From c4c397458b9087746f5bd4a503e76e370ccebe3c Mon Sep 17 00:00:00 2001
From: umair <umair.hussain@ably.com>
Date: Thu, 12 Mar 2026 23:00:57 +0000
Subject: [PATCH 1/8] Add push notification commands for device management,
 channel subscriptions, publishing, and configuration

---
 README.md                                     | 705 ++++++++++++++++--
 docs/Project-Structure.md                     |   8 +-
 src/base-command.ts                           |   3 +
 src/commands/apps/set-apns-p12.ts             |   6 +
 src/commands/push/batch-publish.ts            | 179 +++++
 src/commands/push/channels/index.ts           |  15 +
 src/commands/push/channels/list-channels.ts   |  77 ++
 src/commands/push/channels/list.ts            | 107 +++
 src/commands/push/channels/remove-where.ts    |  94 +++
 src/commands/push/channels/remove.ts          | 110 +++
 src/commands/push/channels/save.ts            |  85 +++
 src/commands/push/config/clear-apns.ts        | 121 +++
 src/commands/push/config/clear-fcm.ts         | 110 +++
 src/commands/push/config/index.ts             |  15 +
 src/commands/push/config/set-apns.ts          | 172 +++++
 src/commands/push/config/set-fcm.ts           | 101 +++
 src/commands/push/config/show.ts              | 134 ++++
 src/commands/push/devices/get.ts              |  92 +++
 src/commands/push/devices/index.ts            |  14 +
 src/commands/push/devices/list.ts             | 117 +++
 src/commands/push/devices/remove-where.ts     |  88 +++
 src/commands/push/devices/remove.ts           |  77 ++
 src/commands/push/devices/save.ts             | 238 ++++++
 src/commands/push/index.ts                    |  15 +
 src/commands/push/publish.ts                  | 197 +++++
 src/services/control-api.ts                   |  15 +-
 src/utils/output.ts                           |  18 +
 test/e2e/push/channels-e2e.test.ts            | 177 +++++
 test/e2e/push/devices-e2e.test.ts             | 496 ++++++++++++
 test/e2e/push/publish-e2e.test.ts             | 316 ++++++++
 test/e2e/push/push-config-e2e.test.ts         | 446 +++++++++++
 test/fixtures/push/test-apns-key.p8           |   5 +
 .../push/test-fcm-service-account.json        |  10 +
 test/helpers/mock-ably-rest.ts                |   6 +
 test/unit/commands/push/batch-publish.test.ts | 128 ++++
 .../push/channels/list-channels.test.ts       |  86 +++
 test/unit/commands/push/channels/list.test.ts | 100 +++
 .../push/channels/remove-where.test.ts        |  85 +++
 .../commands/push/channels/remove.test.ts     | 102 +++
 test/unit/commands/push/channels/save.test.ts | 122 +++
 .../commands/push/config/clear-apns.test.ts   | 160 ++++
 .../commands/push/config/clear-fcm.test.ts    | 160 ++++
 .../commands/push/config/set-apns.test.ts     | 248 ++++++
 .../unit/commands/push/config/set-fcm.test.ts | 165 ++++
 test/unit/commands/push/config/show.test.ts   | 221 ++++++
 test/unit/commands/push/devices/get.test.ts   |  97 +++
 test/unit/commands/push/devices/list.test.ts  | 128 ++++
 .../push/devices/remove-where.test.ts         |  82 ++
 .../unit/commands/push/devices/remove.test.ts |  69 ++
 test/unit/commands/push/devices/save.test.ts  | 252 +++++++
 test/unit/commands/push/publish.test.ts       | 136 ++++
 51 files changed, 6660 insertions(+), 50 deletions(-)
 create mode 100644 src/commands/push/batch-publish.ts
 create mode 100644 src/commands/push/channels/index.ts
 create mode 100644 src/commands/push/channels/list-channels.ts
 create mode 100644 src/commands/push/channels/list.ts
 create mode 100644 src/commands/push/channels/remove-where.ts
 create mode 100644 src/commands/push/channels/remove.ts
 create mode 100644 src/commands/push/channels/save.ts
 create mode 100644 src/commands/push/config/clear-apns.ts
 create mode 100644 src/commands/push/config/clear-fcm.ts
 create mode 100644 src/commands/push/config/index.ts
 create mode 100644 src/commands/push/config/set-apns.ts
 create mode 100644 src/commands/push/config/set-fcm.ts
 create mode 100644 src/commands/push/config/show.ts
 create mode 100644 src/commands/push/devices/get.ts
 create mode 100644 src/commands/push/devices/index.ts
 create mode 100644 src/commands/push/devices/list.ts
 create mode 100644 src/commands/push/devices/remove-where.ts
 create mode 100644 src/commands/push/devices/remove.ts
 create mode 100644 src/commands/push/devices/save.ts
 create mode 100644 src/commands/push/index.ts
 create mode 100644 src/commands/push/publish.ts
 create mode 100644 test/e2e/push/channels-e2e.test.ts
 create mode 100644 test/e2e/push/devices-e2e.test.ts
 create mode 100644 test/e2e/push/publish-e2e.test.ts
 create mode 100644 test/e2e/push/push-config-e2e.test.ts
 create mode 100644 test/fixtures/push/test-apns-key.p8
 create mode 100644 test/fixtures/push/test-fcm-service-account.json
 create mode 100644 test/unit/commands/push/batch-publish.test.ts
 create mode 100644 test/unit/commands/push/channels/list-channels.test.ts
 create mode 100644 test/unit/commands/push/channels/list.test.ts
 create mode 100644 test/unit/commands/push/channels/remove-where.test.ts
 create mode 100644 test/unit/commands/push/channels/remove.test.ts
 create mode 100644 test/unit/commands/push/channels/save.test.ts
 create mode 100644 test/unit/commands/push/config/clear-apns.test.ts
 create mode 100644 test/unit/commands/push/config/clear-fcm.test.ts
 create mode 100644 test/unit/commands/push/config/set-apns.test.ts
 create mode 100644 test/unit/commands/push/config/set-fcm.test.ts
 create mode 100644 test/unit/commands/push/config/show.test.ts
 create mode 100644 test/unit/commands/push/devices/get.test.ts
 create mode 100644 test/unit/commands/push/devices/list.test.ts
 create mode 100644 test/unit/commands/push/devices/remove-where.test.ts
 create mode 100644 test/unit/commands/push/devices/remove.test.ts
 create mode 100644 test/unit/commands/push/devices/save.test.ts
 create mode 100644 test/unit/commands/push/publish.test.ts

diff --git a/README.md b/README.md
index 9c27fc82..a7c13a10 100644
--- a/README.md
+++ b/README.md
@@ -86,7 +86,6 @@ $ ably-interactive
 * [`ably apps rules delete NAMEORID`](#ably-apps-rules-delete-nameorid)
 * [`ably apps rules list`](#ably-apps-rules-list)
 * [`ably apps rules update NAMEORID`](#ably-apps-rules-update-nameorid)
-* [`ably apps set-apns-p12 ID`](#ably-apps-set-apns-p12-id)
 * [`ably apps switch [APPID]`](#ably-apps-switch-appid)
 * [`ably apps update ID`](#ably-apps-update-id)
 * [`ably auth`](#ably-auth)
@@ -150,6 +149,27 @@ $ ably-interactive
 * [`ably logs push history`](#ably-logs-push-history)
 * [`ably logs push subscribe`](#ably-logs-push-subscribe)
 * [`ably logs subscribe`](#ably-logs-subscribe)
+* [`ably push`](#ably-push)
+* [`ably push batch-publish`](#ably-push-batch-publish)
+* [`ably push channels`](#ably-push-channels)
+* [`ably push channels list`](#ably-push-channels-list)
+* [`ably push channels list-channels`](#ably-push-channels-list-channels)
+* [`ably push channels remove`](#ably-push-channels-remove)
+* [`ably push channels remove-where`](#ably-push-channels-remove-where)
+* [`ably push channels save`](#ably-push-channels-save)
+* [`ably push config`](#ably-push-config)
+* [`ably push config clear-apns`](#ably-push-config-clear-apns)
+* [`ably push config clear-fcm`](#ably-push-config-clear-fcm)
+* [`ably push config set-apns`](#ably-push-config-set-apns)
+* [`ably push config set-fcm`](#ably-push-config-set-fcm)
+* [`ably push config show`](#ably-push-config-show)
+* [`ably push devices`](#ably-push-devices)
+* [`ably push devices get DEVICE-ID`](#ably-push-devices-get-device-id)
+* [`ably push devices list`](#ably-push-devices-list)
+* [`ably push devices remove DEVICE-ID`](#ably-push-devices-remove-device-id)
+* [`ably push devices remove-where`](#ably-push-devices-remove-where)
+* [`ably push devices save`](#ably-push-devices-save)
+* [`ably push publish`](#ably-push-publish)
 * [`ably queues`](#ably-queues)
 * [`ably queues create`](#ably-queues-create)
 * [`ably queues delete QUEUEID`](#ably-queues-delete-queueid)
@@ -409,14 +429,13 @@ EXAMPLES
   $ ably apps switch my-app
 
 COMMANDS
-  ably apps create        Create a new app
-  ably apps current       Show the currently selected app
-  ably apps delete        Delete an app
-  ably apps list          List all apps in the current account
-  ably apps rules         Manage Ably channel rules (namespaces)
-  ably apps set-apns-p12  Upload Apple Push Notification Service P12 certificate for an app
-  ably apps switch        Switch to a different Ably app
-  ably apps update        Update an app
+  ably apps create   Create a new app
+  ably apps current  Show the currently selected app
+  ably apps delete   Delete an app
+  ably apps list     List all apps in the current account
+  ably apps rules    Manage Ably channel rules (namespaces)
+  ably apps switch   Switch to a different Ably app
+  ably apps update   Update an app
 ```
 
 _See code: [src/commands/apps/index.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/apps/index.ts)_
@@ -729,41 +748,6 @@ EXAMPLES
 
 _See code: [src/commands/apps/rules/update.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/apps/rules/update.ts)_
 
-## `ably apps set-apns-p12 ID`
-
-Upload Apple Push Notification Service P12 certificate for an app
-
-```
-USAGE
-  $ ably apps set-apns-p12 ID --certificate <value> [-v] [--json | --pretty-json] [--password <value>]
-    [--use-for-sandbox]
-
-ARGUMENTS
-  ID  App ID to set the APNS certificate for
-
-FLAGS
-  -v, --verbose              Output verbose logs
-      --certificate=<value>  (required) Path to the P12 certificate file
-      --json                 Output in JSON format
-      --password=<value>     Password for the P12 certificate
-      --pretty-json          Output in colorized JSON format
-      --use-for-sandbox      Whether to use this certificate for the APNS sandbox environment
-
-DESCRIPTION
-  Upload Apple Push Notification Service P12 certificate for an app
-
-EXAMPLES
-  $ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12
-
-  $ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --password "YOUR_CERTIFICATE_PASSWORD"
-
-  $ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --use-for-sandbox
-
-  $ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --json
-```
-
-_See code: [src/commands/apps/set-apns-p12.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/apps/set-apns-p12.ts)_
-
 ## `ably apps switch [APPID]`
 
 Switch to a different Ably app
@@ -2853,6 +2837,639 @@ EXAMPLES
 
 _See code: [src/commands/logs/subscribe.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/logs/subscribe.ts)_
 
+## `ably push`
+
+Manage push notifications
+
+```
+USAGE
+  $ ably push
+
+DESCRIPTION
+  Manage push notifications
+
+EXAMPLES
+  $ ably push publish --device-id device1 --title Hello --body World
+
+  $ ably push devices list
+
+  $ ably push channels list --channel my-channel
+
+  $ ably push config show
+
+COMMANDS
+  ably push batch-publish  Publish push notifications to multiple recipients in a batch
+  ably push channels       Manage push notification channel subscriptions
+  ably push config         Manage push notification configuration (APNs, FCM)
+  ably push devices        Manage push notification device registrations
+  ably push publish        Publish a push notification to a device or client
+```
+
+_See code: [src/commands/push/index.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/index.ts)_
+
+## `ably push batch-publish`
+
+Publish push notifications to multiple recipients in a batch
+
+```
+USAGE
+  $ ably push batch-publish --payload <value> [-v] [--json | --pretty-json]
+
+FLAGS
+  -v, --verbose          Output verbose logs
+      --json             Output in JSON format
+      --payload=<value>  (required) Batch payload as JSON array, @filepath, or - for stdin
+      --pretty-json      Output in colorized JSON format
+
+DESCRIPTION
+  Publish push notifications to multiple recipients in a batch
+
+EXAMPLES
+  $ ably push batch-publish --payload '[{"recipient":{"deviceId":"dev1"},"notification":{"title":"Hello"}}]'
+
+  $ ably push batch-publish --payload @batch.json
+
+  cat batch.json | ably push batch-publish --payload -
+
+  $ ably push batch-publish --payload @batch.json --json
+```
+
+_See code: [src/commands/push/batch-publish.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/batch-publish.ts)_
+
+## `ably push channels`
+
+Manage push notification channel subscriptions
+
+```
+USAGE
+  $ ably push channels
+
+DESCRIPTION
+  Manage push notification channel subscriptions
+
+EXAMPLES
+  $ ably push channels list --channel my-channel
+
+  $ ably push channels save --channel my-channel --device-id device-123
+
+  $ ably push channels list-channels
+```
+
+_See code: [src/commands/push/channels/index.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/channels/index.ts)_
+
+## `ably push channels list`
+
+List push channel subscriptions
+
+```
+USAGE
+  $ ably push channels list --channel <value> [-v] [--json | --pretty-json] [--device-id <value>] [--client-id <value>]
+    [--limit <value>]
+
+FLAGS
+  -v, --verbose            Output verbose logs
+      --channel=<value>    (required) Channel name to list subscriptions for
+      --client-id=<value>  Filter by client ID
+      --device-id=<value>  Filter by device ID
+      --json               Output in JSON format
+      --limit=<value>      [default: 100] Maximum number of results to return (default: 100)
+      --pretty-json        Output in colorized JSON format
+
+DESCRIPTION
+  List push channel subscriptions
+
+EXAMPLES
+  $ ably push channels list --channel my-channel
+
+  $ ably push channels list --channel my-channel --device-id device-123
+
+  $ ably push channels list --channel my-channel --json
+```
+
+_See code: [src/commands/push/channels/list.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/channels/list.ts)_
+
+## `ably push channels list-channels`
+
+List channels with push subscriptions
+
+```
+USAGE
+  $ ably push channels list-channels [-v] [--json | --pretty-json] [--limit <value>]
+
+FLAGS
+  -v, --verbose        Output verbose logs
+      --json           Output in JSON format
+      --limit=<value>  [default: 100] Maximum number of results to return (default: 100)
+      --pretty-json    Output in colorized JSON format
+
+DESCRIPTION
+  List channels with push subscriptions
+
+EXAMPLES
+  $ ably push channels list-channels
+
+  $ ably push channels list-channels --limit 50
+
+  $ ably push channels list-channels --json
+```
+
+_See code: [src/commands/push/channels/list-channels.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/channels/list-channels.ts)_
+
+## `ably push channels remove`
+
+Remove a push channel subscription
+
+```
+USAGE
+  $ ably push channels remove --channel <value> [-v] [--json | --pretty-json] [--device-id <value> | --client-id <value>]
+    [-f]
+
+FLAGS
+  -f, --force              Skip confirmation prompt
+  -v, --verbose            Output verbose logs
+      --channel=<value>    (required) Channel name to unsubscribe from
+      --client-id=<value>  Client ID to unsubscribe
+      --device-id=<value>  Device ID to unsubscribe
+      --json               Output in JSON format
+      --pretty-json        Output in colorized JSON format
+
+DESCRIPTION
+  Remove a push channel subscription
+
+EXAMPLES
+  $ ably push channels remove --channel my-channel --device-id device-123
+
+  $ ably push channels remove --channel my-channel --client-id client-1 --force
+
+  $ ably push channels remove --channel my-channel --device-id device-123 --json
+```
+
+_See code: [src/commands/push/channels/remove.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/channels/remove.ts)_
+
+## `ably push channels remove-where`
+
+Remove push channel subscriptions matching filter criteria
+
+```
+USAGE
+  $ ably push channels remove-where --channel <value> [-v] [--json | --pretty-json] [--device-id <value>] [--client-id <value>]
+    [-f]
+
+FLAGS
+  -f, --force              Skip confirmation prompt
+  -v, --verbose            Output verbose logs
+      --channel=<value>    (required) Channel name to filter by
+      --client-id=<value>  Filter by client ID
+      --device-id=<value>  Filter by device ID
+      --json               Output in JSON format
+      --pretty-json        Output in colorized JSON format
+
+DESCRIPTION
+  Remove push channel subscriptions matching filter criteria
+
+EXAMPLES
+  $ ably push channels remove-where --channel my-channel
+
+  $ ably push channels remove-where --channel my-channel --device-id device-123 --force
+
+  $ ably push channels remove-where --channel my-channel --json
+```
+
+_See code: [src/commands/push/channels/remove-where.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/channels/remove-where.ts)_
+
+## `ably push channels save`
+
+Subscribe a device or client to push notifications on a channel
+
+```
+USAGE
