Although it's an optional feature, it slightly concerns me from a perspective of testability (in the future) and maintainability that Vellum would be dependent on such a large chunk of HQ.

https://github.com/dimagi/commcare-hq/blob/44b37d2a5a0727b54d48571aeaa2aecf472c1d38/corehq/apps/hqmedia/static/hqmedia/js/hqmedia.upload_controller.js seems like it's basically a separate component which gets reused in both the app builder and Vellum but has a relatively small and well-defined interface with surrounding code.

Would it be worth making a separate repo for it?  This is the sort of thing that I could easily imagine being a JavaScript library.