#
#
# patch "cmd_netsync.cc"
#  from [ae3b4fe97915422e7d549732200225896a7210de]
#    to [d1b9aead3c0742a08d4c5035e14ede9743c50831]
# 
# patch "cmd_scgi.cc"
#  from [509cf28ff9b7584fecde01ba3afa9b26972ab7d8]
#    to [9aea34024e0f9430dcfcc06e59bdca5f22d1feef]
# 
# patch "gsync.cc"
#  from [b617e981d0b11cb8c5fb5ecfcb3b098948a32fc6]
#    to [7e1e1bf22d61c0c1216f3937fda3d77d49ca3521]
# 
# patch "http_client.cc"
#  from [fa1d82dbc9f6b2d5392a15868dfba528cad6cd5b]
#    to [ebd2d796bfaf1f4e027ad3ff6d2d43c3ac2cc93c]
# 
# patch "http_client.hh"
#  from [668db6f5ad1bedccb4679f10763d1432402653d4]
#    to [454f6074e7408d53b97bca7078c6f7f4c07c2b93]
# 
# patch "json_msgs.cc"
#  from [2789059ea725d4728e60e16a6f4a8bcf94d086c2]
#    to [97ca800cb705214d2e8753312226a83e36288112]
# 
# patch "net_common.cc"
#  from [619cb958333738577696c03cf41195ddd68cfef1]
#    to [d812125cc10b1ba6f3139816959aa3713d05e870]
# 
# patch "net_common.hh"
#  from [d716d882f0ec7af9b09f2cbd0be82b401deb2278]
#    to [31882a93b44f0c21e4a7b7d6b0a2b24d81fbae67]
#
============================================================
--- cmd_netsync.cc	ae3b4fe97915422e7d549732200225896a7210de
+++ cmd_netsync.cc	d1b9aead3c0742a08d4c5035e14ede9743c50831
@@ -492,10 +492,9 @@ void 
 }
 
 void 
-run_gsync_protocol(utf8 const & addr,
+run_gsync_protocol(options & opts, lua_hooks & lua, database & db, utf8 const & addr,
                    globish const & include_pattern,
-                   globish const & exclude_pattern,
-                   app_state & app);
+                   globish const & exclude_pattern);
 
 CMD(gsync, "gsync", "", CMD_REF(network),
     N_("[ADDRESS[:PORTNUMBER] [PATTERN ...]]"),
@@ -506,12 +505,16 @@ CMD(gsync, "gsync", "", CMD_REF(network)
     options::opts::key_to_push)
 {
   utf8 addr;
+
+  database db(app);
+  key_store keys(app);
+
   globish include_pattern, exclude_pattern;
-  extract_address(args, addr, app);
-  extract_patterns(args, include_pattern, exclude_pattern, app);
-  find_key_if_needed(addr, include_pattern, exclude_pattern, app);
+  extract_address(app.opts, db, args, addr);
+  extract_patterns(app.opts, db, args, include_pattern, exclude_pattern);
+  find_key_if_needed(app.opts, app.lua, db, keys, addr, include_pattern, exclude_pattern);
 
-  run_gsync_protocol(addr, include_pattern, exclude_pattern, app);
+  run_gsync_protocol(app.opts, app.lua, db, addr, include_pattern, exclude_pattern);
 }
 
 
============================================================
--- cmd_scgi.cc	509cf28ff9b7584fecde01ba3afa9b26972ab7d8
+++ cmd_scgi.cc	9aea34024e0f9430dcfcc06e59bdca5f22d1feef
@@ -15,10 +15,12 @@
 #include "app_state.hh"
 #include "cmd.hh"
 #include "constants.hh"
+#include "database.hh"
 #include "globish.hh"
 #include "json_io.hh"
 #include "json_msgs.hh"
 #include "keys.hh"
+#include "key_store.hh"
 #include "lexical_cast.hh"
 #include "lua.hh"
 #include "lua_hooks.hh"
@@ -153,18 +155,18 @@ static json_io::json_value_t
 }
 
 static json_io::json_value_t
-do_cmd(app_state & app, json_io::json_object_t cmd_obj)
+do_cmd(database & db, json_io::json_object_t cmd_obj)
 {
   set<revision_id> revs;
 
   if (decode_msg_inquire(cmd_obj, revs))
     {
       L(FL("inquiring %d revisions") % revs.size());
-      app.db.ensure_open();
+      db.ensure_open();
       set<revision_id> confirmed;
       for (set<revision_id>::const_iterator i = revs.begin();
            i != revs.end(); ++i)
-        if (app.db.revision_exists(*i))
+        if (db.revision_exists(*i))
           confirmed.insert(*i);
       return encode_msg_confirm(confirmed);
     }
@@ -176,7 +178,7 @@ void
 
 
 void
-process_scgi_transaction(app_state & app, 
+process_scgi_transaction(database & db,
                          std::istream & in,
                          std::ostream & out)
 {
@@ -196,10 +198,10 @@ process_scgi_transaction(app_state & app
 
       if (static_cast<bool>(obj)) 
         {
-          transaction_guard guard(app.db);
+          transaction_guard guard(db);
           L(FL("read JSON object"));
 
