c9ca40ae9 100644
--- a/packages/server/modules/activitystream/tests/integration/activitySummary.spec.ts
+++ b/packages/server/modules/activitystream/tests/integration/activitySummary.spec.ts
@@ -16,7 +16,7 @@ import {
   NotificationTypeMessageMap
 } from '@/modules/notifications/helpers/types'
 import {
-  getActivityFactory,
+  geUserStreamActivityFactory,
   saveStreamActivityFactory
 } from '@/modules/activitystream/repositories'
 import { db } from '@/db/knex'
@@ -24,6 +24,7 @@ import {
   createStreamFactory,
   deleteStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import {
@@ -81,7 +82,7 @@ const getStream = getStreamFactory({ db })
 const saveActivity = saveStreamActivityFactory({ db })
 const createActivitySummary = createActivitySummaryFactory({
   getStream,
-  getActivity: getActivityFactory({ db }),
+  getActivity: geUserStreamActivityFactory({ db }),
   getUser
 })
 
@@ -97,6 +98,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/auth/helpers/types.ts b/packages/server/modules/auth/helpers/types.ts
index 024e552eb..10f084848 100644
--- a/packages/server/modules/auth/helpers/types.ts
+++ b/packages/server/modules/auth/helpers/types.ts
@@ -74,6 +74,13 @@ export type PersonalApiTokenRecord = {
   tokenId: string
 }
 
+export type EmbedApiTokenRecord = {
+  projectId: string
+  tokenId: string
+  userId: string
+  resourceIdString: string
+}
+
 export type TokenScopeRecord = {
   tokenId: string
   scopeName: ServerScope
diff --git a/packages/server/modules/auth/tests/auth.spec.ts b/packages/server/modules/auth/tests/auth.spec.ts
index 996480ad2..9c9553a72 100644
--- a/packages/server/modules/auth/tests/auth.spec.ts
+++ b/packages/server/modules/auth/tests/auth.spec.ts
@@ -22,7 +22,8 @@ import { collectAndValidateCoreTargetsFactory } from '@/modules/serverinvites/se
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { buildCoreInviteEmailContentsFactory } from '@/modules/serverinvites/services/coreEmailContents'
 import { getEventBus } from '@/modules/shared/services/eventBus'
@@ -95,6 +96,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/automate/tests/automations.spec.ts b/packages/server/modules/automate/tests/automations.spec.ts
index 34537636a..6dd4e364d 100644
--- a/packages/server/modules/automate/tests/automations.spec.ts
+++ b/packages/server/modules/automate/tests/automations.spec.ts
@@ -48,7 +48,10 @@ import {
   validateStreamAccessFactory
 } from '@/modules/core/services/streams/access'
 import { authorizeResolver } from '@/modules/shared'
-import { grantStreamPermissionsFactory } from '@/modules/core/repositories/streams'
+import {
+  getStreamRolesFactory,
+  grantStreamPermissionsFactory
+} from '@/modules/core/repositories/streams'
 import { getUserFactory } from '@/modules/core/repositories/users'
 import { getEventBus } from '@/modules/shared/services/eventBus'
 import { AutomationEvents } from '@/modules/automate/domain/events'
@@ -67,6 +70,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
diff --git a/packages/server/modules/blobstorage/clients/objectStorage.ts b/packages/server/modules/blobstorage/clients/objectStorage.ts
index 615b0d01f..119034cd0 100644
--- a/packages/server/modules/blobstorage/clients/objectStorage.ts
+++ b/packages/server/modules/blobstorage/clients/objectStorage.ts
@@ -2,6 +2,7 @@ import {
   getS3AccessKey,
   getS3BucketName,
   getS3Endpoint,
+  getS3PublicEndpoint,
   getS3Region,
   getS3SecretKey
 } from '@/modules/shared/helpers/envHelper'
@@ -51,9 +52,17 @@ export const getObjectStorage = (params: GetObjectStorageParams): ObjectStorage
 }
 
 let mainObjectStorage: Optional<ObjectStorage> = undefined
+let publicMainObjectStorage: Optional<ObjectStorage> = undefined
 
 /**
  * Get main object storage client
+ *
+ * This is used for connecting the server to the S3 host. Where the S3 host is
+ * on the same private network as the server (e.g. in a Docker network),
+ * the S3_ENDPOINT can use the private IP or DNS name of the S3 host.
+ *
+ * S3_PUBLIC_ENDPOINT can be used to connect to the S3 host via the
+ * public internet (or localhost network if running locally or testing).
  */
 export const getMainObjectStorage = (): ObjectStorage => {
   if (mainObjectStorage) return mainObjectStorage
@@ -72,6 +81,37 @@ export const getMainObjectStorage = (): ObjectStorage => {
   return mainObjectStorage
 }
 
+/**
+ * (Optional) Used to connect to the S3 host via the public endpoint.
+ * This is useful for clients that need to access the S3 bucket directly, e.g
+ * during testing or when the S3 host is not on the same private network as the server.
+ *
+ * If `S3_PUBLIC_ENDPOINT` is not set, it will return the same object storage
+ * as `getMainObjectStorage`.
+ */
+export const getPublicMainObjectStorage = (): ObjectStorage => {
+  if (publicMainObjectStorage) return publicMainObjectStorage
+
+  const endpoint = getS3PublicEndpoint()
+  if (!endpoint) {
+    // If no public endpoint is set, return the main object storage
+    return getMainObjectStorage()
+  }
+
+  const mainParams: GetObjectStorageParams = {
+    credentials: {
+      accessKeyId: getS3AccessKey(),
+      secretAccessKey: getS3SecretKey()
+    },
+    endpoint,
+    region: getS3Region(),
+    bucket: getS3BucketName()
+  }
+
+  publicMainObjectStorage = getObjectStorage(mainParams)
+  return publicMainObjectStorage
+}
+
 export const getSignedUrlFactory = (deps: {
   objectStorage: ObjectStorage
 }): GetSignedUrl => {
diff --git a/packages/server/modules/blobstorage/rest/router.ts b/packages/server/modules/blobstorage/rest/router.ts
index 594ffe6c8..de1214d99 100644
--- a/packages/server/modules/blobstorage/rest/router.ts
+++ b/packages/server/modules/blobstorage/rest/router.ts
@@ -124,7 +124,9 @@ export const blobStorageRouterFactory = (): Router => {
 
       const getBlobMetadata = getBlobMetadataFactory({ db: projectDb })
       const getFileStream = getFileStreamFactory({ getBlobMetadata })
-      const getObjectStream = getObjectStreamFactory({ storage: projectStorage })
+      const getObjectStream = getObjectStreamFactory({
+        storage: projectStorage.private
+      })
 
       const { fileName } = await getBlobMetadata({
         streamId: req.params.streamId,
@@ -160,7 +162,7 @@ export const blobStorageRouterFactory = (): Router => {
       ])
 
       const getBlobMetadata = getBlobMetadataFactory({ db: projectDb })
-      const deleteObject = deleteObjectFactory({ storage: projectStorage })
+      const deleteObject = deleteObjectFactory({ storage: projectStorage.private })
       const deleteBlob = fullyDeleteBlobFactory({
         getBlobMetadata,
         deleteBlob: deleteBlobFactory({ db: projectDb }),
diff --git a/packages/server/modules/blobstorage/services/streams.ts b/packages/server/modules/blobstorage/services/streams.ts
index ed87e0acb..6c886f215 100644
--- a/packages/server/modules/blobstorage/services/streams.ts
+++ b/packages/server/modules/blobstorage/services/streams.ts
@@ -45,7 +45,7 @@ export const processNewFileStreamFactory = (): NewFileStreamProcessor => {
       getProjectObjectStorage({ projectId: streamId })
     ])
 
-    const storeFileStream = storeFileStreamFactory({ storage: projectStorage })
+    const storeFileStream = storeFileStreamFactory({ storage: projectStorage.private })
     const updateBlob = updateBlobFactory({ db: projectDb })
     const getBlobMetadata = getBlobMetadataFactory({ db: projectDb })
 
@@ -66,9 +66,9 @@ export const processNewFileStreamFactory = (): NewFileStreamProcessor => {
     })
 
     const getObjectAttributes = getObjectAttributesFactory({
-      storage: projectStorage
+      storage: projectStorage.private
     })
-    const deleteObject = deleteObjectFactory({ storage: projectStorage })
+    const deleteObject = deleteObjectFactory({ storage: projectStorage.private })
 
     busboy.on(
       'file',
diff --git a/packages/server/modules/blobstorage/tests/e2e/blobstorage.graph.spec.ts b/packages/server/modules/blobstorage/tests/e2e/blobstorage.graph.spec.ts
index 8e427a877..18bb10ff1 100644
--- a/packages/server/modules/blobstorage/tests/e2e/blobstorage.graph.spec.ts
+++ b/packages/server/modules/blobstorage/tests/e2e/blobstorage.graph.spec.ts
@@ -12,7 +12,8 @@ import {
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
 import {
@@ -83,6 +84,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/blobstorage/tests/integration/blobstorage.integration.spec.ts b/packages/server/modules/blobstorage/tests/integration/blobstorage.integration.spec.ts
index dc7e04469..380e54238 100644
--- a/packages/server/modules/blobstorage/tests/integration/blobstorage.integration.spec.ts
+++ b/packages/server/modules/blobstorage/tests/integration/blobstorage.integration.spec.ts
@@ -23,7 +23,10 @@ import { BasicTestStream, createTestStream } from '@/test/speckle-helpers/stream
 import cryptoRandomString from 'crypto-random-string'
 import { BasicTestUser, createTestUser } from '@/test/authHelper'
 import { storeFileStreamFactory } from '@/modules/blobstorage/repositories/blobs'
-import { getMainObjectStorage } from '@/modules/blobstorage/clients/objectStorage'
+import {
+  getMainObjectStorage,
+  getPublicMainObjectStorage
+} from '@/modules/blobstorage/clients/objectStorage'
 import { expect } from 'chai'
 import { UploadFileStream } from '@/modules/blobstorage/domain/operations'
 import { BlobStorageItem } from '@/modules/blobstorage/domain/types'
@@ -43,8 +46,8 @@ const buildUploadFileStream = async (params: { streamId: string | null }) => {
 
   const storage = streamId
     ? await getProjectObjectStorage({ projectId: streamId })
-    : getMainObjectStorage()
-  const storeFileStream = storeFileStreamFactory({ storage })
+    : { private: getMainObjectStorage(), public: getPublicMainObjectStorage() }
+  const storeFileStream = storeFileStreamFactory({ storage: storage.public })
   const uploadFileStream = uploadFileStreamFactory({
     upsertBlob,
     updateBlob,
diff --git a/packages/server/modules/blobstorage/tests/integration/presigned.integration.spec.ts b/packages/server/modules/blobstorage/tests/integration/presigned.integration.spec.ts
index f80d22032..ad19720cd 100644
--- a/packages/server/modules/blobstorage/tests/integration/presigned.integration.spec.ts
+++ b/packages/server/modules/blobstorage/tests/integration/presigned.integration.spec.ts
@@ -52,7 +52,7 @@ const { FF_LARGE_FILE_IMPORTS_ENABLED } = getFeatureFlags()
     }
 
     let projectDb: Knex
-    let projectStorage: ObjectStorage
+    let projectStorage: { private: ObjectStorage; public: ObjectStorage }
     let getBlobMetadata: GetBlobMetadata
 
     before(async () => {
@@ -77,7 +77,7 @@ const { FF_LARGE_FILE_IMPORTS_ENABLED } = getFeatureFlags()
       before(() => {
         SUT = generatePresignedUrlFactory({
           getSignedUrl: getSignedUrlFactory({
-            objectStorage: projectStorage
+            objectStorage: projectStorage.public
           }),
           upsertBlob: upsertBlobFactory({
             db: projectDb
@@ -117,7 +117,7 @@ const { FF_LARGE_FILE_IMPORTS_ENABLED } = getFeatureFlags()
       before(() => {
         generatePresignedUrl = generatePresignedUrlFactory({
           getSignedUrl: getSignedUrlFactory({
-            objectStorage: projectStorage
+            objectStorage: projectStorage.public
           }),
           upsertBlob: upsertBlobFactory({
             db: projectDb
@@ -126,7 +126,7 @@ const { FF_LARGE_FILE_IMPORTS_ENABLED } = getFeatureFlags()
         SUT = registerCompletedUploadFactory({
           getBlob: getBlobFactory({ db: projectDb }),
           getBlobMetadata: getBlobMetadataFromStorage({
-            objectStorage: projectStorage
+            objectStorage: projectStorage.public
           }),
           updateBlob: updateBlobFactory({
             db: projectDb
diff --git a/packages/server/modules/comments/tests/comments.spec.ts b/packages/server/modules/comments/tests/comments.spec.ts
index db41f952a..65724960a 100644
--- a/packages/server/modules/comments/tests/comments.spec.ts
+++ b/packages/server/modules/comments/tests/comments.spec.ts
@@ -56,7 +56,8 @@ import {
   getStreamFactory,
   createStreamFactory,
   markCommitStreamUpdatedFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import {
   createCommitByBranchIdFactory,
@@ -250,6 +251,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/core/dbSchema.ts b/packages/server/modules/core/dbSchema.ts
index 201eca27b..d0f6528a8 100644
--- a/packages/server/modules/core/dbSchema.ts
+++ b/packages/server/modules/core/dbSchema.ts
@@ -406,6 +406,13 @@ export const PersonalApiTokens = buildTableHelper('personal_api_tokens', [
   'userId'
 ])
 
+export const EmbedApiTokens = buildTableHelper('embed_api_tokens', [
+  'tokenId',
+  'projectId',
+  'userId',
+  'resourceIdString'
+])
+
 export const UserServerAppTokens = buildTableHelper('user_server_app_tokens', [
   'appId',
   'userId',
diff --git a/packages/server/modules/core/domain/projects/events.ts b/packages/server/modules/core/domain/projects/events.ts
index c63337782..64432806c 100644
--- a/packages/server/modules/core/domain/projects/events.ts
+++ b/packages/server/modules/core/domain/projects/events.ts
@@ -6,7 +6,7 @@ import {
   StreamUpdateInput
 } from '@/modules/core/graph/generated/graphql'
 import { ServerInviteRecord } from '@/modules/serverinvites/domain/types'
-import { StreamRoles } from '@speckle/shared'
+import { Nullable, StreamRoles } from '@speckle/shared'
 
 export const projectEventsNamespace = 'projects' as const
 
@@ -54,10 +54,12 @@ export type ProjectEventsPayloads = {
     targetUserId: string
     role: StreamRoles
     project: Project
+    previousRole: Nullable<StreamRoles>
   }
   [ProjectEvents.PermissionsRevoked]: {
     activityUserId: string
     removedUserId: string
     project: Project
+    role: StreamRoles
   }
 }
diff --git a/packages/server/modules/core/domain/projects/operations.ts b/packages/server/modules/core/domain/projects/operations.ts
index 7ffe171ab..04bef00cb 100644
--- a/packages/server/modules/core/domain/projects/operations.ts
+++ b/packages/server/modules/core/domain/projects/operations.ts
@@ -1,4 +1,4 @@
-import { Project } from '@/modules/core/domain/streams/types'
+import { Project, StreamWithOptionalRole } from '@/modules/core/domain/streams/types'
 import { StreamAclRecord, StreamRecord } from '@/modules/core/helpers/types'
 import { MaybeNullOrUndefined, StreamRoles } from '@speckle/shared'
 
@@ -38,7 +38,7 @@ export type DeleteProjectRole = (args: {
 
 export type DeleteProject = (args: { projectId: string }) => Promise<void>
 
-export type GetRolesByUserId = ({
+export type GetUserProjectRoles = ({
   userId,
   workspaceId
 }: {
@@ -73,3 +73,15 @@ export type WaitForRegionProject = (params: {
   regionKey: string
   maxAttempts?: number
 }) => Promise<void>
+
+export type QueryAllProjects = (
+  args:
+    | {
+        userId: string
+        workspaceId?: string
+      }
+    | {
+        userId?: string
+        workspaceId: string
+      }
+) => AsyncGenerator<StreamWithOptionalRole[], void, unknown>
diff --git a/packages/server/modules/core/domain/streams/operations.ts b/packages/server/modules/core/domain/streams/operations.ts
index 96259e843..e11205f83 100644
--- a/packages/server/modules/core/domain/streams/operations.ts
+++ b/packages/server/modules/core/domain/streams/operations.ts
@@ -258,7 +258,7 @@ export type GetStreamRoles = (
   userId: string,
   streamIds: string[]
 ) => Promise<{
-  [streamId: string]: Nullable<string>
+  [streamId: string]: Nullable<StreamRoles>
 }>
 
 export type GetUserStreamCounts = (params: {
diff --git a/packages/server/modules/core/domain/tokens/operations.ts b/packages/server/modules/core/domain/tokens/operations.ts
index c26528852..85e2cf935 100644
--- a/packages/server/modules/core/domain/tokens/operations.ts
+++ b/packages/server/modules/core/domain/tokens/operations.ts
@@ -1,5 +1,6 @@
 import {
   ApiToken,
+  EmbedApiToken,
   PersonalApiToken,
   TokenResourceAccessDefinition,
   TokenResourceIdentifierType,
@@ -31,6 +32,8 @@ export type StorePersonalApiToken = (
   token: PersonalApiToken
 ) => Promise<PersonalApiToken>
 
+export type StoreEmbedApiToken = (token: EmbedApiToken) => Promise<EmbedApiToken>
+
 export type GetUserPersonalAccessTokens = (userId: string) => Promise<
   {
     id: string
@@ -43,10 +46,33 @@ export type GetUserPersonalAccessTokens = (userId: string) => Promise<
   }[]
 >
 
+export type ListProjectEmbedTokens = (args: {
+  projectId: string
+  filter?: {
+    limit?: number
+    createdBefore?: string | null
+  }
+}) => Promise<
+  (EmbedApiToken & {
+    createdAt: Date
+    lastUsed: Date
+    lifespan: number | bigint
+  })[]
+>
+
+export type CountProjectEmbedTokens = (args: { projectId: string }) => Promise<number>
+
 export type RevokeTokenById = (tokenId: string) => Promise<boolean>
 
 export type RevokeUserTokenById = (tokenId: string, userId: string) => Promise<boolean>
 
+export type RevokeEmbedTokenById = (args: {
+  tokenId: string
+  projectId: string
+}) => Promise<boolean>
+
+export type RevokeProjectEmbedTokens = (args: { projectId: string }) => Promise<void>
+
 export type GetApiTokenById = (tokenId: string) => Promise<Optional<ApiToken>>
 
 export type GetTokenScopesById = (tokenId: string) => Promise<TokenScope[]>
@@ -86,4 +112,30 @@ export type CreateAndStorePersonalAccessToken = (
   lifespan?: number | bigint
 ) => Promise<string>
 
+export type CreateAndStoreEmbedToken = (args: {
+  projectId: string
+  userId: string
+  /**
+   * The models (and optional versions) included in the embed.
+   * @example 'foo123,bar456@baz789'
+   */
+  resourceIdString: string
+  lifespan?: number | bigint
+}) => Promise<{
+  token: string
+  tokenMetadata: EmbedApiToken
+}>
+
+export type GetPaginatedProjectEmbedTokens = (args: {
+  projectId: string
+  filter?: {
+    limit?: number
+    cursor?: string
+  }
+}) => Promise<{
+  items: EmbedApiToken[]
+  totalCount: number
+  cursor: string | null
+}>
+
 export type ValidateToken = (tokenString: string) => Promise<TokenValidationResult>
diff --git a/packages/server/modules/core/domain/tokens/types.ts b/packages/server/modules/core/domain/tokens/types.ts
index 5b6f14888..7d0a00e96 100644
--- a/packages/server/modules/core/domain/tokens/types.ts
+++ b/packages/server/modules/core/domain/tokens/types.ts
@@ -1,4 +1,5 @@
 import {
+  EmbedApiTokenRecord,
   PersonalApiTokenRecord,
   TokenScopeRecord,
   UserServerAppTokenRecord
@@ -26,3 +27,5 @@ export type TokenResourceAccessDefinition = TokenResourceAccessRecord
 export type UserServerAppToken = UserServerAppTokenRecord
 
 export type PersonalApiToken = PersonalApiTokenRecord
+
+export type EmbedApiToken = EmbedApiTokenRecord
diff --git a/packages/server/modules/core/errors/projects.ts b/packages/server/modules/core/errors/projects.ts
index 650bcba88..c7b6d553b 100644
--- a/packages/server/modules/core/errors/projects.ts
+++ b/packages/server/modules/core/errors/projects.ts
@@ -11,3 +11,9 @@ export class ProjectNotFoundError extends BaseError {
   static code = 'PROJECT_NOT_FOUND'
   static statusCode = 404
 }
+
+export class ProjectQueryError extends BaseError {
+  static defaultMessage = 'Unexpected error during query operation'
+  static code = 'PROJECT_QUERY_ERROR'
+  static statusCode = 500
+}
diff --git a/packages/server/modules/core/graph/generated/graphql.ts b/packages/server/modules/core/graph/generated/graphql.ts
index 7b58fb92a..7c9644a4d 100644
--- a/packages/server/modules/core/graph/generated/graphql.ts
+++ b/packages/server/modules/core/graph/generated/graphql.ts
@@ -1,5 +1,5 @@
 import { GraphQLResolveInfo, GraphQLScalarType, GraphQLScalarTypeConfig } from 'graphql';
-import { StreamGraphQLReturn, CommitGraphQLReturn, ProjectGraphQLReturn, ObjectGraphQLReturn, VersionGraphQLReturn, ServerInviteGraphQLReturnType, ModelGraphQLReturn, ModelsTreeItemGraphQLReturn, MutationsObjectGraphQLReturn, LimitedUserGraphQLReturn, UserGraphQLReturn, GraphQLEmptyReturn, StreamCollaboratorGraphQLReturn, ProjectCollaboratorGraphQLReturn, ServerInfoGraphQLReturn, BranchGraphQLReturn, UserMetaGraphQLReturn, ProjectPermissionChecksGraphQLReturn, ModelPermissionChecksGraphQLReturn, VersionPermissionChecksGraphQLReturn, RootPermissionChecksGraphQLReturn } from '@/modules/core/helpers/graphTypes';
+import { StreamGraphQLReturn, CommitGraphQLReturn, ProjectGraphQLReturn, ObjectGraphQLReturn, VersionGraphQLReturn, ServerInviteGraphQLReturnType, ModelGraphQLReturn, ModelsTreeItemGraphQLReturn, MutationsObjectGraphQLReturn, LimitedUserGraphQLReturn, UserGraphQLReturn, EmbedTokenGraphQLReturn, GraphQLEmptyReturn, StreamCollaboratorGraphQLReturn, ProjectCollaboratorGraphQLReturn, ServerInfoGraphQLReturn, BranchGraphQLReturn, UserMetaGraphQLReturn, ProjectPermissionChecksGraphQLReturn, ModelPermissionChecksGraphQLReturn, VersionPermissionChecksGraphQLReturn, RootPermissionChecksGraphQLReturn } from '@/modules/core/helpers/graphTypes';
 import { StreamAccessRequestGraphQLReturn, ProjectAccessRequestGraphQLReturn } from '@/modules/accessrequests/helpers/graphTypes';
 import { CommentReplyAuthorCollectionGraphQLReturn, CommentGraphQLReturn, CommentPermissionChecksGraphQLReturn } from '@/modules/comments/helpers/graphTypes';
 import { PendingStreamCollaboratorGraphQLReturn } from '@/modules/serverinvites/helpers/graphTypes';
@@ -945,6 +945,12 @@ export type CreateCommentReplyInput = {
   threadId: Scalars['String']['input'];
 };
 
+export type CreateEmbedTokenReturn = {
+  __typename?: 'CreateEmbedTokenReturn';
+  token: Scalars['String']['output'];
+  tokenMetadata: EmbedToken;
+};
+
 export type CreateModelInput = {
   description?: InputMaybe<Scalars['String']['input']>;
   name: Scalars['String']['input'];
@@ -1023,6 +1029,32 @@ export type EmailVerificationRequestInput = {
   id: Scalars['ID']['input'];
 };
 
+/** A token used to enable an embedded viewer for a private project */
+export type EmbedToken = {
+  __typename?: 'EmbedToken';
+  createdAt: Scalars['DateTime']['output'];
+  lastUsed: Scalars['DateTime']['output'];
+  lifespan: Scalars['BigInt']['output'];
+  projectId: Scalars['String']['output'];
+  resourceIdString: Scalars['String']['output'];
+  tokenId: Scalars['String']['output'];
+  user?: Maybe<LimitedUser>;
+};
+
+export type EmbedTokenCollection = {
+  __typename?: 'EmbedTokenCollection';
+  cursor?: Maybe<Scalars['String']['output']>;
+  items: Array<EmbedToken>;
+  totalCount: Scalars['Int']['output'];
+};
+
+export type EmbedTokenCreateInput = {
+  lifespan?: InputMaybe<Scalars['BigInt']['input']>;
+  projectId: Scalars['String']['input'];
+  /** The model(s) and version(s) string used in the embed url */
+  resourceIdString: Scalars['String']['input'];
+};
+
 export type FileUpload = {
   __typename?: 'FileUpload';
   branchName: Scalars['String']['output'];
@@ -2118,6 +2150,7 @@ export type Project = {
   description?: Maybe<Scalars['String']['output']>;
   /** Public project-level configuration for embedded viewer */
   embedOptions: ProjectEmbedOptions;
+  embedTokens: EmbedTokenCollection;
   hasAccessToFeature: Scalars['Boolean']['output'];
   id: Scalars['ID']['output'];
   invitableCollaborators: WorkspaceCollaboratorCollection;
@@ -2200,6 +2233,12 @@ export type ProjectCommentThreadsArgs = {
 };
 
 
+export type ProjectEmbedTokensArgs = {
+  cursor?: InputMaybe<Scalars['String']['input']>;
+  limit?: InputMaybe<Scalars['Int']['input']>;
+};
+
+
 export type ProjectHasAccessToFeatureArgs = {
   featureName: WorkspaceFeatureName;
 };
@@ -2599,6 +2638,7 @@ export type ProjectMutations = {
   batchDelete: Scalars['Boolean']['output'];
   /** Create new project */
   create: Project;
+  createEmbedToken: CreateEmbedTokenReturn;
   /**
    * Create onboarding/tutorial project. If one is already created for the active user, that
    * one will be returned instead.
@@ -2610,6 +2650,8 @@ export type ProjectMutations = {
   invites: ProjectInviteMutations;
   /** Leave a project. Only possible if you're not the last remaining owner. */
   leave: Scalars['Boolean']['output'];
+  revokeEmbedToken: Scalars['Boolean']['output'];
+  revokeEmbedTokens: Scalars['Boolean']['output'];
   /** Updates an existing project */
   update: Project;
   /** Update role for a collaborator */
@@ -2632,6 +2674,11 @@ export type ProjectMutationsCreateArgs = {
 };
 
 
+export type ProjectMutationsCreateEmbedTokenArgs = {
+  token: EmbedTokenCreateInput;
+};
+
+
 export type ProjectMutationsDeleteArgs = {
   id: Scalars['String']['input'];
 };
@@ -2642,6 +2689,17 @@ export type ProjectMutationsLeaveArgs = {
 };
 
 
+export type ProjectMutationsRevokeEmbedTokenArgs = {
+  projectId: Scalars['String']['input'];
+  token: Scalars['String']['input'];
+};
+
+
+export type ProjectMutationsRevokeEmbedTokensArgs = {
+  projectId: Scalars['String']['input'];
+};
+
+
 export type ProjectMutationsUpdateArgs = {
   update: ProjectUpdateInput;
 };
@@ -2684,6 +2742,7 @@ export type ProjectPermissionChecks = {
   canBroadcastActivity: PermissionCheckResult;
   canCreateAutomation: PermissionCheckResult;
   canCreateComment: PermissionCheckResult;
+  canCreateEmbedTokens: PermissionCheckResult;
   canCreateModel: PermissionCheckResult;
   canDelete: PermissionCheckResult;
   canInvite: PermissionCheckResult;
@@ -2692,9 +2751,11 @@ export type ProjectPermissionChecks = {
   canMoveToWorkspace: PermissionCheckResult;
   canPublish: PermissionCheckResult;
   canRead: PermissionCheckResult;
+  canReadEmbedTokens: PermissionCheckResult;
   canReadSettings: PermissionCheckResult;
   canReadWebhooks: PermissionCheckResult;
   canRequestRender: PermissionCheckResult;
+  canRevokeEmbedTokens: PermissionCheckResult;
   canUpdate: PermissionCheckResult;
   canUpdateAllowPublicComments: PermissionCheckResult;
 };
@@ -5429,6 +5490,7 @@ export type ResolversTypes = {
   CreateAutomateFunctionWithoutVersionInput: CreateAutomateFunctionWithoutVersionInput;
   CreateCommentInput: CreateCommentInput;
   CreateCommentReplyInput: CreateCommentReplyInput;
+  CreateEmbedTokenReturn: ResolverTypeWrapper<Omit<CreateEmbedTokenReturn, 'tokenMetadata'> & { tokenMetadata: ResolversTypes['EmbedToken'] }>;
   CreateModelInput: CreateModelInput;
   CreateServerRegionInput: CreateServerRegionInput;
   CreateUserEmailInput: CreateUserEmailInput;
@@ -5444,6 +5506,9 @@ export type ResolversTypes = {
   DiscoverableStreamsSortingInput: DiscoverableStreamsSortingInput;
   EditCommentInput: EditCommentInput;
   EmailVerificationRequestInput: EmailVerificationRequestInput;
+  EmbedToken: ResolverTypeWrapper<EmbedTokenGraphQLReturn>;
+  EmbedTokenCollection: ResolverTypeWrapper<Omit<EmbedTokenCollection, 'items'> & { items: Array<ResolversTypes['EmbedToken']> }>;
+  EmbedTokenCreateInput: EmbedTokenCreateInput;
   FileUpload: ResolverTypeWrapper<FileUploadGraphQLReturn>;
   FileUploadCollection: ResolverTypeWrapper<Omit<FileUploadCollection, 'items'> & { items: Array<ResolversTypes['FileUpload']> }>;
   FileUploadMutations: ResolverTypeWrapper<MutationsObjectGraphQLReturn>;
@@ -5773,6 +5838,7 @@ export type ResolversParentTypes = {
   CreateAutomateFunctionWithoutVersionInput: CreateAutomateFunctionWithoutVersionInput;
   CreateCommentInput: CreateCommentInput;
   CreateCommentReplyInput: CreateCommentReplyInput;
+  CreateEmbedTokenReturn: Omit<CreateEmbedTokenReturn, 'tokenMetadata'> & { tokenMetadata: ResolversParentTypes['EmbedToken'] };
   CreateModelInput: CreateModelInput;
   CreateServerRegionInput: CreateServerRegionInput;
   CreateUserEmailInput: CreateUserEmailInput;
@@ -5786,6 +5852,9 @@ export type ResolversParentTypes = {
   DiscoverableStreamsSortingInput: DiscoverableStreamsSortingInput;
   EditCommentInput: EditCommentInput;
   EmailVerificationRequestInput: EmailVerificationRequestInput;
+  EmbedToken: EmbedTokenGraphQLReturn;
+  EmbedTokenCollection: Omit<EmbedTokenCollection, 'items'> & { items: Array<ResolversParentTypes['EmbedToken']> };
+  EmbedTokenCreateInput: EmbedTokenCreateInput;
   FileUpload: FileUploadGraphQLReturn;
   FileUploadCollection: Omit<FileUploadCollection, 'items'> & { items: Array<ResolversParentTypes['FileUpload']> };
   FileUploadMutations: MutationsObjectGraphQLReturn;
@@ -6458,6 +6527,12 @@ export type CountOnlyCollectionResolvers<ContextType = GraphQLContext, ParentTyp
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 };
 
+export type CreateEmbedTokenReturnResolvers<ContextType = GraphQLContext, ParentType extends ResolversParentTypes['CreateEmbedTokenReturn'] = ResolversParentTypes['CreateEmbedTokenReturn']> = {
+  token?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  tokenMetadata?: Resolver<ResolversTypes['EmbedToken'], ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+};
+
 export type CurrencyBasedPricesResolvers<ContextType = GraphQLContext, ParentType extends ResolversParentTypes['CurrencyBasedPrices'] = ResolversParentTypes['CurrencyBasedPrices']> = {
   gbp?: Resolver<ResolversTypes['WorkspacePaidPlanPrices'], ParentType, ContextType>;
   usd?: Resolver<ResolversTypes['WorkspacePaidPlanPrices'], ParentType, ContextType>;
@@ -6468,6 +6543,24 @@ export interface DateTimeScalarConfig extends GraphQLScalarTypeConfig<ResolversT
   name: 'DateTime';
 }
 
