fix: use npm as source of truth for org packages

Author: danielroe

app/composables/npm/useOrgPackages.ts

@@ -79,9 +79,9 @@ async function fetchBulkDownloads(
 /**
  * Fetch all packages for an npm organization.
  *
- * When the user has Algolia search enabled, uses Algolia's `owner.name` filter
- * for a much faster lookup (single request vs N+1 packument fetches).
- * Falls back to the npm registry API when using the npm search provider.
+ * Always uses the npm registry's org endpoint as the source of truth for which
+ * packages belong to the org. When Algolia is enabled, uses it to quickly fetch
+ * metadata for those packages (instead of N+1 packument fetches).
  */
 export function useOrgPackages(orgName: MaybeRefOrGetter<string>) {
   const { searchProvider } = useSearchProvider()
@@ -95,21 +95,9 @@ export function useOrgPackages(orgName: MaybeRefOrGetter<string>) {
         return emptySearchResponse
       }
 
-      // --- Algolia fast path ---
-      if (searchProvider.value === 'algolia') {
-        try {
-          const response = await searchByOwner(org)
-          // If Algolia returns no results, the org may not exist — fall through
-          // to npm registry path which can properly detect a 404
-          if (response.objects.length > 0) {
-            return response
-          }
-        } catch {
-          // Fall through to npm registry path on Algolia failure
-        }
-      }
-
-      // --- npm registry path ---
+      // Always get the authoritative package list from the npm registry.
+      // Algolia's owner.name filter doesn't precisely match npm org membership
+      // (e.g. it includes @nuxtjs/* packages for the @nuxt org).
       let packageNames: string[]
       try {
         const { packages } = await $fetch<{ packages: string[]; count: number }>(
@@ -138,9 +126,33 @@ export function useOrgPackages(orgName: MaybeRefOrGetter<string>) {
         return emptySearchResponse
       }
 
-      // Fetch packuments and downloads in parallel
+      // --- Algolia fast path: use Algolia to get metadata for known packages ---
+      if (searchProvider.value === 'algolia') {
+        try {
+          const response = await searchByOwner(org)
+          if (response.objects.length > 0) {
+            // Filter Algolia results to only include packages that are
+            // actually in the org (per the npm registry's authoritative list)
+            const orgPackageSet = new Set(packageNames.map(n => n.toLowerCase()))
+            const filtered = response.objects.filter(obj =>
+              orgPackageSet.has(obj.package.name.toLowerCase()),
+            )
+
+            if (filtered.length > 0) {
+              return {
+                ...response,
+                objects: filtered,
+                total: filtered.length,
+              }
+            }
+          }
+        } catch {
+          // Fall through to npm registry path
+        }
+      }
+
+      // --- npm registry path: fetch packuments individually ---
       const [packuments, downloads] = await Promise.all([
-        // Fetch packuments with concurrency limit
         (async () => {
           const results = await mapWithConcurrency(
             packageNames,
@@ -157,16 +169,13 @@ export function useOrgPackages(orgName: MaybeRefOrGetter<string>) {
             },
             10,
           )
-          // Filter out any unpublished packages (missing dist-tags)
           return results.filter(
             (pkg): pkg is MinimalPackument => pkg !== null && !!pkg['dist-tags'],
           )
         })(),
-        // Fetch downloads in bulk
         fetchBulkDownloads($npmApi, packageNames, { signal }),
       ])
 
-      // Convert to search results with download data
       const results: NpmSearchResult[] = packuments.map(pkg =>
         packumentToSearchResult(pkg, downloads.get(pkg.name)),
       )