chore(changelog): update changelog for v0.5.0

- Introduce functions to validate CLI inputs like paths, identifiers, and environment variables
- Add error messages for invalid inputs to support user feedback
- Include unit tests to ensure correctness and robustness of validation logic

.gitea/default_merge_message/MERGE_TEMPLATE.md

@@ -0,0 +1,5 @@
+chore(pr): ${PullRequestTitle} ${PullRequestReference}
+
+${PullRequestDescription}
+
+Merged from ${HeadBranch} into ${BaseBranch}

.gitea/workflows/ci.yml

@@ -36,11 +36,19 @@ jobs:
         continue-on-error: true
         run: deno task test
 
+      - name: Compile
+        id: compile
+        continue-on-error: true
+        run: |
+          deno task build:amd64
+          deno task build:arm64
+
       - name: Fail if any step failed
         if: |
           steps.format.outcome != 'success' ||
           steps.lint.outcome != 'success' ||
-          steps.test.outcome != 'success'
+          steps.test.outcome != 'success' ||
+          steps.compile.outcome != 'success'
         run: |
           echo "::error::One or more steps failed"
           exit 1

.vscode/settings.json

@@ -17,5 +17,8 @@
     "[json]": {
         "editor.defaultFormatter": "denoland.vscode-deno"
     },
+    "[jsonc]": {
+        "editor.defaultFormatter": "denoland.vscode-deno"
+    },
     "editor.formatOnSave": true
 }

CHANGELOG.md

@@ -2,6 +2,35 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.5.0](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.4.1..v0.5.0) - 2025-05-30
+
+### 🚀 Features
+
+- *(cli)* Add validation for command options - ([1c07af4](https://git.0xmax42.io/maxp/systemd-timer/commit/1c07af402b35ba4c2abf89ff5816e791994db536))
+- *(validation)* Add CLI validation helpers for input checks - ([3d95706](https://git.0xmax42.io/maxp/systemd-timer/commit/3d95706d683cac8d279dfb718541a17c42fa5d71))
+- *(build)* Add run permissions to compiled binaries - ([ccb04e4](https://git.0xmax42.io/maxp/systemd-timer/commit/ccb04e49820ff8238d7e7ad853aab5db06d5dc8a))
+- *(ci)* Add compile steps to CI workflow - ([531a02a](https://git.0xmax42.io/maxp/systemd-timer/commit/531a02a6e11a769f2e05888d49ea2b4808d974e3))
+- *(vscode)* Add JSONC formatter configuration - ([c7af1fb](https://git.0xmax42.io/maxp/systemd-timer/commit/c7af1fb6caa46c22b84229745067d05bf60b6f64))
+- *(i18n)* Support loading JSONC translation files - ([4ac5dd4](https://git.0xmax42.io/maxp/systemd-timer/commit/4ac5dd4c88324f99cb6827283ad85bb9718abbeb))
+- *(config)* Add @std/jsonc dependency - ([8f1cb3f](https://git.0xmax42.io/maxp/systemd-timer/commit/8f1cb3fad71ead365d93087963ddb6c7202a9b4f))
+
+### 🐛 Bug Fixes
+
+- *(build)* Update included files to use .jsonc format - ([f3f2c61](https://git.0xmax42.io/maxp/systemd-timer/commit/f3f2c61da0785dce4c6b8c7d8ef0ae9abf098172))
+
+### 🎨 Styling
+
+- *(i18n)* Add comments for clarity and rename files - ([5226269](https://git.0xmax42.io/maxp/systemd-timer/commit/5226269ec2a0b76dfa30ac8d614c3789ff3a837b))
+
+### 🧪 Testing
+
+- *(fs)* Update test descriptions and comments to English - ([c4f4614](https://git.0xmax42.io/maxp/systemd-timer/commit/c4f4614a2daee68f9b33b9676106214c65a1a427))
+- *(fs)* Add rollback tests for writeUnitFiles errors - ([6039d23](https://git.0xmax42.io/maxp/systemd-timer/commit/6039d236eb7de449ce22b1d9ea718389a3e2261d))
+
+### ⚙️ Miscellaneous Tasks
+
+- *(lock)* Update dependencies to latest versions - ([28b23cf](https://git.0xmax42.io/maxp/systemd-timer/commit/28b23cf947ecc57eb7fde541b29c68b41e508e7d))
+
 ## [0.4.1](https://git.0xmax42.io/maxp/systemd-timer/compare/v0.4.0..v0.4.1) - 2025-05-28
 