+  $ ably push channels save --channel <value> [-v] [--json | --pretty-json] [--device-id <value> | --client-id <value>]
+
+FLAGS
+  -v, --verbose            Output verbose logs
+      --channel=<value>    (required) Channel name to subscribe to
+      --client-id=<value>  Client ID to subscribe
+      --device-id=<value>  Device ID to subscribe
+      --json               Output in JSON format
+      --pretty-json        Output in colorized JSON format
+
+DESCRIPTION
+  Subscribe a device or client to push notifications on a channel
+
+EXAMPLES
+  $ ably push channels save --channel my-channel --device-id device-123
+
+  $ ably push channels save --channel my-channel --client-id client-1
+
+  $ ably push channels save --channel my-channel --device-id device-123 --json
+```
+
+_See code: [src/commands/push/channels/save.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/channels/save.ts)_
+
+## `ably push config`
+
+Manage push notification configuration (APNs, FCM)
+
+```
+USAGE
+  $ ably push config
+
+DESCRIPTION
+  Manage push notification configuration (APNs, FCM)
+
+EXAMPLES
+  $ ably push config show
+
+  $ ably push config set-apns --certificate /path/to/cert.p12
+
+  $ ably push config set-fcm --service-account /path/to/service-account.json
+```
+
+_See code: [src/commands/push/config/index.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/config/index.ts)_
+
+## `ably push config clear-apns`
+
+Clear APNs push notification configuration for an app
+
+```
+USAGE
+  $ ably push config clear-apns [-v] [--json | --pretty-json] [--app <value>] [-f]
+
+FLAGS
+  -f, --force        Skip confirmation prompt
+  -v, --verbose      Output verbose logs
+      --app=<value>  The app ID or name (defaults to current app)
+      --json         Output in JSON format
+      --pretty-json  Output in colorized JSON format
+
+DESCRIPTION
+  Clear APNs push notification configuration for an app
+
+EXAMPLES
+  $ ably push config clear-apns
+
+  $ ably push config clear-apns --app my-app --force
+
+  $ ably push config clear-apns --force --json
+```
+
+_See code: [src/commands/push/config/clear-apns.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/config/clear-apns.ts)_
+
+## `ably push config clear-fcm`
+
+Clear FCM push notification configuration for an app
+
+```
+USAGE
+  $ ably push config clear-fcm [-v] [--json | --pretty-json] [--app <value>] [-f]
+
+FLAGS
+  -f, --force        Skip confirmation prompt
+  -v, --verbose      Output verbose logs
+      --app=<value>  The app ID or name (defaults to current app)
+      --json         Output in JSON format
+      --pretty-json  Output in colorized JSON format
+
+DESCRIPTION
+  Clear FCM push notification configuration for an app
+
+EXAMPLES
+  $ ably push config clear-fcm
+
+  $ ably push config clear-fcm --app my-app --force
+
+  $ ably push config clear-fcm --force --json
+```
+
+_See code: [src/commands/push/config/clear-fcm.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/config/clear-fcm.ts)_
+
+## `ably push config set-apns`
+
+Configure APNs push notifications for an app
+
+```
+USAGE
+  $ ably push config set-apns [-v] [--json | --pretty-json] [--app <value>] [--certificate <value> | --key-file <value>]
+    [--key-id <value>] [--password <value>] [--sandbox] [--team-id <value>] [--topic <value>]
+
+FLAGS
+  -v, --verbose              Output verbose logs
+      --app=<value>          The app ID or name (defaults to current app)
+      --certificate=<value>  Path to the P12 certificate file
+      --json                 Output in JSON format
+      --key-file=<value>     Path to the P8 key file
+      --key-id=<value>       The APNs key ID (required for P8)
+      --password=<value>     Password for the P12 certificate
+      --pretty-json          Output in colorized JSON format
+      --sandbox              Use the APNs sandbox environment
+      --team-id=<value>      The Apple Developer Team ID (required for P8)
+      --topic=<value>        The APNs topic / bundle ID (required for P8)
+
+DESCRIPTION
+  Configure APNs push notifications for an app
+
+EXAMPLES
+  $ ably push config set-apns --certificate /path/to/cert.p12
+
+  $ ably push config set-apns --certificate /path/to/cert.p12 --password secret --sandbox
+
+  $ ably push config set-apns --key-file /path/to/key.p8 --key-id ABC123 --team-id DEF456 --topic com.example.app
+
+  $ ably push config set-apns --certificate /path/to/cert.p12 --json
+```
+
+_See code: [src/commands/push/config/set-apns.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/config/set-apns.ts)_
+
+## `ably push config set-fcm`
+
+Configure FCM push notifications for an app
+
+```
+USAGE
+  $ ably push config set-fcm --service-account <value> [-v] [--json | --pretty-json] [--app <value>]
+
+FLAGS
+  -v, --verbose                  Output verbose logs
+      --app=<value>              The app ID or name (defaults to current app)
+      --json                     Output in JSON format
+      --pretty-json              Output in colorized JSON format
+      --service-account=<value>  (required) Path to the FCM service account JSON file
+
+DESCRIPTION
+  Configure FCM push notifications for an app
+
+EXAMPLES
+  $ ably push config set-fcm --service-account /path/to/service-account.json
+
+  $ ably push config set-fcm --service-account /path/to/service-account.json --app my-app
+
+  $ ably push config set-fcm --service-account /path/to/service-account.json --json
+```
+
+_See code: [src/commands/push/config/set-fcm.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/config/set-fcm.ts)_
+
+## `ably push config show`
+
+Show push notification configuration for an app
+
+```
+USAGE
+  $ ably push config show [-v] [--json | --pretty-json] [--app <value>]
+
+FLAGS
+  -v, --verbose      Output verbose logs
+      --app=<value>  The app ID or name (defaults to current app)
+      --json         Output in JSON format
+      --pretty-json  Output in colorized JSON format
+
+DESCRIPTION
+  Show push notification configuration for an app
+
+EXAMPLES
+  $ ably push config show
+
+  $ ably push config show --app my-app
+
+  $ ably push config show --json
+```
+
+_See code: [src/commands/push/config/show.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/config/show.ts)_
+
+## `ably push devices`
+
+Manage push notification device registrations
+
+```
+USAGE
+  $ ably push devices
+
+DESCRIPTION
+  Manage push notification device registrations
+
+EXAMPLES
+  $ ably push devices list
+
+  $ ably push devices get device-123
+
+  $ ably push devices save --id device-123 --platform ios --form-factor phone --transport-type apns --device-token token123
+```
+
+_See code: [src/commands/push/devices/index.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/devices/index.ts)_
+
+## `ably push devices get DEVICE-ID`
+
+Get details of a push device registration
+
+```
+USAGE
+  $ ably push devices get DEVICE-ID [-v] [--json | --pretty-json]
+
+ARGUMENTS
+  DEVICE-ID  The device ID to retrieve
+
+FLAGS
+  -v, --verbose      Output verbose logs
+      --json         Output in JSON format
+      --pretty-json  Output in colorized JSON format
+
+DESCRIPTION
+  Get details of a push device registration
+
+EXAMPLES
+  $ ably push devices get device-123
+
+  $ ably push devices get device-123 --json
+```
+
+_See code: [src/commands/push/devices/get.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/devices/get.ts)_
+
+## `ably push devices list`
+
+List push device registrations
+
+```
+USAGE
+  $ ably push devices list [-v] [--json | --pretty-json] [--device-id <value>] [--client-id <value>] [--state
+    ACTIVE|FAILING|FAILED] [--limit <value>]
+
+FLAGS
+  -v, --verbose            Output verbose logs
+      --client-id=<value>  Filter by client ID
+      --device-id=<value>  Filter by device ID
+      --json               Output in JSON format
+      --limit=<value>      [default: 100] Maximum number of results to return (default: 100)
+      --pretty-json        Output in colorized JSON format
+      --state=<option>     Filter by device state
+                           <options: ACTIVE|FAILING|FAILED>
+
+DESCRIPTION
+  List push device registrations
+
+EXAMPLES
+  $ ably push devices list
+
+  $ ably push devices list --device-id device-123
+
+  $ ably push devices list --client-id client-1
+
+  $ ably push devices list --limit 50 --json
+```
+
+_See code: [src/commands/push/devices/list.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/devices/list.ts)_
+
+## `ably push devices remove DEVICE-ID`
+
+Remove a push device registration
+
+```
+USAGE
+  $ ably push devices remove DEVICE-ID [-v] [--json | --pretty-json] [-f]
+
+ARGUMENTS
+  DEVICE-ID  The device ID to remove
+
+FLAGS
+  -f, --force        Skip confirmation prompt
+  -v, --verbose      Output verbose logs
+      --json         Output in JSON format
+      --pretty-json  Output in colorized JSON format
+
+DESCRIPTION
+  Remove a push device registration
+
+EXAMPLES
+  $ ably push devices remove device-123
+
+  $ ably push devices remove device-123 --force
+
+  $ ably push devices remove device-123 --json
+```
+
+_See code: [src/commands/push/devices/remove.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/devices/remove.ts)_
+
+## `ably push devices remove-where`
+
+Remove push device registrations matching filter criteria
+
+```
+USAGE
+  $ ably push devices remove-where [-v] [--json | --pretty-json] [--device-id <value>] [--client-id <value>] [-f]
+
+FLAGS
+  -f, --force              Skip confirmation prompt
+  -v, --verbose            Output verbose logs
+      --client-id=<value>  Filter by client ID
+      --device-id=<value>  Filter by device ID
+      --json               Output in JSON format
+      --pretty-json        Output in colorized JSON format
+
+DESCRIPTION
+  Remove push device registrations matching filter criteria
+
+EXAMPLES
+  $ ably push devices remove-where --device-id device-123
+
+  $ ably push devices remove-where --client-id client-1 --force
+
+  $ ably push devices remove-where --device-id device-123 --json
+```
+
+_See code: [src/commands/push/devices/remove-where.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/devices/remove-where.ts)_
+
+## `ably push devices save`
+
+Register or update a push device
+
+```
+USAGE
+  $ ably push devices save [-v] [--json | --pretty-json] [--id <value>] [--platform ios|android|browser] [--form-factor
+    phone|tablet|desktop|tv|watch|car|embedded|other] [--transport-type apns|fcm|web] [--device-token <value>]
+    [--target-url <value>] [--p256dh-key <value>] [--auth-secret <value>] [--client-id <value>] [--metadata <value>]
+    [--data <value>]
+
+FLAGS
+  -v, --verbose                  Output verbose logs
+      --auth-secret=<value>      Web push auth secret (required for web transport)
+      --client-id=<value>        Client ID to associate with the device
+      --data=<value>             Full device details as JSON string or @filepath
+      --device-token=<value>     Push device token (required for apns/fcm transport)
+      --form-factor=<option>     Device form factor
+                                 <options: phone|tablet|desktop|tv|watch|car|embedded|other>
+      --id=<value>               Device ID
+      --json                     Output in JSON format
+      --metadata=<value>         Device metadata as JSON
+      --p256dh-key=<value>       Web push P256DH key (required for web transport)
+      --platform=<option>        Device platform
+                                 <options: ios|android|browser>
+      --pretty-json              Output in colorized JSON format
+      --target-url=<value>       Web push target URL (required for web transport)
+      --transport-type=<option>  Push transport type
+                                 <options: apns|fcm|web>
+
+DESCRIPTION
+  Register or update a push device
+
+EXAMPLES
+  $ ably push devices save --id device-123 --platform ios --form-factor phone --transport-type apns --device-token token123
+
+  $ ably push devices save --id browser-1 --platform browser --form-factor desktop --transport-type web --target-url https://push.example.com --p256dh-key KEY --auth-secret SECRET
+
+  $ ably push devices save --data '{"id":"device-123","platform":"ios","formFactor":"phone","push":{"recipient":{"transportType":"apns","deviceToken":"token123"}}}'
+
+  $ ably push devices save --data @device.json
+
+  $ ably push devices save --id device-123 --platform ios --form-factor phone --transport-type apns --device-token token123 --json
+```
+
+_See code: [src/commands/push/devices/save.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/devices/save.ts)_
+
+## `ably push publish`
+
+Publish a push notification to a device or client
+
+```
+USAGE
+  $ ably push publish [-v] [--json | --pretty-json] [--device-id <value> | --client-id <value> | --recipient
+    <value>] [--title <value>] [--body <value>] [--sound <value>] [--icon <value>] [--badge <value>] [--data <value>]
+    [--collapse-key <value>] [--ttl <value>] [--payload <value>] [--apns <value>] [--fcm <value>] [--web <value>]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --apns=<value>          APNs-specific override as JSON
+      --badge=<value>         Notification badge count
+      --body=<value>          Notification body
+      --client-id=<value>     Target client ID
+      --collapse-key=<value>  Collapse key for notification grouping
+      --data=<value>          Custom data payload as JSON
+      --device-id=<value>     Target device ID
+      --fcm=<value>           FCM-specific override as JSON
+      --icon=<value>          Notification icon
+      --json                  Output in JSON format
+      --payload=<value>       Full notification payload as JSON (overrides convenience flags)
+      --pretty-json           Output in colorized JSON format
+      --recipient=<value>     Raw recipient JSON for advanced targeting
+      --sound=<value>         Notification sound
+      --title=<value>         Notification title
+      --ttl=<value>           Time to live in seconds
+      --web=<value>           Web push-specific override as JSON
+
+DESCRIPTION
+  Publish a push notification to a device or client
+
+EXAMPLES
+  $ ably push publish --device-id device-123 --title Hello --body World
+
+  $ ably push publish --client-id client-1 --title Hello --body World
+
+  $ ably push publish --device-id device-123 --payload '{"notification":{"title":"Hello","body":"World"}}'
+
+  $ ably push publish --recipient '{"transportType":"apns","deviceToken":"token123"}' --title Hello --body World
+
+  $ ably push publish --device-id device-123 --title Hello --body World --json
+```
+
+_See code: [src/commands/push/publish.ts](https://github.com/ably/ably-cli/blob/v0.17.0/src/commands/push/publish.ts)_
+
 ## `ably queues`
 
 Manage Ably Queues
diff --git a/docs/Project-Structure.md b/docs/Project-Structure.md
index daa9b861..6b2fb6db 100644
--- a/docs/Project-Structure.md
+++ b/docs/Project-Structure.md
@@ -48,6 +48,10 @@ This document outlines the directory structure of the Ably CLI project.
 │   │   ├── connections/        # Client connections (test)
 │   │   ├── integrations/       # Integration rules
 │   │   ├── logs/               # Log streams (subscribe, history, push subscribe)
+│   │   ├── push/              # Push notifications
+│   │   │   ├── config/        # Push config (show, set-apns, set-fcm, clear-apns, clear-fcm)
+│   │   │   ├── devices/       # Device registrations (list, get, save, remove, remove-where)
+│   │   │   └── channels/      # Channel subscriptions (list, list-channels, save, remove, remove-where)
 │   │   ├── queues/             # Queue management
 │   │   ├── rooms/              # Ably Chat rooms (send, subscribe, presence, reactions, typing, etc.)
 │   │   ├── spaces/             # Ably Spaces (members, cursors, locations, locks)
@@ -112,7 +116,8 @@ This document outlines the directory structure of the Ably CLI project.
 │   │   ├── standard-tests.ts        # Standard test generators for the 5 required describe blocks
 │   │   └── control-api-test-helpers.ts # Shared helpers for Control API nock tests (nockControl, getControlApiContext)
 │   ├── fixtures/                 # Mock data factories
-│   │   └── control-api.ts           # Mock factory functions for Control API response bodies (mockApp, mockKey, mockRule, mockQueue, mockNamespace, mockStats)
+│   │   ├── control-api.ts           # Mock factory functions for Control API response bodies (mockApp, mockKey, mockRule, mockQueue, mockNamespace, mockStats)
+│   │   └── push/                    # Push notification test fixtures (P8 key, FCM service account)
 │   ├── unit/                   # Fast, mocked tests
 │   │   ├── setup.ts            # Unit test setup
 │   │   ├── base/               # Base command class tests
@@ -139,6 +144,7 @@ This document outlines the directory structure of the Ably CLI project.
