querysub 0.504.0 → 0.506.0

package/src/1-path-client/RemoteWatcher.ts

@@ -20,6 +20,8 @@ import { auditLog, isDebugLogEnabled } from "../0-path-value-core/auditLogs";
 import { debugNodeThread } from "../-c-identity/IdentityController";
 import { authorityLookup } from "../0-path-value-core/AuthorityLookup";
 import { decodeParentFilter, encodeParentFilter, registerGetSpecForChildPath } from "../0-path-value-core/hackedPackedPathParentFiltering";
+import { getPathNetwork } from "../0-path-value-core/PathRouterRouteOverride";
+import { DEFAULT_NETWORK } from "../config";
 import { removeRange, rangesOverlap } from "../rangeMath";
 import { evaluateValidStates } from "../config2";
 
@@ -46,8 +48,10 @@ export class RemoteWatcher {
             start: number;
             // exclusive
             end: number;
-            // encodeParentFilter({ path: cleanPath, startFraction: start, endFraction: end })
+            // encodeParentFilter({ path: cleanPath, startFraction: start, endFraction: end, network })
             finalPath: string;
+            // undefined means the default network
+            network?: string;
             // All of the requests paths that request it (pre decodeParentFilter).
             inputPaths: Set<string>;
 
@@ -139,8 +143,10 @@ export class RemoteWatcher {
         let parentPath = getParentPathStr(path);
         let watchObj = this.remoteWatchParents2.get(parentPath);
         if (!watchObj) return undefined;
-        // NOTE: PathRouter.getChildReadNodes PROMISES That all of the nodes will hash in the same way, and if they all hash in the same way, and they have different ranges, then every path will uniquely map to a single value. 
+        let pathNetwork = getPathNetwork(path);
+        // NOTE: PathRouter.getChildReadNodes PROMISES That all of the nodes will hash in the same way, and if they all hash in the same way, and they have different ranges, then every path will uniquely map to a single value.
         return watchObj.ranges.find(x => {
+            if ((x.network || DEFAULT_NETWORK) !== pathNetwork) return false;
             let route = PathRouter.getRouteFull({ path, spec: x.authoritySpec });
             return x.start <= route && route < x.end;
         });
@@ -149,8 +155,10 @@ export class RemoteWatcher {
         let parentPath = getParentPathStr(path);
         let watchObj = this.remoteWatchParents2.get(parentPath);
         if (!watchObj) return undefined;
-        // NOTE: PathRouter.getChildReadNodes PROMISES That all of the nodes will hash in the same way, and if they all hash in the same way, and they have different ranges, then every path will uniquely map to a single value. 
+        let pathNetwork = getPathNetwork(path);
+        // NOTE: PathRouter.getChildReadNodes PROMISES That all of the nodes will hash in the same way, and if they all hash in the same way, and they have different ranges, then every path will uniquely map to a single value.
         for (let range of watchObj.ranges) {
+            if ((range.network || DEFAULT_NETWORK) !== pathNetwork) continue;
             let route = PathRouter.getRouteFull({ path, spec: range.authoritySpec });
             if (range.start <= route && route < range.end) {
                 return route;
@@ -258,17 +266,17 @@ export class RemoteWatcher {
                     if (totalMissingPaths === 0) {
                         let authorities = authorityLookup.getTopologySync();
                         authorityId = PathRouter.getReadyAuthority(path)?.nodeId;
-                        console.warn(`Missing authority for path ${path}`, { authorities });
+                        console.warn(`Missing authority for path ${path} (network ${getPathNetwork(path)})`, { network: getPathNetwork(path), authorities });
                     }
                     totalMissingPaths++;
                     if (!this.disconnectedPaths.has(path)) {
                         newDisconnectPaths++;
                         this.disconnectedPaths.add(path);
-                        auditLog("NO AUTHORITY FOR PATH", { path });
+                        auditLog("NO AUTHORITY FOR PATH", { path, network: getPathNetwork(path) });
                     }
                     continue;
                 }
-                auditLog("FOUND AUTHORITY FOR PATH", { path, authorityId });
+                auditLog("FOUND AUTHORITY FOR PATH", { path, network: getPathNetwork(path), authorityId });
                 this.disconnectedPaths.delete(path);
                 foundPaths++;
 
@@ -289,6 +297,7 @@ export class RemoteWatcher {
 
                 let decodedParentFilter = decodeParentFilter(path);
                 let cleanPath = decodedParentFilter?.path ?? path;
+                let network = decodedParentFilter?.network;
 
                 let rangeStart = 0;
                 let rangeEnd = 1;
@@ -297,6 +306,8 @@ export class RemoteWatcher {
                     rangeEnd = decodedParentFilter.end;
                 }
 
