diff --git a/frontends/nextjs/src/app/[tenant]/[package]/[...slug]/page.tsx b/frontends/nextjs/src/app/[tenant]/[package]/[...slug]/page.tsx
index 237e37761..98102a9e5 100644
--- a/frontends/nextjs/src/app/[tenant]/[package]/[...slug]/page.tsx
+++ b/frontends/nextjs/src/app/[tenant]/[package]/[...slug]/page.tsx
@@ -23,11 +23,11 @@ interface EntityPageProps {
 export default async function EntityPage({ params }: EntityPageProps) {
   const { tenant, package: pkg, slug } = await params
 
-  if (!slug || slug.length === 0) {
+  if (!tenant || !pkg || !slug || slug.length === 0) {
     notFound()
   }
 
-  const entity = slug[0]
+  const entity = slug[0]!  // Safe: checked slug.length > 0
   const id = slug[1]
   const action = slug[2]
 
diff --git a/frontends/nextjs/src/app/page.tsx b/frontends/nextjs/src/app/page.tsx
index 5aff18ece..a21bb67dd 100644
--- a/frontends/nextjs/src/app/page.tsx
+++ b/frontends/nextjs/src/app/page.tsx
@@ -30,7 +30,7 @@ export default async function RootPage() {
   }> }
 
   if (godPanelRoutes.data.length > 0) {
-    const route = godPanelRoutes.data[0]
+    const route = godPanelRoutes.data[0]!  // Safe: length check ensures element exists
 
     // TODO: Implement proper session/user context for permission checks
     // For now, we'll allow access to public routes and skip auth checks
diff --git a/frontends/nextjs/src/components/ui-page-renderer/UIPageRenderer.tsx b/frontends/nextjs/src/components/ui-page-renderer/UIPageRenderer.tsx
index 773f3b2e6..29d3ed9ec 100644
--- a/frontends/nextjs/src/components/ui-page-renderer/UIPageRenderer.tsx
+++ b/frontends/nextjs/src/components/ui-page-renderer/UIPageRenderer.tsx
@@ -23,7 +23,7 @@ export function UIPageRenderer({ pageData }: UIPageRendererProps) {
 
   // Provide action handlers via context
   return (
-    <UIPageActionsContext.Provider value={pageData.actions}>
+    <UIPageActionsContext.Provider value={pageData.actions || {}}>
       {elements}
     </UIPageActionsContext.Provider>
   )
diff --git a/frontends/nextjs/src/lib/db/sessions/crud/delete/delete-session-by-token.ts b/frontends/nextjs/src/lib/db/sessions/crud/delete/delete-session-by-token.ts
index a24af2b8f..d3f5240e2 100644
--- a/frontends/nextjs/src/lib/db/sessions/crud/delete/delete-session-by-token.ts
+++ b/frontends/nextjs/src/lib/db/sessions/crud/delete/delete-session-by-token.ts
@@ -10,7 +10,7 @@ export async function deleteSessionByToken(token: string): Promise<boolean> {
     data: DBALSessionRecord[]
   }
   if (!result.data.length) return false
-  const session = result.data[0]
+  const session = result.data[0]!  // Safe: checked length > 0
   await adapter.delete('Session', session.id)
   return true
 }
diff --git a/frontends/nextjs/src/lib/db/sessions/getters/list-sessions.ts b/frontends/nextjs/src/lib/db/sessions/getters/list-sessions.ts
index 781a2e3f6..f12e47b02 100644
--- a/frontends/nextjs/src/lib/db/sessions/getters/list-sessions.ts
+++ b/frontends/nextjs/src/lib/db/sessions/getters/list-sessions.ts
@@ -8,7 +8,8 @@ export async function listSessions(options?: ListSessionsOptions): Promise<Sessi
     ? await adapter.list('Session', { filter: { userId: options.userId } })
     : await adapter.list('Session')
 
-  const sessions = result.data.map(mapSessionRecord)
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const sessions = (result.data as any[]).map(mapSessionRecord)
 
   if (options?.includeExpired) {
     return sessions
diff --git a/frontends/nextjs/src/lib/dbal/core/client/dbal-integration/functions/blob-list.ts b/frontends/nextjs/src/lib/dbal/core/client/dbal-integration/functions/blob-list.ts
index 6875c44d7..b2ec78f8e 100644
--- a/frontends/nextjs/src/lib/dbal/core/client/dbal-integration/functions/blob-list.ts
+++ b/frontends/nextjs/src/lib/dbal/core/client/dbal-integration/functions/blob-list.ts
@@ -4,5 +4,6 @@ import type { DBALClient as _DBALClient, DBALConfig as _DBALConfig } from '@/dba
 export async function blobList(this: any, prefix?: string): Promise<string[]> {
   if (!this.blobStorage) throw new Error('DBAL not initialized')
   const result = await this.blobStorage.list({ prefix })
-  return result.items.map(item => item.key)
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return result.items.map((item: any) => item.key)
 }
diff --git a/frontends/nextjs/src/middleware.ts b/frontends/nextjs/src/middleware.ts
index 25be2ca10..4b2e741d9 100644
--- a/frontends/nextjs/src/middleware.ts
+++ b/frontends/nextjs/src/middleware.ts
@@ -28,8 +28,12 @@ export function middleware(request: NextRequest) {
 
     // Add tenant info to headers for downstream use
     const response = NextResponse.next()
-    response.headers.set('x-tenant-id', tenant)
-    response.headers.set('x-package-id', pkg)
+    if (tenant) {
+      response.headers.set('x-tenant-id', tenant)
+    }
+    if (pkg) {
+      response.headers.set('x-package-id', pkg)
+    }
     
     return response
   }