 │   │   ├── interactive/        # Interactive mode E2E tests
 │   │   ├── rooms/              # Chat rooms E2E tests
 │   │   ├── spaces/             # Spaces E2E tests
+│   │   ├── push/               # Push notification E2E tests
 │   │   ├── stats/              # Stats E2E tests
 │   │   └── web-cli/            # Playwright browser tests for Web CLI
 │   └── manual/                 # Manual test scripts
diff --git a/src/base-command.ts b/src/base-command.ts
index 9d96ba79..7fba27e7 100644
--- a/src/base-command.ts
+++ b/src/base-command.ts
@@ -71,6 +71,9 @@ export const WEB_CLI_ANONYMOUS_RESTRICTED_COMMANDS = [
   "integrations*",
   "queues*",
 
+  // Push notification management is not available to anonymous users
+  "push*",
+
   // Stats commands expose account/app usage data
   "stats*",
 ];
diff --git a/src/commands/apps/set-apns-p12.ts b/src/commands/apps/set-apns-p12.ts
index 87c2e089..d15cf473 100644
--- a/src/commands/apps/set-apns-p12.ts
+++ b/src/commands/apps/set-apns-p12.ts
@@ -21,6 +21,8 @@ export default class AppsSetApnsP12Command extends ControlBaseCommand {
   static description =
     "Upload Apple Push Notification Service P12 certificate for an app";
 
+  static hidden = true;
+
   static examples = [
     "$ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12",
     '$ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --password "YOUR_CERTIFICATE_PASSWORD"',
@@ -47,6 +49,10 @@ export default class AppsSetApnsP12Command extends ControlBaseCommand {
   async run(): Promise<void> {
     const { args, flags } = await this.parse(AppsSetApnsP12Command);
 
+    this.warn(
+      'This command is deprecated. Use "ably push config set-apns" instead.',
+    );
+
     // Display authentication information
     this.showAuthInfoIfNeeded(flags);
 
diff --git a/src/commands/push/batch-publish.ts b/src/commands/push/batch-publish.ts
new file mode 100644
index 00000000..2326142c
--- /dev/null
+++ b/src/commands/push/batch-publish.ts
@@ -0,0 +1,179 @@
+import { Flags } from "@oclif/core";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+import { AblyBaseCommand } from "../../base-command.js";
+import { productApiFlags } from "../../flags.js";
+import { BaseFlags } from "../../types/cli.js";
+import {
+  formatCountLabel,
+  formatProgress,
+  formatSuccess,
+} from "../../utils/output.js";
+
+export default class PushBatchPublish extends AblyBaseCommand {
+  static override description =
+    "Publish push notifications to multiple recipients in a batch";
+
+  static override examples = [
+    '<%= config.bin %> <%= command.id %> --payload \'[{"recipient":{"deviceId":"dev1"},"notification":{"title":"Hello"}}]\'',
+    "<%= config.bin %> <%= command.id %> --payload @batch.json",
+    "cat batch.json | <%= config.bin %> <%= command.id %> --payload -",
+    "<%= config.bin %> <%= command.id %> --payload @batch.json --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    payload: Flags.string({
+      description: "Batch payload as JSON array, @filepath, or - for stdin",
+      required: true,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushBatchPublish);
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      let jsonString: string;
+
+      if (flags.payload === "-") {
+        // Read from stdin
+        jsonString = await this.readStdin();
+      } else if (flags.payload.startsWith("@")) {
+        const filePath = path.resolve(flags.payload.slice(1));
+        if (!fs.existsSync(filePath)) {
+          this.fail(
+            `File not found: ${filePath}`,
+            flags as BaseFlags,
+            "pushBatchPublish",
+          );
+        }
+        jsonString = fs.readFileSync(filePath, "utf8");
+      } else {
+        jsonString = flags.payload;
+      }
+
+      let batchPayload: unknown[];
+      try {
+        batchPayload = JSON.parse(jsonString) as unknown[];
+      } catch {
+        this.fail(
+          "Payload must be a valid JSON array",
+          flags as BaseFlags,
+          "pushBatchPublish",
+        );
+      }
+
+      if (!Array.isArray(batchPayload)) {
+        this.fail(
+          "Payload must be a JSON array",
+          flags as BaseFlags,
+          "pushBatchPublish",
+        );
+      }
+
+      if (batchPayload.length > 10000) {
+        this.fail(
+          "Batch payload cannot exceed 10,000 items",
+          flags as BaseFlags,
+          "pushBatchPublish",
+        );
+      }
+
+      for (const [index, item] of batchPayload.entries()) {
+        const entry = item as Record<string, unknown>;
+        if (!entry.recipient) {
+          this.fail(
+            `Item at index ${index} is missing required "recipient" field`,
+            flags as BaseFlags,
+            "pushBatchPublish",
+          );
+        }
+
+        if (!entry.notification && !entry.data) {
+          this.fail(
+            `Item at index ${index} must have a "notification" or "data" field`,
+            flags as BaseFlags,
+            "pushBatchPublish",
+          );
+        }
+      }
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(
+          formatProgress(
+            `Publishing batch of ${formatCountLabel(batchPayload.length, "notification")}`,
+          ),
+        );
+      }
+
+      const response = await rest.request(
+        "post",
+        "/push/batch/publish",
+        2,
+        null,
+        batchPayload,
+      );
+
+      // Parse response items for success/failure counts
+      const items = (response.items ?? []) as Record<string, unknown>[];
+      const failed = items.filter(
+        (item) => item.error || (item.statusCode && item.statusCode !== 200),
+      );
+      const succeeded =
+        items.length > 0 ? items.length - failed.length : batchPayload.length;
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult(
+          {
+            published: true,
+            total: batchPayload.length,
+            succeeded,
+            failed: failed.length,
+            ...(failed.length > 0 ? { failedItems: failed } : {}),
+          },
+          flags,
+        );
+      } else {
+        if (failed.length > 0) {
+          this.log(
+            formatSuccess(
+              `Batch published: ${succeeded} succeeded, ${failed.length} failed out of ${formatCountLabel(batchPayload.length, "notification")}.`,
+            ),
+          );
+          for (const item of failed) {
+            const error = item.error as Record<string, unknown> | undefined;
+            const message = error?.message ?? "Unknown error";
+            const code = error?.code ? ` (code: ${error.code})` : "";
+            this.logToStderr(`  Failed: ${message}${code}`);
+          }
+        } else {
+          this.log(
+            formatSuccess(
+              `Batch of ${formatCountLabel(batchPayload.length, "notification")} published.`,
+            ),
+          );
+        }
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushBatchPublish");
+    }
+  }
+
+  private async readStdin(): Promise<string> {
+    return new Promise((resolve, reject) => {
+      let data = "";
+      process.stdin.setEncoding("utf8");
+      process.stdin.on("data", (chunk) => {
+        data += chunk;
+      });
+      process.stdin.on("end", () => {
+        resolve(data);
+      });
+      process.stdin.on("error", reject);
+    });
+  }
+}
diff --git a/src/commands/push/channels/index.ts b/src/commands/push/channels/index.ts
new file mode 100644
index 00000000..ef63ed26
--- /dev/null
+++ b/src/commands/push/channels/index.ts
@@ -0,0 +1,15 @@
+import { BaseTopicCommand } from "../../../base-topic-command.js";
+
+export default class PushChannels extends BaseTopicCommand {
+  protected topicName = "push:channels";
+  protected commandGroup = "Push channel subscription";
+
+  static override description =
+    "Manage push notification channel subscriptions";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> list --channel my-channel",
+    "<%= config.bin %> <%= command.id %> save --channel my-channel --device-id device-123",
+    "<%= config.bin %> <%= command.id %> list-channels",
+  ];
+}
diff --git a/src/commands/push/channels/list-channels.ts b/src/commands/push/channels/list-channels.ts
new file mode 100644
index 00000000..dec9c307
--- /dev/null
+++ b/src/commands/push/channels/list-channels.ts
@@ -0,0 +1,77 @@
+import { Flags } from "@oclif/core";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatCountLabel,
+  formatLimitWarning,
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushChannelsListChannels extends AblyBaseCommand {
+  static override description = "List channels with push subscriptions";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %>",
+    "<%= config.bin %> <%= command.id %> --limit 50",
+    "<%= config.bin %> <%= command.id %> --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    limit: Flags.integer({
+      description: "Maximum number of results to return (default: 100)",
+      default: 100,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsListChannels);
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(formatProgress("Fetching channels with push subscriptions"));
+      }
+
+      const result = await rest.push.admin.channelSubscriptions.listChannels({
+        limit: flags.limit,
+      });
+      const channels = result.items;
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ channels }, flags);
+        return;
+      }
+
+      if (channels.length === 0) {
+        this.log("No channels with push subscriptions found.");
+        return;
+      }
+
+      this.log(
+        formatSuccess(`Found ${formatCountLabel(channels.length, "channel")}.`),
+      );
+      this.log("");
+
+      for (const channel of channels) {
+        this.log(`  ${formatResource(channel)}`);
+      }
+      this.log("");
+
+      const limitWarning = formatLimitWarning(
+        channels.length,
+        flags.limit,
+        "channels",
+      );
+      if (limitWarning) this.log(limitWarning);
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushChannelListChannels");
+    }
+  }
+}
diff --git a/src/commands/push/channels/list.ts b/src/commands/push/channels/list.ts
new file mode 100644
index 00000000..23297130
--- /dev/null
+++ b/src/commands/push/channels/list.ts
@@ -0,0 +1,107 @@
+import { Flags } from "@oclif/core";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatCountLabel,
+  formatHeading,
+  formatLabel,
+  formatLimitWarning,
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushChannelsList extends AblyBaseCommand {
+  static override description = "List push channel subscriptions";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --channel my-channel",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --device-id device-123",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    channel: Flags.string({
+      description: "Channel name to list subscriptions for",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Filter by device ID",
+    }),
+    "client-id": Flags.string({
+      description: "Filter by client ID",
+    }),
+    limit: Flags.integer({
+      description: "Maximum number of results to return (default: 100)",
+      default: 100,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsList);
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(
+          formatProgress(
+            `Fetching subscriptions for channel ${formatResource(flags.channel)}`,
+          ),
+        );
+      }
+
+      const params: Record<string, string | number> = {
+        channel: flags.channel,
+        limit: flags.limit,
+      };
+      if (flags["device-id"]) params.deviceId = flags["device-id"];
+      if (flags["client-id"]) params.clientId = flags["client-id"];
+
+      const result = await rest.push.admin.channelSubscriptions.list(params);
+      const subscriptions = result.items;
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ subscriptions }, flags);
+        return;
+      }
+
+      if (subscriptions.length === 0) {
+        this.log("No subscriptions found.");
+        return;
+      }
+
+      this.log(
+        formatSuccess(
+          `Found ${formatCountLabel(subscriptions.length, "subscription")}.`,
+        ),
+      );
+      this.log("");
+
+      for (const sub of subscriptions) {
+        const type = sub.deviceId ? "device" : "client";
+        const id = sub.deviceId || sub.clientId || "unknown";
+        this.log(formatHeading(`${type}: ${id}`));
+        this.log(`  ${formatLabel("Channel")} ${formatResource(sub.channel)}`);
+        if (sub.deviceId)
+          this.log(`  ${formatLabel("Device ID")} ${sub.deviceId}`);
+        if (sub.clientId)
+          this.log(`  ${formatLabel("Client ID")} ${sub.clientId}`);
+        this.log("");
+      }
+
+      const limitWarning = formatLimitWarning(
+        subscriptions.length,
+        flags.limit,
+        "subscriptions",
+      );
+      if (limitWarning) this.log(limitWarning);
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushChannelList");
+    }
+  }
+}
diff --git a/src/commands/push/channels/remove-where.ts b/src/commands/push/channels/remove-where.ts
new file mode 100644
index 00000000..5de3e2d2
--- /dev/null
+++ b/src/commands/push/channels/remove-where.ts
@@ -0,0 +1,94 @@
+import { Flags } from "@oclif/core";
+import inquirer from "inquirer";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushChannelsRemoveWhere extends AblyBaseCommand {
+  static override description =
+    "Remove push channel subscriptions matching filter criteria";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --channel my-channel",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --device-id device-123 --force",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    channel: Flags.string({
+      description: "Channel name to filter by",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Filter by device ID",
+    }),
+    "client-id": Flags.string({
+      description: "Filter by client ID",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsRemoveWhere);
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      const params: Record<string, string> = {
+        channel: flags.channel,
+      };
+      if (flags["device-id"]) params.deviceId = flags["device-id"];
+      if (flags["client-id"]) params.clientId = flags["client-id"];
+
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const filterDesc = Object.entries(params)
+          .map(([k, v]) => `${k}=${v}`)
+          .join(", ");
+
+        const { confirmed } = await inquirer.prompt([
+          {
+            type: "confirm",
+            name: "confirmed",
+            message: `Are you sure you want to remove all subscriptions matching: ${filterDesc}?`,
+            default: false,
+          },
+        ]);
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(
+          formatProgress(
+            `Removing matching subscriptions from channel ${formatResource(flags.channel)}`,
+          ),
+        );
+      }
+
+      await rest.push.admin.channelSubscriptions.removeWhere(params);
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ removed: true, filters: params }, flags);
+      } else {
+        this.log(formatSuccess("Matching subscriptions removed."));
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushChannelRemoveWhere");
+    }
+  }
+}
diff --git a/src/commands/push/channels/remove.ts b/src/commands/push/channels/remove.ts
new file mode 100644
index 00000000..348d7aba
--- /dev/null
+++ b/src/commands/push/channels/remove.ts
@@ -0,0 +1,110 @@
+import { Flags } from "@oclif/core";
+import inquirer from "inquirer";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushChannelsRemove extends AblyBaseCommand {
+  static override description = "Remove a push channel subscription";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --channel my-channel --device-id device-123",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --client-id client-1 --force",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --device-id device-123 --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    channel: Flags.string({
+      description: "Channel name to unsubscribe from",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Device ID to unsubscribe",
+      exclusive: ["client-id"],
+    }),
+    "client-id": Flags.string({
+      description: "Client ID to unsubscribe",
+      exclusive: ["device-id"],
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsRemove);
+
+    if (!flags["device-id"] && !flags["client-id"]) {
+      this.fail(
+        "Either --device-id or --client-id must be provided",
+        flags as BaseFlags,
+        "pushChannelRemove",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      const target = flags["device-id"]
+        ? `device ${flags["device-id"]}`
+        : `client ${flags["client-id"]}`;
+
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const { confirmed } = await inquirer.prompt([
+          {
+            type: "confirm",
+            name: "confirmed",
+            message: `Are you sure you want to unsubscribe ${target} from channel ${flags.channel}?`,
+            default: false,
+          },
+        ]);
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(
+          formatProgress(
+            `Removing subscription from channel ${formatResource(flags.channel)}`,
+          ),
+        );
+      }
+
+      const subscription: Record<string, string> = {
+        channel: flags.channel,
+      };
+      if (flags["device-id"]) subscription.deviceId = flags["device-id"];
+      if (flags["client-id"]) subscription.clientId = flags["client-id"];
+
+      await rest.push.admin.channelSubscriptions.remove(subscription as never);
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult(
+          { removed: true, channel: flags.channel, ...subscription },
+          flags,
+        );
+      } else {
+        this.log(
+          formatSuccess(
+            `Subscription removed from channel ${formatResource(flags.channel)}.`,
+          ),
+        );
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushChannelRemove");
+    }
+  }
+}
diff --git a/src/commands/push/channels/save.ts b/src/commands/push/channels/save.ts
new file mode 100644
index 00000000..a8f300b9
--- /dev/null
+++ b/src/commands/push/channels/save.ts
@@ -0,0 +1,85 @@
+import { Flags } from "@oclif/core";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushChannelsSave extends AblyBaseCommand {
+  static override description =
+    "Subscribe a device or client to push notifications on a channel";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --channel my-channel --device-id device-123",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --client-id client-1",
+    "<%= config.bin %> <%= command.id %> --channel my-channel --device-id device-123 --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    channel: Flags.string({
+      description: "Channel name to subscribe to",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Device ID to subscribe",
+      exclusive: ["client-id"],
+    }),
+    "client-id": Flags.string({
+      description: "Client ID to subscribe",
+      exclusive: ["device-id"],
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsSave);
+
+    if (!flags["device-id"] && !flags["client-id"]) {
+      this.fail(
+        "Either --device-id or --client-id must be provided",
+        flags as BaseFlags,
+        "pushChannelSave",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(
+          formatProgress(
+            `Subscribing to channel ${formatResource(flags.channel)}`,
+          ),
+        );
+      }
+
+      const subscription: Record<string, string> = {
+        channel: flags.channel,
+      };
+      if (flags["device-id"]) subscription.deviceId = flags["device-id"];
+      if (flags["client-id"]) subscription.clientId = flags["client-id"];
+
+      await rest.push.admin.channelSubscriptions.save(subscription as never);
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ subscription }, flags);
+      } else {
+        const target = flags["device-id"]
+          ? `device ${formatResource(flags["device-id"])}`
+          : `client ${formatResource(flags["client-id"]!)}`;
+        this.log(
+          formatSuccess(
+            `Subscribed ${target} to channel ${formatResource(flags.channel)}.`,
+          ),
+        );
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushChannelSave");
+    }
+  }
+}
diff --git a/src/commands/push/config/clear-apns.ts b/src/commands/push/config/clear-apns.ts
new file mode 100644
index 00000000..26486b04
--- /dev/null
+++ b/src/commands/push/config/clear-apns.ts
@@ -0,0 +1,121 @@
+import { Flags } from "@oclif/core";
+import inquirer from "inquirer";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+  formatWarning,
