feat: disabled options + required validation + Tier 3 polish (v3.3.0)

[michaeljfalk]

Summary

Tier 2 (minus multi-select) + all four Tier 3 polish items from the roadmap. All additive, no breaking changes.

Disabled options

• Per-option disabled: true → non-selectable: dimmed, aria-disabled, skipped by ↑/↓ nav, ignored on click/Enter.

required form validation

• Enforced via the Constraint Validation API on the visible input, so an empty required control blocks form submit with a focusable, on-screen bubble (message via texts.required).
• Fixes enhance(): a display:none required <select> can't be focused (browsers reject submit with "invalid form control is not focusable"); enforcement now lives on the visible control.

Match highlighting

• highlight: true wraps the matched substring in <mark class="liveselect__mark">, built from text nodes (no innerHTML) so it stays XSS-safe. Ignored for renderOption rows.

"Showing N of M" footer

• Array sources compute the total automatically; async sources may return { items, total }. Customize via texts.more(shown, total).

Lifecycle events

• Bubbling liveselect:open, liveselect:close, liveselect:search ({ query }), alongside liveselect:change.

Async result caching

• cache: true memoizes async results by query+scope+limit; cleared by setSource() / setScope().

Changes

• dist/liveselect.js — disabled in normalizeOption; _step/_isEnabled keyboard skip; _syncValidity; _highlightInto; _total + cache in _runSearch; _dispatch + open/close/search events; "more" footer in _renderMenu
• dist/liveselect.css — __opt--disabled, __mark (+ dark), __more
• test/client.test.js — 6 new tests → 36/36 pass
• README.md — options table, option shape, async-ctx, Events table, Validation section, Features bullet
• examples/vanilla.html — picker 1 now uses highlight + a disabled row
• CHANGELOG.md + package.json — bump to 3.3.0

Test plan

• npm test → 36/36 (was 30); existing XSS/escaping/a11y regressions still pass
• Core + example inline script parse clean

🤖 Generated with Claude Code