+export type EmbedTokenResolvers<ContextType = GraphQLContext, ParentType extends ResolversParentTypes['EmbedToken'] = ResolversParentTypes['EmbedToken']> = {
+  createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
+  lastUsed?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
+  lifespan?: Resolver<ResolversTypes['BigInt'], ParentType, ContextType>;
+  projectId?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  resourceIdString?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  tokenId?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  user?: Resolver<Maybe<ResolversTypes['LimitedUser']>, ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+};
+
+export type EmbedTokenCollectionResolvers<ContextType = GraphQLContext, ParentType extends ResolversParentTypes['EmbedTokenCollection'] = ResolversParentTypes['EmbedTokenCollection']> = {
+  cursor?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  items?: Resolver<Array<ResolversTypes['EmbedToken']>, ParentType, ContextType>;
+  totalCount?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+};
+
 export type FileUploadResolvers<ContextType = GraphQLContext, ParentType extends ResolversParentTypes['FileUpload'] = ResolversParentTypes['FileUpload']> = {
   branchName?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   convertedCommitId?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
@@ -6820,6 +6913,7 @@ export type ProjectResolvers<ContextType = GraphQLContext, ParentType extends Re
   createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
   description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   embedOptions?: Resolver<ResolversTypes['ProjectEmbedOptions'], ParentType, ContextType>;
+  embedTokens?: Resolver<ResolversTypes['EmbedTokenCollection'], ParentType, ContextType, Partial<ProjectEmbedTokensArgs>>;
   hasAccessToFeature?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<ProjectHasAccessToFeatureArgs, 'featureName'>>;
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
   invitableCollaborators?: Resolver<ResolversTypes['WorkspaceCollaboratorCollection'], ParentType, ContextType, RequireFields<ProjectInvitableCollaboratorsArgs, 'limit'>>;
@@ -6954,10 +7048,13 @@ export type ProjectMutationsResolvers<ContextType = GraphQLContext, ParentType e
   automationMutations?: Resolver<ResolversTypes['ProjectAutomationMutations'], ParentType, ContextType, RequireFields<ProjectMutationsAutomationMutationsArgs, 'projectId'>>;
   batchDelete?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<ProjectMutationsBatchDeleteArgs, 'ids'>>;
   create?: Resolver<ResolversTypes['Project'], ParentType, ContextType, Partial<ProjectMutationsCreateArgs>>;
+  createEmbedToken?: Resolver<ResolversTypes['CreateEmbedTokenReturn'], ParentType, ContextType, RequireFields<ProjectMutationsCreateEmbedTokenArgs, 'token'>>;
   createForOnboarding?: Resolver<ResolversTypes['Project'], ParentType, ContextType>;
   delete?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<ProjectMutationsDeleteArgs, 'id'>>;
   invites?: Resolver<ResolversTypes['ProjectInviteMutations'], ParentType, ContextType>;
   leave?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<ProjectMutationsLeaveArgs, 'id'>>;
+  revokeEmbedToken?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<ProjectMutationsRevokeEmbedTokenArgs, 'projectId' | 'token'>>;
+  revokeEmbedTokens?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType, RequireFields<ProjectMutationsRevokeEmbedTokensArgs, 'projectId'>>;
   update?: Resolver<ResolversTypes['Project'], ParentType, ContextType, RequireFields<ProjectMutationsUpdateArgs, 'update'>>;
   updateRole?: Resolver<ResolversTypes['Project'], ParentType, ContextType, RequireFields<ProjectMutationsUpdateRoleArgs, 'input'>>;
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
@@ -6981,6 +7078,7 @@ export type ProjectPermissionChecksResolvers<ContextType = GraphQLContext, Paren
   canBroadcastActivity?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canCreateAutomation?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canCreateComment?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
+  canCreateEmbedTokens?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canCreateModel?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canDelete?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canInvite?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
@@ -6989,9 +7087,11 @@ export type ProjectPermissionChecksResolvers<ContextType = GraphQLContext, Paren
   canMoveToWorkspace?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType, Partial<ProjectPermissionChecksCanMoveToWorkspaceArgs>>;
   canPublish?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canRead?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
+  canReadEmbedTokens?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canReadSettings?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canReadWebhooks?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canRequestRender?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
+  canRevokeEmbedTokens?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canUpdate?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   canUpdateAllowPublicComments?: Resolver<ResolversTypes['PermissionCheckResult'], ParentType, ContextType>;
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
@@ -7911,8 +8011,11 @@ export type Resolvers<ContextType = GraphQLContext> = {
   Commit?: CommitResolvers<ContextType>;
   CommitCollection?: CommitCollectionResolvers<ContextType>;
   CountOnlyCollection?: CountOnlyCollectionResolvers<ContextType>;
+  CreateEmbedTokenReturn?: CreateEmbedTokenReturnResolvers<ContextType>;
   CurrencyBasedPrices?: CurrencyBasedPricesResolvers<ContextType>;
   DateTime?: GraphQLScalarType;
+  EmbedToken?: EmbedTokenResolvers<ContextType>;
+  EmbedTokenCollection?: EmbedTokenCollectionResolvers<ContextType>;
   FileUpload?: FileUploadResolvers<ContextType>;
   FileUploadCollection?: FileUploadCollectionResolvers<ContextType>;
   FileUploadMutations?: FileUploadMutationsResolvers<ContextType>;
diff --git a/packages/server/modules/core/graph/resolvers/embedTokens.ts b/packages/server/modules/core/graph/resolvers/embedTokens.ts
new file mode 100644
index 000000000..fab53dbaa
--- /dev/null
+++ b/packages/server/modules/core/graph/resolvers/embedTokens.ts
@@ -0,0 +1,113 @@
+import { db } from '@/db/knex'
+import { Resolvers } from '@/modules/core/graph/generated/graphql'
+import {
+  storeApiTokenFactory,
+  storeTokenResourceAccessDefinitionsFactory,
+  storeTokenScopesFactory
+} from '@/modules/core/repositories/tokens'
+import {
+  countProjectEmbedTokensFactory,
+  listProjectEmbedTokensFactory,
+  revokeEmbedTokenByIdFactory,
+  revokeProjectEmbedTokensFactory,
+  storeEmbedApiTokenFactory
+} from '@/modules/core/repositories/embedTokens'
+import {
+  createEmbedTokenFactory,
+  createTokenFactory,
+  getPaginatedProjectEmbedTokensFactory
+} from '@/modules/core/services/tokens'
+import { throwIfAuthNotOk } from '@/modules/shared/helpers/errorHelper'
+import { removeNullOrUndefinedKeys } from '@speckle/shared'
+import { getUserFactory } from '@/modules/core/repositories/users'
+import { throwIfResourceAccessNotAllowed } from '@/modules/core/helpers/token'
+
+const resolvers: Resolvers = {
+  EmbedToken: {
+    user: async (parent) => {
+      return await getUserFactory({ db })(parent.userId)
+    }
+  },
+  Project: {
+    embedTokens: async (parent, args, context) => {
+      const canReadEmbedTokens = await context.authPolicies.project.canReadEmbedTokens({
+        userId: context.userId,
+        projectId: parent.id
+      })
+      throwIfAuthNotOk(canReadEmbedTokens)
+
+      return await getPaginatedProjectEmbedTokensFactory({
+        listEmbedTokens: listProjectEmbedTokensFactory({ db }),
+        countEmbedTokens: countProjectEmbedTokensFactory({ db })
+      })({
+        projectId: parent.id,
+        filter: removeNullOrUndefinedKeys(args)
+      })
+    }
+  },
+  ProjectMutations: {
+    createEmbedToken: async (_parent, args, context) => {
+      const canCreateEmbedToken =
+        await context.authPolicies.project.canUpdateEmbedTokens({
+          userId: context.userId,
+          projectId: args.token.projectId
+        })
+      throwIfAuthNotOk(canCreateEmbedToken)
+      throwIfResourceAccessNotAllowed({
+        resourceId: args.token.projectId,
+        resourceType: 'project',
+        resourceAccessRules: context.resourceAccessRules
+      })
+
+      return await createEmbedTokenFactory({
+        createToken: createTokenFactory({
+          storeApiToken: storeApiTokenFactory({ db }),
+          storeTokenScopes: storeTokenScopesFactory({ db }),
+          storeTokenResourceAccessDefinitions:
+            storeTokenResourceAccessDefinitionsFactory({ db })
+        }),
+        storeEmbedToken: storeEmbedApiTokenFactory({ db })
+      })({
+        ...removeNullOrUndefinedKeys(args.token),
+        userId: context.userId!
+      })
+    },
+    revokeEmbedToken: async (_parent, args, context) => {
+      const canRevokeEmbedToken =
+        await context.authPolicies.project.canUpdateEmbedTokens({
+          userId: context.userId,
+          projectId: args.projectId
+        })
+      throwIfAuthNotOk(canRevokeEmbedToken)
+      throwIfResourceAccessNotAllowed({
+        resourceId: args.projectId,
+        resourceType: 'project',
+        resourceAccessRules: context.resourceAccessRules
+      })
+
+      return await revokeEmbedTokenByIdFactory({ db })({
+        tokenId: args.token,
+        projectId: args.projectId
+      })
+    },
+    revokeEmbedTokens: async (_parent, args, context) => {
+      const canRevokeEmbedTokens =
+        await context.authPolicies.project.canUpdateEmbedTokens({
+          userId: context.userId,
+          projectId: args.projectId
+        })
+      throwIfAuthNotOk(canRevokeEmbedTokens)
+      throwIfResourceAccessNotAllowed({
+        resourceId: args.projectId,
+        resourceType: 'project',
+        resourceAccessRules: context.resourceAccessRules
+      })
+
+      await revokeProjectEmbedTokensFactory({ db })({ projectId: args.projectId })
+
+      return true
+    }
+  }
+}
+
+export default resolvers
diff --git a/packages/server/modules/core/graph/resolvers/permissions.ts b/packages/server/modules/core/graph/resolvers/permissions.ts
index 0691408fc..2b3c1a52c 100644
--- a/packages/server/modules/core/graph/resolvers/permissions.ts
+++ b/packages/server/modules/core/graph/resolvers/permissions.ts
@@ -113,6 +113,27 @@ export default {
         userId: ctx.userId
       })
       return Authz.toGraphqlResult(canInvite)
+    },
+    canReadEmbedTokens: async (parent, _args, ctx) => {
+      const canReadEmbedTokens = await ctx.authPolicies.project.canReadEmbedTokens({
+        projectId: parent.projectId,
+        userId: ctx.userId
+      })
+      return Authz.toGraphqlResult(canReadEmbedTokens)
+    },
+    canCreateEmbedTokens: async (parent, _args, ctx) => {
+      const canCreateEmbedTokens = await ctx.authPolicies.project.canUpdateEmbedTokens({
+        projectId: parent.projectId,
+        userId: ctx.userId
+      })
+      return Authz.toGraphqlResult(canCreateEmbedTokens)
+    },
+    canRevokeEmbedTokens: async (parent, _args, ctx) => {
+      const canUpdateEmbedTokens = await ctx.authPolicies.project.canUpdateEmbedTokens({
+        projectId: parent.projectId,
+        userId: ctx.userId
+      })
+      return Authz.toGraphqlResult(canUpdateEmbedTokens)
     }
   },
   ModelPermissionChecks: {
diff --git a/packages/server/modules/core/graph/resolvers/projects.ts b/packages/server/modules/core/graph/resolvers/projects.ts
index e7e20f1e2..fcfe32a90 100644
--- a/packages/server/modules/core/graph/resolvers/projects.ts
+++ b/packages/server/modules/core/graph/resolvers/projects.ts
@@ -45,7 +45,8 @@ import {
   grantStreamPermissionsFactory,
   getOnboardingBaseStreamFactory,
   getUserStreamsPageFactory,
-  getUserStreamsCountFactory
+  getUserStreamsCountFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { getUserFactory, getUsersFactory } from '@/modules/core/repositories/users'
 import {
@@ -136,6 +137,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
@@ -203,6 +205,7 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 const updateStreamRoleAndNotify = updateStreamRoleAndNotifyFactory({
@@ -211,6 +214,7 @@ const updateStreamRoleAndNotify = updateStreamRoleAndNotifyFactory({
     validateStreamAccess,
     getUser,
     grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+    getStreamRoles: getStreamRolesFactory({ db }),
     emitEvent: getEventBus().emit
   }),
   removeStreamCollaborator
diff --git a/packages/server/modules/core/graph/resolvers/streams.ts b/packages/server/modules/core/graph/resolvers/streams.ts
index 5b25a0c1c..ffea6d6d4 100644
--- a/packages/server/modules/core/graph/resolvers/streams.ts
+++ b/packages/server/modules/core/graph/resolvers/streams.ts
@@ -25,7 +25,8 @@ import {
   canUserFavoriteStreamFactory,
   setStreamFavoritedFactory,
   getUserStreamsPageFactory,
-  getUserStreamsCountFactory
+  getUserStreamsCountFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import {
   createStreamReturnRecordFactory,
@@ -125,6 +126,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
@@ -203,6 +205,7 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 const updateStreamRoleAndNotify = updateStreamRoleAndNotifyFactory({
@@ -211,6 +214,7 @@ const updateStreamRoleAndNotify = updateStreamRoleAndNotifyFactory({
     validateStreamAccess,
     getUser,
     grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+    getStreamRoles: getStreamRolesFactory({ db }),
     emitEvent: getEventBus().emit
   }),
   removeStreamCollaborator
diff --git a/packages/server/modules/core/graph/resolvers/users.ts b/packages/server/modules/core/graph/resolvers/users.ts
index b5edeafc3..3cb62b243 100644
--- a/packages/server/modules/core/graph/resolvers/users.ts
+++ b/packages/server/modules/core/graph/resolvers/users.ts
@@ -33,7 +33,8 @@ import {
 } from '@/modules/core/services/users/management'
 import {
   deleteStreamFactory,
-  getUserDeletableStreamsFactory
+  getUserDeletableStreamsFactory,
+  legacyGetStreamsFactory
 } from '@/modules/core/repositories/streams'
 import { dbLogger } from '@/observability/logging'
 import { getAdminUsersListCollectionFactory } from '@/modules/core/services/users/legacyAdminUsersList'
@@ -51,6 +52,8 @@ import { asOperation } from '@/modules/shared/command'
 import { setUserOnboardingChoicesFactory } from '@/modules/core/services/users/tracking'
 import { getMixpanelClient } from '@/modules/shared/utils/mixpanel'
 import { throwIfAuthNotOk } from '@/modules/shared/helpers/errorHelper'
+import { getUserWorkspaceSeatsFactory } from '@/modules/workspacesCore/repositories/workspaces'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const getUser = legacyGetUserFactory({ db })
 const getUserByEmail = legacyGetUserByEmailFactory({ db })
@@ -67,6 +70,10 @@ const deleteUser = deleteUserFactory({
   logger: dbLogger,
   isLastAdminUser: isLastAdminUserFactory({ db }),
   getUserDeletableStreams: getUserDeletableStreamsFactory({ db }),
+  queryAllProjects: queryAllProjectsFactory({
+    getStreams: legacyGetStreamsFactory({ db })
+  }),
+  getUserWorkspaceSeats: getUserWorkspaceSeatsFactory({ db }),
   deleteAllUserInvites: deleteAllUserInvitesFactory({ db }),
   deleteUserRecord: deleteUserRecordFactory({ db }),
   emitEvent: getEventBus().emit
diff --git a/packages/server/modules/core/helpers/graphTypes.ts b/packages/server/modules/core/helpers/graphTypes.ts
index 75500c608..43e0f734b 100644
--- a/packages/server/modules/core/helpers/graphTypes.ts
+++ b/packages/server/modules/core/helpers/graphTypes.ts
@@ -3,6 +3,7 @@ import {
   LegacyStreamCommit,
   LegacyUserCommit
 } from '@/modules/core/domain/commits/types'
+import { EmbedApiToken } from '@/modules/core/domain/tokens/types'
 import {
   LimitedUser,
   StreamRole,
@@ -154,3 +155,5 @@ export type VersionPermissionChecksGraphQLReturn = {
   versionId: string
   projectId: string
 }
+
+export type EmbedTokenGraphQLReturn = EmbedApiToken
diff --git a/packages/server/modules/core/migrations/20250630073647_add_embed_tokens.ts b/packages/server/modules/core/migrations/20250630073647_add_embed_tokens.ts
new file mode 100644
index 000000000..07db597c3
--- /dev/null
+++ b/packages/server/modules/core/migrations/20250630073647_add_embed_tokens.ts
@@ -0,0 +1,30 @@
+import { Knex } from 'knex'
+
+export async function up(knex: Knex): Promise<void> {
+  await knex.schema.createTable('embed_api_tokens', (table) => {
+    table
+      .string('tokenId')
+      .notNullable()
+      .references('id')
+      .inTable('api_tokens')
+      .onDelete('cascade')
+    table
+      .string('projectId')
+      .notNullable()
+      .references('id')
+      .inTable('streams')
+      .onDelete('cascade')
+    table
+      .string('userId')
+      .notNullable()
+      .references('id')
+      .inTable('users')
+      .onDelete('cascade')
+    table.string('resourceIdString').notNullable()
+    table.primary(['projectId', 'tokenId'])
+  })
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists('embed_api_tokens')
+}
diff --git a/packages/server/modules/core/repositories/commits.ts b/packages/server/modules/core/repositories/commits.ts
index 13274fb77..fcf9ebfea 100644
--- a/packages/server/modules/core/repositories/commits.ts
+++ b/packages/server/modules/core/repositories/commits.ts
@@ -351,12 +351,14 @@ export const getPaginatedBranchCommitsItemsFactory =
     if (cursor) {
       q.andWhere(Commits.col.createdAt, '<', cursor)
     }
-    if (deps.limitsDate) {
-      q.andWhere(Commits.col.createdAt, '>', deps.limitsDate)
+
+    let rows = await q
+
+    const limitsDate = deps.limitsDate
+    if (limitsDate && rows.length > 0) {
+      // the length check above makes the ! ok
+      rows = [rows.shift()!, ...rows.filter((r) => r.createdAt > limitsDate)]
     }
-
-    const rows = await q
-
     return {
       commits: rows,
       cursor: rows.length > 0 ? rows[rows.length - 1].createdAt.toISOString() : null
@@ -701,11 +703,17 @@ export const legacyGetPaginatedStreamCommitsPageFactory =
     if (ignoreGlobalsBranch) query.andWhere('branches.name', '!=', 'globals')
 
     if (cursor) query.andWhere('commits.createdAt', '<', cursor)
-    if (deps.limitsDate) query.andWhere('commits.createdAt', '>', deps.limitsDate)
+    // if (deps.limitsDate) query.andWhere('commits.createdAt', '>', deps.limitsDate)
 
     query.orderBy('commits.createdAt', 'desc').limit(limit)
 
-    const rows = (await query) as LegacyStreamCommit[]
+    let rows = (await query) as LegacyStreamCommit[]
+
+    const limitsDate = deps.limitsDate
+    if (limitsDate && rows.length > 0) {
+      // the length check above makes the ! ok
+      rows = [rows.shift()!, ...rows.filter((r) => r.createdAt > limitsDate)]
+    }
     return {
       commits: rows,
       cursor: rows.length > 0 ? rows[rows.length - 1].createdAt.toISOString() : null
diff --git a/packages/server/modules/core/repositories/embedTokens.ts b/packages/server/modules/core/repositories/embedTokens.ts
new file mode 100644
index 000000000..e8459cca4
--- /dev/null
+++ b/packages/server/modules/core/repositories/embedTokens.ts
@@ -0,0 +1,92 @@
+import { EmbedApiTokenRecord } from '@/modules/auth/helpers/types'
+import { ApiTokenRecord } from '@/modules/auth/repositories'
+import { ApiTokens, EmbedApiTokens } from '@/modules/core/dbSchema'
+import {
+  CountProjectEmbedTokens,
+  ListProjectEmbedTokens,
+  RevokeEmbedTokenById,
+  RevokeProjectEmbedTokens,
+  StoreEmbedApiToken
+} from '@/modules/core/domain/tokens/operations'
+import { UserInputError } from '@/modules/core/errors/userinput'
+import { Knex } from 'knex'
+import { clamp } from 'lodash'
+
+const tables = {
+  apiTokens: (db: Knex) => db<ApiTokenRecord>(ApiTokens.name),
+  embedApiTokens: (db: Knex) => db<EmbedApiTokenRecord>(EmbedApiTokens.name)
+}
+
+export const storeEmbedApiTokenFactory =
+  (deps: { db: Knex }): StoreEmbedApiToken =>
+  async (token) => {
+    const [newToken] = await tables.embedApiTokens(deps.db).insert(token).returning('*')
+    return newToken
+  }
+
+export const countProjectEmbedTokensFactory =
+  (deps: { db: Knex }): CountProjectEmbedTokens =>
+  async ({ projectId }) => {
+    const [{ count }] = await tables
+      .embedApiTokens(deps.db)
+      .where(EmbedApiTokens.col.projectId, projectId)
+      .count()
+    return Number.parseInt(count as string)
+  }
+
+export const listProjectEmbedTokensFactory =
+  (deps: { db: Knex }): ListProjectEmbedTokens =>
+  async ({ projectId, filter = {} }) => {
+    const { limit = 10, createdBefore } = filter
+
+    if (limit === 0) return []
+
+    const q = tables
+      .embedApiTokens(deps.db)
+      .select<
+        (EmbedApiTokenRecord &
+          Pick<ApiTokenRecord, 'createdAt' | 'lastUsed' | 'lifespan'>)[]
+      >(
+        ...EmbedApiTokens.cols,
+        ApiTokens.col.createdAt,
+        ApiTokens.col.lastUsed,
+        ApiTokens.col.lifespan
+      )
+      .orderBy(ApiTokens.col.createdAt, 'desc')
+      .leftJoin(ApiTokens.name, ApiTokens.col.id, EmbedApiTokens.col.tokenId)
+      .where(EmbedApiTokens.col.projectId, projectId)
+      .limit(clamp(limit, 0, 50))
+
+    if (createdBefore) {
+      q.andWhere(ApiTokens.col.createdAt, '<', createdBefore)
+    }
+
+    return await q
+  }
+
+export const revokeEmbedTokenByIdFactory =
+  (deps: { db: Knex }): RevokeEmbedTokenById =>
+  async ({ tokenId: token, projectId }) => {
+    const tokenId = token.slice(0, 10)
+    const delCount = await tables
+      .embedApiTokens(deps.db)
+      .where({ tokenId, projectId })
+      .delete()
+    if (delCount === 0) throw new UserInputError('Embed token not found')
+    await tables.apiTokens(deps.db).where(ApiTokens.col.id, tokenId).delete()
+    return true
+  }
+
+export const revokeProjectEmbedTokensFactory =
+  (deps: { db: Knex }): RevokeProjectEmbedTokens =>
+  async ({ projectId }) => {
+    await tables
+      .apiTokens(deps.db)
+      .whereIn(ApiTokens.col.id, (builder) => {
+        return builder
+          .select('tokenId')
+          .from<EmbedApiTokenRecord>(EmbedApiTokens.name)
+          .where('projectId', projectId)
+      })
+      .delete()
+  }
diff --git a/packages/server/modules/core/repositories/projects.ts b/packages/server/modules/core/repositories/projects.ts
index 806895ef1..11638414d 100644
--- a/packages/server/modules/core/repositories/projects.ts
+++ b/packages/server/modules/core/repositories/projects.ts
@@ -2,6 +2,7 @@ import { StreamAcl, Streams } from '@/modules/core/dbSchema'
 import {
   DeleteProject,
   GetProject,
+  GetUserProjectRoles,
   StoreProject,
   StoreProjectRole,
   StoreProjectRoles
@@ -51,3 +52,17 @@ export const storeProjectRolesFactory =
       }))
     )
   }
+
+export const getUserProjectRolesFactory =
+  ({ db }: { db: Knex }): GetUserProjectRoles =>
+  async ({ userId, workspaceId }) => {
+    const query = db<StreamAclRecord>(StreamAcl.name).where({ userId })
+
+    if (workspaceId) {
+      query
+        .join(Streams.name, Streams.col.id, StreamAcl.col.resourceId)
+        .where({ workspaceId })
+    }
+
+    return await query
+  }
diff --git a/packages/server/modules/core/repositories/streams.ts b/packages/server/modules/core/repositories/streams.ts
index 25b9b8791..ec9a12f95 100644
--- a/packages/server/modules/core/repositories/streams.ts
+++ b/packages/server/modules/core/repositories/streams.ts
@@ -63,7 +63,6 @@ import { removePrivateFields } from '@/modules/core/helpers/userHelper'
 import {
   DeleteProjectRole,
   UpdateProject,
-  GetRolesByUserId,
   UpsertProjectRole
 } from '@/modules/core/domain/projects/operations'
 import {
@@ -455,7 +454,7 @@ export const getStreamRolesFactory =
   async (userId: string, streamIds: string[]) => {
     const q = tables
       .streams(deps.db)
-      .select<{ id: string; role: Nullable<string> }[]>([
+      .select<{ id: string; role: Nullable<StreamRoles> }[]>([
         Streams.col.id,
         StreamAcl.col.role
       ])
@@ -1330,20 +1329,6 @@ export const getOnboardingBaseStreamFactory =
     return await q
   }
 
-export const getRolesByUserIdFactory =
-  ({ db }: { db: Knex }): GetRolesByUserId =>
-  async ({ userId, workspaceId }) => {
-    const query = db<Pick<StreamAclRecord, 'role' | 'resourceId' | 'userId'>>(
-      StreamAcl.name
-    ).where({ userId })
-    if (workspaceId) {
-      query
-        .join(Streams.name, Streams.col.id, StreamAcl.col.resourceId)
-        .where({ workspaceId })
-    }
-    return await query
-  }
-
 /**
  * @deprecated Use getStreams() from the repository directly
  */
diff --git a/packages/server/modules/core/repositories/tokens.ts b/packages/server/modules/core/repositories/tokens.ts
index a1f53581c..a643d9d9c 100644
--- a/packages/server/modules/core/repositories/tokens.ts
+++ b/packages/server/modules/core/repositories/tokens.ts
@@ -1,4 +1,5 @@
 import {
+  EmbedApiTokenRecord,
   PersonalApiTokenRecord,
   TokenScopeRecord,
   UserServerAppTokenRecord
@@ -6,6 +7,7 @@ import {
 import { ApiTokenRecord } from '@/modules/auth/repositories'
 import {
   ApiTokens,
+  EmbedApiTokens,
   PersonalApiTokens,
   TokenResourceAccess,
   TokenScopes,
@@ -38,7 +40,8 @@ const tables = {
     db<TokenResourceAccessRecord>(TokenResourceAccess.name),
   userServerAppTokens: (db: Knex) =>
     db<UserServerAppTokenRecord>(UserServerAppTokens.name),
-  personalApiTokens: (db: Knex) => db<PersonalApiTokenRecord>(PersonalApiTokens.name)
+  personalApiTokens: (db: Knex) => db<PersonalApiTokenRecord>(PersonalApiTokens.name),
+  embedApiTokens: (db: Knex) => db<EmbedApiTokenRecord>(EmbedApiTokens.name)
 }
 
 export const storeApiTokenFactory =
diff --git a/packages/server/modules/core/services/projects.ts b/packages/server/modules/core/services/projects.ts
index 705d10039..452901838 100644
--- a/packages/server/modules/core/services/projects.ts
+++ b/packages/server/modules/core/services/projects.ts
@@ -4,13 +4,17 @@ import {
   CreateProject,
   DeleteProject,
   GetProject,
+  QueryAllProjects,
   StoreModel,
   StoreProject,
   StoreProjectRole,
   WaitForRegionProject
 } from '@/modules/core/domain/projects/operations'
-import { Project } from '@/modules/core/domain/streams/types'
-import { RegionalProjectCreationError } from '@/modules/core/errors/projects'
+import { Project, StreamWithOptionalRole } from '@/modules/core/domain/streams/types'
+import {
+  ProjectQueryError,
+  RegionalProjectCreationError
+} from '@/modules/core/errors/projects'
 import { StreamNotFoundError } from '@/modules/core/errors/stream'
 import { ProjectVisibility } from '@/modules/core/graph/generated/graphql'
 import { mapGqlToDbProjectVisibility } from '@/modules/core/helpers/project'
@@ -19,6 +23,7 @@ import { EventBusEmit } from '@/modules/shared/services/eventBus'
 import { retry } from '@lifeomic/attempt'
 import { Roles, TIME_MS } from '@speckle/shared'
 import cryptoRandomString from 'crypto-random-string'
+import { LegacyGetStreams } from '@/modules/core/domain/streams/operations'
 
 export const createNewProjectFactory =
   ({
@@ -68,6 +73,7 @@ export const createNewProjectFactory =
       projectId,
       authorId: ownerId
     })
+
     await emitEvent({
       eventName: ProjectEvents.Created,
       payload: {
@@ -80,6 +86,17 @@ export const createNewProjectFactory =
         }
       }
     })
+
+    await emitEvent({
+      eventName: ProjectEvents.PermissionsAdded,
+      payload: {
+        project,
+        activityUserId: ownerId,
+        targetUserId: ownerId,
+        role: Roles.Stream.Owner,
+        previousRole: null
+      }
+    })
     return project
   }
 
@@ -109,3 +126,38 @@ export const waitForRegionProjectFactory =
       throw err
     }
   }
+
+export const queryAllProjectsFactory = ({
+  getStreams
+}: {
+  getStreams: LegacyGetStreams
+}): QueryAllProjects =>
+  async function* queryAllWorkspaceProjects({
+    userId,
+    workspaceId
+  }): AsyncGenerator<StreamWithOptionalRole[], void, unknown> {
+    let cursor: Date | null = null
+    let iterationCount = 0
+
+    if (!userId && !workspaceId) throw new ProjectQueryError()
+
+    do {
+      if (iterationCount > 500) throw new ProjectQueryError()
+
+      const { streams, cursorDate } = await getStreams({
+        cursor,
+        orderBy: null,
+        limit: 100,
+        visibility: null,
+        searchQuery: null,
+        streamIdWhitelist: null,
+        workspaceIdWhitelist: workspaceId ? [workspaceId] : null,
+        userId
+      })
+
+      yield streams
+
+      cursor = cursorDate
+      iterationCount++
+    } while (!!cursor)
+  }
diff --git a/packages/server/modules/core/services/streams/access.ts b/packages/server/modules/core/services/streams/access.ts
index 4016115f3..3ba243df6 100644
--- a/packages/server/modules/core/services/streams/access.ts
+++ b/packages/server/modules/core/services/streams/access.ts
@@ -2,6 +2,7 @@ import { ProjectEvents } from '@/modules/core/domain/projects/events'
 import {
   AddOrUpdateStreamCollaborator,
   GetStream,
+  GetStreamRoles,
   GrantStreamPermissions,
   IsStreamCollaborator,
   RemoveStreamCollaborator,
@@ -92,6 +93,7 @@ export const removeStreamCollaboratorFactory =
     validateStreamAccess: ValidateStreamAccess
     isStreamCollaborator: IsStreamCollaborator
     revokeStreamPermissions: RevokeStreamPermissions
+    getStreamRoles: GetStreamRoles
     emitEvent: EventBusEmit
   }): RemoveStreamCollaborator =>
   async (streamId, userId, removedById, removerResourceAccessRules, options) => {
@@ -113,19 +115,23 @@ export const removeStreamCollaboratorFactory =
       }
     }
 
+    const { [streamId]: role } = await deps.getStreamRoles(userId, [streamId])
     const stream = await deps.revokeStreamPermissions({ streamId, userId }, options)
     if (!stream) {
       throw new LogicError('Stream not found')
     }
 
-    await deps.emitEvent({
-      eventName: ProjectEvents.PermissionsRevoked,
-      payload: {
-        project: stream,
-        activityUserId: removedById,
-        removedUserId: userId
-      }
-    })
+    if (role) {
+      await deps.emitEvent({
+        eventName: ProjectEvents.PermissionsRevoked,
+        payload: {
+          project: stream,
+          activityUserId: removedById,
+          removedUserId: userId,
+          role
+        }
+      })
+    }
 
     return stream
   }
@@ -145,6 +151,7 @@ export const addOrUpdateStreamCollaboratorFactory =
     validateStreamAccess: ValidateStreamAccess
     getUser: GetUser
     grantStreamPermissions: GrantStreamPermissions
+    getStreamRoles: GetStreamRoles
     emitEvent: EventBusEmit
   }): AddOrUpdateStreamCollaborator =>
   async (
@@ -194,6 +201,7 @@ export const addOrUpdateStreamCollaboratorFactory =
       }
     })
 
+    const { [streamId]: previousRole } = await deps.getStreamRoles(userId, [streamId])
     const stream = (await deps.grantStreamPermissions(
       {
         streamId,
@@ -203,17 +211,16 @@ export const addOrUpdateStreamCollaboratorFactory =
       { trackProjectUpdate }
     )) as StreamRecord // validateStreamAccess already checked that it exists
 
-    if (!fromInvite) {
-      await deps.emitEvent({
-        eventName: ProjectEvents.PermissionsAdded,
-        payload: {
-          project: stream,
-          activityUserId: addedById,
-          targetUserId: userId,
-          role: role as StreamRoles
-        }
-      })
-    }
+    await deps.emitEvent({
+      eventName: ProjectEvents.PermissionsAdded,
+      payload: {
+        project: stream,
+        activityUserId: addedById,
+        targetUserId: userId,
+        role: role as StreamRoles,
+        previousRole: previousRole || null
+      }
+    })
 
     return stream
   }
diff --git a/packages/server/modules/core/services/streams/management.ts b/packages/server/modules/core/services/streams/management.ts
index 7976fdd74..934cf1ea5 100644
--- a/packages/server/modules/core/services/streams/management.ts
+++ b/packages/server/modules/core/services/streams/management.ts
@@ -92,6 +92,17 @@ export const createStreamReturnRecordFactory =
       }
     })
 
+    await deps.emitEvent({
+      eventName: ProjectEvents.PermissionsAdded,
+      payload: {
+        project: stream,
+        activityUserId: ownerId,
+        targetUserId: ownerId,
+        role: Roles.Stream.Owner,
+        previousRole: null
+      }
+    })
+
     return stream
   }
 
diff --git a/packages/server/modules/core/services/tokens.ts b/packages/server/modules/core/services/tokens.ts
index a883c66ff..770b2705e 100644
--- a/packages/server/modules/core/services/tokens.ts
+++ b/packages/server/modules/core/services/tokens.ts
@@ -4,16 +4,21 @@ import {
   TokenResourceAccessRecord,
   TokenValidationResult
 } from '@/modules/core/helpers/types'
-import { Optional, ServerScope } from '@speckle/shared'
+import { Optional, Scopes, ServerScope } from '@speckle/shared'
 import {
+  CountProjectEmbedTokens,
   CreateAndStoreAppToken,
+  CreateAndStoreEmbedToken,
   CreateAndStorePersonalAccessToken,
   CreateAndStoreUserToken,
   GetApiTokenById,
+  GetPaginatedProjectEmbedTokens,
   GetTokenResourceAccessDefinitionsById,
   GetTokenScopesById,
+  ListProjectEmbedTokens,
   RevokeUserTokenById,
   StoreApiToken,
+  StoreEmbedApiToken,
   StorePersonalApiToken,
   StoreTokenResourceAccessDefinitions,
   StoreTokenScopes,
@@ -24,6 +29,19 @@ import {
 import { GetTokenAppInfo } from '@/modules/auth/domain/operations'
 import { GetUserRole } from '@/modules/core/domain/users/operations'
 import { TokenCreateError } from '@/modules/core/errors/user'
+import cryptoRandomString from 'crypto-random-string'
+import {
+  EmbedApiToken,
+  TokenResourceIdentifierType
+} from '@/modules/core/domain/tokens/types'
+import {
+  createGetParamFromResources,
+  parseUrlParameters
+} from '@speckle/shared/viewer/route'
+import {
+  decodeIsoDateCursor,
+  encodeIsoDateCursor
+} from '@/modules/shared/helpers/dbHelper'
 
 /*
   Tokens
@@ -124,6 +142,69 @@ export const createPersonalAccessTokenFactory =
     return token
   }
 
+export const createEmbedTokenFactory =
+  (deps: {
+    createToken: CreateAndStoreUserToken
+    storeEmbedToken: StoreEmbedApiToken
+  }): CreateAndStoreEmbedToken =>
+  async ({ projectId, userId, resourceIdString, lifespan }) => {
+    const validatedResourceIdString = createGetParamFromResources(
+      parseUrlParameters(resourceIdString)
+    )
+
+    const { id, token } = await deps.createToken({
+      userId,
+      name: cryptoRandomString({ length: 10 }),
+      scopes: [Scopes.Streams.Read],
+      limitResources: [
+        {
+          id: projectId,
+          type: TokenResourceIdentifierType.Project
+        }
+      ],
+      lifespan
+    })
+
+    const tokenMetadata: EmbedApiToken = {
+      projectId,
+      tokenId: id,
+      userId,
+      resourceIdString: validatedResourceIdString
+    }
+
+    await deps.storeEmbedToken(tokenMetadata)
+
+    return { token, tokenMetadata }
+  }
+
+export const getPaginatedProjectEmbedTokensFactory =
+  (deps: {
+    listEmbedTokens: ListProjectEmbedTokens
+    countEmbedTokens: CountProjectEmbedTokens
+  }): GetPaginatedProjectEmbedTokens =>
+  async ({ projectId, filter = {} }) => {
+    const cursor = filter.cursor ? decodeIsoDateCursor(filter.cursor) : null
+
+    const [items, totalCount] = await Promise.all([
+      deps.listEmbedTokens({
+        projectId,
+        filter: {
+          createdBefore: cursor,
+          limit: filter.limit
+        }
+      }),
+      deps.countEmbedTokens({ projectId })
+    ])
+
+    const lastItem = items.at(-1)
+
+    return {
+      items,
+      totalCount,
+      cursor: lastItem ? encodeIsoDateCursor(lastItem.createdAt) : null
+    }
+  }
+
 export const validateTokenFactory =
   (deps: {
     revokeUserTokenById: RevokeUserTokenById
diff --git a/packages/server/modules/core/services/users/management.ts b/packages/server/modules/core/services/users/management.ts
index cec384848..e086a0805 100644
--- a/packages/server/modules/core/services/users/management.ts
+++ b/packages/server/modules/core/services/users/management.ts
@@ -54,6 +54,11 @@ import { GetServerInfo } from '@/modules/core/domain/server/operations'
 import { EventBusEmit } from '@/modules/shared/services/eventBus'
 import { UserEvents } from '@/modules/core/domain/users/events'
 import { getFeatureFlags } from '@/modules/shared/helpers/envHelper'
+import { GetUserWorkspaceSeatsFactory } from '@/modules/workspacesCore/domain/operations'
+import { WorkspaceEvents } from '@/modules/workspacesCore/domain/events'
+import { ProjectEvents } from '@/modules/core/domain/projects/events'
+import { QueryAllProjects } from '@/modules/core/domain/projects/operations'
+import { StreamWithOptionalRole } from '@/modules/core/repositories/streams'
 
 const { FF_NO_PERSONAL_EMAILS_ENABLED } = getFeatureFlags()
 
@@ -80,6 +85,11 @@ export const updateUserAndNotifyFactory =
       const key = entry[0] as keyof typeof update
       let val = entry[1]
 
+      if (key === 'avatar' && val === '') {
+        filteredUpdate[key] = null // avatar removal
+        continue
+      }
+
       if (key === 'avatar') {
         val = sanitizeImageUrl(val)
       }
@@ -288,7 +298,9 @@ export const deleteUserFactory =
     isLastAdminUser: IsLastAdminUser
     getUserDeletableStreams: GetUserDeletableStreams
     deleteAllUserInvites: DeleteAllUserInvites
+    getUserWorkspaceSeats: GetUserWorkspaceSeatsFactory
     deleteUserRecord: DeleteUserRecord
+    queryAllProjects: QueryAllProjects
     emitEvent: EventBusEmit
   }): DeleteUser =>
   async (id, invokerId) => {
@@ -307,6 +319,39 @@ export const deleteUserFactory =
     // THIS REALLY SHOULD BE A REACTION TO THE USER DELETED EVENT EMITTED HER
     await deps.deleteAllUserInvites(id)
 