+} from "../../../utils/output.js";
+
+export default class PushConfigClearApns extends ControlBaseCommand {
+  static override description =
+    "Clear APNs push notification configuration for an app";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %>",
+    "<%= config.bin %> <%= command.id %> --app my-app --force",
+    "<%= config.bin %> <%= command.id %> --force --json",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "The app ID or name (defaults to current app)",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigClearApns);
+
+    await this.runControlCommand(
+      flags,
+      async (controlApi) => {
+        const appId = await this.requireAppId(flags);
+
+        if (!flags.force && !this.shouldOutputJson(flags)) {
+          const { confirmed } = await inquirer.prompt([
+            {
+              default: false,
+              message: `Are you sure you want to clear APNs configuration for app ${formatResource(appId)}?`,
+              name: "confirmed",
+              type: "confirm",
+            },
+          ]);
+
+          if (!confirmed) {
+            this.log("Operation cancelled.");
+            return;
+          }
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(
+            formatProgress(
+              `Checking APNs configuration for app ${formatResource(appId)}`,
+            ),
+          );
+        }
+
+        const app = await controlApi.getApp(appId);
+        const apnsConfigured = !!(
+          app.apnsCertificate ||
+          app.apnsSigningKey ||
+          app.apnsPrivateKey
+        );
+
+        if (!apnsConfigured) {
+          if (this.shouldOutputJson(flags)) {
+            this.logJsonResult(
+              { appId, cleared: "apns", wasConfigured: false },
+              flags,
+            );
+          } else {
+            this.log(
+              formatWarning(
+                `APNs is not configured for app ${formatResource(appId)}. Nothing to clear.`,
+              ),
+            );
+          }
+          return;
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(
+            formatProgress(
+              `Clearing APNs configuration for app ${formatResource(appId)}`,
+            ),
+          );
+        }
+
+        await controlApi.updateApp(appId, {
+          apnsAuthType: null,
+          apnsCertificate: null,
+          apnsIssuerKey: null,
+          apnsPrivateKey: null,
+          apnsSigningKey: null,
+          apnsSigningKeyId: null,
+          apnsTopicHeader: null,
+          apnsUseSandboxEndpoint: null,
+        });
+
+        if (this.shouldOutputJson(flags)) {
+          this.logJsonResult({ appId, cleared: "apns" }, flags);
+        } else {
+          this.log(
+            formatSuccess(
+              `APNs configuration cleared for app ${formatResource(appId)}.`,
+            ),
+          );
+        }
+      },
+      "Error clearing APNs configuration",
+    );
+  }
+}
diff --git a/src/commands/push/config/clear-fcm.ts b/src/commands/push/config/clear-fcm.ts
new file mode 100644
index 00000000..32879b48
--- /dev/null
+++ b/src/commands/push/config/clear-fcm.ts
@@ -0,0 +1,110 @@
+import { Flags } from "@oclif/core";
+import inquirer from "inquirer";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+  formatWarning,
+} from "../../../utils/output.js";
+
+export default class PushConfigClearFcm extends ControlBaseCommand {
+  static override description =
+    "Clear FCM push notification configuration for an app";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %>",
+    "<%= config.bin %> <%= command.id %> --app my-app --force",
+    "<%= config.bin %> <%= command.id %> --force --json",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "The app ID or name (defaults to current app)",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigClearFcm);
+
+    await this.runControlCommand(
+      flags,
+      async (controlApi) => {
+        const appId = await this.requireAppId(flags);
+
+        if (!flags.force && !this.shouldOutputJson(flags)) {
+          const { confirmed } = await inquirer.prompt([
+            {
+              default: false,
+              message: `Are you sure you want to clear FCM configuration for app ${formatResource(appId)}?`,
+              name: "confirmed",
+              type: "confirm",
+            },
+          ]);
+
+          if (!confirmed) {
+            this.log("Operation cancelled.");
+            return;
+          }
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(
+            formatProgress(
+              `Checking FCM configuration for app ${formatResource(appId)}`,
+            ),
+          );
+        }
+
+        const app = await controlApi.getApp(appId);
+        const fcmConfigured = !!app.fcmServiceAccount;
+
+        if (!fcmConfigured) {
+          if (this.shouldOutputJson(flags)) {
+            this.logJsonResult(
+              { appId, cleared: "fcm", wasConfigured: false },
+              flags,
+            );
+          } else {
+            this.log(
+              formatWarning(
+                `FCM is not configured for app ${formatResource(appId)}. Nothing to clear.`,
+              ),
+            );
+          }
+          return;
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(
+            formatProgress(
+              `Clearing FCM configuration for app ${formatResource(appId)}`,
+            ),
+          );
+        }
+
+        await controlApi.updateApp(appId, {
+          fcmServiceAccount: null,
+        });
+
+        if (this.shouldOutputJson(flags)) {
+          this.logJsonResult({ appId, cleared: "fcm" }, flags);
+        } else {
+          this.log(
+            formatSuccess(
+              `FCM configuration cleared for app ${formatResource(appId)}.`,
+            ),
+          );
+        }
+      },
+      "Error clearing FCM configuration",
+    );
+  }
+}
diff --git a/src/commands/push/config/index.ts b/src/commands/push/config/index.ts
new file mode 100644
index 00000000..19e19684
--- /dev/null
+++ b/src/commands/push/config/index.ts
@@ -0,0 +1,15 @@
+import { BaseTopicCommand } from "../../../base-topic-command.js";
+
+export default class PushConfig extends BaseTopicCommand {
+  protected topicName = "push:config";
+  protected commandGroup = "Push configuration";
+
+  static override description =
+    "Manage push notification configuration (APNs, FCM)";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> show",
+    "<%= config.bin %> <%= command.id %> set-apns --certificate /path/to/cert.p12",
+    "<%= config.bin %> <%= command.id %> set-fcm --service-account /path/to/service-account.json",
+  ];
+}
diff --git a/src/commands/push/config/set-apns.ts b/src/commands/push/config/set-apns.ts
new file mode 100644
index 00000000..f595bde6
--- /dev/null
+++ b/src/commands/push/config/set-apns.ts
@@ -0,0 +1,172 @@
+import { Flags } from "@oclif/core";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushConfigSetApns extends ControlBaseCommand {
+  static override description = "Configure APNs push notifications for an app";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --certificate /path/to/cert.p12",
+    "<%= config.bin %> <%= command.id %> --certificate /path/to/cert.p12 --password secret --sandbox",
+    "<%= config.bin %> <%= command.id %> --key-file /path/to/key.p8 --key-id ABC123 --team-id DEF456 --topic com.example.app",
+    "<%= config.bin %> <%= command.id %> --certificate /path/to/cert.p12 --json",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "The app ID or name (defaults to current app)",
+    }),
+    certificate: Flags.string({
+      description: "Path to the P12 certificate file",
+      exclusive: ["key-file"],
+    }),
+    "key-file": Flags.string({
+      description: "Path to the P8 key file",
+      exclusive: ["certificate"],
+    }),
+    "key-id": Flags.string({
+      description: "The APNs key ID (required for P8)",
+    }),
+    password: Flags.string({
+      description: "Password for the P12 certificate",
+    }),
+    sandbox: Flags.boolean({
+      default: false,
+      description: "Use the APNs sandbox environment",
+    }),
+    "team-id": Flags.string({
+      description: "The Apple Developer Team ID (required for P8)",
+    }),
+    topic: Flags.string({
+      description: "The APNs topic / bundle ID (required for P8)",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigSetApns);
+
+    if (!flags.certificate && !flags["key-file"]) {
+      this.fail(
+        "Either --certificate (P12) or --key-file (P8) must be provided",
+        flags,
+        "pushConfigSetApns",
+      );
+    }
+
+    await this.runControlCommand(
+      flags,
+      async (controlApi) => {
+        const appId = await this.requireAppId(flags);
+
+        if (flags.certificate) {
+          const certPath = path.resolve(flags.certificate);
+          if (!fs.existsSync(certPath)) {
+            this.fail(
+              `Certificate file not found: ${certPath}`,
+              flags,
+              "pushConfigSetApns",
+            );
+          }
+
+          if (!this.shouldOutputJson(flags)) {
+            this.log(
+              formatProgress(
+                `Uploading APNs P12 certificate for app ${formatResource(appId)}`,
+              ),
+            );
+          }
+
+          const certificateData = fs.readFileSync(certPath).toString("base64");
+
+          const result = await controlApi.uploadApnsP12(
+            appId,
+            certificateData,
+            {
+              password: flags.password,
+              useForSandbox: flags.sandbox,
+            },
+          );
+
+          if (this.shouldOutputJson(flags)) {
+            this.logJsonResult({ appId, method: "p12", ...result }, flags);
+          } else {
+            this.log(
+              formatSuccess(
+                `APNs P12 certificate uploaded for app ${formatResource(appId)}.`,
+              ),
+            );
+          }
+        } else if (flags["key-file"]) {
+          if (!flags["key-id"]) {
+            this.fail(
+              "--key-id is required when using --key-file (P8)",
+              flags,
+              "pushConfigSetApns",
+            );
+          }
+          if (!flags["team-id"]) {
+            this.fail(
+              "--team-id is required when using --key-file (P8)",
+              flags,
+              "pushConfigSetApns",
+            );
+          }
+          if (!flags.topic) {
+            this.fail(
+              "--topic is required when using --key-file (P8)",
+              flags,
+              "pushConfigSetApns",
+            );
+          }
+
+          const keyPath = path.resolve(flags["key-file"]);
+          if (!fs.existsSync(keyPath)) {
+            this.fail(
+              `Key file not found: ${keyPath}`,
+              flags,
+              "pushConfigSetApns",
+            );
+          }
+
+          if (!this.shouldOutputJson(flags)) {
+            this.log(
+              formatProgress(
+                `Configuring APNs P8 key for app ${formatResource(appId)}`,
+              ),
+            );
+          }
+
+          const keyContents = fs.readFileSync(keyPath, "utf8");
+
+          await controlApi.updateApp(appId, {
+            apnsAuthType: "token",
+            apnsIssuerKey: flags["team-id"],
+            apnsSigningKey: keyContents,
+            apnsSigningKeyId: flags["key-id"],
+            apnsTopicHeader: flags.topic,
+            apnsUseSandboxEndpoint: flags.sandbox,
+          });
+
+          if (this.shouldOutputJson(flags)) {
+            this.logJsonResult({ appId, method: "p8" }, flags);
+          } else {
+            this.log(
+              formatSuccess(
+                `APNs P8 key configured for app ${formatResource(appId)}.`,
+              ),
+            );
+          }
+        }
+      },
+      "Error configuring APNs",
+    );
+  }
+}
diff --git a/src/commands/push/config/set-fcm.ts b/src/commands/push/config/set-fcm.ts
new file mode 100644
index 00000000..b9dedf6c
--- /dev/null
+++ b/src/commands/push/config/set-fcm.ts
@@ -0,0 +1,101 @@
+import { Flags } from "@oclif/core";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushConfigSetFcm extends ControlBaseCommand {
+  static override description = "Configure FCM push notifications for an app";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --service-account /path/to/service-account.json",
+    "<%= config.bin %> <%= command.id %> --service-account /path/to/service-account.json --app my-app",
+    "<%= config.bin %> <%= command.id %> --service-account /path/to/service-account.json --json",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "The app ID or name (defaults to current app)",
+    }),
+    "service-account": Flags.string({
+      description: "Path to the FCM service account JSON file",
+      required: true,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigSetFcm);
+
+    await this.runControlCommand(
+      flags,
+      async (controlApi) => {
+        const appId = await this.requireAppId(flags);
+        const filePath = path.resolve(flags["service-account"]);
+
+        if (!fs.existsSync(filePath)) {
+          this.fail(
+            `Service account file not found: ${filePath}`,
+            flags,
+            "pushConfigSetFcm",
+          );
+        }
+
+        const contents = fs.readFileSync(filePath, "utf8");
+
+        let parsed: Record<string, unknown>;
+        try {
+          parsed = JSON.parse(contents) as Record<string, unknown>;
+        } catch {
+          this.fail(
+            "Service account file is not valid JSON",
+            flags,
+            "pushConfigSetFcm",
+          );
+        }
+
+        if (parsed.type !== "service_account") {
+          this.fail(
+            'Service account JSON must have "type": "service_account"',
+            flags,
+            "pushConfigSetFcm",
+          );
+        }
+
+        if (!parsed.project_id) {
+          this.fail(
+            "Service account JSON must contain a project_id field",
+            flags,
+            "pushConfigSetFcm",
+          );
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(
+            formatProgress(`Configuring FCM for app ${formatResource(appId)}`),
+          );
+        }
+
+        await controlApi.updateApp(appId, {
+          fcmServiceAccount: contents,
+        });
+
+        if (this.shouldOutputJson(flags)) {
+          this.logJsonResult({ appId }, flags);
+        } else {
+          this.log(
+            formatSuccess(
+              `FCM configuration updated for app ${formatResource(appId)}.`,
+            ),
+          );
+        }
+      },
+      "Error configuring FCM",
+    );
+  }
+}
diff --git a/src/commands/push/config/show.ts b/src/commands/push/config/show.ts
new file mode 100644
index 00000000..672374e4
--- /dev/null
+++ b/src/commands/push/config/show.ts
@@ -0,0 +1,134 @@
+import { Flags } from "@oclif/core";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+import {
+  formatLabel,
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushConfigShow extends ControlBaseCommand {
+  static override description =
+    "Show push notification configuration for an app";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %>",
+    "<%= config.bin %> <%= command.id %> --app my-app",
+    "<%= config.bin %> <%= command.id %> --json",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "The app ID or name (defaults to current app)",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigShow);
+
+    await this.runControlCommand(
+      flags,
+      async (controlApi) => {
+        const appId = await this.requireAppId(flags);
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(
+            formatProgress(
+              `Fetching push configuration for app ${formatResource(appId)}`,
+            ),
+          );
+        }
+
+        const app = await controlApi.getApp(appId);
+
+        const apnsConfigured = !!(app.apnsCertificate || app.apnsSigningKey);
+        const fcmConfigured = !!app.fcmServiceAccount;
+
+        const config = {
+          appId,
+          apns: {
+            configured: apnsConfigured,
+            useSandbox:
+              app.apnsUseSandboxEndpoint ?? app.apnsUsesSandboxCert ?? false,
+            ...(app.apnsTopicHeader ? { bundleId: app.apnsTopicHeader } : {}),
+            ...(app.apnsIssuerKey ? { teamId: app.apnsIssuerKey } : {}),
+            ...(app.apnsSigningKeyId ? { keyId: app.apnsSigningKeyId } : {}),
+            ...(app.apnsAuthType ? { authType: app.apnsAuthType } : {}),
+            hasP12Certificate: !!app.apnsCertificate,
+            hasP8Key: !!app.apnsSigningKey,
+          },
+          fcm: {
+            configured: fcmConfigured,
+            ...(app.fcmProjectId ? { projectId: app.fcmProjectId } : {}),
+          },
+          web: {
+            available: !!(
+              app.apnsCertificate ||
+              app.apnsSigningKey ||
+              fcmConfigured
+            ),
+          },
+        };
+
+        if (this.shouldOutputJson(flags)) {
+          this.logJsonResult(config, flags);
+          return;
+        }
+
+        this.log(
+          formatSuccess(`Push configuration for app ${formatResource(appId)}.`),
+        );
+        this.log("");
+
+        this.log("APNs Configuration:");
+        this.log(
+          `  ${formatLabel("Status")} ${apnsConfigured ? "Configured" : "Not configured"}`,
+        );
+        if (apnsConfigured) {
+          this.log(
+            `  ${formatLabel("Environment")} ${config.apns.useSandbox ? "Sandbox" : "Production"}`,
+          );
+          if (config.apns.hasP12Certificate) {
+            this.log(`  ${formatLabel("Auth Method")} P12 Certificate`);
+          }
+          if (config.apns.hasP8Key) {
+            this.log(`  ${formatLabel("Auth Method")} P8 Key`);
+            if (config.apns.teamId)
+              this.log(
+                `  ${formatLabel("Team ID")} ${config.apns.teamId as string}`,
+              );
+            if (config.apns.keyId)
+              this.log(
+                `  ${formatLabel("Key ID")} ${config.apns.keyId as string}`,
+              );
+            if (config.apns.bundleId)
+              this.log(
+                `  ${formatLabel("Bundle ID")} ${config.apns.bundleId as string}`,
+              );
+          }
+        }
+        this.log("");
+        this.log("FCM Configuration:");
+        this.log(
+          `  ${formatLabel("Status")} ${fcmConfigured ? "Configured" : "Not configured"}`,
+        );
+        if (config.fcm.projectId) {
+          this.log(
+            `  ${formatLabel("Project ID")} ${config.fcm.projectId as string}`,
+          );
+        }
+        this.log("");
+        this.log("Web Push:");
+        this.log(
+          `  ${formatLabel("Status")} ${config.web.available ? "Available" : "Not available"}`,
+        );
+        if (!config.web.available) {
+          this.log(`  Configure APNs or FCM to enable web push notifications.`);
+        }
+      },
+      "Error fetching push configuration",
+    );
+  }
+}
diff --git a/src/commands/push/devices/get.ts b/src/commands/push/devices/get.ts
new file mode 100644
index 00000000..86e91402
--- /dev/null
+++ b/src/commands/push/devices/get.ts
@@ -0,0 +1,92 @@
+import { Args } from "@oclif/core";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatDeviceState,
+  formatLabel,
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushDevicesGet extends AblyBaseCommand {
+  static override args = {
+    "device-id": Args.string({
+      description: "The device ID to retrieve",
+      required: true,
+    }),
+  };
+
+  static override description = "Get details of a push device registration";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> device-123",
+    "<%= config.bin %> <%= command.id %> device-123 --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+  };
+
+  async run(): Promise<void> {
+    const { args, flags } = await this.parse(PushDevicesGet);
+    const deviceId = args["device-id"];
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(formatProgress(`Fetching device ${formatResource(deviceId)}`));
+      }
+
+      const device = await rest.push.admin.deviceRegistrations.get(deviceId);
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ device }, flags);
+        return;
+      }
+
+      this.log(formatSuccess(`Device ${formatResource(deviceId)} found.`));
+      this.log("");
+      this.log(`${formatLabel("Device ID")} ${device.id}`);
+      if (device.platform)
+        this.log(`${formatLabel("Platform")} ${device.platform}`);
+      if (device.formFactor)
+        this.log(`${formatLabel("Form Factor")} ${device.formFactor}`);
+      if (device.clientId)
