chore(changelog): update changelog for v0.5.1

- Replaces custom release and changelog logic with auto-changelog action
- Reduces complexity and maintenance effort in the release process
- Ensures consistent changelog generation and release creation

.gitea/default_merge_message/MERGE_TEMPLATE.md

@@ -0,0 +1,5 @@
+chore(pr): ${PullRequestTitle} ${PullRequestReference}
+
+${PullRequestDescription}
+
+Merged from ${HeadBranch} into ${BaseBranch}

.gitea/workflows/ci.yml

@@ -36,11 +36,19 @@ jobs:
         continue-on-error: true
         run: deno task test
 
+      - name: Compile
+        id: compile
+        continue-on-error: true
+        run: |
+          deno task build:amd64
+          deno task build:arm64
+
       - name: Fail if any step failed
         if: |
           steps.format.outcome != 'success' ||
           steps.lint.outcome != 'success' ||
-          steps.test.outcome != 'success'
+          steps.test.outcome != 'success' ||
+          steps.compile.outcome != 'success'
         run: |
           echo "::error::One or more steps failed"
           exit 1

.gitea/workflows/release.yml

@@ -7,217 +7,13 @@ on:
       - "**"
 
 jobs:
-  detect-version-change:
-    runs-on: ubuntu-latest
-    outputs:
-      version_changed: ${{ steps.set.outputs.version_changed }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Check if VERSION file changed
-        if: github.ref == 'refs/heads/main'
-        run: |
-          echo "🔍 Vergleich mit github.event.before:"
-          echo "Before: ${{ github.event.before }}"
-          echo "After:  ${{ github.sha }}"
-
-          echo "📄 Changed files between before and after:"
-          git diff --name-only ${{ github.event.before }} ${{ github.sha }} || echo "(diff failed)"
-
-          if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^VERSION$'; then
-            echo "✅ VERSION file was changed"
-            echo "VERSION_CHANGED=true" >> $GITHUB_ENV
-          else
-            echo "ℹ️ VERSION file not changed"
-            echo "VERSION_CHANGED=false" >> $GITHUB_ENV
-          fi
-
-      - name: Set output (always)
-        id: set
-        run: |
-          echo "version_changed=${VERSION_CHANGED:-false}" >> $GITHUB_OUTPUT
-
-  changelog-only:
-    needs: detect-version-change
-    if: github.ref != 'refs/heads/main' || needs.detect-version-change.outputs.version_changed == 'false'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set Git Author
-        run: |
-          git config user.name "$CI_COMMIT_AUTHOR_NAME"
-          git config user.email "$CI_COMMIT_AUTHOR_EMAIL"
-
-      - name: Read CLIFF_VERSION from cliff.toml
-        id: cliff_version
-        run: |
-          echo "version=$(awk -F '=' '/^# CLIFF_VERSION=/ { gsub(/[" ]/, "", $2); print $2 }' cliff.toml)" >> $GITHUB_OUTPUT
-
-      - name: Restore git-cliff cache
-        id: restore-cliff
-        uses: https://git.0xmax42.io/actions/cache@v1
-        with:
-          key: cargo-cliff-${{ steps.cliff_version.outputs.version }}
-          paths: |
-            /root/.cargo/bin
-
-      - name: Install git-cliff
-        if: steps.restore-cliff.outputs.cache-hit != 'true'
-        run: |
-          cargo install git-cliff --version "${{ steps.cliff_version.outputs.version }}" --features gitea
-
-      - name: Generate unreleased changelog (if file exists or on main)
-        run: |
-          if [[ -f CHANGELOG.md || "${GITHUB_REF##refs/heads/}" == "main" ]]; then
-            echo "Generating CHANGELOG.md..."
-            git-cliff -c cliff.toml -o CHANGELOG.md
-          else
-            echo "CHANGELOG.md does not exist and this is not 'main'. Skipping generation."
-          fi
-
-      - name: Commit updated CHANGELOG
-        run: |
-          git add CHANGELOG.md
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-          else
-            git commit -m "chore(changelog): update unreleased changelog"
-            git push origin "${GITHUB_REF##refs/heads/}"
-          fi
-
   release:
-    needs: detect-version-change
-    if: needs.detect-version-change.outputs.version_changed == 'true' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
+      - name: Release
-      - name: Set Git Author
+        uses: https://git.0xmax42.io/actions/auto-changelog-release-action@v0
-        run: |
-          git config user.name "$CI_COMMIT_AUTHOR_NAME"
-          git config user.email "$CI_COMMIT_AUTHOR_EMAIL"
-
-      - name: Read VERSION
-        id: version
-        run: echo "value=$(cat VERSION)" >> $GITHUB_OUTPUT
-
-      - name: Read CLIFF_VERSION from cliff.toml
-        id: cliff_version
-        run: |
-          echo "version=$(awk -F '=' '/^# CLIFF_VERSION=/ { gsub(/[" ]/, "", $2); print $2 }' cliff.toml)" >> $GITHUB_OUTPUT
-
-      - name: Restore git-cliff cache
-        id: restore-cliff
-        uses: https://git.0xmax42.io/actions/cache@v1
         with:
-          key: cargo-cliff-${{ steps.cliff_version.outputs.version }}
+          token: ${{ secrets.RELEASE_PUBLISH_TOKEN }}
-          paths: |
-            /root/.cargo/bin
-
-      - name: Install git-cliff
-        if: steps.restore-cliff.outputs.cache-hit != 'true'
-        run: |
-          cargo install git-cliff --version "${{ steps.cliff_version.outputs.version }}" --features gitea
-
-      - name: Generate changelog for release and tag
-        id: generate-changelog
-        run: |
-          VERSION=${{ steps.version.outputs.value }}
-          git-cliff -c cliff.toml -t "v$VERSION" -o CHANGELOG.md
-
-          BODY=$(mktemp)
-          ESCAPED_VERSION=$(echo "$VERSION" | sed 's/\./\\./g')
-
-          awk -v ver="$ESCAPED_VERSION" '
-            $0 ~ "^## \\[" ver "\\]" {
-              print_flag=1
-              line = $0
-              sub(/^## /, "", line)
-              sub(/\\s*\\(.*\\)/, "", line)  # entfernt z. B. "(...)" oder "(*)"
-              print line
-              next
-            }
-            $0 ~ "^## \\[" && $0 !~ "^## \\[" ver "\\]" {
-              print_flag=0
-            }
-            print_flag
-          ' CHANGELOG.md > "$BODY"
-
-          echo "changelog_body_path=$BODY" >> $GITHUB_OUTPUT
-
-      - name: Commit updated CHANGELOG
-        run: |
-          git add CHANGELOG.md
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-          else
-            git commit -m "chore(changelog): update changelog for v${{ steps.version.outputs.value }}"
-            git push origin main
-          fi
-
-      - name: Create Git tag (if not exists)
-        run: |
-          VERSION=${{ steps.version.outputs.value }}
-          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
-            echo "Tag v$VERSION already exists, skipping tag creation."
-          else
-            export GIT_AUTHOR_DATE="$(date --iso-8601=seconds)"
-            export GIT_COMMITTER_DATE="$GIT_AUTHOR_DATE"
-            git tag -a "v$VERSION" -F "${{ steps.generate-changelog.outputs.changelog_body_path }}" --cleanup=verbatim
-            git push origin "v$VERSION"
-          fi
-
-      - name: Create Gitea release
-        env:
-          RELEASE_PUBLISH_TOKEN: ${{ secrets.RELEASE_PUBLISH_TOKEN }}
-        run: |
-          VERSION=${{ steps.version.outputs.value }}
-          BODY_FILE="${{ steps.generate-changelog.outputs.changelog_body_path }}"
-
-          OWNER=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f1)
-          REPO=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f2)
-
-          # Token-Auswahl
-          TOKEN="${RELEASE_PUBLISH_TOKEN:-$ACTIONS_RUNTIME_TOKEN}"
-
-          if [[ -z "${RELEASE_PUBLISH_TOKEN:-}" ]]; then
-            echo "::warning title=Limited Release Propagation::"
-            echo "RELEASE_PUBLISH_TOKEN is not set. Using ACTIONS_RUNTIME_TOKEN instead."
-            echo "⚠️  Release events may not trigger other workflows if created with the runtime token."
-            echo
-          fi
-
-          # Prüfe, ob der Release schon existiert
-          if curl -sf "$GITHUB_API_URL/repos/$OWNER/$REPO/releases/tags/v$VERSION" \
-            -H "Authorization: token $TOKEN" > /dev/null; then
-            echo "🔁 Release for tag v$VERSION already exists, skipping."
-            exit 0
-          fi
-
-          echo "🚀 Creating Gitea release for v$VERSION"
-
-          # Release-Beschreibung vorbereiten
-          RELEASE_BODY=$(tail -n +2 "$BODY_FILE" | jq -Rs .)
-
-          curl -X POST "$GITHUB_API_URL/repos/$OWNER/$REPO/releases" \
-            -H "Authorization: token $TOKEN" \
-            -H "Content-Type: application/json" \
-            -d @- <<EOF
-          {
-            "tag_name": "v$VERSION",
-            "target_commitish": "main",
-            "name": "Release v$VERSION",
-            "body": $RELEASE_BODY,
-            "draft": false,
-            "prerelease": false
-          }
-          EOF
-
-          echo "✅ Release for tag $VERSION created successfully."

