/**
 * Built-in attack payload sets for `payloadDriver`. Intended for
 * authorized security testing against your own apps — chaosbringer is
 * a defensive testing tool, not an exploitation framework. Payloads
 * are intentionally tame: enough signal to trigger detection-style
 * invariants (`window.__xss_flag = 1` markers, 500 error invariants,
 * unhandled-promise-rejection invariants), not full exploits.
 *
 * Pair payload sets with invariants that detect the attack class:
 *   - XSS: invariant that fails if `window.__xss_fired` is truthy after
 *     a chaos action. Pages that correctly escape never set it.
 *   - SQLi: invariant that flags any 5xx response from the API layer
 *     during the chaos action.
 *   - Path-traversal: invariant on response body containing
 *     `/etc/passwd`-like markers.
 *
 * Adding a payload set: keep it short. The driver runs many times per
 * page; large sets dilute coverage without raising signal.
 */
export type PayloadSetName = "xss" | "sqli" | "path-traversal" | "large" | "unicode" | "html" | "template-injection";
export declare const XSS_PAYLOADS: ReadonlyArray<string>;
export declare const SQLI_PAYLOADS: ReadonlyArray<string>;
export declare const PATH_TRAVERSAL_PAYLOADS: ReadonlyArray<string>;
export declare const LARGE_PAYLOADS: ReadonlyArray<string>;
export declare const UNICODE_PAYLOADS: ReadonlyArray<string>;
export declare const HTML_INJECTION_PAYLOADS: ReadonlyArray<string>;
export declare const TEMPLATE_INJECTION_PAYLOADS: ReadonlyArray<string>;
export declare const DEFAULT_PAYLOAD_SETS: Record<PayloadSetName, ReadonlyArray<string>>;
/** Combine multiple named sets into one flat payload list. */
export declare function combinePayloadSets(names: ReadonlyArray<PayloadSetName>): ReadonlyArray<string>;
//# sourceMappingURL=payloads.d.ts.map