-          json_io::json_value_t res = do_cmd(app, obj);
+          json_io::json_value_t res = do_cmd(db, obj);
           if (static_cast<bool>(res))
             {
               json_io::printer out_data;
@@ -251,24 +253,28 @@ CMD_NO_WORKSPACE(scgi,             // C
   if (!args.empty())
     throw usage(execid);
 
+  database db(app);
+  key_store keys(app);
+
   if (app.opts.signing_key() == "")
     {
       rsa_keypair_id key;
-      get_user_key(key, app);
+      get_user_key(app.opts, app.lua, db, keys, key);
       app.opts.signing_key = key;
     }
 
+  rsa_keypair_id key;  // still unused...
   if (app.opts.use_transport_auth)
     {
       N(app.lua.hook_persist_phrase_ok(),
         F("need permission to store persistent passphrase (see hook persist_phrase_ok())"));
-      require_password(app.opts.signing_key, app);
+      get_user_key(app.opts, app.lua, db, keys, key);
     }
   else if (!app.opts.bind_stdio)
     W(F("The --no-transport-auth option is usually only used in combination with --stdio"));
 
   if (app.opts.bind_stdio)
-    process_scgi_transaction(app, std::cin, std::cout);
+    process_scgi_transaction(db, std::cin, std::cout);
   else
     {    
 
@@ -313,7 +319,7 @@ CMD_NO_WORKSPACE(scgi,             // C
                       Netxx::Stream stream(peer.get_socketfd());
                       Netxx::Netbuf<constants::bufsz>  buf(stream);
                       std::iostream io(&buf);
-                      process_scgi_transaction(app, io, io);
+                      process_scgi_transaction(db, io, io);
                     }
                   else
                     break;
============================================================
--- gsync.cc	b617e981d0b11cb8c5fb5ecfcb3b098948a32fc6
+++ gsync.cc	7e1e1bf22d61c0c1216f3937fda3d77d49ca3521
@@ -14,7 +14,6 @@
 #include <set>
 #include <string>
 
-#include "app_state.hh"
 #include "database.hh"
 #include "globish.hh"
 #include "http_client.hh"
@@ -196,8 +195,8 @@ static void
 }
 
 static void
-do_missing_playback(http_client & h,
-                    app_state & app, 
+do_missing_playback(database & db,
+                    http_client & h,
                     set<revision_id> & core_frontier, 
                     set<revision_id> & revs_to_push,
                     rev_ancestry_map const & parent_to_child_map)
@@ -250,27 +249,27 @@ static void 
 
 
 static void 
-request_missing_playback(http_client & h,
-                         app_state & app,
+request_missing_playback(database & db,
+                         http_client & h,
                          set<revision_id> const & core_frontier)
 {
 
 }
 
 void
-run_gsync_protocol(utf8 const & addr,
+run_gsync_protocol(options & opts, lua_hooks & lua, database & db,
+                   utf8 const & addr,
                    globish const & include_pattern,
-                   globish const & exclude_pattern,
-                   app_state & app)
+                   globish const & exclude_pattern)
 {
   uri u;
   parse_uri(addr(), u);
-  http_client h(app, u, include_pattern, exclude_pattern);
+  http_client h(opts, lua, u, include_pattern, exclude_pattern);
 
   bool pushing = true, pulling = true;
 
   rev_ancestry_map parent_to_child_map, child_to_parent_map;
-  app.db.get_revision_ancestry(parent_to_child_map);
+  db.get_revision_ancestry(parent_to_child_map);
   invert_ancestry(parent_to_child_map, child_to_parent_map);
 
   set<revision_id> our_revs;
@@ -291,14 +290,14 @@ run_gsync_protocol(utf8 const & addr,
   P(F("revs to send: %d") % ours_alone.size());
 
   set<revision_id> core_frontier = common_core;
-  erase_ancestors(core_frontier, app);
+  erase_ancestors(db, core_frontier);
 
   if (pushing)
-    do_missing_playback(h, app, core_frontier, ours_alone,
+    do_missing_playback(db, h, core_frontier, ours_alone,
                         parent_to_child_map);
 
   if (pulling)
-    request_missing_playback(h, app, core_frontier);
+    request_missing_playback(db, h, core_frontier);
 }
 
 
============================================================
--- http_client.cc	fa1d82dbc9f6b2d5392a15868dfba528cad6cd5b
+++ http_client.cc	ebd2d796bfaf1f4e027ad3ff6d2d43c3ac2cc93c
@@ -10,7 +10,6 @@
 
 // micro http client implementation
 #include "base.hh"
-#include "app_state.hh"
 #include "globish.hh"
 #include "http_client.hh"
 #include "json_io.hh"
@@ -46,15 +45,16 @@ using Netxx::PipeStream;
 using Netxx::PipeStream;
 