.gitea/workflows/upload-assets.yml

@@ -43,6 +43,22 @@ jobs:
       - name: Upload SHA256 for ${{ matrix.target }}-${{ matrix.arch }}
         run: .gitea/scripts/upload-asset.sh ./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.sha256 systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.sha256
 
+      - name: Create zstd compressed archive
+        run: |
+          FILE="./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}"
+          zstd -q -19 -T0 -f "$FILE" -o "$FILE.zst"
+
+      - name: Generate SHA256 for zstd compressed archive
+        run: |
+          FILE="./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst"
+          sha256sum "$FILE" > "$FILE.sha256"
+
+      - name: Upload zstd compressed archive for ${{ matrix.target }}-${{ matrix.arch }}
+        run: .gitea/scripts/upload-asset.sh ./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst
+
+      - name: Upload SHA256 for zstd compressed archive
+        run: .gitea/scripts/upload-asset.sh ./dist/systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst.sha256 systemd-timer-${{ matrix.target }}-${{ matrix.arch }}.zst.sha256
+
       - name: Run Releases Sync Action
         uses: https://git.0xmax42.io/actions/releases-sync@main
         with:

.vscode/settings.json

@@ -17,5 +17,8 @@
     "[json]": {
         "editor.defaultFormatter": "denoland.vscode-deno"
     },
+    "[jsonc]": {
+        "editor.defaultFormatter": "denoland.vscode-deno"
+    },
     "editor.formatOnSave": true
 }

CHANGELOG.md

@@ -2,6 +2,57 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.5.1](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.5.0..v0.5.1) - 2025-06-15
+
+### 🚀 Features
+
+- *(install)* Add support for compressed .zst archives - ([3a1ee0c](https://git.0xmax42.io/maxp/systemd-timer/commit/3a1ee0cfd6ddba8734cde09196803e9ccdd14c5f))
+- *(workflows)* Add zstd compression for build artifacts - ([d9183d2](https://git.0xmax42.io/maxp/systemd-timer/commit/d9183d2f04b03cbdaf9e11bf05f7ce66111123e5))
+
+### 📚 Documentation
+
+- *(readme)* Add input validation and multilingual support - ([ce78cf3](https://git.0xmax42.io/maxp/systemd-timer/commit/ce78cf3a9a14028114e0fb6fcc0973d86c2b2227))
+
+### ⚙️ Miscellaneous Tasks
+
+- *(workflows)* Simplify release workflow with auto-changelog - ([05f3b51](https://git.0xmax42.io/maxp/systemd-timer/commit/05f3b519f56d893a0135736d8b722302c7cdd3f6))
+- *(workflows)* Add locked flag to cargo install for git-cliff - ([6efc151](https://git.0xmax42.io/maxp/systemd-timer/commit/6efc1515ed4f4fb8802405529e4a6e04870ec02a))
+
+## [0.5.0](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.4.1..v0.5.0) - 2025-05-30
+
+### 🚀 Features
+
+- *(cli)* Add validation for command options - ([1c07af4](https://git.0xmax42.io/maxp/systemd-timer/commit/1c07af402b35ba4c2abf89ff5816e791994db536))
+- *(validation)* Add CLI validation helpers for input checks - ([3d95706](https://git.0xmax42.io/maxp/systemd-timer/commit/3d95706d683cac8d279dfb718541a17c42fa5d71))
+- *(build)* Add run permissions to compiled binaries - ([ccb04e4](https://git.0xmax42.io/maxp/systemd-timer/commit/ccb04e49820ff8238d7e7ad853aab5db06d5dc8a))
+- *(ci)* Add compile steps to CI workflow - ([531a02a](https://git.0xmax42.io/maxp/systemd-timer/commit/531a02a6e11a769f2e05888d49ea2b4808d974e3))
+- *(vscode)* Add JSONC formatter configuration - ([c7af1fb](https://git.0xmax42.io/maxp/systemd-timer/commit/c7af1fb6caa46c22b84229745067d05bf60b6f64))
+- *(i18n)* Support loading JSONC translation files - ([4ac5dd4](https://git.0xmax42.io/maxp/systemd-timer/commit/4ac5dd4c88324f99cb6827283ad85bb9718abbeb))
+- *(config)* Add @std/jsonc dependency - ([8f1cb3f](https://git.0xmax42.io/maxp/systemd-timer/commit/8f1cb3fad71ead365d93087963ddb6c7202a9b4f))
+
+### 🐛 Bug Fixes
+
+- *(build)* Update included files to use .jsonc format - ([f3f2c61](https://git.0xmax42.io/maxp/systemd-timer/commit/f3f2c61da0785dce4c6b8c7d8ef0ae9abf098172))
+
+### 🎨 Styling
+
+- *(i18n)* Add comments for clarity and rename files - ([5226269](https://git.0xmax42.io/maxp/systemd-timer/commit/5226269ec2a0b76dfa30ac8d614c3789ff3a837b))
+
+### 🧪 Testing
+
+- *(fs)* Update test descriptions and comments to English - ([c4f4614](https://git.0xmax42.io/maxp/systemd-timer/commit/c4f4614a2daee68f9b33b9676106214c65a1a427))
+- *(fs)* Add rollback tests for writeUnitFiles errors - ([6039d23](https://git.0xmax42.io/maxp/systemd-timer/commit/6039d236eb7de449ce22b1d9ea718389a3e2261d))
+
+### ⚙️ Miscellaneous Tasks
+
+- *(lock)* Update dependencies to latest versions - ([28b23cf](https://git.0xmax42.io/maxp/systemd-timer/commit/28b23cf947ecc57eb7fde541b29c68b41e508e7d))
+
+## [0.4.1](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.4.0..v0.4.1) - 2025-05-28
+
+### 🐛 Bug Fixes
+
+- *(tasks)* Add read permissions to build scripts - ([a22c156](https://git.0xmax42.io/maxp/systemd-timer/commit/a22c156dd3d2cf4a24f0eed699f7dfabfae3837a))
+
 ## [0.4.0](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.3.1..v0.4.0) - 2025-05-28
 
