I think the package validation should better be removed there, and instead moved to the Psr4 "plugin" addPackage() method. Which already has some validation.