diff --git a/radicle-cli/src/commands/sync.rs b/radicle-cli/src/commands/sync.rs
index 5d872566..85e8633d 100644
--- a/radicle-cli/src/commands/sync.rs
+++ b/radicle-cli/src/commands/sync.rs
@@ -483,7 +483,7 @@ pub fn fetch(
     let local = profile.id();
     let is_private = profile.storage.repository(rid).ok().and_then(|repo| {
         let doc = repo.identity_doc().ok()?.doc;
-        sync::fetch::PrivateNetwork::private_repo(&doc)
+        sync::PrivateNetwork::private_repo(&doc)
     });
     let config = match is_private {
         Some(private) => sync::FetcherConfig::private(private, settings.replicas, *local),
diff --git a/radicle/src/node/sync.rs b/radicle/src/node/sync.rs
index c3ad8726..5e42f2a5 100644
--- a/radicle/src/node/sync.rs
+++ b/radicle/src/node/sync.rs
@@ -1,7 +1,52 @@
 pub mod fetch;
-
 pub use fetch::{Fetcher, FetcherConfig, FetcherError, FetcherResult};
 
+use std::collections::BTreeSet;
+
+use crate::identity::Visibility;
+use crate::prelude::Doc;
+
+use super::NodeId;
+
+/// A set of nodes that form a private network for fetching from.
+///
+/// This could be the set of allowed nodes for a private repository, using
+/// [`PrivateNetwork::private_repo`]
+pub struct PrivateNetwork {
+    allowed: BTreeSet<NodeId>,
+}
+
+impl PrivateNetwork {
+    pub fn private_repo(doc: &Doc) -> Option<Self> {
+        match doc.visibility() {
+            Visibility::Public => None,
+            Visibility::Private { allow } => {
+                let allowed = doc
+                    .delegates()
+                    .iter()
+                    .chain(allow.iter())
+                    .map(|did| *did.as_key())
+                    .collect();
+                Some(Self { allowed })
+            }
+        }
+    }
+
+    /// Restrict the set of allowed nodes based on the `predicate`, where `true`
+    /// keeps the `NodeId` in the allowed set.
+    ///
+    /// For example, this can be useful to restrict the set to only connected
+    /// nodes.
+    pub fn restrict<P>(self, predicate: P) -> Self
+    where
+        P: FnMut(&NodeId) -> bool,
+    {
+        Self {
+            allowed: self.allowed.into_iter().filter(predicate).collect(),
+        }
+    }
+}
+
 /// The replication factor of a syncing operation.
 #[derive(Copy, Clone, Debug, PartialEq, Eq)]
 pub enum ReplicationFactor {
diff --git a/radicle/src/node/sync/fetch.rs b/radicle/src/node/sync/fetch.rs
index c7c8f4ef..ed8118fe 100644
--- a/radicle/src/node/sync/fetch.rs
+++ b/radicle/src/node/sync/fetch.rs
@@ -5,11 +5,9 @@
 use std::collections::{BTreeSet, VecDeque};
 use std::ops::ControlFlow;
 
-use crate::identity::Visibility;
 use crate::node::{Address, FetchResult, FetchResults, NodeId};
-use crate::prelude::Doc;
 
-use super::ReplicationFactor;
+use super::{PrivateNetwork, ReplicationFactor};
 
 /// A [`Fetcher`] describes a machine for driving a fetching process.
 ///
@@ -236,31 +234,6 @@ impl Fetcher {
     }
 }
 
-/// A set of nodes that form a private network for fetching from.
-///
-/// This could be the set of allowed nodes for a private repository, using
-/// [`PrivateNetwork::private_repo`]
-pub struct PrivateNetwork {
-    allowed: BTreeSet<NodeId>,
-}
-
-impl PrivateNetwork {
-    pub fn private_repo(doc: &Doc) -> Option<Self> {
-        match doc.visibility() {
-            Visibility::Public => None,
-            Visibility::Private { allow } => {
-                let allowed = doc
-                    .delegates()
-                    .iter()
-                    .chain(allow.iter())
-                    .map(|did| *did.as_key())
-                    .collect();
-                Some(Self { allowed })
-            }
-        }
-    }
-}
-
 /// The progress a [`Fetcher`] is making.
 #[derive(Clone, Copy, Debug)]
 pub struct Progress {