+                const sameNetwork = (rangeNetwork: string | undefined) => (rangeNetwork || DEFAULT_NETWORK) === (network || DEFAULT_NETWORK);
+
                 let watchObj = this.remoteWatchParents2.get(cleanPath);
 
                 if (watchObj && !config.tryReconnect) {
@@ -306,11 +317,13 @@ export class RemoteWatcher {
                         end: rangeEnd,
                     }];
                     for (let range of watchObj.ranges) {
+                        if (!sameNetwork(range.network)) continue;
                         removeRange(requiredRanges, range);
                     }
                     if (requiredRanges.length === 0) {
                         this.disconnectedParents.delete(path);
                         for (let range of watchObj.ranges) {
+                            if (!sameNetwork(range.network)) continue;
                             if (rangesOverlap(range, { start: rangeStart, end: rangeEnd })) {
                                 range.inputPaths.add(path);
                             }
@@ -319,7 +332,8 @@ export class RemoteWatcher {
                     }
                 }
 
-                let { nodes } = PathRouter.getChildReadNodes(cleanPath, {
+                let readNodesPath = network && encodeParentFilter({ path: cleanPath, startFraction: 0, endFraction: 1, network }) || cleanPath;
+                let { nodes } = PathRouter.getChildReadNodes(readNodesPath, {
                     // Pass existing connected node ids as preferred
                     preferredNodeIds: watchObj?.ranges.map(x => x.authorityId) || []
                 });
@@ -347,6 +361,7 @@ export class RemoteWatcher {
                 // Compute which parts of [rangeStart, rangeEnd] aren't yet covered by existing watches
                 let missingRanges: { start: number; end: number }[] = [{ start: rangeStart, end: rangeEnd }];
                 for (let range of watchObj.ranges) {
+                    if (!sameNetwork(range.network)) continue;
                     removeRange(missingRanges, range);
                 }
 
@@ -359,13 +374,14 @@ export class RemoteWatcher {
                         let clippedStart = Math.max(node.range.start, missing.start);
                         let clippedEnd = Math.min(node.range.end, missing.end);
 
-                        let finalPath = encodeParentFilter({ path: cleanPath, startFraction: clippedStart, endFraction: clippedEnd });
+                        let finalPath = encodeParentFilter({ path: cleanPath, startFraction: clippedStart, endFraction: clippedEnd, network });
                         let existingRange = watchObj.ranges.find(x => x.finalPath === finalPath && x.authorityId === node.nodeId);
                         if (!existingRange) {
                             existingRange = {
                                 start: clippedStart,
                                 end: clippedEnd,
                                 finalPath,
+                                network,
                                 inputPaths: new Set(),
                                 authorityId: node.nodeId,
                                 suppressedWatches: new Set(),
@@ -385,6 +401,7 @@ export class RemoteWatcher {
 
                 // Register path on pre-existing ranges that already cover parts of [rangeStart, rangeEnd]
                 for (let range of watchObj.ranges) {
+                    if (!sameNetwork(range.network)) continue;
                     if (rangesOverlap(range, { start: rangeStart, end: rangeEnd })) {
                         range.inputPaths.add(path);
                     }
@@ -396,7 +413,7 @@ export class RemoteWatcher {
             console.warn(`Some paths have no authority. We will search for an authority periodically until we find an authority. New missing ${newDisconnectPaths} paths and ${newDisconnectParents} parent paths, total missing ${this.disconnectedPaths.size} paths and ${this.disconnectedParents.size} parent paths.`);
             let first10 = Array.from(this.disconnectedPaths).slice(0, 10);
             for (let path of first10) {
-                console.log(`\t${path}`);
+                console.log(`\t(network ${getPathNetwork(path)}) ${path}`);
             }
             if (this.disconnectedPaths.size > 10) {
                 console.log(`\t... and ${this.disconnectedPaths.size - 10} more paths`);
@@ -416,10 +433,10 @@ export class RemoteWatcher {
             if (isOwnNodeId(authorityId)) continue;
 
             for (let path of paths) {
-                auditLog("remoteWatcher outer WATCH", { path, remoteNodeId: authorityId });
+                auditLog("remoteWatcher outer WATCH", { path, network: getPathNetwork(path), remoteNodeId: authorityId });
             }
             for (let path of parentPaths) {
-                auditLog("remoteWatcher outer PARENT WATCH", { path, remoteNodeId: authorityId });
+                auditLog("remoteWatcher outer PARENT WATCH", { path, network: decodeParentFilter(path)?.network || DEFAULT_NETWORK, remoteNodeId: authorityId });
             }
 
