function cmd::logs::on_load() {
  flag::register --name
  flag::register --type
  flag::register --since
  flag::register --limit
  flag::register --fw
  flag::register --wg
  flag::register --follow
  flag::register --merged
  flag::register --all
  flag::register --before
  flag::register --force
  flag::register --days
  flag::register --raw
  flag::register --detailed
  flag::register --service
  flag::register --event
  flag::register --ascending
  flag::register --descending
}

function cmd::logs::help() {
  cat <<EOF
Usage: wgctl logs [subcommand] [options]

Show or manage WireGuard and firewall activity logs.

Subcommands:
  show (default)    Show activity logs
  remove, rm        Remove log entries
  rotate            Remove entries older than N days

Options for show:
  --name <name>         Filter by client name
  --type <type>         Filter by device type
  --limit <n>           Max results per source (default: 50)
  --since <time>        Show events since: 2h, 7d, 23/05, 23/05/2026, 2026-05-23
  --service <svc>       Filter by service name, IP, or IP:port
                        e.g. pihole, proxmox:web-ui, 10.0.0.100, 10.0.0.100:8006
  --event <type>        Filter wg events: attempt | handshake
  --fw                  Show only firewall drops
  --wg                  Show only WireGuard events
  --merged              Show all events chronologically interleaved
  --detailed            Show all deduplicated events (bypass hourly collapse)
  --follow, -f          Follow logs in real time
  --raw                 Show raw IPs without service annotation

Options for remove:
  --name <name>     Remove entries for specific peer
  --all             Remove all log entries
  --fw              Remove only firewall events
  --wg              Remove only WireGuard events
  --before <days>   Remove entries older than N days
  --force           Skip confirmation

Options for rotate:
  --days <n>        Days to keep (default: 7)
  --force           Skip confirmation

Examples:
  wgctl logs
  wgctl logs --since 2h
  wgctl logs --since 23/05
  wgctl logs --name phone-nuno --since 7d
  wgctl logs --fw --service pihole
  wgctl logs --fw --service proxmox:web-ui
  wgctl logs --fw --service 10.0.0.100
  wgctl logs --wg --event attempt
  wgctl logs --wg --event handshake --since 24h
  wgctl logs --detailed
  wgctl logs --merged
  wgctl logs --follow
  wgctl logs remove --name phone-nuno
  wgctl logs rotate --days 30
EOF
}