{ config, pkgs, lib, flakeRoot, ... }:
let
  moduleName = "install-flatpaks";
  flatpakConfPath = flakeRoot + "/assets/conf/apps/flatpaks.conf";
  raw = builtins.readFile flatpakConfPath;
  # Explicit "\n" so we never accidentally split into characters
  rawLines = lib.splitString "\n" raw;

  # Guard: if we accidentally split into characters, rawLines length ~= stringLength raw
  _guard = assert !(
  builtins.stringLength raw > 1 &&
  builtins.length rawLines == builtins.stringLength raw
  ); true;

  cleanLine = l:
  let
  noCR = lib.replaceStrings [ "\r" ] [ "" ] l;
  noInlineComment = lib.head (lib.splitString "#" noCR);
  in
  lib.strings.trim noInlineComment;

  entries =
  builtins.filter (l: l != "")
  (map cleanLine rawLines);

  # Flatpak app IDs are reverse-DNS style like org.example.App (at least 2 dots).
  # We'll validate and fail early with a clear message.
  dotCount = s: builtins.length (lib.splitString "." s) - 1;

  isValidId = s:
  (dotCount s) >= 2; # matches the error you're seeing: "at least 2 periods"

  _validate =
  builtins.seq _guard (
  builtins.map (id:
    if isValidId id then true else
    throw ''
    ${moduleName}: invalid Flatpak ID in flatpaks.conf (needs reverse-DNS with at least 2 dots)

    Token    : ${builtins.toJSON id}
    flatpaks.conf : ${toString flatpakConfPath}

    Fix: remove stray tokens/headers, or comment them out with '#'.
    ''
  ) entries
  );

  # Use validated entries
  flatpakApps = builtins.seq _validate entries;

  syncFlatpaks = pkgs.writeShellScript "sync-flatpaks" ''
  set -euo pipefail

  # Use the deployed config path (matches environment.etc below)
  CONF="/etc/flatpak/flatpaks.conf"
  if [[ -f "$CONF" ]]; then
  echo "flatpak-sync: using $CONF"
  else
  echo "flatpak-sync: WARNING: $CONF not found, using embedded list"
  fi

  if ! flatpak remotes --system --columns=name | grep -qx flathub; then
  flatpak remote-add --system --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
  fi

  desired_apps=(
  ${lib.concatStringsSep "\n" (map (a: ''"${a}"'') flatpakApps)}
  )

  for app in "''${desired_apps[@]}"; do
  if ! flatpak info --system "$app" >/dev/null 2>&1; then
    flatpak install --system -y --noninteractive flathub "$app"
  fi
  done
  '';
in
{
  services.flatpak.enable = true;

  xdg.portal = {
  enable = true;
  extraPortals = with pkgs; [
  xdg-desktop-portal-hyprland
  xdg-desktop-portal-gtk
  ];
  };

  # Deploy the config file for runtime visibility/debugging
  environment.etc."flatpak/flatpaks.conf".source = lib.mkForce flatpakConfPath;

  systemd.services.flatpak-sync = {
  description = "Install Flatpak apps listed in flatpaks.conf";
  wantedBy = [ "multi-user.target" ];
  wants = [ "network-online.target" ];
  after = [ "network-online.target" ];

  serviceConfig = {
  Type = "oneshot";
  ExecStart = syncFlatpaks;
  };

  restartTriggers = [ flatpakConfPath ];
  path = [ pkgs.flatpak pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
  };
}