             if (STOP_KEYS_DOUBLE_SENDS) {
@@ -428,7 +445,7 @@ export class RemoteWatcher {
                     let range = this.getRemoteWatchParentRange(path);
                     if (range) {
                         range.suppressedWatches.add(path);
-                        auditLog("remoteWatcher outer WATCH SUPPRESSED", { path, remoteNodeId: authorityId });
+                        auditLog("remoteWatcher outer WATCH SUPPRESSED", { path, network: getPathNetwork(path), remoteNodeId: authorityId });
                         return false;
                     }
                     return true;
@@ -480,10 +497,10 @@ export class RemoteWatcher {
                 }
                 for (let [authorityId, { paths, parentPaths }] of byAuthority) {
                     for (let path of paths) {
-                        auditLog("remoteWatcher inner WATCH", { path, remoteNodeId: authorityId });
+                        auditLog("remoteWatcher inner WATCH", { path, network: getPathNetwork(path), remoteNodeId: authorityId });
                     }
                     for (let path of parentPaths) {
-                        auditLog("remoteWatcher inner WATCH PARENT", { path, remoteNodeId: authorityId });
+                        auditLog("remoteWatcher inner WATCH PARENT", { path, network: decodeParentFilter(path)?.network || DEFAULT_NETWORK, remoteNodeId: authorityId });
                     }
                     // NOTE: We log watches here because we want to log batched watches
                     ActionsHistory.OnNewWatches({ newPathsWatched: paths, newParentsWatched: parentPaths, debugName: batched[0].debugName, authorityId });
@@ -494,10 +511,10 @@ export class RemoteWatcher {
                     };
                     if (isDebugLogEnabled()) {
                         for (let path of paths) {
-                            auditLog("Asking to watch path", { path, authorityId, targetNodeThreadId: debugNodeThread(authorityId) });
+                            auditLog("Asking to watch path", { path, network: getPathNetwork(path), authorityId, targetNodeThreadId: debugNodeThread(authorityId) });
                         }
                         for (let path of parentPaths) {
-                            auditLog("Asking to watch parent path", { path, authorityId, targetNodeThreadId: debugNodeThread(authorityId) });
+                            auditLog("Asking to watch parent path", { path, network: decodeParentFilter(path)?.network || DEFAULT_NETWORK, authorityId, targetNodeThreadId: debugNodeThread(authorityId) });
                         }
                     }
                     logErrors(RemoteWatcher.REMOTE_WATCH_FUNCTION(config, authorityId));
@@ -587,10 +604,10 @@ export class RemoteWatcher {
         }
         for (let [authorityIdBase, { paths, parentPaths }] of unwatchesPerAuthority.entries()) {
             for (let path of paths) {
-                auditLog("remoteWatcher inner UNWATCH", { path, remoteNodeId: authorityIdBase });
+                auditLog("remoteWatcher inner UNWATCH", { path, network: getPathNetwork(path), remoteNodeId: authorityIdBase });
             }
             for (let path of parentPaths) {
-                auditLog("remoteWatcher inner UNWATCH PARENT", { path, remoteNodeId: authorityIdBase });
+                auditLog("remoteWatcher inner UNWATCH PARENT", { path, network: decodeParentFilter(path)?.network || DEFAULT_NETWORK, remoteNodeId: authorityIdBase });
             }
             if (!isOwnNodeId(authorityIdBase)) {
                 logErrors(RemoteWatcher.REMOTE_UNWATCH_FUNCTION({ paths, parentPaths }, authorityIdBase));

package/src/3-path-functions/PathFunctionHelpers.ts

@@ -14,13 +14,12 @@ import { blue, green, red } from "socket-function/src/formatting/logColors";
 import { getPathStr2 } from "../path";
 import { isNode, sort } from "socket-function/src/misc";
 import { decodeCborx, encodeCborx } from "../misc/cloneHelpers";
-import { parseFilterable } from "../misc/filterable";
 import { interceptCalls } from "../-0-hooks/hooks";
 import { createRoutingOverrideKey } from "../0-path-value-core/PathRouterRouteOverride";
 import { PathRouter } from "../0-path-value-core/PathRouter";
 import { getPathFromProxy } from "../2-proxy/pathValueProxy";
-import { getDomain, isPublic } from "../config";
-import { getFncFilter, isServer } from "../config2";
+import { getDomain, getPrimaryNetwork, isPublic, DEFAULT_NETWORK } from "../config";
+import { isServer } from "../config2";
 import { getTimeUnique } from "socket-function/src/bits";
 