 ### 🚀 Features

README.DE.md

@@ -23,6 +23,9 @@ Ein einfaches CLI-Tool zum schnellen Erzeugen von systemd `.service` und `.timer
   - `--cwd`: Arbeitsverzeichnis des Prozesses (`WorkingDirectory`)
   - `--dry-run`: Gibt nur die generierten Inhalte aus, ohne sie zu schreiben
 - Getestet und typisiert mit **Deno** + **Cliffy**
+- Eingaben werden validiert und auf Fehler geprüft;
+  - z.B. muss `--calendar` ein gültiger systemd `OnCalendar` Ausdruck sein
+- Mehrsprachig (Englisch, Deutsch)
 
 ---
 

README.md

@@ -24,6 +24,9 @@ A simple CLI tool for quickly generating systemd `.service` and `.timer` units
   * `--cwd`: Working directory for the process (`WorkingDirectory`)
   * `--dry-run`: Outputs unit content without writing to disk
 * Tested and fully typed with **Deno** + **Cliffy**
+* Inputs are validated and checked for errors;
+  * e.g., `--calendar` must be a valid systemd `OnCalendar` expression
+* Multilingual (English, German)
 
 ---
 

VERSION

@@ -1 +1 @@
-0.4.0
+0.5.1

deno.jsonc

@@ -4,9 +4,9 @@
         "test": "deno test -A --coverage **/__tests__/*.test.ts",
         "fmt": "deno fmt --check",
         "lint": "deno lint",
-        "ci": "deno task fmt && deno task lint && deno task test", // For local CI checks
+        "ci": "deno task fmt && deno task lint && deno task test && build:amd64", // For local CI checks
-        "build:amd64": "deno compile --target x86_64-unknown-linux-gnu --include VERSION --include src/i18n/de.json --include src/i18n/en.json --allow-env --allow-write --output dist/systemd-timer-linux-amd64 src/mod.ts",
+        "build:amd64": "deno compile --target x86_64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --allow-run --output dist/systemd-timer-linux-amd64 src/mod.ts",
-        "build:arm64": "deno compile --target aarch64-unknown-linux-gnu --include VERSION --include src/i18n/de.json --include src/i18n/en.json --allow-env --allow-write --output dist/systemd-timer-linux-arm64 src/mod.ts"
+        "build:arm64": "deno compile --target aarch64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --allow-run --output dist/systemd-timer-linux-arm64 src/mod.ts"
     },
     "compilerOptions": {},
     "fmt": {
@@ -23,6 +23,7 @@
     },
     "exclude": [],
     "imports": {
-        "@cliffy/command": "jsr:@cliffy/command@1.0.0-rc.7"
+        "@cliffy/command": "jsr:@cliffy/command@1.0.0-rc.7",
+        "@std/jsonc": "jsr:@std/jsonc@^1.0.2"
     }
 }

