fix(view): inline Semantic UI icon font so dev page icons render (#2563)

* fix(view): inline Semantic UI icon font so dev page icons render

The framework dev pages (/wheels/guides, /wheels/info, /wheels/migrator,
/wheels/packages, etc.) inline semantic.min.css into a <style> block.
Its @font-face declarations point at relative URLs like
themes/default/assets/fonts/icons.woff2, which resolve against the
page URL (e.g. /wheels/guides) — there is no static route to serve
them, so every <i class="...icon"> rendered as an empty bordered box.

Read icons.woff2 once at application scope, base64-encode it, and
emit a data-URI @font-face override after the inlined Semantic CSS.
Later @font-face for the same font-family wins in the CSS cascade,
so this overrides the broken declarations without modifying
semantic.min.css. Added in both _header.cfm and _header_simple.cfm
(the latter is used by error pages and may render before any
"full" page has visited).

Closes #2421.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(view): address Reviewer A/B consensus findings (round 1)

- Wrap icon-font init in double-checked cflock on both _header.cfm and
  _header_simple.cfm. Build the data URI into a local variable inside
  an exclusive lock and assign to application scope only once,
  eliminating the intermediate empty-string state that let a concurrent
  request read "" and skip the @font-face block. Mirrors the pattern
  in BrowserTest.cfc::$ensureLauncher.
- Add CHANGELOG [Unreleased] ### Fixed entry referencing #2563.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>

Author: 3 people

CHANGELOG.md

@@ -152,6 +152,7 @@ All historical references to "CFWheels" in this changelog have been preserved fo
 
 ### Fixed
 
+- Framework dev pages (`/wheels/guides`, `/wheels/info`, `/wheels/migrator`, `/wheels/packages`, error screens) now render Semantic UI icons instead of empty bordered squares. The dev layouts inline `semantic.min.css` into a `<style>` block, so its relative URLs to `themes/default/assets/fonts/icons.woff2` resolved against the page URL and 404'd — every `<i class="...icon">` rendered as the fallback square. `_header.cfm` and `_header_simple.cfm` now read the woff2 once at application scope, base64-encode it, and emit a `@font-face` override after the inlined Semantic CSS. Initialization uses double-checked locking on `application.wheels.iconsFontDataUri` so concurrent first-requests can't read an intermediate empty value. (#2563)
 - Debug bar Tools → Packages page now lists packages available from the `wheels-dev/wheels-packages` registry in fresh apps generated with `wheels new`. The previous gate (`FileExists("/cli/lucli/services/packages/Registry.cfc")`) silently returned an empty list because user apps don't ship the CLI alongside the framework. The registry reader now lives at `vendor/wheels/services/packages/{Registry,HttpClient,ManifestCache}.cfc` and ships with every generated app. The registry list stays scoped to the standalone Tools → Packages page; the inline debug-bar Environment panel shows installed packages only, so the bar stays compact and doesn't trigger a registry walk on every dev-mode page load. (#2530)
 - `Registry.fetchManifest()` now validates that a manifest contains a non-empty `versions` array before returning, throwing `Wheels.Packages.RegistryMalformed` instead of letting a downstream `local.m.versions[ArrayLen(...)]` access crash with an unhandled `Expression` error. The per-package skip-on-malformed catch in `listAll()` now actually catches every malformed shape, so the Tools → Packages page degrades gracefully when the registry serves a partial manifest. Mirrored into the CLI's `cli/lucli/services/packages/Registry.cfc` to keep both copies in sync. (#2530)
 - Snapshot pre-releases on `develop` now publish the full artifact set (`wheels-core-*.zip`, `wheels-base-template-*.zip`, `wheels-cli-*.zip`, `wheels-starter-app-*.zip`) alongside `wheels-module-*`. Previously only the module tarball was attached, which broke Homebrew/Chocolatey distributions that depend on fetching `wheels-core-*.zip` as a companion artifact: users scaffolded a new app and hit "Could not locate the Wheels framework source" at chapter 1 of the tutorial. Snapshots now mirror the main-branch release contents exactly, flagged as pre-release.

vendor/wheels/public/layout/_header.cfm

@@ -7,6 +7,37 @@ if (!IsDefined("pageHeader")) {
 // Css Path
 request.wheelsInternalAssetPath = application.wheels.webpath & "wheels/public/assets";
 
