Bumps [@rollup/plugin-node-resolve](https://github.com/rollup/plugins/tree/HEAD/packages/node-resolve) from 13.0.6 to 13.1.1.
- [Release notes](https://github.com/rollup/plugins/releases)
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/node-resolve/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/node-resolve-v13.1.1/packages/node-resolve)

---
updated-dependencies:
- dependency-name: "@rollup/plugin-node-resolve"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [core-js](https://github.com/zloirock/core-js) from 3.19.3 to 3.20.0.
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/compare/v3.19.3...v3.20.0)

---
updated-dependencies:
- dependency-name: core-js
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss) from 3.0.2 to 3.0.7.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/compare/v3.0.2...v3.0.7)

---
updated-dependencies:
- dependency-name: tailwindcss
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint-plugin-mocha](https://github.com/lo1tuma/eslint-plugin-mocha) from 10.0.1 to 10.0.3.
- [Release notes](https://github.com/lo1tuma/eslint-plugin-mocha/releases)
- [Changelog](https://github.com/lo1tuma/eslint-plugin-mocha/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lo1tuma/eslint-plugin-mocha/compare/10.0.1...10.0.3)

---
updated-dependencies:
- dependency-name: eslint-plugin-mocha
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.16.0 to 7.16.5.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.16.5/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint](https://github.com/eslint/eslint) from 8.4.1 to 8.5.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.4.1...v8.5.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.16.4 to 7.16.5.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.16.5/packages/babel-preset-env)

---
updated-dependencies:
- dependency-name: "@babel/preset-env"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Script origin lookup used `document.currentScript` which does not work
for module scripts. Use `import.meta.url` instead which does [1].

This change will result in the `allowUrls` Sentry configuration being
set once again, which will hopefully prevent some reports from external code (eg.
browser extensions) from being sent to Sentry.

Fixes https://github.com/hypothesis/client/issues/4046

[1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import.meta

Guest frames can be loaded in arbitrary origins, including opaque
origins.

When deploying the new inter-frame communication code we saw errors [1]
setting up communication between the sidebar and host frames caused by:

 - Mismatches between the version of the client used in the annotator
   and the sidebar
 - The sidebar being served from an unexpected origin (eg. due to use of
   a web proxy) or an opaque origin (eg. due to the host being loaded in a
   sandboxed iframe).

In some cases these issues are beyond our control and we can't reasonably
guarantee that the client will work.

This commit adds checks for these issues when the sidebar launches. If the
checks fail client startup is allowed to continue, but we log a warning in the
browser console and disable Sentry error reporting to reduce noise.

 - Add `origin` parameter to `#config` fragment in sidebar and notebook
   app launch URLs, which contains the expected origin of the app

 - Check the `version` and `origin` parameters from the config fragment
   on app startup. If they don't match what is expected, log a warning
   and disable error reporting, but try and continue to minimize user
   inconvenience if it does work.

[1] See https://github.com/hypothesis/client/issues/3986#issuecomment-989685057
    for more details.

Co-authored-by: Robert Knight <robertknight@gmail.com>

In addition to cover the changes in the previous commit I have improved
the test in this way:

* like in frame-sync, segregate bridges according to the different
  channels and create utility functions to test the communication in
  those specific channels.
* simplify a few test by relying on `emit[frame]Event` functions
* remove mocking a public method

Replace the 'sidebarLayoutChanged' event emitter for an RPC call using
the `guest-host` communication channel. This change is a step further
into be able to instantiate `Sidebar` independently from the `Guest`.
This may be desirable in scenarios that has several iframes, like Ebooks
and VitalSource.

There is both an 'sidebarOpened' event emitter and RPC events. The RPC
event is used, while the event emitter is not.

I moved a guest RPC listener with the rest of the listeners in the
`Sidebar#_setupGuestEvents` method. This helps to quickly see which
events from the `Guest` the `Sidebar` listens to.

On a slow device if the host page is heavily loaded with JavaScript, the
10-second timeout can be exceeded. Increase this threshold to 20s to see
what effect that has on the volume of reports we receive.

The test was erroneously passing a Group object instead of a Group.id
and was causing warnings to be logged to the test output.

The immediately-following test passed because the group it was
attempting to focus was the group that would be focused by default anyway.
I adjusted the groups being focused and tested here to not use the
default-focused group to assure the test is testing what it means to.

Reduce the potential for mismatches between the client versions loaded
in the annotator and sidebar when rolling out a new release by
shortening the cache expiry time on the boot script.

Set a very short expiry time on the browser cache TTL and a slightly
longer time on the edge cache.

Limit the line length in minified bundles to make them easier to examine in
various tools which don't like very long source lines, and also mitigate an
issue with stack traces in Firefox.

Firefox stack traces report column numbers in Unicode code points whereas Sentry
expects UTF-16 code units. If the input source contains Unicode characters which
require multiple UTF-16 code units to represent then processed stack traces in
Firefox will point to the wrong location.

One of our dependencies (Showdown) contains a long string of emojis, which
require multiple UTF-16 units to represent, and Terser by default tries to
compress the code into as few lines as possible. The combined result of this is
that stack traces from Firefox could end up being resolved to a location far
from what is expected.