deno.lock

@@ -6,6 +6,8 @@
     "jsr:@cliffy/internal@1.0.0-rc.7": "1.0.0-rc.7",
     "jsr:@cliffy/table@1.0.0-rc.7": "1.0.0-rc.7",
     "jsr:@std/fmt@~1.0.2": "1.0.7",
+    "jsr:@std/json@^1.0.2": "1.0.2",
+    "jsr:@std/jsonc@^1.0.2": "1.0.2",
     "jsr:@std/text@~1.0.7": "1.0.13"
   },
   "jsr": {
@@ -37,11 +39,24 @@
     "@std/fmt@1.0.7": {
       "integrity": "2a727c043d8df62cd0b819b3fb709b64dd622e42c3b1bb817ea7e6cc606360fb"
     },
+    "@std/json@1.0.2": {
+      "integrity": "d9e5497801c15fb679f55a2c01c7794ad7a5dfda4dd1bebab5e409cb5e0d34d4"
+    },
+    "@std/jsonc@1.0.2": {
+      "integrity": "909605dae3af22bd75b1cbda8d64a32cf1fd2cf6efa3f9e224aba6d22c0f44c7",
+      "dependencies": [
+        "jsr:@std/json"
+      ]
+    },
     "@std/text@1.0.13": {
       "integrity": "2191c90e6e667b0c3b7dea1cd082137580a93b3c136bad597c0212d5fe006eb1"
     }
   },
   "remote": {
+    "https://deno.land/std@0.192.0/fmt/colors.ts": "d67e3cd9f472535241a8e410d33423980bec45047e343577554d3356e1f0ef4e",
+    "https://deno.land/std@0.192.0/testing/_diff.ts": "1a3c044aedf77647d6cac86b798c6417603361b66b54c53331b312caeb447aea",
+    "https://deno.land/std@0.192.0/testing/_format.ts": "a69126e8a469009adf4cf2a50af889aca364c349797e63174884a52ff75cf4c7",
+    "https://deno.land/std@0.192.0/testing/asserts.ts": "e16d98b4d73ffc4ed498d717307a12500ae4f2cbe668f1a215632d19fcffc22f",
     "https://deno.land/std@0.224.0/assert/_constants.ts": "a271e8ef5a573f1df8e822a6eb9d09df064ad66a4390f21b3e31f820a38e0975",
     "https://deno.land/std@0.224.0/assert/assert.ts": "09d30564c09de846855b7b071e62b5974b001bb72a4b797958fe0660e7849834",
     "https://deno.land/std@0.224.0/assert/assert_almost_equals.ts": "9e416114322012c9a21fa68e187637ce2d7df25bcbdbfd957cd639e65d3cf293",
@@ -168,11 +183,13 @@
     "https://deno.land/std@0.224.0/path/windows/relative.ts": "3e1abc7977ee6cc0db2730d1f9cb38be87b0ce4806759d271a70e4997fc638d7",
     "https://deno.land/std@0.224.0/path/windows/resolve.ts": "8dae1dadfed9d46ff46cc337c9525c0c7d959fb400a6308f34595c45bdca1972",
     "https://deno.land/std@0.224.0/path/windows/to_file_url.ts": "40e560ee4854fe5a3d4d12976cef2f4e8914125c81b11f1108e127934ced502e",
-    "https://deno.land/std@0.224.0/path/windows/to_namespaced_path.ts": "4ffa4fb6fae321448d5fe810b3ca741d84df4d7897e61ee29be961a6aac89a4c"
+    "https://deno.land/std@0.224.0/path/windows/to_namespaced_path.ts": "4ffa4fb6fae321448d5fe810b3ca741d84df4d7897e61ee29be961a6aac89a4c",
+    "https://deno.land/std@0.224.0/testing/mock.ts": "a963181c2860b6ba3eb60e08b62c164d33cf5da7cd445893499b2efda20074db"
   },
   "workspace": {
     "dependencies": [
-      "jsr:@cliffy/command@1.0.0-rc.7"
+      "jsr:@cliffy/command@1.0.0-rc.7",
+      "jsr:@std/jsonc@^1.0.2"
     ]
   }
 }

scripts/install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Fail-safe bash mode (only if bash is used)
+# Fail-safe bash mode
 if [ -n "$BASH_VERSION" ]; then
   set -euo pipefail
 else
@@ -26,37 +26,71 @@ case "$OS" in
   *) echo "Unsupported OS: $OS" >&2; exit 1 ;;
 esac
 
-# === Download-URL zusammensetzen ===
+# === Datei- und URL-Namen ===
-BINARY_FILE="${BINARY_NAME}-${OS}-${ARCH}"
+BASE_NAME="${BINARY_NAME}-${OS}-${ARCH}"
-DOWNLOAD_URL="${REPO_URL}/${BINARY_FILE}"
+ZST_NAME="${BASE_NAME}.zst"
+ZST_URL="${REPO_URL}/${ZST_NAME}"
+BIN_URL="${REPO_URL}/${BASE_NAME}"
 
 echo "📦 Installing ${BINARY_NAME} for ${OS}/${ARCH}..."
-echo "🌐 Downloading from: ${DOWNLOAD_URL}"
 
-# === Binary herunterladen ===
+USE_ZSTD=false
-TMP_FILE=$(mktemp)
+if command -v zstd >/dev/null; then
-curl -fsSL "${DOWNLOAD_URL}" -o "${TMP_FILE}"
+  echo "✅ 'zstd' found – will use compressed .zst archive"
-chmod +x "${TMP_FILE}"
+  USE_ZSTD=true
-
-# === SHA256-Check ===
-TMP_HASH=$(mktemp)
-curl -fsSL "${DOWNLOAD_URL}.sha256" -o "$TMP_HASH"
-EXPECTED_HASH=$(cut -d ' ' -f1 "$TMP_HASH")
-ACTUAL_HASH=$(openssl dgst -sha256 "$TMP_FILE" | awk '{print $2}')
-
-if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
-  echo "⚠️ Checksum mismatch!"
-  echo "Expected: $EXPECTED_HASH"
-  echo "Actual:   $ACTUAL_HASH"
-  exit 1
 fi
 
-# === Installation ===
+TMP_DIR=$(mktemp -d)
+cleanup() {
+  rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
+
+if [ "$USE_ZSTD" = true ]; then
+  echo "🌐 Downloading: ${ZST_URL}"
+  curl -fsSL "$ZST_URL" -o "$TMP_DIR/${ZST_NAME}"
+  echo "🌐 Downloading checksum: ${ZST_URL}.sha256"
+  curl -fsSL "$ZST_URL.sha256" -o "$TMP_DIR/zst.sha256"
+
+  EXPECTED_HASH=$(cut -d ' ' -f1 "$TMP_DIR/zst.sha256")
+  ACTUAL_HASH=$(openssl dgst -sha256 "$TMP_DIR/${ZST_NAME}" | awk '{print $2}')
+
+  if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
+    echo "⚠️ Checksum mismatch for .zst archive!"
+    echo "Expected: $EXPECTED_HASH"
+    echo "Actual:   $ACTUAL_HASH"
+    exit 1
+  fi
+
+  echo "📥 Decompressing..."
+  zstd -d -q "$TMP_DIR/${ZST_NAME}" -o "$TMP_DIR/${BASE_NAME}"
+  TMP_FILE="$TMP_DIR/${BASE_NAME}"
+
+else
+  echo "🌐 Downloading uncompressed binary: ${BIN_URL}"
+  curl -fsSL "$BIN_URL" -o "$TMP_DIR/${BASE_NAME}"
+  echo "🌐 Downloading checksum: ${BIN_URL}.sha256"
+  curl -fsSL "$BIN_URL.sha256" -o "$TMP_DIR/binary.sha256"
+
+  EXPECTED_HASH=$(cut -d ' ' -f1 "$TMP_DIR/binary.sha256")
+  ACTUAL_HASH=$(openssl dgst -sha256 "$TMP_DIR/${BASE_NAME}" | awk '{print $2}')
+
+  if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
+    echo "⚠️ Checksum mismatch!"
+    echo "Expected: $EXPECTED_HASH"
+    echo "Actual:   $ACTUAL_HASH"
+    exit 1
+  fi
+
+  TMP_FILE="$TMP_DIR/${BASE_NAME}"
+fi
+
+chmod +x "$TMP_FILE"
 echo "🚀 Installing to ${INSTALL_PATH}/${BINARY_NAME}"
 if [ -w "$INSTALL_PATH" ]; then
-  install -m 755 "${TMP_FILE}" "${INSTALL_PATH}/${BINARY_NAME}"
+  install -m 755 "$TMP_FILE" "${INSTALL_PATH}/${BINARY_NAME}"
 else
-  sudo install -m 755 "${TMP_FILE}" "${INSTALL_PATH}/${BINARY_NAME}"
+  sudo install -m 755 "$TMP_FILE" "${INSTALL_PATH}/${BINARY_NAME}"
 fi
 