 ### 🐛 Bug Fixes

VERSION

@@ -1 +1 @@
-0.4.1
+0.5.0

deno.jsonc

@@ -4,9 +4,9 @@
         "test": "deno test -A --coverage **/__tests__/*.test.ts",
         "fmt": "deno fmt --check",
         "lint": "deno lint",
-        "ci": "deno task fmt && deno task lint && deno task test", // For local CI checks
-        "build:amd64": "deno compile --target x86_64-unknown-linux-gnu --include VERSION --include src/i18n/de.json --include src/i18n/en.json --allow-env --allow-write --allow-read --output dist/systemd-timer-linux-amd64 src/mod.ts",
-        "build:arm64": "deno compile --target aarch64-unknown-linux-gnu --include VERSION --include src/i18n/de.json --include src/i18n/en.json --allow-env --allow-write --allow-read --output dist/systemd-timer-linux-arm64 src/mod.ts"
+        "ci": "deno task fmt && deno task lint && deno task test && build:amd64", // For local CI checks
+        "build:amd64": "deno compile --target x86_64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --allow-run --output dist/systemd-timer-linux-amd64 src/mod.ts",
+        "build:arm64": "deno compile --target aarch64-unknown-linux-gnu --include VERSION --include src/i18n/de.jsonc --include src/i18n/en.jsonc --allow-env --allow-write --allow-read --allow-run --output dist/systemd-timer-linux-arm64 src/mod.ts"
     },
     "compilerOptions": {},
     "fmt": {
@@ -23,6 +23,7 @@
     },
     "exclude": [],
     "imports": {
-        "@cliffy/command": "jsr:@cliffy/command@1.0.0-rc.7"
+        "@cliffy/command": "jsr:@cliffy/command@1.0.0-rc.7",
+        "@std/jsonc": "jsr:@std/jsonc@^1.0.2"
     }
 }

deno.lock

@@ -6,6 +6,8 @@
     "jsr:@cliffy/internal@1.0.0-rc.7": "1.0.0-rc.7",
     "jsr:@cliffy/table@1.0.0-rc.7": "1.0.0-rc.7",
     "jsr:@std/fmt@~1.0.2": "1.0.7",
+    "jsr:@std/json@^1.0.2": "1.0.2",
+    "jsr:@std/jsonc@^1.0.2": "1.0.2",
     "jsr:@std/text@~1.0.7": "1.0.13"
   },
   "jsr": {
@@ -37,11 +39,24 @@
     "@std/fmt@1.0.7": {
       "integrity": "2a727c043d8df62cd0b819b3fb709b64dd622e42c3b1bb817ea7e6cc606360fb"
     },
+    "@std/json@1.0.2": {
+      "integrity": "d9e5497801c15fb679f55a2c01c7794ad7a5dfda4dd1bebab5e409cb5e0d34d4"
+    },
+    "@std/jsonc@1.0.2": {
+      "integrity": "909605dae3af22bd75b1cbda8d64a32cf1fd2cf6efa3f9e224aba6d22c0f44c7",
+      "dependencies": [
+        "jsr:@std/json"
+      ]
+    },
     "@std/text@1.0.13": {
       "integrity": "2191c90e6e667b0c3b7dea1cd082137580a93b3c136bad597c0212d5fe006eb1"
     }
   },
   "remote": {
+    "https://deno.land/std@0.192.0/fmt/colors.ts": "d67e3cd9f472535241a8e410d33423980bec45047e343577554d3356e1f0ef4e",
+    "https://deno.land/std@0.192.0/testing/_diff.ts": "1a3c044aedf77647d6cac86b798c6417603361b66b54c53331b312caeb447aea",
+    "https://deno.land/std@0.192.0/testing/_format.ts": "a69126e8a469009adf4cf2a50af889aca364c349797e63174884a52ff75cf4c7",
+    "https://deno.land/std@0.192.0/testing/asserts.ts": "e16d98b4d73ffc4ed498d717307a12500ae4f2cbe668f1a215632d19fcffc22f",
     "https://deno.land/std@0.224.0/assert/_constants.ts": "a271e8ef5a573f1df8e822a6eb9d09df064ad66a4390f21b3e31f820a38e0975",
     "https://deno.land/std@0.224.0/assert/assert.ts": "09d30564c09de846855b7b071e62b5974b001bb72a4b797958fe0660e7849834",
     "https://deno.land/std@0.224.0/assert/assert_almost_equals.ts": "9e416114322012c9a21fa68e187637ce2d7df25bcbdbfd957cd639e65d3cf293",
@@ -168,11 +183,13 @@
     "https://deno.land/std@0.224.0/path/windows/relative.ts": "3e1abc7977ee6cc0db2730d1f9cb38be87b0ce4806759d271a70e4997fc638d7",
     "https://deno.land/std@0.224.0/path/windows/resolve.ts": "8dae1dadfed9d46ff46cc337c9525c0c7d959fb400a6308f34595c45bdca1972",
     "https://deno.land/std@0.224.0/path/windows/to_file_url.ts": "40e560ee4854fe5a3d4d12976cef2f4e8914125c81b11f1108e127934ced502e",
-    "https://deno.land/std@0.224.0/path/windows/to_namespaced_path.ts": "4ffa4fb6fae321448d5fe810b3ca741d84df4d7897e61ee29be961a6aac89a4c"
+    "https://deno.land/std@0.224.0/path/windows/to_namespaced_path.ts": "4ffa4fb6fae321448d5fe810b3ca741d84df4d7897e61ee29be961a6aac89a4c",
+    "https://deno.land/std@0.224.0/testing/mock.ts": "a963181c2860b6ba3eb60e08b62c164d33cf5da7cd445893499b2efda20074db"
   },
   "workspace": {
     "dependencies": [
-      "jsr:@cliffy/command@1.0.0-rc.7"
+      "jsr:@cliffy/command@1.0.0-rc.7",
+      "jsr:@std/jsonc@^1.0.2"
     ]
   }
 }

