assertPackagePolicy = (allegedPackagePolicy, path, url) => {
  if (allegedPackagePolicy === undefined) {
    return;
  }
  const inUrl = url ? ` in ${q(url)}` : '';

  const packagePolicy = Object(allegedPackagePolicy);
  assert(
    allegedPackagePolicy === packagePolicy && !isArray(allegedPackagePolicy),
    `${path} must be an object, got ${q(allegedPackagePolicy)}${inUrl}`,
  );
  const {
    packages,
    builtins,
    globals,
    noGlobalFreeze,
    defaultAttenuator: _ignore, // a carve out for the default attenuator in compartment map
    // eslint-disable-next-line no-unused-vars
    options, // any extra options
    ...extra
  } = /** @type {SomePackagePolicy} */ (packagePolicy);

  assert(
    keys(extra).length === 0,
    `${path} must not have extra properties, got ${q(keys(extra))}${inUrl}`,
  );

  assert(
    noGlobalFreeze === undefined || typeof noGlobalFreeze === 'boolean',
    `${path}.noGlobalFreeze must be a boolean, got ${q({
      noGlobalFreeze,
    })}${inUrl}`,
  );

  isPolicyItem(packages) ||
    assert.fail(
      `${path}.packages must be a record of booleans, got ${q({
        packages,
      })}${inUrl}`,
    );

  isPolicyItem(globals) ||
    isAttenuationDefinition(globals) ||
    assert.fail(
      `${path}.globals must be a record of booleans or a single attenuation, got ${q(
        {
          globals,
        },
      )}${inUrl}`,
    );

  isPolicyItem(builtins) ||
    isRecordOf(builtins, predicateOr(isBoolean, isAttenuationDefinition)) ||
    assert.fail(
      `${path}.builtins must be a record of booleans or attenuations, got ${q({
        builtins,
      })}${inUrl}`,
    );
}
This asserts (i.e., throws) that `allegedPackagePolicy` is a valid `PackagePolicy`.

Mild-mannered during the day, but fights crime at night as a type guard.

@param {unknown} allegedPackagePolicy - Alleged `PackagePolicy` to test
@param {string} path - Path in the `Policy` object; used for error messages only
@param {string} [url] - URL of the policy file; used for error messages only
@returns {asserts allegedPackagePolicy is SomePackagePolicy|undefined}