 echo "✅ Installation complete: $(command -v ${BINARY_NAME})"

src/cli/create.ts

@@ -2,6 +2,14 @@ import { Command } from '@cliffy/command';
 import { generateUnitFiles } from '../templates/unit-generator.ts';
 import { TimerOptions } from '../types/options.ts';
 import { t } from '../i18n/mod.ts';
+import {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from '../utils/mod.ts';
 
 export function createCommand() {
     return new Command()
@@ -9,43 +17,54 @@ export function createCommand() {
         .option(
             '--name <name:string>',
             t('option_name'),
+            { value: (v) => validateIdentifier(v, '--name') },
         )
         .option(
             '--exec <cmd:string>',
             t('option_exec'),
-            { required: true },
+            {
+                required: true,
+                value: (v) => validateNotEmpty(v, '--exec'),
+            },
         )
         .option('--calendar <time:string>', t('option_calendar'), {
             required: true,
+            value: validateSystemdCalendar,
         })
         .option('--description <desc:string>', t('option_description'))
         .option('--user', t('option_user'))
         .option(
             '--run-as <user:string>',
             t('option_run_as'),
+            { value: (v) => validateNotEmpty(v, '--run-as') },
         )
         .option(
             '--home <path:string>',
             t('option_home'),
+            { value: (v) => validatePath(v, true) },
         )
         .option(
             '--cwd <path:string>',
             t('option_cwd'),
+            { value: (v) => validatePath(v, true) },
         )
-        .option('--output <dir:string>', t('option_output'))
+        .option('--output <dir:string>', t('option_output'), {
+            value: (v) => validatePath(v, false),
+        })
         .option(
             '--after <target:string>',
             t('option_after'),
-            { collect: true },
+            { collect: true, value: collectAndValidateAfter },
         )
         .option(
             '--environment <env:string>',
             t('option_environment'),
-            { collect: true },
+            { collect: true, value: collectAndValidateEnv },
         )
         .option(
             '--logfile <file:string>',
             t('option_logfile'),
+            { value: (v) => validatePath(v, false) },
         )
         .option('--dry-run', t('option_dry_run'))
         .action(async (options: TimerOptions) => {

src/i18n/de.jsonc

@@ -1,6 +1,8 @@
 {
+    // General
     "cli_description": "CLI-Tool zum Erzeugen von systemd .timer und .service Units",
     "cli_create_description": "Erzeugt eine systemd .service und .timer Unit",
+    // Options
     "option_name": "Name der Unit-Dateien (optional, wird sonst aus dem Exec generiert)",
     "option_exec": "Kommando, das durch systemd ausgeführt werden soll",
     "option_calendar": "OnCalendar-Ausdruck für den Timer",
@@ -14,9 +16,17 @@
     "option_environment": "Environment-Variablen im Format KEY=VALUE",
     "option_logfile": "Dateipfad für Log-Ausgabe (stdout/stderr)",
     "option_dry_run": "Gibt die Unit-Dateien nur aus, ohne sie zu schreiben",
+    // Messages
     "unit_written_service": "Service Unit geschrieben in: {path}",
     "unit_written_timer": "Timer Unit geschrieben in: {path}",
     "hint_header": "\nℹ️  Hinweis:",
+    // Error messages
     "error_write_units": "Fehler beim Schreiben der Units:",
-    "rollback_failed": "Rollback fehlgeschlagen:"
+    "rollback_failed": "Rollback fehlgeschlagen:",
+    "error_invalid_env": "Ungültiges Environment-Format. Verwende KEY=VALUE.",
+    "error_path_schold_not_be_empty": "Pfad darf nicht leer sein.",
+    "error_path_not_found": "Pfad nicht gefunden: {path}",
+    "error_value_should_not_be_empty": "Wert ({label}) sollte nicht leer sein.",
+    "error_invalid_identifier": "Ungültiger Bezeichner: '{value}' für {identifier}. Erlaubt sind nur alphanumerische Zeichen, Unterstriche und Bindestriche.",
+    "error_invalid_calendar": "Ungültiger OnCalendar-Ausdruck: {value}. Bitte überprüfe die Syntax."
 }

src/i18n/en.jsonc

@@ -1,6 +1,8 @@
 {
+    // General
     "cli_description": "CLI tool for generating systemd .timer and .service units",
     "cli_create_description": "Generates a systemd .service and .timer unit",
+    // Options
     "option_name": "Name of the unit files (optional, otherwise derived from the exec command)",
     "option_exec": "Command to be executed by systemd",
     "option_calendar": "OnCalendar expression for the timer",
@@ -14,9 +16,17 @@
     "option_environment": "Environment variables in the format KEY=VALUE",
     "option_logfile": "File path for log output (stdout/stderr)",
     "option_dry_run": "Only outputs the unit files without writing them",
+    // Messages
     "unit_written_service": "Service unit written to: {path}",
     "unit_written_timer": "Timer unit written to: {path}",
     "hint_header": "\nℹ️  Note:",
+    // Error messages
     "error_write_units": "Error while writing unit files:",
-    "rollback_failed": "Rollback failed:"
+    "rollback_failed": "Rollback failed:",
+    "error_invalid_env": "Invalid environment format. Use KEY=VALUE.",
+    "error_path_schold_not_be_empty": "Path should not be empty.",
+    "error_path_not_found": "Path not found: {path}",
+    "error_value_should_not_be_empty": "Value ({label}) should not be empty.",
+    "error_invalid_identifier": "Invalid identifier: '{value}' for {identifier}. Only alphanumeric characters, underscores, and hyphens are allowed.",
+    "error_invalid_calendar": "Invalid OnCalendar expression: {value}. Please check the syntax."
 }

