feat(flatpak): support .flatpak bundle URLs; migrate autenticacao-gov-pt

Extend meta/flatpak.txt format to allow per-line URL for non-Flathub
.flatpak bundles. Lines are now either '<id>' (Flathub) or '<id>  <url>'
(downloaded + installed via 'flatpak install <file>'). Bundle entries
are skipped on pkg-apply/pkg-fix when already installed, and re-fetched
on flatpak-update only when the version embedded in the URL differs
from the installed version.

Use this to migrate Portuguese Citizen Card (pteid-mw) off the AUR
'autenticacao-gov-pt-bin' pseudo-flatpak unpack to the upstream-shipped
flatpak bundle from amagovpt/autenticacao.gov GitHub releases — same
codebase the AUR PKGBUILD already vendors, but properly sandboxed.

Refactors duplicated install logic in pkg-apply/pkg-fix into a private
_flatpak-install helper. ID-only contexts (pkg-status, undeclared,
pkg-list) now extract the first whitespace-separated token instead of
treating each line as a single ID.

Caveat: PKCS#11-based Citizen Card web auth in the LibreWolf flatpak
remains unsolved — the .so lives inside the autenticacao-gov sandbox
and would need a 'flatpak override' + 'modutil' bridge to be loaded
across sandboxes. The CLI/GUI eID app works as expected.

3 files changed, 97 insertions, 37 deletions

diff --git a/justfile b/justfile
index fe73648..39992a2 100644
--- a/justfile
+++ b/justfile
@@ -31,9 +31,26 @@ update: pkg-update nvim-update flatpak-update
 pkg-update:
     paru -Syu
 
-# Update all user-scope flatpaks
+# Update all user-scope flatpaks (Flathub apps + URL bundles when their version changes)
 flatpak-update:
+    #!/bin/sh
+    set -eu
     flatpak update --user -y --noninteractive
+    [ -f meta/flatpak.txt ] || exit 0
+    awk '!/^[[:space:]]*(#|$)/ && NF>=2 {print $1, $2}' meta/flatpak.txt \
+        | while read -r id url; do
+            url_ver=$(echo "$url" | grep -oE 'v?[0-9]+(\.[0-9]+)+' | head -1 | sed 's/^v//')
+            installed_ver=$(flatpak info --user "$id" 2>/dev/null \
+                | awk -F: '/^[[:space:]]*Version:/ {gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2; exit}')
+            if [ -n "$url_ver" ] && [ "$url_ver" = "$installed_ver" ]; then
+                continue
+            fi
+            echo ">>> updating $id from $url"
+            tmp=$(mktemp --suffix=.flatpak)
+            curl -fsSL -o "$tmp" "$url"
+            flatpak install --user -y --noninteractive --reinstall "$tmp"
+            rm -f "$tmp"
+        done
 
