move validators into their own package

also hides the visitor in internal classes to have a cleaner
public interface.