 
-http_client::http_client(app_state & app,
+http_client::http_client(options & opts, lua_hooks & lua,
                          uri const & u,               
                          globish const & include_pattern,
                          globish const & exclude_pattern)
-  : app(app), 
+  : opts(opts),
+    lua(lua),
     u(u), 
     include_pattern(include_pattern), 
     exclude_pattern(exclude_pattern),
-    stream(build_stream_to_server(app, u, include_pattern, exclude_pattern,
+    stream(build_stream_to_server(opts, lua, u, include_pattern, exclude_pattern,
                                   (u.port.empty() ? constants::default_http_port
                                                   : lexical_cast<size_t,string>(u.port)),
                                   Netxx::Timeout(static_cast<long>(constants::netsync_timeout_seconds)))), 
@@ -69,7 +69,7 @@ http_client::transact_json(json_value_t 
   if (!open)
     {
       L(FL("reopening connection"));
-      stream = build_stream_to_server(app, u, include_pattern, exclude_pattern, 
+      stream = build_stream_to_server(opts, lua, u, include_pattern, exclude_pattern, 
                                       constants::default_http_port,
                                       Netxx::Timeout(static_cast<long>(constants::netsync_timeout_seconds)));
       nb = shared_ptr< Netbuf<constants::bufsz> >(new Netbuf<constants::bufsz>(*stream));
============================================================
--- http_client.hh	668db6f5ad1bedccb4679f10763d1432402653d4
+++ http_client.hh	454f6074e7408d53b97bca7078c6f7f4c07c2b93
@@ -21,15 +21,16 @@
 
 #include <boost/shared_ptr.hpp>
 
-struct app_state;
 struct uri;
 struct globish;
+struct options;
+class lua_hooks;
 
-
 struct
 http_client
 {
-  app_state & app;
+  options & opts;
+  lua_hooks & lua;
   uri const & u;
   globish const & include_pattern;
   globish const & exclude_pattern;
@@ -39,7 +40,7 @@ http_client
   boost::shared_ptr<std::iostream> io;
   bool open;
 
-  http_client(app_state & app,
+  http_client(options & opts, lua_hooks & lua,
               uri const & u,          
               globish const & include_pattern,
               globish const & exclude_pattern); 
============================================================
--- json_msgs.cc	2789059ea725d4728e60e16a6f4a8bcf94d086c2
+++ json_msgs.cc	97ca800cb705214d2e8753312226a83e36288112
@@ -11,6 +11,7 @@
 #include "base.hh"
 #include "json_io.hh"
 #include "json_msgs.hh"
+#include "cset.hh"
 
 #include <map>
 #include <set>
============================================================
--- net_common.cc	619cb958333738577696c03cf41195ddd68cfef1
+++ net_common.cc	d812125cc10b1ba6f3139816959aa3713d05e870
@@ -9,9 +9,10 @@
 
 #include "base.hh"
 
-#include "app_state.hh"
 #include "globish.hh"
+#include "lua_hooks.hh"
 #include "net_common.hh"
+#include "options.hh"
 #include "uri.hh"
 #include "vocab.hh"
 
@@ -65,7 +66,8 @@ shared_ptr<Netxx::StreamBase>
 }
 
 shared_ptr<Netxx::StreamBase>
-build_stream_to_server(app_state & app,
+build_stream_to_server(options & opts,
+                       lua_hooks & lua,
                        uri const & u,
                        globish const & include_pattern,
                        globish const & exclude_pattern,                       
@@ -75,16 +77,16 @@ build_stream_to_server(app_state & app,
   shared_ptr<Netxx::StreamBase> server;
   vector<string> argv;
 
-  if (app.lua.hook_get_netsync_connect_command(u,
-                                               include_pattern,
-                                               exclude_pattern,
-                                               global_sanity.debug_p(),
-                                               argv))
+  if (lua.hook_get_netsync_connect_command(u,
+                                           include_pattern,
+                                           exclude_pattern,
+                                           global_sanity.debug_p(),
+                                           argv))
     {
       I(argv.size() > 0);
       string cmd = argv[0];
       argv.erase(argv.begin());
-      app.opts.use_transport_auth = app.lua.hook_use_transport_auth(u);
+      opts.use_transport_auth = lua.hook_use_transport_auth(u);
       return shared_ptr<Netxx::StreamBase>
         (new Netxx::PipeStream(cmd, argv));
     }
============================================================
--- net_common.hh	d716d882f0ec7af9b09f2cbd0be82b401deb2278
+++ net_common.hh	31882a93b44f0c21e4a7b7d6b0a2b24d81fbae67
@@ -25,7 +25,8 @@ struct uri;
 struct globish;
 struct utf8;
 struct uri;
-struct app_state;
+struct options;
+class lua_hooks;
 
 
 // This just covers helper routines that are shared across networking
@@ -38,7 +39,8 @@ boost::shared_ptr<Netxx::StreamBase>
                   Netxx::port_type default_port);
 
 boost::shared_ptr<Netxx::StreamBase>
-build_stream_to_server(app_state & app,
+build_stream_to_server(options & opts,
+                       lua_hooks & lua,
                        uri const & u,
                        globish const & include_pattern,
                        globish const & exclude_pattern,