 // NOTE: We could deploy single functions, but... we will almost always be updating all functions at
@@ -161,16 +160,27 @@ export function writeFunctionCall(config: {
     //          which gives them about a minute to guess it...
     let callId = now + "_" + secureRandom();
 
+    // Clients don't know their network. The QuerysubController decides the network for their calls (and rewrites the callId to match).
+    let network: string | undefined;
+    if (isNode()) {
+        network = getPrimaryNetwork();
+        if (network === DEFAULT_NETWORK) {
+            network = undefined;
+        }
+    }
+
     // We HAVE to override the routing id, otherwise PathFunctionRunner secondary sharding won't work
     callId = getCallIdOverride({
         moduleId,
         functionId,
         callId,
         args,
+        network,
     }) || createRoutingOverrideKey({
         originalKey: callId,
         routeKey: callId,
         remappedPrefix: getFunctionRunnerPrefix(moduleId),
+        network,
     });
 
     let argsEncoded = encodeArgs(args);
@@ -185,19 +195,8 @@ export function writeFunctionCall(config: {
         // Will be updated by Querysub to be correct (unless we are directly writing, then...
         //  this is fine).
         callerIP: "127.0.0.1",
+        network,
     };
-    // NOTE: I don't know when this would ever really work. I guess to isolate function calls, but if we're running locally, isn't that easy? 
-    // if (!isNode()) {
-    //     // Get the "setfncfilter" querystring parameter
-    //     let url = new URL(window.location.href);
-    //     let setfncfilter = url.searchParams.get("setfncfilter");
-    //     if (setfncfilter) {
-    //         callSpec.filterable = parseFilterable(setfncfilter);
-    //     }
-    // }
-    if (isNode()) {
-        callSpec.filterable = getFncFilter();
-    }
 
     if (curInterceptor) {
         curInterceptor.onCall(callSpec, metadata);

package/src/3-path-functions/PathFunctionRunner.ts

@@ -16,10 +16,9 @@ import { parseArgs } from "./PathFunctionHelpers";
 import { FunctionMetadata, PERMISSIONS_FUNCTION_ID, addRoutingPrefixForDeploy, getAllDevelopmentModulesIds, getDevelopmentModule, getExportPath, getModuleRelativePath, getSchemaObject } from "./syncSchema";
 import { formatTime } from "socket-function/src/formatting/format";
 import { getControllerNodeIdList, set_debug_getFunctionRunnerShards } from "../-g-core-values/NodeCapabilities";
-import { FilterSelector, Filterable, doesMatch } from "../misc/filterable";
 import { SocketFunction } from "socket-function/SocketFunction";
 import { requiresNetworkTrustHook } from "../-d-trust/NetworkTrust2";
-import { getDomain, isPublic } from "../config";
+import { getDomain, isPublic, DEFAULT_NETWORK } from "../config";
 import { getGitRefSync, getGitURLSync } from "../4-deploy/git";
 import type { DeployProgress } from "../4-deploy/deployFunctions";
 import { getRoutingOverride, getRoutingOverridePart } from "../0-path-value-core/PathRouterRouteOverride";
@@ -105,10 +104,11 @@ export interface CallSpec {
     callerIP: string;
     runAtTime: Time;
 
-    // Not just used for debugging, also used to add special proxy-related warnings. 
+    // Not just used for debugging, also used to add special proxy-related warnings.
     fromProxy?: string;
 
-    filterable?: Filterable;
+    // The network the call is on ("default" if unset). Only FunctionRunners on this network will run the call.
+    network?: string;
 }
 export function debugCallSpec(spec: CallSpec): string {
     return `${spec.DomainName}/${spec.ModuleId}/${spec.FunctionId}`;
@@ -227,7 +227,8 @@ export class PathFunctionRunner {
         shardRange: { startFraction: number, endFraction: number };
         secondaryShardRange?: { startFraction: number, endFraction: number };
         PermissionsChecker: PermissionsCheckType | undefined;
-        filterSelector?: FilterSelector;
+        // The networks we listen to calls on. Unset is equivalent to ["default"].
+        networks?: string[];
     }) {
         SocketFunction.expose(FunctionPreloadController);
         SocketFunction.expose(FunctionCaptureController);
@@ -264,11 +265,14 @@ export class PathFunctionRunner {
 
         let outstandingCalls = 0;
 
