fix: allow creating empty sessions

[lprnmns]

Problem

FastifyInstance.createSecureSession(data?) is declared with optional data in types/index.d.ts and is exercised without an argument in the TypeScript tests. At runtime, calling createSecureSession() throws while Session initializes its timestamp, so integrations that need an empty session cannot use the public helper.

Fix

Default omitted data to an empty object at the createSecureSession decorator boundary. Existing object arguments are unchanged, and the regression assertion confirms the returned empty session is usable.

Tests

• node --test test/decorators.test.js - passed; 3 tests
• npm test - passed; 49 unit tests with 100 percent coverage and 16 TypeScript assertions
• npm run lint - passed
• git diff HEAD^ HEAD --check - passed

Compatibility

This changes only the previously failing omitted or undefined-data case to match the existing optional TypeScript contract. Sessions created with an object retain their current behavior.

Related issue

Independent reproduction; no issue linked.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused fix matches the public type contract and has adequate regression coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Aligns runtime behavior with the existing optional-data TypeScript contract.

Changes:

• Defaults omitted session data to an empty object.
• Adds regression coverage for empty-session creation.

File	Description
index.js	Adds the empty-object default.
test/​decorators.test.js	Verifies empty sessions are usable.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Fdawgs]

I guess the question is are the types wrong or is the implementation wrong?

[lprnmns]

I think the implementation is the mismatch here. types/index.d.ts explicitly makes data optional, and types/index.tst.ts already checks app.createSecureSession(); separately, the plugin creates a new session with {} when a request has no cookie (index.js). The public decorator alone passes omitted data as undefined, which makes Session throw while setting __ts. Defaulting only that decorator argument to {} aligns it with both existing contracts without changing calls that provide data. If the intended API is instead to require data, I can update the type declaration and type test, but that would be a breaking change to the declared API.