Retry request if DPoP nonce is empty

src/Auth/DPoPKeyManager.php

···
         DPoPKey $key,
         string $method,
         string $url,
-        string $nonce,
+        string $nonce = '',
         ?string $accessToken = null
     ): string {
         $now = time();
···
             'htu' => $url,
             'iat' => $now,
             'exp' => $now + 60, // 1 minute validity
-            'nonce' => $nonce,
         ];
+
+        // Only include nonce if provided (first request may not have one)
+        if ($nonce !== '') {
+            $payload['nonce'] = $nonce;
+        }
 
         if ($accessToken) {
             $payload['ath'] = $this->hashAccessToken($accessToken);

src/Auth/DPoPNonceManager.php

···
 {
     /**
      * Get DPoP nonce for PDS endpoint
+     *
+     * Returns cached nonce if available, otherwise empty string.
+     * The first request will fail with use_dpop_nonce error,
+     * and the server will provide a valid nonce in the response.
      */
     public function getNonce(string $pdsEndpoint): string
     {
         $cacheKey = 'dpop_nonce:'.md5($pdsEndpoint);
 
-        // Return cached nonce if available
-        if ($nonce = Cache::get($cacheKey)) {
-            return $nonce;
-        }
-
-        // Fetch new nonce from server
-        $nonce = $this->fetchNonce($pdsEndpoint);
-
-        // Cache for 5 minutes
-        Cache::put($cacheKey, $nonce, now()->addMinutes(5));
-
-        return $nonce;
+        // Return cached nonce if available, empty string otherwise
+        // Empty nonce triggers use_dpop_nonce error, which is expected
+        return Cache::get($cacheKey, '');
     }
 
     /**
···
     {
         $cacheKey = 'dpop_nonce:'.md5($pdsEndpoint);
         Cache::forget($cacheKey);
-    }
-
-    /**
-     * Fetch nonce from PDS server
-     */
-    protected function fetchNonce(string $pdsEndpoint): string
-    {
-        // Make a HEAD request to get initial nonce
-        // The server returns nonce in DPoP-Nonce header
-        try {
-            $response = app('http')->head($pdsEndpoint.'/xrpc/_health');
-
-            return $response->header('DPoP-Nonce') ?? 'fallback-nonce-'.time();
-        } catch (\Exception $e) {
-            // Fallback if health endpoint fails
-            return 'fallback-nonce-'.time();
-        }
     }
 }

src/Auth/OAuthEngine.php

···
 use SocialDept\AtpClient\Data\AccessToken;
 use SocialDept\AtpClient\Data\AuthorizationRequest;
 use SocialDept\AtpClient\Exceptions\AuthenticationException;
-use SocialDept\AtpResolver\Facades\Resolver;
+use SocialDept\Resolver\Facades\Resolver;
 
 class OAuthEngine
 {
···
         protected HttpClient $http,
         protected DPoPKeyManager $dpopManager,
         protected ClientMetadataManager $metadata,
+        protected DPoPNonceManager $nonceManager,
     ) {}
 
     /**
···
 
         // Get PDS endpoint from request
         $pdsEndpoint = $this->extractPdsFromRequestUri($request->requestUri);
+        $tokenUrl = $pdsEndpoint.'/oauth/token';
+        $tokenData = [
+            'grant_type' => 'authorization_code',
+            'code' => $code,
+            'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
+            'client_id' => $this->metadata->getClientId(),
+            'code_verifier' => $request->codeVerifier,
+        ];
+
+        // Get cached nonce
+        $nonce = $this->nonceManager->getNonce($pdsEndpoint);
 
-        // Exchange code for token
         $dpopProof = $this->dpopManager->createProof(
             key: $request->dpopKey,
             method: 'POST',
-            url: $pdsEndpoint.'/oauth/token',
-            nonce: $this->getDpopNonce($pdsEndpoint),
+            url: $tokenUrl,
+            nonce: $nonce,
         );
 