src/cli/create.ts

@@ -2,6 +2,14 @@ import { Command } from '@cliffy/command';
 import { generateUnitFiles } from '../templates/unit-generator.ts';
 import { TimerOptions } from '../types/options.ts';
 import { t } from '../i18n/mod.ts';
+import {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from '../utils/mod.ts';
 
 export function createCommand() {
     return new Command()
@@ -9,43 +17,54 @@ export function createCommand() {
         .option(
             '--name <name:string>',
             t('option_name'),
+            { value: (v) => validateIdentifier(v, '--name') },
         )
         .option(
             '--exec <cmd:string>',
             t('option_exec'),
-            { required: true },
+            {
+                required: true,
+                value: (v) => validateNotEmpty(v, '--exec'),
+            },
         )
         .option('--calendar <time:string>', t('option_calendar'), {
             required: true,
+            value: validateSystemdCalendar,
         })
         .option('--description <desc:string>', t('option_description'))
         .option('--user', t('option_user'))
         .option(
             '--run-as <user:string>',
             t('option_run_as'),
+            { value: (v) => validateNotEmpty(v, '--run-as') },
         )
         .option(
             '--home <path:string>',
             t('option_home'),
+            { value: (v) => validatePath(v, true) },
         )
         .option(
             '--cwd <path:string>',
             t('option_cwd'),
+            { value: (v) => validatePath(v, true) },
         )
-        .option('--output <dir:string>', t('option_output'))
+        .option('--output <dir:string>', t('option_output'), {
+            value: (v) => validatePath(v, false),
+        })
         .option(
             '--after <target:string>',
             t('option_after'),
-            { collect: true },
+            { collect: true, value: collectAndValidateAfter },
         )
         .option(
             '--environment <env:string>',
             t('option_environment'),
-            { collect: true },
+            { collect: true, value: collectAndValidateEnv },
         )
         .option(
             '--logfile <file:string>',
             t('option_logfile'),
+            { value: (v) => validatePath(v, false) },
         )
         .option('--dry-run', t('option_dry_run'))
         .action(async (options: TimerOptions) => {

src/i18n/de.jsonc

@@ -1,6 +1,8 @@
 {
+    // General
     "cli_description": "CLI-Tool zum Erzeugen von systemd .timer und .service Units",
     "cli_create_description": "Erzeugt eine systemd .service und .timer Unit",
+    // Options
     "option_name": "Name der Unit-Dateien (optional, wird sonst aus dem Exec generiert)",
     "option_exec": "Kommando, das durch systemd ausgeführt werden soll",
     "option_calendar": "OnCalendar-Ausdruck für den Timer",
@@ -14,9 +16,17 @@
     "option_environment": "Environment-Variablen im Format KEY=VALUE",
     "option_logfile": "Dateipfad für Log-Ausgabe (stdout/stderr)",
     "option_dry_run": "Gibt die Unit-Dateien nur aus, ohne sie zu schreiben",
+    // Messages
     "unit_written_service": "Service Unit geschrieben in: {path}",
     "unit_written_timer": "Timer Unit geschrieben in: {path}",
     "hint_header": "\nℹ️  Hinweis:",
+    // Error messages
     "error_write_units": "Fehler beim Schreiben der Units:",
-    "rollback_failed": "Rollback fehlgeschlagen:"
+    "rollback_failed": "Rollback fehlgeschlagen:",
+    "error_invalid_env": "Ungültiges Environment-Format. Verwende KEY=VALUE.",
+    "error_path_schold_not_be_empty": "Pfad darf nicht leer sein.",
+    "error_path_not_found": "Pfad nicht gefunden: {path}",
+    "error_value_should_not_be_empty": "Wert ({label}) sollte nicht leer sein.",
+    "error_invalid_identifier": "Ungültiger Bezeichner: '{value}' für {identifier}. Erlaubt sind nur alphanumerische Zeichen, Unterstriche und Bindestriche.",
+    "error_invalid_calendar": "Ungültiger OnCalendar-Ausdruck: {value}. Bitte überprüfe die Syntax."
 }

