clay-policy-guardrails

# Clay Policy & Guardrails

## Overview
Automated policy enforcement and guardrails for Clay integrations.

## Prerequisites
- ESLint configured in project
- Pre-commit hooks infrastructure
- CI/CD pipeline with policy checks
- TypeScript for type enforcement

## ESLint Rules

### Custom Clay Plugin
```javascript
// eslint-plugin-clay/rules/no-hardcoded-keys.js
module.exports = {
  meta: {
    type: 'problem',
    docs: {
      description: 'Disallow hardcoded Clay API keys',
    },
    fixable: 'code',
  },
  create(context) {
    return {
      Literal(node) {
        if (typeof node.value === 'string') {
          if (node.value.match(/^sk_(live|test)_[a-zA-Z0-9]{24,}/)) {
            context.report({
              node,
              message: 'Hardcoded Clay API key detected',
            });
          }
        }
      },
    };
  },
};
```

### ESLint Configuration
```javascript
// .eslintrc.js
module.exports = {
  plugins: ['clay'],
  rules: {
    'clay/no-hardcoded-keys': 'error',
    'clay/require-error-handling': 'warn',
    'clay/use-typed-client': 'warn',
  },
};
```

## Pre-Commit Hooks

```yaml
# .pre-commit-config.yaml
repos:
  - repo: local
    hooks:
      - id: clay-secrets-check
        name: Check for Clay secrets
        entry: bash -c 'git diff --cached --name-only | xargs grep -l "sk_live_" && exit 1 || exit 0'
        language: system
        pass_filenames: false

      - id: clay-config-validate
        name: Validate Clay configuration
        entry: node scripts/validate-clay-config.js
        language: node
        files: '\.clay\.json$'
```

## TypeScript Strict Patterns

```typescript
// Enforce typed configuration
interface ClayStrictConfig {
  apiKey: string;  // Required
  environment: 'development' | 'staging' | 'production';  // Enum
  timeout: number;  // Required number, not optional
  retries: number;
}

// Disallow any in Clay code
// @ts-expect-error - Using any is forbidden
const client = new Client({ apiKey: any });

// Pre