function cmd::block::run() {
  local name=""
  local type=""
  local block_name=""
  local ips=()
  local subnets=()
  local ports=()
  local quiet=false
  local services=()

  while [[ $# -gt 0 ]]; do
    case "$1" in
      --name)   name="$2";            shift 2 ;;
      --type)   type="$2";            shift 2 ;;
      --ip)     ips+=("$2");          shift 2 ;;
      --block-name) block_name="$2";  shift 2 ;;
      --service) services+=("$2");    shift 2 ;;
      --force)  force=true;           shift   ;;
      --quiet)  quiet=true;           shift   ;;
      --subnet) subnets+=("$2");      shift 2 ;;
      --port)   ports+=("$2");        shift 2 ;;
      --help)   cmd::block::help; return  ;;
      *)
        log::error "Unknown flag: $1"
        cmd::block::help
        return 1
        ;;
    esac
  done

  if [[ -z "$name" ]]; then
    log::error "Missing required flag: --name"
    cmd::block::help
    return 1
  fi

  name=$(peers::resolve_and_require "$name" "$type") || return 1

  # Check if actually blocked
  if peers::is_blocked "$name" || block::has_file "$name"; then
    log::wg_warning "Client is already blocked: ${name}"
    return 0
  fi

  # Update cache first
  monitor::update_endpoint_cache
  
  local public_key
  public_key=$(keys::public "$name") || return 1
  
  local endpoint
  endpoint=$(cmd::block::_get_endpoint "$name" "$public_key")

  local client_ip
  client_ip=$(peers::get_ip "$name") || return 1

  # No specific target — block everything
  # Only full block if no specific targets provided
  if [[ ${#ips[@]} -eq 0 && ${#ports[@]} -eq 0 && ${#subnets[@]} -eq 0 ]]; then
    cmd::block::_block_all "$name" "$client_ip" "$quiet"
    return 0
  fi

  # Specific rules — don't full block
  block::set_direct "$name" "$client_ip" "false"  # ensure not marked as full block

  # Block specific IPs
  for ip in "${ips[@]}"; do
    ip::require_valid "$ip"
    fw::block_ip "$client_ip" "$ip"
    block::add_rule "$name" "$client_ip" "ip" "" "$ip"
  done

  # Block specific subnets
  for subnet in "${subnets[@]}"; do
    ip::require_valid "$subnet"
    fw::block_subnet "$client_ip" "$subnet"
    block::add_rule "$name" "$client_ip" "subnet" "" "$target_ip"
  done

  # Block specific ports
  for entry in "${ports[@]}"; do
    local target port proto
    IFS=":" read -r target port proto <<< "$entry"
    ip::require_valid "$target"

    fw::block_port "$client_ip" "$target" "$port" "${proto:-tcp}"
    block::add_rule "$name" "$client_ip" "port" "" "$target" "$port" "${proto:-tcp}"
  done

  for svc in "${services[@]}"; do
    local resolved_lines=()
    mapfile -t resolved_lines < <(net::resolve "$svc" 2>/dev/null)
    if [[ ${#resolved_lines[@]} -eq 0 ]]; then
      log::error "Service not found or has no ports: ${svc}"
      return 1
    fi
    for resolved in "${resolved_lines[@]}"; do
      if [[ "$resolved" == *:*:* ]]; then
        # ip:port:proto
        local b_ip b_port b_proto
        IFS=":" read -r b_ip b_port b_proto <<< "$resolved"
        fw::block_port "$client_ip" "$b_ip" "$b_port" "$b_proto"
        block::add_rule "$name" "$client_ip" "port" "$svc" \
          "$b_ip" "$b_port" "$b_proto"
      else
        # just ip
        fw::block_ip "$client_ip" "$resolved"
        block::add_rule "$name" "$client_ip" "ip" "$svc" "$resolved"
      fi
    done
  done

  log::debug "Block rules applied for: ${name}"
}