src/i18n/i18n.ts

@@ -1,3 +1,5 @@
+import { parse as parseJsonc } from '@std/jsonc';
+
 /**
  * Initializes the i18n module by loading
  * the appropriate locale file based on the system language.
@@ -15,29 +17,35 @@ let translations: Record<string, string> = {};
 /**
  * Loads the translation file for the specified locale.
  *
- * Expects a JSON file in the same directory named like `de.json` or `en.json`.
+ * Accepts both `.jsonc` (JSON with comments) and plain `.json`.
+ * When both exist, `.jsonc` takes precedence.
  * Falls back to English ('en') if the specified file does not exist.
  *
  * @param locale - The language code (e.g., 'de', 'en') to load
  * @returns Promise that resolves once the translations have been loaded
  */
 export async function loadLocale(locale: string): Promise<void> {
-    try {
+    const extensions = ['jsonc', 'json'];
-        const localeUrl = new URL(`./${locale}.json`, import.meta.url);
+    for (const ext of extensions) {
-        const file = await Deno.readTextFile(localeUrl);
+        try {
-        translations = JSON.parse(file);
+            const localeUrl = new URL(`./${locale}.${ext}`, import.meta.url);
-    } catch (err) {
+            const raw = await Deno.readTextFile(localeUrl);
-        if (err instanceof Deno.errors.NotFound) {
+            // parseJsonc tolerates both pure JSON and JSONC, so we can use it for either.
-            console.warn(
+            translations = parseJsonc(raw) as Record<string, string>;
-                `Locale '${locale}' not found – falling back to 'en'.`,
+            return;
-            );
+        } catch (err) {
-            if (locale !== 'en') {
+            if (err instanceof Deno.errors.NotFound) {
-                await loadLocale('en');
+                // Continue with next extension.
+                continue;
             }
-        } else {
+            console.error(`Error parsing locale '${locale}.${ext}':`, err);
-            console.error('Error loading translation file:', err);
+            break;
         }
     }
+    if (locale !== 'en') {
+        console.warn(`Locale '${locale}' not found – falling back to 'en'.`);
+        await loadLocale('en');
+    }
 }
 
 /**

src/utils/__tests__/cliValidationHelper.test.ts

@@ -0,0 +1,145 @@
+import { resolve } from 'https://deno.land/std@0.224.0/path/mod.ts';
+import { ValidationError } from '@cliffy/command';
+import {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from '../mod.ts';
+import { t } from '../../i18n/mod.ts';
+import {
+    assertEquals,
+    assertThrows,
+} from 'https://deno.land/std@0.224.0/assert/mod.ts';
+
+Deno.test(
+    'collectAndValidateEnv: throws ValidationError for invalid env format',
+    () => {
+        const invalidEnv = 'INVALID_ENV';
+        assertThrows(
+            () => collectAndValidateEnv(invalidEnv),
+            ValidationError,
+            t('error_invalid_env', { value: invalidEnv }),
+        );
+    },
+);
+
+Deno.test(
+    'collectAndValidateEnv: returns collected array for valid env format',
+    () => {
+        const validEnv = 'KEY=value';
+        const previous = ['EXISTING=env'];
+        const result = collectAndValidateEnv(validEnv, previous);
+        assertEquals(result, ['EXISTING=env', 'KEY=value']);
+    },
+);
+
+Deno.test('collectAndValidateEnv: aggregates multiple calls', () => {
+    const first = collectAndValidateEnv('FOO=bar');
+    const second = collectAndValidateEnv('BAZ=qux', first);
+    assertEquals(second, ['FOO=bar', 'BAZ=qux']);
+});
+
+Deno.test(
+    'validatePath: returns absolute path for valid path without existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const relativePath = `${tmpDir}/testfile.txt`;
+        const result = validatePath(relativePath, false);
+        assertEquals(result, resolve(relativePath));
+    },
+);
+
+Deno.test(
+    'validatePath: throws ValidationError for non‑existent path with existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const nonExistentPath = `${tmpDir}/nonexistent.txt`;
+        assertThrows(
+            () => validatePath(nonExistentPath, true),
+            ValidationError,
+            t('error_path_not_found', { path: resolve(nonExistentPath) }),
+        );
+    },
+);
+
+Deno.test(
+    'validatePath: returns absolute path for existing path with existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const existingPath = `${tmpDir}/existing.txt`;
+        Deno.writeTextFileSync(existingPath, 'test content');
+        const result = validatePath(existingPath, true);
+        assertEquals(result, resolve(existingPath));
+    },
+);
+
+Deno.test('validatePath: throws ValidationError for empty path', () => {
+    const invalidPath = '';
+    assertThrows(
+        () => validatePath(invalidPath, true),
+        ValidationError,
+        t('error_path_schold_not_be_empty'),
+    );
+});
+
+Deno.test('validateNotEmpty: returns value for non‑empty string', () => {
+    const input = 'some-value';
+    const result = validateNotEmpty(input, '--exec');
+    assertEquals(result, input);
+});
+
+Deno.test('validateNotEmpty: throws ValidationError for empty string', () => {
+    const input = '';
+    assertThrows(
+        () => validateNotEmpty(input, '--exec'),
+        ValidationError,
+        t('error_value_should_not_be_empty', { label: '--exec' }),
+    );
+});
+
+Deno.test('collectAndValidateAfter: returns aggregated array', () => {
+    const first = collectAndValidateAfter('network.target');
+    const second = collectAndValidateAfter('postgres.service', first);
+    assertEquals(second, ['network.target', 'postgres.service']);
+});
+
+Deno.test('collectAndValidateAfter: throws ValidationError for empty value', () => {
+    assertThrows(
+        () => collectAndValidateAfter(''),
+        ValidationError,
+        t('error_value_should_not_be_empty', { label: '--after' }),
+    );
+});
+
+Deno.test('validateIdentifier: returns value for valid identifier', () => {
+    const id = 'backup_job-1';
+    const result = validateIdentifier(id, '--name');
+    assertEquals(result, id);
+});
+
+Deno.test('validateIdentifier: throws ValidationError for invalid identifier', () => {
+    const id = 'invalid$';
+    assertThrows(
+        () => validateIdentifier(id, '--name'),
+        ValidationError,
+        t('error_invalid_identifier', { label: '--name', value: id }),
+    );
+});
+
+Deno.test('validateSystemdCalendar: accepts valid expression', async () => {
+    const valid = 'Mon..Fri 12:00';
+    const result = await validateSystemdCalendar(valid);
+    assertEquals(result, valid);
+});
+
+Deno.test('validateSystemdCalendar: rejects invalid expression', async () => {
+    const invalid = 'Mo..Fr 12:00';
+    await assertThrows(
+        () => validateSystemdCalendar(invalid),
+        ValidationError,
+        t('error_invalid_calendar', { value: invalid }),
+    );
+});

src/utils/__tests__/fs.test.ts

@@ -3,11 +3,13 @@ import {
     assertExists,
     assertStringIncludes,
 } from 'https://deno.land/std@0.224.0/assert/mod.ts';
+import { stub } from 'https://deno.land/std@0.224.0/testing/mock.ts';
+import { exists } from 'https://deno.land/std@0.224.0/fs/mod.ts';
 import { join } from 'https://deno.land/std@0.224.0/path/mod.ts';
 import { resolveUnitTargetPath, writeUnitFiles } from '../mod.ts';
 import { TimerOptions } from '../../types/options.ts';
 
