fix: align UTF-8 decoding across payload utilities

docs/CHECKLIST.md

@@ -276,3 +276,5 @@ Race-detector execution is intentionally excluded because CGO must remain disabl
 - [x] REL-PUBLIC: Publish all 27 maintained public modules as v0.1.0 from merged preparation PR #16 at immutable SHA 34fcc751355a2b29bca393748139ff96dd8bbf2a. The hosted GoReleaser OSS v2.18.2 run finalized every Release only after independent public download, tidy, build, module/checksum verification, and rejection of local replacements, with CGO disabled, GOWORK=off and fresh session caches. Release issue #15 closed automatically after completion. The frozen tracer/xray adapter was excluded. See [RELEASE_ACCEPTANCE.json](RELEASE_ACCEPTANCE.json) (2026-10-04). Hosted preparation controls and native PR/main checks were exercised; browser form rendering and default-token authorization remain separate rollout checks.
 - [x] REL-UNIFIED: Replace new component-scoped releases with one version for all maintained public modules, preserving independent Go paths and prefixed tags. Add project release_version, aggregate auto-increment policy, cohort-wide reserved-version avoidance, synchronized internal requirements, schema-2 full-cohort validation, component/repository grouped root notes, and root finalization last with the stable Latest label. Twenty-one isolated automation and 37 release regressions passed, including Logger-only cohort bumps, divergent published baselines/reserved nested tags, partial/mixed-plan rejection, aligned requirements, failure/resume ordering, legacy schema-1 recovery, and real GoReleaser OSS v2.18.2 root/component/prerelease draft/finalization and Latest configuration. Eighteen contribution/form regressions and actionlint v1.7.12 passed (2026-10-05). This records implementation acceptance; no new public version was prepared or published. See issue #23 and [Releasing modules](RELEASING.md).
 - [x] SIGNER-BODY-HANDOFF: Preserve asynchronous base-transport body ownership for custom signers returning the input request or a clone sharing its body. Four deterministic success/error regressions reproduced premature closure before the fix; packaged Signer tests, vet, tidy verification and its independent consumer build pass with CGO disabled. Distinct/empty bodies and nil signing results retain cleanup coverage. See issue #25 and [Signer ownership](SIGNER.md) (2026-10-05).
+- [x] MODULE-REVIEW-20261005: Review the main entry points and critical state/ownership/error/decoding paths of the 26 maintained public modules excluding Logger. Twenty-five native Windows packaged checks and standalone consumers passed with CGO disabled; the exact-baseline hosted Linux run passed all 31 repository modules, including KMS and frozen X-Ray. Register issues #25–#28 before production changes; merge the verified Signer fix before starting the shared decoding fix. Local Docker runtime acceptance was unavailable. See [the review scope and evidence](MODULE_REVIEW_2026_10_05.md).
+- [x] UTF8-DECODING: Reuse Commons.DecodeUTF8 in Parser, Parameters and JMESPath while preserving each reference path's BOM and gzip fallback rules. Generate 56 expected cases from the pinned TypeScript 2.35.0 packages: 20 Parser, 16 Parameters and 20 JMESPath cases. New regressions failed before the fix; all three affected packaged modules passed tests, vet, tidy and standalone consumer builds afterward, with CGO disabled and GOWORK=off. Parameters additionally verifies Auto transforms and untransformed raw bytes. See issues #26–#28 and [the review report](MODULE_REVIEW_2026_10_05.md) (2026-10-05).

docs/JMESPATH.md

@@ -83,6 +83,8 @@ Pass a compiled expression to `logger.HandlerOptions.CorrelationExtractor`. Logg
 
 Seventy-eight cases execute the actual TypeScript v2.35.0 package: standard functions, projections/filters/slices/pipes, numeric/null behavior, all thirteen envelopes, Unicode/BOM handling, and errors. Additional Go tests cover custom functions, signature errors, result/definition isolation, typed events, and 100 concurrent searches. Docker covers decoded projections and Logger correlation alongside Signer and OTel.
 