+        this.log(`${formatLabel("Client ID")} ${device.clientId}`);
+      if (device.push?.state)
+        this.log(
+          `${formatLabel("State")} ${formatDeviceState(device.push.state)}`,
+        );
+      if (device.push?.recipient?.transportType) {
+        this.log(
+          `${formatLabel("Transport Type")} ${device.push.recipient.transportType}`,
+        );
+      }
+      if (device.push?.recipient?.deviceToken) {
+        const token = device.push.recipient.deviceToken as string;
+        const redacted =
+          token.length > 8
+            ? `${token.slice(0, 4)}...${token.slice(-4)} (redacted)`
+            : "****(redacted)";
+        this.log(`${formatLabel("Device Token")} ${redacted}`);
+      }
+      if (device.push?.recipient?.targetUrl) {
+        this.log(
+          `${formatLabel("Target URL")} ${device.push.recipient.targetUrl}`,
+        );
+      }
+      if (device.metadata) {
+        this.log(
+          `${formatLabel("Metadata")} ${JSON.stringify(device.metadata)}`,
+        );
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushDeviceGet");
+    }
+  }
+}
diff --git a/src/commands/push/devices/index.ts b/src/commands/push/devices/index.ts
new file mode 100644
index 00000000..be95bc04
--- /dev/null
+++ b/src/commands/push/devices/index.ts
@@ -0,0 +1,14 @@
+import { BaseTopicCommand } from "../../../base-topic-command.js";
+
+export default class PushDevices extends BaseTopicCommand {
+  protected topicName = "push:devices";
+  protected commandGroup = "Push device registration";
+
+  static override description = "Manage push notification device registrations";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> list",
+    "<%= config.bin %> <%= command.id %> get device-123",
+    "<%= config.bin %> <%= command.id %> save --id device-123 --platform ios --form-factor phone --transport-type apns --device-token token123",
+  ];
+}
diff --git a/src/commands/push/devices/list.ts b/src/commands/push/devices/list.ts
new file mode 100644
index 00000000..44ec3cf6
--- /dev/null
+++ b/src/commands/push/devices/list.ts
@@ -0,0 +1,117 @@
+import { Flags } from "@oclif/core";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatDeviceState,
+  formatHeading,
+  formatLabel,
+  formatProgress,
+  formatSuccess,
+  formatCountLabel,
+  formatLimitWarning,
+} from "../../../utils/output.js";
+
+export default class PushDevicesList extends AblyBaseCommand {
+  static override description = "List push device registrations";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %>",
+    "<%= config.bin %> <%= command.id %> --device-id device-123",
+    "<%= config.bin %> <%= command.id %> --client-id client-1",
+    "<%= config.bin %> <%= command.id %> --limit 50 --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    "device-id": Flags.string({
+      description: "Filter by device ID",
+    }),
+    "client-id": Flags.string({
+      description: "Filter by client ID",
+    }),
+    state: Flags.string({
+      description: "Filter by device state",
+      options: ["ACTIVE", "FAILING", "FAILED"],
+    }),
+    limit: Flags.integer({
+      description: "Maximum number of results to return (default: 100)",
+      default: 100,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushDevicesList);
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(formatProgress("Fetching device registrations"));
+      }
+
+      const params: Record<string, string | number> = {
+        limit: flags.limit,
+      };
+      if (flags["device-id"]) params.deviceId = flags["device-id"];
+      if (flags["client-id"]) params.clientId = flags["client-id"];
+      if (flags.state) params.state = flags.state;
+
+      const result = await rest.push.admin.deviceRegistrations.list(params);
+      const devices = result.items;
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ devices }, flags);
+        return;
+      }
+
+      if (devices.length === 0) {
+        this.log("No device registrations found.");
+        return;
+      }
+
+      this.log(
+        formatSuccess(
+          `Found ${formatCountLabel(devices.length, "device registration")}.`,
+        ),
+      );
+      this.log("");
+
+      for (const device of devices) {
+        this.log(formatHeading(`Device ID: ${device.id}`));
+        if (device.platform)
+          this.log(`  ${formatLabel("Platform")} ${device.platform}`);
+        if (device.formFactor)
+          this.log(`  ${formatLabel("Form Factor")} ${device.formFactor}`);
+        if (device.push?.state)
+          this.log(
+            `  ${formatLabel("State")} ${formatDeviceState(device.push.state)}`,
+          );
+        if (device.clientId)
+          this.log(`  ${formatLabel("Client ID")} ${device.clientId}`);
+        if (device.push?.recipient?.transportType) {
+          this.log(
+            `  ${formatLabel("Transport")} ${device.push.recipient.transportType}`,
+          );
+        }
+        if (device.metadata) {
+          this.log(
+            `  ${formatLabel("Metadata")} ${JSON.stringify(device.metadata)}`,
+          );
+        }
+        this.log("");
+      }
+
+      const limitWarning = formatLimitWarning(
+        devices.length,
+        flags.limit,
+        "device registrations",
+      );
+      if (limitWarning) this.log(limitWarning);
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushDeviceList");
+    }
+  }
+}
diff --git a/src/commands/push/devices/remove-where.ts b/src/commands/push/devices/remove-where.ts
new file mode 100644
index 00000000..ae5b7eda
--- /dev/null
+++ b/src/commands/push/devices/remove-where.ts
@@ -0,0 +1,88 @@
+import { Flags } from "@oclif/core";
+import inquirer from "inquirer";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import { formatProgress, formatSuccess } from "../../../utils/output.js";
+
+export default class PushDevicesRemoveWhere extends AblyBaseCommand {
+  static override description =
+    "Remove push device registrations matching filter criteria";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --device-id device-123",
+    "<%= config.bin %> <%= command.id %> --client-id client-1 --force",
+    "<%= config.bin %> <%= command.id %> --device-id device-123 --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    "device-id": Flags.string({
+      description: "Filter by device ID",
+    }),
+    "client-id": Flags.string({
+      description: "Filter by client ID",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushDevicesRemoveWhere);
+
+    if (!flags["device-id"] && !flags["client-id"]) {
+      this.fail(
+        "At least one filter is required: --device-id or --client-id",
+        flags as BaseFlags,
+        "pushDeviceRemoveWhere",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      const params: Record<string, string> = {};
+      if (flags["device-id"]) params.deviceId = flags["device-id"];
+      if (flags["client-id"]) params.clientId = flags["client-id"];
+
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const filterDesc = Object.entries(params)
+          .map(([k, v]) => `${k}=${v}`)
+          .join(", ");
+
+        const { confirmed } = await inquirer.prompt([
+          {
+            type: "confirm",
+            name: "confirmed",
+            message: `Are you sure you want to remove all devices matching: ${filterDesc}?`,
+            default: false,
+          },
+        ]);
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(formatProgress("Removing matching device registrations"));
+      }
+
+      await rest.push.admin.deviceRegistrations.removeWhere(params);
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ removed: true, filters: params }, flags);
+      } else {
+        this.log(formatSuccess("Matching device registrations removed."));
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushDeviceRemoveWhere");
+    }
+  }
+}
diff --git a/src/commands/push/devices/remove.ts b/src/commands/push/devices/remove.ts
new file mode 100644
index 00000000..1b65cded
--- /dev/null
+++ b/src/commands/push/devices/remove.ts
@@ -0,0 +1,77 @@
+import { Args, Flags } from "@oclif/core";
+import inquirer from "inquirer";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushDevicesRemove extends AblyBaseCommand {
+  static override args = {
+    "device-id": Args.string({
+      description: "The device ID to remove",
+      required: true,
+    }),
+  };
+
+  static override description = "Remove a push device registration";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> device-123",
+    "<%= config.bin %> <%= command.id %> device-123 --force",
+    "<%= config.bin %> <%= command.id %> device-123 --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { args, flags } = await this.parse(PushDevicesRemove);
+    const deviceId = args["device-id"];
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const { confirmed } = await inquirer.prompt([
+          {
+            type: "confirm",
+            name: "confirmed",
+            message: `Are you sure you want to remove device ${deviceId}?`,
+            default: false,
+          },
+        ]);
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(formatProgress(`Removing device ${formatResource(deviceId)}`));
+      }
+
+      await rest.push.admin.deviceRegistrations.remove(deviceId);
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ deviceId, removed: true }, flags);
+      } else {
+        this.log(formatSuccess(`Device ${formatResource(deviceId)} removed.`));
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushDeviceRemove");
+    }
+  }
+}
diff --git a/src/commands/push/devices/save.ts b/src/commands/push/devices/save.ts
new file mode 100644
index 00000000..40cdf589
--- /dev/null
+++ b/src/commands/push/devices/save.ts
@@ -0,0 +1,238 @@
+import { Flags } from "@oclif/core";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+import { AblyBaseCommand } from "../../../base-command.js";
+import { productApiFlags } from "../../../flags.js";
+import { BaseFlags } from "../../../types/cli.js";
+import {
+  formatProgress,
+  formatResource,
+  formatSuccess,
+} from "../../../utils/output.js";
+
+export default class PushDevicesSave extends AblyBaseCommand {
+  static override description = "Register or update a push device";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --id device-123 --platform ios --form-factor phone --transport-type apns --device-token token123",
+    "<%= config.bin %> <%= command.id %> --id browser-1 --platform browser --form-factor desktop --transport-type web --target-url https://push.example.com --p256dh-key KEY --auth-secret SECRET",
+    '<%= config.bin %> <%= command.id %> --data \'{"id":"device-123","platform":"ios","formFactor":"phone","push":{"recipient":{"transportType":"apns","deviceToken":"token123"}}}\'',
+    "<%= config.bin %> <%= command.id %> --data @device.json",
+    "<%= config.bin %> <%= command.id %> --id device-123 --platform ios --form-factor phone --transport-type apns --device-token token123 --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    id: Flags.string({
+      description: "Device ID",
+    }),
+    platform: Flags.string({
+      description: "Device platform",
+      options: ["ios", "android", "browser"],
+    }),
+    "form-factor": Flags.string({
+      description: "Device form factor",
+      options: [
+        "phone",
+        "tablet",
+        "desktop",
+        "tv",
+        "watch",
+        "car",
+        "embedded",
+        "other",
+      ],
+    }),
+    "transport-type": Flags.string({
+      description: "Push transport type",
+      options: ["apns", "fcm", "web"],
+    }),
+    "device-token": Flags.string({
+      description: "Push device token (required for apns/fcm transport)",
+    }),
+    "target-url": Flags.string({
+      description: "Web push target URL (required for web transport)",
+    }),
+    "p256dh-key": Flags.string({
+      description: "Web push P256DH key (required for web transport)",
+    }),
+    "auth-secret": Flags.string({
+      description: "Web push auth secret (required for web transport)",
+    }),
+    "client-id": Flags.string({
+      description: "Client ID to associate with the device",
+    }),
+    metadata: Flags.string({
+      description: "Device metadata as JSON",
+    }),
+    data: Flags.string({
+      description: "Full device details as JSON string or @filepath",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushDevicesSave);
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      let deviceData: Record<string, unknown>;
+
+      if (flags.data) {
+        deviceData = this.parseDataFlag(flags.data, flags);
+      } else {
+        if (!flags.id) {
+          this.fail(
+            "--id is required when not using --data",
+            flags as BaseFlags,
+            "pushDeviceSave",
+          );
+        }
+        if (!flags.platform) {
+          this.fail(
+            "--platform is required when not using --data",
+            flags as BaseFlags,
+            "pushDeviceSave",
+          );
+        }
+        if (!flags["form-factor"]) {
+          this.fail(
+            "--form-factor is required when not using --data",
+            flags as BaseFlags,
+            "pushDeviceSave",
+          );
+        }
+        if (!flags["transport-type"]) {
+          this.fail(
+            "--transport-type is required when not using --data",
+            flags as BaseFlags,
+            "pushDeviceSave",
+          );
+        }
+
+        const transportType = flags["transport-type"];
+        let recipient: Record<string, string>;
+
+        if (transportType === "web") {
+          if (!flags["target-url"]) {
+            this.fail(
+              "--target-url is required for web transport",
+              flags as BaseFlags,
+              "pushDeviceSave",
+            );
+          }
+          if (!flags["p256dh-key"]) {
+            this.fail(
+              "--p256dh-key is required for web transport",
+              flags as BaseFlags,
+              "pushDeviceSave",
+            );
+          }
+          if (!flags["auth-secret"]) {
+            this.fail(
+              "--auth-secret is required for web transport",
+              flags as BaseFlags,
+              "pushDeviceSave",
+            );
+          }
+          recipient = {
+            transportType: "web",
+            targetUrl: flags["target-url"],
+            encryptionKey: flags["p256dh-key"],
+            auth: flags["auth-secret"],
+          };
+        } else {
+          if (!flags["device-token"]) {
+            this.fail(
+              "--device-token is required for apns/fcm transport",
+              flags as BaseFlags,
+              "pushDeviceSave",
+            );
+          }
+          recipient = {
+            transportType,
+            deviceToken: flags["device-token"],
+          };
+        }
+
+        deviceData = {
+          id: flags.id,
+          platform: flags.platform,
+          formFactor: flags["form-factor"],
+          push: { recipient },
+        };
+
+        if (flags["client-id"]) {
+          deviceData.clientId = flags["client-id"];
+        }
+
+        if (flags.metadata) {
+          try {
+            deviceData.metadata = JSON.parse(flags.metadata);
+          } catch {
+            this.fail(
+              "--metadata must be valid JSON",
+              flags as BaseFlags,
+              "pushDeviceSave",
+            );
+          }
+        }
+      }
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(
+          formatProgress(
+            `Saving device registration ${formatResource(String(deviceData.id || ""))}`,
+          ),
+        );
+      }
+
+      const result = await rest.push.admin.deviceRegistrations.save(
+        deviceData as never,
+      );
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ device: result }, flags);
+      } else {
+        this.log(
+          formatSuccess(
+            `Device registration saved for ${formatResource(String(deviceData.id || ""))}.`,
+          ),
+        );
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushDeviceSave");
+    }
+  }
+
+  private parseDataFlag(
+    data: string,
+    flags: Record<string, unknown>,
+  ): Record<string, unknown> {
+    let jsonString = data;
+
+    if (data.startsWith("@")) {
+      const filePath = path.resolve(data.slice(1));
+      if (!fs.existsSync(filePath)) {
+        this.fail(
+          `File not found: ${filePath}`,
+          flags as BaseFlags,
+          "pushDeviceSave",
+        );
+      }
+      jsonString = fs.readFileSync(filePath, "utf8");
+    }
+
+    try {
+      return JSON.parse(jsonString) as Record<string, unknown>;
+    } catch {
+      this.fail(
+        "--data must be valid JSON or a path to a JSON file (prefixed with @)",
+        flags as BaseFlags,
+        "pushDeviceSave",
+      );
+    }
+  }
+}
diff --git a/src/commands/push/index.ts b/src/commands/push/index.ts
new file mode 100644
index 00000000..8b722294
--- /dev/null
+++ b/src/commands/push/index.ts
@@ -0,0 +1,15 @@
+import { BaseTopicCommand } from "../../base-topic-command.js";
+
+export default class Push extends BaseTopicCommand {
+  protected topicName = "push";
+  protected commandGroup = "Push notification";
+
+  static override description = "Manage push notifications";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> publish --device-id device1 --title Hello --body World",
+    "<%= config.bin %> <%= command.id %> devices list",
+    "<%= config.bin %> <%= command.id %> channels list --channel my-channel",
+    "<%= config.bin %> <%= command.id %> config show",
+  ];
+}
diff --git a/src/commands/push/publish.ts b/src/commands/push/publish.ts
new file mode 100644
index 00000000..94c0ce1d
--- /dev/null
+++ b/src/commands/push/publish.ts
@@ -0,0 +1,197 @@
+import { Flags } from "@oclif/core";
+
+import { AblyBaseCommand } from "../../base-command.js";
+import { productApiFlags } from "../../flags.js";
+import { BaseFlags } from "../../types/cli.js";
+import { formatProgress, formatSuccess } from "../../utils/output.js";
+
+export default class PushPublish extends AblyBaseCommand {
+  static override description =
+    "Publish a push notification to a device or client";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> --device-id device-123 --title Hello --body World",
+    "<%= config.bin %> <%= command.id %> --client-id client-1 --title Hello --body World",
+    '<%= config.bin %> <%= command.id %> --device-id device-123 --payload \'{"notification":{"title":"Hello","body":"World"}}\'',
+    '<%= config.bin %> <%= command.id %> --recipient \'{"transportType":"apns","deviceToken":"token123"}\' --title Hello --body World',
+    "<%= config.bin %> <%= command.id %> --device-id device-123 --title Hello --body World --json",
+  ];
+
+  static override flags = {
+    ...productApiFlags,
+    "device-id": Flags.string({
+      description: "Target device ID",
+      exclusive: ["client-id", "recipient"],
+    }),
+    "client-id": Flags.string({
+      description: "Target client ID",
+      exclusive: ["device-id", "recipient"],
+    }),
+    recipient: Flags.string({
+      description: "Raw recipient JSON for advanced targeting",
+      exclusive: ["device-id", "client-id"],
+    }),
+    title: Flags.string({
+      description: "Notification title",
+    }),
+    body: Flags.string({
+      description: "Notification body",
+    }),
+    sound: Flags.string({
+      description: "Notification sound",
+    }),
+    icon: Flags.string({
+      description: "Notification icon",
+    }),
+    badge: Flags.integer({
+      description: "Notification badge count",
+    }),
+    data: Flags.string({
+      description: "Custom data payload as JSON",
+    }),
+    "collapse-key": Flags.string({
+      description: "Collapse key for notification grouping",
+    }),
+    ttl: Flags.integer({
+      description: "Time to live in seconds",
+    }),
+    payload: Flags.string({
+      description:
+        "Full notification payload as JSON (overrides convenience flags)",
+    }),
+    apns: Flags.string({
+      description: "APNs-specific override as JSON",
+    }),
+    fcm: Flags.string({
+      description: "FCM-specific override as JSON",
+    }),
+    web: Flags.string({
+      description: "Web push-specific override as JSON",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushPublish);
+
+    if (!flags["device-id"] && !flags["client-id"] && !flags.recipient) {
+      this.fail(
+        "A recipient is required: --device-id, --client-id, or --recipient",
+        flags as BaseFlags,
+        "pushPublish",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags as BaseFlags);
+      if (!rest) return;
+
+      // Build recipient
+      let recipient: Record<string, unknown>;