+    const workspaceSeats = await deps.getUserWorkspaceSeats({ userId: id })
+    for (const seat of workspaceSeats) {
+      await deps.emitEvent({
+        eventName: WorkspaceEvents.SeatDeleted,
+        payload: {
+          updatedByUserId: id,
+          previousSeat: seat
+        }
+      })
+    }
+
+    const emitRevokeEventIfUserHasRole = async (project: StreamWithOptionalRole) => {
+      if (!project.role) return
+
+      await deps.emitEvent({
+        eventName: ProjectEvents.PermissionsRevoked,
+        payload: {
+          activityUserId: id,
+          removedUserId: id,
+          role: project.role,
+          project
+        }
+      })
+    }
+
+    for await (const projectsPage of deps.queryAllProjects({
+      userId: id
+    })) {
+      for (const project of projectsPage) {
+        await emitRevokeEventIfUserHasRole(project)
+      }
+    }
+
     const deleted = await deps.deleteUserRecord(id)
     if (deleted) {
       await deps.emitEvent({
diff --git a/packages/server/modules/core/tests/batchCommits.spec.ts b/packages/server/modules/core/tests/batchCommits.spec.ts
index 5c64b2ed4..1f70735b0 100644
--- a/packages/server/modules/core/tests/batchCommits.spec.ts
+++ b/packages/server/modules/core/tests/batchCommits.spec.ts
@@ -4,7 +4,10 @@ import { Commits, Streams, Users } from '@/modules/core/dbSchema'
 import { Roles } from '@/modules/core/helpers/mainConstants'
 import { createBranchFactory } from '@/modules/core/repositories/branches'
 import { getCommitsFactory } from '@/modules/core/repositories/commits'
-import { grantStreamPermissionsFactory } from '@/modules/core/repositories/streams'
+import {
+  getStreamRolesFactory,
+  grantStreamPermissionsFactory
+} from '@/modules/core/repositories/streams'
 import { getUserFactory } from '@/modules/core/repositories/users'
 import {
   addOrUpdateStreamCollaboratorFactory,
@@ -39,6 +42,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
diff --git a/packages/server/modules/core/tests/branches.spec.ts b/packages/server/modules/core/tests/branches.spec.ts
index f8d130081..d01a9f756 100644
--- a/packages/server/modules/core/tests/branches.spec.ts
+++ b/packages/server/modules/core/tests/branches.spec.ts
@@ -28,7 +28,8 @@ import {
   createStreamFactory,
   markBranchStreamUpdatedFactory,
   markCommitStreamUpdatedFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import {
   createCommitByBranchIdFactory,
@@ -152,6 +153,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/core/tests/commits.spec.ts b/packages/server/modules/core/tests/commits.spec.ts
index 6b43f358b..0a49084c9 100644
--- a/packages/server/modules/core/tests/commits.spec.ts
+++ b/packages/server/modules/core/tests/commits.spec.ts
@@ -38,7 +38,8 @@ import {
   getCommitStreamFactory,
   createStreamFactory,
   markCommitStreamUpdatedFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import {
   getObjectFactory,
@@ -166,6 +167,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/core/tests/commitsGraphql.spec.ts b/packages/server/modules/core/tests/commitsGraphql.spec.ts
index e3b104e86..28f3f0cdc 100644
--- a/packages/server/modules/core/tests/commitsGraphql.spec.ts
+++ b/packages/server/modules/core/tests/commitsGraphql.spec.ts
@@ -2,7 +2,10 @@ import { buildApolloServer } from '@/app'
 import { db } from '@/db/knex'
 import { Commits, Streams, Users } from '@/modules/core/dbSchema'
 import { Roles } from '@/modules/core/helpers/mainConstants'
-import { grantStreamPermissionsFactory } from '@/modules/core/repositories/streams'
+import {
+  getStreamRolesFactory,
+  grantStreamPermissionsFactory
+} from '@/modules/core/repositories/streams'
 import { getUserFactory } from '@/modules/core/repositories/users'
 import {
   addOrUpdateStreamCollaboratorFactory,
@@ -25,6 +28,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
diff --git a/packages/server/modules/core/tests/embedTokens.spec.ts b/packages/server/modules/core/tests/embedTokens.spec.ts
new file mode 100644
index 000000000..b805729da
--- /dev/null
+++ b/packages/server/modules/core/tests/embedTokens.spec.ts
@@ -0,0 +1,120 @@
+import { TokenResourceIdentifierType } from '@/modules/core/domain/tokens/types'
+import { AllScopes } from '@/modules/core/helpers/mainConstants'
+import {
+  createRandomEmail,
+  createRandomPassword
+} from '@/modules/core/helpers/testHelpers'
+import {
+  BasicTestWorkspace,
+  createTestWorkspace
+} from '@/modules/workspaces/tests/helpers/creation'
+import { BasicTestUser, createTestUser } from '@/test/authHelper'
+import {
+  CreateEmbedTokenDocument,
+  GetActiveUserDocument,
+  GetProjectDocument,
+  GetWorkspaceDocument
+} from '@/test/graphql/generated/graphql'
+import {
+  createTestContext,
+  testApolloServer,
+  TestApolloServer
+} from '@/test/graphqlHelper'
+import { BasicTestStream, createTestStream } from '@/test/speckle-helpers/streamHelper'
+import { Roles, Scopes } from '@speckle/shared'
+import { expect } from 'chai'
+
+describe('Embed tokens', () => {
+  const adminUser: BasicTestUser = {
+    id: '',
+    name: 'John Speckle',
+    email: createRandomEmail(),
+    password: createRandomPassword()
+  }
+
+  const workspace: BasicTestWorkspace = {
+    id: '',
+    ownerId: '',
+    name: 'My Workspace',
+    slug: ''
+  }
+
+  const projectA: BasicTestStream = {
+    id: '',
+    ownerId: '',
+    name: 'My Project'
+  }
+  const projectB: BasicTestStream = {
+    id: '',
+    ownerId: '',
+    name: 'My Project 2'
+  }
+
+  let apollo: TestApolloServer
+
+  before(async () => {
+    await createTestUser(adminUser)
+
+    await createTestWorkspace(workspace, adminUser)
+
+    projectA.workspaceId = workspace.id
+    projectB.workspaceId = workspace.id
+
+    await createTestStream(projectA, adminUser)
+    await createTestStream(projectB, adminUser)
+
+    const adminApollo = await testApolloServer({
+      context: await createTestContext({
+        auth: true,
+        userId: adminUser.id,
+        role: Roles.Server.Admin,
+        scopes: AllScopes,
+        token: 'abc'
+      })
+    })
+
+    const res = await adminApollo.execute(CreateEmbedTokenDocument, {
+      token: {
+        projectId: projectA.id,
+        resourceIdString: 'foo123'
+      }
+    })
+    const token = res.data!.projectMutations.createEmbedToken.token
+
+    apollo = await testApolloServer({
+      context: await createTestContext({
+        auth: true,
+        userId: adminUser.id,
+        role: Roles.Server.Admin,
+        scopes: [Scopes.Streams.Read],
+        resourceAccessRules: [
+          { id: projectA.id, type: TokenResourceIdentifierType.Project }
+        ],
+        token
+      })
+    })
+  })
+
+  it('can read associated project data', async () => {
+    const res = await apollo.execute(GetProjectDocument, { id: projectA.id })
+    expect(res).to.not.haveGraphQLErrors()
+    expect(res.data?.project.name).to.equal(projectA.name)
+  })
+
+  it('cannot read other project data, even if the source user has access', async () => {
+    const res = await apollo.execute(GetProjectDocument, { id: projectB.id })
+    expect(res).to.haveGraphQLErrors()
+  })
+
+  it('cannot access source user profile', async () => {
+    const res = await apollo.execute(GetActiveUserDocument, {})
+    expect(res).to.haveGraphQLErrors()
+  })
+
+  it('cannot access workspace data', async () => {
+    const res = await apollo.execute(GetWorkspaceDocument, {
+      workspaceId: workspace.id
+    })
+    expect(res).to.haveGraphQLErrors()
+  })
+})
diff --git a/packages/server/modules/core/tests/favoriteStreams.spec.ts b/packages/server/modules/core/tests/favoriteStreams.spec.ts
index f3e282692..d3597b69b 100644
--- a/packages/server/modules/core/tests/favoriteStreams.spec.ts
+++ b/packages/server/modules/core/tests/favoriteStreams.spec.ts
@@ -15,7 +15,8 @@ import {
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
 import {
@@ -86,6 +87,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/core/tests/generic.spec.ts b/packages/server/modules/core/tests/generic.spec.ts
index 02fba6e32..4f9574bbc 100644
--- a/packages/server/modules/core/tests/generic.spec.ts
+++ b/packages/server/modules/core/tests/generic.spec.ts
@@ -11,7 +11,8 @@ import { ForbiddenError } from '@/modules/shared/errors'
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
 import {
@@ -78,6 +79,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/core/tests/graph.spec.ts b/packages/server/modules/core/tests/graph.spec.ts
index 70d6719da..7481e8b5c 100644
--- a/packages/server/modules/core/tests/graph.spec.ts
+++ b/packages/server/modules/core/tests/graph.spec.ts
@@ -18,7 +18,8 @@ import { authorizeResolver } from '@/modules/shared'
 import {
   getStreamFactory,
   revokeStreamPermissionsFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import {
   getUserFactory,
@@ -76,6 +77,7 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -83,6 +85,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 const getUsers = legacyGetPaginatedUsersFactory({ db })
diff --git a/packages/server/modules/core/tests/integration/projectRepositories.spec.ts b/packages/server/modules/core/tests/integration/projectRepositories.spec.ts
index 4c2467ec0..6eb541f22 100644
--- a/packages/server/modules/core/tests/integration/projectRepositories.spec.ts
+++ b/packages/server/modules/core/tests/integration/projectRepositories.spec.ts
@@ -7,7 +7,7 @@ import {
   storeProjectFactory,
   storeProjectRoleFactory
 } from '@/modules/core/repositories/projects'
-import { getRolesByUserIdFactory } from '@/modules/core/repositories/streams'
+import { getUserProjectRolesFactory } from '@/modules/core/repositories/projects'
 import { expectToThrow } from '@/test/assertionHelper'
 import { createTestUser } from '@/test/authHelper'
 import { Roles } from '@speckle/shared'
@@ -105,7 +105,9 @@ describe('project repositories @core', () => {
         userId: testUser.id
       }
       await storeProjectRole(role)
-      const storedRoles = await getRolesByUserIdFactory({ db })({ userId: testUser.id })
+      const storedRoles = await getUserProjectRolesFactory({ db })({
+        userId: testUser.id
+      })
       expect(storedRoles).deep.equalInAnyOrder([
         { resourceId: project.id, role: role.role, userId: role.userId }
       ])
diff --git a/packages/server/modules/core/tests/integration/subs.graph.spec.ts b/packages/server/modules/core/tests/integration/subs.graph.spec.ts
index f9cac82c8..ab76a035c 100644
--- a/packages/server/modules/core/tests/integration/subs.graph.spec.ts
+++ b/packages/server/modules/core/tests/integration/subs.graph.spec.ts
@@ -20,6 +20,7 @@ import {
   deleteStreamFactory,
   getCommitStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   getStreamsFactory,
   grantStreamPermissionsFactory,
   markBranchStreamUpdatedFactory,
@@ -188,6 +189,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser: getUserFactory({ db }),
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -195,6 +197,7 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -216,125 +219,123 @@ describe('Core GraphQL Subscriptions (New)', () => {
     subServer.quit()
   })
 
-  const modes = [
-    { isMultiRegion: false },
-    ...(isMultiRegionTestMode() ? [{ isMultiRegion: true }] : [])
-  ]
+  const isMultiRegion = isMultiRegionTestMode()
 
-  modes.forEach(({ isMultiRegion }) => {
-    describe(`W/${!isMultiRegion ? 'o' : ''} @multiregion`, () => {
-      const myMainWorkspace: BasicTestWorkspace = {
-        id: '',
-        ownerId: '',
-        slug: '',
-        name: 'My Main Workspace'
-      }
-      const otherGuysWorkspace: BasicTestWorkspace = {
-        id: '',
-        ownerId: '',
-        slug: '',
-        name: 'Other Guys Workspace'
-      }
+  describe(`W/${!isMultiRegion ? 'o' : ''} @multiregion`, () => {
+    const myMainWorkspace: BasicTestWorkspace = {
+      id: '',
+      ownerId: '',
+      slug: '',
+      name: 'My Main Workspace'
+    }
+    const otherGuysWorkspace: BasicTestWorkspace = {
+      id: '',
+      ownerId: '',
+      slug: '',
+      name: 'Other Guys Workspace'
+    }
 
-      before(async () => {
-        await Promise.all([
-          createTestWorkspace(myMainWorkspace, me, {
-            regionKey: isMultiRegion ? getMainTestRegionKey() : undefined,
-            addPlan: WorkspacePlans.Pro
-          }),
-          createTestWorkspace(otherGuysWorkspace, otherGuy, {
-            regionKey: isMultiRegion ? getMainTestRegionKey() : undefined,
-            addPlan: WorkspacePlans.Pro
-          })
-        ])
+    before(async () => {
+      await Promise.all([
+        createTestWorkspace(myMainWorkspace, me, {
+          regionKey: isMultiRegion ? getMainTestRegionKey() : undefined,
+          addPlan: WorkspacePlans.Pro
+        }),
+        createTestWorkspace(otherGuysWorkspace, otherGuy, {
+          regionKey: isMultiRegion ? getMainTestRegionKey() : undefined,
+          addPlan: WorkspacePlans.Pro
+        })
+      ])
 
-        await waitForRegionUsers([me, otherGuy])
-      })
+      await waitForRegionUsers([me, otherGuy])
+    })
 
-      describe('Project Subs', () => {
-        describe('scope tests', () => {
-          const randomProject: BasicTestStream = {
-            name: 'Scope test project',
-            id: '',
-            ownerId: '',
-            isPublic: true
+    describe('Project Subs', () => {
+      describe('scope tests', () => {
+        const randomProject: BasicTestStream = {
+          name: 'Scope test project',
+          id: '',
+          ownerId: '',
+          isPublic: true
+        }
+        let testClient: Optional<TestApolloSubscriptionClient> = undefined
+
+        before(async () => {
+          randomProject.workspaceId = myMainWorkspace.id
+          await createTestStreams([[randomProject, me]])
+        })
+
+        afterEach(async () => {
+          testClient?.quit()
+        })
+
+        type ScopeTest = {
+          title: string
+          withoutScope: ServerScope
+          expectedMessages: number
+          sub: () => {
+            query: any
+            variables: any
           }
-          let testClient: Optional<TestApolloSubscriptionClient> = undefined
+          triggerMessage: () => Promise<void>
+        }
 
-          before(async () => {
-            randomProject.workspaceId = myMainWorkspace.id
-            await createTestStreams([[randomProject, me]])
-          })
+        const triggerProjectUpdate = async () => {
+          const projectId = randomProject.id
+          const updateProject = await buildUpdateProject({ projectId })
+          await updateProject({ id: projectId, name: new Date().toISOString() }, me.id)
+        }
 
-          afterEach(async () => {
-            testClient?.quit()
-          })
-
-          type ScopeTest = {
-            title: string
-            withoutScope: ServerScope
-            sub: () => {
-              query: any
-              variables: any
-            }
-            triggerMessage: () => Promise<void>
-          }
-
-          const triggerProjectUpdate = async () => {
-            const projectId = randomProject.id
-            const updateProject = await buildUpdateProject({ projectId })
-            await updateProject(
-              { id: projectId, name: new Date().toISOString() },
-              me.id
-            )
-          }
-
-          const scopeTests: ScopeTest[] = [
-            {
-              title: 'streamUpdated()',
-              withoutScope: Scopes.Streams.Read,
-              sub: () => ({
-                query: OnStreamUpdatedDocument,
-                variables: { streamId: randomProject.id }
-              }),
-              triggerMessage: triggerProjectUpdate
-            },
-            {
-              title: 'projectUpdated()',
-              withoutScope: Scopes.Streams.Read,
-              sub: () => ({
-                query: OnProjectUpdatedDocument,
-                variables: { projectId: randomProject.id }
-              }),
-              triggerMessage: triggerProjectUpdate
-            },
-            {
-              title: 'userProjectsUpdated()',
-              withoutScope: Scopes.Profile.Read,
-              sub: () => ({
-                query: OnUserProjectsUpdatedDocument,
-                variables: {}
-              }),
-              triggerMessage: async () => {
-                // Create a new project
-                const newProject: BasicTestStream = {
-                  name: 'New Scope Test Project',
-                  id: '',
-                  ownerId: me.id,
-                  isPublic: true,
-                  workspaceId: myMainWorkspace.id
-                }
-
-                await createTestStreams([[newProject, me]])
+        const scopeTests: ScopeTest[] = [
+          {
+            title: 'streamUpdated()',
+            withoutScope: Scopes.Streams.Read,
+            expectedMessages: 1,
+            sub: () => ({
+              query: OnStreamUpdatedDocument,
+              variables: { streamId: randomProject.id }
+            }),
+            triggerMessage: triggerProjectUpdate
+          },
+          {
+            title: 'projectUpdated()',
+            withoutScope: Scopes.Streams.Read,
+            expectedMessages: 1,
+            sub: () => ({
+              query: OnProjectUpdatedDocument,
+              variables: { projectId: randomProject.id }
+            }),
+            triggerMessage: triggerProjectUpdate
+          },
+          {
+            title: 'userProjectsUpdated()',
+            withoutScope: Scopes.Profile.Read,
+            expectedMessages: 2,
+            sub: () => ({
+              query: OnUserProjectsUpdatedDocument,
+              variables: {}
+            }),
+            triggerMessage: async () => {
+              // Create a new project
+              const newProject: BasicTestStream = {
+                name: 'New Scope Test Project',
+                id: '',
+                ownerId: me.id,
+                isPublic: true,
+                workspaceId: myMainWorkspace.id
               }
-            }
-          ]
 
-          scopeTests.forEach(({ title, withoutScope, sub, triggerMessage }) => {
+              await createTestStreams([[newProject, me]])
+            }
+          }
+        ]
+
+        scopeTests.forEach(
+          ({ title, withoutScope, sub, triggerMessage, expectedMessages }) => {
             itEach(
               [{ allow: false }, { allow: true }],
               ({ allow }) =>
-                `should ${allow ? '' : 'not '} allow ${title} sub with${
+                `should${allow ? '' : ' not'} allow ${title} sub with${
                   !allow ? 'out' : ''
                 } ${withoutScope} scope`,
               async ({ allow }) => {
@@ -364,754 +365,760 @@ describe('Core GraphQL Subscriptions (New)', () => {
                 await triggerMessage()
                 await onMessage.waitForMessage()
 
-                expect(onMessage.getMessages()).to.have.length(1)
+                if (isMultiRegion && title === 'userProjectsUpdated()') {
+                  // should have 2 but sometimes the expectancy hits before it gets the second event only in multiregion setups and for this specific case
+                  expect(onMessage.getMessages()).to.have.length.gte(1)
+                  expect(onMessage.getMessages()).to.have.length.lessThan(3)
+                } else {
+                  expect(onMessage.getMessages()).to.have.lengthOf(expectedMessages)
+                }
               }
             )
-          })
-        })
-
-        it('should notify me of a new project (userProjectsUpdated/userStreamAdded)', async () => {
-          const onUserProjectsUpdated = await meSubClient.subscribe(
-            OnUserProjectsUpdatedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userProjectsUpdated.type).to.equal(
-                UserProjectsUpdatedMessageType.Added
-              )
-              expect(res.data?.userProjectsUpdated.project?.name).to.equal(myProj.name)
-            }
-          )
-          const onUserStreamAdded = await meSubClient.subscribe(
-            OnUserStreamAddedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userStreamAdded?.name).to.equal(myProj.name)
-            }
-          )
-          await meSubClient.waitForReadiness()
-
-          const myProj: BasicTestStream = {
-            name: 'My New Test1 Project',
-            id: '',
-            ownerId: me.id,
-            isPublic: true,
-            workspaceId: myMainWorkspace.id
-          }
-          const otherGuysProj: BasicTestStream = {
-            name: 'Other Guys Project',
-            id: '',
-            ownerId: otherGuy.id,
-            isPublic: true,
-            workspaceId: otherGuysWorkspace.id
-          }
-          await createTestStreams([
-            [myProj, me],
-            [otherGuysProj, otherGuy]
-          ])
-          await Promise.all([
-            onUserProjectsUpdated.waitForMessage(),
-            onUserStreamAdded.waitForMessage()
-          ])
-
-          expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
-          expect(onUserStreamAdded.getMessages()).to.have.length(1)
-        })
-
-        it('should notify me of a project ive just been added to (userProjectsUpdated/userStreamAdded)', async () => {
-          const otherGuysProj: BasicTestStream = {
-            name: 'Other Guys Project #1',
-            id: '',
-            ownerId: otherGuy.id,
-            isPublic: true,
-            workspaceId: otherGuysWorkspace.id
-          }
-          await createTestStreams([[otherGuysProj, otherGuy]])
-
-          const onUserProjectsUpdated = await meSubClient.subscribe(
-            OnUserProjectsUpdatedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userProjectsUpdated.type).to.equal(
-                UserProjectsUpdatedMessageType.Added
-              )
-              expect(res.data?.userProjectsUpdated.project?.id).to.equal(
-                otherGuysProj.id
-              )
-            }
-          )
-          const onUserStreamAdded = await meSubClient.subscribe(
-            OnUserStreamAddedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userStreamAdded?.id).to.equal(otherGuysProj.id)
-            }
-          )
-          await meSubClient.waitForReadiness()
-
-          await addOrUpdateStreamCollaborator(
-            otherGuysProj.id,
-            me.id,
-            Roles.Stream.Contributor,
-            otherGuy.id
-          )
-
-          await Promise.all([
-            onUserProjectsUpdated.waitForMessage(),
-            onUserStreamAdded.waitForMessage()
-          ])
-
-          expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
-          expect(onUserStreamAdded.getMessages()).to.have.length(1)
-        })
-
-        it('should notify me of a removed project (userProjectsUpdated/userStreamRemoved)', async () => {
-          const myProj: BasicTestStream = {
-            name: 'My New Test2 Project',
-            id: '',
-            ownerId: me.id,
-            isPublic: true,
-            workspaceId: myMainWorkspace.id
-          }
-          await createTestStreams([[myProj, me]])
-          const deleteProject = await buildDeleteProject({
-            projectId: myProj.id,
-            ownerId: me.id
-          })
-
-          const onUserProjectsUpdated = await meSubClient.subscribe(
-            OnUserProjectsUpdatedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userProjectsUpdated.type).to.equal(
-                UserProjectsUpdatedMessageType.Removed
-              )
-              expect(res.data?.userProjectsUpdated.id).to.equal(myProj.id)
-            }
-          )
-          const onUserStreamRemoved = await meSubClient.subscribe(
-            OnUserStreamRemovedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userStreamRemoved?.id).to.equal(myProj.id)
-            }
-          )
-          await meSubClient.waitForReadiness()
-          await deleteProject()
-
-          await Promise.all([
-            onUserProjectsUpdated.waitForMessage(),
-            onUserStreamRemoved.waitForMessage()
-          ])
-
-          expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
-          expect(onUserStreamRemoved.getMessages()).to.have.length(1)
-        })
-
-        it('should notify me of a project ive just been removed from (userProjectsUpdated/userStreamRemoved)', async () => {
-          const otherGuysProj: BasicTestStream = {
-            name: 'Other Guys Project #2',
-            id: '',
-            ownerId: otherGuy.id,
-            isPublic: true,
-            workspaceId: otherGuysWorkspace.id
-          }
-          await createTestStreams([[otherGuysProj, otherGuy]])
-          await addOrUpdateStreamCollaborator(
-            otherGuysProj.id,
-            me.id,
-            Roles.Stream.Contributor,
-            otherGuy.id
-          )
-
-          const onUserProjectsUpdated = await meSubClient.subscribe(
-            OnUserProjectsUpdatedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userProjectsUpdated.type).to.equal(
-                UserProjectsUpdatedMessageType.Removed
-              )
-              expect(res.data?.userProjectsUpdated.id).to.equal(otherGuysProj.id)
-            }
-          )
-          const onUserStreamRemoved = await meSubClient.subscribe(
-            OnUserStreamRemovedDocument,
-            {},
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.userStreamRemoved?.id).to.equal(otherGuysProj.id)
-            }
-          )
-          await meSubClient.waitForReadiness()
-          await removeStreamCollaborator(otherGuysProj.id, me.id, otherGuy.id, null)
-
-          await Promise.all([
-            onUserProjectsUpdated.waitForMessage(),
-            onUserStreamRemoved.waitForMessage()
-          ])
-
-          expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
-          expect(onUserStreamRemoved.getMessages()).to.have.length(1)
-        })
-
-        it('should notify me of a project update (projectUpdated/streamUpdate)', async () => {
-          const myProj: BasicTestStream = {
-            name: 'My New Test3 Project',
-            id: '',
-            ownerId: me.id,
-            isPublic: true,
-            workspaceId: myMainWorkspace.id
-          }
-          await createTestStreams([[myProj, me]])
-          const updateProject = await buildUpdateProject({ projectId: myProj.id })
-
-          const onUserProjectsUpdated = await meSubClient.subscribe(
-            OnProjectUpdatedDocument,
-            { projectId: myProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.projectUpdated.type).to.equal(
-                ProjectUpdatedMessageType.Updated
-              )
-              expect(res.data?.projectUpdated.project?.id).to.equal(myProj.id)
-            }
-          )
-          const onStreamUpdated = await meSubClient.subscribe(
-            OnStreamUpdatedDocument,
-            { streamId: myProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.streamUpdated?.id).to.equal(myProj.id)
-            }
-          )
-          await meSubClient.waitForReadiness()
-          await updateProject({ id: myProj.id, name: 'Updated Project Name' }, me.id)
-
-          await Promise.all([
-            onUserProjectsUpdated.waitForMessage(),
-            onStreamUpdated.waitForMessage()
-          ])
-
-          expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
-          expect(onStreamUpdated.getMessages()).to.have.length(1)
-        })
-
-        it('should not notify me of a project update for a different project', async () => {
-          const myProj: BasicTestStream = {
-            name: 'My New Test4 Project',
-            id: '',
-            ownerId: me.id,
-            isPublic: true,
-            workspaceId: myMainWorkspace.id
-          }
-          await createTestStreams([[myProj, me]])
-          const updateProject = await buildUpdateProject({ projectId: myProj.id })
-
-          const onUserProjectsUpdated = await meSubClient.subscribe(
-            OnProjectUpdatedDocument,
-            { projectId: 'aaa' },
-            (res) => {
-              throw new TestError('Message received for wrong project', {
-                info: { res }
-              })
-            }
-          )
-          const onStreamUpdated = await meSubClient.subscribe(
-            OnStreamUpdatedDocument,
-            { streamId: 'bbb' },
-            (res) => {
-              throw new TestError('Message received for wrong project', {
-                info: { res }
-              })
-            }
-          )
-          await meSubClient.waitForReadiness()
-          await updateProject({ id: myProj.id, name: 'Updated Project Name' }, me.id)
-
-          await Promise.all([
-            onUserProjectsUpdated.waitForTimeout(),
-            onStreamUpdated.waitForTimeout()
-          ])
-
-          expect(onUserProjectsUpdated.getMessages()).to.have.length(0)
-          expect(onStreamUpdated.getMessages()).to.have.length(0)
-        })
-      })
-
-      describe('Version Subs', () => {
-        const myVersionProj: BasicTestStream = {
-          name: 'My New Version Project #1',
-          id: '',
-          ownerId: '',
-          isPublic: true
-        }
-
-        before(async () => {
-          myVersionProj.workspaceId = myMainWorkspace.id
-          await createTestStreams([[myVersionProj, me]])
-        })
-
-        it(`should notify me of a new version (projectVersionsUpdated/commitCreated)`, async () => {
-          const message = 'ayyyooo'
-          const onUserProjectVersionsUpdated = await meSubClient.subscribe(
-            OnUserProjectVersionsUpdatedDocument,
-            { projectId: myVersionProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.projectVersionsUpdated.type).to.equal(
-                ProjectVersionsUpdatedMessageType.Created
-              )
-              expect(res.data?.projectVersionsUpdated.version?.message).to.equal(
-                message
-              )
-            }
-          )
-          const onUserStreamCommitCreated = await meSubClient.subscribe(
-            OnUserStreamCommitCreatedDocument,
-            { streamId: myVersionProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.commitCreated?.message).to.equal(message)
-            }
-          )
-          await meSubClient.waitForReadiness()
-
-          // Create test commit
-          const commit: BasicTestCommit = {
-            streamId: '',
-            objectId: '',
-            id: '',
-            authorId: '',
-            branchId: '',
-            message
-          }
-
-          await createTestCommits([commit], { owner: me, stream: myVersionProj })
-
-          await Promise.all([
-            onUserProjectVersionsUpdated.waitForMessage(),
-            onUserStreamCommitCreated.waitForMessage()
-          ])
-
-          expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(1)
-          expect(onUserStreamCommitCreated.getMessages()).to.have.length(1)
-        })
-
-        it('should notify me when a version is deleted (projectVersionsUpdated/commitDeleted)', async () => {
-          const commitToDelete: BasicTestCommit = {
-            streamId: '',
-            objectId: '',
-            id: '',
-            authorId: '',
-            branchId: '',
-            message: 'Commit to Delete'
-          }
-          await createTestCommits([commitToDelete], {
-            owner: me,
-            stream: myVersionProj
-          })
-          const deleteVersion = await buildDeleteVersion({
-            projectId: myVersionProj.id
-          })
-
-          const onUserProjectVersionsUpdated = await meSubClient.subscribe(
-            OnUserProjectVersionsUpdatedDocument,
-            { projectId: myVersionProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.projectVersionsUpdated.type).to.equal(
-                ProjectVersionsUpdatedMessageType.Deleted
-              )
-              expect(res.data?.projectVersionsUpdated.id).to.equal(commitToDelete.id)
-            }
-          )
-          const onUserStreamCommitDeleted = await meSubClient.subscribe(
-            OnUserStreamCommitDeletedDocument,
-            { streamId: myVersionProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.commitDeleted?.id).to.equal(commitToDelete.id)
-            }
-          )
-          await meSubClient.waitForReadiness()
-          await deleteVersion(
-            {
-              versionIds: [commitToDelete.id],
-              projectId: myVersionProj.id
-            },
-            me.id
-          )
-
-          await Promise.all([
-            onUserProjectVersionsUpdated.waitForMessage(),
-            onUserStreamCommitDeleted.waitForMessage()
-          ])
-
-          expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(1)
-          expect(onUserStreamCommitDeleted.getMessages()).to.have.length(1)
-        })
-
-        it('should notify me when a version is updated (projectVersionsUpdated/commitUpdated)', async () => {
-          const commitToUpdate: BasicTestCommit = {
-            streamId: '',
-            objectId: '',
-            id: '',
-            authorId: '',
-            branchId: '',
-            message: 'Commit to Update'
-          }
-          await createTestCommits([commitToUpdate], {
-            owner: me,
-            stream: myVersionProj
-          })
-          const updateVersion = await buildUpdateVersion({
-            projectId: myVersionProj.id
-          })
-
-          const onUserProjectVersionsUpdated = await meSubClient.subscribe(
-            OnUserProjectVersionsUpdatedDocument,
-            { projectId: myVersionProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.projectVersionsUpdated.type).to.equal(
-                ProjectVersionsUpdatedMessageType.Updated
-              )
-              expect(res.data?.projectVersionsUpdated.version?.id).to.equal(
-                commitToUpdate.id
-              )
-            }
-          )
-          const onUserStreamCommitCreated = await meSubClient.subscribe(
-            OnUserStreamCommitUpdatedDocument,
-            { streamId: myVersionProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.commitUpdated?.id).to.equal(commitToUpdate.id)
-            }
-          )
-          await meSubClient.waitForReadiness()
-          await updateVersion(
-            {
-              versionId: commitToUpdate.id,
-              message: 'Updated Message',
-              projectId: myVersionProj.id
-            },
-            me.id
-          )
-
-          await Promise.all([
-            onUserProjectVersionsUpdated.waitForMessage(),
-            onUserStreamCommitCreated.waitForMessage()
-          ])
-
-          expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(1)
-          expect(onUserStreamCommitCreated.getMessages()).to.have.length(1)
-        })
-
-        it('should not notify me when version is created for stream im not authorized for', async () => {
-          const otherGuysProj: BasicTestStream = {
-            name: 'Other Guys Project #3',
-            id: '',
-            ownerId: otherGuy.id,
-            isPublic: false,
-            workspaceId: otherGuysWorkspace.id
-          }
-          await createTestStreams([[otherGuysProj, otherGuy]])
-
-          const onUserProjectVersionsUpdated = await meSubClient.subscribe(
-            OnUserProjectVersionsUpdatedDocument,
-            { projectId: otherGuysProj.id },
-            (res) => {
-              throw new TestError('Message received for wrong project', {
-                info: { res }
-              })
-            }
-          )
-          const onUserStreamCommitCreated = await meSubClient.subscribe(
-            OnUserStreamCommitCreatedDocument,
-            { streamId: otherGuysProj.id },
-            (res) => {
-              throw new TestError('Message received for wrong project', {
-                info: { res }
-              })
-            }
-          )
-          await meSubClient.waitForReadiness()
-
-          const commit: BasicTestCommit = {
-            streamId: otherGuysProj.id,
-            objectId: '',
-            id: '',
-            authorId: '',
-            branchId: '',
-            message: 'Random Commit'
-          }
-          await createTestCommits([commit], {
-            owner: otherGuy,
-            stream: otherGuysProj
-          })
-
-          await Promise.all([
-            onUserProjectVersionsUpdated.waitForTimeout(),
-            onUserStreamCommitCreated.waitForTimeout()
-          ])
-
-          expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(0)
-          expect(onUserStreamCommitCreated.getMessages()).to.have.length(0)
-        })
-      })
-
-      describe('Model Subs', () => {
-        const myModelProj: BasicTestStream = {
-          name: 'My New Model Project #1',
-          id: '',
-          ownerId: '',
-          isPublic: true
-        }
-
-        before(async () => {
-          myModelProj.workspaceId = myMainWorkspace.id
-          await createTestStreams([[myModelProj, me]])
-        })
-
-        it(`should notify me of a new model (projectModelsUpdated/branchCreated)`, async () => {
-          const newModel: BasicTestBranch = {
-            name: 'Some New Fangled kind of Model',
-            streamId: '',
-            authorId: '',
-            id: ''
-          }
-
-          const onProjectModelsUpdated = await meSubClient.subscribe(
-            OnProjectModelsUpdatedDocument,
-            { projectId: myModelProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-
-              // name should be lowercaseified
-              expect(res.data?.projectModelsUpdated.model?.name).to.equal(
-                newModel.name.toLowerCase()
-              )
-              expect(res.data?.projectModelsUpdated.type).to.equal(
-                ProjectModelsUpdatedMessageType.Created
-              )
-            }
-          )
-          const onBranchCreated = await meSubClient.subscribe(
-            OnBranchCreatedDocument,
-            { streamId: myModelProj.id },
-            (res) => {
-              expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.branchCreated?.name).to.equal(
-                newModel.name.toLowerCase()
-              )
-            }
-          )
-          await meSubClient.waitForReadiness()
-
-          await createTestBranch({ branch: newModel, stream: myModelProj, owner: me })
-          await Promise.all([
-            onProjectModelsUpdated.waitForMessage(),
-            onBranchCreated.waitForMessage()
-          ])
-
-          expect(onProjectModelsUpdated.getMessages()).to.have.length(1)
-          expect(onBranchCreated.getMessages()).to.have.length(1)
-        })
-
-        itEach(
-          [{ any: false }, { any: true }],
-          ({ any }) =>
-            `should notify me of ${
-              any ? 'any ' : ''
-            }updated model (projectModelsUpdated/branchUpdated)`,
-          async ({ any }) => {
-            // Create 2 models
-            const firstModel: BasicTestBranch = {
-              name: 'First Model ' + faker.number.int(),
-              streamId: '',
-              authorId: '',
-              id: ''
-            }
-            const secondModel: BasicTestBranch = {
-              name: 'Second Model ' + faker.number.int(),
-              streamId: '',
-              authorId: '',
-              id: ''
-            }
-            await createTestBranches([
-              { branch: firstModel, stream: myModelProj, owner: me },
-              { branch: secondModel, stream: myModelProj, owner: me }
-            ])
-            const updateModel = await buildUpdateModel({ projectId: myModelProj.id })
-
-            // Sub
-            const onProjectModelsUpdated = await meSubClient.subscribe(
-              OnProjectModelsUpdatedDocument,
-              {
-                projectId: myModelProj.id,
-                ...(!any ? { modelIds: [firstModel.id] } : {})
-              },
-              (res) => {
-                expect(res).to.not.haveGraphQLErrors()
-
-                const modelId = res.data?.projectModelsUpdated.model?.id
-                expect([firstModel.id, ...(any ? [secondModel.id] : [])]).to.include(
-                  modelId
-                )
-                expect(res.data?.projectModelsUpdated.type).to.equal(
-                  ProjectModelsUpdatedMessageType.Updated
-                )
-              }
-            )
-            const onBranchUpdated = await meSubClient.subscribe(
-              OnBranchUpdatedDocument,
-              {
-                streamId: myModelProj.id,
-                branchId: !any ? firstModel.id : undefined
-              },
-              (res) => {
-                expect(res).to.not.haveGraphQLErrors()
-                const modelId = res.data?.branchUpdated?.id
-                expect([firstModel.id, ...(any ? [secondModel.id] : [])]).to.include(
-                  modelId
-                )
-              }
-            )
-            await meSubClient.waitForReadiness()
-
-            // Update both models
-            await Promise.all([
-              updateModel(
-                {
-                  id: firstModel.id,
-                  name: 'First Model New Name' + faker.number.int(),
-                  projectId: myModelProj.id
-                },
-                me.id
-              ),
-              updateModel(
-                {
-                  id: secondModel.id,
-                  name: 'Second Model New Name' + faker.number.int(),
-                  projectId: myModelProj.id
-                },
-                me.id
-              )
-            ])
-
-            await Promise.all([
-              onProjectModelsUpdated.waitForMessage(),
-              onBranchUpdated.waitForMessage()
-            ])
-
-            expect(onProjectModelsUpdated.getMessages()).to.have.length(any ? 2 : 1)
-            expect(onBranchUpdated.getMessages()).to.have.length(any ? 2 : 1)
           }
         )
+      })
 
