refactor(codegen): 替换Java原生序列化为Jackson JSON序列化

- 使用Jackson JSON序列化替代ObjectOutputStream/ObjectInputStream
- 避免JDK版本间serialVersionUID不兼容问题
- 在序列化格式中嵌入类名以支持准确的类型重建
- 添加Base64编码的JSON字符串序列化功能
- 实现从Base64编码数据反序列化对象的方法
- 更新原生镜像配置以包含必要的构造函数反射支持

Author: cjbi

flexmodel-engine/flexmodel-codegen/src/main/java/dev/flexmodel/codegen/ObjectUtils.java

@@ -1,25 +1,70 @@
 package dev.flexmodel.codegen;
 
-import java.io.*;
+import dev.flexmodel.JsonUtils;
+
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 
 /**
+ * Object serialization utilities.
+ * <p>
+ * Uses Jackson JSON serialization (wrapped in Base64) instead of Java native
+ * serialization ({@link ObjectOutputStream}/{@link ObjectInputStream}) to avoid
+ * {@code serialVersionUID} incompatibility between JDK versions. JDK classes
+ * like {@link java.util.HashMap} and {@link java.util.ArrayList} change their
+ * {@code serialVersionUID} across releases, which breaks deserialization when
+ * the codegen JDK differs from the runtime JDK (e.g., in GraalVM native-image).
+ * </p>
+ *
  * @author cjbi
  */
 public class ObjectUtils {
 
+  private ObjectUtils() {
+  }
+
+  /**
+   * Serialize an object to a Base64-encoded JSON string.
+   * <p>
+   * The serialized format embeds the class name as the first line, followed by
+   * the JSON representation. This allows deserialization to reconstruct the
+   * exact object type without requiring an explicit type parameter.
+   * </p>
+   */
   public static String serialize(Object obj) throws IOException {
-    ByteArrayOutputStream baos = new ByteArrayOutputStream();
-    ObjectOutputStream oos = new ObjectOutputStream(baos);
-    oos.writeObject(obj);
-    oos.flush();
-    return Base64.getEncoder().encodeToString(baos.toByteArray());
+    String json = JsonUtils.toJsonString(obj);
+    String className = obj.getClass().getName();
+    String combined = className + "\n" + json;
+    return Base64.getEncoder().encodeToString(combined.getBytes(StandardCharsets.UTF_8));
   }
 
+  /**
+   * Deserialize a Base64-encoded JSON string back to an object.
+   * <p>
+   * The first line of the decoded data is the fully qualified class name,
+   * which is used to determine the target type for Jackson deserialization.
+   * </p>
+   *
+   * @param str Base64-encoded serialized data
+   * @return the deserialized object
+   * @throws IOException            if I/O error occurs
+   * @throws ClassNotFoundException if the target class cannot be found
+   */
   public static Object deserialize(String str) throws IOException, ClassNotFoundException {
     byte[] data = Base64.getDecoder().decode(str);
-    ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data));
-    return ois.readObject();
+    String combined = new String(data, StandardCharsets.UTF_8);
+    int newlineIdx = combined.indexOf('\n');
+    if (newlineIdx < 0) {
+      throw new IOException("Invalid serialized format: missing class name header");
+    }
+    String className = combined.substring(0, newlineIdx);
+    String json = combined.substring(newlineIdx + 1);
+    @SuppressWarnings("unchecked")
+    Class<?> clazz = Class.forName(className);
+    return JsonUtils.parseToObject(json, clazz);
   }
 
 }

flexmodel-server/src/main/java/dev/flexmodel/common/config/nativeimage/FlexmodelNativeProcessor.java

@@ -107,7 +107,11 @@ ReflectiveClassBuildItem registerDtos() {
 
   /**
    * 注册引擎模块中的模型定义类。
-   * 这些类使用 Jackson 多态反序列化（@JsonSubTypes / @JsonTypeInfo）。
+   * 这些类使用 Jackson 多态反序列化（@JsonSubTypes / @JsonTypeInfo），
+   * 并通过 ObjectUtils.deserialize() 在运行时从 JSON 反序列化。
+   * <p>
+   * <b>注意</b>：必须包含 {@code .constructors()}，因为 Jackson 在原生镜像中
+   * 需要通过反射调用无参构造函数来实例化模型对象。
    */
   @BuildStep
   ReflectiveClassBuildItem registerModelDefinitions() {
@@ -116,8 +120,11 @@ ReflectiveClassBuildItem registerModelDefinitions() {
         "dev.flexmodel.model.field.**",
         "dev.flexmodel.condition.**",
         "dev.flexmodel.event.**",
-        "dev.flexmodel.event.impl.**"
+        "dev.flexmodel.event.impl.**",
+        "dev.flexmodel.ModelImportBundle",
+        "dev.flexmodel.ModelImportBundle$ImportData"
       )
+      .constructors()
       .methods()
       .fields()
       .build();