feat(02-02): capture, scrub, and strictly diff stateful flows

Resolve named placeholders from a private variable store, mask
dates and ids after shape checks, and keep comparing independent steps.

Co-authored-by: Cursor <cursoragent@cursor.com>

tide/headers_test.go

@@ -0,0 +1,77 @@
+package tide
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestHeadersAllowListIgnoresDate(t *testing.T) {
+	want := Response{
+		Status: 401,
+		Headers: map[string]string{
+			"Content-Type":     "application/json",
+			"WWW-Authenticate": `Bearer error="invalid_token"`,
+			"Cache-Control":    "no-store",
+			"Date":             "Wed, 01 Jan 2020 00:00:00 GMT",
+		},
+		Body: Body(`{"ok":false}`),
+	}
+	got := Response{
+		Status: 401,
+		Headers: map[string]string{
+			"Content-Type":     "application/json",
+			"WWW-Authenticate": `Bearer error="invalid_token"`,
+			"Cache-Control":    "no-store",
+			"Date":             "Thu, 02 Jan 2020 00:00:00 GMT",
+			"Server":           "php",
+		},
+		Body: Body(`{"ok":false}`),
+	}
+	diffs := compareStep(Step{ID: "h", Response: want, Headers: map[string]string{"WWW-Authenticate": "", "Cache-Control": ""}}, got)
+	if len(diffs) != 0 {
+		t.Fatalf("Date/Server must be ignored: %+v", diffs)
+	}
+
+	got.Headers["WWW-Authenticate"] = `Bearer error="other"`
+	diffs = compareStep(Step{ID: "h", Response: want}, got)
+	if len(diffs) == 0 {
+		t.Fatal("WWW-Authenticate mismatch must fail")
+	}
+	if !strings.Contains(strings.ToLower(diffs[0].Path), "www-authenticate") {
+		t.Fatalf("path %s", diffs[0].Path)
+	}
+}
+
+func TestHeadersReplayAgainstServer(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Pragma", "no-cache")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"ok":true}`))
+	}))
+	t.Cleanup(srv.Close)
+	flow := Flow{
+		Version: 1,
+		Name:    "headers",
+		Steps: []Step{{
+			ID: "h",
+			Request: Request{Method: http.MethodGet, Path: "/"},
+			Response: Response{
+				Status: 200,
+				Headers: map[string]string{
+					"Content-Type":  "application/json",
+					"Cache-Control": "no-store",
+					"Pragma":        "no-cache",
+				},
+				Body: Body(`{"ok":true}`),
+			},
+		}},
+	}
+	if _, err := ReplayFlow(context.Background(), flow, ReplayConfig{Target: srv.URL}); err != nil {
+		t.Fatal(err)
+	}
+}