Bumps [eslint](https://github.com/eslint/eslint) from 8.7.0 to 8.8.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.7.0...v8.8.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](https://github.com/cure53/DOMPurify/compare/2.3.4...2.3.5)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Replace use of local utility classes with tailwind
utility classes that do the same thing. Structure the utilities
layer for both sidebar and annotator.

Clarify what happens if we try to test whether a VitalSource frame
contains "real content", before it has finished loading.

The real VitalSource viewer loads the final URL with a form submission,
which does not update the `src` attribute of the iframe. Make the demo
page also load the app in a way that doesn't modify the parent frame's
DOM, to ensure the client is not relying on that.

I don't know if these scenarios can actually happen in the real VS viewer, but
this feels like appropriate defensive coding.

Navigations between sections of a book in VitalSource happen in several
steps:

 1. The iframe for the previous chapter is removed
 2. An iframe is created for the new chapter. The initial load of this
    iframe contains a "blank" page with the chapter content in an
    encoded/encrypted form as hidden text in the page.
 3. The chapter content data is submitted to the VS backend via a form
    POST request, which returns the decoded content

Previously the Hypothesis client would sometimes detect the new iframe
after step 2 and inject the client before step 3 had completed. As a
result the client would be injected into the blank frame, then
immediately unloaded, and not re-loaded into the "real" content frame.

Make injection more reliable by:

 1. Checking whether the content frame is a "blank" frame or not before
    injecting the client.
 2. Listening for `load` events on the frame and re-injecting the client
    if the iframe is navigated

The VitalSource EPUB test page was missing an important behavior of the
real VS viewer, where the content loads in multiple steps - see code
comments for details. The client does not load reliably into the new
chapter after a navigation due to this behavior of the VS viewer.

Get the WebSocket URL from the /api/links endpoint instead of the `websocketUrl`
configuration in app.html. This ensures that the client uses the correct
WebSocket endpoint for the h API service it is currently talking to, which may
be different than the default when  `services` configuration is specified.

When updating the tests, several had to be reworked to be less sensitive
to the number of microtask ticks in between certain events.

This depends on the h change in https://github.com/hypothesis/h/pull/7253.

CSS reset via tailwind preflight changes SVG default display. Adjust to
make things look as before.

See https://tailwindcss.com/docs/preflight#images-are-block-level

Tutorial needed a little adjustment after preflight enabled, so it has
been fully converted to tailwind at this time.

This component needed some adjustment after a CSS reset was applied, so
it has been converted to Tailwind.

Reimplement `elements` styles as TW-style CSS and put in `base` layer
Convert variables in sidebar body styles to Tailwind values and move to
base layer

To be able to use `frontend-shared` components that use Tailwind
utility classes, we need to let Tailwind know not to strip classes used
in the frontend-shared package source.

Co-authored-by: Robert Knight <robertknight@gmail.com>

I have changed the term `anchor` to `annotation` when referring to
events related to selecting or focusing annotations. I kept the
reference to `anchor` when referring to scrolling.

This PR makes the `Buckets` component to accept a simplified data
structure that doesn't contain `anchor`s. The `anchor` objects are no
longer needed and the can't be serialised (because they contain DOM
elements).

In order to decouple `BucketBar` from `Guest` we need to send RPC events
through the `guest-host` inter-frame communication channel.  The
messages must trigger identical behaviour on the `Guest`.

In this PR, we replace the direct use of `Guest#scrollToAnchor` by a new
RPC event, `scrollToAnnotations`.

Bumps [mocha](https://github.com/mochajs/mocha) from 9.1.4 to 9.2.0.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mochajs/mocha/compare/v9.1.4...v9.2.0)

---
updated-dependencies:
- dependency-name: mocha
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [puppeteer](https://github.com/puppeteer/puppeteer) from 13.0.1 to 13.1.1.
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/puppeteer/puppeteer/compare/v13.0.1...v13.1.1)

---
updated-dependencies:
- dependency-name: puppeteer
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.16.8 to 7.16.11.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.16.11/packages/babel-preset-env)

---
updated-dependencies:
- dependency-name: "@babel/preset-env"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.16.7 to 7.16.12.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.16.12/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@sentry/browser](https://github.com/getsentry/sentry-javascript) from 6.16.1 to 6.17.0.
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-javascript/compare/6.16.1...6.17.0)

---
updated-dependencies:
- dependency-name: "@sentry/browser"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.5.4 to 4.5.5.
- [Release notes](https://github.com/Microsoft/TypeScript/releases)
- [Commits](https://github.com/Microsoft/TypeScript/compare/v4.5.4...v4.5.5)

---
updated-dependencies:
- dependency-name: typescript
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sass](https://github.com/sass/dart-sass) from 1.48.0 to 1.49.0.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.48.0...1.49.0)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [rollup](https://github.com/rollup/rollup) from 2.64.0 to 2.66.0.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v2.64.0...v2.66.0)

---
updated-dependencies:
- dependency-name: rollup
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@sentry/cli](https://github.com/getsentry/sentry-cli) from 1.71.0 to 1.72.0.
- [Release notes](https://github.com/getsentry/sentry-cli/releases)
- [Changelog](https://github.com/getsentry/sentry-cli/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-cli/compare/1.71.0...1.72.0)

---
updated-dependencies:
- dependency-name: "@sentry/cli"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1058.0 to 2.1062.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1058.0...v2.1062.0)

---
updated-dependencies:
- dependency-name: aws-sdk
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [log4js](https://github.com/log4js-node/log4js-node) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/log4js-node/log4js-node/releases)
- [Changelog](https://github.com/log4js-node/log4js-node/blob/master/CHANGELOG.md)
- [Commits](https://github.com/log4js-node/log4js-node/compare/v6.3.0...v6.4.0)

---
updated-dependencies:
- dependency-name: log4js
  dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>

I can't see any negative consequence of starting to listen to
postMessage discovery message immediately after `PortProvider` is
instantiated. (In fact, this is what it was currently happening). These
messages won't be lost, and the `PortRPC`s won't create the
communication channels before the RPC methods are registered.

On the other hand, it simplifies the use of `PortProvider` and
eliminates the potential problem of `PortProvider#listen` been called
more than once.

Construction of the integration was recently moved to happen earlier in the
Guest.  This caused a regression in the VitalSource integration, which may
synchronously call `Guest#injectClient` when constructed. `injectClient` in turn
relies on `_hypothesisInjector` being initialized, which was not the case.

The error could be seen in the dev server's VS test case at
http://localhost:3000/document/vitalsource-epub.

Fix the issue by moving `_hypothesisInjector` initialization to happen earlier
in the Guest constructor, before `createIntegration` is called.

`BucketBar` was setting the focus when hovering on the left-pointed
buckets. That relied on direct access to the anchors, which it is not
always possible. Instead, now the `BucketBar` communicates with a new
RPC event, `focusAnnotations`, in the `guest-host` channel (analogous to
the `focusAnnotations` in the `sidebar-guest` channel.

I have made a small improvement: when hovering a left-pointed bucket,
not only focus the anchor's highlights but also the corresponding
annotation cards in the sidebar. The same can be done for top and
bottom-pointed buckets.

The `@implements` tag works with or without braces. We decided to
include braces following the document:

https://jsdoc.app/tags-implements.html

See also: https://github.com/hypothesis/client/pull/4048/files#r786462923

Co-authored-by: Robert Knight <robertknight@gmail.com>

This new integration test checks that `PortFinder`, `PortProvider` and
`PortRPC` work in harmony. One change in one could lead to the others no
working as planned.