src/i18n/en.jsonc

@@ -1,6 +1,8 @@
 {
+    // General
     "cli_description": "CLI tool for generating systemd .timer and .service units",
     "cli_create_description": "Generates a systemd .service and .timer unit",
+    // Options
     "option_name": "Name of the unit files (optional, otherwise derived from the exec command)",
     "option_exec": "Command to be executed by systemd",
     "option_calendar": "OnCalendar expression for the timer",
@@ -14,9 +16,17 @@
     "option_environment": "Environment variables in the format KEY=VALUE",
     "option_logfile": "File path for log output (stdout/stderr)",
     "option_dry_run": "Only outputs the unit files without writing them",
+    // Messages
     "unit_written_service": "Service unit written to: {path}",
     "unit_written_timer": "Timer unit written to: {path}",
     "hint_header": "\nℹ️  Note:",
+    // Error messages
     "error_write_units": "Error while writing unit files:",
-    "rollback_failed": "Rollback failed:"
+    "rollback_failed": "Rollback failed:",
+    "error_invalid_env": "Invalid environment format. Use KEY=VALUE.",
+    "error_path_schold_not_be_empty": "Path should not be empty.",
+    "error_path_not_found": "Path not found: {path}",
+    "error_value_should_not_be_empty": "Value ({label}) should not be empty.",
+    "error_invalid_identifier": "Invalid identifier: '{value}' for {identifier}. Only alphanumeric characters, underscores, and hyphens are allowed.",
+    "error_invalid_calendar": "Invalid OnCalendar expression: {value}. Please check the syntax."
 }

src/i18n/i18n.ts

@@ -1,3 +1,5 @@
+import { parse as parseJsonc } from '@std/jsonc';
+
 /**
  * Initializes the i18n module by loading
  * the appropriate locale file based on the system language.
@@ -15,29 +17,35 @@ let translations: Record<string, string> = {};
 /**
  * Loads the translation file for the specified locale.
  *
- * Expects a JSON file in the same directory named like `de.json` or `en.json`.
+ * Accepts both `.jsonc` (JSON with comments) and plain `.json`.
+ * When both exist, `.jsonc` takes precedence.
  * Falls back to English ('en') if the specified file does not exist.
  *
  * @param locale - The language code (e.g., 'de', 'en') to load
  * @returns Promise that resolves once the translations have been loaded
  */
 export async function loadLocale(locale: string): Promise<void> {
-    try {
-        const localeUrl = new URL(`./${locale}.json`, import.meta.url);
-        const file = await Deno.readTextFile(localeUrl);
-        translations = JSON.parse(file);
-    } catch (err) {
-        if (err instanceof Deno.errors.NotFound) {
-            console.warn(
-                `Locale '${locale}' not found – falling back to 'en'.`,
-            );
-            if (locale !== 'en') {
-                await loadLocale('en');
+    const extensions = ['jsonc', 'json'];
+    for (const ext of extensions) {
+        try {
+            const localeUrl = new URL(`./${locale}.${ext}`, import.meta.url);
+            const raw = await Deno.readTextFile(localeUrl);
+            // parseJsonc tolerates both pure JSON and JSONC, so we can use it for either.
+            translations = parseJsonc(raw) as Record<string, string>;
+            return;
+        } catch (err) {
+            if (err instanceof Deno.errors.NotFound) {
+                // Continue with next extension.
+                continue;
             }
-        } else {
-            console.error('Error loading translation file:', err);
+            console.error(`Error parsing locale '${locale}.${ext}':`, err);
+            break;
         }
     }
+    if (locale !== 'en') {
+        console.warn(`Locale '${locale}' not found – falling back to 'en'.`);
+        await loadLocale('en');
+    }
 }
 
