We restrict it in PackageService when we validate package metadata during package upload. We don't yet enforce it in the database schema.