+      if (flags["device-id"]) {
+        recipient = { deviceId: flags["device-id"] };
+      } else if (flags["client-id"]) {
+        recipient = { clientId: flags["client-id"] };
+      } else {
+        try {
+          recipient = JSON.parse(flags.recipient!) as Record<string, unknown>;
+        } catch {
+          this.fail(
+            "--recipient must be valid JSON",
+            flags as BaseFlags,
+            "pushPublish",
+          );
+        }
+      }
+
+      // Build notification payload
+      let payload: Record<string, unknown>;
+      if (flags.payload) {
+        try {
+          payload = JSON.parse(flags.payload) as Record<string, unknown>;
+        } catch {
+          this.fail(
+            "--payload must be valid JSON",
+            flags as BaseFlags,
+            "pushPublish",
+          );
+        }
+      } else {
+        const notification: Record<string, unknown> = {};
+        if (flags.title) notification.title = flags.title;
+        if (flags.body) notification.body = flags.body;
+        if (flags.sound) notification.sound = flags.sound;
+        if (flags.icon) notification.icon = flags.icon;
+        if (flags.badge !== undefined) notification.badge = flags.badge;
+        if (flags["collapse-key"])
+          notification.collapseKey = flags["collapse-key"];
+        if (flags.ttl !== undefined) notification.ttl = flags.ttl;
+
+        payload = {};
+        if (Object.keys(notification).length > 0) {
+          payload.notification = notification;
+        }
+
+        if (flags.data) {
+          try {
+            payload.data = JSON.parse(flags.data);
+          } catch {
+            this.fail(
+              "--data must be valid JSON",
+              flags as BaseFlags,
+              "pushPublish",
+            );
+          }
+        }
+      }
+
+      // Add platform-specific overrides
+      if (flags.apns) {
+        try {
+          payload.apns = JSON.parse(flags.apns);
+        } catch {
+          this.fail(
+            "--apns must be valid JSON",
+            flags as BaseFlags,
+            "pushPublish",
+          );
+        }
+      }
+      if (flags.fcm) {
+        try {
+          payload.fcm = JSON.parse(flags.fcm);
+        } catch {
+          this.fail(
+            "--fcm must be valid JSON",
+            flags as BaseFlags,
+            "pushPublish",
+          );
+        }
+      }
+      if (flags.web) {
+        try {
+          payload.web = JSON.parse(flags.web);
+        } catch {
+          this.fail(
+            "--web must be valid JSON",
+            flags as BaseFlags,
+            "pushPublish",
+          );
+        }
+      }
+
+      if (!this.shouldOutputJson(flags)) {
+        this.log(formatProgress("Publishing push notification"));
+      }
+
+      await rest.push.admin.publish(recipient!, payload);
+
+      if (this.shouldOutputJson(flags)) {
+        this.logJsonResult({ published: true, recipient: recipient! }, flags);
+      } else {
+        this.log(formatSuccess("Push notification published."));
+      }
+    } catch (error) {
+      this.fail(error, flags as BaseFlags, "pushPublish");
+    }
+  }
+}
diff --git a/src/services/control-api.ts b/src/services/control-api.ts
index 804c7b81..8639ce48 100644
--- a/src/services/control-api.ts
+++ b/src/services/control-api.ts
@@ -10,8 +10,17 @@ export interface ControlApiOptions {
 
 export interface App {
   accountId: string;
+  apnsAuthType?: string | null;
+  apnsCertificate?: string | null;
+  apnsIssuerKey?: string | null;
+  apnsPrivateKey?: string | null;
+  apnsSigningKey?: string | null;
+  apnsSigningKeyId?: string | null;
+  apnsTopicHeader?: string | null;
+  apnsUseSandboxEndpoint?: boolean | null;
   apnsUsesSandboxCert?: boolean;
   created: number;
+  fcmServiceAccount?: string | null;
   id: string;
   modified: number;
   name: string;
@@ -414,11 +423,7 @@ export class ControlApi {
   }
 
   // Update an app
-  async updateApp(
-    appId: string,
-    appData: { name?: string; tlsOnly?: boolean },
-  ): Promise<App> {
-    // Update app uses /apps/{appId} path
+  async updateApp(appId: string, appData: Partial<App>): Promise<App> {
     return this.request<App>(`/apps/${appId}`, "PATCH", appData);
   }
 
diff --git a/src/utils/output.ts b/src/utils/output.ts
index 870f6093..e700379b 100644
--- a/src/utils/output.ts
+++ b/src/utils/output.ts
@@ -95,6 +95,24 @@ export function formatIndex(n: number): string {
   return chalk.dim(`[${n}]`);
 }
 
+/** Device push state display — green for ACTIVE, yellow for FAILING, red for FAILED */
+export function formatDeviceState(state: string): string {
+  switch (state.toUpperCase()) {
+    case "ACTIVE": {
+      return chalk.green(state);
+    }
+    case "FAILING": {
+      return chalk.yellow(state);
+    }
+    case "FAILED": {
+      return chalk.red(state);
+    }
+    default: {
+      return state;
+    }
+  }
+}
+
 export interface MessageDisplayFields {
   action?: string;
   channel: string;
diff --git a/test/e2e/push/channels-e2e.test.ts b/test/e2e/push/channels-e2e.test.ts
new file mode 100644
index 00000000..ea59f17a
--- /dev/null
+++ b/test/e2e/push/channels-e2e.test.ts
@@ -0,0 +1,177 @@
+import {
+  describe,
+  it,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll,
+  expect,
+} from "vitest";
+import * as Ably from "ably";
+import {
+  E2E_API_KEY,
+  SHOULD_SKIP_E2E,
+  forceExit,
+  cleanupTrackedResources,
+  setupTestFailureHandler,
+  resetTestTracking,
+  createAblyClient,
+} from "../../helpers/e2e-test-helper.js";
+import { runCommand } from "../../helpers/command-helpers.js";
+
+describe.skipIf(SHOULD_SKIP_E2E)("Push Channel Subscriptions E2E Tests", () => {
+  let testDeviceIdBase: string;
+  let client: Ably.Rest;
+  let testDeviceId: string;
+
+  beforeAll(async () => {
+    process.on("SIGINT", forceExit);
+
+    // Generate unique device ID base for this test run
+    testDeviceIdBase = `cli-e2e-channel-test-${Date.now()}`;
+    testDeviceId = `${testDeviceIdBase}-device`;
+
+    // Create Ably client for verification
+    client = createAblyClient();
+
+    // Create a test device for subscription tests
+    await client.push.admin.deviceRegistrations.save({
+      id: testDeviceId,
+      platform: "android",
+      formFactor: "phone",
+      clientId: "e2e-channel-test-user",
+      push: {
+        recipient: {
+          transportType: "fcm",
+          registrationToken: `fake-fcm-channel-test-${Date.now()}`,
+        },
+      },
+    });
+  });
+
+  afterAll(async () => {
+    // Cleanup test device
+    try {
+      await client.push.admin.deviceRegistrations.remove(testDeviceId);
+    } catch {
+      // Ignore cleanup errors
+    }
+
+    process.removeListener("SIGINT", forceExit);
+  });
+
+  beforeEach(() => {
+    resetTestTracking();
+  });
+
+  afterEach(async () => {
+    setupTestFailureHandler();
+    await cleanupTrackedResources();
+  });
+
+  describe("push channels save - validation", () => {
+    it("should error when neither device-id nor client-id provided", async () => {
+      const result = await runCommand(
+        ["push", "channels", "save", "--channel", "test-channel"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "Either --device-id or --client-id must be provided",
+      );
+    });
+
+    it("should error when both device-id and client-id provided", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "channels",
+          "save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "device1",
+          "--client-id",
+          "client1",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe("push channels list - validation", () => {
+    it("should require --channel flag", async () => {
+      const result = await runCommand(["push", "channels", "list"], {
+        env: { ABLY_API_KEY: E2E_API_KEY || "" },
+        timeoutMs: 30000,
+      });
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("Missing required flag channel");
+    });
+  });
+
+  describe("push channels list-channels", () => {
+    it("should list channels (may be empty if no push subscriptions)", async () => {
+      const result = await runCommand(["push", "channels", "list-channels"], {
+        env: { ABLY_API_KEY: E2E_API_KEY || "" },
+        timeoutMs: 30000,
+      });
+
+      expect(result.exitCode).toBe(0);
+      // Output is either "Found N channels." or "No channels with push subscriptions found."
+      expect(
+        result.stdout.includes("Found") ||
+          result.stdout.includes("No channels"),
+      ).toBe(true);
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const result = await runCommand(
+        ["push", "channels", "list-channels", "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.channels).toBeInstanceOf(Array);
+    });
+  });
+
+  describe("push channels remove - validation", () => {
+    it("should error when neither device-id nor client-id provided", async () => {
+      const result = await runCommand(
+        ["push", "channels", "remove", "--channel", "test-channel", "--force"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "Either --device-id or --client-id must be provided",
+      );
+    });
+  });
+
+  // Note: Tests that require push-enabled channels are not included here
+  // because the test environment doesn't have push configured for channels.
+  // The validation tests above verify the CLI command structure is correct.
+  // Full integration tests would require a push-enabled namespace configuration.
+});
diff --git a/test/e2e/push/devices-e2e.test.ts b/test/e2e/push/devices-e2e.test.ts
new file mode 100644
index 00000000..335375d8
--- /dev/null
+++ b/test/e2e/push/devices-e2e.test.ts
@@ -0,0 +1,496 @@
+import {
+  describe,
+  it,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll,
+  expect,
+} from "vitest";
+import * as Ably from "ably";
+import {
+  E2E_API_KEY,
+  SHOULD_SKIP_E2E,
+  forceExit,
+  cleanupTrackedResources,
+  setupTestFailureHandler,
+  resetTestTracking,
+  createAblyClient,
+} from "../../helpers/e2e-test-helper.js";
+import { runCommand } from "../../helpers/command-helpers.js";
+
+describe.skipIf(SHOULD_SKIP_E2E)("Push Devices E2E Tests", () => {
+  let testDeviceIdBase: string;
+  let client: Ably.Rest;
+
+  beforeAll(async () => {
+    process.on("SIGINT", forceExit);
+
+    // Generate unique device ID base for this test run
+    testDeviceIdBase = `cli-e2e-test-${Date.now()}`;
+
+    // Create Ably client for verification
+    client = createAblyClient();
+  });
+
+  afterAll(() => {
+    process.removeListener("SIGINT", forceExit);
+  });
+
+  beforeEach(() => {
+    // Clear tracked commands and output files before each test
+    resetTestTracking();
+  });
+
+  afterEach(async () => {
+    // Set up failure handler for debug output
+    setupTestFailureHandler();
+    await cleanupTrackedResources();
+  });
+
+  describe("push devices save", () => {
+    it("should register an Android device with FCM token", async () => {
+      const deviceId = `${testDeviceIdBase}-android-save`;
+      const fakeToken = `fake-fcm-token-${Date.now()}`;
+
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "save",
+          "--id",
+          deviceId,
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          fakeToken,
+          "--client-id",
+          "e2e-test-user",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Device registration saved");
+      expect(result.stdout).toContain(deviceId);
+
+      // Verify with SDK
+      const device = await client.push.admin.deviceRegistrations.get(deviceId);
+      expect(device.id).toBe(deviceId);
+      expect(device.platform).toBe("android");
+      expect(device.formFactor).toBe("phone");
+      expect(device.clientId).toBe("e2e-test-user");
+
+      // Cleanup
+      await client.push.admin.deviceRegistrations.remove(deviceId);
+    });
+
+    it("should register an iOS device with APNs token", async () => {
+      const deviceId = `${testDeviceIdBase}-ios-save`;
+      const fakeToken = `fake-apns-token-${Date.now()}`;
+
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "save",
+          "--id",
+          deviceId,
+          "--platform",
+          "ios",
+          "--form-factor",
+          "tablet",
+          "--transport-type",
+          "apns",
+          "--device-token",
+          fakeToken,
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Device registration saved");
+
+      // Cleanup
+      await client.push.admin.deviceRegistrations.remove(deviceId);
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const deviceId = `${testDeviceIdBase}-json-save`;
+      const fakeToken = `fake-fcm-token-json-${Date.now()}`;
+
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "save",
+          "--id",
+          deviceId,
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          fakeToken,
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.device).toBeDefined();
+      expect(json.device.id).toBe(deviceId);
+      expect(json.device.platform).toBe("android");
+
+      // Cleanup
+      await client.push.admin.deviceRegistrations.remove(deviceId);
+    });
+  });
+
+  describe("push devices get", () => {
+    let testDeviceId: string;
+
+    beforeAll(async () => {
+      // Create a test device for get tests
+      testDeviceId = `${testDeviceIdBase}-get-test`;
+      await client.push.admin.deviceRegistrations.save({
+        id: testDeviceId,
+        platform: "android",
+        formFactor: "phone",
+        clientId: "e2e-get-test-user",
+        push: {
+          recipient: {
+            transportType: "fcm",
+            registrationToken: `fake-token-get-${Date.now()}`,
+          },
+        },
+      });
+    });
+
+    afterAll(async () => {
+      // Cleanup test device
+      try {
+        await client.push.admin.deviceRegistrations.remove(testDeviceId);
+      } catch {
+        // Ignore cleanup errors
+      }
+    });
+
+    it("should get device details by ID", async () => {
+      const result = await runCommand(
+        ["push", "devices", "get", testDeviceId],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Device");
+      expect(result.stdout).toContain(testDeviceId);
+      expect(result.stdout).toContain("android");
+      expect(result.stdout).toContain("phone");
+      expect(result.stdout).toContain("e2e-get-test-user");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const result = await runCommand(
+        ["push", "devices", "get", testDeviceId, "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.device).toBeDefined();
+      expect(json.device.id).toBe(testDeviceId);
+      expect(json.device.platform).toBe("android");
+      expect(json.device.clientId).toBe("e2e-get-test-user");
+    });
+
+    it("should handle non-existent device", async () => {
+      const result = await runCommand(
+        ["push", "devices", "get", "non-existent-device-12345"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      // Command should fail with non-zero exit code
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe("push devices list", () => {
+    const listTestDevices: string[] = [];
+
+    beforeAll(async () => {
+      // Create multiple test devices for list tests
+      for (let i = 0; i < 3; i++) {
+        const deviceId = `${testDeviceIdBase}-list-${i}`;
+        listTestDevices.push(deviceId);
+
+        await client.push.admin.deviceRegistrations.save({
+          id: deviceId,
+          platform: i % 2 === 0 ? "android" : "ios",
+          formFactor: "phone",
+          clientId: "e2e-list-test-user",
+          push: {
+            recipient: {
+              transportType: i % 2 === 0 ? "fcm" : "apns",
+              ...(i % 2 === 0
+                ? { registrationToken: `fake-fcm-list-${i}-${Date.now()}` }
+                : { deviceToken: `fake-apns-list-${i}-${Date.now()}` }),
+            },
+          },
+        });
+      }
+    });
+
+    afterAll(async () => {
+      // Cleanup test devices
+      for (const deviceId of listTestDevices) {
+        try {
+          await client.push.admin.deviceRegistrations.remove(deviceId);
+        } catch {
+          // Ignore cleanup errors
+        }
+      }
+    });
+
+    it("should list devices", async () => {
+      const result = await runCommand(["push", "devices", "list"], {
+        env: { ABLY_API_KEY: E2E_API_KEY || "" },
+        timeoutMs: 30000,
+      });
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Found");
+      expect(result.stdout).toContain("device");
+    });
+
+    it("should filter by client ID", async () => {
+      const result = await runCommand(
+        ["push", "devices", "list", "--client-id", "e2e-list-test-user"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      // All our test devices have this client ID
+      for (const deviceId of listTestDevices) {
+        expect(result.stdout).toContain(deviceId);
+      }
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "list",
+          "--client-id",
+          "e2e-list-test-user",
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.devices).toBeInstanceOf(Array);
+      expect(json.devices.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it("should respect --limit flag", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "list",
+          "--client-id",
+          "e2e-list-test-user",
+          "--limit",
+          "2",
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.devices.length).toBeLessThanOrEqual(2);
+    });
+  });
+
+  describe("push devices remove", () => {
+    it("should remove a device by ID", async () => {
+      const deviceId = `${testDeviceIdBase}-remove-test`;
+
+      // First create a device
+      await client.push.admin.deviceRegistrations.save({
+        id: deviceId,
+        platform: "android",
+        formFactor: "phone",
+        push: {
+          recipient: {
+            transportType: "fcm",
+            registrationToken: `fake-remove-${Date.now()}`,
+          },
+        },
+      });
+
+      // Remove using CLI with --force to skip confirmation
+      const result = await runCommand(
+        ["push", "devices", "remove", deviceId, "--force"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("removed");
+      expect(result.stdout).toContain(deviceId);
+
+      // Verify device is gone
+      await expect(
+        client.push.admin.deviceRegistrations.get(deviceId),
+      ).rejects.toMatchObject({ code: 40400 });
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const deviceId = `${testDeviceIdBase}-remove-json`;
+
+      // First create a device
+      await client.push.admin.deviceRegistrations.save({
+        id: deviceId,
+        platform: "ios",
+        formFactor: "phone",
+        push: {
+          recipient: {
+            transportType: "apns",
+            deviceToken: `fake-remove-json-${Date.now()}`,
+          },
+        },
+      });
+
+      const result = await runCommand(
+        ["push", "devices", "remove", deviceId, "--force", "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.removed).toBe(true);
+      expect(json.deviceId).toBe(deviceId);
+    });
+  });
+
+  describe("push devices remove-where", () => {
+    it("should remove devices by client ID", async () => {
+      const clientIdForRemoval = `e2e-remove-where-${Date.now()}`;
+      const deviceIds: string[] = [];
+
+      // Create multiple devices with same client ID
+      for (let i = 0; i < 2; i++) {
+        const deviceId = `${testDeviceIdBase}-remove-where-${i}`;
+        deviceIds.push(deviceId);
+
+        await client.push.admin.deviceRegistrations.save({
+          id: deviceId,
+          platform: "android",
+          formFactor: "phone",
+          clientId: clientIdForRemoval,
+          push: {
+            recipient: {
+              transportType: "fcm",
+              registrationToken: `fake-remove-where-${i}-${Date.now()}`,
+            },
+          },
+        });
+      }
+
+      // Remove using CLI
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "remove-where",
+          "--client-id",
+          clientIdForRemoval,
+          "--force",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("removed");
+
+      // Verify all devices are gone
+      for (const deviceId of deviceIds) {
+        await expect(
+          client.push.admin.deviceRegistrations.get(deviceId),
+        ).rejects.toMatchObject({ code: 40400 });
+      }
+    });
+
+    it("should require at least one filter criterion", async () => {
+      const result = await runCommand(
+        ["push", "devices", "remove-where", "--force"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "At least one filter is required: --device-id or --client-id",
+      );
+    });
+  });
+});
diff --git a/test/e2e/push/publish-e2e.test.ts b/test/e2e/push/publish-e2e.test.ts
