function cmd::rule::update() {
  local name="" desc=""
  local allow_ips=() block_ips=() block_ports=()
  local dns_redirect=""

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)         name="$2";              shift 2 ;;
      --desc)         desc="$2";              shift 2 ;;
      --allow-ip)     allow_ips+=("$2");      shift 2 ;;
      --block-ip)     block_ips+=("$2");      shift 2 ;;
      --block-port)   block_ports+=("$2");    shift 2 ;;
      --dns-redirect) dns_redirect=true;      shift   ;;
      --help)         cmd::rule::help;        return  ;;
      *)
        log::error "Unknown flag: $1"
        return 1
        ;;
    esac
  done

  if [[ -z "$name" ]]; then
    log::error "Missing required flag: --name"
    return 1
  fi

  rule::require_exists "$name" || return 1

  # Update individual fields if provided
  [[ -n "$desc" ]] && json::set "$(ctx::rule::path "${name}.rule")" "desc" "\"$desc\""
  [[ -n "$dns_redirect" ]] && json::set "$(ctx::rule::path "${name}.rule")" "dns_redirect" "true"

  for ip in "${allow_ips[@]}"; do
    json::append "$(ctx::rule::path "${name}.rule")" "allow_ips" "$ip"
  done
  for ip in "${block_ips[@]}"; do
    json::append "$(ctx::rule::path "${name}.rule")" "block_ips" "$ip"
  done
  for port in "${block_ports[@]}"; do
    json::append "$(ctx::rule::path "${name}.rule")" "block_ports" "$port"
  done

  log::wg_success "Rule updated: ${name}"

  # Re-apply to all assigned peers
  rule::reapply_all "$name"
}