fix(core): re-host non-http(s) CORS iframe URLs instead of failing upload

[Shivanshu-07]

Problem

Percy CLI fails snapshot upload when a page includes an iframe whose src is a blob: URL:

[percy:core] Error: Invalid URL, scheme must be http or https: blob:https://www.example.com

Regression introduced by #2121, which moved CORS iframe processing into @percy/core. Reported in #2285 (works on 1.31.7, fails on 1.31.14+).

Root cause

processCorsIframesInDomSnapshot() in packages/core/src/utils.js creates an upload resource for every CORS iframe, keyed on the iframe's frameUrl:

const iframeResource = { url: frameUrlWithWidth, content: iframeSnapshot.html, mimetype: 'text/html' };

A blob: URL is an in-memory handle that only exists in the originating browser context — there is no endpoint to fetch, it is scoped to the creating document, and it is revoked on unload. Percy's renderer (a separate browser) can never resolve it. When the iframe src is blob: (also data:, about:), that URL is sent to the API as a resource-url; the API rejects any non-http(s) scheme (snapshot_service.rb → Invalid URL, scheme must be http or https), failing the entire snapshot upload.

Fix

@percy/dom already handles blob URLs correctly for stylesheets (serialize-cssom.js): it extracts the content and re-hosts it under a synthetic /__serialized__/ http(s) URL via resourceFromText. The CORS iframe path never applied that pattern — this PR brings it to parity.

For a non-http(s) frameUrl, buildSyntheticFrameResourceUrl() mints a synthetic http(s) URL from the captured iframe HTML:

• resolved against the page origin (options.url), with localhost/127.0.0.1 rewritten to render.percy.local — matching how serialized DOM resources are hosted;
• path /__serialized__/cors-iframe-<percyElementId>.html (percyElementId URL-encoded);
• used for both the upload resource url and the rewritten iframe src, so the renderer serves the captured content exactly as it does an ordinary cross-origin iframe.

The blob URL never reaches the API, the snapshot uploads successfully, and the iframe content is preserved and renderable. Frames without a percyElementId (where the src cannot be rewritten to the synthetic URL) are skipped so no resource is orphaned. http(s) frames are completely unchanged.

Tests

packages/core/test/utils.test.js:

• isHttpOrHttpsUrl, rewriteLocalhostURL, buildSyntheticFrameResourceUrl helpers (origin resolution, localhost rewrite, render.percy.local fallback, id encoding, null when no percyElementId)
• processCorsIframesInDomSnapshot: re-hosts a blob frameUrl (resource + src rewritten, no blob: left), re-hosts data/about against render.percy.local fallback, skips a non-http(s) frame with no percyElementId, mixed http+blob array

All 121 utils specs and all Snapshot › CORS iframe processing integration specs pass; lint clean; unreachable defensive catch marked with istanbul ignore.

Fixes PER-9574 / closes #2285

🤖 Generated with Claude Code