Fix TypeScript compilation errors across P3-P6

- jwt.sign: explicit SignOptions cast for expiresIn (all 4 products)
- ioredis: use named import { Redis } instead of default (P4, P6)
- P4 catalog/service: fix import paths for aws-scanner and github-scanner
- P4 discovery: pass pool to ScheduledDiscovery constructor
- P6 agent-bridge: add explicit types for Redis message callback params
- All 4 Node products now compile cleanly with tsc --noEmit

products/03-alert-intelligence/src/auth/middleware.ts

@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---

products/04-lightweight-idp/src/api/discovery.ts

@@ -1,6 +1,6 @@
 import type { FastifyInstance } from 'fastify';
 import pino from 'pino';
-import Redis from 'ioredis';
+import { Redis } from 'ioredis';
 import { withTenant, pool } from '../data/db.js';
 import { config } from '../config/index.js';
 import { AwsDiscoveryScanner } from '../discovery/aws-scanner.js';
@@ -10,7 +10,7 @@ import { ScheduledDiscovery } from '../discovery/scheduler.js';
 
 const logger = pino({ name: 'api-discovery' });
 const redis = new Redis(config.REDIS_URL);
-const scheduler = new ScheduledDiscovery(redis);
+const scheduler = new ScheduledDiscovery(redis, pool);
 const catalog = new CatalogService(pool);
 
 export function registerDiscoveryRoutes(app: FastifyInstance) {

products/04-lightweight-idp/src/auth/middleware.ts

@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---

products/04-lightweight-idp/src/catalog/service.ts

@@ -1,6 +1,6 @@
 import pino from 'pino';
-import type { DiscoveredService } from './aws-scanner.js';
+import type { DiscoveredService } from '../discovery/aws-scanner.js';
-import type { GitHubRepo } from './github-scanner.js';
+import type { GitHubRepo } from '../discovery/github-scanner.js';
 
 const logger = pino({ name: 'catalog' });
 

products/04-lightweight-idp/src/discovery/scheduler.ts

@@ -1,5 +1,5 @@
 import pino from 'pino';
-import Redis from 'ioredis';
+import { Redis } from 'ioredis';
 import { Pool } from 'pg';
 import { AwsDiscoveryScanner } from './aws-scanner.js';
 import { GitHubDiscoveryScanner } from './github-scanner.js';

products/05-aws-cost-anomaly/src/auth/middleware.ts

@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---

products/06-runbook-automation/saas/src/auth/middleware.ts

@@ -87,7 +87,7 @@ export function requireRole(req: FastifyRequest, reply: FastifyReply, minRole: A
 }
 
 export function signToken(payload: AuthPayload, secret: string, expiresIn = '24h'): string {
-  return jwt.sign(payload, secret, { expiresIn });
+  return jwt.sign(payload, secret, { expiresIn } as jwt.SignOptions);
 }
 
 // --- Password hashing (scrypt — no native bcrypt dep needed) ---

products/06-runbook-automation/saas/src/bridge/agent-bridge.ts

@@ -1,5 +1,5 @@
 import pino from 'pino';
-import Redis from 'ioredis';
+import { Redis } from 'ioredis';
 
 const logger = pino({ name: 'agent-ws' });
 
@@ -41,7 +41,7 @@ export class AgentBridge {
     const channel = `dd0c:run:${tenantId}:${executionId}:from_agent`;
     await this.sub.subscribe(channel);
 
-    this.sub.on('message', (ch, message) => {
+    this.sub.on('message', (ch: string, message: string) => {
       if (ch !== channel) return;
       try {
         const parsed = JSON.parse(message) as StepResultMessage;
@@ -71,7 +71,7 @@ export class AgentBridge {
     const channel = `dd0c:run:${tenantId}:${executionId}:to_agent`;
     await this.sub.subscribe(channel);
 
-    this.sub.on('message', (ch, message) => {
+    this.sub.on('message', (ch: string, message: string) => {
       if (ch !== channel) return;
       try {
         const parsed = JSON.parse(message);