`A2uiMessage.fromJson` accepts objects carrying more than one of `createSurface`/`updateComponents`/`updateDataModel`/`deleteSurface`

_↴ Ported from [flutter/genui#934](https://github.com/flutter/genui/issues/934) — originally opened by [andrewkolos](https://github.com/andrewkolos) on 2026-05-26._
_Original labels: front-line-handled_
_Original assignees: [andrewkolos](https://github.com/andrewkolos)_

---

[`A2uiMessage.fromJson`](https://github.com/flutter/genui/blob/ae53cc52b35b72312f01b80eeb565163e3c869d7/packages/genui/lib/src/model/a2ui_message.dart#L20). The message type is parsed in the order of 1) `createSurface`, 2) `updateComponents`, 3) `updateDataModel`, and then 4) `deleteSurface`). The function returns on the first match.

A payload that matches multiple of these checks will silently parse as whatever happens to come first instead of failing validation.

```dart
final message = A2uiMessage.fromJson({
'version': 'v0.9',
'createSurface': {'surfaceId': 's1', 'catalogId': 'c1'},
'updateComponents': {'surfaceId': 's1', 'components': []},
});
// Expected: A2uiValidationException
// Actual: parses as CreateSurface, drops updateComponents silently
```

I would normally consider this a corner case and not bother with fixing it, as I think an LLM is very unlikely to generate a message that matches multiple types. However, 1) I'd like `package:genui` to have as much parity with other renderers as possible ([`web_core` does include logic to catch this case](https://github.com/google/A2UI/blob/0e0375749bf8a940d57969d612e74f7221ad246e/renderers/web_core/src/v0_9/processing/message-processor.ts#L229-L262)) and 2) the 0.9 spec does explicitly specify `oneOf` and `additionalProperties: false` for each message type, so fixing this would also make the genui package follow the spec more closely.

この issue は、ファイル `packages/genui/lib/src/model/a2ui_message.dart` にある Dart パッケージ `genui` のものです。`A2uiMessage.fromJson` メソッドとその解析順序を確認してください。web_core renderer の検証ロジック（`renderers/web_core/src/v0_9/processing/message-processor.ts` の 229-262 行目）と比較してください。修正では、JSON ペイロードに指定されたメッセージフィールドのうちちょうど 1 つだけが含まれることを保証し、複数一致した場合は `A2uiValidationException` をスローする必要があります。無効なケースのテストを書いてください。

索引モデルが issue の本文から書いたものです。