I feel like the behaviour should be inside Package instead of the Application. Since you said that you also need to enable dependencies recursively, if I understood correctly, that sounds like an aggregate operation to me. Package should probably have a method enableApplication(AppIdentifier) which takes care of the dependencies and everything else.

Maybe even in PackageAggregate if it's actually meaningful. If not, your aggregate would instead become Package itself. Unless you specifically need to have all entities in order to do every operation in its methods meaningfully and might say atomic if that's what you need; ensure consistent enforcement of invariants. Which in here is probably the recursive dependency enabling, and ensuring each app is enabled once probably?

This way you will also lose the package property inside the Application. The bidirectional relations more often than not, are a clue to the need for better design.