Split IDP and SSO server into separate packages
Since they're separate components, splitting the code might make it more obvious which parts of the stack are replaceable.
Possibly still within the same binary though, no reason to come up with yet another callback protocol.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information