 # Update Neovim plugins (vim.pack) and Mason tools in a headless session
 nvim-update:
@@ -928,7 +945,7 @@ pkg-status:
         pacman -Qi "$pkg" >/dev/null 2>&1 || echo "  missing:    $pkg"
     done
     if [ -f meta/flatpak.txt ]; then
-        sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' meta/flatpak.txt | while read -r id; do
+        awk '!/^[[:space:]]*(#|$)/ {print $1}' meta/flatpak.txt | while read -r id; do
             [ -z "$id" ] && continue
             printf '%s\n' "$flatpaks" | grep -qxF "$id" || echo "  missing:    flatpak: $id"
         done
@@ -943,7 +960,7 @@ undeclared:
         echo "$active" | grep -qxF "$pkg" || echo "$pkg"
     done
     if [ -f meta/flatpak.txt ]; then
-        declared=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' meta/flatpak.txt)
+        declared=$(awk '!/^[[:space:]]*(#|$)/ {print $1}' meta/flatpak.txt)
         flatpak list --user --app --columns=application 2>/dev/null | while read -r id; do
             [ -z "$id" ] && continue
             echo "$declared" | grep -qxF "$id" || echo "flatpak: $id"
@@ -968,18 +985,33 @@ pkg-list group="":
             echo "error: $file does not exist" >&2
             exit 1
         fi
-        sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file" | while read -r pkg; do
-            if is_installed '{{ group }}' "$pkg"; then
-                printf '  \033[32m✓\033[0m %s\n' "$pkg"
-            else
-                printf '  \033[31m✗\033[0m %s\n' "$pkg"
-            fi
-        done
+        if [ '{{ group }}' = "flatpak" ]; then
+            parser='!/^[[:space:]]*(#|$)/ {print $1}'
+            awk "$parser" "$file" | while read -r pkg; do
+                if is_installed '{{ group }}' "$pkg"; then
+                    printf '  \033[32m✓\033[0m %s\n' "$pkg"
+                else
+                    printf '  \033[31m✗\033[0m %s\n' "$pkg"
+                fi
+            done
+        else
+            sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file" | while read -r pkg; do
+                if is_installed '{{ group }}' "$pkg"; then
+                    printf '  \033[32m✓\033[0m %s\n' "$pkg"
+                else
+                    printf '  \033[31m✗\033[0m %s\n' "$pkg"
+                fi
+            done
+        fi
         exit 0
     fi
     for file in meta/*.txt; do
         group=$(basename "$file" .txt)
-        pkgs=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file")
+        if [ "$group" = "flatpak" ]; then
+            pkgs=$(awk '!/^[[:space:]]*(#|$)/ {print $1}' "$file")
+        else
+            pkgs=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file")
+        fi
         total=$(echo "$pkgs" | wc -l)
         installed=0
         for pkg in $pkgs; do
@@ -998,35 +1030,23 @@ pkg-list group="":
 pkg-apply *groups:
     #!/bin/sh
     set -eu
-    install_flatpaks() {
-        # $@: flathub app ids
-        [ "$#" -gt 0 ] || return 0
-        flatpak remote-add --if-not-exists --user flathub \
-            https://dl.flathub.org/repo/flathub.flatpakrepo >/dev/null
-        flatpak install --user -y --noninteractive flathub "$@"
-    }
     if [ -n "{{ groups }}" ]; then
         for group in {{ groups }}; do
             file="meta/${group}.txt"
-            pkgs=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file")
-            [ -n "$pkgs" ] || continue
             if [ "$group" = "flatpak" ]; then
-                # shellcheck disable=SC2086
-                install_flatpaks $pkgs
-            else
-                printf '%s\n' "$pkgs" | paru -S --needed --noconfirm --ask=4 -
+                just _flatpak-install
+                continue
             fi
+            pkgs=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file")
+            [ -n "$pkgs" ] || continue
+            printf '%s\n' "$pkgs" | paru -S --needed --noconfirm --ask=4 -
         done
     else
         find meta -maxdepth 1 -name '*.txt' ! -name 'flatpak.txt' -print0 \
             | xargs -0 cat \
             | sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' \
             | sort -u | paru -S --needed --noconfirm --ask=4 -
-        if [ -f meta/flatpak.txt ]; then
-            ids=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' meta/flatpak.txt)
-            # shellcheck disable=SC2086
-            [ -n "$ids" ] && install_flatpaks $ids
-        fi
+        [ -f meta/flatpak.txt ] && just _flatpak-install
     fi
 
 # Top up missing packages in groups that are already ≥50% installed (never installs new groups)
@@ -1035,7 +1055,11 @@ pkg-fix:
     flatpaks=$(flatpak list --user --app --columns=application 2>/dev/null || true)
     for file in meta/*.txt; do
         group=$(basename "$file" .txt)
-        pkgs=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file")
+        if [ "$group" = "flatpak" ]; then
+            pkgs=$(awk '!/^[[:space:]]*(#|$)/ {print $1}' "$file")
+        else
+            pkgs=$(sed -E 's/[[:space:]]*#.*$//; /^[[:space:]]*$/d' "$file")
+        fi
         total=$(echo "$pkgs" | wc -l)
         installed=0
         for pkg in $pkgs; do
@@ -1048,10 +1072,7 @@ pkg-fix:
         if [ $((installed * 2)) -ge "$total" ] && [ "$installed" -lt "$total" ]; then
             echo ">>> topping up $group ($installed/$total installed)"
             if [ "$group" = "flatpak" ]; then
-                flatpak remote-add --if-not-exists --user flathub \
-                    https://dl.flathub.org/repo/flathub.flatpakrepo >/dev/null
-                # shellcheck disable=SC2086
-                flatpak install --user -y --noninteractive flathub $pkgs
+                just _flatpak-install
             else
                 echo "$pkgs" | paru -S --needed --noconfirm --ask=4 -
             fi
@@ -1111,6 +1132,34 @@ _chezmoi-init:
 _install-hooks:
     git config core.hooksPath .githooks
 