-        it('should notify me of model delete (projectModelsUpdated/branchDeleted)', async () => {
-          const modelToDelete: BasicTestBranch = {
-            name: 'Model to Delete',
+      it('should notify me of a new project (userProjectsUpdated/userStreamAdded)', async () => {
+        const onUserProjectsUpdated = await meSubClient.subscribe(
+          OnUserProjectsUpdatedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.userProjectsUpdated.type).to.equal(
+              UserProjectsUpdatedMessageType.Added
+            )
+            expect(res.data?.userProjectsUpdated.project?.name).to.equal(myProj.name)
+          }
+        )
+        const onUserStreamAdded = await meSubClient.subscribe(
+          OnUserStreamAddedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            const event = res.data?.userStreamAdded
+            if (event && 'sharedBy' in event) {
+              expect(res.data?.userStreamAdded?.sharedBy).to.equal(me.id)
+              return
+            }
+
+            expect(res.data?.userStreamAdded?.name).to.equal(myProj.name)
+          }
+        )
+        await meSubClient.waitForReadiness()
+
+        const myProj: BasicTestStream = {
+          name: 'My New Test1 Project',
+          id: '',
+          ownerId: me.id,
+          isPublic: true,
+          workspaceId: myMainWorkspace.id
+        }
+        const otherGuysProj: BasicTestStream = {
+          name: 'Other Guys Project',
+          id: '',
+          ownerId: otherGuy.id,
+          isPublic: true,
+          workspaceId: otherGuysWorkspace.id
+        }
+        await createTestStreams([
+          [myProj, me],
+          [otherGuysProj, otherGuy]
+        ])
+        await Promise.all([
+          onUserProjectsUpdated.waitForMessage(),
+          onUserStreamAdded.waitForMessage()
+        ])
+
+        expect(onUserProjectsUpdated.getMessages()).to.have.lengthOf(2)
+        expect(onUserStreamAdded.getMessages()).to.have.lengthOf(2)
+      })
+
+      it('should notify me of a project ive just been added to (userProjectsUpdated/userStreamAdded)', async () => {
+        const otherGuysProj: BasicTestStream = {
+          name: 'Other Guys Project #1',
+          id: '',
+          ownerId: otherGuy.id,
+          isPublic: true,
+          workspaceId: otherGuysWorkspace.id
+        }
+        await createTestStreams([[otherGuysProj, otherGuy]])
+
+        const onUserProjectsUpdated = await meSubClient.subscribe(
+          OnUserProjectsUpdatedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.userProjectsUpdated.type).to.equal(
+              UserProjectsUpdatedMessageType.Added
+            )
+            expect(res.data?.userProjectsUpdated.project?.id).to.equal(otherGuysProj.id)
+          }
+        )
+        const onUserStreamAdded = await meSubClient.subscribe(
+          OnUserStreamAddedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.userStreamAdded?.id).to.equal(otherGuysProj.id)
+          }
+        )
+        await meSubClient.waitForReadiness()
+
+        await addOrUpdateStreamCollaborator(
+          otherGuysProj.id,
+          me.id,
+          Roles.Stream.Contributor,
+          otherGuy.id
+        )
+
+        await Promise.all([
+          onUserProjectsUpdated.waitForMessage(),
+          onUserStreamAdded.waitForMessage()
+        ])
+
+        expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
+        expect(onUserStreamAdded.getMessages()).to.have.length(1)
+      })
+
+      it('should notify me of a removed project (userProjectsUpdated/userStreamRemoved)', async () => {
+        const myProj: BasicTestStream = {
+          name: 'My New Test2 Project',
+          id: '',
+          ownerId: me.id,
+          isPublic: true,
+          workspaceId: myMainWorkspace.id
+        }
+        await createTestStreams([[myProj, me]])
+        const deleteProject = await buildDeleteProject({
+          projectId: myProj.id,
+          ownerId: me.id
+        })
+
+        const onUserProjectsUpdated = await meSubClient.subscribe(
+          OnUserProjectsUpdatedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.userProjectsUpdated.type).to.equal(
+              UserProjectsUpdatedMessageType.Removed
+            )
+            expect(res.data?.userProjectsUpdated.id).to.equal(myProj.id)
+          }
+        )
+        const onUserStreamRemoved = await meSubClient.subscribe(
+          OnUserStreamRemovedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.userStreamRemoved?.id).to.equal(myProj.id)
+          }
+        )
+        await meSubClient.waitForReadiness()
+        await deleteProject()
+
+        await Promise.all([
+          onUserProjectsUpdated.waitForMessage(),
+          onUserStreamRemoved.waitForMessage()
+        ])
+
+        expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
+        expect(onUserStreamRemoved.getMessages()).to.have.length(1)
+      })
+
+      it('should notify me of a project ive just been removed from (userProjectsUpdated/userStreamRemoved)', async () => {
+        const otherGuysProj: BasicTestStream = {
+          name: 'Other Guys Project #2',
+          id: '',
+          ownerId: otherGuy.id,
+          isPublic: true,
+          workspaceId: otherGuysWorkspace.id
+        }
+        await createTestStreams([[otherGuysProj, otherGuy]])
+        await addOrUpdateStreamCollaborator(
+          otherGuysProj.id,
+          me.id,
+          Roles.Stream.Contributor,
+          otherGuy.id
+        )
+
+        const onUserProjectsUpdated = await meSubClient.subscribe(
+          OnUserProjectsUpdatedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.userProjectsUpdated.type).to.equal(
+              UserProjectsUpdatedMessageType.Removed
+            )
+            expect(res.data?.userProjectsUpdated.id).to.equal(otherGuysProj.id)
+          }
+        )
+        const onUserStreamRemoved = await meSubClient.subscribe(
+          OnUserStreamRemovedDocument,
+          {},
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.userStreamRemoved?.id).to.equal(otherGuysProj.id)
+          }
+        )
+        await meSubClient.waitForReadiness()
+        await removeStreamCollaborator(otherGuysProj.id, me.id, otherGuy.id, null)
+
+        await Promise.all([
+          onUserProjectsUpdated.waitForMessage(),
+          onUserStreamRemoved.waitForMessage()
+        ])
+
+        expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
+        expect(onUserStreamRemoved.getMessages()).to.have.length(1)
+      })
+
+      it('should notify me of a project update (projectUpdated/streamUpdate)', async () => {
+        const myProj: BasicTestStream = {
+          name: 'My New Test3 Project',
+          id: '',
+          ownerId: me.id,
+          isPublic: true,
+          workspaceId: myMainWorkspace.id
+        }
+        await createTestStreams([[myProj, me]])
+        const updateProject = await buildUpdateProject({ projectId: myProj.id })
+
+        const onUserProjectsUpdated = await meSubClient.subscribe(
+          OnProjectUpdatedDocument,
+          { projectId: myProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.projectUpdated.type).to.equal(
+              ProjectUpdatedMessageType.Updated
+            )
+            expect(res.data?.projectUpdated.project?.id).to.equal(myProj.id)
+          }
+        )
+        const onStreamUpdated = await meSubClient.subscribe(
+          OnStreamUpdatedDocument,
+          { streamId: myProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.streamUpdated?.id).to.equal(myProj.id)
+          }
+        )
+        await meSubClient.waitForReadiness()
+        await updateProject({ id: myProj.id, name: 'Updated Project Name' }, me.id)
+
+        await Promise.all([
+          onUserProjectsUpdated.waitForMessage(),
+          onStreamUpdated.waitForMessage()
+        ])
+
+        expect(onUserProjectsUpdated.getMessages()).to.have.length(1)
+        expect(onStreamUpdated.getMessages()).to.have.length(1)
+      })
+
+      it('should not notify me of a project update for a different project', async () => {
+        const myProj: BasicTestStream = {
+          name: 'My New Test4 Project',
+          id: '',
+          ownerId: me.id,
+          isPublic: true,
+          workspaceId: myMainWorkspace.id
+        }
+        await createTestStreams([[myProj, me]])
+        const updateProject = await buildUpdateProject({ projectId: myProj.id })
+
+        const onUserProjectsUpdated = await meSubClient.subscribe(
+          OnProjectUpdatedDocument,
+          { projectId: 'aaa' },
+          (res) => {
+            throw new TestError('Message received for wrong project', {
+              info: { res }
+            })
+          }
+        )
+        const onStreamUpdated = await meSubClient.subscribe(
+          OnStreamUpdatedDocument,
+          { streamId: 'bbb' },
+          (res) => {
+            throw new TestError('Message received for wrong project', {
+              info: { res }
+            })
+          }
+        )
+        await meSubClient.waitForReadiness()
+        await updateProject({ id: myProj.id, name: 'Updated Project Name' }, me.id)
+
+        await Promise.all([
+          onUserProjectsUpdated.waitForTimeout(),
+          onStreamUpdated.waitForTimeout()
+        ])
+
+        expect(onUserProjectsUpdated.getMessages()).to.have.length(0)
+        expect(onStreamUpdated.getMessages()).to.have.length(0)
+      })
+    })
+
+    describe('Version Subs', () => {
+      const myVersionProj: BasicTestStream = {
+        name: 'My New Version Project #1',
+        id: '',
+        ownerId: '',
+        isPublic: true
+      }
+
+      before(async () => {
+        myVersionProj.workspaceId = myMainWorkspace.id
+        await createTestStreams([[myVersionProj, me]])
+      })
+
+      it(`should notify me of a new version (projectVersionsUpdated/commitCreated)`, async () => {
+        const message = 'ayyyooo'
+        const onUserProjectVersionsUpdated = await meSubClient.subscribe(
+          OnUserProjectVersionsUpdatedDocument,
+          { projectId: myVersionProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.projectVersionsUpdated.type).to.equal(
+              ProjectVersionsUpdatedMessageType.Created
+            )
+            expect(res.data?.projectVersionsUpdated.version?.message).to.equal(message)
+          }
+        )
+        const onUserStreamCommitCreated = await meSubClient.subscribe(
+          OnUserStreamCommitCreatedDocument,
+          { streamId: myVersionProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.commitCreated?.message).to.equal(message)
+          }
+        )
+        await meSubClient.waitForReadiness()
+
+        // Create test commit
+        const commit: BasicTestCommit = {
+          streamId: '',
+          objectId: '',
+          id: '',
+          authorId: '',
+          branchId: '',
+          message
+        }
+
+        await createTestCommits([commit], { owner: me, stream: myVersionProj })
+
+        await Promise.all([
+          onUserProjectVersionsUpdated.waitForMessage(),
+          onUserStreamCommitCreated.waitForMessage()
+        ])
+
+        expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(1)
+        expect(onUserStreamCommitCreated.getMessages()).to.have.length(1)
+      })
+
+      it('should notify me when a version is deleted (projectVersionsUpdated/commitDeleted)', async () => {
+        const commitToDelete: BasicTestCommit = {
+          streamId: '',
+          objectId: '',
+          id: '',
+          authorId: '',
+          branchId: '',
+          message: 'Commit to Delete'
+        }
+        await createTestCommits([commitToDelete], {
+          owner: me,
+          stream: myVersionProj
+        })
+        const deleteVersion = await buildDeleteVersion({
+          projectId: myVersionProj.id
+        })
+
+        const onUserProjectVersionsUpdated = await meSubClient.subscribe(
+          OnUserProjectVersionsUpdatedDocument,
+          { projectId: myVersionProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.projectVersionsUpdated.type).to.equal(
+              ProjectVersionsUpdatedMessageType.Deleted
+            )
+            expect(res.data?.projectVersionsUpdated.id).to.equal(commitToDelete.id)
+          }
+        )
+        const onUserStreamCommitDeleted = await meSubClient.subscribe(
+          OnUserStreamCommitDeletedDocument,
+          { streamId: myVersionProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.commitDeleted?.id).to.equal(commitToDelete.id)
+          }
+        )
+        await meSubClient.waitForReadiness()
+        await deleteVersion(
+          {
+            versionIds: [commitToDelete.id],
+            projectId: myVersionProj.id
+          },
+          me.id
+        )
+
+        await Promise.all([
+          onUserProjectVersionsUpdated.waitForMessage(),
+          onUserStreamCommitDeleted.waitForMessage()
+        ])
+
+        expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(1)
+        expect(onUserStreamCommitDeleted.getMessages()).to.have.length(1)
+      })
+
+      it('should notify me when a version is updated (projectVersionsUpdated/commitUpdated)', async () => {
+        const commitToUpdate: BasicTestCommit = {
+          streamId: '',
+          objectId: '',
+          id: '',
+          authorId: '',
+          branchId: '',
+          message: 'Commit to Update'
+        }
+        await createTestCommits([commitToUpdate], {
+          owner: me,
+          stream: myVersionProj
+        })
+        const updateVersion = await buildUpdateVersion({
+          projectId: myVersionProj.id
+        })
+
+        const onUserProjectVersionsUpdated = await meSubClient.subscribe(
+          OnUserProjectVersionsUpdatedDocument,
+          { projectId: myVersionProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.projectVersionsUpdated.type).to.equal(
+              ProjectVersionsUpdatedMessageType.Updated
+            )
+            expect(res.data?.projectVersionsUpdated.version?.id).to.equal(
+              commitToUpdate.id
+            )
+          }
+        )
+        const onUserStreamCommitCreated = await meSubClient.subscribe(
+          OnUserStreamCommitUpdatedDocument,
+          { streamId: myVersionProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.commitUpdated?.id).to.equal(commitToUpdate.id)
+          }
+        )
+        await meSubClient.waitForReadiness()
+        await updateVersion(
+          {
+            versionId: commitToUpdate.id,
+            message: 'Updated Message',
+            projectId: myVersionProj.id
+          },
+          me.id
+        )
+
+        await Promise.all([
+          onUserProjectVersionsUpdated.waitForMessage(),
+          onUserStreamCommitCreated.waitForMessage()
+        ])
+
+        expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(1)
+        expect(onUserStreamCommitCreated.getMessages()).to.have.length(1)
+      })
+
+      it('should not notify me when version is created for stream im not authorized for', async () => {
+        const otherGuysProj: BasicTestStream = {
+          name: 'Other Guys Project #3',
+          id: '',
+          ownerId: otherGuy.id,
+          isPublic: false,
+          workspaceId: otherGuysWorkspace.id
+        }
+        await createTestStreams([[otherGuysProj, otherGuy]])
+
+        const onUserProjectVersionsUpdated = await meSubClient.subscribe(
+          OnUserProjectVersionsUpdatedDocument,
+          { projectId: otherGuysProj.id },
+          (res) => {
+            throw new TestError('Message received for wrong project', {
+              info: { res }
+            })
+          }
+        )
+        const onUserStreamCommitCreated = await meSubClient.subscribe(
+          OnUserStreamCommitCreatedDocument,
+          { streamId: otherGuysProj.id },
+          (res) => {
+            throw new TestError('Message received for wrong project', {
+              info: { res }
+            })
+          }
+        )
+        await meSubClient.waitForReadiness()
+
+        const commit: BasicTestCommit = {
+          streamId: otherGuysProj.id,
+          objectId: '',
+          id: '',
+          authorId: '',
+          branchId: '',
+          message: 'Random Commit'
+        }
+        await createTestCommits([commit], {
+          owner: otherGuy,
+          stream: otherGuysProj
+        })
+
+        await Promise.all([
+          onUserProjectVersionsUpdated.waitForTimeout(),
+          onUserStreamCommitCreated.waitForTimeout()
+        ])
+
+        expect(onUserProjectVersionsUpdated.getMessages()).to.have.length(0)
+        expect(onUserStreamCommitCreated.getMessages()).to.have.length(0)
+      })
+    })
+
+    describe('Model Subs', () => {
+      const myModelProj: BasicTestStream = {
+        name: 'My New Model Project #1',
+        id: '',
+        ownerId: '',
+        isPublic: true
+      }
+
+      before(async () => {
+        myModelProj.workspaceId = myMainWorkspace.id
+        await createTestStreams([[myModelProj, me]])
+      })
+
+      it(`should notify me of a new model (projectModelsUpdated/branchCreated)`, async () => {
+        const newModel: BasicTestBranch = {
+          name: 'Some New Fangled kind of Model',
+          streamId: '',
+          authorId: '',
+          id: ''
+        }
+
+        const onProjectModelsUpdated = await meSubClient.subscribe(
+          OnProjectModelsUpdatedDocument,
+          { projectId: myModelProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+
+            // name should be lowercaseified
+            expect(res.data?.projectModelsUpdated.model?.name).to.equal(
+              newModel.name.toLowerCase()
+            )
+            expect(res.data?.projectModelsUpdated.type).to.equal(
+              ProjectModelsUpdatedMessageType.Created
+            )
+          }
+        )
+        const onBranchCreated = await meSubClient.subscribe(
+          OnBranchCreatedDocument,
+          { streamId: myModelProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.branchCreated?.name).to.equal(newModel.name.toLowerCase())
+          }
+        )
+        await meSubClient.waitForReadiness()
+
+        await createTestBranch({ branch: newModel, stream: myModelProj, owner: me })
+        await Promise.all([
+          onProjectModelsUpdated.waitForMessage(),
+          onBranchCreated.waitForMessage()
+        ])
+
+        expect(onProjectModelsUpdated.getMessages()).to.have.length(1)
+        expect(onBranchCreated.getMessages()).to.have.length(1)
+      })
+
+      itEach(
+        [{ any: false }, { any: true }],
+        ({ any }) =>
+          `should notify me of ${
+            any ? 'any ' : ''
+          }updated model (projectModelsUpdated/branchUpdated)`,
+        async ({ any }) => {
+          // Create 2 models
+          const firstModel: BasicTestBranch = {
+            name: 'First Model ' + faker.number.int(),
             streamId: '',
             authorId: '',
             id: ''
           }
-          await createTestBranch({
-            branch: modelToDelete,
-            stream: myModelProj,
-            owner: me
-          })
-          const deleteModel = await buildDeleteModel({ projectId: myModelProj.id })
+          const secondModel: BasicTestBranch = {
+            name: 'Second Model ' + faker.number.int(),
+            streamId: '',
+            authorId: '',
+            id: ''
+          }
+          await createTestBranches([
+            { branch: firstModel, stream: myModelProj, owner: me },
+            { branch: secondModel, stream: myModelProj, owner: me }
+          ])
+          const updateModel = await buildUpdateModel({ projectId: myModelProj.id })
 
+          // Sub
           const onProjectModelsUpdated = await meSubClient.subscribe(
             OnProjectModelsUpdatedDocument,
-            { projectId: myModelProj.id },
+            {
+              projectId: myModelProj.id,
+              ...(!any ? { modelIds: [firstModel.id] } : {})
+            },
             (res) => {
               expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.projectModelsUpdated.type).to.equal(
-                ProjectModelsUpdatedMessageType.Deleted
+
+              const modelId = res.data?.projectModelsUpdated.model?.id
+              expect([firstModel.id, ...(any ? [secondModel.id] : [])]).to.include(
+                modelId
+              )
+              expect(res.data?.projectModelsUpdated.type).to.equal(
+                ProjectModelsUpdatedMessageType.Updated
               )
-              expect(res.data?.projectModelsUpdated.id).to.equal(modelToDelete.id)
             }
           )
-          const onBranchDeleted = await meSubClient.subscribe(
-            OnBranchDeletedDocument,
-            { streamId: myModelProj.id },
+          const onBranchUpdated = await meSubClient.subscribe(
+            OnBranchUpdatedDocument,
+            {
+              streamId: myModelProj.id,
+              branchId: !any ? firstModel.id : undefined
+            },
             (res) => {
               expect(res).to.not.haveGraphQLErrors()
-              expect(res.data?.branchDeleted?.id).to.equal(modelToDelete.id)
+              const modelId = res.data?.branchUpdated?.id
+              expect([firstModel.id, ...(any ? [secondModel.id] : [])]).to.include(
+                modelId
+              )
             }
           )
           await meSubClient.waitForReadiness()
-          await deleteModel({ id: modelToDelete.id, projectId: myModelProj.id }, me.id)
+
+          // Update both models
+          await Promise.all([
+            updateModel(
+              {
+                id: firstModel.id,
+                name: 'First Model New Name' + faker.number.int(),
+                projectId: myModelProj.id
+              },
+              me.id
+            ),
+            updateModel(
+              {
+                id: secondModel.id,
+                name: 'Second Model New Name' + faker.number.int(),
+                projectId: myModelProj.id
+              },
+              me.id
+            )
+          ])
 
           await Promise.all([
             onProjectModelsUpdated.waitForMessage(),
-            onBranchDeleted.waitForMessage()
+            onBranchUpdated.waitForMessage()
           ])
 
-          expect(onProjectModelsUpdated.getMessages()).to.have.length(1)
-          expect(onBranchDeleted.getMessages()).to.have.length(1)
+          expect(onProjectModelsUpdated.getMessages()).to.have.length(any ? 2 : 1)
+          expect(onBranchUpdated.getMessages()).to.have.length(any ? 2 : 1)
+        }
+      )
+
+      it('should notify me of model delete (projectModelsUpdated/branchDeleted)', async () => {
+        const modelToDelete: BasicTestBranch = {
+          name: 'Model to Delete',
+          streamId: '',
+          authorId: '',
+          id: ''
+        }
+        await createTestBranch({
+          branch: modelToDelete,
+          stream: myModelProj,
+          owner: me
+        })
+        const deleteModel = await buildDeleteModel({ projectId: myModelProj.id })
+
+        const onProjectModelsUpdated = await meSubClient.subscribe(
+          OnProjectModelsUpdatedDocument,
+          { projectId: myModelProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.projectModelsUpdated.type).to.equal(
+              ProjectModelsUpdatedMessageType.Deleted
+            )
+            expect(res.data?.projectModelsUpdated.id).to.equal(modelToDelete.id)
+          }
+        )
+        const onBranchDeleted = await meSubClient.subscribe(
+          OnBranchDeletedDocument,
+          { streamId: myModelProj.id },
+          (res) => {
+            expect(res).to.not.haveGraphQLErrors()
+            expect(res.data?.branchDeleted?.id).to.equal(modelToDelete.id)
+          }
+        )
+        await meSubClient.waitForReadiness()
+        await deleteModel({ id: modelToDelete.id, projectId: myModelProj.id }, me.id)
+
+        await Promise.all([
+          onProjectModelsUpdated.waitForMessage(),
+          onBranchDeleted.waitForMessage()
+        ])
+
+        expect(onProjectModelsUpdated.getMessages()).to.have.length(1)
+        expect(onBranchDeleted.getMessages()).to.have.length(1)
+      })
+
+      it('should not notify me when model is created for stream im not authorized for', async () => {
+        const otherGuysProj: BasicTestStream = {
+          name: 'Other Guys Project #3',
+          id: '',
+          ownerId: otherGuy.id,
+          isPublic: false,
+          workspaceId: otherGuysWorkspace.id
+        }
+        await createTestStreams([[otherGuysProj, otherGuy]])
+
+        const newModel: BasicTestBranch = {
+          name: 'Some New Fangled kind of Model',
+          streamId: '',
+          authorId: '',
+          id: ''
+        }
+
+        const onProjectModelsUpdated = await meSubClient.subscribe(
+          OnProjectModelsUpdatedDocument,
+          { projectId: otherGuysProj.id },
+          (res) => {
+            throw new TestError('Message received for wrong project', {
+              info: { res }
+            })
+          }
+        )
+        const onBranchCreated = await meSubClient.subscribe(
+          OnBranchCreatedDocument,
+          { streamId: otherGuysProj.id },
+          (res) => {
+            throw new TestError('Message received for wrong project', {
+              info: { res }
+            })
+          }
+        )
+        await meSubClient.waitForReadiness()
+
+        await createTestBranch({
+          branch: newModel,
+          stream: otherGuysProj,
+          owner: otherGuy
         })
 
-        it('should not notify me when model is created for stream im not authorized for', async () => {
-          const otherGuysProj: BasicTestStream = {
-            name: 'Other Guys Project #3',
-            id: '',
-            ownerId: otherGuy.id,
-            isPublic: false,
-            workspaceId: otherGuysWorkspace.id
-          }
-          await createTestStreams([[otherGuysProj, otherGuy]])
+        await Promise.all([
+          onProjectModelsUpdated.waitForTimeout(),
+          onBranchCreated.waitForTimeout()
+        ])
 
-          const newModel: BasicTestBranch = {
-            name: 'Some New Fangled kind of Model',
-            streamId: '',
-            authorId: '',
-            id: ''
-          }
-
-          const onProjectModelsUpdated = await meSubClient.subscribe(
-            OnProjectModelsUpdatedDocument,
-            { projectId: otherGuysProj.id },
-            (res) => {
-              throw new TestError('Message received for wrong project', {
-                info: { res }
-              })
-            }
-          )
-          const onBranchCreated = await meSubClient.subscribe(
-            OnBranchCreatedDocument,
-            { streamId: otherGuysProj.id },
-            (res) => {
-              throw new TestError('Message received for wrong project', {
-                info: { res }
-              })
-            }
-          )
-          await meSubClient.waitForReadiness()
-
-          await createTestBranch({
-            branch: newModel,
-            stream: otherGuysProj,
-            owner: otherGuy
-          })
-
-          await Promise.all([
-            onProjectModelsUpdated.waitForTimeout(),
-            onBranchCreated.waitForTimeout()
-          ])
-
-          expect(onProjectModelsUpdated.getMessages()).to.have.length(0)
-          expect(onBranchCreated.getMessages()).to.have.length(0)
-        })
+        expect(onProjectModelsUpdated.getMessages()).to.have.length(0)
+        expect(onBranchCreated.getMessages()).to.have.length(0)
       })
     })
   })
diff --git a/packages/server/modules/core/tests/objects.spec.ts b/packages/server/modules/core/tests/objects.spec.ts
index 2cb8e55ba..49381b823 100644
--- a/packages/server/modules/core/tests/objects.spec.ts
+++ b/packages/server/modules/core/tests/objects.spec.ts
@@ -10,7 +10,8 @@ import { getAnIdForThisOnePlease } from '@/test/helpers'
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
 import {
@@ -119,6 +120,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/core/tests/rest.spec.ts b/packages/server/modules/core/tests/rest.spec.ts
index f427bd523..1669d4094 100644
--- a/packages/server/modules/core/tests/rest.spec.ts
+++ b/packages/server/modules/core/tests/rest.spec.ts
@@ -12,7 +12,8 @@ import { Scopes } from '@speckle/shared'
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
 import {
@@ -92,6 +93,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/core/tests/streams.spec.ts b/packages/server/modules/core/tests/streams.spec.ts
index aa89562d7..3de29147d 100644
--- a/packages/server/modules/core/tests/streams.spec.ts
+++ b/packages/server/modules/core/tests/streams.spec.ts
@@ -18,6 +18,7 @@ import {
   createStreamFactory,
   deleteStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   getStreamsCollaboratorsFactory,
   grantStreamPermissionsFactory,
   markBranchStreamUpdatedFactory,
@@ -163,6 +164,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
@@ -245,6 +247,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 const isStreamCollaborator = isStreamCollaboratorFactory({
diff --git a/packages/server/modules/core/tests/users.spec.ts b/packages/server/modules/core/tests/users.spec.ts
index 22f0e92d5..58b78f727 100644
--- a/packages/server/modules/core/tests/users.spec.ts
+++ b/packages/server/modules/core/tests/users.spec.ts
@@ -37,7 +37,9 @@ import {
   grantStreamPermissionsFactory,
   markCommitStreamUpdatedFactory,
   deleteStreamFactory,
-  getUserDeletableStreamsFactory
+  getUserDeletableStreamsFactory,
+  getStreamRolesFactory,
+  legacyGetStreamsFactory
 } from '@/modules/core/repositories/streams'
 import {
   getObjectFactory,
@@ -128,6 +130,8 @@ import {
   validateStreamAccessFactory
 } from '@/modules/core/services/streams/access'
 import { authorizeResolver } from '@/modules/shared'
+import { getUserWorkspaceSeatsFactory } from '@/modules/workspacesCore/repositories/workspaces'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const getServerInfo = getServerInfoFactory({ db })
 const getUser = legacyGetUserFactory({ db })
@@ -167,6 +171,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
@@ -279,6 +284,10 @@ const deleteUser = deleteUserFactory({
   logger: dbLogger,
   isLastAdminUser: isLastAdminUserFactory({ db }),
   getUserDeletableStreams: getUserDeletableStreamsFactory({ db }),
+  queryAllProjects: queryAllProjectsFactory({
+    getStreams: legacyGetStreamsFactory({ db })
+  }),
+  getUserWorkspaceSeats: getUserWorkspaceSeatsFactory({ db }),
   deleteAllUserInvites: deleteAllUserInvitesFactory({ db }),
   deleteUserRecord: deleteUserRecordFactory({ db }),
   emitEvent: getEventBus().emit
diff --git a/packages/server/modules/core/tests/usersAdmin.spec.ts b/packages/server/modules/core/tests/usersAdmin.spec.ts
index b0b5a29b9..b0ba54406 100644
--- a/packages/server/modules/core/tests/usersAdmin.spec.ts
+++ b/packages/server/modules/core/tests/usersAdmin.spec.ts
@@ -38,12 +38,15 @@ import {
 } from '@/modules/serverinvites/repositories/serverInvites'
 import {
   deleteStreamFactory,
-  getUserDeletableStreamsFactory
+  getUserDeletableStreamsFactory,
+  legacyGetStreamsFactory
 } from '@/modules/core/repositories/streams'
 import { dbLogger } from '@/observability/logging'
 import { getServerInfoFactory } from '@/modules/core/repositories/server'
 import { getEventBus } from '@/modules/shared/services/eventBus'
 import { expect } from 'chai'
+import { getUserWorkspaceSeatsFactory } from '@/modules/workspacesCore/repositories/workspaces'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const getUsers = legacyGetPaginatedUsersFactory({ db })
 const countUsers = legacyGetPaginatedUsersCountFactory({ db })
@@ -81,6 +84,10 @@ const deleteUser = deleteUserFactory({
   logger: dbLogger,
   isLastAdminUser: isLastAdminUserFactory({ db }),
   getUserDeletableStreams: getUserDeletableStreamsFactory({ db }),
+  queryAllProjects: queryAllProjectsFactory({
+    getStreams: legacyGetStreamsFactory({ db })
+  }),
+  getUserWorkspaceSeats: getUserWorkspaceSeatsFactory({ db }),
   deleteAllUserInvites: deleteAllUserInvitesFactory({ db }),
   deleteUserRecord: deleteUserRecordFactory({ db }),
   emitEvent: getEventBus().emit
diff --git a/packages/server/modules/core/tests/usersAdminList.spec.ts b/packages/server/modules/core/tests/usersAdminList.spec.ts
index 5b7376970..df292882c 100644
--- a/packages/server/modules/core/tests/usersAdminList.spec.ts
+++ b/packages/server/modules/core/tests/usersAdminList.spec.ts
@@ -12,6 +12,7 @@ import { createAuthedTestContext, ServerAndContext } from '@/test/graphqlHelper'
 import {
   createStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
@@ -86,6 +87,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/cross-server-sync/graph/generated/graphql.ts b/packages/server/modules/cross-server-sync/graph/generated/graphql.ts
index 06542fdec..152973098 100644
--- a/packages/server/modules/cross-server-sync/graph/generated/graphql.ts
+++ b/packages/server/modules/cross-server-sync/graph/generated/graphql.ts
@@ -925,6 +925,12 @@ export type CreateCommentReplyInput = {
   threadId: Scalars['String']['input'];
 };
 
+export type CreateEmbedTokenReturn = {
+  __typename?: 'CreateEmbedTokenReturn';
+  token: Scalars['String']['output'];
+  tokenMetadata: EmbedToken;
+};
+
 export type CreateModelInput = {
   description?: InputMaybe<Scalars['String']['input']>;
   name: Scalars['String']['input'];
@@ -1003,6 +1009,32 @@ export type EmailVerificationRequestInput = {
   id: Scalars['ID']['input'];
 };
 
+/** A token used to enable an embedded viewer for a private project */
+export type EmbedToken = {
+  __typename?: 'EmbedToken';
+  createdAt: Scalars['DateTime']['output'];
+  lastUsed: Scalars['DateTime']['output'];
+  lifespan: Scalars['BigInt']['output'];
+  projectId: Scalars['String']['output'];
+  resourceIdString: Scalars['String']['output'];
+  tokenId: Scalars['String']['output'];
+  user?: Maybe<LimitedUser>;
+};
+
+export type EmbedTokenCollection = {
+  __typename?: 'EmbedTokenCollection';
+  cursor?: Maybe<Scalars['String']['output']>;
+  items: Array<EmbedToken>;
+  totalCount: Scalars['Int']['output'];
+};
+
+export type EmbedTokenCreateInput = {
+  lifespan?: InputMaybe<Scalars['BigInt']['input']>;
+  projectId: Scalars['String']['input'];
+  /** The model(s) and version(s) string used in the embed url */
+  resourceIdString: Scalars['String']['input'];
+};
+
 export type FileUpload = {
   __typename?: 'FileUpload';
   branchName: Scalars['String']['output'];
@@ -2098,6 +2130,7 @@ export type Project = {
   description?: Maybe<Scalars['String']['output']>;
   /** Public project-level configuration for embedded viewer */
   embedOptions: ProjectEmbedOptions;
+  embedTokens: EmbedTokenCollection;
   hasAccessToFeature: Scalars['Boolean']['output'];
   id: Scalars['ID']['output'];
   invitableCollaborators: WorkspaceCollaboratorCollection;
@@ -2180,6 +2213,12 @@ export type ProjectCommentThreadsArgs = {
 };
 
 
+export type ProjectEmbedTokensArgs = {
+  cursor?: InputMaybe<Scalars['String']['input']>;
+  limit?: InputMaybe<Scalars['Int']['input']>;
+};
+
+
 export type ProjectHasAccessToFeatureArgs = {
   featureName: WorkspaceFeatureName;
 };
@@ -2579,6 +2618,7 @@ export type ProjectMutations = {
   batchDelete: Scalars['Boolean']['output'];
   /** Create new project */
   create: Project;
+  createEmbedToken: CreateEmbedTokenReturn;
   /**
    * Create onboarding/tutorial project. If one is already created for the active user, that
    * one will be returned instead.
@@ -2590,6 +2630,8 @@ export type ProjectMutations = {
   invites: ProjectInviteMutations;
   /** Leave a project. Only possible if you're not the last remaining owner. */
   leave: Scalars['Boolean']['output'];
+  revokeEmbedToken: Scalars['Boolean']['output'];
+  revokeEmbedTokens: Scalars['Boolean']['output'];
   /** Updates an existing project */
   update: Project;
   /** Update role for a collaborator */
@@ -2612,6 +2654,11 @@ export type ProjectMutationsCreateArgs = {
 };
 
 
+export type ProjectMutationsCreateEmbedTokenArgs = {
+  token: EmbedTokenCreateInput;
+};
+
+
 export type ProjectMutationsDeleteArgs = {
   id: Scalars['String']['input'];
 };
@@ -2622,6 +2669,17 @@ export type ProjectMutationsLeaveArgs = {
 };
 
 
+export type ProjectMutationsRevokeEmbedTokenArgs = {
+  projectId: Scalars['String']['input'];
+  token: Scalars['String']['input'];
+};
+
+
+export type ProjectMutationsRevokeEmbedTokensArgs = {
+  projectId: Scalars['String']['input'];
+};
+
+
 export type ProjectMutationsUpdateArgs = {
   update: ProjectUpdateInput;
 };
@@ -2664,6 +2722,7 @@ export type ProjectPermissionChecks = {
   canBroadcastActivity: PermissionCheckResult;
   canCreateAutomation: PermissionCheckResult;
   canCreateComment: PermissionCheckResult;
+  canCreateEmbedTokens: PermissionCheckResult;
   canCreateModel: PermissionCheckResult;
   canDelete: PermissionCheckResult;
   canInvite: PermissionCheckResult;
@@ -2672,9 +2731,11 @@ export type ProjectPermissionChecks = {
   canMoveToWorkspace: PermissionCheckResult;
   canPublish: PermissionCheckResult;
   canRead: PermissionCheckResult;
+  canReadEmbedTokens: PermissionCheckResult;
   canReadSettings: PermissionCheckResult;
   canReadWebhooks: PermissionCheckResult;
   canRequestRender: PermissionCheckResult;
+  canRevokeEmbedTokens: PermissionCheckResult;
   canUpdate: PermissionCheckResult;
   canUpdateAllowPublicComments: PermissionCheckResult;
 };
diff --git a/packages/server/modules/fileuploads/domain/operations.ts b/packages/server/modules/fileuploads/domain/operations.ts
index 71413e0bd..a4c41b04a 100644
--- a/packages/server/modules/fileuploads/domain/operations.ts
+++ b/packages/server/modules/fileuploads/domain/operations.ts
@@ -69,11 +69,16 @@ export type ProcessFileImportResult = (params: {
 
 export type UpdateFileStatus = (params: {
   fileId: string
+  projectId: string
   status: FileUploadConvertedStatus
   convertedMessage: string
   convertedCommitId: string | null
 }) => Promise<FileUploadRecord>
 
+export type UpdateFileStatusForProjectFactory = (params: {
+  projectId: string
+}) => Promise<UpdateFileStatus>
+
 export type UploadedFile = UploadResult & { userId: string }
 
 export type FileImportMessage = Pick<
diff --git a/packages/server/modules/fileuploads/graph/resolvers/fileUploads.ts b/packages/server/modules/fileuploads/graph/resolvers/fileUploads.ts
index 62bd4ba61..f33240092 100644
--- a/packages/server/modules/fileuploads/graph/resolvers/fileUploads.ts
+++ b/packages/server/modules/fileuploads/graph/resolvers/fileUploads.ts
@@ -25,7 +25,9 @@ import {
 } from '@/modules/shared/errors'
 import { throwIfAuthNotOk } from '@/modules/shared/helpers/errorHelper'
 import {
+  fileImportServiceShouldUsePrivateObjectsServerUrl,
   getFileUploadUrlExpiryMinutes,
+  getPrivateObjectsServerOrigin,
   getServerOrigin,
   isFileUploadsEnabled
 } from '@/modules/shared/helpers/envHelper'
@@ -68,6 +70,11 @@ import cryptoRandomString from 'crypto-random-string'
 import { getFeatureFlags } from '@speckle/shared/environment'
 import { throwIfResourceAccessNotAllowed } from '@/modules/core/helpers/token'
 import { TokenResourceIdentifierType } from '@/modules/core/domain/tokens/types'
+import { getModelUploadsFactory } from '@/modules/fileuploads/services/management'
+import {
+  FileUploadRecord,
+  FileUploadRecordV2
+} from '@/modules/fileuploads/helpers/types'
 
 const { FF_LARGE_FILE_IMPORTS_ENABLED, FF_NEXT_GEN_FILE_IMPORTER_ENABLED } =
   getFeatureFlags()
@@ -134,7 +141,7 @@ const fileUploadMutations: Resolvers['FileUploadMutations'] = {
 
     const generatePresignedUrl = generatePresignedUrlFactory({
       getSignedUrl: getSignedUrlFactory({
-        objectStorage: projectStorage
+        objectStorage: projectStorage.public
       }),
       upsertBlob: upsertBlobFactory({
         db: projectDb
@@ -189,7 +196,9 @@ const fileUploadMutations: Resolvers['FileUploadMutations'] = {
     ])
 
     const pushJobToFileImporter = pushJobToFileImporterFactory({
-      getServerOrigin,
+      getServerOrigin: fileImportServiceShouldUsePrivateObjectsServerUrl()
+        ? getPrivateObjectsServerOrigin
+        : getServerOrigin,
       createAppToken: createAppTokenFactory({
         storeApiToken: storeApiTokenFactory({ db }),
         storeTokenScopes: storeTokenScopesFactory({ db }),
@@ -221,7 +230,7 @@ const fileUploadMutations: Resolvers['FileUploadMutations'] = {
             db: projectDb
           }),
           getBlobMetadata: getBlobMetadataFromStorage({
-            objectStorage: projectStorage
+            objectStorage: projectStorage.private
           })
         }),
         insertNewUploadAndNotify: FF_NEXT_GEN_FILE_IMPORTER_ENABLED
@@ -249,11 +258,6 @@ const fileUploadMutations: Resolvers['FileUploadMutations'] = {
     }
   }
 }
-import { getModelUploadsFactory } from '@/modules/fileuploads/services/management'
-import {
-  FileUploadRecord,
-  FileUploadRecordV2
-} from '@/modules/fileuploads/helpers/types'
 
 export = {
   Stream: {
diff --git a/packages/server/modules/fileuploads/index.ts b/packages/server/modules/fileuploads/index.ts
index f8764868e..d6c6ee956 100644
--- a/packages/server/modules/fileuploads/index.ts
+++ b/packages/server/modules/fileuploads/index.ts
@@ -22,7 +22,8 @@ import { getEventBus } from '@/modules/shared/services/eventBus'
 import {
   expireOldPendingUploadsFactory,
   getFileInfoFactory,
-  updateFileUploadFactory
+  updateFileUploadFactory,
+  updateFileStatusFactory
 } from '@/modules/fileuploads/repositories/fileUploads'
 import { db } from '@/db/knex'
 import { getFileImportTimeLimitMinutes } from '@/modules/shared/helpers/envHelper'
@@ -35,14 +36,19 @@ import {
 import type { ScheduleExecution } from '@/modules/core/domain/scheduledTasks/operations'
 import { manageFileImportExpiryFactory } from '@/modules/fileuploads/services/tasks'
 import { TIME } from '@speckle/shared'
-import { FileUploadDatabaseEvents } from '@/modules/fileuploads/domain/consts'
+import {
+  DelayBetweenFileImportRetriesMinutes,
+  FileUploadDatabaseEvents,
+  NumberOfFileImportRetries
+} from '@/modules/fileuploads/domain/consts'
 import { fileuploadRouterFactory } from '@/modules/fileuploads/rest/router'
 import { nextGenFileImporterRouterFactory } from '@/modules/fileuploads/rest/nextGenRouter'
 import {
-  initializeRhinoQueue,
-  initializeIfcQueue,
+  initializeRhinoQueueFactory,
+  initializeIfcQueueFactory,
   shutdownQueues,
-  fileImportQueues
+  fileImportQueues,
+  initializeQueueFactory
 } from '@/modules/fileuploads/queues/fileimports'
 import { initializeEventListenersFactory } from '@/modules/fileuploads/events/eventListener'
 import {
@@ -50,6 +56,12 @@ import {
   ObserveResult
 } from '@/modules/fileuploads/observability/metrics'
 import { reportSubscriptionEventsFactory } from '@/modules/fileuploads/events/subscriptionListeners'
+import {
+  requestActiveHandlerFactory,
+  requestErrorHandlerFactory,
+  requestFailedHandlerFactory
+} from '@/modules/fileuploads/services/requestHandler'
+import { UpdateFileStatusForProjectFactory } from '@/modules/fileuploads/domain/operations'
 
 const { FF_NEXT_GEN_FILE_IMPORTER_ENABLED } = getFeatureFlags()
 
@@ -85,7 +97,12 @@ const scheduleFileImportExpiry = async ({
         fileImportExpiryHandlers.map((handler) =>
           handler({
             logger,
-            timeoutThresholdSeconds: (getFileImportTimeLimitMinutes() + 1) * TIME.minute // additional buffer of 1 minute
+            timeoutThresholdSeconds:
+              (NumberOfFileImportRetries *
+                (getFileImportTimeLimitMinutes() +
+                  DelayBetweenFileImportRetriesMinutes) +
+                1) * // additional buffer of 1 minute
+              TIME.minute
           })
         )
       )
@@ -93,6 +110,12 @@ const scheduleFileImportExpiry = async ({
   )
 }
 
