Java modules: distinguish exported APIs from open packages

Last updated: 5 Oct 20265 min read

tutorial

A named module's exported package supports access to public API types; an open package permits deeper reflection to another module. Module inspection exposes these separate conditions.

Operational contract

The helper reports whether the provider module exports or opens its class package to a consumer module, and whether the consumer reads the provider. These checks describe module relationships, not whether a particular private member may be invoked; member accessibility, caller context, and lookup mode still matter. Unnamed modules report broad export/open behavior. For a named plugin, declaring exports is not a substitute for opens when a framework needs deep reflection. Code should prefer a public interface if possible and validate module setup at startup.

Failure case

A public receipt interface remains callable after a plugin removes opens. A serializer that reads private fields can fail. The report shows that exported and opened are separate deployment decisions.

Java code

import java.util.Objects;

public class PluginModuleVisibility {
    public record Access(boolean consumerReadsProvider,
                         boolean packageExported, boolean packageOpen) { }

    public static Access inspect(Class<?> providerType, Module consumer) {
        Objects.requireNonNull(providerType);
        Objects.requireNonNull(consumer);
        Module provider = providerType.getModule();
        String packageName = providerType.getPackageName();
        return new Access(consumer.canRead(provider),
                provider.isExported(packageName, consumer),
                provider.isOpen(packageName, consumer));
    }
}

Performance and ownership cost

The inspection uses O(1) application data and small module-graph lookups. It is a configuration check, not a performance path; run it when a plugin is registered rather than for each receipt.

Common Mistakes

Do not treat exports as permission for private-member reflection.
Do not ignore the consumer's readability relationship.
Do not interpret a package-level report as proof a particular Method or Field is accessible.

Connected lessons

java

module boundaries

module-exports-vs-opens-check