There are four different values for a function's access attribute in ColdFusion: public, private, package, and remote.

Quick note - you'll see references to the terms "method" and "function" in this article. A method is simply a function, but in an Object-oriented Programming context. In other words, a function outside a component is a function and a function inside a component can be referred to as a method. Don't get too hung up on one term being more or less correct. CFML developers should know what you mean either way.

The Adobe documentation portal for cffunction describes "package" access like this:

available only to the component that declares the method, components that extend the component, or any other components in the package. Methods are available to the CFC pages in the same package.

Let's break that down a bit...

available only to the component that declares the method

OK, fair enough. If a component defines a method, it should also be able to call it. I'm with you so far, Adobe.

components that extend the component

Again, this makes sense. If you're using an inherited component, you'd want to be able to call the method from its parent. Methods marked as "private" function in the same way, by the way. Everything's on the up-and-up to this point.

or any other components in the package

Now you've lost me.

What is a "package", exactly?

Let me preface everything you're about to read with the following statement: I'm not really sure what this means. It's not documented anywhere and I can find very little discussion about this topic.

As best I can tell, all components in a directory are in the same package. Consider the following scenario:

Here we have two components in the same package: com.services.Image and com.services.Text. We have a third component that's not in the same package: com.MyComponent. This means that Image could call a package method on Text (and vice versa), but MyComponent cannot call a package method on either Image or Text.

Package vs Private Methods

The only documented difference between package and private methods is that package methods can be called from other components in the same package, whereas private methods cannot be called in that way. A private method can only be called from the same component where it's defined as well as any components extending from the component where the method is defined.

Notice I said "documented" above. Another difference that I've found in practical use is that private methods cannot be called using the this reference, i.e. this.doSomethingPrivate(). If you try that on a private method, you'll get an error. If you try that on a package method, it works. This is why I've always used package methods instead of private methods: I prefer the explicit knowledge of where the method is declared. I never have to worry if my method is built-in or if it's user-defined, nor does anyone else reading my code.

Now that I know that "package" isn't exactly the same as "private", I may have to revisit my decision to use "package" access for what I thought were actually private methods.