 /**

src/utils/__tests__/cliValidationHelper.test.ts

@@ -0,0 +1,145 @@
+import { resolve } from 'https://deno.land/std@0.224.0/path/mod.ts';
+import { ValidationError } from '@cliffy/command';
+import {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from '../mod.ts';
+import { t } from '../../i18n/mod.ts';
+import {
+    assertEquals,
+    assertThrows,
+} from 'https://deno.land/std@0.224.0/assert/mod.ts';
+
+Deno.test(
+    'collectAndValidateEnv: throws ValidationError for invalid env format',
+    () => {
+        const invalidEnv = 'INVALID_ENV';
+        assertThrows(
+            () => collectAndValidateEnv(invalidEnv),
+            ValidationError,
+            t('error_invalid_env', { value: invalidEnv }),
+        );
+    },
+);
+
+Deno.test(
+    'collectAndValidateEnv: returns collected array for valid env format',
+    () => {
+        const validEnv = 'KEY=value';
+        const previous = ['EXISTING=env'];
+        const result = collectAndValidateEnv(validEnv, previous);
+        assertEquals(result, ['EXISTING=env', 'KEY=value']);
+    },
+);
+
+Deno.test('collectAndValidateEnv: aggregates multiple calls', () => {
+    const first = collectAndValidateEnv('FOO=bar');
+    const second = collectAndValidateEnv('BAZ=qux', first);
+    assertEquals(second, ['FOO=bar', 'BAZ=qux']);
+});
+
+Deno.test(
+    'validatePath: returns absolute path for valid path without existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const relativePath = `${tmpDir}/testfile.txt`;
+        const result = validatePath(relativePath, false);
+        assertEquals(result, resolve(relativePath));
+    },
+);
+
+Deno.test(
+    'validatePath: throws ValidationError for non‑existent path with existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const nonExistentPath = `${tmpDir}/nonexistent.txt`;
+        assertThrows(
+            () => validatePath(nonExistentPath, true),
+            ValidationError,
+            t('error_path_not_found', { path: resolve(nonExistentPath) }),
+        );
+    },
+);
+
+Deno.test(
+    'validatePath: returns absolute path for existing path with existence check',
+    () => {
+        const tmpDir = Deno.makeTempDirSync();
+        const existingPath = `${tmpDir}/existing.txt`;
+        Deno.writeTextFileSync(existingPath, 'test content');
+        const result = validatePath(existingPath, true);
+        assertEquals(result, resolve(existingPath));
+    },
+);
+
+Deno.test('validatePath: throws ValidationError for empty path', () => {
+    const invalidPath = '';
+    assertThrows(
+        () => validatePath(invalidPath, true),
+        ValidationError,
+        t('error_path_schold_not_be_empty'),
+    );
+});
+
+Deno.test('validateNotEmpty: returns value for non‑empty string', () => {
+    const input = 'some-value';
+    const result = validateNotEmpty(input, '--exec');
+    assertEquals(result, input);
+});
+
+Deno.test('validateNotEmpty: throws ValidationError for empty string', () => {
+    const input = '';
+    assertThrows(
+        () => validateNotEmpty(input, '--exec'),
+        ValidationError,
+        t('error_value_should_not_be_empty', { label: '--exec' }),
+    );
+});
+
+Deno.test('collectAndValidateAfter: returns aggregated array', () => {
+    const first = collectAndValidateAfter('network.target');
+    const second = collectAndValidateAfter('postgres.service', first);
+    assertEquals(second, ['network.target', 'postgres.service']);
+});
+
+Deno.test('collectAndValidateAfter: throws ValidationError for empty value', () => {
+    assertThrows(
+        () => collectAndValidateAfter(''),
+        ValidationError,
+        t('error_value_should_not_be_empty', { label: '--after' }),
+    );
+});
+
+Deno.test('validateIdentifier: returns value for valid identifier', () => {
+    const id = 'backup_job-1';
+    const result = validateIdentifier(id, '--name');
+    assertEquals(result, id);
+});
+
+Deno.test('validateIdentifier: throws ValidationError for invalid identifier', () => {
+    const id = 'invalid$';
+    assertThrows(
+        () => validateIdentifier(id, '--name'),
+        ValidationError,
+        t('error_invalid_identifier', { label: '--name', value: id }),
+    );
+});
+
+Deno.test('validateSystemdCalendar: accepts valid expression', async () => {
+    const valid = 'Mon..Fri 12:00';
+    const result = await validateSystemdCalendar(valid);
+    assertEquals(result, valid);
+});
+
+Deno.test('validateSystemdCalendar: rejects invalid expression', async () => {
+    const invalid = 'Mo..Fr 12:00';
+    await assertThrows(
+        () => validateSystemdCalendar(invalid),
+        ValidationError,
+        t('error_invalid_calendar', { value: invalid }),
+    );
+});

src/utils/__tests__/fs.test.ts

@@ -3,11 +3,13 @@ import {
     assertExists,
     assertStringIncludes,
 } from 'https://deno.land/std@0.224.0/assert/mod.ts';
+import { stub } from 'https://deno.land/std@0.224.0/testing/mock.ts';
+import { exists } from 'https://deno.land/std@0.224.0/fs/mod.ts';
 import { join } from 'https://deno.land/std@0.224.0/path/mod.ts';
 import { resolveUnitTargetPath, writeUnitFiles } from '../mod.ts';
 import { TimerOptions } from '../../types/options.ts';
 
