`A2uiMessage.fromJson` accepts objects carrying more than one of `createSurface`/`updateComponents`/`updateDataModel`/`deleteSurface`

_↴ Ported from [flutter/genui#934](https://github.com/flutter/genui/issues/934) — originally opened by [andrewkolos](https://github.com/andrewkolos) on 2026-05-26._
_Original labels: front-line-handled_
_Original assignees: [andrewkolos](https://github.com/andrewkolos)_

---

[`A2uiMessage.fromJson`](https://github.com/flutter/genui/blob/ae53cc52b35b72312f01b80eeb565163e3c869d7/packages/genui/lib/src/model/a2ui_message.dart#L20). The message type is parsed in the order of 1) `createSurface`, 2) `updateComponents`, 3) `updateDataModel`, and then 4) `deleteSurface`). The function returns on the first match.

A payload that matches multiple of these checks will silently parse as whatever happens to come first instead of failing validation.

```dart
final message = A2uiMessage.fromJson({
'version': 'v0.9',
'createSurface': {'surfaceId': 's1', 'catalogId': 'c1'},
'updateComponents': {'surfaceId': 's1', 'components': []},
});
// Expected: A2uiValidationException
// Actual: parses as CreateSurface, drops updateComponents silently
```

I would normally consider this a corner case and not bother with fixing it, as I think an LLM is very unlikely to generate a message that matches multiple types. However, 1) I'd like `package:genui` to have as much parity with other renderers as possible ([`web_core` does include logic to catch this case](https://github.com/google/A2UI/blob/0e0375749bf8a940d57969d612e74f7221ad246e/renderers/web_core/src/v0_9/processing/message-processor.ts#L229-L262)) and 2) the 0.9 spec does explicitly specify `oneOf` and `additionalProperties: false` for each message type, so fixing this would also make the genui package follow the spec more closely.

El issue está en el paquete de Dart `genui`, en el archivo `packages/genui/lib/src/model/a2ui_message.dart`. Revisa el método `A2uiMessage.fromJson` y su orden de análisis. Compáralo con la lógica de validación del renderizador web_core (`renderers/web_core/src/v0_9/processing/message-processor.ts`, líneas 229-262). La corrección debe garantizar que la carga útil JSON contenga exactamente uno de los campos de mensaje especificados y lance una `A2uiValidationException` cuando haya varias coincidencias. Escribe una prueba para el caso no válido.

Escrito por el modelo de indexación a partir del texto del issue.