+Twenty additional pinned reference cases verify UTF-8 replacement and BOM boundaries for the Powertools Base64 functions. Both replace each maximal malformed subpart using Commons. `powertools_base64` strips exactly one leading BOM, matching `TextDecoder`; `powertools_base64_gzip` retains BOM, matching `Buffer.toString`. See `testdata/utf8-v2.35.0.json` and `tools/reference/generate-utf8-decoding.mjs`.
+
 `*Error` carries `Kind`, `Expression`, optional `Function`, and an unwrap cause. Syntax errors are grouped instead of reproducing every TypeScript lexer/parser exception class or message; empty expressions have a distinct kind. Function type/arity and unknown-function failures remain distinguishable.
 
 The pinned interpreter silently swallows ordinary decoder and custom-function failures, returning JavaScript `undefined`. Go intentionally returns an error and preserves the cause. Fixtures explicitly record the three decoder `undefined` results rather than treating them as successful null values. JSON object ordering, `to_string` serialization details, malformed UTF-8 replacement boundaries, and extreme numeric behavior still require exhaustive cross-language coverage. This implementation does not claim a complete specification compliance audit or performance budgets.

docs/MODULE_ACCEPTANCE_SCOPED.json

@@ -5,24 +5,82 @@
   "completed": true,
   "modules": [
     {
-      "path": "github.com/rambow-cloud/powertools-lambda-go/signer",
-      "directory": "signer",
+      "path": "github.com/rambow-cloud/powertools-lambda-go/jmespath",
+      "directory": "jmespath",
       "public": true,
       "version": "v0.1.0",
-      "archive_sha256": "7e7bc65590a5f255d3a4381394ec15d75848455196dab3a5a6aa3f3884e96726",
+      "archive_sha256": "175484f2b375c7f22875d4e687ea002dc8dbfd3dfe4ab3612a8f716c1b802be0",
+      "tests": true,
+      "vet": true,
+      "tidy": true,
+      "consumer_build": true,
+      "external_modules": [
+        "github.com/davecgh/go-spew",
+        "github.com/google/go-cmp",
+        "github.com/jmespath-community/go-jmespath",
+        "github.com/pmezard/go-difflib",
+        "github.com/stretchr/testify",
+        "golang.org/x/exp",
+        "golang.org/x/mod",
+        "golang.org/x/sys",
+        "golang.org/x/tools",
+        "gopkg.in/yaml.v3"
+      ],
+      "binary_bytes": 3223040
+    },
+    {
+      "path": "github.com/rambow-cloud/powertools-lambda-go/parser",
+      "directory": "parser",
+      "public": true,
+      "version": "v0.1.0",
+      "archive_sha256": "750c955357a32433e4163bbefc03f2c1fa339b05490731b463c60c937386945a",
+      "tests": true,
+      "vet": true,
+      "tidy": true,
+      "consumer_build": true,
+      "external_modules": [],
+      "binary_bytes": 4545024
+    },
+    {
+      "path": "github.com/rambow-cloud/powertools-lambda-go/parameters",
+      "directory": "parameters",
+      "public": true,
+      "version": "v0.1.0",
+      "archive_sha256": "3adfda169361b436e67c5ae13e08caf4f3e244be587bb808e387358c959ed13c",
       "tests": true,
       "vet": true,
       "tidy": true,
       "consumer_build": true,
       "external_modules": [
         "github.com/aws/aws-sdk-go-v2",
+        "github.com/aws/aws-sdk-go-v2/config",
+        "github.com/aws/aws-sdk-go-v2/credentials",
+        "github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue",
+        "github.com/aws/aws-sdk-go-v2/feature/ec2/imds",
+        "github.com/aws/aws-sdk-go-v2/internal/configsources",
+        "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2",
+        "github.com/aws/aws-sdk-go-v2/internal/v4a",
+        "github.com/aws/aws-sdk-go-v2/service/appconfigdata",
+        "github.com/aws/aws-sdk-go-v2/service/dynamodb",
+        "github.com/aws/aws-sdk-go-v2/service/dynamodbstreams",
+        "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding",
+        "github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery",
+        "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url",
+        "github.com/aws/aws-sdk-go-v2/service/secretsmanager",
+        "github.com/aws/aws-sdk-go-v2/service/signin",
+        "github.com/aws/aws-sdk-go-v2/service/ssm",
+        "github.com/aws/aws-sdk-go-v2/service/sso",
+        "github.com/aws/aws-sdk-go-v2/service/ssooidc",
+        "github.com/aws/aws-sdk-go-v2/service/sts",
         "github.com/aws/smithy-go"
       ],
-      "binary_bytes": 5602304
+      "binary_bytes": 3157504
     }
   ],
   "scope": "Selected modules only; this report does not replace full-workspace acceptance",
   "selected_directories": [
-    "signer"
+    "jmespath",
+    "parameters",
+    "parser"
   ]
 }