+const updateFileStatusBuilder: UpdateFileStatusForProjectFactory = async (params) => {
+  const { projectId } = params
+  const projectDb = await getProjectDbClient({ projectId })
+  return updateFileStatusFactory({ db: projectDb })
+}
+
 export const init: SpeckleModule['init'] = async ({
   app,
   isInitial,
@@ -108,8 +131,32 @@ export const init: SpeckleModule['init'] = async ({
 
   if (isInitial) {
     if (FF_NEXT_GEN_FILE_IMPORTER_ENABLED) {
-      const rhinoQueue = await initializeRhinoQueue()
-      const ifcQueue = await initializeIfcQueue()
+      const rhinoQueue = await initializeRhinoQueueFactory({
+        initializeQueue: initializeQueueFactory({
+          jobActiveHandler: requestActiveHandlerFactory({
+            logger: moduleLogger,
+            updateFileStatusBuilder
+          }),
+          jobErrorHandler: requestErrorHandlerFactory({ logger: moduleLogger }),
+          jobFailedHandler: requestFailedHandlerFactory({
+            logger: moduleLogger,
+            updateFileStatusForProjectFactory: updateFileStatusBuilder
+          })
+        })
+      })()
+      const ifcQueue = await initializeIfcQueueFactory({
+        initializeQueue: initializeQueueFactory({
+          jobActiveHandler: requestActiveHandlerFactory({
+            logger: moduleLogger,
+            updateFileStatusBuilder
+          }),
+          jobErrorHandler: requestErrorHandlerFactory({ logger: moduleLogger }),
+          jobFailedHandler: requestFailedHandlerFactory({
+            logger: moduleLogger,
+            updateFileStatusForProjectFactory: updateFileStatusBuilder
+          })
+        })
+      })()
 
       ;({ observeResult } = initializeMetrics({
         registers: [metricsRegister],
diff --git a/packages/server/modules/fileuploads/queues/fileimports.ts b/packages/server/modules/fileuploads/queues/fileimports.ts
index b7ca320a3..0059628b9 100644
--- a/packages/server/modules/fileuploads/queues/fileimports.ts
+++ b/packages/server/modules/fileuploads/queues/fileimports.ts
@@ -7,12 +7,16 @@ import {
   getRedisUrl,
   isTestEnv
 } from '@/modules/shared/helpers/envHelper'
-import { Logger, logger } from '@/observability/logging'
+import { Logger, fileUploadsLogger as logger } from '@/observability/logging'
 import { TIME, TIME_MS } from '@speckle/shared'
 import { initializeQueue as setupQueue } from '@speckle/shared/dist/commonjs/queue/index.js'
 import { JobPayload } from '@speckle/shared/workers/fileimport'
 import { FileImportQueue } from '@/modules/fileuploads/domain/types'
-import Bull from 'bull'
+import Bull, {
+  ActiveEventCallback,
+  ErrorEventCallback,
+  FailedEventCallback
+} from 'bull'
 import {
   NumberOfFileImportRetries,
   DelayBetweenFileImportRetriesMinutes
@@ -57,51 +61,78 @@ const defaultJobOptions = {
   }
 }
 
-const initializeQueue = async (params: {
-  label: string
-  queueName: string
-  redisUrl: string
-  supportedFileTypes: string[]
-}): Promise<FileImportQueue & { queue: Bull.Queue }> => {
-  const { label, queueName, redisUrl, supportedFileTypes } = params
-  const queue = await setupQueue({
-    queueName,
-    redisUrl,
-    options: {
-      ...(!isTestEnv() ? { limiter } : {}),
-      defaultJobOptions
-    }
-  })
-  const fileImportQueue = {
-    label,
-    queue,
-    supportedFileTypes: supportedFileTypes.map(
-      (type) => type.toLocaleLowerCase() // Normalize file types to lowercase (this is a safeguard to prevent stupid typos in the future)
-    ),
-    shutdown: async () => await queue.close(),
-    scheduleJob: async (jobData: JobPayload): Promise<void> => {
-      await queue.add(jobData, defaultJobOptions)
+export const initializeQueueFactory =
+  (deps: {
+    jobActiveHandler: ActiveEventCallback
+    jobErrorHandler: ErrorEventCallback
+    jobFailedHandler: FailedEventCallback
+  }) =>
+  async (params: {
+    label: string
+    queueName: string
+    redisUrl: string
+    supportedFileTypes: string[]
+  }): Promise<FileImportQueue & { queue: Bull.Queue }> => {
+    const { label, queueName, redisUrl, supportedFileTypes } = params
+    const queue = await setupQueue({
+      queueName,
+      redisUrl,
+      options: {
+        ...(!isTestEnv() ? { limiter } : {}),
+        defaultJobOptions
+      }
+    })
+
+    queue.removeListener('active', deps.jobActiveHandler)
+    queue.on('active', deps.jobActiveHandler)
+
+    // The error event is triggered when an error in the Redis backend is thrown.
+    queue.removeListener('error', deps.jobErrorHandler)
+    queue.on('error', deps.jobErrorHandler)
+
+    // The failed event is triggered when a job fails by throwing an exception during execution.
+    // https://api.docs.bullmq.io/interfaces/v5.QueueEventsListener.html#failed
+    queue.removeListener('failed', deps.jobFailedHandler)
+    queue.on('failed', deps.jobFailedHandler)
+
+    const fileImportQueue = {
+      label,
+      queue,
+      supportedFileTypes: supportedFileTypes.map(
+        (type) => type.toLocaleLowerCase() // Normalize file types to lowercase (this is a safeguard to prevent stupid typos in the future)
+      ),
+      shutdown: async () => await queue.close(),
+      scheduleJob: async (jobData: JobPayload): Promise<void> => {
+        await queue.add(jobData, defaultJobOptions)
+      }
     }
+    fileImportQueues.push(fileImportQueue)
+    return fileImportQueue
   }
-  fileImportQueues.push(fileImportQueue)
-  return fileImportQueue
-}
 
-export const initializeRhinoQueue = async () =>
-  initializeQueue({
-    label: 'rhino',
-    queueName: FILEIMPORT_SERVICE_RHINO_QUEUE_NAME,
-    redisUrl: getFileImportServiceRhinoParserRedisUrl() ?? getRedisUrl(),
-    supportedFileTypes: ['obj', 'stl', 'skp']
-  })
+export const initializeRhinoQueueFactory =
+  (deps: { initializeQueue: ReturnType<typeof initializeQueueFactory> }) =>
+  async () => {
+    const rhinoImportServiceRedisUrl = getFileImportServiceRhinoParserRedisUrl()
+    return deps.initializeQueue({
+      label: 'rhino',
+      queueName: FILEIMPORT_SERVICE_RHINO_QUEUE_NAME,
+      redisUrl: rhinoImportServiceRedisUrl ? rhinoImportServiceRedisUrl : getRedisUrl(),
+      supportedFileTypes: ['obj', 'stl', 'skp']
+    })
+  }
 
-export const initializeIfcQueue = async () =>
-  initializeQueue({
-    label: 'ifc',
-    queueName: FILEIMPORT_SERVICE_IFC_QUEUE_NAME,
-    redisUrl: getFileImportServiceIFCParserRedisUrl() ?? getRedisUrl(),
-    supportedFileTypes: ['ifc']
-  })
+export const initializeIfcQueueFactory =
+  (deps: { initializeQueue: ReturnType<typeof initializeQueueFactory> }) =>
+  async () => {
+    const ifcImportServiceRedisUrl = getFileImportServiceIFCParserRedisUrl()
+    return deps.initializeQueue({
+      label: 'ifc',
+      queueName: FILEIMPORT_SERVICE_IFC_QUEUE_NAME,
+      redisUrl: ifcImportServiceRedisUrl ? ifcImportServiceRedisUrl : getRedisUrl(),
+      supportedFileTypes: ['ifc']
+    })
+  }
 
 export const shutdownQueues = async (params: { logger: Logger }) => {
   for (const queue of fileImportQueues) {
diff --git a/packages/server/modules/fileuploads/repositories/fileUploads.ts b/packages/server/modules/fileuploads/repositories/fileUploads.ts
index 032d9d56d..231001cfe 100644
--- a/packages/server/modules/fileuploads/repositories/fileUploads.ts
+++ b/packages/server/modules/fileuploads/repositories/fileUploads.ts
@@ -10,7 +10,8 @@ import {
   UpdateFileUpload,
   GetModelUploadsItems,
   GetModelUploadsBaseArgs,
-  GetModelUploadsTotalCount
+  GetModelUploadsTotalCount,
+  UpdateFileStatus
 } from '@/modules/fileuploads/domain/operations'
 import {
   FileUploadConvertedStatus,
@@ -162,17 +163,19 @@ export const expireOldPendingUploadsFactory =
     const updatedRows = await deps
       .db(FileUploads.name)
       .whereIn(FileUploads.withoutTablePrefix.col.convertedStatus, [
-        FileUploadConvertedStatus.Converting,
-        FileUploadConvertedStatus.Queued
+        FileUploadConvertedStatus.Converting
       ])
       .andWhere(
-        FileUploads.withoutTablePrefix.col.uploadDate,
+        FileUploads.withoutTablePrefix.col.convertedLastUpdate,
         '<',
         deps.db.raw(`now() - interval '${params.timeoutThresholdSeconds} seconds'`)
       )
       .update({
         [FileUploads.withoutTablePrefix.col.convertedStatus]:
-          FileUploadConvertedStatus.Error
+          FileUploadConvertedStatus.Error,
+        [FileUploads.withoutTablePrefix.col.convertedMessage]:
+          'File import job timed out',
+        [FileUploads.withoutTablePrefix.col.convertedLastUpdate]: knex.fn.now()
       })
       .returning<FileUploadRecord[]>('*')
 
@@ -261,6 +264,30 @@ export const updateFileUploadFactory =
     return updatedFile[0]
   }
 
+export const updateFileStatusFactory =
+  (deps: { db: Knex }): UpdateFileStatus =>
+  async (params) => {
+    const updatedFile = await tables
+      .fileUploads(deps.db)
+      .update({
+        [FileUploads.withoutTablePrefix.col.convertedStatus]: params.status,
+        [FileUploads.withoutTablePrefix.col.convertedMessage]: params.convertedMessage,
+        [FileUploads.withoutTablePrefix.col.convertedCommitId]:
+          params.convertedCommitId,
+        [FileUploads.withoutTablePrefix.col.convertedLastUpdate]: knex.fn.now()
+      })
+      .where({
+        [FileUploads.withoutTablePrefix.col.id]: params.fileId,
+        [FileUploads.withoutTablePrefix.col.streamId]: params.projectId
+      })
+      .returning<FileUploadRecord[]>('*')
+
+    if (updatedFile.length === 0) {
+      throw new FileImportJobNotFoundError(`File with id ${params.fileId} not found`)
+    }
+    return updatedFile[0]
+  }
+
 const getModelUploadsBaseQueryFactory =
   (deps: { db: Knex }) => (params: GetModelUploadsBaseArgs) => {
     const { projectId, modelId } = params
diff --git a/packages/server/modules/fileuploads/rest/router.ts b/packages/server/modules/fileuploads/rest/router.ts
index 0ce8637fe..af6baa9e4 100644
--- a/packages/server/modules/fileuploads/rest/router.ts
+++ b/packages/server/modules/fileuploads/rest/router.ts
@@ -13,12 +13,18 @@ import { UnauthorizedError } from '@/modules/shared/errors'
 import { ensureError, Nullable } from '@speckle/shared'
 import { UploadRequestErrorMessage } from '@/modules/fileuploads/helpers/rest'
 import { getEventBus } from '@/modules/shared/services/eventBus'
+import { getFeatureFlags } from '@/modules/shared/helpers/envHelper'
+
+const { FF_LARGE_FILE_IMPORTS_ENABLED } = getFeatureFlags()
 
 export const fileuploadRouterFactory = (): Router => {
   const processNewFileStream = processNewFileStreamFactory()
 
   const app = Router()
 
+  /**
+   * @deprecated use POST /graphql (mutation.fileUploadMutations.generateUploadUrl), then PUT (to the provided url), then POST /graphql (mutation.fileUploadMutations.startFileImport)
+   */
   app.post(
     '/api/file/:fileType/:streamId/:branchName?',
     authMiddlewareCreator(
@@ -89,6 +95,14 @@ export const fileuploadRouterFactory = (): Router => {
             logger.error(ensureError(err), 'File importer handling error @deprecated')
             res.status(500)
           }
+
+          if (FF_LARGE_FILE_IMPORTS_ENABLED) {
+            res.setHeader(
+              'Warning',
+              'Deprecated API; use POST /graphql (mutation.fileUploadMutations.generateUploadUrl), then PUT (to the provided url), then POST /graphql (mutation.fileUploadMutations.startFileImport)'
+            )
+          }
+
           res.status(201).send({ uploadResults })
         },
         onError: () => {
diff --git a/packages/server/modules/fileuploads/services/requestHandler.ts b/packages/server/modules/fileuploads/services/requestHandler.ts
new file mode 100644
index 000000000..774bd57ac
--- /dev/null
+++ b/packages/server/modules/fileuploads/services/requestHandler.ts
@@ -0,0 +1,83 @@
+import { Logger } from '@/observability/logging'
+import { ActiveEventCallback, ErrorEventCallback, FailedEventCallback } from 'bull'
+import { UpdateFileStatusForProjectFactory } from '@/modules/fileuploads/domain/operations'
+import { JobPayload } from '@speckle/shared/workers/fileimport'
+import { FileUploadConvertedStatus } from '@speckle/shared/blobs'
+import { ensureError } from '@speckle/shared'
+
+export const requestActiveHandlerFactory =
+  (deps: {
+    logger: Logger
+    updateFileStatusBuilder: UpdateFileStatusForProjectFactory
+  }): ActiveEventCallback<JobPayload> =>
+  async (job) => {
+    deps.logger.info(
+      {
+        jobId: job.id,
+        projectId: job.data.projectId,
+        streamId: job.data.projectId, //legacy
+        fileName: job.data.fileName,
+        fileType: job.data.fileType,
+        blobId: job.data.blobId,
+        modelId: job.data.modelId
+      },
+      "File import job for file '${fileName}' accepted for project '${projectId} with file type '${fileType}'; updating status to 'Converting'."
+    )
+    const updateFileStatus = await deps.updateFileStatusBuilder({
+      projectId: job.data.projectId
+    })
+    await updateFileStatus({
+      fileId: job.data.blobId,
+      projectId: job.data.projectId,
+      status: FileUploadConvertedStatus.Converting,
+      convertedMessage: 'File import job accepted and converting started',
+      convertedCommitId: null
+    })
+  }
+
+export const requestErrorHandlerFactory =
+  (deps: { logger: Logger }): ErrorEventCallback =>
+  (e) => {
+    const err = ensureError(
+      e,
+      'File import job errored for unknown reason, likely a Redis, networking, or application configuration problem'
+    )
+    deps.logger.error({ err }, 'File import job errored (likely a Redis problem)')
+    // we do not have details about the job here, so we cannot update the file upload status
+  }
+
+export const requestFailedHandlerFactory =
+  (deps: {
+    logger: Logger
+    updateFileStatusForProjectFactory: UpdateFileStatusForProjectFactory
+  }): FailedEventCallback<JobPayload> =>
+  async (job, e) => {
+    const err = ensureError(
+      e,
+      'File import job failed for an unknown reason. This may occur if the worker was killed, memory was exhausted, or a bug in the parsing of the file occurred which caused the worker to crash.'
+    )
+    deps.logger.warn(
+      {
+        error: err,
+        jobId: job.id,
+        projectId: job.data.projectId,
+        streamId: job.data.projectId, //legacy
+        fileType: job.data.fileType,
+        fileName: job.data.fileName,
+        blobId: job.data.blobId,
+        modelId: job.data.modelId
+      },
+      "File import job for file '${fileName}' failed for ${projectId} with file type ${fileType}. Updating status to 'Error'."
+    )
+    const updateFileStatus = await deps.updateFileStatusForProjectFactory({
+      projectId: job.data.projectId
+    })
+
+    await updateFileStatus({
+      fileId: job.data.blobId,
+      projectId: job.data.projectId,
+      status: FileUploadConvertedStatus.Error,
+      convertedMessage: err.message,
+      convertedCommitId: null
+    })
+  }
diff --git a/packages/server/modules/fileuploads/tests/helpers/init.ts b/packages/server/modules/fileuploads/tests/helpers/init.ts
index d0eb408a7..bb894e7e8 100644
--- a/packages/server/modules/fileuploads/tests/helpers/init.ts
+++ b/packages/server/modules/fileuploads/tests/helpers/init.ts
@@ -4,6 +4,7 @@ import { getServerInfoFactory } from '@/modules/core/repositories/server'
 import {
   createStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import {
@@ -127,6 +128,7 @@ export const initUploadTestEnvironment = () => {
           validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
           getUser,
           grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+          getStreamRoles: getStreamRolesFactory({ db }),
           emitEvent: getEventBus().emit
         })
       }),
diff --git a/packages/server/modules/fileuploads/tests/integration/presigned.integration.spec.ts b/packages/server/modules/fileuploads/tests/integration/presigned.integration.spec.ts
index 5feb9a024..1a0977cfe 100644
--- a/packages/server/modules/fileuploads/tests/integration/presigned.integration.spec.ts
+++ b/packages/server/modules/fileuploads/tests/integration/presigned.integration.spec.ts
@@ -75,7 +75,7 @@ const { FF_LARGE_FILE_IMPORTS_ENABLED, FF_NEXT_GEN_FILE_IMPORTER_ENABLED } =
     }
 
     let projectDb: Knex
-    let projectStorage: ObjectStorage
+    let projectStorage: { private: ObjectStorage; public: ObjectStorage }
 
     before(async () => {
       await beforeEachContext()
@@ -112,7 +112,7 @@ const { FF_LARGE_FILE_IMPORTS_ENABLED, FF_NEXT_GEN_FILE_IMPORTER_ENABLED } =
       before(() => {
         generatePresignedUrl = generatePresignedUrlFactory({
           getSignedUrl: getSignedUrlFactory({
-            objectStorage: projectStorage
+            objectStorage: projectStorage.public
           }),
           upsertBlob: upsertBlobFactory({
             db: projectDb
@@ -152,7 +152,7 @@ const { FF_LARGE_FILE_IMPORTS_ENABLED, FF_NEXT_GEN_FILE_IMPORTER_ENABLED } =
           registerCompletedUpload: registerCompletedUploadFactory({
             getBlob: getBlobFactory({ db: projectDb }),
             getBlobMetadata: getBlobMetadataFromStorage({
-              objectStorage: projectStorage
+              objectStorage: projectStorage.public
             }),
             updateBlob: updateBlobFactory({
               db: projectDb
diff --git a/packages/server/modules/fileuploads/tests/unit/fileuploads.spec.ts b/packages/server/modules/fileuploads/tests/unit/fileuploads.spec.ts
index 257796c71..fffa802d2 100644
--- a/packages/server/modules/fileuploads/tests/unit/fileuploads.spec.ts
+++ b/packages/server/modules/fileuploads/tests/unit/fileuploads.spec.ts
@@ -3,7 +3,8 @@ import { db } from '@/db/knex'
 import {
   getFileInfoFactory,
   saveUploadFileFactory,
-  saveUploadFileFactoryV2
+  saveUploadFileFactoryV2,
+  updateFileStatusFactory
 } from '@/modules/fileuploads/repositories/fileUploads'
 import {
   insertNewUploadAndNotifyFactory,
@@ -57,6 +58,7 @@ describe('FileUploads @fileuploads', () => {
         saveUploadFile: saveUploadFileFactory({ db }),
         emit: async () => {}
       })
+      const updateFileStatus = updateFileStatusFactory({ db })
       const fileId = cryptoRandomString({ length: 10 })
       await insertNewUploadAndNotify({
         streamId: createdStreamId,
@@ -68,6 +70,13 @@ describe('FileUploads @fileuploads', () => {
         fileType: 'text/plain',
         modelId: null
       })
+      await updateFileStatus({
+        fileId,
+        projectId: createdStreamId,
+        status: FileUploadConvertedStatus.Converting,
+        convertedMessage: 'Converting started',
+        convertedCommitId: null
+      })
       await sleep(2000)
       await garbageCollector({ logger, timeoutThresholdSeconds: 1 })
       const results = await getFileInfoFactory({ db })({
diff --git a/packages/server/modules/gatekeeper/clients/stripe.ts b/packages/server/modules/gatekeeper/clients/stripe.ts
index 5438a1325..a799f06c6 100644
--- a/packages/server/modules/gatekeeper/clients/stripe.ts
+++ b/packages/server/modules/gatekeeper/clients/stripe.ts
@@ -41,7 +41,7 @@ export const createCustomerPortalUrlFactory =
     return session.url
   }
 
-export const getSubscriptionDataFactory =
+export const getStripeSubscriptionDataFactory =
   ({
     stripe
   }: // getWorkspacePlanPrice
@@ -92,9 +92,15 @@ export const parseSubscriptionData = (
 // this should be a reconcile subscriptions, we keep an accurate state in the DB
 // on each change, we're reconciling that state to stripe
 export const reconcileWorkspaceSubscriptionFactory =
-  ({ stripe }: { stripe: Stripe }): ReconcileSubscriptionData =>
+  ({
+    stripe,
+    getStripeSubscriptionData
+  }: {
+    stripe: Stripe
+    getStripeSubscriptionData: GetSubscriptionData
+  }): ReconcileSubscriptionData =>
   async ({ subscriptionData, prorationBehavior }) => {
-    const existingSubscriptionState = await getSubscriptionDataFactory({ stripe })({
+    const existingSubscriptionState = await getStripeSubscriptionData({
       subscriptionId: subscriptionData.subscriptionId
     })
     const items: Stripe.SubscriptionUpdateParams.Item[] = []
diff --git a/packages/server/modules/gatekeeper/errors/billing.ts b/packages/server/modules/gatekeeper/errors/billing.ts
index 4be2b0367..1027cf192 100644
--- a/packages/server/modules/gatekeeper/errors/billing.ts
+++ b/packages/server/modules/gatekeeper/errors/billing.ts
@@ -77,3 +77,9 @@ export class UnsupportedWorkspacePlanError extends BaseError {
   static code = 'UNSUPPORTED_WORKSPACE_PLAN_ERROR'
   static statusCode = 400
 }
+
+export class SubscriptionStateError extends BaseError {
+  static defaultMessage = 'Subscription has an unexpected state'
+  static code = 'SUBSCRIPTION_STATE_ERROR'
+  static statusCode = 500
+}
diff --git a/packages/server/modules/gatekeeper/events/eventListener.ts b/packages/server/modules/gatekeeper/events/eventListener.ts
index 172134118..87e92e0a9 100644
--- a/packages/server/modules/gatekeeper/events/eventListener.ts
+++ b/packages/server/modules/gatekeeper/events/eventListener.ts
@@ -1,4 +1,7 @@
-import { reconcileWorkspaceSubscriptionFactory } from '@/modules/gatekeeper/clients/stripe'
+import {
+  getStripeSubscriptionDataFactory,
+  reconcileWorkspaceSubscriptionFactory
+} from '@/modules/gatekeeper/clients/stripe'
 import {
   getWorkspacePlanFactory,
   getWorkspaceSubscriptionFactory,
@@ -28,7 +31,8 @@ export const initializeEventListenersFactory =
             getWorkspacePlanPriceId,
             getWorkspacePlanProductId,
             reconcileSubscriptionData: reconcileWorkspaceSubscriptionFactory({
-              stripe
+              stripe,
+              getStripeSubscriptionData: getStripeSubscriptionDataFactory({ stripe })
             }),
             upsertWorkspaceSubscription: upsertWorkspaceSubscriptionFactory({ db }),
             countSeatsByTypeInWorkspace: countSeatsByTypeInWorkspaceFactory({ db })
diff --git a/packages/server/modules/gatekeeper/graph/resolvers/index.ts b/packages/server/modules/gatekeeper/graph/resolvers/index.ts
index 92e9349e9..163cfd1b8 100644
--- a/packages/server/modules/gatekeeper/graph/resolvers/index.ts
+++ b/packages/server/modules/gatekeeper/graph/resolvers/index.ts
@@ -17,6 +17,7 @@ import { db } from '@/db/knex'
 import {
   createCustomerPortalUrlFactory,
   getRecurringPricesFactory,
+  getStripeSubscriptionDataFactory,
   reconcileWorkspaceSubscriptionFactory
 } from '@/modules/gatekeeper/clients/stripe'
 import {
@@ -54,12 +55,12 @@ import {
 import { assignWorkspaceSeatFactory } from '@/modules/workspaces/services/workspaceSeat'
 import { getEventBus } from '@/modules/shared/services/eventBus'
 import { getTotalSeatsCountByPlanFactory } from '@/modules/gatekeeper/services/subscriptions'
-import { queryAllWorkspaceProjectsFactory } from '@/modules/workspaces/services/projects'
 import { legacyGetStreamsFactory } from '@/modules/core/repositories/streams'
 import { getWorkspaceModelCountFactory } from '@/modules/workspaces/services/workspaceLimits'
 import { getProjectDbClient } from '@/modules/multiregion/utils/dbSelector'
 import { getPaginatedProjectModelsTotalCountFactory } from '@/modules/core/repositories/branches'
 import { withOperationLogging } from '@/observability/domain/businessLogging'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const { FF_GATEKEEPER_MODULE_ENABLED, FF_BILLING_INTEGRATION_ENABLED } =
   getFeatureFlags()
@@ -206,7 +207,7 @@ export = FF_GATEKEEPER_MODULE_ENABLED
           const { workspaceId } = parent
 
           return await getWorkspaceModelCountFactory({
-            queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
+            queryAllProjects: queryAllProjectsFactory({
               getStreams: legacyGetStreamsFactory({ db })
             }),
             getPaginatedProjectModelsTotalCount: async (projectId, params) => {
@@ -458,7 +459,8 @@ export = FF_GATEKEEPER_MODULE_ENABLED
           const upgradeWorkspaceSubscription = upgradeWorkspaceSubscriptionFactory({
             getWorkspacePlan: getWorkspacePlanFactory({ db }),
             reconcileSubscriptionData: reconcileWorkspaceSubscriptionFactory({
-              stripe
+              stripe,
+              getStripeSubscriptionData: getStripeSubscriptionDataFactory({ stripe })
             }),
             countSeatsByTypeInWorkspace: countSeatsByTypeInWorkspaceFactory({
               db
diff --git a/packages/server/modules/gatekeeper/index.ts b/packages/server/modules/gatekeeper/index.ts
index 4ae390414..9b7cd22e5 100644
--- a/packages/server/modules/gatekeeper/index.ts
+++ b/packages/server/modules/gatekeeper/index.ts
@@ -25,7 +25,7 @@ import {
   upsertWorkspaceSubscriptionFactory
 } from '@/modules/gatekeeper/repositories/billing'
 import {
-  getSubscriptionDataFactory,
+  getStripeSubscriptionDataFactory,
   reconcileWorkspaceSubscriptionFactory
 } from '@/modules/gatekeeper/clients/stripe'
 import { ScheduleExecution } from '@/modules/core/domain/scheduledTasks/operations'
@@ -53,17 +53,21 @@ const scheduleWorkspaceSubscriptionDownscale = ({
   scheduleExecution: ScheduleExecution
 }) => {
   const stripe = getStripeClient()
+  const getStripeSubscriptionData = getStripeSubscriptionDataFactory({ stripe })
   const manageSubscriptionDownscale = manageSubscriptionDownscaleFactory({
     downscaleWorkspaceSubscription: downscaleWorkspaceSubscriptionFactory({
       countSeatsByTypeInWorkspace: countSeatsByTypeInWorkspaceFactory({ db }),
       getWorkspacePlan: getWorkspacePlanFactory({ db }),
-      reconcileSubscriptionData: reconcileWorkspaceSubscriptionFactory({ stripe }),
+      reconcileSubscriptionData: reconcileWorkspaceSubscriptionFactory({
+        stripe,
+        getStripeSubscriptionData
+      }),
       getWorkspacePlanProductId
     }),
     getWorkspaceSubscriptions: getWorkspaceSubscriptionsPastBillingCycleEndFactory({
       db
     }),
-    getSubscriptionData: getSubscriptionDataFactory({ stripe }),
+    getStripeSubscriptionData,
     updateWorkspaceSubscription: upsertWorkspaceSubscriptionFactory({ db })
   })
 
diff --git a/packages/server/modules/gatekeeper/rest/billing.ts b/packages/server/modules/gatekeeper/rest/billing.ts
index cf4105697..5cc57e3cd 100644
--- a/packages/server/modules/gatekeeper/rest/billing.ts
+++ b/packages/server/modules/gatekeeper/rest/billing.ts
@@ -5,7 +5,7 @@ import { getStripeEndpointSigningKey } from '@/modules/shared/helpers/envHelper'
 import { db } from '@/db/knex'
 import { completeCheckoutSessionFactory } from '@/modules/gatekeeper/services/checkout'
 import {
-  getSubscriptionDataFactory,
+  getStripeSubscriptionDataFactory,
   parseSubscriptionData
 } from '@/modules/gatekeeper/clients/stripe'
 import {
@@ -132,7 +132,7 @@ export const getBillingRouter = (): Router => {
                     }),
                     getWorkspacePlan: getWorkspacePlanFactory({ db }),
                     getWorkspaceSubscription: getWorkspaceSubscriptionFactory({ db }),
-                    getSubscriptionData: getSubscriptionDataFactory({
+                    getSubscriptionData: getStripeSubscriptionDataFactory({
                       stripe
                     }),
                     emitEvent: emit
@@ -256,7 +256,7 @@ const getSubscriptionFromEventFactory =
       return null
     }
     if (typeof subscription === 'string') {
-      return await getSubscriptionDataFactory({ stripe })({
+      return await getStripeSubscriptionDataFactory({ stripe })({
         subscriptionId: subscription
       })
     }
diff --git a/packages/server/modules/gatekeeper/services/subscriptions/manageSubscriptionDownscale.ts b/packages/server/modules/gatekeeper/services/subscriptions/manageSubscriptionDownscale.ts
index e427c44c7..7c1dd5f2a 100644
--- a/packages/server/modules/gatekeeper/services/subscriptions/manageSubscriptionDownscale.ts
+++ b/packages/server/modules/gatekeeper/services/subscriptions/manageSubscriptionDownscale.ts
@@ -65,6 +65,7 @@ export const downscaleWorkspaceSubscriptionFactory =
     })
 
     const subscriptionData = cloneDeep(workspaceSubscription.subscriptionData)
+
     mutateSubscriptionDataWithNewValidSeatNumbers({
       seatCount: editorsCount,
       workspacePlan: workspacePlan.name,
@@ -86,12 +87,12 @@ export const manageSubscriptionDownscaleFactory =
     getWorkspaceSubscriptions,
     downscaleWorkspaceSubscription,
     updateWorkspaceSubscription,
-    getSubscriptionData
+    getStripeSubscriptionData
   }: {
     getWorkspaceSubscriptions: GetWorkspaceSubscriptions
     downscaleWorkspaceSubscription: DownscaleWorkspaceSubscription
     updateWorkspaceSubscription: UpsertWorkspaceSubscription
-    getSubscriptionData: GetSubscriptionData
+    getStripeSubscriptionData: GetSubscriptionData
   }) =>
   async (context: { logger: Logger }) => {
     const { logger } = context
@@ -110,9 +111,15 @@ export const manageSubscriptionDownscaleFactory =
           log.info('Did not need to downscale the workspace subscription')
         }
       } catch (err) {
-        log.error({ err }, 'Failed to downscale workspace subscription')
+        log.error(
+          {
+            err,
+            workspaceId: workspaceSubscription.workspaceId
+          },
+          'Failed to downscale workspace subscription'
+        )
       }
-      const subscriptionData = await getSubscriptionData(
+      const subscriptionData = await getStripeSubscriptionData(
         workspaceSubscription.subscriptionData
       )
       const updatedWorkspaceSubscription = {
diff --git a/packages/server/modules/gatekeeper/services/subscriptions/mutateSubscriptionDataWithNewValidSeatNumbers.ts b/packages/server/modules/gatekeeper/services/subscriptions/mutateSubscriptionDataWithNewValidSeatNumbers.ts
index b8c13fddb..a92039a88 100644
--- a/packages/server/modules/gatekeeper/services/subscriptions/mutateSubscriptionDataWithNewValidSeatNumbers.ts
+++ b/packages/server/modules/gatekeeper/services/subscriptions/mutateSubscriptionDataWithNewValidSeatNumbers.ts
@@ -4,6 +4,7 @@ import {
 } from '@/modules/gatekeeper/domain/billing'
 import { WorkspacePricingProducts } from '@/modules/gatekeeperCore/domain/billing'
 import { LogicError } from '@/modules/shared/errors'
+import { SubscriptionStateError } from '@/modules/gatekeeper/errors/billing'
 
 export const mutateSubscriptionDataWithNewValidSeatNumbers = ({
   seatCount,
@@ -20,15 +21,25 @@ export const mutateSubscriptionDataWithNewValidSeatNumbers = ({
   const product = subscriptionData.products.find(
     (product) => product.productId === productId
   )
-  if (seatCount < 0) throw new LogicError('Invalid seat count, cannot be negative')
 
-  if (seatCount === 0 && product === undefined) return
-  if (seatCount === 0 && product !== undefined) {
+  if (product === undefined && seatCount === 0) return
+  if (product === undefined) {
+    throw new LogicError('Product not found at mutation')
+  }
+
+  if (seatCount < 0) {
+    throw new LogicError('Invalid seat count, cannot be negative')
+  }
+
+  if (product.quantity < seatCount) {
+    throw new SubscriptionStateError('Subscription missing an upscale')
+  }
+
+  if (seatCount === 0) {
     const prodIndex = subscriptionData.products.indexOf(product)
     subscriptionData.products.splice(prodIndex, 1)
-  } else if (product !== undefined && product.quantity >= seatCount) {
-    product.quantity = seatCount
-  } else {
-    throw new LogicError('Invalid subscription state')
+    return
   }
+
+  product.quantity = seatCount
 }
diff --git a/packages/server/modules/gatekeeper/tests/helpers/stripe.ts b/packages/server/modules/gatekeeper/tests/helpers/stripe.ts
new file mode 100644
index 000000000..5b214a94b
--- /dev/null
+++ b/packages/server/modules/gatekeeper/tests/helpers/stripe.ts
@@ -0,0 +1,11 @@
+import Stripe from 'stripe'
+
+export const buildFakeStripe = (updates: Record<string, unknown> = {}): Stripe => {
+  return {
+    subscriptions: {
+      update: async (subscriptionId: string, params?: unknown) => {
+        updates[subscriptionId] = params
+      }
+    }
+  } as unknown as Stripe
+}
diff --git a/packages/server/modules/gatekeeper/tests/unit/stripe.spec.ts b/packages/server/modules/gatekeeper/tests/unit/stripe.spec.ts
new file mode 100644
index 000000000..3fb59a018
--- /dev/null
+++ b/packages/server/modules/gatekeeper/tests/unit/stripe.spec.ts
@@ -0,0 +1,141 @@
+import { buildFakeStripe } from '@/modules/gatekeeper/tests/helpers/stripe'
+import cryptoRandomString from 'crypto-random-string'
+import {
+  buildTestSubscriptionData,
+  buildTestSubscriptionProduct
+} from '@/modules/gatekeeper/tests/helpers/workspacePlan'
+import { reconcileWorkspaceSubscriptionFactory } from '@/modules/gatekeeper/clients/stripe'
+import { expect } from 'chai'
+
+describe('Stripe integration', () => {
+  describe('Reconciliation', () => {
+    it('does not send any delete or create anything in Stripe when existing subscription equals to the new one', async () => {
+      const updates = {}
+      const subscriptionId = cryptoRandomString({ length: 10 })
+      const subscriptionItemId = cryptoRandomString({ length: 10 })
+      const fakeStripe = buildFakeStripe(updates)
+      const subscriptionData = buildTestSubscriptionData({
+        subscriptionId,
+        products: [
+          buildTestSubscriptionProduct({
+            subscriptionItemId,
+            quantity: 2
+          })
+        ]
+      })
+      const reconcileWorkspaceSubscription = reconcileWorkspaceSubscriptionFactory({
+        stripe: fakeStripe,
+        getStripeSubscriptionData: async () => subscriptionData
+      })
+
+      await reconcileWorkspaceSubscription({
+        subscriptionData,
+        prorationBehavior: 'none'
+      })
+
+      expect(updates).to.be.deep.equal({
+        [subscriptionId]: {
+          items: [{ quantity: 2, id: subscriptionItemId }],
+          // eslint-disable-next-line camelcase
+          proration_behavior: 'none'
+        }
+      })
+    })
+
+    it('deletes the current products and adds only the needed when stripe has more products than we provided', async () => {
+      const updates = {}
+      const subscriptionId = cryptoRandomString({ length: 10 })
+      const priceId = cryptoRandomString({ length: 10 })
+      const subscriptionItemId = cryptoRandomString({ length: 10 })
+      const fakeStripe = buildFakeStripe(updates)
+      const subscriptionData = buildTestSubscriptionData({
+        subscriptionId,
+        products: [
+          buildTestSubscriptionProduct({
+            priceId,
+            subscriptionItemId,
+            quantity: 1
+          })
+        ]
+      })
+      const reconcileWorkspaceSubscription = reconcileWorkspaceSubscriptionFactory({
+        stripe: fakeStripe,
+        getStripeSubscriptionData: async () =>
+          buildTestSubscriptionData({
+            subscriptionId,
+            products: [
+              buildTestSubscriptionProduct({
+                priceId,
+                subscriptionItemId,
+                quantity: 2
+              })
+            ]
+          })
+      })
+
+      await reconcileWorkspaceSubscription({
+        subscriptionData,
+        prorationBehavior: 'none'
+      })
+
+      expect(updates).to.be.deep.equal({
+        [subscriptionId]: {
+          items: [
+            { quantity: 1, price: priceId },
+            { deleted: true, id: subscriptionItemId }
+          ],
+          // eslint-disable-next-line camelcase
+          proration_behavior: 'none'
+        }
+      })
+    })
+
+    it('deletes the current products and ads new ones when stripe has less products than we provided', async () => {
+      const updates = {}
+      const subscriptionId = cryptoRandomString({ length: 10 })
+      const priceId = cryptoRandomString({ length: 10 })
+      const subscriptionItemId = cryptoRandomString({ length: 10 })
+      const fakeStripe = buildFakeStripe(updates)
+      const subscriptionData = buildTestSubscriptionData({
+        subscriptionId,
+        products: [
+          buildTestSubscriptionProduct({
+            priceId,
+            subscriptionItemId,
+            quantity: 3
+          })
+        ]
+      })
+      const reconcileWorkspaceSubscription = reconcileWorkspaceSubscriptionFactory({
+        stripe: fakeStripe,
+        getStripeSubscriptionData: async () =>
+          buildTestSubscriptionData({
+            subscriptionId,
+            products: [
+              buildTestSubscriptionProduct({
+                priceId,
+                subscriptionItemId,
+                quantity: 2
+              })
+            ]
+          })
+      })
+
+      await reconcileWorkspaceSubscription({
+        subscriptionData,
+        prorationBehavior: 'none'
+      })
+
+      expect(updates).to.be.deep.equal({
+        [subscriptionId]: {
+          items: [
+            { quantity: 3, price: priceId },
+            { deleted: true, id: subscriptionItemId }
+          ],
+          // eslint-disable-next-line camelcase
+          proration_behavior: 'none'
+        }
+      })
+    })
+  })
+})
diff --git a/packages/server/modules/gatekeeper/tests/unit/subscriptions.spec.ts b/packages/server/modules/gatekeeper/tests/unit/subscriptions.spec.ts
index 226dad693..3534f42a6 100644
--- a/packages/server/modules/gatekeeper/tests/unit/subscriptions.spec.ts
+++ b/packages/server/modules/gatekeeper/tests/unit/subscriptions.spec.ts
@@ -30,6 +30,7 @@ import { omit } from 'lodash'
 import { upgradeWorkspaceSubscriptionFactory } from '@/modules/gatekeeper/services/subscriptions/upgradeWorkspaceSubscription'
 import { EventBusEmit } from '@/modules/shared/services/eventBus'
 import { testLogger } from '@/observability/logging'
+import { mutateSubscriptionDataWithNewValidSeatNumbers } from '@/modules/gatekeeper/services/subscriptions/mutateSubscriptionDataWithNewValidSeatNumbers'
 
 describe('subscriptions @gatekeeper', () => {
   describe('handleSubscriptionUpdateFactory creates a function, that', () => {
@@ -811,6 +812,93 @@ describe('subscriptions @gatekeeper', () => {
     })
   })
 
