/**
 * Validate a post-login redirect target against open redirects. Accepts only
 * an internal absolute path (`/…`) and returns `fallback` for anything else:
 * absolute/protocol-relative URLs (`https://evil.test`, `//evil.test`), the
 * backslash variant browsers normalize into one (`/\evil.test`), or an
 * empty/missing value.
 *
 * The auth handle appends the originally requested path to its login redirect
 * as `?redirectTo=…` (GET navigations only). This helper is the mandatory
 * gate between that query param — attacker-writable, like any URL — and a
 * `goto()`:
 *
 * ```svelte
 * <LoginPage onSuccess={() =>
 *   goto(sanitizeRedirect(page.url.searchParams.get('redirectTo'), '/dashboard'))
 * } />
 * ```
 *
 * Environment-free (no SvelteKit imports), so it works in components, load
 * functions and form actions alike.
 */
export declare function sanitizeRedirect(candidate: string | null | undefined, fallback: string): string;