SEP-1932 DPoP fixtures fail auth/dpop-server-validation at the CLI's default spec version #566

Follow-up from the SEP-1932 thread (modelcontextprotocol/modelcontextprotocol#1932), where @nbarbettini asked for an issue here. Not blocking the #395 / #527 / #528 / #529 stack.

What happens

The CLI runs auth/dpop-server-validation at DRAFT_PROTOCOL_VERSION (2026-07-28) by default, so the positive probe is a stateless server/discover request with a per-request _meta envelope.

examples/servers/typescript/sep-1932-compliant-server.ts and sep-1932-broken-server.ts are built on the pinned @modelcontextprotocol/sdk 1.29 StreamableHTTPServerTransport, which only speaks the initialize/session lifecycle. It answers the probe with HTTP 400:

{"jsonrpc":"2.0","error":{"code":-32000,"message":"Bad Request: Unsupported protocol version: 2026-07-28 (supported versions: 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05, 2024-10-07)"},"id":null}

AcceptsValidProof fails before any DPoP check runs. 23 more checks fail as not testable and ReportsDpopErrorCode warns. Only AdvertisesDpop and PrmDpop pass: 2/26.

Reproduce

At the head of the #529 stack (834e234), from the conformance checkout:

# fixture
cd examples/servers/typescript
DPOP_ISSUER_JWK='<public ES256 JWK JSON>' \
DPOP_ISSUER=https://conformance-dpop-issuer.example.com \
DPOP_AUDIENCE=http://localhost:3010/mcp \
PORT=3010 npx tsx sep-1932-compliant-server.ts

# CLI
DPOP_ISSUER_PRIVATE_JWK='<private ES256 JWK JSON>' \
DPOP_ISSUER=https://conformance-dpop-issuer.example.com \
node dist/index.js server --url http://localhost:3010/mcp \
  --scenario auth/dpop-server-validation

The same command with --spec-version 2025-11-25 --force passes 27/27 (28/28 with DPOP_REQUIRE_NONCE=1).

Why the tests miss it

src/scenarios/server/auth/dpop.test.ts builds its context with testContext(url(...)), and testContext defaults specVersion to LATEST_SPEC_VERSION (2025-11-25). The tests always send initialize and never take the server/discover path the CLI takes by default.

Options

1. Move the DPoP fixtures (and the examples package) to the TS SDK 2.x packages, which speak the stateless wire, and add test cases at DRAFT_PROTOCOL_VERSION. This is the direction @nbarbettini suggested.
2. Stopgap without an SDK bump: give the fixtures a minimal stateless dispatcher, the way everything-server.ts already does on SDK 1.29. A PR with this is linked below.
3. Independently of either: when the positive probe is refused with a non-401 JSON-RPC error, have AcceptsValidProof say once that the server does not support the requested protocol version, instead of 24 not-testable rows. The linked PR has this as a separate commit.

The same 1.29-versus-draft gap likely affects any other example fixture a draft-only scenario targets.