Hide default capture sources whose output can never pass allowedFileTypes

[BSalaeddin]

In 3.1.0 the default sources are:

DEFAULT_SOURCES = ["camera", "local", "microphone", "screen", "url"]

(@upupjs/core/dist/internal.cjs)

v1's default surface was effectively local + url. After migrating one of our apps (which never passed a sources prop because the v1 default was fine), the widget suddenly showed camera / microphone / screen-record buttons. Their output (webm) wasn't in the app's allowedFileTypes, so a user could record a clip and then hit a validation dead end.

We fixed it with sources={['local', 'url']}, but it shipped as a regression first and only got caught in review.

Two suggestions:

1. call this out in the migration guide's gotchas — anyone relying on the v1 default gets three new capture sources silently
2. longer term, consider hiding capture sources whose output can never pass the configured allowedFileTypes — a mic button that always produces a rejected file is never what anyone wants

[AminDhouib]

Suggestion 1 is implemented in #353: the migration guide's "Sources & cloud drives" section now carries a warning callout on exactly this (v1's effective default was local + url; v3 defaults to five sources including the three capture panels, whose MediaRecorder output may not pass your allowedFileTypes), plus a sources={['local', 'url']} snippet and an entry in the before/after gotchas checklist.

Suggestion 2 (hide capture sources whose output can never pass the configured accept list) is assessed and worth doing — keeping this issue open, rescoped to it. Feasibility notes from the assessment:

• The filter is cheap to place: resolvedSources and the accept list are both computed in normalizeUploaderOptions (packages/core/src/uploader/normalize-options.ts), so core is the only code that changes and all six frameworks inherit it for free.
• Each capture source needs a declared output-MIME set (camera → image/* + video/*, microphone → audio/webm, screen → video/webm), matched against an accept string that may contain wildcards, bare extensions, or preset aliases.
• Policy: extension-only accept lists (.png,.pdf) are ambiguous and must fail OPEN (never hide a source we can't prove useless). Filtering applies to the DEFAULT source set only — an explicitly passed sources array is always honored (ideally with a dev-mode warning on a contradictory combination).
• Blast radius: parity fixtures whose accept lists exclude a capture source lose chips from the normalized DOM, so this lands with a parity-fixture regen and a full six-framework run — a scoped ~1-day 3.2 candidate.