new file mode 100644
index 00000000..cf53ac5a
--- /dev/null
+++ b/test/e2e/push/publish-e2e.test.ts
@@ -0,0 +1,316 @@
+import {
+  describe,
+  it,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll,
+  expect,
+} from "vitest";
+import * as Ably from "ably";
+import {
+  E2E_API_KEY,
+  SHOULD_SKIP_E2E,
+  forceExit,
+  cleanupTrackedResources,
+  setupTestFailureHandler,
+  resetTestTracking,
+  createAblyClient,
+} from "../../helpers/e2e-test-helper.js";
+import { runCommand } from "../../helpers/command-helpers.js";
+
+describe.skipIf(SHOULD_SKIP_E2E)("Push Publish E2E Tests", () => {
+  let testDeviceId: string;
+  let client: Ably.Rest;
+
+  beforeAll(async () => {
+    process.on("SIGINT", forceExit);
+
+    // Generate unique device ID for this test run
+    testDeviceId = `cli-e2e-publish-test-${Date.now()}`;
+
+    // Create Ably client
+    client = createAblyClient();
+
+    // Create a test device for publish tests
+    await client.push.admin.deviceRegistrations.save({
+      id: testDeviceId,
+      platform: "android",
+      formFactor: "phone",
+      clientId: "e2e-publish-test-user",
+      push: {
+        recipient: {
+          transportType: "fcm",
+          registrationToken: `fake-fcm-publish-test-${Date.now()}`,
+        },
+      },
+    });
+  });
+
+  afterAll(async () => {
+    // Cleanup test device
+    try {
+      await client.push.admin.deviceRegistrations.remove(testDeviceId);
+    } catch {
+      // Ignore cleanup errors
+    }
+
+    process.removeListener("SIGINT", forceExit);
+  });
+
+  beforeEach(() => {
+    resetTestTracking();
+  });
+
+  afterEach(async () => {
+    setupTestFailureHandler();
+    await cleanupTrackedResources();
+  });
+
+  describe("push publish", () => {
+    it("should publish a simple notification to a device", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          testDeviceId,
+          "--title",
+          "Test Title",
+          "--body",
+          "Test Body",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("published");
+    });
+
+    it("should publish with JSON output", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          testDeviceId,
+          "--title",
+          "JSON Test",
+          "--body",
+          "Testing JSON output",
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.published).toBe(true);
+      expect(json.recipient.deviceId).toBe(testDeviceId);
+    });
+
+    it("should publish with custom data payload", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          testDeviceId,
+          "--title",
+          "Data Test",
+          "--body",
+          "With custom data",
+          "--data",
+          '{"orderId":"12345","action":"view"}',
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("published");
+    });
+
+    it("should publish with full payload", async () => {
+      const payload = JSON.stringify({
+        notification: {
+          title: "Full Payload Test",
+          body: "Testing full payload",
+        },
+        data: {
+          key: "value",
+        },
+      });
+
+      const result = await runCommand(
+        ["push", "publish", "--device-id", testDeviceId, "--payload", payload],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("published");
+    });
+
+    it("should publish to a client ID", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--client-id",
+          "e2e-publish-test-user",
+          "--title",
+          "Client Test",
+          "--body",
+          "To client",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("published");
+    });
+
+    it("should error when neither device-id nor client-id provided", async () => {
+      const result = await runCommand(
+        ["push", "publish", "--title", "Test", "--body", "Test"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("A recipient is required");
+    });
+
+    it("should error when both device-id and client-id provided", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          "device1",
+          "--client-id",
+          "client1",
+          "--title",
+          "Test",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr.length).toBeGreaterThan(0);
+    });
+
+    it("should error when no payload or title/body provided", async () => {
+      const result = await runCommand(
+        ["push", "publish", "--device-id", testDeviceId],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("--payload");
+    });
+  });
+
+  describe("push batch-publish", () => {
+    it("should batch publish notifications", async () => {
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: testDeviceId },
+          notification: { title: "Batch 1", body: "First" },
+        },
+        {
+          recipient: { deviceId: testDeviceId },
+          notification: { title: "Batch 2", body: "Second" },
+        },
+      ]);
+
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", batchPayload],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("published");
+    });
+
+    it("should batch publish with JSON output", async () => {
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: testDeviceId },
+          notification: { title: "JSON Batch", body: "Test" },
+        },
+      ]);
+
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", batchPayload, "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.total).toBe(1);
+      expect(json.succeeded).toBeDefined();
+    });
+
+    it("should error with invalid batch payload format", async () => {
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", '{"not":"an array"}'],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("JSON array");
+    });
+
+    it("should error with missing recipient in batch item", async () => {
+      const batchPayload = JSON.stringify([
+        { notification: { title: "No recipient" } },
+      ]);
+
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", batchPayload],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("recipient");
+    });
+  });
+});
diff --git a/test/e2e/push/push-config-e2e.test.ts b/test/e2e/push/push-config-e2e.test.ts
new file mode 100644
index 00000000..5fa9bb78
--- /dev/null
+++ b/test/e2e/push/push-config-e2e.test.ts
@@ -0,0 +1,446 @@
+import {
+  describe,
+  it,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll,
+  expect,
+} from "vitest";
+import { ControlApi } from "../../../src/services/control-api.js";
+import {
+  forceExit,
+  cleanupTrackedResources,
+  testOutputFiles,
+  testCommands,
+  setupTestFailureHandler,
+  resetTestTracking,
+} from "../../helpers/e2e-test-helper.js";
+import { runCommand } from "../../helpers/command-helpers.js";
+import { resolve } from "node:path";
+
+describe("Push Config E2E Tests", () => {
+  let controlApi: ControlApi;
+  let testAppId: string;
+  let shouldSkip = false;
+
+  beforeAll(async () => {
+    process.on("SIGINT", forceExit);
+
+    const accessToken = process.env.E2E_ABLY_ACCESS_TOKEN;
+    if (!accessToken) {
+      console.log(
+        "E2E_ABLY_ACCESS_TOKEN not available, skipping Push Config E2E tests",
+      );
+      shouldSkip = true;
+      return;
+    }
+
+    controlApi = new ControlApi({
+      accessToken,
+      logErrors: false,
+    });
+
+    try {
+      // Create a dedicated test app for push config tests
+      const appName = `E2E Push Config Test ${Date.now()}`;
+      const createResult = await runCommand(
+        ["apps", "create", "--name", appName, "--json"],
+        {
+          env: { ABLY_ACCESS_TOKEN: accessToken },
+        },
+      );
+
+      const result = JSON.parse(createResult.stdout);
+      testAppId = result.app.id;
+      console.log(`Created test app for push config: ${testAppId}`);
+    } catch (error) {
+      console.error("Failed to create test app:", error);
+      shouldSkip = true;
+    }
+  });
+
+  afterAll(async () => {
+    if (testAppId) {
+      try {
+        await controlApi.deleteApp(testAppId);
+        console.log(`Deleted test app: ${testAppId}`);
+      } catch (error) {
+        console.warn(`Failed to delete test app ${testAppId}:`, error);
+      }
+    }
+    process.removeListener("SIGINT", forceExit);
+  });
+
+  beforeEach(() => {
+    resetTestTracking();
+    testOutputFiles.clear();
+    testCommands.length = 0;
+  });
+
+  afterEach(async () => {
+    await cleanupTrackedResources();
+  });
+
+  describe("Push Config Show", () => {
+    it(
+      "should show push config for a new app (not configured)",
+      { timeout: 15000 },
+      async () => {
+        setupTestFailureHandler("should show push config for a new app");
+
+        if (shouldSkip) return;
+
+        const result = await runCommand(
+          ["push:config:show", "--app", testAppId, "--json"],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(result.exitCode).toBe(0);
+        const output = JSON.parse(result.stdout);
+        expect(output).toHaveProperty("success", true);
+        expect(output).toHaveProperty("appId", testAppId);
+        expect(output.apns).toHaveProperty("configured", false);
+        expect(output.fcm).toHaveProperty("configured", false);
+      },
+    );
+
+    it(
+      "should show push config in human-readable format",
+      { timeout: 15000 },
+      async () => {
+        setupTestFailureHandler("should show push config human-readable");
+
+        if (shouldSkip) return;
+
+        const result = await runCommand(
+          ["push:config:show", "--app", testAppId],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(result.exitCode).toBe(0);
+        expect(result.stdout).toContain("APNs Configuration");
+        expect(result.stdout).toContain("FCM Configuration");
+        expect(result.stdout).toContain("Not configured");
+      },
+    );
+  });
+
+  describe("APNs P8 Configuration", () => {
+    const p8FixturePath = resolve("test/fixtures/push/test-apns-key.p8");
+
+    it(
+      "should configure APNs with P8 key and verify via show",
+      { timeout: 30000 },
+      async () => {
+        setupTestFailureHandler("should configure APNs with P8 key");
+
+        if (shouldSkip) return;
+
+        // 1. Set APNs P8 config
+        const setResult = await runCommand(
+          [
+            "push:config:set-apns",
+            "--app",
+            testAppId,
+            "--key-file",
+            p8FixturePath,
+            "--key-id",
+            "ABC123DEFG",
+            "--team-id",
+            "TEAM123456",
+            "--topic",
+            "com.example.pushtest",
+            "--sandbox",
+            "--json",
+          ],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(setResult.exitCode).toBe(0);
+        const setOutput = JSON.parse(setResult.stdout);
+        expect(setOutput).toHaveProperty("success", true);
+        expect(setOutput).toHaveProperty("method", "p8");
+
+        // 2. Verify config was set by showing it
+        const showResult = await runCommand(
+          ["push:config:show", "--app", testAppId, "--json"],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(showResult.exitCode).toBe(0);
+        const showOutput = JSON.parse(showResult.stdout);
+        expect(showOutput.apns).toHaveProperty("configured", true);
+        expect(showOutput.apns).toHaveProperty("hasP8Key", true);
+        expect(showOutput.apns).toHaveProperty("useSandbox", true);
+        expect(showOutput.apns).toHaveProperty("authType", "token");
+        expect(showOutput.apns).toHaveProperty("keyId", "ABC123DEFG");
+        expect(showOutput.apns).toHaveProperty("teamId", "TEAM123456");
+        expect(showOutput.apns).toHaveProperty(
+          "bundleId",
+          "com.example.pushtest",
+        );
+      },
+    );
+
+    it("should clear APNs config and verify", { timeout: 30000 }, async () => {
+      setupTestFailureHandler("should clear APNs config");
+
+      if (shouldSkip) return;
+
+      // 1. First set APNs config (in case previous test didn't run)
+      await runCommand(
+        [
+          "push:config:set-apns",
+          "--app",
+          testAppId,
+          "--key-file",
+          p8FixturePath,
+          "--key-id",
+          "ABC123DEFG",
+          "--team-id",
+          "TEAM123456",
+          "--topic",
+          "com.example.pushtest",
+          "--json",
+        ],
+        {
+          env: {
+            ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+          },
+        },
+      );
+
+      // 2. Clear APNs config
+      const clearResult = await runCommand(
+        ["push:config:clear-apns", "--app", testAppId, "--force", "--json"],
+        {
+          env: {
+            ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+          },
+        },
+      );
+
+      expect(clearResult.exitCode).toBe(0);
+      const clearOutput = JSON.parse(clearResult.stdout);
+      expect(clearOutput).toHaveProperty("success", true);
+      expect(clearOutput).toHaveProperty("cleared", "apns");
+
+      // 3. Verify config was cleared
+      const showResult = await runCommand(
+        ["push:config:show", "--app", testAppId, "--json"],
+        {
+          env: {
+            ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+          },
+        },
+      );
+
+      expect(showResult.exitCode).toBe(0);
+      const showOutput = JSON.parse(showResult.stdout);
+      expect(showOutput.apns).toHaveProperty("configured", false);
+      expect(showOutput.apns).toHaveProperty("hasP8Key", false);
+    });
+  });
+
+  describe("FCM Configuration", () => {
+    const fcmFixturePath = resolve(
+      "test/fixtures/push/test-fcm-service-account.json",
+    );
+
+    it(
+      "should configure FCM and verify via show",
+      { timeout: 30000 },
+      async () => {
+        setupTestFailureHandler("should configure FCM");
+
+        if (shouldSkip) return;
+
+        // 1. Set FCM config
+        const setResult = await runCommand(
+          [
+            "push:config:set-fcm",
+            "--app",
+            testAppId,
+            "--service-account",
+            fcmFixturePath,
+            "--json",
+          ],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(setResult.exitCode).toBe(0);
+        const setOutput = JSON.parse(setResult.stdout);
+        expect(setOutput).toHaveProperty("success", true);
+
+        // 2. Verify config was set
+        const showResult = await runCommand(
+          ["push:config:show", "--app", testAppId, "--json"],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(showResult.exitCode).toBe(0);
+        const showOutput = JSON.parse(showResult.stdout);
+        expect(showOutput.fcm).toHaveProperty("configured", true);
+      },
+    );
+
+    it("should clear FCM config and verify", { timeout: 30000 }, async () => {
+      setupTestFailureHandler("should clear FCM config");
+
+      if (shouldSkip) return;
+
+      // 1. First set FCM config
+      await runCommand(
+        [
+          "push:config:set-fcm",
+          "--app",
+          testAppId,
+          "--service-account",
+          fcmFixturePath,
+          "--json",
+        ],
+        {
+          env: {
+            ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+          },
+        },
+      );
+
+      // 2. Clear FCM config
+      const clearResult = await runCommand(
+        ["push:config:clear-fcm", "--app", testAppId, "--force", "--json"],
+        {
+          env: {
+            ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+          },
+        },
+      );
+
+      expect(clearResult.exitCode).toBe(0);
+      const clearOutput = JSON.parse(clearResult.stdout);
+      expect(clearOutput).toHaveProperty("success", true);
+      expect(clearOutput).toHaveProperty("cleared", "fcm");
+
+      // 3. Verify config was cleared
+      const showResult = await runCommand(
+        ["push:config:show", "--app", testAppId, "--json"],
+        {
+          env: {
+            ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+          },
+        },
+      );
+
+      expect(showResult.exitCode).toBe(0);
+      const showOutput = JSON.parse(showResult.stdout);
+      expect(showOutput.fcm).toHaveProperty("configured", false);
+    });
+  });
+
+  describe("Validation", () => {
+    it(
+      "should reject set-apns without required P8 flags",
+      { timeout: 15000 },
+      async () => {
+        setupTestFailureHandler("should reject set-apns without P8 flags");
+
+        if (shouldSkip) return;
+
+        const p8FixturePath = resolve("test/fixtures/push/test-apns-key.p8");
+
+        // Missing --key-id, --team-id, --topic
+        const result = await runCommand(
+          [
+            "push:config:set-apns",
+            "--app",
+            testAppId,
+            "--key-file",
+            p8FixturePath,
+          ],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(result.exitCode).not.toBe(0);
+      },
+    );
+
+    it(
+      "should reject set-apns without any certificate or key",
+      { timeout: 15000 },
+      async () => {
+        setupTestFailureHandler("should reject set-apns without cert or key");
+
+        if (shouldSkip) return;
+
+        const result = await runCommand(
+          ["push:config:set-apns", "--app", testAppId],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(result.exitCode).not.toBe(0);
+      },
+    );
+
+    it(
+      "should reject set-fcm with invalid JSON file",
+      { timeout: 15000 },
+      async () => {
+        setupTestFailureHandler("should reject set-fcm with invalid JSON");
+
+        if (shouldSkip) return;
+
+        const p8FixturePath = resolve("test/fixtures/push/test-apns-key.p8");
+
+        const result = await runCommand(
+          [
+            "push:config:set-fcm",
+            "--app",
+            testAppId,
+            "--service-account",
+            p8FixturePath,
+          ],
+          {
+            env: {
+              ABLY_ACCESS_TOKEN: process.env.E2E_ABLY_ACCESS_TOKEN,
+            },
+          },
+        );
+
+        expect(result.exitCode).not.toBe(0);
+      },
+    );
+  });
+});
diff --git a/test/fixtures/push/test-apns-key.p8 b/test/fixtures/push/test-apns-key.p8
new file mode 100644
index 00000000..3791a6bf
--- /dev/null
+++ b/test/fixtures/push/test-apns-key.p8
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgFAKE+KEY+DATA+
+FOR+TESTING+ONLY+NOT+A+REAL+KEY+DATAoGCCqGSM49AwEHoUQDQgAEFAKE+
+PUBLIC+KEY+DATA+FOR+TESTING+ONLY+NOT+A+REAL+PUBLIC+KEY+DATA+HERE
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/push/test-fcm-service-account.json b/test/fixtures/push/test-fcm-service-account.json
new file mode 100644
index 00000000..76131da4
--- /dev/null
+++ b/test/fixtures/push/test-fcm-service-account.json
@@ -0,0 +1,10 @@
+{
+  "type": "service_account",
+  "project_id": "test-project-id",
+  "private_key_id": "test-key-id",
+  "private_key": "-----BEGIN RSA PRIVATE KEY-----\nFAKE+KEY+FOR+TESTING\n-----END RSA PRIVATE KEY-----\n",
+  "client_email": "test@test-project-id.iam.gserviceaccount.com",
+  "client_id": "123456789",
+  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+  "token_uri": "https://oauth2.googleapis.com/token"
+}
diff --git a/test/helpers/mock-ably-rest.ts b/test/helpers/mock-ably-rest.ts
index 5afd487f..073974a6 100644
--- a/test/helpers/mock-ably-rest.ts
+++ b/test/helpers/mock-ably-rest.ts
@@ -84,14 +84,17 @@ export interface MockPush {
     publish: Mock;
     channelSubscriptions: {
       list: Mock;
+      listChannels: Mock;
       save: Mock;
       remove: Mock;
+      removeWhere: Mock;
     };
     deviceRegistrations: {
       list: Mock;
       get: Mock;
       save: Mock;
       remove: Mock;
+      removeWhere: Mock;
     };
   };
 }
@@ -217,14 +220,17 @@ function createMockPush(): MockPush {
       publish: vi.fn().mockImplementation(async () => {}),
       channelSubscriptions: {
         list: vi.fn().mockResolvedValue({ items: [] }),
+        listChannels: vi.fn().mockResolvedValue({ items: [] }),
         save: vi.fn().mockImplementation(async () => {}),
         remove: vi.fn().mockImplementation(async () => {}),
+        removeWhere: vi.fn().mockImplementation(async () => {}),
       },
       deviceRegistrations: {
         list: vi.fn().mockResolvedValue({ items: [] }),
         get: vi.fn().mockResolvedValue(null),
         save: vi.fn().mockImplementation(async () => {}),
         remove: vi.fn().mockImplementation(async () => {}),
+        removeWhere: vi.fn().mockImplementation(async () => {}),
       },
     },
   };
diff --git a/test/unit/commands/push/batch-publish.test.ts b/test/unit/commands/push/batch-publish.test.ts
new file mode 100644
index 00000000..7017e5c6
--- /dev/null
+++ b/test/unit/commands/push/batch-publish.test.ts
@@ -0,0 +1,128 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../helpers/standard-tests.js";