         $response = $this->http
···
                 'Content-Type' => 'application/x-www-form-urlencoded',
             ])
             ->asForm()
-            ->post($pdsEndpoint.'/oauth/token', [
-                'grant_type' => 'authorization_code',
-                'code' => $code,
-                'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
-                'client_id' => $this->metadata->getClientId(),
-                'code_verifier' => $request->codeVerifier,
-            ]);
+            ->post($tokenUrl, $tokenData);
+
+        // Handle use_dpop_nonce error - retry with server-provided nonce
+        if ($response->status() === 400) {
+            $error = $response->json('error');
+
+            if ($error === 'use_dpop_nonce' && $response->header('DPoP-Nonce')) {
+                $nonce = $response->header('DPoP-Nonce');
+                $this->nonceManager->storeNonce($pdsEndpoint, $nonce);
+
+                // Retry with new nonce
+                $dpopProof = $this->dpopManager->createProof(
+                    key: $request->dpopKey,
+                    method: 'POST',
+                    url: $tokenUrl,
+                    nonce: $nonce,
+                );
+
+                $response = $this->http
+                    ->withHeaders([
+                        'DPoP' => $dpopProof,
+                        'Content-Type' => 'application/x-www-form-urlencoded',
+                    ])
+                    ->asForm()
+                    ->post($tokenUrl, $tokenData);
+            }
+        }
+
+        // Store nonce from response for future requests
+        if ($response->header('DPoP-Nonce')) {
+            $this->nonceManager->storeNonce($pdsEndpoint, $response->header('DPoP-Nonce'));
+        }
 
         if ($response->failed()) {
             throw new AuthenticationException(
···
         string $codeChallenge,
         $dpopKey
     ): array {
+        $parUrl = $pdsEndpoint.'/oauth/par';
+        $parData = [
+            'client_id' => $this->metadata->getClientId(),
+            'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
+            'response_type' => 'code',
+            'scope' => implode(' ', $scopes),
+            'code_challenge' => $codeChallenge,
+            'code_challenge_method' => 'S256',
+            'state' => Str::random(32),
+        ];
+
+        // Try with cached nonce first (may be empty on first request)
+        $nonce = $this->nonceManager->getNonce($pdsEndpoint);
+
         $dpopProof = $this->dpopManager->createProof(
             key: $dpopKey,
             method: 'POST',
-            url: $pdsEndpoint.'/oauth/par',
-            nonce: $this->getDpopNonce($pdsEndpoint),
+            url: $parUrl,
+            nonce: $nonce,
         );
 
         $response = $this->http
             ->withHeaders(['DPoP' => $dpopProof])
             ->asForm()
-            ->post($pdsEndpoint.'/oauth/par', [
-                'client_id' => $this->metadata->getClientId(),
-                'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
-                'response_type' => 'code',
-                'scope' => implode(' ', $scopes),
-                'code_challenge' => $codeChallenge,
-                'code_challenge_method' => 'S256',
-                'state' => Str::random(32),
-            ]);
+            ->post($parUrl, $parData);
+
+        // Handle use_dpop_nonce error - retry with server-provided nonce
+        if ($response->status() === 400) {
+            $error = $response->json('error');
+
+            if ($error === 'use_dpop_nonce' && $response->header('DPoP-Nonce')) {
+                $nonce = $response->header('DPoP-Nonce');
+                $this->nonceManager->storeNonce($pdsEndpoint, $nonce);
+
+                // Retry with new nonce
+                $dpopProof = $this->dpopManager->createProof(
+                    key: $dpopKey,
+                    method: 'POST',
+                    url: $parUrl,
+                    nonce: $nonce,
+                );
+
+                $response = $this->http
+                    ->withHeaders(['DPoP' => $dpopProof])
+                    ->asForm()
+                    ->post($parUrl, $parData);
+            }
+        }
+
+        // Store nonce from successful response for future requests
+        if ($response->header('DPoP-Nonce')) {
+            $this->nonceManager->storeNonce($pdsEndpoint, $response->header('DPoP-Nonce'));
+        }
 
         if ($response->failed()) {
             throw new AuthenticationException('PAR failed: '.$response->body());
···
     protected function generatePkceChallenge(string $verifier): string
     {
         return rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');
-    }
-
-    /**
-     * Get DPoP nonce from server
-     */
-    protected function getDpopNonce(string $pdsEndpoint): string
-    {
-        // TODO: Implement proper DPoP nonce fetching and caching
-        // This is typically returned in DPoP-Nonce header
-        return 'temp-nonce-'.time();
     }
 
     /**