-Deno.test('writeUnitFiles schreibt .service und .timer korrekt', async () => {
+Deno.test('writeUnitFiles: writes .service and .timer files correctly', async () => {
     const tmp = await Deno.makeTempDir({ prefix: 'test-units-' });
 
     const options = {
@@ -26,15 +28,15 @@ Deno.test('writeUnitFiles schreibt .service und .timer korrekt', async () => {
         options as TimerOptions,
     ) as { servicePath: string; timerPath: string };
 
-    // Überprüfe Pfade
+    // Check file paths
     assertEquals(servicePath, join(tmp, 'test-backup.service'));
     assertEquals(timerPath, join(tmp, 'test-backup.timer'));
 
-    // Existieren Dateien?
+    // Check if files exist
     assertExists(await Deno.stat(servicePath));
     assertExists(await Deno.stat(timerPath));
 
-    // Enthält die Datei den erwarteten Inhalt?
+    // Check if file contents match expectations
     const readService = await Deno.readTextFile(servicePath);
     const readTimer = await Deno.readTextFile(timerPath);
 
@@ -42,18 +44,237 @@ Deno.test('writeUnitFiles schreibt .service und .timer korrekt', async () => {
     assertStringIncludes(readTimer, 'OnCalendar=daily');
 });
 
-Deno.test('resolveUnitTargetPath mit --output', () => {
+Deno.test('resolveUnitTargetPath: with --output', () => {
     const result = resolveUnitTargetPath({ output: '/tmp/units', user: false });
     assertEquals(result, '/tmp/units');
 });
 
-Deno.test('resolveUnitTargetPath mit --user ohne output', () => {
+Deno.test('resolveUnitTargetPath: with --user and no output', () => {
     Deno.env.set('HOME', '/home/maxp');
     const result = resolveUnitTargetPath({ output: undefined, user: true });
     assertEquals(result, '/home/maxp/.config/systemd/user');
 });
 
-Deno.test('resolveUnitTargetPath ohne output und ohne user', () => {
+Deno.test('resolveUnitTargetPath: with no output and no user', () => {
     const result = resolveUnitTargetPath({ output: undefined, user: false });
     assertEquals(result, '/etc/systemd/system');
 });
+
+Deno.test('writeUnitFiles: error writing .timer file triggers rollback', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'never',
+    };
+
+    const name = 'fail-timer';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=never';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    // Simulate: writing the .timer file fails
+    const originalWrite = Deno.writeTextFile;
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        async (path: string | URL, data: string | ReadableStream<string>) => {
+            if (typeof path === 'string' && path.endsWith('.timer')) {
+                throw new Error('Simulated write error');
+            } else {
+                return await originalWrite(path, data);
+            }
+        },
+    );
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+
+    // Expect: function returns undefined
+    assertEquals(result, undefined);
+
+    // Expect: both files have been deleted (rollback)
+    assertEquals(await exists(servicePath), false);
+    assertEquals(await exists(timerPath), false);
+
+    writeStub.restore();
+});
+
+Deno.test('writeUnitFiles: error writing .service file prevents further actions', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'weekly',
+    };
+
+    const name = 'fail-service';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=weekly';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    // Simulate: error writing the .service file
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        (path: string | URL, _data: string | ReadableStream<string>) => {
+            if (typeof path === 'string' && path.endsWith('.service')) {
+                throw new Error('Simulated service write error');
+            }
+            return Promise.resolve();
+        },
+    );
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+
+    // Expect: function returns undefined
+    assertEquals(result, undefined);
+
+    // Expect: no files were created
+    assertEquals(await exists(servicePath), false);
+    assertEquals(await exists(timerPath), false);
+
+    writeStub.restore();
+});
+
+Deno.test('writeUnitFiles: both files written, then error → full rollback', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'never',
+    };
+
+    const name = 'fail-after-write';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=never';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    let writeCount = 0;
+    const originalWriteTextFile = Deno.writeTextFile;
+
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        async (path: string | URL, data: string | ReadableStream<string>) => {
+            if (typeof path !== 'string') {
+                throw new Error('Unexpected path type');
+            }
+
+            // Simulate both writes, then throw an error after the second
+            writeCount++;
+
+            await originalWriteTextFile(path, data);
+
+            if (writeCount === 2) {
+                throw new Error('Simulated error after full write');
+            }
+        },
+    );
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+
+    // Expect: function returns undefined
+    assertEquals(result, undefined);
+
+    // Expect: both files were removed
+    assertEquals(await exists(servicePath), false);
+    assertEquals(await exists(timerPath), false);
+
+    writeStub.restore();
+});
+
+Deno.test('writeUnitFiles: rollback fails if files cannot be deleted', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'never',
+    };
+
+    const name = 'rollback-error';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=never';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    const originalWriteTextFile = Deno.writeTextFile;
+    const _originalRemove = Deno.remove;
+
+    let writeCount = 0;
+
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        async (path: string | URL, data: string | ReadableStream<string>) => {
+            writeCount++;
+            await originalWriteTextFile(path, data);
+            if (writeCount === 2) {
+                throw new Error('Error after full write');
+            }
+        },
+    );
+
+    const removeStub = stub(
+        Deno,
+        'remove',
+        // deno-lint-ignore require-await
+        async (_path: string | URL, _opts?: Deno.RemoveOptions) => {
+            throw new Error('Deletion forbidden!');
+        },
+    );
+
+    const logs: string[] = [];
+    const consoleStub = stub(console, 'error', (...args) => {
+        logs.push(args.map((a) => String(a)).join(' '));
+    });
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+    assertEquals(result, undefined);
+
+    // Files still exist because deletion failed
+    assertEquals(await exists(servicePath), true);
+    assertEquals(await exists(timerPath), true);
+
+    // Error output contains "rollback_failed"
+    const combinedLogs = logs.join('\n');
+    assertStringIncludes(combinedLogs, 'rollback_failed');
+
+    writeStub.restore();
+    removeStub.restore();
+    consoleStub.restore();
+});