Though it is not a complete fix for the issue, limiting the length of lines
effectively mitigates this problem as only code nearby (on the same line as)
these characters in the output is affected.

I did also try Terser's `ascii_only` output option, but that increased the
bundle size by 2% and has more potential for unexpected consequences elsewhere.

By default Terser keeps certain comments [1] in minified output. Safari has a
bug [2] that causes column numbers to be incorrectly reported in stack
traces when a line contains inline comments. In minified code where the
output is packed into a small number of lines, this can result in stack
traces that map to the wrong source line. Stripping all comments from
the output works around the issue.

The effect on the size of the bundles is minimal. sidebar.bundle.js is
about 2KB smaller with this change.

Part of https://github.com/hypothesis/client/issues/4045

[1] https://github.com/terser/terser#format-options
[2] https://bugs.webkit.org/show_bug.cgi?id=221548

Extract RPC typing into its own module to avoid dependencies between
the store and the RPC implementation. Clarify a few points in other
types.

Move the typing for the parameter passed to the `changeFocusModeUser`
RPC call into `cross-origin-rpc` and expand in preparation for
supporting group filtering.

Add support for normalizing a set of GroupIdentifiers (which could be
`id`s or `groupid`s or a mix) to  `id`s, for use with store layer logic.

Needed to support filtering groups based on RPC calls from the LMS
application, which sends `groupid`s.

In grading mode, a student may belong to more than one group and the
instructor may switch between groups when grading the student. Restore
the applied user-focus filter when switching groups to maintain UI
continuity.

All Group objects have an `id`, some have a `groupid`. First party
groups deal in `id`s only (aka `pubid`s), while LMS groups use
`groupid`s as they include authority information and are unique across
all authorities.

The only typical time that the filter interface is visible when loading
is when loading groups for a focused student-user in grading mode.
Other filtering happens client-side and doesn't involve loading.

But when we ARE loading, don't show an inaccurate count (because we
don't have all the results yet), show a spinner instead.

I defined a type and initialise the value of `Guest#selectedRanges` in
the constructor.

As far as I know, this is used only in tests.

Follow up of https://github.com/hypothesis/client/pull/3904/files#r764767461

The main `Guest` was assumed to be always in the same frame as the
`host` frame. In that scenario (which is currently the most common),
`Guest` was able to communicate with the `host` via `TinyEmitter`.

This PR removes that assumption an enforce all communication between the
`Guest` and the `host` to occur via an inter-frame communication
channel. This paves the work for the main `Guest` to be in a different
frame than the `host`, which is the case in the Ebook readers and
VitalSource.

Fix several issues with the Sentry file uploads which prevented Sentry
from using the uploaded files.

 - Upload the JS bundles to Sentry as well as the sourcemaps. Sentry
   reads the `sourceMappingURL` comment from the JS

 - Set the correct URL prefix for the files, so that Sentry knows that
   eg. "sidebar.bundle.js" is served at https://cdn.hypothes.is/hypothesis/$VERSION/build/scripts/sidebar.bundle.js

   For Sentry to use a file uploaded in a release, the artifact name
   (URL prefix + name) must match the URL from which it is served (and
   referenced in crash reports). The origin of the URL can optionally be
   shortened to `~`, but we haven't done that here.

 - Finalize the release after uploading files

Rewrite source paths in sourcemaps from being relative to the sourcemap
URL (eg. "../../src/path/to/file.js") to absolute URLs ("app:///src/path/to/file.js").
This ensures that the resolved source URLs, which result from joining
the sourcemap URL to the source path, remain consistent across releases.
This in turn improves issue grouping.

For a full explanation of how Sentry processes JavaScript crash
reports and determines the fingerprint used to group issues, see
https://gist.github.com/robertknight/cbdee9db50601c5244d9e483930c32ca.

Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss) from 2.2.19 to 3.0.2.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/compare/v2.2.19...v3.0.2)

---
updated-dependencies:
- dependency-name: tailwindcss
  dependency-type: direct:development
  update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>

In fixing https://github.com/hypothesis/client/issues/3681, we will be
stripping parts of the script filename in stacktraces sent to Sentry. As
a result it will no longer be possible for Sentry to fetch the script
and associated sourcemap from https://cdn.hypothes.is/. Instead we need
to upload sourcemaps directly to Sentry as part of the build process.

See https://docs.sentry.io/platforms/javascript/sourcemaps/uploading/

Bumps [puppeteer](https://github.com/puppeteer/puppeteer) from 12.0.1 to 13.0.0.
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/puppeteer/puppeteer/compare/v12.0.1...v13.0.0)

---
updated-dependencies:
- dependency-name: puppeteer
  dependency-type: direct:development
  update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [rollup](https://github.com/rollup/rollup) from 2.60.2 to 2.61.1.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v2.60.2...v2.61.1)

---
updated-dependencies:
- dependency-name: rollup
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [postcss](https://github.com/postcss/postcss) from 8.4.4 to 8.4.5.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.4.4...8.4.5)

---
updated-dependencies:
- dependency-name: postcss
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>