+// Inline the Semantic UI icon font as a data URI. The framework's dev pages
+// inline semantic.min.css into a <style> block, so its relative URLs to
+// `themes/default/assets/fonts/icons.woff2` resolve against the page URL
+// (e.g. /wheels/guides) and 404 — every <i class="...icon"> renders as an
+// empty box. Cached at application scope; falls back silently if the font
+// can't be read. See issue ##2421.
+// Wrapped in cflock to guard the check-then-act on application scope
+// against parallel first-request initialization. Without the lock a
+// second thread that wins the StructKeyExists race after the first
+// thread's initial assignment but before its file-read completes
+// reads an empty data URI and skips the @font-face block — the exact
+// symptom this PR is fixing. Same double-checked locking pattern as
+// BrowserTest.cfc::$ensureLauncher(). The value is built into a
+// local variable and assigned to application scope only once, so
+// readers never see an intermediate empty-string state.
+if (!StructKeyExists(application.wheels, "iconsFontDataUri")) {
+	lock name="wheelsIconsFontInit" type="exclusive" timeout="10" {
+		if (!StructKeyExists(application.wheels, "iconsFontDataUri")) {
+			local.iconsFontPath = ExpandPath("/wheels/public/assets/css/woff_files/icons.woff2");
+			local.dataUri = "";
+			if (FileExists(local.iconsFontPath)) {
+				try {
+					local.dataUri = "data:font/woff2;base64," & ToBase64(FileReadBinary(local.iconsFontPath));
+				} catch (any e) {
+				}
+			}
+			application.wheels.iconsFontDataUri = local.dataUri;
+		}
+	}
+}
+
 // Opt the request into the dev debug bar emitted at onrequestend.
 // Public.cfc handlers <cfinclude> these views directly (bypassing
 // renderView, which is what normally flips this flag), so without this
@@ -125,6 +156,15 @@ if (StructKeyExists(url, "refresh")) {
 		<style>
 			<cfinclude template="/wheels/public/assets/css/semantic.min.css">
 			<cfinclude template="/wheels/public/assets/css/highlight_default.min.css">
+			<cfif Len(application.wheels.iconsFontDataUri)>
+			@font-face {
+				font-family: 'Icons';
+				src: url("#application.wheels.iconsFontDataUri#") format('woff2');
+				font-weight: normal;
+				font-style: normal;
+				font-display: block;
+			}
+			</cfif>
 			.h-100 {height:100%;}
 			.forcescroll { overflow-y: scroll; max-height: 40rem; }
 			.margin-top { margin-top: 5em; }

vendor/wheels/public/layout/_header_simple.cfm

@@ -10,6 +10,26 @@ Static simple version of the header/navigation for output on error screens
 if (StructKeyExists(request, "wheels") && IsStruct(request.wheels)) {
 	request.wheels.showDebugInformation = true;
 }
+
+// Inline icon font (see _header.cfm and issue ##2421). Duplicated here
+// because error pages can render before _header.cfm has been visited.
+// Double-checked locking matches _header.cfm — see comment there for
+// the TOCTOU rationale.
+if (!StructKeyExists(application.wheels, "iconsFontDataUri")) {
+	lock name="wheelsIconsFontInit" type="exclusive" timeout="10" {
+		if (!StructKeyExists(application.wheels, "iconsFontDataUri")) {
+			local.iconsFontPath = ExpandPath("/wheels/public/assets/css/woff_files/icons.woff2");
+			local.dataUri = "";
+			if (FileExists(local.iconsFontPath)) {
+				try {
+					local.dataUri = "data:font/woff2;base64," & ToBase64(FileReadBinary(local.iconsFontPath));
+				} catch (any e) {
+				}
+			}
+			application.wheels.iconsFontDataUri = local.dataUri;
+		}
+	}
+}
 </cfscript>
 <cfoutput>
 <!--- cfformat-ignore-start --->
@@ -21,6 +41,15 @@ if (StructKeyExists(request, "wheels") && IsStruct(request.wheels)) {
 	<meta name="robots" content="noindex,nofollow">
 	<style>
 		<cfinclude template="/wheels/public/assets/css/semantic.min.css">
+		<cfif Len(application.wheels.iconsFontDataUri)>
+		@font-face {
+			font-family: 'Icons';
+			src: url("#application.wheels.iconsFontDataUri#") format('woff2');
+			font-weight: normal;
+			font-style: normal;
+			font-display: block;
+		}
+		</cfif>
 		/* ===== Wheels Dark Error Theme ===== */
 		:root {
 			--w-bg-base: ##1e1e2e;