+        let networks = this.config.networks && this.config.networks.length > 0 && this.config.networks || [DEFAULT_NETWORK];
+
         let watchModuleCalls = cache((moduleId: string) => {
-            // Object.keys(functionSchema()[domainName].PathFunctionRunner[moduleId].Calls);
-            // Object.keys(functionSchema()[domainName].PathFunctionRunner[moduleId].Results);
-            Querysub.keys(functionSchema()[domainName].PathFunctionRunner[moduleId].Calls, fullFraction);
-            Querysub.keys(functionSchema()[domainName].PathFunctionRunner[moduleId].Results, fullFraction);
+            for (let network of networks) {
+                let networkConfig = network === DEFAULT_NETWORK && fullFraction || { ...fullFraction, network };
+                Querysub.keys(functionSchema()[domainName].PathFunctionRunner[moduleId].Calls, networkConfig);
+                Querysub.keys(functionSchema()[domainName].PathFunctionRunner[moduleId].Results, networkConfig);
+            }
         });
 
         let runningCalls = new Set<string>();
@@ -394,8 +398,8 @@ export class PathFunctionRunner {
                         }
 
                         if (PathFunctionRunner.DEBUG_CALLS) {
-                            // NOTE: If this start, it means that the filter didn't match, which either means it was a dev function and so not relevant for us, or we are dev and it's a production function, so not relevant for us.
-                            //  - The filter is set by fncfilter when running serverside, or, clientside, by fncfilter set on the command line of the querysub server.
+                            // NOTE: If this starts but never runs, it means the call's network didn't match ours, which either means it was a dev call and so not relevant for us, or we are dev and it's a production call, so not relevant for us.
+                            //  - The network is set by --network when running serverside, or, clientside, by --network set on the command line of the querysub server.
                             console.log(`QUEUING ${getDebugName(callData, functionSpec, true)}`);
                             let resultsPath = getProxyPath(() => moduleData.Results[callId]);
                             let history = authorityStorage.getValuePlusHistory(resultsPath);
@@ -551,7 +555,9 @@ export class PathFunctionRunner {
             skipPermissions = PermissionsChecker.skipPermissionsChecks.bind(PermissionsChecker);
         }
 
-        if (!doesMatch(callSpec.filterable, this.config.filterSelector)) {
+        let callNetwork = callSpec.network || DEFAULT_NETWORK;
+        let ourNetworks = this.config.networks && this.config.networks.length > 0 && this.config.networks || [DEFAULT_NETWORK];
+        if (!ourNetworks.includes(callNetwork)) {
             return;
         }
 

package/src/3-path-functions/PathFunctionRunnerMain.ts

@@ -6,7 +6,6 @@ import yargs from "yargs";
 let yargObj = yargs(process.argv)
     .option("fncshard", { type: "string", default: "0-1", desc: "Shard range as start-end (e.g., '0-0.5' or '0.25-0.75')" })
     .option("fncsecshard", { type: "string", default: "", desc: "Secondary shard range as start-end (e.g., '0-0.5'). Values in this range (not matched in fncshard) are delayed." })
-    .option("filter", { type: "string", default: "", desc: `Filter to only include handle specific function calls (fncshard is still applied). For example, "a&b|c", using regular boolean rules.` })
     .argv
     ;
 
@@ -16,9 +15,8 @@ import { SocketFunction } from "socket-function/SocketFunction";
 import { getThreadKeyCert } from "sliftutils/misc/https/certs";
 import { ClientWatcher } from "../1-path-client/pathValueClientWatcher";
 import { timeInMinute } from "socket-function/src/misc";
-import { getDomain, isLocal, isPublic } from "../config";
+import { getDomain, getNetworks, isLocal, isPublic, DEFAULT_NETWORK } from "../config";
 import { green, magenta } from "socket-function/src/formatting/logColors";
-import { parseFilterSelector } from "../misc/filterable";
 import path from "path";
 import { IndexedLogs } from "../diagnostics/logs/IndexedLogs/IndexedLogs";
 
@@ -61,7 +59,7 @@ async function main() {
         console.log(green(`Sharding from ${shardStart} to ${shardEnd}`));
     }
 
-    let filterSelector = parseFilterSelector(yargObj.filter);
+    let networks = getNetworks();
 
     new PathFunctionRunner({
         domainName: getDomain(),
@@ -69,7 +67,7 @@ async function main() {
         secondaryShardRange,
         // TODO: Maybe abstract this out even more, so anything can plug in permissions checks?
         PermissionsChecker: PermissionsCheck,
-        filterSelector,
+        networks,
     });
 
     if (!isPublic()) {
@@ -78,8 +76,8 @@ async function main() {
         await import(deployPath);
     }
 