docs/MODULE_REVIEW_2026_10_05.json

@@ -0,0 +1,278 @@
+{
+  "date": "2026-10-05",
+  "baseline_commit": "6d4157d24f84f7fa2b8a1cdeb94ad5bac8359a93",
+  "scope": "26 maintained public modules excluding Logger; frozen tracer/xray regression evidence retained",
+  "local": {
+    "go": "1.27.1",
+    "platform": "windows/amd64",
+    "cgo_enabled": false,
+    "workspace": "off",
+    "module_count": 25,
+    "modules": [
+      {
+        "directory": ".",
+        "archive_sha256": "480e2dbebef7cdb9947e999a313533d1b582c88a38d2585f62ac10894b3cbe79",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "commons/regex",
+        "archive_sha256": "cd229f91182c2ff3015384faaa4e3214dbb0896f09fe66eaa9c07004fd99ec55",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "signer",
+        "archive_sha256": "473cc7dced621fa191f12cc4f5105646203ee3d4d46e5667bc9ccbe434c82217",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "batch",
+        "archive_sha256": "c4bbc2f4e8c8a0e69ae9b10dcfd41a348bd60cda532706018a868d79922f0bc3",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "commons/awssdk",
+        "archive_sha256": "ec1411bd3d705bfcc03ae078b4adb85a57ae6e601ff0c7310d20075c84077ec5",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "commons/dynamodb",
+        "archive_sha256": "01a09d86bb4c90995ca10f6237ce0103a48fbe665cf966aabf8aace9e6264dca",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "commons/metadata",
+        "archive_sha256": "8aac8b9fe97edfe705d22cb62f297453d4a88bcae11adcafbdfa47cfc79ced9e",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "datamasking",
+        "archive_sha256": "a0af3350e9bde0c4d46a521e1274c938afc3cb24fab9257409955dfc16e122cb",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "eventhandler/appsyncevents",
+        "archive_sha256": "d873f72f5496c14c6bcf669def78a88c97c2ae9d48f7cad90c2cae14842f1ded",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "eventhandler/appsyncgraphql",
+        "archive_sha256": "859a311c3cc428a27358c7ab2a156d94b3a6f4c78e69950e419cb5e42fd01ba4",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "eventhandler/bedrock",
+        "archive_sha256": "a2a0c89936007fb9396a57932d18a0c95ee99163584f6b6ee9bf83f53e497cf7",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "eventhandler/http",
+        "archive_sha256": "5e62d66311aabcd8a4941c8baa046746067caf7b201d531c5cfc89c244b137c8",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "jmespath",
+        "archive_sha256": "7bf2ec8c850435531fa6f460aea4bba17c01d66954999d07d22e8bf8c1534f9f",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "kafka",
+        "archive_sha256": "63cce9360d920e296350e6880204455d805b6608384a9adf5a7a06ad1946f6f4",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "metrics",
+        "archive_sha256": "0e54bf02fc1c175c726d29397fd1eb728053e3513d1f6a1bb9f45e86b3cc1a88",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "parser",
+        "archive_sha256": "ad0a9d640a88d0b01049749730d9b04d4eadef06be22bd4a60f5fe683947d8af",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "eventhandler/http/metrics",
