--- a/.hgignore	Sat Mar 14 22:34:35 2015 +0000
+++ b/.hgignore	Sat Mar 14 22:37:07 2015 +0000
@@ -1,2 +1,2 @@
-private
-modules/python/.git
+^private
+^modules/python/.git

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/modules/private/manifests	Sat Mar 14 22:37:07 2015 +0000
@@ -0,0 +1,1 @@
+../../private/manifests/
\ No newline at end of file

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/modules/private/templates/apache	Sat Mar 14 22:37:07 2015 +0000
@@ -0,0 +1,1 @@
+../../../private/apache/templates
\ No newline at end of file

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/modules/stdlib/lib/puppet/parser/functions/private.rb	Sat Mar 14 22:37:07 2015 +0000
@@ -0,0 +1,29 @@
+#
+# private.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:private, :doc => <<-'EOS'
+    Sets the current class or definition as private.
+    Calling the class or definition from outside the current module will fail.
+    EOS
+  ) do |args|
+
+    raise(Puppet::ParseError, "private(): Wrong number of arguments "+
+      "given (#{args.size}}) for 0 or 1)") if args.size > 1
+
+    scope = self
+    if scope.lookupvar('module_name') != scope.lookupvar('caller_module_name')
+      message = nil
+      if args[0] and args[0].is_a? String
+        message = args[0]
+      else
+        manifest_name = scope.source.name
+        manifest_type = scope.source.type
+        message = (manifest_type.to_s == 'hostclass') ? 'Class' : 'Definition'
+        message += " #{manifest_name} is private"
+      end
+      raise(Puppet::ParseError, message)
+    end
+  end
+end

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/modules/stdlib/spec/functions/private_spec.rb	Sat Mar 14 22:37:07 2015 +0000
@@ -0,0 +1,55 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:private) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  subject do
+    function_name = Puppet::Parser::Functions.function(:private)
+    scope.method(function_name)
+  end
+
+  context "when called from inside module" do
+    it "should not fail" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('foo')
+      expect {
+        subject.call []
+      }.not_to raise_error
+    end
+  end
+
+  context "with an explicit failure message" do
+    it "prints the failure message on error" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('bar')
+      expect {
+        subject.call ['failure message!']
+      }.to raise_error Puppet::ParseError, /failure message!/
+    end
+  end
+
+  context "when called from private class" do
+    it "should fail with a class error message" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('bar')
+      scope.source.expects(:name).returns('foo::baz')
+      scope.source.expects(:type).returns('hostclass')
+      expect {
+        subject.call []
+      }.to raise_error Puppet::ParseError, /Class foo::baz is private/
+    end
+  end
+
+  context "when called from private definition" do
+    it "should fail with a class error message" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('bar')
+      scope.source.expects(:name).returns('foo::baz')
+      scope.source.expects(:type).returns('definition')
+      expect {
+        subject.call []
+      }.to raise_error Puppet::ParseError, /Definition foo::baz is private/
+    end
+  end
+end