function cmd::block::run() {
  local name=""
  local type=""
  local ips=()
  local subnets=()
  local ports=()
  local quiet=false

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)   name="$2";        shift 2 ;;
      --type)   type="$2";        shift 2 ;;
      --ip)     ips+=("$2");      shift 2 ;;
      --force)  force=true;       shift   ;;
      --quiet)  quiet=true;       shift   ;;
      --subnet) subnets+=("$2");  shift 2 ;;
      --port)   ports+=("$2");    shift 2 ;;
      --help)   cmd::block::help; return  ;;
      *)
        log::error "Unknown flag: $1"
        cmd::block::help
        return 1
        ;;
    esac
  done

  if [[ -z "$name" ]]; then
    log::error "Missing required flag: --name"
    cmd::block::help
    return 1
  fi

  name=$(peers::resolve_and_require "$name" "$type") || return 1

  # Check if actually blocked
  if peers::is_blocked "$name" || [[ -f "$(ctx::block::path "${name}.block")" ]]; then
    log::wg_warning "Client is already blocked: ${name}"
    return 0
  fi

  # Update cache first
  monitor::update_endpoint_cache
  
  local public_key
  public_key=$(keys::public "$name") || return 1
  
  local endpoint
  endpoint=$(monitor::endpoint_for_key "$public_key")
  
  # Fall back to cache if live endpoint not available
  if [[ -z "$endpoint" || "$endpoint" == "(none)" ]]; then
    endpoint=$(monitor::get_cached_endpoint "$name")
  fi

  local client_ip
  client_ip=$(cmd::block::get_client_ip "$name") || return 1

  # $quiet || log::section "Blocking client: ${name} (${client_ip})"

  # No specific target — block everything
  if [[ ${#ips[@]} -eq 0 && ${#subnets[@]} -eq 0 && ${#ports[@]} -eq 0 ]]; then
    # Get real endpoint IP before removing peer from server
    local public_key endpoint
    public_key=$(keys::public "$name") || return 1
    endpoint=$(monitor::endpoint_for_key "$public_key")

    fw::block_all "$client_ip" "$name"
    fw::save_block "$name" "$client_ip"

    # Watch real endpoint IP if available
    if [[ -n "$endpoint" ]]; then
      monitor::unwatch "$client_ip"  # remove tunnel IP if added by block_all
      monitor::watch "$endpoint" "$name"
    fi

    # Remove peer from server to kill active connection
    peers::remove_from_server "$name"
    peers::reload

    $quiet || log::wg_success "${name} has been blocked."
    return 0
  fi

  # Block specific IPs
  for ip in "${ips[@]}"; do
    ip::require_valid "$ip"
    fw::block_ip "$client_ip" "$ip"
    fw::save_block "$name" "$client_ip" "$ip"
  done

  # Block specific subnets
  for subnet in "${subnets[@]}"; do
    ip::require_valid "$subnet"
    fw::block_subnet "$client_ip" "$subnet"
    fw::save_block "$name" "$client_ip" "$subnet"
  done

  # Block specific ports
  for entry in "${ports[@]}"; do
    local target port proto
    IFS=":" read -r target port proto <<< "$entry"
    proto="${proto:-tcp}"
    ip::require_valid "$target"
    fw::block_port "$client_ip" "$target" "$port" "$proto"
    fw::save_block "$name" "$client_ip" "$target" "$port" "$proto"
  done

  log::debug "Block rules applied for: ${name}"
}