Function dedup_files_by_path 

fn dedup_files_by_path<'a>(
    files: &'a [BundleImportFile],
    warnings: &mut WarningSink,
) -> HashMap<String, &'a str>

Normalize every input file’s path and reduce to a first-wins, deduped (path -> content) map — the exact effective representation parse_bundle_import builds internally before doing anything else. Extracted so the Phase 3 files-mode content digest (§3.0.5, round 6) can compute over the IDENTICAL order-resolved representation the parser itself uses, rather than a naive raw-input sort that could disagree with which entry the parser’s own first-wins rule actually keeps.

Also enforces the accounts/ allowlist (§4.3.5): only accounts/requirements.json is ever readable from that directory, checked against every file actually present (not just what the manifest references, since a malformed bundle’s components object isn’t a trustworthy inventory of its own contents), and normalized the same way regardless of intake source (zip or raw files list) so neither can bypass the check with a non-canonical spelling (codex P1, PR #2379 rounds 1–2). A rejected file is excluded from the returned map entirely, not merely warned about — otherwise a components.* reference pointing at it (e.g. accounts/secrets.json) would still resolve and leak its content into the imported bundle.