-Deno.test('writeUnitFiles schreibt .service und .timer korrekt', async () => {
+Deno.test('writeUnitFiles: writes .service and .timer files correctly', async () => {
     const tmp = await Deno.makeTempDir({ prefix: 'test-units-' });
 
     const options = {
@@ -26,15 +28,15 @@ Deno.test('writeUnitFiles schreibt .service und .timer korrekt', async () => {
         options as TimerOptions,
     ) as { servicePath: string; timerPath: string };
 
-    // Überprüfe Pfade
+    // Check file paths
     assertEquals(servicePath, join(tmp, 'test-backup.service'));
     assertEquals(timerPath, join(tmp, 'test-backup.timer'));
 
-    // Existieren Dateien?
+    // Check if files exist
     assertExists(await Deno.stat(servicePath));
     assertExists(await Deno.stat(timerPath));
 
-    // Enthält die Datei den erwarteten Inhalt?
+    // Check if file contents match expectations
     const readService = await Deno.readTextFile(servicePath);
     const readTimer = await Deno.readTextFile(timerPath);
 
@@ -42,18 +44,237 @@ Deno.test('writeUnitFiles schreibt .service und .timer korrekt', async () => {
     assertStringIncludes(readTimer, 'OnCalendar=daily');
 });
 
-Deno.test('resolveUnitTargetPath mit --output', () => {
+Deno.test('resolveUnitTargetPath: with --output', () => {
     const result = resolveUnitTargetPath({ output: '/tmp/units', user: false });
     assertEquals(result, '/tmp/units');
 });
 
-Deno.test('resolveUnitTargetPath mit --user ohne output', () => {
+Deno.test('resolveUnitTargetPath: with --user and no output', () => {
     Deno.env.set('HOME', '/home/maxp');
     const result = resolveUnitTargetPath({ output: undefined, user: true });
     assertEquals(result, '/home/maxp/.config/systemd/user');
 });
 
