export function sanitizeWhmcsRedirectPath(path?: string): string {
  const defaultPath = "clientarea.php";
  if (!path || typeof path !== "string") return defaultPath;
  const trimmed = path.trim();
  if (!trimmed) return defaultPath;
  // Only allow relative, non-protocol paths
  if (/^https?:\/\/|^\/\//i.test(trimmed)) return defaultPath;
  // Prevent directory traversal
  if (trimmed.includes("..")) return defaultPath;
  // Normalize leading slash
  const normalized = trimmed.replace(/^\/+/, "");
  return normalized || defaultPath;
}
