refactor(cloud-shared): drop milady.ai + shad0w.xyz from pairing alias group

Audit of agent_pairing_tokens (90d) and agent_sandboxes.bridge_url
shows 0 prod rows under .milady.ai or .shad0w.xyz. Both were 0xSolace-
era domains:

  - .milady.ai resolves to GitHub Pages (static front, never served
    sandbox HTTP infra)
  - .shad0w.xyz was a personal-handle dev convenience

Keeping them in the alias group would silently keep "0 legacy" from
being true. Drop both. Old bookmarks under those domains now fail
Origin validation, which is the intended outcome.

The remaining group is the three Eliza brands [waifu.fun, eliza.ai,
elizacloud.ai]. .elizacloud.ai is the post-2026-05 canonical; the
others ride along during the rebrand grace period.

Author: standujar

packages/cloud-shared/src/lib/services/pairing-token-domains.ts

@@ -4,16 +4,24 @@
 // `<uuid>.elizacloud.ai` link but the agent was originally provisioned with
 // an `<uuid>.waifu.fun` Origin), so token validation tries every alias.
 //
-// `.elizacloud.ai` is the canonical post-2026-05 brand; the others are
-// kept during the rebrand grace period and can be retired one by one once
-// no DB rows reference them.
+// `.elizacloud.ai` is the canonical post-2026-05 brand; `.waifu.fun` and
+// `.eliza.ai` are kept during the rebrand grace period and can be retired
+// once no DB rows reference them.
+//
+// Intentionally NOT in this list:
+//   - `.milady.ai`  — resolves to GitHub Pages (static front, no agent
+//     sandbox infra was ever served from this domain)
+//   - `.shad0w.xyz` — personal handle from the 0xSolace stack, never
+//     served real production sandbox URLs
+// Both are part of the "0 legacy" cleanup goal; old bookmarks under those
+// domains will fail Origin validation, which is the intended outcome.
 //
 // Pure data + pure function — extracted from `pairing-token.ts` so the
 // alias logic stays unit-testable without pulling the Postgres repository
 // import chain.
 
 export const DOMAIN_ALIAS_GROUPS: readonly (readonly string[])[] = [
-  [".waifu.fun", ".eliza.ai", ".elizacloud.ai", ".milady.ai", ".shad0w.xyz"],
+  [".waifu.fun", ".eliza.ai", ".elizacloud.ai"],
 ];
 
 /**

packages/cloud-shared/src/lib/services/pairing-token.test.ts

@@ -3,19 +3,13 @@ import { DOMAIN_ALIAS_GROUPS, getAlternateDomainOrigins } from "./pairing-token-
 
 describe("getAlternateDomainOrigins", () => {
   it("returns every other suffix in the same alias group", () => {
-    // The canonical group is the first entry. Verify all five domains
-    // produce four alternates each (the matched suffix is excluded).
-    const inputs = [
-      "https://abc.waifu.fun",
-      "https://abc.eliza.ai",
-      "https://abc.elizacloud.ai",
-      "https://abc.milady.ai",
-      "https://abc.shad0w.xyz",
-    ];
+    // The canonical group is the first entry. Verify each domain produces
+    // (group.length - 1) alternates — the matched suffix is excluded.
+    const inputs = ["https://abc.waifu.fun", "https://abc.eliza.ai", "https://abc.elizacloud.ai"];
 
     for (const origin of inputs) {
       const alts = getAlternateDomainOrigins(origin);
-      expect(alts).toHaveLength(4);
+      expect(alts).toHaveLength(2);
       expect(alts).not.toContain(origin);
       const hostnames = alts.map((url) => new URL(url).hostname);
       for (const hostname of hostnames) {
@@ -33,12 +27,18 @@ describe("getAlternateDomainOrigins", () => {
       [
         "9d77d8b5-1d63-4b4c-9bd1-ec1b5deb4dc8.eliza.ai",
         "9d77d8b5-1d63-4b4c-9bd1-ec1b5deb4dc8.elizacloud.ai",
-        "9d77d8b5-1d63-4b4c-9bd1-ec1b5deb4dc8.milady.ai",
-        "9d77d8b5-1d63-4b4c-9bd1-ec1b5deb4dc8.shad0w.xyz",
       ].sort(),
     );
   });
 
+  it("rejects retired 0xSolace-era domains (milady.ai, shad0w.xyz)", () => {
+    // These domains were intentionally dropped from the alias group to
+    // close the "0 legacy" cleanup. A leftover bookmark must fail Origin
+    // validation rather than silently aliasing into a live brand.
+    expect(getAlternateDomainOrigins("https://abc.milady.ai")).toEqual([]);
+    expect(getAlternateDomainOrigins("https://abc.shad0w.xyz")).toEqual([]);
+  });
+
   it("preserves the URL port when an origin includes one", () => {
     // `URL.origin` keeps non-default ports — the alternate origins must
     // round-trip them so a sandbox served on :8443 still matches its alias.

packages/cloud-shared/src/lib/services/pairing-token.ts

@@ -94,9 +94,8 @@ class PairingTokenService {
 
     // If no match, try each alternate domain in the same alias group. The
     // dashboard may rewrite the agent URL between any two aliased domains
-    // (waifu.fun ↔ eliza.ai ↔ elizacloud.ai ↔ milady.ai ↔ shad0w.xyz), and
-    // we cannot predict which one is stored as `expected_origin` for a
-    // given token row.
+    // (waifu.fun ↔ eliza.ai ↔ elizacloud.ai), and we cannot predict which
+    // one is stored as `expected_origin` for a given token row.
     if (!row) {
       for (const alternateOrigin of getAlternateDomainOrigins(normalizedOrigin)) {
         row = await agentPairingTokensRepository.consumeValidToken(