-    if (yargObj.filter) {
-        console.log(magenta(`Only running functions that match the filter: ${yargObj.filter}. Either use --fncfilter dev in your http server to can calls here, or use ?setfncfilter=${yargObj.filter} in the browser to trigger functions that match this filter.`));
+    if (networks.length !== 1 || networks[0] !== DEFAULT_NETWORK) {
+        console.log(magenta(`Only running functions on the network(s): ${networks.join(", ")}. Use --network ${networks[0]} in your http server to route calls here.`));
     }
 }
 logErrors(main());

package/src/3-path-functions/syncSchema.ts

@@ -579,11 +579,12 @@ export function getCallIdOverride(config: {
     functionId: string;
     callId: string;
     args: unknown[];
+    network?: string;
 }): string {
     try {
         if (querysub) {
             if (!querysub.Querysub.isInSyncedCall()) {
-                // NOTE: This is wrong and it will result in loading user being used as a key sometimes. However, it should be fine, as if the call id override is wrong, it shouldn't break anything. 
+                // NOTE: This is wrong and it will result in loading user being used as a key sometimes. However, it should be fine, as if the call id override is wrong, it shouldn't break anything.
                 return querysub.Querysub.localRead(() => getCallIdOverride(config));
             }
         }
@@ -593,6 +594,7 @@ export function getCallIdOverride(config: {
             remappedPrefix: def.prefix,
             originalKey: config.callId,
             routeKey: def.getKey(...config.args),
+            network: config.network,
         });
     } catch (e: any) {
         console.error(`Error getting call id override for ${config.moduleId}.${config.functionId}, falling back to original call id`, { error: e.stack });

package/src/4-querysub/Querysub.ts

@@ -1096,15 +1096,21 @@ export class Querysub {
          *  BOTH start and end must be provided, otherwise if only one is provided we will ignore it.
          */
         endFraction?: number;
+        /** Only listen to keys on this network. If not specified, only keys on the default network are returned. */
+        network?: string;
     }): (keyof T)[] {
 
-        let { startFraction, endFraction } = config || {};
+        let { startFraction, endFraction, network } = config || {};
         if ((startFraction === undefined) !== (endFraction === undefined)) {
             throw new Error(`startFraction and endFraction must both be provided, or both be undefined. If you want to get all keys, don't provide startFraction and endFraction.`);
         }
         if (!isNode() && startFraction !== undefined && endFraction !== undefined) {
             console.warn(`keys() with a range restriction is not supported clientside. It's too complicated for the proxy to handle it because the hashing depends on the authority server. You can synchronize all the keys client side, but you can't synchronize a restriction of the keys.`);
         }
+        if (network && startFraction === undefined) {
+            startFraction = 0;
+            endFraction = 1;
+        }
         if (startFraction === undefined || endFraction === undefined) {
             return Object.keys(obj);
         }
@@ -1112,10 +1118,15 @@ export class Querysub {
         if (!path) {
             return Object.keys(obj);
         }
-        let packedPath = encodeParentFilter({ path, startFraction, endFraction });
+        let packedPath = encodeParentFilter({ path, startFraction, endFraction, network });
         return proxyWatcher.getKeys(packedPath);
     }
 
+    /** Creates a key that lives on the given network. Reads and writes using the returned key route to authorities on that network (instead of the default network), and it will only be enumerated by Querysub.keys calls that ask for that network. */
+    public static createNetworkKey(config: { key: string; network: string }): string {
+        return createNetworkKey({ originalKey: config.key, network: config.network });
+    }
+
     // TODO: Maybe expose checkPermissions(getValue: () => unknown)?
     //  - It would be easy, if we every need to explicitly check if we have permissions. Although, it seems
     //      like just relying on the automatic checking is better?
@@ -1366,5 +1377,6 @@ import { onAllPredictionsFinished } from "../-0-hooks/hooks";
 import { LOCAL_DOMAIN } from "../0-path-value-core/PathRouter";
 import { authorityLookup } from "../0-path-value-core/AuthorityLookup";
 import { encodeParentFilter } from "../0-path-value-core/hackedPackedPathParentFiltering";
+import { createNetworkKey } from "../0-path-value-core/PathRouterRouteOverride";
 import { AliveChecker, registerAliveChecker } from "../2-proxy/garbageCollection";
 import { QuerysubController, anyPredictionsPending, flushDelayedFunctions, onCallPredict, waitUntilAllPredictionsFinish } from "./QuerysubController";

