/**
 * Restrict a user-supplied return target to a same-origin pathname.
 * Rejects absolute URLs, protocol-relative paths, backslash-prefixed paths, CRLF
 * header-injection attempts, dot-segment traversal, URL-encoded bypasses, and
 * oversized inputs. Returns the input on success, '/' on rejection.
 */
export declare function sanitizeReturnPathname(input: unknown): string;