-Deno.test('resolveUnitTargetPath ohne output und ohne user', () => {
+Deno.test('resolveUnitTargetPath: with no output and no user', () => {
     const result = resolveUnitTargetPath({ output: undefined, user: false });
     assertEquals(result, '/etc/systemd/system');
 });
+
+Deno.test('writeUnitFiles: error writing .timer file triggers rollback', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'never',
+    };
+
+    const name = 'fail-timer';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=never';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    // Simulate: writing the .timer file fails
+    const originalWrite = Deno.writeTextFile;
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        async (path: string | URL, data: string | ReadableStream<string>) => {
+            if (typeof path === 'string' && path.endsWith('.timer')) {
+                throw new Error('Simulated write error');
+            } else {
+                return await originalWrite(path, data);
+            }
+        },
+    );
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+
+    // Expect: function returns undefined
+    assertEquals(result, undefined);
+
+    // Expect: both files have been deleted (rollback)
+    assertEquals(await exists(servicePath), false);
+    assertEquals(await exists(timerPath), false);
+
+    writeStub.restore();
+});
+
+Deno.test('writeUnitFiles: error writing .service file prevents further actions', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'weekly',
+    };
+
+    const name = 'fail-service';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=weekly';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    // Simulate: error writing the .service file
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        (path: string | URL, _data: string | ReadableStream<string>) => {
+            if (typeof path === 'string' && path.endsWith('.service')) {
+                throw new Error('Simulated service write error');
+            }
+            return Promise.resolve();
+        },
+    );
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+
+    // Expect: function returns undefined
+    assertEquals(result, undefined);
+
+    // Expect: no files were created
+    assertEquals(await exists(servicePath), false);
+    assertEquals(await exists(timerPath), false);
+
+    writeStub.restore();
+});
+
+Deno.test('writeUnitFiles: both files written, then error → full rollback', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'never',
+    };
+
+    const name = 'fail-after-write';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=never';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    let writeCount = 0;
+    const originalWriteTextFile = Deno.writeTextFile;
+
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        async (path: string | URL, data: string | ReadableStream<string>) => {
+            if (typeof path !== 'string') {
+                throw new Error('Unexpected path type');
+            }
+
+            // Simulate both writes, then throw an error after the second
+            writeCount++;
+
+            await originalWriteTextFile(path, data);
+
+            if (writeCount === 2) {
+                throw new Error('Simulated error after full write');
+            }
+        },
+    );
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+
+    // Expect: function returns undefined
+    assertEquals(result, undefined);
+
+    // Expect: both files were removed
+    assertEquals(await exists(servicePath), false);
+    assertEquals(await exists(timerPath), false);
+
+    writeStub.restore();
+});
+
+Deno.test('writeUnitFiles: rollback fails if files cannot be deleted', async () => {
+    const tmp = await Deno.makeTempDir();
+
+    const options: TimerOptions = {
+        output: tmp,
+        user: false,
+        exec: '/bin/true',
+        calendar: 'never',
+    };
+
+    const name = 'rollback-error';
+    const serviceContent = '[Service]\nExecStart=/bin/true';
+    const timerContent = '[Timer]\nOnCalendar=never';
+
+    const servicePath = join(tmp, `${name}.service`);
+    const timerPath = join(tmp, `${name}.timer`);
+
+    const originalWriteTextFile = Deno.writeTextFile;
+    const _originalRemove = Deno.remove;
+
+    let writeCount = 0;
+
+    const writeStub = stub(
+        Deno,
+        'writeTextFile',
+        async (path: string | URL, data: string | ReadableStream<string>) => {
+            writeCount++;
+            await originalWriteTextFile(path, data);
+            if (writeCount === 2) {
+                throw new Error('Error after full write');
+            }
+        },
+    );
+
+    const removeStub = stub(
+        Deno,
+        'remove',
+        // deno-lint-ignore require-await
+        async (_path: string | URL, _opts?: Deno.RemoveOptions) => {
+            throw new Error('Deletion forbidden!');
+        },
+    );
+
+    const logs: string[] = [];
+    const consoleStub = stub(console, 'error', (...args) => {
+        logs.push(args.map((a) => String(a)).join(' '));
+    });
+
+    const result = await writeUnitFiles(
+        name,
+        serviceContent,
+        timerContent,
+        options,
+    );
+    assertEquals(result, undefined);
+
+    // Files still exist because deletion failed
+    assertEquals(await exists(servicePath), true);
+    assertEquals(await exists(timerPath), true);
+
+    // Error output contains "rollback_failed"
+    const combinedLogs = logs.join('\n');
+    assertStringIncludes(combinedLogs, 'rollback_failed');
+
+    writeStub.restore();
+    removeStub.restore();
+    consoleStub.restore();
+});

