anchor.diff:      });
     }
   
  -  /// Determines [lockfile] agrees with the given [packagePathsMapping].
  +  /// Determines [lockFile] agrees with the given [packagePathsMapping].
     ///
     /// The [packagePathsMapping] is a mapping from package names to paths where
     /// the packages are located. (The library is located under
     /// `lib/` relative to the path given).
     bool _isPackagePathsMappingUpToDateWithLockfile(
  -          Map<String, String> packagePathsMapping) =>
  -      lockFile.packages.values.every((lockFileId) {
  -        // It's very unlikely that the lockfile is invalid here, but it's not
  -        // impossible—for example, the user may have a very old application
  -        // package with a checked-in lockfile that's newer than the pubspec, but
  -        // that contains SDK dependencies.
  -        if (lockFileId.source is UnknownSource) return false;
  -
  -        final packagePath = packagePathsMapping[lockFileId.name];
  -        if (packagePath == null) {
  -          return false;
  -        }
  -
  -        final source = cache.source(lockFileId.source);
  -        final lockFilePackagePath =
  -            p.join(root.dir, source.getDirectory(lockFileId));
  -
  -        // Make sure that the packagePath agrees with the lock file about the
  -        // path to the package.
  -        if (p.normalize(packagePath) != p.normalize(lockFilePackagePath)) {
  -          return false;
  -        }
  -
  -        // For cached sources, make sure the directory exists and looks like a
  -        // package. This is also done by [_arePackagesAvailable] but that may not
  -        // be run if the lockfile is newer than the pubspec.
  -        if (source is CachedSource && !dirExists(lockFilePackagePath) ||
  -            !fileExists(p.join(lockFilePackagePath, 'pubspec.yaml'))) {
  -          return false;
  -        }
  -
  -        return true;
  -      });
  +    Map<String, String> packagePathsMapping,
  +  ) {
  +    // Check that [packagePathsMapping] does not contain more packages than what
  +    // is required. This could lead to import statements working, when they are
  +    // not supposed to work.
  +    final hasExtraMappings = packagePathsMapping.keys.every((packageName) {
  +      return packageName == root.name ||
  +          lockFile.packages.containsKey(packageName);
  +    });
  +    if (!hasExtraMappings) {
  +      return false;
  +    }
  +
  +    // Check that all packages in the [lockFile] are reflected in the
  +    // [packagePathsMapping].
  +    return lockFile.packages.values.every((lockFileId) {
  +      // It's very unlikely that the lockfile is invalid here, but it's not
  +      // impossible—for example, the user may have a very old application
  +      // package with a checked-in lockfile that's newer than the pubspec, but
  +      // that contains SDK dependencies.
  +      if (lockFileId.source is UnknownSource) return false;
  +
  +      final packagePath = packagePathsMapping[lockFileId.name];
  +      if (packagePath == null) {
  +        return false;
  +      }
  +
  +      final source = cache.source(lockFileId.source);
  +      final lockFilePackagePath =
  +          p.join(root.dir, source.getDirectory(lockFileId));
  +
  +      // Make sure that the packagePath agrees with the lock file about the
  +      // path to the package.
  +      if (p.normalize(packagePath) != p.normalize(lockFilePackagePath)) {
  +        return false;
  +      }
  +
  +      // For cached sources, make sure the directory exists and looks like a
  +      // package. This is also done by [_arePackagesAvailable] but that may not
  +      // be run if the lockfile is newer than the pubspec.
  +      if (source is CachedSource && !dirExists(lockFilePackagePath) ||
  +          !fileExists(p.join(lockFilePackagePath, 'pubspec.yaml'))) {
  +        return false;
  +      }
  +
  +      return true;
  +    });
  +  }
   
     /// Checks whether or not the `.packages` file is out of date with respect
     /// to the [lockfile].
  
positive.code: 
      var touchedLockFile = false;
      if (lockFileModified.isBefore(pubspecModified) || hasPathDependencies) {
        _assertLockFileUpToDate();
        if (_arePackagesAvailable()) {
          touchedLockFile = true;
  
negative.code:     } on FormatException {
        badPackageConfig();
      }
  
      // Version 2 is the initial version number for `package_config.json`,
      // because `.packages` was version 1 (even if it was a different file).
      // If the version is different from 2, then it must be a newer incompatible
      // version, hence, the user should run `pub get` with the downgraded SDK.
      if (cfg.configVersion != 2) {
        badPackageConfig();
      }
  
  