src/utils/cliValidationHelper.ts

@@ -0,0 +1,176 @@
+import { ValidationError } from '@cliffy/command';
+import { t } from '../i18n/mod.ts';
+import { existsSync } from 'https://deno.land/std@0.224.0/fs/mod.ts';
+import { resolve } from 'https://deno.land/std@0.224.0/path/mod.ts';
+
+/**
+ * Collects repeated occurrences of the `--environment` CLI option and validates
+ * that every entry adheres to `KEY=value` syntax.
+ *
+ * Cliffy calls this handler for *each* `--environment` argument. The previously
+ * accumulated values are passed in via the `previous` parameter, allowing us to
+ * build up the final array manually.
+ *
+ * @example
+ * ```ts
+ * // CLI invocation:
+ * //   mycli --environment FOO=bar --environment BAZ=qux
+ * const env = collectAndValidateEnv("FOO=bar");
+ * const env2 = collectAndValidateEnv("BAZ=qux", env);
+ * console.log(env2); // => ["FOO=bar", "BAZ=qux"]
+ * ```
+ *
+ * @param value - Current `KEY=value` string supplied by the user.
+ * @param previous - Array of values collected so far (defaults to an empty
+ *   array on the first call).
+ * @returns The updated array containing all validated `KEY=value` pairs.
+ *
+ * @throws {ValidationError} If the input does not match the required syntax
+ *   The resulting error is caught by Cliffy, which
+ *   will print a help message and terminate with a non-zero exit code.
+ */
+export function collectAndValidateEnv(
+    value: string,
+    previous: string[] = [],
+): string[] {
+    if (!/^\w+=.+/.test(value)) {
+        throw new ValidationError(t('error_invalid_env', { value }));
+    }
+    previous.push(value);
+    return previous;
+}
+
+/**
+ * Normalises a given path to its absolute representation and optionally checks
+ * whether it exists on the filesystem.
+ *
+ * @remarks
+ * Because `--home`, `--cwd`, `--output`, and similar options may refer to files
+ * or directories that *must* already exist, this helper performs the common
+ * validation in a single place.
+ *
+ * @param value - Path provided by the user (absolute or relative).
+ * @param mustExist - When `true`, the function asserts that the resolved path
+ *   exists; otherwise, existence is not verified.
+ * @returns The absolute path derived via {@linkcode resolve}.
+ *
+ * @throws {ValidationError}
+ *  - If `value` is empty or not a string.
+ *  - If `mustExist` is `true` **and** the resolved path cannot be found.
+ */
+export function validatePath(value: string, mustExist: boolean): string {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(t('error_path_schold_not_be_empty'));
+    }
+    const abs = resolve(value);
+    if (mustExist && !existsSync(abs)) {
+        throw new ValidationError(t('error_path_not_found', { path: abs }));
+    }
+    return abs;
+}
+
+/**
+ * Ensures that a mandatory CLI argument is not empty.
+ *
+ * @param value - Raw string supplied by the user.
+ * @param label - Human-readable label identifying the option (used in error
+ *   messages). Example: `"--exec"`.
+ * @returns The original `value` if the validation passes.
+ *
+ * @throws {ValidationError} When `value` is `""`, `null`, `undefined`, or a
+ *   non-string.
+ */
+export function validateNotEmpty(value: string, label: string): string {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(
+            t('error_value_should_not_be_empty', { label }),
+        );
+    }
+    return value;
+}
+
+/**
+ * Collects repeated occurrences of the `--after` CLI option, validating each
+ * target unit name and returning the aggregated list.
+ *
+ * The validation performed here is intentionally minimal – it merely checks
+ * that the argument is a non-empty string. Detailed identifier rules (ASCII
+ * characters, digits, etc.) are enforced elsewhere by
+ * {@link validateIdentifier} when appropriate.
+ *
+ * @param value - Unit name provided with the current `--after` occurrence.
+ * @param previous - Accumulated array of unit names (defaults to an empty
+ *   array).
+ * @returns An array containing all validated `--after` values.
+ *
+ * @throws {ValidationError} If `value` is empty.
+ */
+export function collectAndValidateAfter(
+    value: string,
+    previous: string[] = [],
+): string[] {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(
+            t('error_value_should_not_be_empty', { label: '--after' }),
+        );
+    }
+    previous.push(value);
+    return previous;
+}
+
+/**
+ * Validates identifiers used in generated systemd unit file names (e.g.
+ * service or timer names) and option flags like `--run-as`.
+ *
+ * @example
+ * ```ts
+ * validateIdentifier("backup_job", "--name");   // OK
+ * validateIdentifier("foo.bar-baz", "--after"); // OK
+ * validateIdentifier("oops$", "--name");        // throws ValidationError
+ * ```
+ *
+ * @param value - The identifier string to validate.
+ * @param label - The relevant option flag, forwarded to the error message so
+ *   the user immediately sees which argument is wrong.
+ * @returns The unchanged `value` when it satisfies the pattern.
+ *
+ * @throws {ValidationError} If `value` contains characters outside the allowed
+ *   set of ASCII letters, digits, `.`, `_`, and `-`.
+ */
+export function validateIdentifier(value: string, label: string): string {
+    if (!/^[A-Za-z0-9_.-]+$/.test(value)) {
+        throw new ValidationError(
+            t('error_invalid_identifier', { identifier: label, value }),
+        );
+    }
+    return value;
+}
+
+/**
+ * Validates a systemd OnCalendar expression by invoking `systemd-analyze calendar`
+ * as a subprocess using a synchronous call. This avoids async overhead.
+ *
+ * @remarks
+ * Requires a Linux environment with systemd available.
+ *
+ * @param value - Calendar expression to validate
+ * @returns The original `value` if valid
+ * @throws {ValidationError} If the expression is invalid or systemd rejects it
+ */
+export function validateSystemdCalendar(value: string): string {
+    const command = new Deno.Command('systemd-analyze', {
+        args: ['calendar', value],
+        stdout: 'null',
+        stderr: 'null',
+    });
+
+    const { success } = command.outputSync();
+
+    if (!success) {
+        throw new ValidationError(
+            t('error_invalid_calendar', { value }),
+        );
+    }
+
+    return value;
+}

src/utils/mod.ts

@@ -1,3 +1,11 @@
+export {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from './cliValidationHelper.ts';
 export { resolveUnitTargetPath, writeUnitFiles } from './fs.ts';
 export { deriveNameFromExec } from './misc.ts';
 export { getVersion } from './version.ts';