src/utils/cliValidationHelper.ts

@@ -0,0 +1,176 @@
+import { ValidationError } from '@cliffy/command';
+import { t } from '../i18n/mod.ts';
+import { existsSync } from 'https://deno.land/std@0.224.0/fs/mod.ts';
+import { resolve } from 'https://deno.land/std@0.224.0/path/mod.ts';
+
+/**
+ * Collects repeated occurrences of the `--environment` CLI option and validates
+ * that every entry adheres to `KEY=value` syntax.
+ *
+ * Cliffy calls this handler for *each* `--environment` argument. The previously
+ * accumulated values are passed in via the `previous` parameter, allowing us to
+ * build up the final array manually.
+ *
+ * @example
+ * ```ts
+ * // CLI invocation:
+ * //   mycli --environment FOO=bar --environment BAZ=qux
+ * const env = collectAndValidateEnv("FOO=bar");
+ * const env2 = collectAndValidateEnv("BAZ=qux", env);
+ * console.log(env2); // => ["FOO=bar", "BAZ=qux"]
+ * ```
+ *
+ * @param value - Current `KEY=value` string supplied by the user.
+ * @param previous - Array of values collected so far (defaults to an empty
+ *   array on the first call).
+ * @returns The updated array containing all validated `KEY=value` pairs.
+ *
+ * @throws {ValidationError} If the input does not match the required syntax
+ *   The resulting error is caught by Cliffy, which
+ *   will print a help message and terminate with a non-zero exit code.
+ */
+export function collectAndValidateEnv(
+    value: string,
+    previous: string[] = [],
+): string[] {
+    if (!/^\w+=.+/.test(value)) {
+        throw new ValidationError(t('error_invalid_env', { value }));
+    }
+    previous.push(value);
+    return previous;
+}
+
+/**
+ * Normalises a given path to its absolute representation and optionally checks
+ * whether it exists on the filesystem.
+ *
+ * @remarks
+ * Because `--home`, `--cwd`, `--output`, and similar options may refer to files
+ * or directories that *must* already exist, this helper performs the common
+ * validation in a single place.
+ *
+ * @param value - Path provided by the user (absolute or relative).
+ * @param mustExist - When `true`, the function asserts that the resolved path
+ *   exists; otherwise, existence is not verified.
+ * @returns The absolute path derived via {@linkcode resolve}.
+ *
+ * @throws {ValidationError}
+ *  - If `value` is empty or not a string.
+ *  - If `mustExist` is `true` **and** the resolved path cannot be found.
+ */
+export function validatePath(value: string, mustExist: boolean): string {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(t('error_path_schold_not_be_empty'));
+    }
+    const abs = resolve(value);
+    if (mustExist && !existsSync(abs)) {
+        throw new ValidationError(t('error_path_not_found', { path: abs }));
+    }
+    return abs;
+}
+
+/**
+ * Ensures that a mandatory CLI argument is not empty.
+ *
+ * @param value - Raw string supplied by the user.
+ * @param label - Human-readable label identifying the option (used in error
+ *   messages). Example: `"--exec"`.
+ * @returns The original `value` if the validation passes.
+ *
+ * @throws {ValidationError} When `value` is `""`, `null`, `undefined`, or a
+ *   non-string.
+ */
+export function validateNotEmpty(value: string, label: string): string {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(
+            t('error_value_should_not_be_empty', { label }),
+        );
+    }
+    return value;
+}
+
+/**
+ * Collects repeated occurrences of the `--after` CLI option, validating each
+ * target unit name and returning the aggregated list.
+ *
+ * The validation performed here is intentionally minimal – it merely checks
+ * that the argument is a non-empty string. Detailed identifier rules (ASCII
+ * characters, digits, etc.) are enforced elsewhere by
+ * {@link validateIdentifier} when appropriate.
+ *
+ * @param value - Unit name provided with the current `--after` occurrence.
+ * @param previous - Accumulated array of unit names (defaults to an empty
+ *   array).
+ * @returns An array containing all validated `--after` values.
+ *
+ * @throws {ValidationError} If `value` is empty.
+ */
+export function collectAndValidateAfter(
+    value: string,
+    previous: string[] = [],
+): string[] {
+    if (!value || typeof value !== 'string') {
+        throw new ValidationError(
+            t('error_value_should_not_be_empty', { label: '--after' }),
+        );
+    }
+    previous.push(value);
+    return previous;
+}
+
+/**
+ * Validates identifiers used in generated systemd unit file names (e.g.
+ * service or timer names) and option flags like `--run-as`.
+ *
+ * @example
+ * ```ts
+ * validateIdentifier("backup_job", "--name");   // OK
+ * validateIdentifier("foo.bar-baz", "--after"); // OK
+ * validateIdentifier("oops$", "--name");        // throws ValidationError
+ * ```
+ *
+ * @param value - The identifier string to validate.
+ * @param label - The relevant option flag, forwarded to the error message so
+ *   the user immediately sees which argument is wrong.
+ * @returns The unchanged `value` when it satisfies the pattern.
+ *
+ * @throws {ValidationError} If `value` contains characters outside the allowed
+ *   set of ASCII letters, digits, `.`, `_`, and `-`.
+ */
+export function validateIdentifier(value: string, label: string): string {
+    if (!/^[A-Za-z0-9_.-]+$/.test(value)) {
+        throw new ValidationError(
+            t('error_invalid_identifier', { identifier: label, value }),
+        );
+    }
+    return value;
+}
+
+/**
+ * Validates a systemd OnCalendar expression by invoking `systemd-analyze calendar`
+ * as a subprocess using a synchronous call. This avoids async overhead.
+ *
+ * @remarks
+ * Requires a Linux environment with systemd available.
+ *
+ * @param value - Calendar expression to validate
+ * @returns The original `value` if valid
+ * @throws {ValidationError} If the expression is invalid or systemd rejects it
+ */
+export function validateSystemdCalendar(value: string): string {
+    const command = new Deno.Command('systemd-analyze', {
+        args: ['calendar', value],
+        stdout: 'null',
+        stderr: 'null',
+    });
+
+    const { success } = command.outputSync();
+
+    if (!success) {
+        throw new ValidationError(
+            t('error_invalid_calendar', { value }),
+        );
+    }
+
+    return value;
+}

src/utils/mod.ts

@@ -1,3 +1,11 @@
+export {
+    collectAndValidateAfter,
+    collectAndValidateEnv,
+    validateIdentifier,
+    validateNotEmpty,
+    validatePath,
+    validateSystemdCalendar,
+} from './cliValidationHelper.ts';
 export { resolveUnitTargetPath, writeUnitFiles } from './fs.ts';
 export { deriveNameFromExec } from './misc.ts';
 export { getVersion } from './version.ts';