+  describe('mutateSubscriptionDataWithNewValidSeats', () => {
+    it('can totally downscale the subscription', () => {
+      const desiredSeatCount = 0
+      const productId = cryptoRandomString({ length: 10 })
+      const priceId = cryptoRandomString({ length: 10 })
+      const subscriptionItemId = cryptoRandomString({ length: 10 })
+      const currentQuantity = 2
+      const subscriptionData = createTestSubscriptionData({
+        products: [
+          { priceId, productId, quantity: currentQuantity, subscriptionItemId }
+        ]
+      })
+
+      mutateSubscriptionDataWithNewValidSeatNumbers({
+        seatCount: desiredSeatCount,
+        workspacePlan: PaidWorkspacePlans.Team,
+        getWorkspacePlanProductId: () => productId,
+        subscriptionData
+      })
+
+      expect(subscriptionData.products).to.has.lengthOf(0)
+    })
+
+    it('mutates the quantity when the count is less than the one given', () => {
+      const desiredSeatCount = 5
+      const productId = cryptoRandomString({ length: 10 })
+      const priceId = cryptoRandomString({ length: 10 })
+      const subscriptionItemId = cryptoRandomString({ length: 10 })
+      const currentQuantity = 10
+      const subscriptionData = createTestSubscriptionData({
+        products: [
+          { priceId, productId, quantity: currentQuantity, subscriptionItemId }
+        ]
+      })
+
+      mutateSubscriptionDataWithNewValidSeatNumbers({
+        seatCount: desiredSeatCount,
+        workspacePlan: PaidWorkspacePlans.Team,
+        getWorkspacePlanProductId: () => productId,
+        subscriptionData
+      })
+
+      expect(subscriptionData.products[0].quantity).to.be.equal(desiredSeatCount)
+    })
+
+    it('throws an exception to notify that instead of downscale, a subscription is broken and an upscale is required', () => {
+      const desiredSeatCount = 10
+      const currentQuantity = 5
+      const productId = cryptoRandomString({ length: 10 })
+      const priceId = cryptoRandomString({ length: 10 })
+      const subscriptionItemId = cryptoRandomString({ length: 10 })
+      const subscriptionData = createTestSubscriptionData({
+        products: [
+          { priceId, productId, quantity: currentQuantity, subscriptionItemId }
+        ]
+      })
+
+      const mutation = () =>
+        mutateSubscriptionDataWithNewValidSeatNumbers({
+          seatCount: desiredSeatCount,
+          workspacePlan: PaidWorkspacePlans.Team,
+          getWorkspacePlanProductId: () => productId,
+          subscriptionData
+        })
+
+      expect(mutation).to.throw('Subscription missing an upscale')
+    })
+
+    it('throws an exception when the subscription is malformed', () => {
+      const desiredSeatCount = 10
+      const productId = cryptoRandomString({ length: 10 })
+      const subscriptionData = createTestSubscriptionData({
+        products: []
+      })
+
+      const mutation = () =>
+        mutateSubscriptionDataWithNewValidSeatNumbers({
+          seatCount: desiredSeatCount,
+          workspacePlan: PaidWorkspacePlans.Team,
+          getWorkspacePlanProductId: () => productId,
+          subscriptionData
+        })
+
+      expect(mutation).to.throw('Product not found at mutation')
+    })
+  })
+
   describe('downscaleWorkspaceSubscriptionFactory creates a function, that', () => {
     it('throws an error if the workspace has no plan attached to it', async () => {
       const subscriptionData = createTestSubscriptionData()
diff --git a/packages/server/modules/gendo/graph/resolvers/index.ts b/packages/server/modules/gendo/graph/resolvers/index.ts
index 3924b4912..9515a53f8 100644
--- a/packages/server/modules/gendo/graph/resolvers/index.ts
+++ b/packages/server/modules/gendo/graph/resolvers/index.ts
@@ -119,7 +119,9 @@ export = FF_GENDOAI_MODULE_ENABLED
             token: getGendoAIKey()
           })
 
-          const storeFileStream = storeFileStreamFactory({ storage: projectStorage })
+          const storeFileStream = storeFileStreamFactory({
+            storage: projectStorage.private
+          })
           const createRenderRequest = createRenderRequestFactory({
             uploadFileStream: uploadFileStreamFactory({
               storeFileStream,
diff --git a/packages/server/modules/gendo/rest/index.ts b/packages/server/modules/gendo/rest/index.ts
index 20251890a..587d8b272 100644
--- a/packages/server/modules/gendo/rest/index.ts
+++ b/packages/server/modules/gendo/rest/index.ts
@@ -59,7 +59,9 @@ export default function (app: express.Express) {
         getProjectObjectStorage({ projectId })
       ])
 
-      const storeFileStream = storeFileStreamFactory({ storage: projectStorage })
+      const storeFileStream = storeFileStreamFactory({
+        storage: projectStorage.private
+      })
       const updateRenderRequest = updateRenderRequestFactory({
         getRenderByGenerationId: getRenderByGenerationIdFactory({ db: projectDb }),
         uploadFileStream: uploadFileStreamFactory({
diff --git a/packages/server/modules/multiregion/domain/operations.ts b/packages/server/modules/multiregion/domain/operations.ts
index 7dffb8114..ac79ee302 100644
--- a/packages/server/modules/multiregion/domain/operations.ts
+++ b/packages/server/modules/multiregion/domain/operations.ts
@@ -64,8 +64,8 @@ export type UpdateAndValidateRegion = (params: {
 
 export type GetProjectObjectStorage = (args: {
   projectId: string
-}) => Promise<ObjectStorage>
+}) => Promise<{ private: ObjectStorage; public: ObjectStorage }>
 
 export type GetRegionObjectStorage = (args: {
   regionKey: string
-}) => Promise<ObjectStorage>
+}) => Promise<{ private: ObjectStorage; public: ObjectStorage }>
diff --git a/packages/server/modules/multiregion/services/queue.ts b/packages/server/modules/multiregion/services/queue.ts
index ca57e3a80..277de80e5 100644
--- a/packages/server/modules/multiregion/services/queue.ts
+++ b/packages/server/modules/multiregion/services/queue.ts
@@ -165,9 +165,11 @@ export const startQueue = async () => {
         const { projectId, regionKey } = job.data.payload
 
         const sourceDb = await getProjectDbClient({ projectId })
-        const sourceObjectStorage = await getProjectObjectStorage({ projectId })
+        const sourceObjectStorage = (await getProjectObjectStorage({ projectId }))
+          .private
         const targetDb = await getRegionDb({ regionKey })
-        const targetObjectStorage = await getRegionObjectStorage({ regionKey })
+        const targetObjectStorage = (await getRegionObjectStorage({ regionKey }))
+          .private
 
         // Move project to target region
         const project = await withTransaction(
diff --git a/packages/server/modules/multiregion/tests/e2e/serverAdmin.graph.spec.ts b/packages/server/modules/multiregion/tests/e2e/serverAdmin.graph.spec.ts
index 96f56c821..bdce57304 100644
--- a/packages/server/modules/multiregion/tests/e2e/serverAdmin.graph.spec.ts
+++ b/packages/server/modules/multiregion/tests/e2e/serverAdmin.graph.spec.ts
@@ -74,7 +74,9 @@ isEnabled
           Promise.resolve()
         )
         MultiRegionBlobStorageSelectorMock.mockFunction('initializeRegion', async () =>
-          Promise.resolve(undefined as unknown as ObjectStorage)
+          Promise.resolve(
+            undefined as unknown as { private: ObjectStorage; public: ObjectStorage }
+          )
         )
 
         await beforeEachContext()
diff --git a/packages/server/modules/multiregion/utils/blobStorageSelector.ts b/packages/server/modules/multiregion/utils/blobStorageSelector.ts
index ddc0d0c9a..29d6c852b 100644
--- a/packages/server/modules/multiregion/utils/blobStorageSelector.ts
+++ b/packages/server/modules/multiregion/utils/blobStorageSelector.ts
@@ -1,6 +1,7 @@
 import {
   getMainObjectStorage,
   getObjectStorage,
+  getPublicMainObjectStorage,
   ObjectStorage
 } from '@/modules/blobstorage/clients/objectStorage'
 import { ensureStorageAccessFactory } from '@/modules/blobstorage/repositories/blobs'
@@ -20,7 +21,7 @@ import { Optional } from '@speckle/shared'
 import { BlobStorageConfig } from '@speckle/shared/environment/db'
 
 type RegionStorageClients = {
-  [regionKey: string]: ObjectStorage
+  [regionKey: string]: { private: ObjectStorage; public: ObjectStorage }
 }
 
 let initializedClients: Optional<RegionStorageClients> = undefined
@@ -36,7 +37,8 @@ export const initializeRegion = async (params: {
    */
   config?: BlobStorageConfig
 }) => {
-  if (!isMultiRegionBlobStorageEnabled()) return getMainObjectStorage()
+  if (!isMultiRegionBlobStorageEnabled())
+    return { private: getMainObjectStorage(), public: getPublicMainObjectStorage() }
 
   const { regionKey } = params
   let config = params.config
@@ -66,10 +68,33 @@ export const initializeRegion = async (params: {
 
   // Only add, if clients already initialized
   if (initializedClients) {
-    initializedClients[regionKey] = storage
+    initializedClients[regionKey] = { private: storage, public: storage }
   }
 
-  return storage
+  if (config.publicEndpoint) {
+    const publicStorage = getObjectStorage({
+      credentials: {
+        accessKeyId: config.accessKey,
+        secretAccessKey: config.secretKey
+      },
+      endpoint: config.publicEndpoint,
+      region: config.s3Region,
+      bucket: config.bucket
+    })
+
+    // ensure it works
+    const ensure = ensureStorageAccessFactory({ storage: publicStorage })
+    await ensure({ createBucketIfNotExists: config.createBucketIfNotExists })
+
+    // Only add, if clients already initialized
+    if (initializedClients) {
+      initializedClients[regionKey] = { private: storage, public: publicStorage }
+    }
+
+    return { private: storage, public: publicStorage }
+  }
+
+  return { private: storage, public: storage }
 }
 
 /**
@@ -99,7 +124,8 @@ export const getRegisteredRegionClients = async (): Promise<RegionStorageClients
 }
 
 export const getRegionObjectStorage: GetRegionObjectStorage = async ({ regionKey }) => {
-  if (!isMultiRegionBlobStorageEnabled()) return getMainObjectStorage()
+  if (!isMultiRegionBlobStorageEnabled())
+    return { private: getMainObjectStorage(), public: getPublicMainObjectStorage() }
 
   const clients = await getRegisteredRegionClients()
   let storage = clients[regionKey]
@@ -123,5 +149,7 @@ export const getProjectObjectStorage: GetProjectObjectStorage = async ({
   projectId
 }) => {
   const regionKey = await getProjectRegionKey({ projectId })
-  return regionKey ? getRegionObjectStorage({ regionKey }) : getMainObjectStorage()
+  return regionKey
+    ? getRegionObjectStorage({ regionKey })
+    : { private: getMainObjectStorage(), public: getPublicMainObjectStorage() }
 }
diff --git a/packages/server/modules/notifications/services/handlers/activityDigest.ts b/packages/server/modules/notifications/services/handlers/activityDigest.ts
index 162fc5c68..198f056d7 100644
--- a/packages/server/modules/notifications/services/handlers/activityDigest.ts
+++ b/packages/server/modules/notifications/services/handlers/activityDigest.ts
@@ -25,7 +25,7 @@ import {
   StreamActivitySummary
 } from '@/modules/activitystream/domain/types'
 import { createActivitySummaryFactory } from '@/modules/activitystream/services/summary'
-import { getActivityFactory } from '@/modules/activitystream/repositories'
+import { geUserStreamActivityFactory } from '@/modules/activitystream/repositories'
 import { getStreamFactory } from '@/modules/core/repositories/streams'
 import { getUserFactory } from '@/modules/core/repositories/users'
 import { GetServerInfo } from '@/modules/core/domain/server/operations'
@@ -439,7 +439,7 @@ const digestNotificationEmailHandler = digestNotificationEmailHandlerFactory({
   }),
   createActivitySummary: createActivitySummaryFactory({
     getStream: getStreamFactory({ db }),
-    getActivity: getActivityFactory({ db }),
+    getActivity: geUserStreamActivityFactory({ db }),
     getUser: getUserFactory({ db })
   }),
   getServerInfo: getServerInfoFactory({ db }),
diff --git a/packages/server/modules/previews/clients/bull.ts b/packages/server/modules/previews/clients/bull.ts
index e75e9fc6d..917324cfa 100644
--- a/packages/server/modules/previews/clients/bull.ts
+++ b/packages/server/modules/previews/clients/bull.ts
@@ -1,4 +1,9 @@
-import { Queue, type Job } from 'bull'
+import type {
+  ActiveEventCallback,
+  ErrorEventCallback,
+  FailedEventCallback,
+  Queue
+} from 'bull'
 import type { EventEmitter } from 'stream'
 import { initializeQueue } from '@speckle/shared/queue'
 import { JobPayload, PreviewResultPayload } from '@speckle/shared/workers/previews'
@@ -35,9 +40,9 @@ const defaultJobOptions = {
 
 export const addRequestQueueListeners = (params: {
   requestQueue: QueueEventEmitter
-  requestErrorHandler: (err: Error) => void
-  requestFailedHandler: (job: Job, err: Error) => void
-  requestActiveHandler: (job: Job) => void
+  requestErrorHandler: ErrorEventCallback
+  requestFailedHandler: FailedEventCallback
+  requestActiveHandler: ActiveEventCallback
 }) => {
   const {
     requestQueue,
@@ -63,9 +68,9 @@ export const createRequestAndResponseQueues = async (params: {
   redisUrl: string
   requestQueueName: string
   responseQueueName: string
-  requestErrorHandler: (err: Error) => void
-  requestFailedHandler: (job: Job, err: Error) => void
-  requestActiveHandler: (job: Job) => void
+  requestErrorHandler: ErrorEventCallback
+  requestFailedHandler: FailedEventCallback
+  requestActiveHandler: ActiveEventCallback
 }): Promise<{
   requestQueue: Queue<JobPayload>
   responseQueue: Queue<PreviewResultPayload>
diff --git a/packages/server/modules/serverinvites/graph/resolvers/serverInvites.ts b/packages/server/modules/serverinvites/graph/resolvers/serverInvites.ts
index 3c2618a73..744c5eb57 100644
--- a/packages/server/modules/serverinvites/graph/resolvers/serverInvites.ts
+++ b/packages/server/modules/serverinvites/graph/resolvers/serverInvites.ts
@@ -71,6 +71,7 @@ import { renderEmail } from '@/modules/emails/services/emailRendering'
 import { sendEmail } from '@/modules/emails/services/sending'
 import {
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import {
@@ -91,6 +92,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 const getServerInfo = getServerInfoFactory({ db })
diff --git a/packages/server/modules/shared/helpers/envHelper.ts b/packages/server/modules/shared/helpers/envHelper.ts
index 4da4b9798..7d4a9d501 100644
--- a/packages/server/modules/shared/helpers/envHelper.ts
+++ b/packages/server/modules/shared/helpers/envHelper.ts
@@ -125,6 +125,10 @@ export const previewServiceShouldUsePrivateObjectsServerUrl = (): boolean => {
   return getBooleanFromEnv('PREVIEW_SERVICE_USE_PRIVATE_OBJECTS_SERVER_URL')
 }
 
+export const fileImportServiceShouldUsePrivateObjectsServerUrl = (): boolean => {
+  return getBooleanFromEnv('FILEIMPORT_SERVICE_USE_PRIVATE_OBJECTS_SERVER_URL')
+}
+
 export const getFileImportServiceRhinoParserRedisUrl = (): string | undefined => {
   return getStringFromEnv('FILEIMPORT_SERVICE_RHINO_REDIS_URL', { unsafe: true })
 }
@@ -429,6 +433,10 @@ export function getS3Endpoint() {
   return getStringFromEnv('S3_ENDPOINT')
 }
 
+export function getS3PublicEndpoint() {
+  return getStringFromEnv('S3_PUBLIC_ENDPOINT', { unsafe: true })
+}
+
 export function getS3Region(aDefault: string = 'us-east-1') {
   return process.env.S3_REGION || aDefault
 }
diff --git a/packages/server/modules/shared/helpers/errorHelper.ts b/packages/server/modules/shared/helpers/errorHelper.ts
index 5fe0836d3..93f006046 100644
--- a/packages/server/modules/shared/helpers/errorHelper.ts
+++ b/packages/server/modules/shared/helpers/errorHelper.ts
@@ -41,7 +41,7 @@ export const mapAuthToServerError = (e: Authz.AllAuthErrors): BaseError => {
     case Authz.WorkspaceProjectMoveInvalidError.code:
     case Authz.CommentNoAccessError.code:
     case Authz.ProjectNotEnoughPermissionsError.code:
-    case Authz.WorkspaceNoFeatureAccessError.code:
+    case Authz.WorkspacePlanNoFeatureAccessError.code:
     case Authz.EligibleForExclusiveWorkspaceError.code:
       return new ForbiddenError(e.message)
     case Authz.WorkspaceSsoSessionNoAccessError.code:
diff --git a/packages/server/modules/stats/tests/stats.spec.ts b/packages/server/modules/stats/tests/stats.spec.ts
index e8aa12d0a..c557df72f 100644
--- a/packages/server/modules/stats/tests/stats.spec.ts
+++ b/packages/server/modules/stats/tests/stats.spec.ts
@@ -27,6 +27,7 @@ import {
 import {
   createStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory,
   markCommitStreamUpdatedFactory
 } from '@/modules/core/repositories/streams'
@@ -127,6 +128,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/webhooks/tests/cleanup.spec.ts b/packages/server/modules/webhooks/tests/cleanup.spec.ts
index 3fe486d96..cd637832c 100644
--- a/packages/server/modules/webhooks/tests/cleanup.spec.ts
+++ b/packages/server/modules/webhooks/tests/cleanup.spec.ts
@@ -8,6 +8,7 @@ import { getServerInfoFactory } from '@/modules/core/repositories/server'
 import {
   createStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import {
@@ -87,6 +88,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/webhooks/tests/webhooks.spec.ts b/packages/server/modules/webhooks/tests/webhooks.spec.ts
index e1028e7af..d1b4072fb 100644
--- a/packages/server/modules/webhooks/tests/webhooks.spec.ts
+++ b/packages/server/modules/webhooks/tests/webhooks.spec.ts
@@ -25,7 +25,8 @@ import {
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import {
   legacyCreateStreamFactory,
@@ -107,6 +108,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/modules/workspaces/authz/loaders/index.ts b/packages/server/modules/workspaces/authz/loaders/index.ts
index 7bb6af505..45fbf39a4 100644
--- a/packages/server/modules/workspaces/authz/loaders/index.ts
+++ b/packages/server/modules/workspaces/authz/loaders/index.ts
@@ -12,10 +12,10 @@ import {
   getUserEligibleWorkspacesFactory,
   getWorkspaceRoleForUserFactory
 } from '@/modules/workspaces/repositories/workspaces'
-import { queryAllWorkspaceProjectsFactory } from '@/modules/workspaces/services/projects'
 import { getWorkspaceModelCountFactory } from '@/modules/workspaces/services/workspaceLimits'
 import { getUsersCurrentAndEligibleToBecomeAMemberWorkspaces } from '@/modules/workspaces/services/retrieval'
 import { findEmailsByUserIdFactory } from '@/modules/core/repositories/userEmails'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 // TODO: Move everything to use dataLoaders
 export default defineModuleLoaders(async () => {
@@ -58,7 +58,7 @@ export default defineModuleLoaders(async () => {
     getWorkspaceModelCount: async ({ workspaceId }) => {
       // TODO: Dataloader that has to dynamically pick regional dbs?
       return await getWorkspaceModelCountFactory({
-        queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
+        queryAllProjects: queryAllProjectsFactory({
           getStreams: legacyGetStreamsFactory({ db })
         }),
         getPaginatedProjectModelsTotalCount: async (projectId, params) => {
diff --git a/packages/server/modules/workspaces/domain/operations.ts b/packages/server/modules/workspaces/domain/operations.ts
index 6cdc5234d..5e58b6965 100644
--- a/packages/server/modules/workspaces/domain/operations.ts
+++ b/packages/server/modules/workspaces/domain/operations.ts
@@ -22,7 +22,7 @@ import {
 } from '@speckle/shared'
 import { WorkspaceCreationState } from '@/modules/workspaces/domain/types'
 import { WorkspaceTeam } from '@/modules/workspaces/domain/types'
-import { Stream, StreamWithOptionalRole } from '@/modules/core/domain/streams/types'
+import { Stream } from '@/modules/core/domain/streams/types'
 import { TokenResourceIdentifier } from '@/modules/core/domain/tokens/types'
 import { ServerRegion } from '@/modules/multiregion/domain/types'
 import { SetOptional } from 'type-fest'
@@ -286,18 +286,6 @@ export type ValidateWorkspaceMemberProjectRole = (params: {
 
 /** Workspace Projects */
 
-type QueryAllWorkspaceProjectsArgs = {
-  workspaceId: string
-  /**
-   * Optionally get project roles for a specific user
-   */
-  userId?: string
-}
-
-export type QueryAllWorkspaceProjects = (
-  args: QueryAllWorkspaceProjectsArgs
-) => AsyncGenerator<StreamWithOptionalRole[], void, unknown>
-
 export type GetWorkspacesProjectsCounts = (params: {
   workspaceIds: string[]
 }) => Promise<{
diff --git a/packages/server/modules/workspaces/events/eventListener.ts b/packages/server/modules/workspaces/events/eventListener.ts
index 20e814c16..4859def72 100644
--- a/packages/server/modules/workspaces/events/eventListener.ts
+++ b/packages/server/modules/workspaces/events/eventListener.ts
@@ -1,5 +1,6 @@
 import {
   getStreamFactory,
+  getStreamRolesFactory,
   getStreamsCollaboratorCountsFactory,
   grantStreamPermissionsFactory,
   legacyGetStreamsFactory,
@@ -17,7 +18,6 @@ import {
   GetWorkspaceSeatCount,
   GetWorkspaceSeatTypeToProjectRoleMapping,
   GetWorkspacesProjectsCounts,
-  QueryAllWorkspaceProjects,
   ValidateWorkspaceMemberProjectRole
 } from '@/modules/workspaces/domain/operations'
 import {
@@ -44,7 +44,10 @@ import {
   throwUncoveredError,
   WorkspaceRoles
 } from '@speckle/shared'
-import { UpsertProjectRole } from '@/modules/core/domain/projects/operations'
+import {
+  QueryAllProjects,
+  UpsertProjectRole
+} from '@/modules/core/domain/projects/operations'
 import { WorkspaceEvents } from '@/modules/workspacesCore/domain/events'
 import { Knex } from 'knex'
 import {
@@ -59,7 +62,6 @@ import {
   upsertWorkspaceRoleFactory
 } from '@/modules/workspaces/repositories/workspaces'
 import {
-  queryAllWorkspaceProjectsFactory,
   getWorkspaceRoleToDefaultProjectRoleMappingFactory,
   getWorkspaceSeatTypeToProjectRoleMappingFactory,
   validateWorkspaceMemberProjectRoleFactory
@@ -142,6 +144,7 @@ import { WorkspacePlanStatuses } from '@/modules/cross-server-sync/graph/generat
 import { GatekeeperEvents } from '@/modules/gatekeeperCore/domain/events'
 import { GetUser } from '@/modules/core/domain/users/operations'
 import { WorkspacePlans } from '@/modules/core/graph/generated/graphql'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const { FF_BILLING_INTEGRATION_ENABLED } = getFeatureFlags()
 
@@ -241,7 +244,7 @@ export const onWorkspaceAuthorizedFactory =
 
 export const onWorkspaceRoleDeletedFactory =
   (deps: {
-    queryAllWorkspaceProjects: QueryAllWorkspaceProjects
+    queryAllProjects: QueryAllProjects
     deleteWorkspaceSeat: DeleteWorkspaceSeat
     getStreamsCollaboratorCounts: GetStreamsCollaboratorCounts
     getWorkspaceCollaborators: GetWorkspaceCollaborators
@@ -269,7 +272,7 @@ export const onWorkspaceRoleDeletedFactory =
     })
 
     // Delete roles for all workspace projects
-    for await (const projectsPage of deps.queryAllWorkspaceProjects({
+    for await (const projectsPage of deps.queryAllProjects({
       workspaceId,
       userId
     })) {
@@ -322,7 +325,7 @@ export const onWorkspaceRoleDeletedFactory =
 export const onWorkspaceSeatUpdatedFactory =
   (deps: {
     getWorkspaceSeatTypeToProjectRoleMapping: GetWorkspaceSeatTypeToProjectRoleMapping
-    queryAllWorkspaceProjects: QueryAllWorkspaceProjects
+    queryAllProjects: QueryAllProjects
     setStreamCollaborator: SetStreamCollaborator
     getWorkspaceWithPlan: GetWorkspaceWithPlan
     getWorkspaceRoleForUser: GetWorkspaceRoleForUser
@@ -357,7 +360,7 @@ export const onWorkspaceSeatUpdatedFactory =
     })
 
     // Ensure project roles are valid on seat type switch
-    for await (const projectsPage of deps.queryAllWorkspaceProjects({
+    for await (const projectsPage of deps.queryAllProjects({
       workspaceId,
       userId
     })) {
@@ -409,7 +412,7 @@ export const onWorkspaceSeatUpdatedFactory =
 
 export const onWorkspaceRoleUpdatedFactory =
   (deps: {
-    queryAllWorkspaceProjects: QueryAllWorkspaceProjects
+    queryAllProjects: QueryAllProjects
     setStreamCollaborator: SetStreamCollaborator
     getWorkspaceUserSeat: GetWorkspaceUserSeat
     getStreamsCollaboratorCounts: GetStreamsCollaboratorCounts
@@ -444,7 +447,7 @@ export const onWorkspaceRoleUpdatedFactory =
     })
 
     // Enforce project roles based on workspace role and seat type, if project role exists
-    for await (const projectsPage of deps.queryAllWorkspaceProjects({
+    for await (const projectsPage of deps.queryAllProjects({
       workspaceId,
       userId
     })) {
@@ -926,9 +929,7 @@ export const initializeEventListenersFactory =
           getWorkspacePlan,
           getWorkspaceSubscription: getWorkspaceSubscriptionFactory({ db }),
           getWorkspaceModelCount: getWorkspaceModelCountFactory({
-            queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
-              getStreams
-            }),
+            queryAllProjects: queryAllProjectsFactory({ getStreams }),
             getPaginatedProjectModelsTotalCount:
               getPaginatedProjectModelsTotalCountFactory({ db })
           }),
@@ -946,9 +947,7 @@ export const initializeEventListenersFactory =
           getWorkspacePlan,
           getWorkspaceSubscription: getWorkspaceSubscriptionFactory({ db }),
           getWorkspaceModelCount: getWorkspaceModelCountFactory({
-            queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
-              getStreams
-            }),
+            queryAllProjects: queryAllProjectsFactory({ getStreams }),
             getPaginatedProjectModelsTotalCount:
               getPaginatedProjectModelsTotalCountFactory({ db })
           }),
@@ -987,9 +986,7 @@ export const initializeEventListenersFactory =
         await withTransaction(
           async ({ db: trx }) => {
             const onWorkspaceRoleDeleted = onWorkspaceRoleDeletedFactory({
-              queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
-                getStreams
-              }),
+              queryAllProjects: queryAllProjectsFactory({ getStreams }),
               deleteWorkspaceSeat: deleteWorkspaceSeatFactory({ db: trx }),
               getStreamsCollaboratorCounts: getStreamsCollaboratorCountsFactory({ db }),
               getWorkspaceCollaborators: getWorkspaceCollaboratorsFactory({ db }),
@@ -1007,7 +1004,8 @@ export const initializeEventListenersFactory =
                 }),
                 revokeStreamPermissions: revokeStreamPermissionsFactory({
                   db: trx
-                })
+                }),
+                getStreamRoles: getStreamRolesFactory({ db: trx })
               }),
               getWorkspaceUserSeat: getWorkspaceUserSeatFactory({ db }),
               emitEvent: eventBus.emit
@@ -1022,9 +1020,7 @@ export const initializeEventListenersFactory =
         await withTransaction(
           async ({ db: trx }) => {
             const onWorkspaceRoleUpdated = onWorkspaceRoleUpdatedFactory({
-              queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
-                getStreams
-              }),
+              queryAllProjects: queryAllProjectsFactory({ getStreams }),
               setStreamCollaborator: setStreamCollaboratorFactory({
                 getUser: getUserFactory({ db }),
                 validateStreamAccess: validateStreamAccessFactory({
@@ -1039,7 +1035,8 @@ export const initializeEventListenersFactory =
                 }),
                 revokeStreamPermissions: revokeStreamPermissionsFactory({
                   db: trx
-                })
+                }),
+                getStreamRoles: getStreamRolesFactory({ db: trx })
               }),
               getWorkspaceUserSeat: getWorkspaceUserSeatFactory({ db }),
               getStreamsCollaboratorCounts: getStreamsCollaboratorCountsFactory({ db }),
@@ -1065,11 +1062,10 @@ export const initializeEventListenersFactory =
                 isStreamCollaborator: isStreamCollaboratorFactory({
                   getStream: getStreamFactory({ db })
                 }),
-                revokeStreamPermissions: revokeStreamPermissionsFactory({ db: trx })
-              }),
-              queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
-                getStreams
+                revokeStreamPermissions: revokeStreamPermissionsFactory({ db: trx }),
+                getStreamRoles: getStreamRolesFactory({ db: trx })
               }),
+              queryAllProjects: queryAllProjectsFactory({ getStreams }),
               getWorkspaceWithPlan: getWorkspaceWithPlanFactory({ db }),
               getWorkspaceRoleForUser: getWorkspaceRoleForUserFactory({ db }),
               getWorkspaceSeatTypeToProjectRoleMapping:
diff --git a/packages/server/modules/workspaces/graph/resolvers/regions.ts b/packages/server/modules/workspaces/graph/resolvers/regions.ts
index 3b5047ec5..1c4d27e8a 100644
--- a/packages/server/modules/workspaces/graph/resolvers/regions.ts
+++ b/packages/server/modules/workspaces/graph/resolvers/regions.ts
@@ -20,10 +20,10 @@ import {
 import { Roles } from '@speckle/shared'
 import { WorkspacesNotYetImplementedError } from '@/modules/workspaces/errors/workspace'
 import { scheduleJob } from '@/modules/multiregion/services/queue'
-import { queryAllWorkspaceProjectsFactory } from '@/modules/workspaces/services/projects'
 import { legacyGetStreamsFactory } from '@/modules/core/repositories/streams'
 import { getFeatureFlags } from '@/modules/shared/helpers/envHelper'
 import { withOperationLogging } from '@/observability/domain/businessLogging'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const { FF_MOVE_PROJECT_REGION_ENABLED } = getFeatureFlags()
 
@@ -76,10 +76,10 @@ export default {
 
       // Move existing workspace projects to new target region
       if (FF_MOVE_PROJECT_REGION_ENABLED) {
-        const queryAllWorkspaceProjects = queryAllWorkspaceProjectsFactory({
+        const queryAllProjects = queryAllProjectsFactory({
           getStreams: legacyGetStreamsFactory({ db })
         })
-        for await (const projects of queryAllWorkspaceProjects({
+        for await (const projects of queryAllProjects({
           workspaceId
         })) {
           await Promise.all(
diff --git a/packages/server/modules/workspaces/graph/resolvers/workspaces.ts b/packages/server/modules/workspaces/graph/resolvers/workspaces.ts
index 53a141655..b5434d1a2 100644
--- a/packages/server/modules/workspaces/graph/resolvers/workspaces.ts
+++ b/packages/server/modules/workspaces/graph/resolvers/workspaces.ts
@@ -6,13 +6,13 @@ import {
 import { removePrivateFields } from '@/modules/core/helpers/userHelper'
 import {
   updateProjectFactory,
-  getRolesByUserIdFactory,
   getStreamFactory,
   deleteStreamFactory,
   revokeStreamPermissionsFactory,
   grantStreamPermissionsFactory,
   legacyGetStreamsFactory,
-  getStreamCollaboratorsFactory
+  getStreamCollaboratorsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { InviteCreateValidationError } from '@/modules/serverinvites/errors'
 import {
@@ -107,7 +107,6 @@ import {
   getWorkspaceRoleToDefaultProjectRoleMappingFactory,
   getWorkspaceSeatTypeToProjectRoleMappingFactory,
   moveProjectToWorkspaceFactory,
-  queryAllWorkspaceProjectsFactory,
   validateWorkspaceMemberProjectRoleFactory
 } from '@/modules/workspaces/services/projects'
 import {
@@ -194,7 +193,10 @@ import {
   updateWorkspaceJoinRequestStatusFactory
 } from '@/modules/workspaces/repositories/workspaceJoinRequests'
 import { sendWorkspaceJoinRequestReceivedEmailFactory } from '@/modules/workspaces/services/workspaceJoinRequestEmails/received'
-import { getProjectFactory } from '@/modules/core/repositories/projects'
+import {
+  getProjectFactory,
+  getUserProjectRolesFactory
+} from '@/modules/core/repositories/projects'
 import { getProjectRegionKey } from '@/modules/multiregion/utils/regionSelector'
 import { scheduleJob } from '@/modules/multiregion/services/queue'
 import { updateWorkspacePlanFactory } from '@/modules/gatekeeper/services/workspacePlans'
@@ -228,6 +230,7 @@ import {
 } from '@/modules/serverinvites/services/coreFinalization'
 import { WorkspaceInvitesLimit } from '@/modules/workspaces/domain/constants'
 import { copyWorkspaceFactory } from '@/modules/workspaces/repositories/projectRegions'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const eventBus = getEventBus()
 const getServerInfo = getServerInfoFactory({ db })
@@ -331,6 +334,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -406,6 +410,7 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 const updateStreamRoleAndNotify = updateStreamRoleAndNotifyFactory({
@@ -769,7 +774,7 @@ export = FF_WORKSPACES_MODULE_ENABLED
               deleteWorkspace: repoDeleteWorkspaceFactory({ db }),
               deleteProject: deleteStreamFactory({ db }),
               deleteAllResourceInvites: deleteAllResourceInvitesFactory({ db }),
-              queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
+              queryAllProjects: queryAllProjectsFactory({
                 getStreams: legacyGetStreamsFactory({ db })
               }),
               deleteSsoProvider: deleteSsoProviderFactory({ db }),
@@ -1849,7 +1854,7 @@ export = FF_WORKSPACES_MODULE_ENABLED
           return parent.workspaceRoleCreatedAt
         },
         projectRoles: async (parent) => {
-          const projectRoles = await getRolesByUserIdFactory({ db })({
+          const projectRoles = await getUserProjectRolesFactory({ db })({
             userId: parent.id,
             workspaceId: parent.workspaceId
           })
diff --git a/packages/server/modules/workspaces/index.ts b/packages/server/modules/workspaces/index.ts
index 4024f6b79..bf3ccab9c 100644
--- a/packages/server/modules/workspaces/index.ts
+++ b/packages/server/modules/workspaces/index.ts
@@ -19,7 +19,6 @@ import {
 } from '@/modules/core/repositories/scheduledTasks'
 import { getWorkspacesNonCompleteFactory } from '@/modules/workspaces/repositories/workspaces'
 import { deleteWorkspacesNonCompleteFactory } from '@/modules/workspaces/services/workspaceCreationState'
-import { queryAllWorkspaceProjectsFactory } from '@/modules/workspaces/services/projects'
 import {
   deleteStreamFactory,
   legacyGetStreamsFactory
@@ -31,6 +30,7 @@ import { deleteWorkspaceFactory as repoDeleteWorkspaceFactory } from '@/modules/
 import { deleteWorkspaceFactory } from '@/modules/workspaces/services/management'
 import { scheduleUpdateAllWorkspacesTracking } from '@/modules/workspaces/services/tracking'
 import { getClient } from '@/modules/shared/utils/mixpanel'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const {
   FF_WORKSPACES_MODULE_ENABLED,
@@ -62,7 +62,7 @@ const scheduleDeleteWorkspacesNonComplete = ({
       deleteWorkspace: repoDeleteWorkspaceFactory({ db }),
       deleteProject: deleteStreamFactory({ db }),
       deleteAllResourceInvites: deleteAllResourceInvitesFactory({ db }),
-      queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
+      queryAllProjects: queryAllProjectsFactory({
         getStreams: legacyGetStreamsFactory({ db })
       }),
       deleteSsoProvider: deleteSsoProviderFactory({ db }),
diff --git a/packages/server/modules/workspaces/services/management.ts b/packages/server/modules/workspaces/services/management.ts
index 0b9d2ffb3..51578d365 100644
--- a/packages/server/modules/workspaces/services/management.ts
+++ b/packages/server/modules/workspaces/services/management.ts
@@ -4,7 +4,6 @@ import {
   EmitWorkspaceEvent,
   GetWorkspace,
   StoreWorkspaceDomain,
-  QueryAllWorkspaceProjects,
   UpsertWorkspace,
   UpsertWorkspaceRole,
   GetWorkspaceWithDomains,
@@ -70,6 +69,7 @@ import {
   DeleteSsoProvider,
   GetWorkspaceSsoProviderRecord
 } from '@/modules/workspaces/domain/sso/operations'
+import { QueryAllProjects } from '@/modules/core/domain/projects/operations'
 
 type WorkspaceCreateArgs = {
   userId: string
@@ -295,14 +295,14 @@ export const deleteWorkspaceFactory =
   ({
     deleteWorkspace,
     deleteProject,
-    queryAllWorkspaceProjects,
+    queryAllProjects,
     deleteAllResourceInvites,
     deleteSsoProvider,
     emitWorkspaceEvent
   }: {
     deleteWorkspace: DeleteWorkspace
     deleteProject: DeleteStreamRecord
-    queryAllWorkspaceProjects: QueryAllWorkspaceProjects
+    queryAllProjects: QueryAllProjects
     deleteAllResourceInvites: DeleteAllResourceInvites
     deleteSsoProvider: DeleteSsoProvider
     emitWorkspaceEvent: EventBus['emit']
@@ -313,7 +313,7 @@ export const deleteWorkspaceFactory =
 
