Unfortunately, the packrat code that handles this is not yet exposed, but you can see what packrat does here (the code is unfortunately not nearly as clear as it could be):
The general idea, though, is given a package name + version, you want to:
1. First check if the package is 'current'; this can usually be checked by comparing the relevant values in the output of `available.packages()`,
2. If that doesn't work, try constructing an appropriate URL to the CRAN archives, and downloading from that location.
Also note complications re: downloading package binaries vs. package sources; you might need to ensure that the 'pkgType' option is set to 'source' if you want sources (e.g. for the 'available.packages()' output).