diff --git a/products/03-alert-intelligence/src/auth/middleware.ts b/products/03-alert-intelligence/src/auth/middleware.ts
index 84510bc..46a0617 100644
--- a/products/03-alert-intelligence/src/auth/middleware.ts
+++ b/products/03-alert-intelligence/src/auth/middleware.ts
@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---
diff --git a/products/04-lightweight-idp/src/api/discovery.ts b/products/04-lightweight-idp/src/api/discovery.ts
index 444633a..307086c 100644
--- a/products/04-lightweight-idp/src/api/discovery.ts
+++ b/products/04-lightweight-idp/src/api/discovery.ts
@@ -1,6 +1,6 @@
 import type { FastifyInstance } from 'fastify';
 import pino from 'pino';
-import Redis from 'ioredis';
+import { Redis } from 'ioredis';
 import { withTenant, pool } from '../data/db.js';
 import { config } from '../config/index.js';
 import { AwsDiscoveryScanner } from '../discovery/aws-scanner.js';
@@ -10,7 +10,7 @@ import { ScheduledDiscovery } from '../discovery/scheduler.js';
 
 const logger = pino({ name: 'api-discovery' });
 const redis = new Redis(config.REDIS_URL);
-const scheduler = new ScheduledDiscovery(redis);
+const scheduler = new ScheduledDiscovery(redis, pool);
 const catalog = new CatalogService(pool);
 
 export function registerDiscoveryRoutes(app: FastifyInstance) {
diff --git a/products/04-lightweight-idp/src/auth/middleware.ts b/products/04-lightweight-idp/src/auth/middleware.ts
index 84510bc..46a0617 100644
--- a/products/04-lightweight-idp/src/auth/middleware.ts
+++ b/products/04-lightweight-idp/src/auth/middleware.ts
@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---
diff --git a/products/04-lightweight-idp/src/catalog/service.ts b/products/04-lightweight-idp/src/catalog/service.ts
index a1bb96d..de4ade3 100644
--- a/products/04-lightweight-idp/src/catalog/service.ts
+++ b/products/04-lightweight-idp/src/catalog/service.ts
@@ -1,6 +1,6 @@
 import pino from 'pino';
-import type { DiscoveredService } from './aws-scanner.js';
-import type { GitHubRepo } from './github-scanner.js';
+import type { DiscoveredService } from '../discovery/aws-scanner.js';
+import type { GitHubRepo } from '../discovery/github-scanner.js';
 
 const logger = pino({ name: 'catalog' });
 
diff --git a/products/04-lightweight-idp/src/discovery/scheduler.ts b/products/04-lightweight-idp/src/discovery/scheduler.ts
index 6ed586d..57fe11a 100644
--- a/products/04-lightweight-idp/src/discovery/scheduler.ts
+++ b/products/04-lightweight-idp/src/discovery/scheduler.ts
@@ -1,5 +1,5 @@
 import pino from 'pino';
-import Redis from 'ioredis';
+import { Redis } from 'ioredis';
 import { Pool } from 'pg';
 import { AwsDiscoveryScanner } from './aws-scanner.js';
 import { GitHubDiscoveryScanner } from './github-scanner.js';
diff --git a/products/05-aws-cost-anomaly/src/auth/middleware.ts b/products/05-aws-cost-anomaly/src/auth/middleware.ts
index 84510bc..46a0617 100644
--- a/products/05-aws-cost-anomaly/src/auth/middleware.ts
+++ b/products/05-aws-cost-anomaly/src/auth/middleware.ts
@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---
diff --git a/products/06-runbook-automation/saas/src/auth/middleware.ts b/products/06-runbook-automation/saas/src/auth/middleware.ts
index 84510bc..46a0617 100644
--- a/products/06-runbook-automation/saas/src/auth/middleware.ts
+++ b/products/06-runbook-automation/saas/src/auth/middleware.ts
@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---
diff --git a/products/06-runbook-automation/saas/src/bridge/agent-bridge.ts b/products/06-runbook-automation/saas/src/bridge/agent-bridge.ts
index 85a346c..9c4d466 100644
--- a/products/06-runbook-automation/saas/src/bridge/agent-bridge.ts
+++ b/products/06-runbook-automation/saas/src/bridge/agent-bridge.ts
@@ -1,5 +1,5 @@
 import pino from 'pino';
-import Redis from 'ioredis';
+import { Redis } from 'ioredis';
 
 const logger = pino({ name: 'agent-ws' });
 
@@ -41,7 +41,7 @@ export class AgentBridge {
     const channel = `dd0c:run:${tenantId}:${executionId}:from_agent`;
     await this.sub.subscribe(channel);
 
-    this.sub.on('message', (ch, message) => {
+    this.sub.on('message', (ch: string, message: string) => {
       if (ch !== channel) return;
       try {
         const parsed = JSON.parse(message) as StepResultMessage;
@@ -71,7 +71,7 @@ export class AgentBridge {
     const channel = `dd0c:run:${tenantId}:${executionId}:to_agent`;
     await this.sub.subscribe(channel);
 
-    this.sub.on('message', (ch, message) => {
+    this.sub.on('message', (ch: string, message: string) => {
       if (ch !== channel) return;
       try {
         const parsed = JSON.parse(message);