package/src/4-querysub/QuerysubController.ts

@@ -27,16 +27,16 @@ import { CallerContextBase } from "socket-function/SocketFunctionTypes";
 import { isTrustedByNode } from "../-d-trust/NetworkTrust2";
 import { Querysub, id } from "./Querysub";
 import { isDefined } from "../misc";
-import { getFncFilter, isClient, isServer } from "../config2";
+import { isClient, isServer } from "../config2";
 import { PromiseObj } from "../promise";
 import { LoggingClient } from "../0-path-value-core/LoggingClient";
 import * as prediction from "./querysubPrediction";
 setFlag(require, "preact", "allowclient", true);
 
 import yargs from "yargs";
-import { mergeFilterables, parseFilterable, serializeFilterable } from "../misc/filterable";
+import { setRoutingOverrideKeyNetwork } from "../0-path-value-core/PathRouterRouteOverride";
 import { isManagementUser, onAllPredictionsFinished } from "../-0-hooks/hooks";
-import { getDomain, isBootstrapOnly } from "../config";
+import { getDomain, getPrimaryNetwork, isBootstrapOnly, DEFAULT_NETWORK } from "../config";
 import { flushPredictionQueueBase, runInPredictionQueue, syncHasPendingPredictionsBase } from "./predictionQueue";
 import { PathRouter } from "../0-path-value-core/PathRouter";
 import { authorityLookup } from "../0-path-value-core/AuthorityLookup";
@@ -551,10 +551,17 @@ export class QuerysubControllerBase {
         let callerCreatorId = IdentityController_getPubKeyShort(caller);
         call.callerIP = IdentityController_getSecureIP(caller);
 
-        if (call.filterable && !await isManagementUser()) {
-            throw new Error(`Caller is not a management user, and so does not have permissions to set filterable on calls. Call ${debugCallSpec(call)}, filter was "${serializeFilterable(call.filterable)}"`);
+        if (call.network && call.network !== DEFAULT_NETWORK && !await isManagementUser()) {
+            throw new Error(`Caller is not a management user, and so does not have permissions to set the network on calls. Call ${debugCallSpec(call)}, network was "${call.network}"`);
+        }
+        // Clients don't know their network, so we decide it for them, rewriting the callId so the call routes to (and is picked up by) the right network.
+        if (!call.network) {
+            let network = getPrimaryNetwork();
+            if (network !== DEFAULT_NETWORK) {
+                call.network = network;
+                call.CallId = setRoutingOverrideKeyNetwork(call.CallId, network);
+            }
         }
-        call.filterable = mergeFilterables([getFncFilter(), call.filterable]);
 
         if (Querysub.SIMULATE_LAG) {
             await delay(Querysub.SIMULATE_LAG * 2);

package/src/config.ts

@@ -5,6 +5,7 @@ import { MaybePromise } from "socket-function/src/types";
 import { parseArgsFactory } from "./misc/rawParams";
 import { lazy } from "socket-function/src/caching";
 import fs from "fs";
+import os from "os";
 import { SocketFunction } from "socket-function/SocketFunction";
 
 export const serverPort = 11748;
@@ -32,7 +33,8 @@ let yargObj = parseArgsFactory()
     })
     .option("logbackblaze", { type: "boolean", desc: "Log all backblaze activity to disk." })
     .option("slowdown", { type: "number", desc: "Delay all input data values by this amount of time, pretending like we didn't even receive it until this time is up." })
-    .option("fncfilter", { type: "string", default: "", desc: `Sets the filterable state for function calls, causing them to target specific FunctionRunners. If no FunctionRunner matches, all functions will fail to run. For example: "devtestserver" will match a FunctionRunner that uses the "devtestserver" filter. Merges with the existing filterable state if a client sets it explicitly.` })
+    .option("network", { type: "array", desc: `The networks this node is on (pass multiple arguments to be on multiple, ex: --network test --network default). Authorities only satisfy paths on their networks ("default" if unset). Function calls are put on the first network in the list. If no FunctionRunner is on a call's network, the call will fail to run.` })
+    .option("networkfile", { type: "string", desc: `The same as --network, except the networks are read from the given file (one per line). Supports "~/" for the home directory. If the file doesn't exist, the process exits with an error.` })
     .argv
     ;
 
