Problem

Session.authFetch is the authenticated drop-in for fetch, but it's an ordinary unbound class method, so passing it by reference loses this:

const f = session.authFetch
await f(url)   // TypeError: cannot read properties of undefined (reading '_isActive')

This bites any consumer that hands the authed fetch to a library expecting a bare fetch function (rdflib Fetcher / UpdateManager, rdf-dereference, solid-logic) or destructures it:

const { authFetch } = session

Since authFetch is intended as a drop-in for fetch, the public API should support that usage.

Status

Not urgent. Current consumers either call session.authFetch(...) directly or go through a wrapper, so nothing passes the raw method by reference today. This is hardening for external consumers, not a live regression.

Fix

One line in the Session constructor, plus a test that destructures and calls it:

// Bind so authFetch survives being passed by reference (drop-in fetch)
this.authFetch = this.authFetch.bind(this)