+# Install all flatpaks declared in meta/flatpak.txt. Flathub IDs are batched
+# into a single install call; URL bundles are downloaded and installed only
+# when the app id is not already present (use `flatpak-update` to pick up
+# new versions of bundle entries).
+_flatpak-install:
+    #!/bin/sh
+    set -eu
+    [ -f meta/flatpak.txt ] || exit 0
+    flatpak remote-add --if-not-exists --user flathub \
+        https://dl.flathub.org/repo/flathub.flatpakrepo >/dev/null
+    flathub_ids=$(awk '!/^[[:space:]]*(#|$)/ && NF==1 {print $1}' meta/flatpak.txt)
+    if [ -n "$flathub_ids" ]; then
+        # shellcheck disable=SC2086
+        flatpak install --user -y --noninteractive flathub $flathub_ids
+    fi
+    installed=$(flatpak list --user --app --columns=application 2>/dev/null || true)
+    awk '!/^[[:space:]]*(#|$)/ && NF>=2 {print $1, $2}' meta/flatpak.txt \
+        | while read -r id url; do
+            if printf '%s\n' "$installed" | grep -qxF "$id"; then
+                continue
+            fi
+            echo ">>> downloading $id from $url"
+            tmp=$(mktemp --suffix=.flatpak)
+            curl -fsSL -o "$tmp" "$url"
+            flatpak install --user -y --noninteractive "$tmp"
+            rm -f "$tmp"
+        done
+
 # Print packages from pacman groups that are ≥50% installed (adopted), one per line
 _active-packages:
     #!/bin/sh
diff --git a/meta/extra.txt b/meta/extra.txt
index f08953d..3936385 100644
--- a/meta/extra.txt
+++ b/meta/extra.txt
@@ -2,7 +2,6 @@ gpg-tui
 pandoc-bin
 syncthing
 udisks2
-autenticacao-gov-pt-bin
 
 # Flatpak runtime (apps tracked in meta/flatpak.txt)
 flatpak
diff --git a/meta/flatpak.txt b/meta/flatpak.txt
index 9635831..5fdd5ec 100644
--- a/meta/flatpak.txt
+++ b/meta/flatpak.txt
@@ -1,8 +1,20 @@
-# Flathub app IDs. Managed by `just pkg-*` recipes via the magic
-# `flatpak` group name (see justfile). Installed with --user scope.
+# Flatpak apps. Managed by `just pkg-*` recipes via the magic `flatpak`
+# group name (see justfile). Installed with --user scope.
+#
+# Each non-comment line is one of:
+#   <app.id>            installed from Flathub
+#   <app.id>  <url>     installed from the .flatpak bundle at <url>
+#
+# Bundle entries are re-downloaded on `just flatpak-update` whenever the
+# version embedded in the URL differs from the installed version.
 
 io.gitlab.librewolf-community
 org.chromium.Chromium
 org.kde.okular
 org.libreoffice.LibreOffice
 org.torproject.torbrowser-launcher
+
+# Portuguese Citizen Card (eID) middleware + GUI. Not on Flathub; ships
+# as a standalone .flatpak bundle from upstream. Bump version by editing
+# the URL when amagovpt/autenticacao.gov publishes a new release.
+pt.gov.autenticacao  https://github.com/amagovpt/autenticacao.gov/releases/download/v3.14.0/pteid-mw-3.14.0-pcsclite-2.3.flatpak