config/
├── clay/
│   ├── base.json           # Shared config
│   ├── development.json    # Dev overrides
│   ├── staging.json        # Staging overrides
│   └── production.json     # Prod overrides

{
  "timeout": 30000,
  "retries": 3,
  "cache": {
    "enabled": true,
    "ttlSeconds": 60
  }
}

{
  "apiKey": "${CLAY_API_KEY}",
  "baseUrl": "https://api-sandbox.clay.com",
  "debug": true,
  "cache": {
    "enabled": false
  }
}

{
  "apiKey": "${CLAY_API_KEY_STAGING}",
  "baseUrl": "https://api-staging.clay.com",
  "debug": false
}

{
  "apiKey": "${CLAY_API_KEY_PROD}",
  "baseUrl": "https://api.clay.com",
  "debug": false,
  "retries": 5
}

// src/clay/config.ts
import baseConfig from '../../config/clay/base.json';

type Environment = 'development' | 'staging' | 'production';

function detectEnvironment(): Environment {
  const env = process.env.NODE_ENV || 'development';
  const validEnvs: Environment[] = ['development', 'staging', 'production'];
  return validEnvs.includes(env as Environment)
    ? (env as Environment)
    : 'development';
}

export function getClayConfig() {
  const env = detectEnvironment();
  const envConfig = require(`../../config/clay/${env}.json`);

  return {
    ...baseConfig,
    ...envConfig,
    environment: env,
  };
}

# .env.local (git-ignored)
CLAY_API_KEY=sk_test_dev_***

env:
  CLAY_API_KEY: ${{ secrets.CLAY_API_KEY_${{ matrix.environment }} }}

# AWS Secrets Manager
aws secretsmanager get-secret-value --secret-id clay/production/api-key

# GCP Secret Manager
gcloud secrets versions access latest --secret=clay-api-key

# HashiCorp Vault
vault kv get -field=api_key secret/clay/production

// Prevent production operations in non-prod
function guardProductionOperation(operation: string): void {
  const config = getClayConfig();

  if (config.environment !== 'production') {
    console.warn(`[clay] ${operation} blocked in ${config.environment}`);
    throw new Error(`${operation} only allowed in production`);
  }
}

// Usage
async function deleteAllData() {
  guardProductionOperation('deleteAllData');
  // Dangerous operation here
}

const featureFlags: Record<Environment, Record<string, boolean>> = {
  development: {
    newFeature: true,
    betaApi: true,
  },
  staging: {
    newFeature: true,
    betaApi: false,
  },
  production: {
    newFeature: false,
    betaApi: false,
  },
};

const env = getClayConfig();
console.log(`Running in ${env.environment} with ${env.baseUrl}`);