It looks like when Shiny internally calls createWebDependency, it (first calls htmltools::resolveDependencies)[https://github.com/rstudio/shiny/blob/master/R/html-deps.R#L46-L49], which turns the relative paths into absolute ones. That's why these dependencies work with Shiny, but not with leaflet. I think it's actually incorrect for leaflet (or anyone) to pass unresolved dependencies to createWebDependency; it means, for one thing, there could be multiple copies of i.e. name="bootstrap" and the last one would win (rather than the one with the highest version number).

That's a real sucky API though...

Maybe resolveDependencies should add a class to each dependency object, and createWebDependency should warn if the objects it gets aren't marked with the class?

Maybe resolveDependencies should add a class to each dependency object, and createWebDependency should warn if the objects it gets aren't marked with the class?

This doesn't seem quite right either. You could still end up in a situation where you have manually combined 2 (or more) lists of the same resolved dependencies, which should "un-resolve" them, but there's no way for us to detect or prevent that from happening. If we're really concerned about duplicated dependencies, maybe createWebDependency() could look for likely suspects in .globals$resources?

pattern <- paste0("^", dependency$name, "-")
if (grepl(pattern, names(.globals$resources))) {
  warning("HTML dependency ", dependency$name, " has likely already been registered as a web resource.")
}