{ config, pkgs, lib, user, inputs, flakeRoot,... }:
{
  config,
  lib,
  pkgs,
  flakeRoot,
  inputs,
  ...
}:
let
  packagesConfPath = "${builtins.toString flakeRoot.outPath}/assets/common/apps/packages.conf";
  raw = builtins.readFile packagesConfPath;
  # IMPORTANT: explicit "\n" so we never accidentally split into characters
  rawLines = lib.splitString "\n" raw;
  # Guard: if we accidentally split into characters, rawLines length ~= stringLength raw
  _guard =
    assert !(builtins.stringLength raw > 1 && builtins.length rawLines == builtins.stringLength raw);
    true;
  cleanLine =
    l:
    let
      noCR = lib.replaceStrings [ "\r" ] [ "" ] l;
      noInlineComment = lib.head (lib.splitString "#" noCR);
    in
    lib.strings.trim noInlineComment;
  entries = builtins.filter (l: l != "") (map cleanLine rawLines);
  resolvePkg =
    name:
    let
      parts = lib.splitString "." name;
      found = lib.attrByPath parts null pkgs;
    in
    if found == null then
      throw ''
        packages.nix: package not found in pkgs
        Token    : ${builtins.toJSON name}
        packages.conf   : ${toString packagesConfPath}
        Hint     : check the attribute name on search.nixos.org/packages
      ''
    else
      found;
  packages = builtins.seq _guard (map resolvePkg entries);
  zenBrowser = inputs.zen-browser.packages.${pkgs.stdenv.hostPlatform.system}.default;
in
{
  environment.systemPackages = packages ++ [ zenBrowser ];
}

{
  config,
  pkgs,
  lib,
  flakeRoot,
  ...
}:
let
  moduleName = "install-flatpaks";
  flatpakConfPath = flakeRoot.outPath + "/assets/common/apps/flatpaks.conf";
  raw = builtins.readFile flatpakConfPath;
  # Explicit "\n" so we never accidentally split into characters
  rawLines = lib.splitString "\n" raw;

  # Guard: if we accidentally split into characters, rawLines length ~= stringLength raw
  _guard =
    assert !(builtins.stringLength raw > 1 && builtins.length rawLines == builtins.stringLength raw);
    true;

  cleanLine =
    l:
    let
      noCR = lib.replaceStrings [ "\r" ] [ "" ] l;
      noInlineComment = lib.head (lib.splitString "#" noCR);
    in
    lib.strings.trim noInlineComment;

  entries = builtins.filter (l: l != "") (map cleanLine rawLines);

  # Flatpak app IDs are reverse-DNS style like org.example.App (at least 2 dots).
  # We'll validate and fail early with a clear message.
  dotCount = s: builtins.length (lib.splitString "." s) - 1;

  isValidId = s: (dotCount s) >= 2; # matches the error you're seeing: "at least 2 periods"

  _validate = builtins.seq _guard (
    builtins.map (
      id:
      if isValidId id then
        true
      else
        throw ''
          ${moduleName}: invalid Flatpak ID in flatpaks.conf (needs reverse-DNS with at least 2 dots)

          Token    : ${builtins.toJSON id}
          flatpaks.conf : ${toString flatpakConfPath}

          Fix: remove stray tokens/headers, or comment them out with '#'.
        ''
    ) entries
  );

  # Use validated entries
  flatpakApps = builtins.seq _validate entries;

  syncFlatpaks = pkgs.writeShellScript "sync-flatpaks" ''
    set -euo pipefail

    # Use the deployed config path (matches environment.etc below)
    CONF="/etc/flatpak/flatpaks.conf"
    if [[ -f "$CONF" ]]; then
    echo "flatpak-sync: using $CONF"
    else
    echo "flatpak-sync: WARNING: $CONF not found, using embedded list"
    fi

    if ! flatpak remotes --system --columns=name | grep -qx flathub; then
    flatpak remote-add --system --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
    fi

    desired_apps=(
    ${lib.concatStringsSep "\n" (map (a: ''"${a}"'') flatpakApps)}
    )

    for app in "''${desired_apps[@]}"; do
    if ! flatpak info --system "$app" >/dev/null 2>&1; then
      flatpak install --system -y --noninteractive flathub "$app"
    fi
    done
  '';
in
{
  services.flatpak.enable = true;

  xdg.portal = {
    enable = true;
  };

  # Deploy the config file for runtime visibility/debugging
  environment.etc."flatpak/flatpaks.conf".source = lib.mkForce flatpakConfPath;

  systemd.services.flatpak-sync = {
    description = "Install Flatpak apps listed in flatpaks.conf";
    wantedBy = [ "multi-user.target" ];
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];

    serviceConfig = {
      Type = "oneshot";
      ExecStart = syncFlatpaks;
    };

    restartTriggers = [ flatpakConfPath ];
    path = [
      pkgs.flatpak
      pkgs.coreutils
      pkgs.gnugrep
      pkgs.gnused
    ];
  };
}