perf(setup): download an org in about 2s instead of 30s (#93)

## Value

**V.A.L.U.E. tier:** micro. It's a mechanical change of 36 lines across 3 files, and the before/after timings below prove it.

- **Problem:** connecting an org through the setup wizard is slow. Picking "All" took **31.6s** on an org of about 300 resources. Each API request returns in about 90ms and local work is under a second, so nearly all of that was fixed waiting.
- **Who it affects:** everyone running `npm run setup`, including every [`npx create-vapi-app`](https://www.npmjs.com/package/create-vapi-app) user, plus anyone running `npm run pull`.

## How it works

1. **No `--force` pause for setup's own pulls.** `pull --force` warns and waits 2s so someone typing it by hand can Ctrl+C. The wizard ran one `--force` pull per resource type, so 9 types meant 18s of pauses. setup now sets `VAPI_GITOPS_FORCE_PAUSE=off` for the pulls it starts, following the `VAPI_GITOPS_ORG_PIN=off` convention. A hand-typed `--force` still pauses.
2. **No request gap on GETs.** `api.ts` waited 700ms between every request, reads included, which was about 9 of a plain pull's 11 seconds. Reads now skip the gap. A 429 is still retried with backoff (5 tries from 2s), as the config-free `vapi-client.ts` already does. Writes (POST, PATCH, DELETE) keep the gap.
3. **One pull for "All".** Picking "All" ran 10 processes, each re-fetching credentials and its type's full list. It now runs the same two steps as non-interactive setup: a bindings-only pull, then one full `--force --skip-bindings` pull. "Let me pick…" still pulls by `--id` per type.
4. **Org folder created before the first pull.** The org pin (`.vapi-org.json`) is only written into a folder that already exists. Non-interactive setup creates `resources/<org>/` first, but the wizard didn't, so the pin used to come from its second per-type pull. With a single pull, nothing would have written it, so the wizard now creates the folder first too.

## Verification

These are the exact command sequences each path runs, timed against a real org (`scott-dev`: 8 tools, 13 assistants, 8 structured outputs, 2 squads, 11 personalities, 118 scenarios, 118 simulations, 11 suites, 8 evals). They used read-only pulls in a throwaway copy of the repo.

| Path | Before | After |
|---|---|---|
| Wizard, "All" | 31.6s | **2.2–2.5s** |
| Wizard, "Let me pick…" with everything picked | 31.6s | 6.2s |
| Non-interactive setup / `npm run pull` | 11.1s | ~2.4s |
| Hand-typed `npm run pull -- <org> --force` | 11.1s | 3.8s (still pauses 2s) |

- **Output unchanged:** "All" via one pull and "pick everything" via per-type pulls wrote identical trees, 298 files, `.vapi-org.json` included.
- **No rate limiting:** none of the runs logged a 429 retry. Separately, 11 concurrent list requests against production all returned 200.
- `npm run build` passes, and `npm test` passes 584/584.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: scott-lowe-vapi

src/api.ts

@@ -103,7 +103,10 @@ function formatBodyPreview(body: Record<string, unknown>): string {
 // existing importers and `instanceof` checks see one class.
 export { VapiApiError };
 
-const REQUEST_DELAY_MS = 700; // Delay between requests to avoid rate limits
+// Minimum gap between writes, to stay under rate limits. Reads skip it: a pull
+// is a handful of list requests, and a 700ms gap before each one was most of a
+// pull's run time. A 429 on a read is still retried with backoff.
+const REQUEST_DELAY_MS = 700;
 
 let lastRequestTime = 0;
 
@@ -190,7 +193,6 @@ export async function vapiGet<T = unknown>(endpoint: string): Promise<T> {
   const url = `${VAPI_BASE_URL}${endpoint}`;
 
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-    await throttle();
     const response = await fetch(url, {
       method: "GET",
       headers: {

src/pull.ts

@@ -1291,7 +1291,13 @@ export async function runPull(options: PullOptions = {}): Promise<PullResult> {
   const bothDivergedResources: BothDivergedResource[] = [];
   let idsByType: Map<ResourceType, string[]> | undefined;
 
-  if (force && process.env.CI !== "true") {
+  // setup turns the pause off for the pulls it runs itself: the warning is for
+  // someone typing --force, and the wizard can run one --force pull per type.
+  if (
+    force &&
+    process.env.CI !== "true" &&
+    process.env.VAPI_GITOPS_FORCE_PAUSE !== "off"
+  ) {
     console.warn(
       "\n⚠️  --force will overwrite local files without showing you direction labels or surfacing 3-way conflicts.",
     );

src/setup.ts

@@ -304,15 +304,17 @@ async function deleteExistingOrg(slug: string): Promise<void> {
 // Pull integration
 // ─────────────────────────────────────────────────────────────────────────────
 
+// "all" downloads everything with one full pull rather than one pull per type,
+// each of which starts a process and re-fetches credentials and its list.
 function invokePull(
   slug: string,
-  selectedIds: Set<string>,
+  selectedIds: Set<string> | "all",
   token: string,
   baseUrl: string,
 ): void {
   // Group selected resources by type so we can pass --id per invocation
   const byType = new Map<string, string[]>();
-  for (const id of selectedIds) {
+  for (const id of selectedIds === "all" ? [] : selectedIds) {
     const sep = id.indexOf("::");
     const typeKey = id.substring(0, sep);
     const uuid = id.substring(sep + 2);
@@ -332,6 +334,7 @@ function invokePull(
     VAPI_PRIVATE_API_KEY: token,
     VAPI_TOKEN: token,
     VAPI_BASE_URL: baseUrl,
+    VAPI_GITOPS_FORCE_PAUSE: "off",
   };
 
   execSync(`tsx src/pull.ts ${slug} --bootstrap --bindings-only`, {
@@ -340,6 +343,15 @@ function invokePull(
     env,
   });
 
+  if (selectedIds === "all") {
+    execSync(`tsx src/pull.ts ${slug} --force --skip-bindings`, {
+      cwd: BASE_DIR,
+      stdio: "inherit",
+      env,
+    });
+    return;
+  }
+
   for (const [typeKey, uuids] of byType) {
     const idArgs = uuids.flatMap((id) => ["--id", id]);
     const cmd = [
@@ -704,6 +716,7 @@ async function main(): Promise<void> {
 
   // selectedIds: "typeKey::resourceUUID"
   let selectedIds: Set<string>;
+  let downloadAll = false;
 
   // eslint-disable-next-line no-constant-condition
   while (true) {
@@ -738,6 +751,7 @@ async function main(): Promise<void> {
 
       selectedIds = new Set(picked);
     } else {
+      downloadAll = true;
       selectedIds = new Set(
         nonEmpty.flatMap((snap) =>
           snap.resources.map((r) => `${snap.key}::${r.id as string}`),
@@ -796,10 +810,18 @@ async function main(): Promise<void> {
 
   await writeEnvFile(slug, trimmedKey, vapiBaseUrl);
   console.log(c.green(`  ✓ Created .env.${slug}\n`));
+  // Before the first pull, as non-interactive setup does: the org pin
+  // (.vapi-org.json) is only written into a folder that already exists.
+  await mkdir(resourceDir, { recursive: true });
 
   console.log(c.bold("  Downloading...\n"));
 
-  invokePull(slug, selectedIds, trimmedKey, vapiBaseUrl);
+  invokePull(
+    slug,
+    downloadAll ? "all" : selectedIds,
+    trimmedKey,
+    vapiBaseUrl,
+  );
 
   // ── Done ──────────────────────────────────────────────────────────────