move validators into their own package

also hides the visitor in internal classes to have a cleaner public interface.