     // Cache project ids for post-workspace-delete cleanup
     const projectIds: string[] = []
-    for await (const projects of queryAllWorkspaceProjects({ workspaceId })) {
+    for await (const projects of queryAllProjects({ workspaceId })) {
       projectIds.push(...projects.map((project) => project.id))
     }
 
diff --git a/packages/server/modules/workspaces/services/projects.ts b/packages/server/modules/workspaces/services/projects.ts
index 332a43f0f..e032197c0 100644
--- a/packages/server/modules/workspaces/services/projects.ts
+++ b/packages/server/modules/workspaces/services/projects.ts
@@ -5,7 +5,6 @@ import {
   GetWorkspaceRoleToDefaultProjectRoleMapping,
   GetWorkspaceSeatTypeToProjectRoleMapping,
   IntersectProjectCollaboratorsAndWorkspaceCollaborators,
-  QueryAllWorkspaceProjects,
   AddOrUpdateWorkspaceRole,
   ValidateWorkspaceMemberProjectRole,
   CopyWorkspace
@@ -13,15 +12,13 @@ import {
 import {
   WorkspaceInvalidProjectError,
   WorkspaceInvalidRoleError,
-  WorkspaceNotFoundError,
-  WorkspaceQueryError
+  WorkspaceNotFoundError
 } from '@/modules/workspaces/errors/workspace'
 import { GetProject, UpdateProject } from '@/modules/core/domain/projects/operations'
 import { chunk } from 'lodash'
 import { Roles, WorkspaceRoles } from '@speckle/shared'
 import {
   GetStreamCollaborators,
-  LegacyGetStreams,
   UpdateStreamRole
 } from '@/modules/core/domain/streams/operations'
 import { ProjectNotFoundError } from '@/modules/core/errors/projects'
@@ -58,39 +55,6 @@ import { userEmailsCompliantWithWorkspaceDomains } from '@/modules/workspaces/do
 import { CreateWorkspaceSeat } from '@/modules/gatekeeper/domain/operations'
 import { WorkspaceAcl } from '@/modules/workspacesCore/domain/types'
 
-export const queryAllWorkspaceProjectsFactory = ({
-  getStreams
-}: {
-  getStreams: LegacyGetStreams
-}): QueryAllWorkspaceProjects =>
-  async function* queryAllWorkspaceProjects({
-    workspaceId,
-    userId
-  }): AsyncGenerator<StreamRecord[], void, unknown> {
-    let cursor: Date | null = null
-    let iterationCount = 0
-
-    do {
-      if (iterationCount > 500) throw new WorkspaceQueryError()
-
-      const { streams, cursorDate } = await getStreams({
-        cursor,
-        orderBy: null,
-        limit: 100,
-        visibility: null,
-        searchQuery: null,
-        streamIdWhitelist: null,
-        workspaceIdWhitelist: [workspaceId],
-        userId
-      })
-
-      yield streams
-
-      cursor = cursorDate
-      iterationCount++
-    } while (!!cursor)
-  }
-
 type MoveProjectToWorkspaceArgs = {
   projectId: string
   workspaceId: string
diff --git a/packages/server/modules/workspaces/services/tracking.ts b/packages/server/modules/workspaces/services/tracking.ts
index cc200f27b..0931cf727 100644
--- a/packages/server/modules/workspaces/services/tracking.ts
+++ b/packages/server/modules/workspaces/services/tracking.ts
@@ -33,9 +33,9 @@ import {
 } from '@/modules/gatekeeper/repositories/billing'
 import { db } from '@/db/knex'
 import { getPaginatedProjectModelsTotalCountFactory } from '@/modules/core/repositories/branches'
-import { queryAllWorkspaceProjectsFactory } from '@/modules/workspaces/services/projects'
 import { getWorkspaceModelCountFactory } from '@/modules/workspaces/services/workspaceLimits'
 import { legacyGetStreamsFactory } from '@/modules/core/repositories/streams'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 export type WorkspaceTrackingProperties = {
   name: string
@@ -215,7 +215,7 @@ export const scheduleUpdateAllWorkspacesTracking = ({
       getWorkspacePlan: getWorkspacePlanFactory({ db }),
       getWorkspaceSubscription: getWorkspaceSubscriptionFactory({ db }),
       getWorkspaceModelCount: getWorkspaceModelCountFactory({
-        queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
+        queryAllProjects: queryAllProjectsFactory({
           getStreams: legacyGetStreamsFactory({ db })
         }),
         getPaginatedProjectModelsTotalCount: getPaginatedProjectModelsTotalCountFactory(
diff --git a/packages/server/modules/workspaces/services/workspaceLimits.ts b/packages/server/modules/workspaces/services/workspaceLimits.ts
index f89cda3ce..380b3b98f 100644
--- a/packages/server/modules/workspaces/services/workspaceLimits.ts
+++ b/packages/server/modules/workspaces/services/workspaceLimits.ts
@@ -1,19 +1,17 @@
 import { GetPaginatedProjectModelsTotalCount } from '@/modules/core/domain/branches/operations'
-import {
-  GetWorkspaceModelCount,
-  QueryAllWorkspaceProjects
-} from '@/modules/workspaces/domain/operations'
+import { QueryAllProjects } from '@/modules/core/domain/projects/operations'
+import { GetWorkspaceModelCount } from '@/modules/workspaces/domain/operations'
 
 // TODO: Optimize with single model count query per regional db
 export const getWorkspaceModelCountFactory =
   (deps: {
-    queryAllWorkspaceProjects: QueryAllWorkspaceProjects
+    queryAllProjects: QueryAllProjects
     getPaginatedProjectModelsTotalCount: GetPaginatedProjectModelsTotalCount
   }): GetWorkspaceModelCount =>
   async ({ workspaceId }) => {
     let modelCount = 0
 
-    for await (const projects of deps.queryAllWorkspaceProjects({ workspaceId })) {
+    for await (const projects of deps.queryAllProjects({ workspaceId })) {
       for (const project of projects) {
         modelCount =
           modelCount + (await deps.getPaginatedProjectModelsTotalCount(project.id, {}))
diff --git a/packages/server/modules/workspaces/tests/helpers/creation.ts b/packages/server/modules/workspaces/tests/helpers/creation.ts
index 03d8c1820..88205349f 100644
--- a/packages/server/modules/workspaces/tests/helpers/creation.ts
+++ b/packages/server/modules/workspaces/tests/helpers/creation.ts
@@ -59,6 +59,7 @@ import {
 } from '@speckle/shared'
 import {
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import { getUserFactory } from '@/modules/core/repositories/users'
@@ -594,6 +595,7 @@ export const createWorkspaceInviteDirectly = async (
             validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
             getUser: getUserFactory({ db }),
             grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+            getStreamRoles: getStreamRolesFactory({ db }),
             emitEvent: getEventBus().emit
           })
         })
diff --git a/packages/server/modules/workspaces/tests/integration/invites.graph.spec.ts b/packages/server/modules/workspaces/tests/integration/invites.graph.spec.ts
index d2377b996..d67be1ae9 100644
--- a/packages/server/modules/workspaces/tests/integration/invites.graph.spec.ts
+++ b/packages/server/modules/workspaces/tests/integration/invites.graph.spec.ts
@@ -54,7 +54,10 @@ import {
   WorkspaceProtectedError
 } from '@/modules/workspaces/errors/workspace'
 import cryptoRandomString from 'crypto-random-string'
-import { grantStreamPermissionsFactory } from '@/modules/core/repositories/streams'
+import {
+  getStreamRolesFactory,
+  grantStreamPermissionsFactory
+} from '@/modules/core/repositories/streams'
 import {
   addOrUpdateStreamCollaboratorFactory,
   validateStreamAccessFactory
@@ -84,6 +87,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
diff --git a/packages/server/modules/workspaces/tests/integration/projects.graph.spec.ts b/packages/server/modules/workspaces/tests/integration/projects.graph.spec.ts
index ea74c0da7..a1a7d198c 100644
--- a/packages/server/modules/workspaces/tests/integration/projects.graph.spec.ts
+++ b/packages/server/modules/workspaces/tests/integration/projects.graph.spec.ts
@@ -1,9 +1,15 @@
 import { db } from '@/db/knex'
-import { StreamAcl } from '@/modules/core/dbSchema'
-import { ProjectRecordVisibility } from '@/modules/core/helpers/types'
+import { StreamAcl, Streams } from '@/modules/core/dbSchema'
+import { ProjectRecordVisibility, StreamRecord } from '@/modules/core/helpers/types'
+import {
+  deleteProjectFactory,
+  getProjectFactory
+} from '@/modules/core/repositories/projects'
 import { grantStreamPermissionsFactory } from '@/modules/core/repositories/streams'
+import { waitForRegionProjectFactory } from '@/modules/core/services/projects'
 import { WorkspaceSeatType } from '@/modules/gatekeeper/domain/billing'
 import { getWorkspaceUserSeatsFactory } from '@/modules/gatekeeper/repositories/workspaceSeat'
+import { getRegionDb } from '@/modules/multiregion/utils/dbSelector'
 import { WorkspaceInvalidRoleError } from '@/modules/workspaces/errors/workspace'
 import {
   assignToWorkspace,
@@ -59,11 +65,16 @@ import {
 import { expect } from 'chai'
 import cryptoRandomString from 'crypto-random-string'
 import dayjs from 'dayjs'
+import { Knex } from 'knex'
 import { times } from 'lodash'
 
 const grantStreamPermissions = grantStreamPermissionsFactory({ db })
 const adminOverrideMock = mockAdminOverride()
 
+const tables = {
+  streams: (db: Knex) => db.table<StreamRecord>(Streams.name)
+}
+
 describe('Workspace project GQL CRUD', () => {
   let apollo: TestApolloServer
 
@@ -862,8 +873,7 @@ describe('Workspace project GQL CRUD', () => {
       id: '',
       ownerId: '',
       name: 'Test Project',
-      visibility: ProjectRecordVisibility.Private,
-      regionKey: isMultiRegionTestMode() ? 'region1' : undefined
+      visibility: ProjectRecordVisibility.Private
     }
 
     const targetWorkspace: BasicTestWorkspace = {
@@ -986,26 +996,61 @@ describe('Workspace project GQL CRUD', () => {
       expect(adminWorkspaceRole?.role).to.equal(Roles.Workspace.Admin)
     })
 
-    it('should respect project region during move mutations @multiregion', async () => {
-      const resA = await apollo.execute(MoveProjectToWorkspaceDocument, {
-        projectId: testProject.id,
-        workspaceId: targetWorkspace.id
-      })
-      const resB = await apollo.execute(UpdateProjectDocument, {
-        input: {
-          id: testProject.id,
-          name: 'Foo'
-        }
-      })
-      const resC = await apollo.execute(GetProjectDocument, {
-        id: testProject.id
-      })
+    isMultiRegionTestMode()
+      ? describe('when the default server db region is not the main db', () => {
+          const regionalProject: StreamRecord = {
+            id: cryptoRandomString({ length: 9 }),
+            name: 'My Special Project',
+            description: null,
+            clonedFrom: null,
+            createdAt: new Date(),
+            updatedAt: new Date(),
+            allowPublicComments: false,
+            workspaceId: null,
+            regionKey: 'region1',
+            visibility: ProjectRecordVisibility.Public
+          }
 
-      expect(resA).to.not.haveGraphQLErrors()
-      expect(resB).to.not.haveGraphQLErrors()
-      expect(resC).to.not.haveGraphQLErrors()
-      expect(resC.data?.project?.workspaceId).to.equal(targetWorkspace.id)
-    })
+          beforeEach(async () => {
+            // Simulate non-main default db region
+            const regionDb = await getRegionDb({ regionKey: 'region1' })
+            await tables.streams(regionDb).insert(regionalProject)
+            await waitForRegionProjectFactory({
+              getProject: getProjectFactory({ db }),
+              deleteProject: deleteProjectFactory({ db: regionDb })
+            })({
+              projectId: regionalProject.id,
+              regionKey: 'region1'
+            })
+            await grantStreamPermissions({
+              streamId: regionalProject.id,
+              userId: serverAdminUser.id,
+              role: Roles.Stream.Owner
+            })
+          })
+
+          it('should update project without removing workspace association @multiregion', async () => {
+            const resA = await apollo.execute(MoveProjectToWorkspaceDocument, {
+              projectId: regionalProject.id,
+              workspaceId: targetWorkspace.id
+            })
+            const resB = await apollo.execute(UpdateProjectDocument, {
+              input: {
+                id: regionalProject.id,
+                name: 'Foo'
+              }
+            })
+            const resC = await apollo.execute(GetProjectDocument, {
+              id: regionalProject.id
+            })
+
+            expect(resA).to.not.haveGraphQLErrors()
+            expect(resB).to.not.haveGraphQLErrors()
+            expect(resC).to.not.haveGraphQLErrors()
+            expect(resC.data?.project?.workspaceId).to.equal(targetWorkspace.id)
+          })
+        })
+      : null
   })
 
   // moved over Alessandro's tests from core to here, since they are all related to workspaces
diff --git a/packages/server/modules/workspaces/tests/integration/tracking.spec.ts b/packages/server/modules/workspaces/tests/integration/tracking.spec.ts
index 635796c7c..affcb3516 100644
--- a/packages/server/modules/workspaces/tests/integration/tracking.spec.ts
+++ b/packages/server/modules/workspaces/tests/integration/tracking.spec.ts
@@ -16,7 +16,6 @@ import {
   getWorkspaceSubscriptionFactory
 } from '@/modules/gatekeeper/repositories/billing'
 import { getWorkspaceModelCountFactory } from '@/modules/workspaces/services/workspaceLimits'
-import { queryAllWorkspaceProjectsFactory } from '@/modules/workspaces/services/projects'
 import { legacyGetStreamsFactory } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
 import { getPaginatedProjectModelsTotalCountFactory } from '@/modules/core/repositories/branches'
@@ -26,6 +25,7 @@ import { buildMixpanelFake } from '@/modules/shared/test/helpers/mixpanel'
 import { expect } from 'chai'
 import { truncateTables } from '@/test/hooks'
 import { Workspaces } from '@/modules/workspaces/helpers/db'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 describe('Tracking Workspaces', () => {
   const testUser: BasicTestUser = {
@@ -41,7 +41,7 @@ describe('Tracking Workspaces', () => {
       getWorkspacePlan: getWorkspacePlanFactory({ db }),
       getWorkspaceSubscription: getWorkspaceSubscriptionFactory({ db }),
       getWorkspaceModelCount: getWorkspaceModelCountFactory({
-        queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
+        queryAllProjects: queryAllProjectsFactory({
           getStreams: legacyGetStreamsFactory({ db })
         }),
         getPaginatedProjectModelsTotalCount: getPaginatedProjectModelsTotalCountFactory(
diff --git a/packages/server/modules/workspaces/tests/integration/users.graph.spec.ts b/packages/server/modules/workspaces/tests/integration/users.graph.spec.ts
index bfe492979..b38c08439 100644
--- a/packages/server/modules/workspaces/tests/integration/users.graph.spec.ts
+++ b/packages/server/modules/workspaces/tests/integration/users.graph.spec.ts
@@ -14,6 +14,8 @@ import {
   login
 } from '@/test/authHelper'
 import {
+  ActiveUserUpdateMutationDocument,
+  GetActiveUserDocument,
   GetProjectInvitableCollaboratorsDocument,
   SetUserActiveWorkspaceDocument,
   UserActiveResourcesDocument
@@ -24,7 +26,7 @@ import { BasicTestStream, createTestStream } from '@/test/speckle-helpers/stream
 import { expect } from 'chai'
 import cryptoRandomString from 'crypto-random-string'
 
-describe('ActiveUserMutations.setActiveWorkspace', () => {
+describe('ActiveUserMutations', () => {
   let apollo: TestApolloServer
 
   const user: BasicTestUser = {
@@ -56,55 +58,139 @@ describe('ActiveUserMutations.setActiveWorkspace', () => {
     apollo = await testApolloServer({ authUserId: user.id })
   })
 
-  it('should accurately report active workspace', async () => {
-    const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
-      slug: workspace.slug
+  describe('setActiveWorkspace', () => {
+    it('should accurately report active workspace', async () => {
+      const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
+        slug: workspace.slug
+      })
+      expect(resA).to.not.haveGraphQLErrors()
+
+      const resB = await apollo.execute(UserActiveResourcesDocument, {})
+      expect(resB).to.not.haveGraphQLErrors()
+
+      expect(resB?.data?.activeUser?.activeWorkspace?.id).to.equal(workspace.id)
     })
-    expect(resA).to.not.haveGraphQLErrors()
 
-    const resB = await apollo.execute(UserActiveResourcesDocument, {})
-    expect(resB).to.not.haveGraphQLErrors()
+    it('should accurately report if last visited project is not a workspace project', async () => {
+      const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
+        slug: null,
+        isProjectsActive: true
+      })
+      expect(resA).to.not.haveGraphQLErrors()
 
-    expect(resB?.data?.activeUser?.activeWorkspace?.id).to.equal(workspace.id)
+      const resB = await apollo.execute(UserActiveResourcesDocument, {})
+      expect(resB).to.not.haveGraphQLErrors()
+
+      expect(resB?.data?.activeUser?.isProjectsActive).to.be.true
+    })
+
+    it('should allow values to be cleared with null input', async () => {
+      const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
+        slug: workspace.slug
+      })
+      expect(resA).to.not.haveGraphQLErrors()
+      const resB = await apollo.execute(SetUserActiveWorkspaceDocument, { slug: null })
+      expect(resB).to.not.haveGraphQLErrors()
+
+      const resC = await apollo.execute(UserActiveResourcesDocument, {})
+      expect(resC).to.not.haveGraphQLErrors()
+
+      expect(resC.data?.activeUser?.activeWorkspace).to.be.null
+    })
+
+    it('should return null if workspace is not found or was deleted', async () => {
+      const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
+        slug: cryptoRandomString({ length: 9 })
+      })
+      expect(resA).to.not.haveGraphQLErrors()
+
+      const resB = await apollo.execute(UserActiveResourcesDocument, {})
+      expect(resB).to.not.haveGraphQLErrors()
+
+      expect(resB?.data?.activeUser?.activeWorkspace).to.be.null
+    })
   })
 
-  it('should accurately report if last visited project is not a workspace project', async () => {
-    const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
-      slug: null,
-      isProjectsActive: true
+  describe('update', () => {
+    it('writes the desired field to the active user', async () => {
+      const name = cryptoRandomString({ length: 10 })
+      const bio = cryptoRandomString({ length: 10 })
+      const avatar = 'data:image/jpeg;base64,/////Z'
+      const company = cryptoRandomString({ length: 10 })
+
+      const resA = await apollo.execute(ActiveUserUpdateMutationDocument, {
+        user: { name, bio, avatar, company }
+      })
+      expect(resA).to.not.haveGraphQLErrors()
+
+      const resB = await apollo.execute(GetActiveUserDocument, {})
+      expect(resB).to.not.haveGraphQLErrors()
+
+      expect(resB?.data?.activeUser).to.deep.include({
+        name,
+        bio,
+        avatar,
+        company
+      })
     })
-    expect(resA).to.not.haveGraphQLErrors()
 
-    const resB = await apollo.execute(UserActiveResourcesDocument, {})
-    expect(resB).to.not.haveGraphQLErrors()
+    it('does not unset the avatar on updates', async () => {
+      const name = cryptoRandomString({ length: 10 })
+      const avatar = 'data:image/jpeg;base64,/////Z'
 
-    expect(resB?.data?.activeUser?.isProjectsActive).to.be.true
+      const resA = await apollo.execute(ActiveUserUpdateMutationDocument, {
+        user: {
+          name,
+          avatar
+        }
+      })
+      expect(resA).to.not.haveGraphQLErrors()
+
+      const updatedName = name + '-updated'
+      const resB = await apollo.execute(ActiveUserUpdateMutationDocument, {
+        user: {
+          name: updatedName,
+          avatar: null
+        }
+      })
+      expect(resB).to.not.haveGraphQLErrors()
+
+      const resC = await apollo.execute(GetActiveUserDocument, {})
+      expect(resC).to.not.haveGraphQLErrors()
+
+      expect(resC?.data?.activeUser).to.deep.include({
+        name: updatedName,
+        avatar
+      })
+    })
   })
 
-  it('should allow values to be cleared with null input', async () => {
-    const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
-      slug: workspace.slug
+  it('is able to clear the avatar', async () => {
+    const name = cryptoRandomString({ length: 10 })
+    const avatar = 'data:image/jpeg;base64,/////Z'
+
+    const resA = await apollo.execute(ActiveUserUpdateMutationDocument, {
+      user: {
+        name,
+        avatar
+      }
     })
     expect(resA).to.not.haveGraphQLErrors()
-    const resB = await apollo.execute(SetUserActiveWorkspaceDocument, { slug: null })
+
+    const resB = await apollo.execute(ActiveUserUpdateMutationDocument, {
+      user: {
+        avatar: ''
+      }
+    })
     expect(resB).to.not.haveGraphQLErrors()
 
-    const resC = await apollo.execute(UserActiveResourcesDocument, {})
+    const resC = await apollo.execute(GetActiveUserDocument, {})
     expect(resC).to.not.haveGraphQLErrors()
 
-    expect(resC.data?.activeUser?.activeWorkspace).to.be.null
-  })
-
-  it('should return null if workspace is not found or was deleted', async () => {
-    const resA = await apollo.execute(SetUserActiveWorkspaceDocument, {
-      slug: cryptoRandomString({ length: 9 })
+    expect(resC?.data?.activeUser).to.deep.include({
+      name,
+      avatar: null
     })
-    expect(resA).to.not.haveGraphQLErrors()
-
-    const resB = await apollo.execute(UserActiveResourcesDocument, {})
-    expect(resB).to.not.haveGraphQLErrors()
-
-    expect(resB?.data?.activeUser?.activeWorkspace).to.be.null
   })
 })
 
diff --git a/packages/server/modules/workspaces/tests/integration/workspacesCreationState.spec.ts b/packages/server/modules/workspaces/tests/integration/workspacesCreationState.spec.ts
index a72231fa1..44647cc14 100644
--- a/packages/server/modules/workspaces/tests/integration/workspacesCreationState.spec.ts
+++ b/packages/server/modules/workspaces/tests/integration/workspacesCreationState.spec.ts
@@ -14,7 +14,6 @@ import { expect } from 'chai'
 import dayjs from 'dayjs'
 import { deleteWorkspacesNonCompleteFactory } from '@/modules/workspaces/services/workspaceCreationState'
 import { logger } from '@/observability/logging'
-import { queryAllWorkspaceProjectsFactory } from '@/modules/workspaces/services/projects'
 import {
   deleteStreamFactory,
   legacyGetStreamsFactory
@@ -24,6 +23,7 @@ import { getEventBus } from '@/modules/shared/services/eventBus'
 import { deleteAllResourceInvitesFactory } from '@/modules/serverinvites/repositories/serverInvites'
 import { deleteWorkspaceFactory as repoDeleteWorkspaceFactory } from '@/modules/workspaces/repositories/workspaces'
 import { deleteWorkspaceFactory } from '@/modules/workspaces/services/management'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 
 const updateAWorkspaceCreatedAt = async (
   workspaceId: string,
@@ -44,7 +44,7 @@ describe('WorkspaceCreationState services', () => {
       deleteWorkspace: repoDeleteWorkspaceFactory({ db }),
       deleteProject: deleteStreamFactory({ db }),
       deleteAllResourceInvites: deleteAllResourceInvitesFactory({ db }),
-      queryAllWorkspaceProjects: queryAllWorkspaceProjectsFactory({
+      queryAllProjects: queryAllProjectsFactory({
         getStreams: legacyGetStreamsFactory({ db })
       }),
       deleteSsoProvider: deleteSsoProviderFactory({ db }),
diff --git a/packages/server/modules/workspaces/tests/unit/services/projects.spec.ts b/packages/server/modules/workspaces/tests/unit/services/projects.spec.ts
index 7e0896778..ebfe2d2cf 100644
--- a/packages/server/modules/workspaces/tests/unit/services/projects.spec.ts
+++ b/packages/server/modules/workspaces/tests/unit/services/projects.spec.ts
@@ -1,12 +1,10 @@
 import { ProjectTeamMember } from '@/modules/core/domain/projects/types'
 import { ProjectNotFoundError } from '@/modules/core/errors/projects'
 import { StreamRecord } from '@/modules/core/helpers/types'
+import { queryAllProjectsFactory } from '@/modules/core/services/projects'
 import { WorkspaceSeat, WorkspaceSeatType } from '@/modules/gatekeeper/domain/billing'
 import { WorkspaceInvalidProjectError } from '@/modules/workspaces/errors/workspace'
-import {
-  moveProjectToWorkspaceFactory,
-  queryAllWorkspaceProjectsFactory
-} from '@/modules/workspaces/services/projects'
+import { moveProjectToWorkspaceFactory } from '@/modules/workspaces/services/projects'
 import {
   Workspace,
   WorkspaceAcl,
@@ -26,7 +24,7 @@ describe('Project retrieval services', () => {
       const foundProjects: StreamRecord[] = []
       const storedProjects: StreamRecord[] = [{ workspaceId } as StreamRecord]
 
-      const queryAllWorkspaceProjectsGenerator = queryAllWorkspaceProjectsFactory({
+      const queryAllWorkspaceProjectsGenerator = queryAllProjectsFactory({
         getStreams: async () => {
           return {
             streams: storedProjects,
@@ -53,7 +51,7 @@ describe('Project retrieval services', () => {
         { workspaceId } as StreamRecord
       ]
 
-      const queryAllWorkspaceProjectsGenerator = queryAllWorkspaceProjectsFactory({
+      const queryAllWorkspaceProjectsGenerator = queryAllProjectsFactory({
         getStreams: async ({ cursor }) => {
           return cursor
             ? { streams: [storedProjects[1]], totalCount: 1, cursorDate: null }
@@ -74,7 +72,7 @@ describe('Project retrieval services', () => {
 
       const foundProjects: StreamRecord[] = []
 
-      const queryAllWorkspaceProjectsGenerator = queryAllWorkspaceProjectsFactory({
+      const queryAllWorkspaceProjectsGenerator = queryAllProjectsFactory({
         getStreams: async () => {
           return { streams: [], totalCount: 0, cursorDate: null }
         }
diff --git a/packages/server/modules/workspacesCore/domain/operations.ts b/packages/server/modules/workspacesCore/domain/operations.ts
index 2d6b104f0..83849718b 100644
--- a/packages/server/modules/workspacesCore/domain/operations.ts
+++ b/packages/server/modules/workspacesCore/domain/operations.ts
@@ -27,4 +27,8 @@ export type GetUserWorkspaceCountFactory = (params: {
   userId: string
 }) => Promise<number>
 
+export type GetUserWorkspaceSeatsFactory = (params: {
+  userId: string
+}) => Promise<WorkspaceSeat[]>
+
 export type GetTotalWorkspaceCountFactory = () => Promise<number>
diff --git a/packages/server/modules/workspacesCore/repositories/workspaces.ts b/packages/server/modules/workspacesCore/repositories/workspaces.ts
index 8553854df..5b6eb01b0 100644
--- a/packages/server/modules/workspacesCore/repositories/workspaces.ts
+++ b/packages/server/modules/workspacesCore/repositories/workspaces.ts
@@ -1,17 +1,24 @@
 import {
   GetTotalWorkspaceCountFactory,
-  GetUserWorkspaceCountFactory
+  GetUserWorkspaceCountFactory,
+  GetUserWorkspaceSeatsFactory
 } from '@/modules/workspacesCore/domain/operations'
-import { Workspace, WorkspaceAcl } from '@/modules/workspacesCore/domain/types'
+import {
+  Workspace,
+  WorkspaceAcl,
+  WorkspaceSeat
+} from '@/modules/workspacesCore/domain/types'
 import {
   WorkspaceAcl as WorkspaceAclDb,
-  Workspaces
+  Workspaces,
+  WorkspaceSeats
 } from '@/modules/workspacesCore/helpers/db'
 import { Knex } from 'knex'
 
 const tables = {
   workspaces: (db: Knex) => db<Workspace>(Workspaces.name),
-  workspaceAcl: (db: Knex) => db<WorkspaceAcl>(WorkspaceAclDb.name)
+  workspaceAcl: (db: Knex) => db<WorkspaceAcl>(WorkspaceAclDb.name),
+  workspaceSeats: (db: Knex) => db<WorkspaceSeat>(WorkspaceSeats.name)
 }
 
 export const getUserWorkspaceCountFactory =
@@ -27,6 +34,14 @@ export const getUserWorkspaceCountFactory =
     return parseInt(count)
   }
 
+export const getUserWorkspaceSeatsFactory =
+  (deps: { db: Knex }): GetUserWorkspaceSeatsFactory =>
+  async ({ userId }: { userId: string }) => {
+    const workspaceSeats = await tables.workspaceSeats(deps.db).where({ userId })
+
+    return workspaceSeats
+  }
+
 export const getTotalWorkspaceCountFactory =
   (deps: { db: Knex }): GetTotalWorkspaceCountFactory =>
   async () => {
diff --git a/packages/server/scripts/streamObjects.ts b/packages/server/scripts/streamObjects.ts
index ca15761a1..1ee79c437 100644
--- a/packages/server/scripts/streamObjects.ts
+++ b/packages/server/scripts/streamObjects.ts
@@ -9,7 +9,8 @@ import { Scopes } from '@speckle/shared'
 import {
   getStreamFactory,
   createStreamFactory,
-  grantStreamPermissionsFactory
+  grantStreamPermissionsFactory,
+  getStreamRolesFactory
 } from '@/modules/core/repositories/streams'
 import { db } from '@/db/knex'
 import {
@@ -84,6 +85,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/test/graphql/embedTokens.ts b/packages/server/test/graphql/embedTokens.ts
new file mode 100644
index 000000000..34d6c51ae
--- /dev/null
+++ b/packages/server/test/graphql/embedTokens.ts
@@ -0,0 +1,11 @@
+import gql from 'graphql-tag'
+
+export const createEmbedTokenMutation = gql`
+  mutation CreateEmbedToken($token: EmbedTokenCreateInput!) {
+    projectMutations {
+      createEmbedToken(token: $token) {
+        token
+      }
+    }
+  }
+`
diff --git a/packages/server/test/graphql/generated/graphql.ts b/packages/server/test/graphql/generated/graphql.ts
index 08956ba9e..d9ad04177 100644
--- a/packages/server/test/graphql/generated/graphql.ts
+++ b/packages/server/test/graphql/generated/graphql.ts
@@ -926,6 +926,12 @@ export type CreateCommentReplyInput = {
   threadId: Scalars['String']['input'];
 };
 
+export type CreateEmbedTokenReturn = {
+  __typename?: 'CreateEmbedTokenReturn';
+  token: Scalars['String']['output'];
+  tokenMetadata: EmbedToken;
+};
+
 export type CreateModelInput = {
   description?: InputMaybe<Scalars['String']['input']>;
   name: Scalars['String']['input'];
@@ -1004,6 +1010,32 @@ export type EmailVerificationRequestInput = {
   id: Scalars['ID']['input'];
 };
 
+/** A token used to enable an embedded viewer for a private project */
+export type EmbedToken = {
+  __typename?: 'EmbedToken';
+  createdAt: Scalars['DateTime']['output'];
+  lastUsed: Scalars['DateTime']['output'];
+  lifespan: Scalars['BigInt']['output'];
+  projectId: Scalars['String']['output'];
+  resourceIdString: Scalars['String']['output'];
+  tokenId: Scalars['String']['output'];
+  user?: Maybe<LimitedUser>;
+};
+
+export type EmbedTokenCollection = {
+  __typename?: 'EmbedTokenCollection';
+  cursor?: Maybe<Scalars['String']['output']>;
+  items: Array<EmbedToken>;
+  totalCount: Scalars['Int']['output'];
+};
+
+export type EmbedTokenCreateInput = {
+  lifespan?: InputMaybe<Scalars['BigInt']['input']>;
+  projectId: Scalars['String']['input'];
+  /** The model(s) and version(s) string used in the embed url */
+  resourceIdString: Scalars['String']['input'];
+};
+
 export type FileUpload = {
   __typename?: 'FileUpload';
   branchName: Scalars['String']['output'];
@@ -2099,6 +2131,7 @@ export type Project = {
   description?: Maybe<Scalars['String']['output']>;
   /** Public project-level configuration for embedded viewer */
   embedOptions: ProjectEmbedOptions;
+  embedTokens: EmbedTokenCollection;
   hasAccessToFeature: Scalars['Boolean']['output'];
   id: Scalars['ID']['output'];
   invitableCollaborators: WorkspaceCollaboratorCollection;
@@ -2181,6 +2214,12 @@ export type ProjectCommentThreadsArgs = {
 };
 
 
+export type ProjectEmbedTokensArgs = {
+  cursor?: InputMaybe<Scalars['String']['input']>;
+  limit?: InputMaybe<Scalars['Int']['input']>;
+};
+
+
 export type ProjectHasAccessToFeatureArgs = {
   featureName: WorkspaceFeatureName;
 };
@@ -2580,6 +2619,7 @@ export type ProjectMutations = {
   batchDelete: Scalars['Boolean']['output'];
   /** Create new project */
   create: Project;
+  createEmbedToken: CreateEmbedTokenReturn;
   /**
    * Create onboarding/tutorial project. If one is already created for the active user, that
    * one will be returned instead.
@@ -2591,6 +2631,8 @@ export type ProjectMutations = {
   invites: ProjectInviteMutations;
   /** Leave a project. Only possible if you're not the last remaining owner. */
   leave: Scalars['Boolean']['output'];
+  revokeEmbedToken: Scalars['Boolean']['output'];
+  revokeEmbedTokens: Scalars['Boolean']['output'];
   /** Updates an existing project */
   update: Project;
   /** Update role for a collaborator */
@@ -2613,6 +2655,11 @@ export type ProjectMutationsCreateArgs = {
 };
 
 
+export type ProjectMutationsCreateEmbedTokenArgs = {
+  token: EmbedTokenCreateInput;
+};
+
+
 export type ProjectMutationsDeleteArgs = {
   id: Scalars['String']['input'];
 };
@@ -2623,6 +2670,17 @@ export type ProjectMutationsLeaveArgs = {
 };
 
 
+export type ProjectMutationsRevokeEmbedTokenArgs = {
+  projectId: Scalars['String']['input'];
+  token: Scalars['String']['input'];
+};
+
+
+export type ProjectMutationsRevokeEmbedTokensArgs = {
+  projectId: Scalars['String']['input'];
+};
+
+
 export type ProjectMutationsUpdateArgs = {
   update: ProjectUpdateInput;
 };
@@ -2665,6 +2723,7 @@ export type ProjectPermissionChecks = {
   canBroadcastActivity: PermissionCheckResult;
   canCreateAutomation: PermissionCheckResult;
   canCreateComment: PermissionCheckResult;
+  canCreateEmbedTokens: PermissionCheckResult;
   canCreateModel: PermissionCheckResult;
   canDelete: PermissionCheckResult;
   canInvite: PermissionCheckResult;
@@ -2673,9 +2732,11 @@ export type ProjectPermissionChecks = {
   canMoveToWorkspace: PermissionCheckResult;
   canPublish: PermissionCheckResult;
   canRead: PermissionCheckResult;
+  canReadEmbedTokens: PermissionCheckResult;
   canReadSettings: PermissionCheckResult;
   canReadWebhooks: PermissionCheckResult;
   canRequestRender: PermissionCheckResult;
+  canRevokeEmbedTokens: PermissionCheckResult;
   canUpdate: PermissionCheckResult;
   canUpdateAllowPublicComments: PermissionCheckResult;
 };
@@ -5868,6 +5929,13 @@ export type DeleteCommitsMutationVariables = Exact<{
 
 export type DeleteCommitsMutation = { __typename?: 'Mutation', commitsDelete: boolean };
 
+export type CreateEmbedTokenMutationVariables = Exact<{
+  token: EmbedTokenCreateInput;
+}>;
+
+
+export type CreateEmbedTokenMutation = { __typename?: 'Mutation', projectMutations: { __typename?: 'ProjectMutations', createEmbedToken: { __typename?: 'CreateEmbedTokenReturn', token: string } } };
+
 export type GetWorkspacePlanPricesQueryVariables = Exact<{ [key: string]: never; }>;
 
 
@@ -6304,6 +6372,13 @@ export type GetActiveUserQueryVariables = Exact<{ [key: string]: never; }>;
 
 export type GetActiveUserQuery = { __typename?: 'Query', activeUser?: { __typename?: 'User', id: string, email?: string | null, name: string, bio?: string | null, company?: string | null, avatar?: string | null, verified?: boolean | null, role?: string | null } | null };
 
+export type ActiveUserUpdateMutationMutationVariables = Exact<{
+  user: UserUpdateInput;
+}>;
+
+
+export type ActiveUserUpdateMutationMutation = { __typename?: 'Mutation', activeUserMutations: { __typename?: 'ActiveUserMutations', update: { __typename?: 'User', name: string, bio?: string | null, company?: string | null, avatar?: string | null } } };
+
 export type GetActiveUserWithWorkspaceJoinRequestsQueryVariables = Exact<{ [key: string]: never; }>;
 
