# hashavatar 0.12.0

`0.12.0` expands the built-in avatar catalog while keeping `hashavatar` as a
single, asset-free image-generation crate.

## Added

- Added raster and SVG renderers for eight new `AvatarKind` values:
  - `bear`
  - `penguin`
  - `dragon`
  - `ninja`
  - `astronaut`
  - `diamond`
  - `coffee-cup`
  - `shield`
- Added face-layer anchors for the new face families: `bear`, `penguin`,
  `dragon`, `ninja`, and `astronaut`.
- Added golden visual fingerprints for every new family.
- Updated README option catalogs and examples for the expanded family list.

## Compatibility Notes

- Explicit `AvatarOptions` selections remain deterministic for the selected
  kind, background, dimensions, seed, namespace, crate identity hash mode, and
  identity.
- Automatic style derivation uses `AvatarKind::ALL`, so adding new family
  variants changes the automatic family distribution. Services that need old
  automatic output should keep their existing namespace `style_version` until
  they intentionally migrate.
- `AvatarIdentity::seed()` and `AvatarIdentity::as_digest()` are removed from
  the public API, and the internal 256-bit RNG seed helper is private.
  Rendering callers should not handle raw identity digest bytes.
- `docs/SECURITY_CONTROLS.md` now states that identity preimage allocation does
  not hide input length at the allocator level. High-assurance callers should
  pad or normalize sensitive identifiers before passing them to the crate.
- `AvatarSpec::default()` is documented and tested as a fixed deterministic
  `256x256` seed-`1` convenience spec, not as a random or production policy
  default.
- SVG rendering no longer uses ad-hoc `String::replace` minification. The test
  suite and fuzz harness now parse generated SVG with `roxmltree` to verify
  XML well-formedness across families, layers, and representative identities.
- `AvatarRenderResourceBudget` and `AvatarSpec::render_resource_budget(...)`
  make raw RGBA memory estimates explicit for service-level render concurrency
  limits without adding an async runtime or semaphore dependency to the crate.
- Polygon scanline interpolation now widens coordinate deltas before rounding,
  and the fuzz harness includes a dedicated polygon rasterizer target for
  degenerate, negative-coordinate, and extreme-point inputs.
- Runtime identity hash algorithm selection has been removed. The crate uses
  SHA-512 by default, BLAKE3 when built with `blake3`, and XXH3-128 when built
  with `xxh3`. The `blake3` and `xxh3` features are mutually exclusive, and
  XXH3-128 remains documented as non-cryptographic and unsuitable for
  adversarial, user-controlled, or sensitive identifiers.
- `AvatarIdentity` debug formatting is now redacted, preventing accidental
  `{:?}` logging from exposing the raw 64-byte identity digest.
- `AvatarIdentity` rustdoc and security controls now state that clones are
  zeroized independently on drop, and that high-assurance callers should keep
  clone lifetimes short to avoid unnecessary live digest copies.
- SHA-512 is built with upstream `zeroize` support so its block buffer uses
  `ZeroizeOnDrop`. BLAKE3 is built with upstream `zeroize` support, and the
  BLAKE3 hasher plus XOF reader are explicitly zeroized after digest
  derivation.
- Digest-derived renderer RNG seed copies are now wrapped in
  `zeroize::Zeroizing`, so the temporary mixed seed is scrubbed immediately
  after RNG initialization. The security controls also document `StdRng`'s
  non-zeroized expanded internal state as a known residual.
- Owned RGBA encode buffers and JPEG RGB flattening buffers now use RAII
  zeroization guards, so temporary pixel data is scrubbed during normal
  returns, encoder errors, and unwinding panics.
- Polygon rasterization now returns immediately for zero-width or zero-height
  images, keeping the fuzz-only polygon harness from reporting artificial
  zero-sized-image crashes.
- PNG, JPEG, and GIF output are now behind explicit `png`, `jpeg`, and `gif`
  Cargo features, leaving WebP as the only default raster encoder. The
  `AvatarOutputFormat::Gif` rustdoc and security controls call out that the
  `image` crate's internal GIF quantization buffers are not zeroized by
  `hashavatar`, so high-assurance deployments should prefer WebP or PNG.
- Rectangle intersection size calculation now uses saturating arithmetic for
  extreme internal coordinate ranges.
- The hidden `fuzzing` feature now has a compile-time guard that rejects
  ordinary non-fuzzing release builds, reducing the chance that internal fuzz
  harness entry points are accidentally exposed in production.
- `diamond`, `coffee-cup`, and `shield` are object/symbol families. They do
  not have face anchors, so accessories and expressions are deterministic
  no-ops for those families. Accent palettes and frame shapes still apply.

## Deferred

- Pattern, gradient, and environment backgrounds were not admitted in this
  release. They need their own bounded raster/SVG texture path and visual
  contrast review before becoming public API.