+        "archive_sha256": "f3ec4b843a955435986a62d760f7c84c290d50339ff3e7a00a97cb890905f565",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "idempotency",
+        "archive_sha256": "6e89d4fb28b8a6ff10f9b49f4e53cb89c94634ec724a0449fc061e27d6581d67",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "kafka/avro",
+        "archive_sha256": "09f7d1ceae9e8a043b29fb890e5dfc21589394b3c579389989cdd29265fe1083",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "kafka/protobuf",
+        "archive_sha256": "0037dad4873823fc7cc2cf8ca70a55a2468ad661af4a8ce7902d7b4acfab252b",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "parameters",
+        "archive_sha256": "bd19af4a40ad71ba1dd8f249b68ab00d365eb286482a753d5df8e78ddae1bec2",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "tracer",
+        "archive_sha256": "3dd558ab92d7b3f441ae1673014c17f5bdc6acf8af73ae43ea93edf5fa93bc5f",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "validation",
+        "archive_sha256": "c3124787bce16f480efd7e207ecd3998e3408f9b3ea4a7881c3fc9ed89313eec",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "eventhandler/http/tracer",
+        "archive_sha256": "dd0927202bafa506137ca91910c9b520eea67dedfc486cdcb7ef40bebf820fe5",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      },
+      {
+        "directory": "idempotency/cache",
+        "archive_sha256": "bb252f2f266ad78a4131f14ea7ad16ce4fe023716a618449811e9058696f055e",
+        "tests": true,
+        "vet": true,
+        "tidy": true,
+        "consumer_build": true
+      }
+    ]
+  },
+  "linux_baseline": {
+    "run": "https://github.com/rambow-cloud/powertools-lambda-go/actions/runs/37219502507",
+    "completed": true,
+    "module_count": 31,
+    "kms": true,
+    "frozen_xray": true
+  },
+  "findings": [
+    {
+      "issue": 25,
+      "module": "signer",
+      "problem": "premature shared request-body closure"
+    },
+    {
+      "issue": 26,
+      "module": "parser",
+      "problem": "UTF-8 replacement and BOM handling"
+    },
+    {
+      "issue": 27,
+      "module": "parameters",
+      "problem": "UTF-8 replacement and BOM handling"
+    },
+    {
+      "issue": 28,
+      "module": "jmespath",
+      "problem": "UTF-8 replacement"
+    }
+  ],
+  "local_limitations": [
+    "Linux Docker engine did not respond within a bounded probe.",
+    "Frozen X-Ray workspace test could not download a selected external dependency."
+  ],
+  "reference_case_count": 53,
+  "pre_fix_differences": {
+    "parser": 13,
+    "parameters": 8,
+    "jmespath": 6
+  },
+  "signer_fix": {
+    "pr": 29,
+    "merge_commit": "b02d8dc47e8529ca6b6b61e217bf37b2e819df34",
+    "required_checks": "passed before merge"
+  },
+  "utf8_regression_cases": {
+    "parser": 20,
+    "parameters": 16,
+    "jmespath": 20,
+    "total": 56
+  },
+  "utf8_packaged_verification": {
+    "selected_modules": [
+      "parser",
+      "parameters",
+      "jmespath"
+    ],
+    "completed": true,
+    "tests": true,
+    "vet": true,
+    "tidy": true,
+    "standalone_consumers": 3,
+    "cgo_enabled": false,
+    "workspace": "off"
+  }
+}