 
@@ -6615,6 +6690,7 @@ export const ReadOtherUsersCommitsDocument = {"kind":"Document","definitions":[{
 export const ReadStreamBranchCommitsDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"ReadStreamBranchCommits"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"streamId"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}},{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"branchName"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}},{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"cursor"}},"type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}},{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"limit"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"Int"}}},"defaultValue":{"kind":"IntValue","value":"10"}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"stream"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"id"},"value":{"kind":"Variable","name":{"kind":"Name","value":"streamId"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"role"}},{"kind":"Field","name":{"kind":"Name","value":"branch"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"name"},"value":{"kind":"Variable","name":{"kind":"Name","value":"branchName"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"description"}},{"kind":"Field","name":{"kind":"Name","value":"commits"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"cursor"},"value":{"kind":"Variable","name":{"kind":"Name","value":"cursor"}}},{"kind":"Argument","name":{"kind":"Name","value":"limit"},"value":{"kind":"Variable","name":{"kind":"Name","value":"limit"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"totalCount"}},{"kind":"Field","name":{"kind":"Name","value":"cursor"}},{"kind":"Field","name":{"kind":"Name","value":"items"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"BaseCommitFields"}}]}}]}}]}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"BaseCommitFields"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"Commit"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"authorName"}},{"kind":"Field","name":{"kind":"Name","value":"authorId"}},{"kind":"Field","name":{"kind":"Name","value":"authorAvatar"}},{"kind":"Field","name":{"kind":"Name","value":"streamId"}},{"kind":"Field","name":{"kind":"Name","value":"streamName"}},{"kind":"Field","name":{"kind":"Name","value":"sourceApplication"}},{"kind":"Field","name":{"kind":"Name","value":"message"}},{"kind":"Field","name":{"kind":"Name","value":"referencedObject"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"commentCount"}}]}}]} as unknown as DocumentNode<ReadStreamBranchCommitsQuery, ReadStreamBranchCommitsQueryVariables>;
 export const MoveCommitsDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"MoveCommits"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"input"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"CommitsMoveInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"commitsMove"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"input"},"value":{"kind":"Variable","name":{"kind":"Name","value":"input"}}}]}]}}]} as unknown as DocumentNode<MoveCommitsMutation, MoveCommitsMutationVariables>;
 export const DeleteCommitsDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"DeleteCommits"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"input"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"CommitsDeleteInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"commitsDelete"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"input"},"value":{"kind":"Variable","name":{"kind":"Name","value":"input"}}}]}]}}]} as unknown as DocumentNode<DeleteCommitsMutation, DeleteCommitsMutationVariables>;
+export const CreateEmbedTokenDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"CreateEmbedToken"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"token"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"EmbedTokenCreateInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"projectMutations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"createEmbedToken"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"token"},"value":{"kind":"Variable","name":{"kind":"Name","value":"token"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"token"}}]}}]}}]}}]} as unknown as DocumentNode<CreateEmbedTokenMutation, CreateEmbedTokenMutationVariables>;
 export const GetWorkspacePlanPricesDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"GetWorkspacePlanPrices"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"serverInfo"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"workspaces"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"planPrices"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"usd"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"team"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"teamUnlimited"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"pro"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"proUnlimited"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"gbp"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"team"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"teamUnlimited"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"pro"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}},{"kind":"Field","name":{"kind":"Name","value":"proUnlimited"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"monthly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}},{"kind":"Field","name":{"kind":"Name","value":"yearly"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"amount"}},{"kind":"Field","name":{"kind":"Name","value":"currency"}}]}}]}}]}}]}}]}}]}}]}}]} as unknown as DocumentNode<GetWorkspacePlanPricesQuery, GetWorkspacePlanPricesQueryVariables>;
 export const CreateProjectModelDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"CreateProjectModel"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"input"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"CreateModelInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"modelMutations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"create"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"input"},"value":{"kind":"Variable","name":{"kind":"Name","value":"input"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"description"}}]}}]}}]}}]} as unknown as DocumentNode<CreateProjectModelMutation, CreateProjectModelMutationVariables>;
 export const FindProjectModelByNameDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"FindProjectModelByName"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"projectId"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}},{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"name"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"project"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"id"},"value":{"kind":"Variable","name":{"kind":"Name","value":"projectId"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"modelByName"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"name"},"value":{"kind":"Variable","name":{"kind":"Name","value":"name"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"description"}}]}}]}}]}}]} as unknown as DocumentNode<FindProjectModelByNameQuery, FindProjectModelByNameQueryVariables>;
@@ -6673,6 +6749,7 @@ export const CreateUserEmailDocument = {"kind":"Document","definitions":[{"kind"
 export const DeleteUserEmailDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"DeleteUserEmail"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"input"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"DeleteUserEmailInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"activeUserMutations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"emailMutations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"delete"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"input"},"value":{"kind":"Variable","name":{"kind":"Name","value":"input"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"UserWithEmails"}}]}}]}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"UserWithEmails"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"User"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"role"}},{"kind":"Field","name":{"kind":"Name","value":"emails"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"email"}},{"kind":"Field","name":{"kind":"Name","value":"verified"}},{"kind":"Field","name":{"kind":"Name","value":"primary"}}]}}]}}]} as unknown as DocumentNode<DeleteUserEmailMutation, DeleteUserEmailMutationVariables>;
 export const SetPrimaryUserEmailDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"SetPrimaryUserEmail"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"input"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"SetPrimaryUserEmailInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"activeUserMutations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"emailMutations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"setPrimary"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"input"},"value":{"kind":"Variable","name":{"kind":"Name","value":"input"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"UserWithEmails"}}]}}]}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"UserWithEmails"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"User"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"createdAt"}},{"kind":"Field","name":{"kind":"Name","value":"role"}},{"kind":"Field","name":{"kind":"Name","value":"emails"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"email"}},{"kind":"Field","name":{"kind":"Name","value":"verified"}},{"kind":"Field","name":{"kind":"Name","value":"primary"}}]}}]}}]} as unknown as DocumentNode<SetPrimaryUserEmailMutation, SetPrimaryUserEmailMutationVariables>;
 export const GetActiveUserDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"GetActiveUser"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"activeUser"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"BaseUserFields"}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"BaseUserFields"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"User"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"email"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"bio"}},{"kind":"Field","name":{"kind":"Name","value":"company"}},{"kind":"Field","name":{"kind":"Name","value":"avatar"}},{"kind":"Field","name":{"kind":"Name","value":"verified"}},{"kind":"Field","name":{"kind":"Name","value":"role"}}]}}]} as unknown as DocumentNode<GetActiveUserQuery, GetActiveUserQueryVariables>;
+export const ActiveUserUpdateMutationDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"mutation","name":{"kind":"Name","value":"activeUserUpdateMutation"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"user"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"UserUpdateInput"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"activeUserMutations"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"update"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"user"},"value":{"kind":"Variable","name":{"kind":"Name","value":"user"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"bio"}},{"kind":"Field","name":{"kind":"Name","value":"company"}},{"kind":"Field","name":{"kind":"Name","value":"avatar"}}]}}]}}]}}]} as unknown as DocumentNode<ActiveUserUpdateMutationMutation, ActiveUserUpdateMutationMutationVariables>;
 export const GetActiveUserWithWorkspaceJoinRequestsDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"GetActiveUserWithWorkspaceJoinRequests"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"activeUser"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"BaseUserFields"}},{"kind":"Field","name":{"kind":"Name","value":"workspaceJoinRequests"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"totalCount"}},{"kind":"Field","name":{"kind":"Name","value":"cursor"}},{"kind":"Field","name":{"kind":"Name","value":"items"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"workspace"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}}]}},{"kind":"Field","name":{"kind":"Name","value":"user"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}}]}},{"kind":"Field","name":{"kind":"Name","value":"status"}}]}}]}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"BaseUserFields"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"User"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"email"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"bio"}},{"kind":"Field","name":{"kind":"Name","value":"company"}},{"kind":"Field","name":{"kind":"Name","value":"avatar"}},{"kind":"Field","name":{"kind":"Name","value":"verified"}},{"kind":"Field","name":{"kind":"Name","value":"role"}}]}}]} as unknown as DocumentNode<GetActiveUserWithWorkspaceJoinRequestsQuery, GetActiveUserWithWorkspaceJoinRequestsQueryVariables>;
 export const GetOtherUserDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"GetOtherUser"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"id"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"otherUser"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"id"},"value":{"kind":"Variable","name":{"kind":"Name","value":"id"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"FragmentSpread","name":{"kind":"Name","value":"BaseLimitedUserFields"}}]}}]}},{"kind":"FragmentDefinition","name":{"kind":"Name","value":"BaseLimitedUserFields"},"typeCondition":{"kind":"NamedType","name":{"kind":"Name","value":"LimitedUser"}},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}},{"kind":"Field","name":{"kind":"Name","value":"bio"}},{"kind":"Field","name":{"kind":"Name","value":"company"}},{"kind":"Field","name":{"kind":"Name","value":"avatar"}},{"kind":"Field","name":{"kind":"Name","value":"verified"}}]}}]} as unknown as DocumentNode<GetOtherUserQuery, GetOtherUserQueryVariables>;
 export const GetAdminUsersDocument = {"kind":"Document","definitions":[{"kind":"OperationDefinition","operation":"query","name":{"kind":"Name","value":"GetAdminUsers"},"variableDefinitions":[{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"limit"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"Int"}}},"defaultValue":{"kind":"IntValue","value":"25"}},{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"offset"}},"type":{"kind":"NonNullType","type":{"kind":"NamedType","name":{"kind":"Name","value":"Int"}}},"defaultValue":{"kind":"IntValue","value":"0"}},{"kind":"VariableDefinition","variable":{"kind":"Variable","name":{"kind":"Name","value":"query"}},"type":{"kind":"NamedType","name":{"kind":"Name","value":"String"}},"defaultValue":{"kind":"NullValue"}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"adminUsers"},"arguments":[{"kind":"Argument","name":{"kind":"Name","value":"limit"},"value":{"kind":"Variable","name":{"kind":"Name","value":"limit"}}},{"kind":"Argument","name":{"kind":"Name","value":"offset"},"value":{"kind":"Variable","name":{"kind":"Name","value":"offset"}}},{"kind":"Argument","name":{"kind":"Name","value":"query"},"value":{"kind":"Variable","name":{"kind":"Name","value":"query"}}}],"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"totalCount"}},{"kind":"Field","name":{"kind":"Name","value":"items"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"registeredUser"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"email"}},{"kind":"Field","name":{"kind":"Name","value":"name"}}]}},{"kind":"Field","name":{"kind":"Name","value":"invitedUser"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"email"}},{"kind":"Field","name":{"kind":"Name","value":"invitedBy"},"selectionSet":{"kind":"SelectionSet","selections":[{"kind":"Field","name":{"kind":"Name","value":"id"}},{"kind":"Field","name":{"kind":"Name","value":"name"}}]}}]}}]}}]}}]}}]} as unknown as DocumentNode<GetAdminUsersQuery, GetAdminUsersQueryVariables>;
diff --git a/packages/server/test/graphql/users.ts b/packages/server/test/graphql/users.ts
index 6c602ff24..104629671 100644
--- a/packages/server/test/graphql/users.ts
+++ b/packages/server/test/graphql/users.ts
@@ -47,6 +47,19 @@ const getActiveUserQuery = gql`
   ${baseUserFieldsFragment}
 `
 
+export const activeUserUpdateMutation = gql`
+  mutation activeUserUpdateMutation($user: UserUpdateInput!) {
+    activeUserMutations {
+      update(user: $user) {
+        name
+        bio
+        company
+        avatar
+      }
+    }
+  }
+`
+
 export const getActiveUserWithWorkspaceJoinRequestsQuery = gql`
   query GetActiveUserWithWorkspaceJoinRequests {
     activeUser {
diff --git a/packages/server/test/projectHelper.ts b/packages/server/test/projectHelper.ts
index 56a52d322..63990ac5c 100644
--- a/packages/server/test/projectHelper.ts
+++ b/packages/server/test/projectHelper.ts
@@ -16,6 +16,7 @@ import { getEventBus } from '@/modules/shared/services/eventBus'
 import {
   createStreamFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import { createBranchFactory } from '@/modules/core/repositories/branches'
@@ -62,6 +63,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/test/speckle-helpers/blobHelper.ts b/packages/server/test/speckle-helpers/blobHelper.ts
index 21282952c..17fea6bd2 100644
--- a/packages/server/test/speckle-helpers/blobHelper.ts
+++ b/packages/server/test/speckle-helpers/blobHelper.ts
@@ -25,7 +25,7 @@ export const createTestBlob = async (params: { userId: string; projectId: string
   return await uploadFileStreamFactory({
     upsertBlob: upsertBlobFactory({ db: projectDb }),
     updateBlob: updateBlobFactory({ db: projectDb }),
-    storeFileStream: storeFileStreamFactory({ storage: projectStorage })
+    storeFileStream: storeFileStreamFactory({ storage: projectStorage.public })
   })(
     {
       userId,
diff --git a/packages/server/test/speckle-helpers/inviteHelper.ts b/packages/server/test/speckle-helpers/inviteHelper.ts
index 07115600a..815e98d9a 100644
--- a/packages/server/test/speckle-helpers/inviteHelper.ts
+++ b/packages/server/test/speckle-helpers/inviteHelper.ts
@@ -31,6 +31,7 @@ import {
 import { EmailSendingServiceMock } from '@/test/mocks/global'
 import {
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
 import { getUserFactory } from '@/modules/core/repositories/users'
@@ -74,6 +75,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
diff --git a/packages/server/test/speckle-helpers/streamHelper.ts b/packages/server/test/speckle-helpers/streamHelper.ts
index a14967179..fe4d10533 100644
--- a/packages/server/test/speckle-helpers/streamHelper.ts
+++ b/packages/server/test/speckle-helpers/streamHelper.ts
@@ -1,16 +1,14 @@
 import { db } from '@/db/knex'
 import { StreamAcl } from '@/modules/core/dbSchema'
-import { RegionalProjectCreationError } from '@/modules/core/errors/projects'
-import { StreamNotFoundError } from '@/modules/core/errors/stream'
 import { mapDbToGqlProjectVisibility } from '@/modules/core/helpers/project'
 import { StreamAclRecord, StreamRecord } from '@/modules/core/helpers/types'
 import { createBranchFactory } from '@/modules/core/repositories/branches'
-import { getProjectFactory } from '@/modules/core/repositories/projects'
 import { getServerInfoFactory } from '@/modules/core/repositories/server'
 import {
   createStreamFactory,
   getStreamCollaboratorsFactory,
   getStreamFactory,
+  getStreamRolesFactory,
   grantStreamPermissionsFactory,
   revokeStreamPermissionsFactory
 } from '@/modules/core/repositories/streams'
@@ -35,7 +33,6 @@ import { deleteOldAndInsertNewVerificationFactory } from '@/modules/emails/repos
 import { renderEmail } from '@/modules/emails/services/emailRendering'
 import { sendEmail } from '@/modules/emails/services/sending'
 import { requestNewEmailVerificationFactory } from '@/modules/emails/services/verification/request'
-import { getRegionDb } from '@/modules/multiregion/utils/dbSelector'
 import {
   deleteInvitesByTargetFactory,
   deleteServerOnlyInvitesFactory,
@@ -57,7 +54,6 @@ import {
 } from '@/modules/serverinvites/services/processing'
 import { inviteUsersToProjectFactory } from '@/modules/serverinvites/services/projectInviteManagement'
 import { authorizeResolver } from '@/modules/shared'
-import { isTestEnv } from '@/modules/shared/helpers/envHelper'
 import { Nullable } from '@/modules/shared/helpers/typeHelper'
 import { getEventBus } from '@/modules/shared/services/eventBus'
 import { getDefaultRegionFactory } from '@/modules/workspaces/repositories/regions'
@@ -65,8 +61,7 @@ import { createWorkspaceProjectFactory } from '@/modules/workspaces/services/pro
 import { BasicTestUser } from '@/test/authHelper'
 import { ProjectVisibility } from '@/test/graphql/generated/graphql'
 import { faker } from '@faker-js/faker'
-import { retry } from '@lifeomic/attempt'
-import { ensureError, Roles, StreamRoles, TIME_MS } from '@speckle/shared'
+import { ensureError, Roles, StreamRoles } from '@speckle/shared'
 import { omit } from 'lodash'
 
 const getServerInfo = getServerInfoFactory({ db })
@@ -86,6 +81,7 @@ const buildFinalizeProjectInvite = () =>
         validateStreamAccess: validateStreamAccessFactory({ authorizeResolver }),
         getUser,
         grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+        getStreamRoles: getStreamRolesFactory({ db }),
         emitEvent: getEventBus().emit
       })
     }),
@@ -156,6 +152,7 @@ const removeStreamCollaborator = removeStreamCollaboratorFactory({
   validateStreamAccess,
   isStreamCollaborator,
   revokeStreamPermissions: revokeStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -163,6 +160,7 @@ const addOrUpdateStreamCollaborator = addOrUpdateStreamCollaboratorFactory({
   validateStreamAccess,
   getUser,
   grantStreamPermissions: grantStreamPermissionsFactory({ db }),
+  getStreamRoles: getStreamRolesFactory({ db }),
   emitEvent: getEventBus().emit
 })
 
@@ -221,45 +219,11 @@ export async function createTestStream(
     })
     id = newProject.id
   } else {
-    // Create personal project
-    if (streamObj.regionKey) {
-      const regionDb = await getRegionDb({ regionKey: streamObj.regionKey })
-      const project = await createStreamFactory({ db: regionDb })({
-        ...omit(streamObj, ['id', 'ownerId', 'visibility']),
-        isPublic: visibility === ProjectVisibility.Public
-      })
-      try {
-        await retry(
-          async () => {
-            const replicatedProject = await getProjectFactory({
-              db
-            })({ projectId: project.id })
-            if (!replicatedProject) throw new StreamNotFoundError()
-          },
-          { maxAttempts: 10, delay: isTestEnv() ? TIME_MS.second : undefined }
-        )
-      } catch (err) {
-        if (err instanceof StreamNotFoundError) {
-          throw new RegionalProjectCreationError(undefined, {
-            info: { projectId: project.id, regionKey: streamObj.regionKey }
-          })
-        }
-        // else throw as is
-        throw err
-      }
-      await grantStreamPermissionsFactory({ db })({
-        streamId: project.id,
-        userId: owner.id,
-        role: Roles.Stream.Owner
-      })
-      id = project.id
-    } else {
-      id = await createStream({
-        ...omit(streamObj, ['id', 'ownerId', 'visibility']),
-        isPublic: visibility === ProjectVisibility.Public,
-        ownerId: owner.id
-      })
-    }
+    id = await createStream({
+      ...omit(streamObj, ['id', 'ownerId', 'visibility']),
+      isPublic: visibility === ProjectVisibility.Public,
+      ownerId: owner.id
+    })
   }
 
   streamObj.id = id
diff --git a/packages/shared/src/authz/domain/authErrors.ts b/packages/shared/src/authz/domain/authErrors.ts
index ff6eecc9b..15b03c157 100644
--- a/packages/shared/src/authz/domain/authErrors.ts
+++ b/packages/shared/src/authz/domain/authErrors.ts
@@ -116,7 +116,7 @@ export const WorkspaceLimitsReachedError = defineAuthError<
   message: 'Workspace limits have been reached'
 })
 
-export const WorkspaceNoFeatureAccessError = defineAuthError({
+export const WorkspacePlanNoFeatureAccessError = defineAuthError({
   code: 'WorkspaceNoFeatureAccess',
   message: 'Your workspace plan does not have access to this feature.'
 })
diff --git a/packages/shared/src/authz/policies/index.ts b/packages/shared/src/authz/policies/index.ts
index 71ade434c..def12f934 100644
--- a/packages/shared/src/authz/policies/index.ts
+++ b/packages/shared/src/authz/policies/index.ts
@@ -31,6 +31,7 @@ import { canLoadPolicy } from './project/canLoad.js'
 import { canReadMemberEmailPolicy } from './workspace/canReadMemberEmail.js'
 import { canCreateWorkspacePolicy } from './workspace/canCreateWorkspace.js'
 import { canUseWorkspacePlanFeature } from './workspace/canUseWorkspacePlanFeature.js'
+import { canUpdateEmbedTokensPolicy } from './project/canUpdateEmbedTokens.js'
 
 export const authPoliciesFactory = (loaders: AllAuthCheckContextLoaders) => ({
   project: {
@@ -68,7 +69,9 @@ export const authPoliciesFactory = (loaders: AllAuthCheckContextLoaders) => ({
     canLeave: canLeaveProjectPolicy(loaders),
     canInvite: canInviteToProjectPolicy(loaders),
     canPublish: canPublishPolicy(loaders),
-    canLoad: canLoadPolicy(loaders)
+    canLoad: canLoadPolicy(loaders),
+    canReadEmbedTokens: canUpdateEmbedTokensPolicy(loaders),
+    canUpdateEmbedTokens: canUpdateEmbedTokensPolicy(loaders)
   },
   workspace: {
     canCreateProject: canCreateWorkspaceProjectPolicy(loaders),
diff --git a/packages/shared/src/authz/policies/project/canUpdateEmbedTokens.spec.ts b/packages/shared/src/authz/policies/project/canUpdateEmbedTokens.spec.ts
new file mode 100644
index 000000000..1ffeb6e04
--- /dev/null
+++ b/packages/shared/src/authz/policies/project/canUpdateEmbedTokens.spec.ts
@@ -0,0 +1,134 @@
+import cryptoRandomString from 'crypto-random-string'
+import { Roles } from '../../../core/constants.js'
+import { parseFeatureFlags } from '../../../environment/index.js'
+import { getProjectFake, getWorkspaceFake } from '../../../tests/fakes.js'
+import { canUpdateEmbedTokensPolicy } from './canUpdateEmbedTokens.js'
+import { assert, describe, expect, it } from 'vitest'
+import {
+  ProjectNotEnoughPermissionsError,
+  ServerNoAccessError,
+  WorkspacePlanNoFeatureAccessError
+} from '../../domain/authErrors.js'
+import { OverridesOf } from '../../../tests/helpers/types.js'
+
+const buildCanUpdateEmbedTokens = (
+  overrides?: OverridesOf<typeof canUpdateEmbedTokensPolicy>
+) => {
+  const workspaceId = cryptoRandomString({ length: 9 })
+
+  return canUpdateEmbedTokensPolicy({
+    getEnv: async () => parseFeatureFlags({ FF_WORKSPACES_MODULE_ENABLED: 'true' }),
+    getServerRole: async () => {
+      return Roles.Server.User
+    },
+    getProject: getProjectFake({
+      id: 'project-id',
+      workspaceId
+    }),
+    getProjectRole: async () => {
+      return Roles.Stream.Owner
+    },
+    getWorkspace: getWorkspaceFake({
+      id: workspaceId
+    }),
+    getWorkspaceRole: async () => {
+      return Roles.Workspace.Admin
+    },
+    getWorkspaceSsoProvider: async () => {
+      return null
+    },
+    getWorkspaceSsoSession: async () => {
+      assert.fail()
+    },
+    getWorkspacePlan: async () => {
+      return {
+        status: 'valid',
+        workspaceId,
+        name: 'unlimited',
+        createdAt: new Date(),
+        updatedAt: new Date()
+      }
+    },
+    ...overrides
+  })
+}
+
+const canUpdateEmbedTokensArgs = () => ({
+  userId: cryptoRandomString({ length: 9 }),
+  projectId: cryptoRandomString({ length: 9 })
+})
+
+describe('canUpdateEmbedTokensArgs returns a function, that', () => {
+  it('requires a user session', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getServerRole: async () => {
+        return null
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: ServerNoAccessError.code
+    })
+  })
+  it('requires user to be project owner', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getWorkspaceRole: async () => {
+        return Roles.Workspace.Member
+      },
+      getProjectRole: async () => {
+        return Roles.Stream.Contributor
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: ProjectNotEnoughPermissionsError.code
+    })
+  })
+  it('does not check workspace plan if workspaces not enabled', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getEnv: async () =>
+        parseFeatureFlags({
+          FF_WORKSPACES_MODULE_ENABLED: 'false'
+        }),
+      getWorkspacePlan: async () => {
+        assert.fail()
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthOKResult()
+  })
+  it('does not check workspace plan if project is not in a workspace', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getProject: getProjectFake({
+        id: 'project-id',
+        workspaceId: null
+      }),
+      getWorkspacePlan: async () => {
+        assert.fail()
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthOKResult()
+  })
+  it('requires a paid workspace plan, if project is in a workspace', async () => {
+    const result = await buildCanUpdateEmbedTokens({
+      getWorkspacePlan: async () => {
+        return {
+          status: 'valid',
+          workspaceId: 'foo',
+          name: 'free',
+          createdAt: new Date(),
+          updatedAt: new Date()
+        }
+      }
+    })(canUpdateEmbedTokensArgs())
+
+    expect(result).toBeAuthErrorResult({
+      code: WorkspacePlanNoFeatureAccessError.code
+    })
+  })
+  it('allows action on paid workspace plans', async () => {
+    const result = await buildCanUpdateEmbedTokens()(canUpdateEmbedTokensArgs())
+    expect(result).toBeAuthOKResult()
+  })
+})
diff --git a/packages/shared/src/authz/policies/project/canUpdateEmbedTokens.ts b/packages/shared/src/authz/policies/project/canUpdateEmbedTokens.ts
new file mode 100644
index 000000000..27521c429
--- /dev/null
+++ b/packages/shared/src/authz/policies/project/canUpdateEmbedTokens.ts
@@ -0,0 +1,101 @@
+import { err, ok } from 'true-myth/result'
+import {
+  ProjectNoAccessError,
+  ProjectNotEnoughPermissionsError,
+  ProjectNotFoundError,
+  ServerNoAccessError,
+  ServerNoSessionError,
+  ServerNotEnoughPermissionsError,
+  WorkspaceNoAccessError,
+  WorkspacePlanNoFeatureAccessError,
+  WorkspaceNotEnoughPermissionsError,
+  WorkspaceSsoSessionNoAccessError
+} from '../../domain/authErrors.js'
+import { MaybeUserContext, ProjectContext } from '../../domain/context.js'
+import { Loaders } from '../../domain/loaders.js'
+import { AuthPolicy } from '../../domain/policies.js'
+import {
+  ensureImplicitProjectMemberWithWriteAccessFragment,
+  ensureMinimumProjectRoleFragment
+} from '../../fragments/projects.js'
+import { Roles } from '../../../core/constants.js'
+
+type PolicyLoaderKeys =
+  | typeof Loaders.getEnv
+  | typeof Loaders.getServerRole
+  | typeof Loaders.getProject
+  | typeof Loaders.getWorkspaceRole
+  | typeof Loaders.getWorkspace
+  | typeof Loaders.getWorkspaceSsoProvider
+  | typeof Loaders.getWorkspaceSsoSession
+  | typeof Loaders.getProjectRole
+  | typeof Loaders.getWorkspacePlan
+
+type PolicyArgs = MaybeUserContext & ProjectContext
+
+type PolicyErrors = InstanceType<
+  | typeof ServerNoAccessError
+  | typeof ServerNoSessionError
+  | typeof ServerNotEnoughPermissionsError
+  | typeof ProjectNotFoundError
+  | typeof ProjectNoAccessError
+  | typeof WorkspaceNoAccessError
+  | typeof WorkspaceSsoSessionNoAccessError
+  | typeof ProjectNotEnoughPermissionsError
+  | typeof WorkspaceNotEnoughPermissionsError
+  | typeof WorkspacePlanNoFeatureAccessError
+>
+
+export const canUpdateEmbedTokensPolicy: AuthPolicy<
+  PolicyLoaderKeys,
+  PolicyArgs,
+  PolicyErrors
+> =
+  (loaders) =>
+  async ({ userId, projectId }) => {
+    const env = await loaders.getEnv()
+    const project = await loaders.getProject({ projectId })
+
+    if (!!project?.workspaceId && env.FF_WORKSPACES_MODULE_ENABLED) {
+      // Ensure owner-level access and valid plan
+      const ensuredProjectRole =
+        await ensureImplicitProjectMemberWithWriteAccessFragment(loaders)({
+          userId,
+          projectId,
+          role: Roles.Stream.Owner
+        })
+      if (ensuredProjectRole.isErr) {
+        return err(ensuredProjectRole.error)
+      }
+
+      const plan = await loaders.getWorkspacePlan({ workspaceId: project.workspaceId })
+
+      switch (plan?.name) {
+        case 'academia':
+        case 'enterprise':
+        case 'pro':
+        case 'proUnlimited':
+        case 'proUnlimitedInvoiced':
+        case 'team':
+        case 'teamUnlimited':
+        case 'teamUnlimitedInvoiced':
+        case 'unlimited':
+          return ok()
+        case 'free':
+        default:
+          return err(new WorkspacePlanNoFeatureAccessError())
+      }
+    } else {
+      // Ensure project owner
+      const isProjectOwner = await ensureMinimumProjectRoleFragment(loaders)({
+        userId: userId!,
+        projectId,
+        role: Roles.Stream.Owner
+      })
+      if (isProjectOwner.isErr) {
+        return err(isProjectOwner.error)
+      }
+
+      return ok()
+    }
+  }
diff --git a/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.spec.ts b/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.spec.ts
index 26d82e8a1..bb8b7b47c 100644
--- a/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.spec.ts
+++ b/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.spec.ts
@@ -10,7 +10,7 @@ import {
   ServerNoSessionError,
   ServerNotEnoughPermissionsError,
   WorkspaceNoAccessError,
-  WorkspaceNoFeatureAccessError,
+  WorkspacePlanNoFeatureAccessError,
   WorkspaceNotEnoughPermissionsError,
   WorkspaceReadOnlyError
 } from '../../domain/authErrors.js'
@@ -151,7 +151,7 @@ describe('canUseFeature', () => {
     })
 
     expect(result).toBeAuthErrorResult({
-      code: WorkspaceNoFeatureAccessError.code
+      code: WorkspacePlanNoFeatureAccessError.code
     })
   })
 
diff --git a/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.ts b/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.ts
index 230a164f5..5a093d014 100644
--- a/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.ts
+++ b/packages/shared/src/authz/policies/workspace/canUseWorkspacePlanFeature.ts
@@ -4,7 +4,7 @@ import {
   ServerNoSessionError,
   ServerNotEnoughPermissionsError,
   WorkspaceNoAccessError,
-  WorkspaceNoFeatureAccessError,
+  WorkspacePlanNoFeatureAccessError,
   WorkspaceNotEnoughPermissionsError,
   WorkspaceReadOnlyError,
   WorkspacesNotEnabledError,
@@ -43,7 +43,7 @@ type PolicyErrors =
   | InstanceType<typeof ServerNoAccessError>
   | InstanceType<typeof ServerNotEnoughPermissionsError>
   | InstanceType<typeof WorkspaceNotEnoughPermissionsError>
-  | InstanceType<typeof WorkspaceNoFeatureAccessError>
+  | InstanceType<typeof WorkspacePlanNoFeatureAccessError>
 
 export const canUseWorkspacePlanFeature: AuthPolicy<
   PolicyLoaderKeys,
@@ -63,10 +63,10 @@ export const canUseWorkspacePlanFeature: AuthPolicy<
     if (ensuredNotReadOnly.isErr) return err(ensuredNotReadOnly.error)
 
     const workspacePlan = await loaders.getWorkspacePlan({ workspaceId })
-    if (!workspacePlan) return err(new WorkspaceNoFeatureAccessError())
+    if (!workspacePlan) return err(new WorkspacePlanNoFeatureAccessError())
     const canUseFeature = workspacePlanHasAccessToFeature({
       plan: workspacePlan.name,
       feature
     })
-    return canUseFeature ? ok() : err(new WorkspaceNoFeatureAccessError())
+    return canUseFeature ? ok() : err(new WorkspacePlanNoFeatureAccessError())
   }
diff --git a/packages/shared/src/environment/db.ts b/packages/shared/src/environment/db.ts
index 7ed22f8dc..5a453b35f 100644
--- a/packages/shared/src/environment/db.ts
+++ b/packages/shared/src/environment/db.ts
@@ -32,7 +32,19 @@ const regionConfigSchema = z.object({
       .optional()
   }),
   blobStorage: z.object({
-    endpoint: z.string().url().describe('URL of the S3-compatible storage endpoint'),
+    endpoint: z
+      .string()
+      .url()
+      .describe(
+        'URL of the S3-compatible storage endpoint, accessible from the server'
+      ),
+    publicEndpoint: z
+      .string()
+      .url()
+      .optional()
+      .describe(
+        'Public URL of the S3-compatible storage endpoint, accessible from clients via the public internet'
+      ),
     accessKey: z.string().describe('Access key for the S3-compatible storage endpoint'),
     secretKey: z.string().describe('Secret key for the S3-compatible storage endpoint'),
     bucket: z.string().describe('Name of the S3-compatible storage bucket'),
diff --git a/packages/shared/src/environment/index.ts b/packages/shared/src/environment/index.ts
index 900a38f85..34a766d67 100644
--- a/packages/shared/src/environment/index.ts
+++ b/packages/shared/src/environment/index.ts
@@ -109,6 +109,18 @@ export const parseFeatureFlags = (
       description:
         'Enables the new file importer to handle large files via pre-signed URLs.',
       defaults: { _: false }
+    },
+    FF_LEGACY_IFC_IMPORTER_ENABLED: {
+      schema: z.boolean(),
+      description:
+        'Enables the legacy javascript based webIFC file importer (pre-2025). Even if disabled this importer can be accessed by appending `.legacyimporter.ifc` to the uploaded file name. This is deprecated and will be removed in the future.',
+      defaults: { _: false }
+    },
+    FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED: {
+      schema: z.boolean(),
+      description:
+        'Enables the IFC file importer based on IFCOpenShell (as of July 2025). Even if enabled, the previous webIFC & .Net importer can be accessed by appending `.dotnetimporter.ifc` to the uploaded file name.',
+      defaults: { _: false }
     }
   })
 
@@ -142,6 +154,8 @@ export type FeatureFlags = {
   FF_PERSONAL_PROJECTS_LIMITS_ENABLED: boolean
   FF_NEXT_GEN_FILE_IMPORTER_ENABLED: boolean
   FF_LARGE_FILE_IMPORTS_ENABLED: boolean
+  FF_LEGACY_IFC_IMPORTER_ENABLED: boolean
+  FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED: boolean
 }
 
 export function getFeatureFlags(): FeatureFlags {
diff --git a/utils/docker-compose-ingress/Dockerfile b/utils/docker-compose-ingress/Dockerfile
index b160f88b5..fe5ea98a0 100644
--- a/utils/docker-compose-ingress/Dockerfile
+++ b/utils/docker-compose-ingress/Dockerfile
@@ -5,4 +5,4 @@ RUN mkdir -p /var/nginx
 COPY utils/docker-compose-ingress/nginx/templates /etc/nginx/templates
 COPY utils/docker-compose-ingress/nginx/conf/mime.types /etc/nginx/mime.types
 
-EXPOSE 8080
\ No newline at end of file
+EXPOSE 8080
diff --git a/utils/helm/speckle-server/templates/fileimport_service/deployment.yml b/utils/helm/speckle-server/templates/fileimport_service/deployment.yml
index b280d7553..5aeb5ce48 100644
--- a/utils/helm/speckle-server/templates/fileimport_service/deployment.yml
+++ b/utils/helm/speckle-server/templates/fileimport_service/deployment.yml
@@ -151,6 +151,14 @@ spec:
           - name: FF_NEXT_GEN_FILE_IMPORTER_ENABLED
             value: {{ .Values.featureFlags.nextGenFileImporterEnabled | quote }}
           {{- end }}
+          {{- if .Values.featureFlags.experimentalIfcImporterEnabled }}
+          - name: FF_EXPERIMENTAL_IFC_IMPORTER_ENABLED
+            value: {{ .Values.featureFlags.experimentalIfcImporterEnabled | quote }}
+          {{- end }}
+          {{- if .Values.featureFlags.legacyIfcImporterEnabled }}
+          - name: FF_LEGACY_IFC_IMPORTER_ENABLED
+            value: {{ .Values.featureFlags.legacyIfcImporterEnabled | quote }}
+          {{- end }}
           {{- with .Values.fileimport_service.additionalEnvVars }}
           {{- toYaml . | nindent 10}}
           {{- end }}
diff --git a/utils/helm/speckle-server/values.schema.json b/utils/helm/speckle-server/values.schema.json
index 16ae24923..218fb6cd0 100644
--- a/utils/helm/speckle-server/values.schema.json
+++ b/utils/helm/speckle-server/values.schema.json
@@ -109,6 +109,16 @@
           "type": "boolean",
           "description": "Enables the ability to upload large files to Speckle",
           "default": false
+        },
+        "experimentalIfcImporterEnabled": {
+          "type": "boolean",
+          "description": "Enables the ability to parse IFC files using the experimental IFC importer",
+          "default": false
+        },
+        "legacyIfcImporterEnabled": {
+          "type": "boolean",
+          "description": "Enables the ability to parse IFC files using the legacy IFC importer.",
+          "default": false
         }
       }
     },
diff --git a/utils/helm/speckle-server/values.yaml b/utils/helm/speckle-server/values.yaml
index f07725c66..9d532d233 100644
--- a/utils/helm/speckle-server/values.yaml
+++ b/utils/helm/speckle-server/values.yaml
@@ -65,6 +65,10 @@ featureFlags:
   nextGenFileImporterEnabled: false
   ## @param featureFlags.largeFileUploadsEnabled Enables the ability to upload large files to Speckle
   largeFileUploadsEnabled: false
+  ## @param featureFlags.experimentalIfcImporterEnabled Enables the ability to parse IFC files using the experimental IFC importer
+  experimentalIfcImporterEnabled: false
+  ## @param featureFlags.legacyIfcImporterEnabled Enables the ability to parse IFC files using the legacy IFC importer.
+  legacyIfcImporterEnabled: false
 
 analytics:
   ## @param analytics.enabled Enable or disable analytics
diff --git a/utils/postgres/Dockerfile b/utils/postgres/Dockerfile
index b8a82b726..dc9a9ea06 100644
--- a/utils/postgres/Dockerfile
+++ b/utils/postgres/Dockerfile
@@ -1,9 +1,9 @@
 FROM postgres:16.4-alpine3.20@sha256:d898b0b78a2627cb4ee63464a14efc9d296884f1b28c841b0ab7d7c42f1fffdf AS builder
 
-RUN apk add --no-cache 'git=2.45.3-r0' \
-    'build-base=0.5-r3' \
-    'clang15=15.0.7-r19' \
-    'llvm15=15.0.7-r14'
+RUN apk add --no-cache 'git=2.45.4-r0' \
+  'build-base=0.5-r3' \
+  'clang15=15.0.7-r19' \
+  'llvm15=15.0.7-r14'
 
 WORKDIR /aiven-extras
 # hack to clone only a single commit, so that the cache is not invalidated by other changes in the repo