@@ -42,8 +44,42 @@ if (isNode()) {
     }
 }
 
-export function getRawFncFilter() {
-    return yargObj.fncfilter;
+export const DEFAULT_NETWORK = "default";
+
+export function expandHomePath(path: string): string {
+    if (path === "~" || path.startsWith("~/") || path.startsWith("~\\")) {
+        return os.homedir() + path.slice(1);
+    }
+    return path;
+}
+
+let networkFileNetworks = lazy((): string[] => {
+    if (!yargObj.networkfile) return [];
+    let path = expandHomePath(String(yargObj.networkfile));
+    if (!fs.existsSync(path)) {
+        console.error(`--networkfile file not found: ${path}`);
+        process.exit(1);
+    }
+    return fs.readFileSync(path, "utf8").split("\n").map(x => x.trim()).filter(x => x);
+});
+
+export function getNetworks(): string[] {
+    let networks = yargObj.network;
+    if (!networks) {
+        networks = [];
+    } else if (!Array.isArray(networks)) {
+        networks = [networks];
+    }
+    let result = networks.map(x => String(x));
+    if (isNode()) {
+        result = [...result, ...networkFileNetworks()];
+    }
+    result = Array.from(new Set(result));
+    if (result.length === 0) return [DEFAULT_NETWORK];
+    return result;
+}
+export function getPrimaryNetwork(): string {
+    return getNetworks()[0];
 }
 
 type QuerysubConfig = {

package/src/config2.ts

@@ -1,12 +1,10 @@
 import { deepCloneJSON, isNode } from "socket-function/src/misc";
 import { hasArchivesPermissions } from "./-a-archives/archives";
-import { baseIsClient, getDomain, getRawFncFilter } from "./config";
+import { baseIsClient, getDomain } from "./config";
 import { JSONLACKS } from "socket-function/src/JSONLACKS/JSONLACKS";
 import { rootPathStr, prependToPathStr, getPathDepth } from "./path";
 import fs from "fs";
 import { AuthoritySpec } from "./0-path-value-core/PathRouter";
-import { parseFilterable } from "./misc/filterable";
-import { lazy } from "socket-function/src/caching";
 
 export function isClient() {
     return baseIsClient();
@@ -24,8 +22,4 @@ export function evaluateValidStates() {
     return isServer();
 }
 
-// NOTE: getOurAuthorities moved to PathRouterHashOverrides, and renamed to getOurAuthoritySpec
-
-
-
-export const getFncFilter = lazy(() => parseFilterable(getRawFncFilter() || ""));
+// NOTE: getOurAuthorities moved to PathRouterHashOverrides, and renamed to getOurAuthoritySpec

package/src/diagnostics/logs/errorTickets/TicketPage.tsx

@@ -7,6 +7,7 @@ import { nextId, sort } from "socket-function/src/misc";
 import { formatDateTime, formatTime } from "socket-function/src/formatting/format";
 import { Querysub } from "../../../4-querysub/Querysub";
 import { URLParam } from "../../../library-components/URLParam";
+import { mainResets } from "../../../library-components/urlResetGroups";
 import { ATag } from "../../../library-components/ATag";
 import { Button } from "../../../library-components/Button";
 import { InputLabel } from "../../../library-components/InputLabel";
@@ -16,8 +17,8 @@ import { TicketsController, watchTickets } from "./tickets";
 import { isTicketFinished, Ticket, TicketComment, TicketPatchFile, TicketState, TICKET_STATES } from "./ticketTypes";
 
 export const ticketIdURL = new URLParam("ticketid", "");
-// "unfinished" hides tickets in a final state (fixed / not-a-bug).
-export const ticketFilterURL = new URLParam("ticketfilter", "");
+// "unfinished" hides tickets in a final state (fixed / not-a-bug). Resets when the page changes, so the filter doesn't confusingly stick around.
+export const ticketFilterURL = new URLParam("ticketfilter", "", { reset: [mainResets] });
 
 const TITLE_MAX_LENGTH = 200;
 const COMMENT_TEXTAREA_MIN_HEIGHT = 250;
@@ -205,7 +206,7 @@ class TicketList extends qreact.Component {
         return <div className={css.vbox(16).pad2(16).fillBoth.minHeight(0)}>
             <div className={css.hbox(16)}>
                 <h2>Tickets ({sorted.length}{showUnfinishedOnly && " unfinished" || ""})</h2>
-                <ATag values={[ticketFilterURL.getOverride(showUnfinishedOnly && "" || "unfinished")]}>
+                <ATag values={[ticketFilterURL.getOverride(showUnfinishedOnly ? "" : "unfinished")]}>
                     {showUnfinishedOnly && "Show All" || "Show Unfinished Only"}
                 </ATag>
                 <Button

package/src/diagnostics/managementPages.tsx

@@ -112,7 +112,7 @@ export async function registerManagementPages2(config: {
         getModule: () => import("./misc-pages/SnapshotViewer"),
     });
     inputPages.push({
-        title: "Authority Specs",
+        title: "Routing Table",
         componentName: "AuthoritySpecPage",
         controllerName: "AuthoritySpecPageController",
         getModule: () => import("./misc-pages/AuthoritySpecPage"),