+
+describe("push:batch-publish command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:batch-publish", import.meta.url);
+  standardArgValidationTests("push:batch-publish", import.meta.url);
+  standardFlagTests("push:batch-publish", import.meta.url, [
+    "--json",
+    "--payload",
+  ]);
+
+  describe("functionality", () => {
+    it("should batch publish notifications", async () => {
+      const mock = getMockAblyRest();
+      const payload =
+        '[{"recipient":{"deviceId":"dev-1"},"notification":{"title":"Hello"}}]';
+
+      const { stdout } = await runCommand(
+        ["push:batch-publish", "--payload", payload],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("published");
+      expect(mock.request).toHaveBeenCalledWith(
+        "post",
+        "/push/batch/publish",
+        2,
+        null,
+        expect.any(Array),
+      );
+    });
+
+    it("should output JSON when requested", async () => {
+      getMockAblyRest();
+      const payload =
+        '[{"recipient":{"deviceId":"dev-1"},"notification":{"title":"Hello"}}]';
+
+      const { stdout } = await runCommand(
+        ["push:batch-publish", "--payload", payload, "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("published", true);
+      expect(result).toHaveProperty("total", 1);
+      expect(result).toHaveProperty("succeeded");
+      expect(result).toHaveProperty("failed", 0);
+    });
+
+    it("should require --payload flag", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should reject invalid JSON", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", "not-json"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should reject non-array JSON", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", '{"not":"array"}'],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should reject items missing recipient", async () => {
+      const payload = '[{"notification":{"title":"Hello"}}]';
+
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", payload],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should reject items missing notification and data", async () => {
+      const payload = '[{"recipient":{"deviceId":"dev-1"}}]';
+
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", payload],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.request.mockRejectedValue(new Error("Batch publish failed"));
+
+      const payload =
+        '[{"recipient":{"deviceId":"dev-1"},"notification":{"title":"Hello"}}]';
+
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", payload],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/list-channels.test.ts b/test/unit/commands/push/channels/list-channels.test.ts
new file mode 100644
index 00000000..a44bba1f
--- /dev/null
+++ b/test/unit/commands/push/channels/list-channels.test.ts
@@ -0,0 +1,86 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:channels:list-channels command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:channels:list-channels", import.meta.url);
+  standardArgValidationTests("push:channels:list-channels", import.meta.url);
+  standardFlagTests("push:channels:list-channels", import.meta.url, [
+    "--json",
+    "--limit",
+  ]);
+
+  describe("functionality", () => {
+    it("should list channels with push subscriptions", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.listChannels.mockResolvedValue({
+        items: ["channel-1", "channel-2", "channel-3"],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list-channels"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("channel-1");
+      expect(stdout).toContain("channel-2");
+      expect(stdout).toContain("channel-3");
+    });
+
+    it("should handle empty list", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.listChannels.mockResolvedValue({
+        items: [],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list-channels"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("No channels with push subscriptions found");
+    });
+
+    it("should output JSON when requested", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.listChannels.mockResolvedValue({
+        items: ["channel-1"],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list-channels", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("channels");
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.listChannels.mockRejectedValue(
+        new Error("API error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:channels:list-channels"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/list.test.ts b/test/unit/commands/push/channels/list.test.ts
new file mode 100644
index 00000000..4f632ef2
--- /dev/null
+++ b/test/unit/commands/push/channels/list.test.ts
@@ -0,0 +1,100 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:channels:list command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:channels:list", import.meta.url);
+  standardArgValidationTests("push:channels:list", import.meta.url);
+  standardFlagTests("push:channels:list", import.meta.url, [
+    "--json",
+    "--channel",
+    "--device-id",
+    "--client-id",
+    "--limit",
+  ]);
+
+  describe("functionality", () => {
+    it("should list subscriptions for a channel", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockResolvedValue({
+        items: [
+          { channel: "my-channel", deviceId: "device-1" },
+          { channel: "my-channel", clientId: "client-1" },
+        ],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list", "--channel", "my-channel"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("device-1");
+      expect(stdout).toContain("client-1");
+    });
+
+    it("should handle empty list", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockResolvedValue({
+        items: [],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list", "--channel", "my-channel"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("No subscriptions found");
+    });
+
+    it("should output JSON when requested", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockResolvedValue({
+        items: [{ channel: "my-channel", deviceId: "device-1" }],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list", "--channel", "my-channel", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("subscriptions");
+    });
+
+    it("should require --channel flag", async () => {
+      const { error } = await runCommand(
+        ["push:channels:list"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockRejectedValue(
+        new Error("API error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:channels:list", "--channel", "my-channel"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/remove-where.test.ts b/test/unit/commands/push/channels/remove-where.test.ts
new file mode 100644
index 00000000..47b1411f
--- /dev/null
+++ b/test/unit/commands/push/channels/remove-where.test.ts
@@ -0,0 +1,85 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:channels:remove-where command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:channels:remove-where", import.meta.url);
+  standardArgValidationTests("push:channels:remove-where", import.meta.url);
+  standardFlagTests("push:channels:remove-where", import.meta.url, [
+    "--json",
+    "--channel",
+    "--device-id",
+    "--client-id",
+    "--force",
+  ]);
+
+  describe("functionality", () => {
+    it("should remove matching subscriptions with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:channels:remove-where", "--channel", "my-channel", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("removed");
+      expect(
+        mock.push.admin.channelSubscriptions.removeWhere,
+      ).toHaveBeenCalledWith(
+        expect.objectContaining({ channel: "my-channel" }),
+      );
+    });
+
+    it("should require --channel flag", async () => {
+      const { error } = await runCommand(
+        ["push:channels:remove-where", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should output JSON when requested", async () => {
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove-where",
+          "--channel",
+          "my-channel",
+          "--force",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("removed", true);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.removeWhere.mockRejectedValue(
+        new Error("Remove failed"),
+      );
+
+      const { error } = await runCommand(
+        ["push:channels:remove-where", "--channel", "my-channel", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/remove.test.ts b/test/unit/commands/push/channels/remove.test.ts
new file mode 100644
index 00000000..5887ee6b
--- /dev/null
+++ b/test/unit/commands/push/channels/remove.test.ts
@@ -0,0 +1,102 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:channels:remove command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:channels:remove", import.meta.url);
+  standardArgValidationTests("push:channels:remove", import.meta.url);
+  standardFlagTests("push:channels:remove", import.meta.url, [
+    "--json",
+    "--channel",
+    "--device-id",
+    "--client-id",
+    "--force",
+  ]);
+
+  describe("functionality", () => {
+    it("should remove subscription with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "my-channel",
+          "--device-id",
+          "dev-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("removed");
+      expect(mock.push.admin.channelSubscriptions.remove).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "my-channel",
+          deviceId: "dev-1",
+        }),
+      );
+    });
+
+    it("should require either device-id or client-id", async () => {
+      const { error } = await runCommand(
+        ["push:channels:remove", "--channel", "my-channel", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should output JSON when requested", async () => {
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "my-channel",
+          "--device-id",
+          "dev-1",
+          "--force",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("removed", true);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.remove.mockRejectedValue(
+        new Error("Remove failed"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "my-channel",
+          "--device-id",
+          "dev-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/save.test.ts b/test/unit/commands/push/channels/save.test.ts
new file mode 100644
index 00000000..8d4edaff
--- /dev/null
+++ b/test/unit/commands/push/channels/save.test.ts
@@ -0,0 +1,122 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:channels:save command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:channels:save", import.meta.url);
+  standardArgValidationTests("push:channels:save", import.meta.url);
+  standardFlagTests("push:channels:save", import.meta.url, [
+    "--json",
+    "--channel",
+    "--device-id",
+    "--client-id",
+  ]);
+
+  describe("functionality", () => {
+    it("should save subscription with device ID", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "my-channel",
+          "--device-id",
+          "device-1",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Subscribed");
+      expect(stdout).toContain("my-channel");
+      expect(mock.push.admin.channelSubscriptions.save).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "my-channel",
+          deviceId: "device-1",
+        }),
+      );
+    });
+
+    it("should save subscription with client ID", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "my-channel",
+          "--client-id",
+          "client-1",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Subscribed");
+      expect(mock.push.admin.channelSubscriptions.save).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "my-channel",
+          clientId: "client-1",
+        }),
+      );
+    });
+
+    it("should require either device-id or client-id", async () => {
+      const { error } = await runCommand(
+        ["push:channels:save", "--channel", "my-channel"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should output JSON when requested", async () => {
+      const { stdout } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "my-channel",
+          "--device-id",
+          "dev-1",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("subscription");
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.save.mockRejectedValue(
+        new Error("Save failed"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "my-channel",
+          "--device-id",
+          "dev-1",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/clear-apns.test.ts b/test/unit/commands/push/config/clear-apns.test.ts
new file mode 100644
index 00000000..f547da6b
--- /dev/null
+++ b/test/unit/commands/push/config/clear-apns.test.ts
@@ -0,0 +1,160 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import {
+  nockControl,
+  controlApiCleanup,
+  getControlApiContext,
+} from "../../../../helpers/control-api-test-helpers.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+  standardControlApiErrorTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:config:clear-apns command", () => {
+  let appId: string;
+
+  beforeEach(() => {
+    const ctx = getControlApiContext();
+    appId = ctx.appId;
+    process.env.ABLY_ACCESS_TOKEN = "fake_access_token";
+  });
+
+  afterEach(() => {
+    controlApiCleanup();
+    delete process.env.ABLY_ACCESS_TOKEN;
+  });
+
+  standardHelpTests("push:config:clear-apns", import.meta.url);
+  standardArgValidationTests("push:config:clear-apns", import.meta.url);
+  standardFlagTests("push:config:clear-apns", import.meta.url, [
+    "--json",
+    "--app",
+    "--force",
+  ]);
+
+  describe("functionality", () => {
+    it("should clear APNs config with --force", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: "test-account", name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/test-account/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId: "test-account",
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+            apnsCertificate: "some-cert",
+          },
+        ]);
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-apns", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs configuration cleared");
+    });
+
+    it("should warn when APNs is not configured", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: "test-account", name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/test-account/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId: "test-account",
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+          },
+        ]);
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-apns", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("not configured");
+      expect(stdout).toContain("Nothing to clear");
+    });
+
+    it("should output JSON when requested", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: "test-account", name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/test-account/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId: "test-account",
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+            apnsSigningKey: "some-key",
+          },
+        ]);
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-apns", "--force", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("cleared", "apns");
+    });
+  });
+
+  describe("error handling", () => {
+    standardControlApiErrorTests({
+      commandArgs: ["push:config:clear-apns", "--force"],
+      importMetaUrl: import.meta.url,
+      setupNock: (scenario) => {
+        switch (scenario) {
+          case "401": {
+            nockControl().get("/v1/me").reply(401, { error: "Unauthorized" });
+
+            break;
+          }
+          case "500": {
+            nockControl().get("/v1/me").reply(500, { error: "Server Error" });
+
+            break;
+          }
+          case "network": {
+            nockControl().get("/v1/me").replyWithError("Network error");
+
+            break;
+          }
+          // No default
+        }
+      },
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/clear-fcm.test.ts b/test/unit/commands/push/config/clear-fcm.test.ts
new file mode 100644
index 00000000..3dab92b0
--- /dev/null
+++ b/test/unit/commands/push/config/clear-fcm.test.ts
@@ -0,0 +1,160 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import {
+  nockControl,
+  controlApiCleanup,
+  getControlApiContext,
+} from "../../../../helpers/control-api-test-helpers.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+  standardControlApiErrorTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:config:clear-fcm command", () => {
+  let appId: string;
+
+  beforeEach(() => {
+    const ctx = getControlApiContext();
+    appId = ctx.appId;
+    process.env.ABLY_ACCESS_TOKEN = "fake_access_token";
+  });
+
+  afterEach(() => {
+    controlApiCleanup();
+    delete process.env.ABLY_ACCESS_TOKEN;
+  });
+
+  standardHelpTests("push:config:clear-fcm", import.meta.url);
+  standardArgValidationTests("push:config:clear-fcm", import.meta.url);
+  standardFlagTests("push:config:clear-fcm", import.meta.url, [
+    "--json",
+    "--app",
+    "--force",
+  ]);
+
+  describe("functionality", () => {
+    it("should clear FCM config with --force", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: "test-account", name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/test-account/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId: "test-account",
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+            fcmServiceAccount: "some-account",
+          },
+        ]);
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-fcm", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("FCM configuration cleared");
+    });
+
+    it("should warn when FCM is not configured", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: "test-account", name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/test-account/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId: "test-account",
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+          },
+        ]);
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-fcm", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("not configured");
+      expect(stdout).toContain("Nothing to clear");
+    });
+
+    it("should output JSON when requested", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: "test-account", name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/test-account/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId: "test-account",
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+            fcmServiceAccount: "some-account",
+          },
+        ]);
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-fcm", "--force", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("cleared", "fcm");
+    });
+  });
+
+  describe("error handling", () => {
+    standardControlApiErrorTests({
+      commandArgs: ["push:config:clear-fcm", "--force"],
+      importMetaUrl: import.meta.url,
+      setupNock: (scenario) => {
+        switch (scenario) {
+          case "401": {
+            nockControl().get("/v1/me").reply(401, { error: "Unauthorized" });
+
+            break;
+          }
+          case "500": {
+            nockControl().get("/v1/me").reply(500, { error: "Server Error" });
+
+            break;
+          }
+          case "network": {
+            nockControl().get("/v1/me").replyWithError("Network error");
+
+            break;
+          }
+          // No default
+        }
+      },
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/set-apns.test.ts b/test/unit/commands/push/config/set-apns.test.ts
new file mode 100644
index 00000000..dcbea72a
--- /dev/null
+++ b/test/unit/commands/push/config/set-apns.test.ts
@@ -0,0 +1,248 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { resolve } from "node:path";
+import {
+  nockControl,
+  controlApiCleanup,
+  getControlApiContext,
+} from "../../../../helpers/control-api-test-helpers.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+  standardControlApiErrorTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:config:set-apns command", () => {
+  let appId: string;
+  const p8FixturePath = resolve("test/fixtures/push/test-apns-key.p8");
+
+  beforeEach(() => {
+    const ctx = getControlApiContext();
+    appId = ctx.appId;
+    process.env.ABLY_ACCESS_TOKEN = "fake_access_token";
+  });
+
+  afterEach(() => {
+    controlApiCleanup();
+    delete process.env.ABLY_ACCESS_TOKEN;
+  });
+
+  standardHelpTests("push:config:set-apns", import.meta.url);
+  standardArgValidationTests("push:config:set-apns", import.meta.url);
+  standardFlagTests("push:config:set-apns", import.meta.url, [
+    "--json",
+    "--app",
+    "--certificate",
+    "--key-file",
+    "--sandbox",
+  ]);
+
+  describe("functionality", () => {
+    it("should configure APNs with P8 key successfully", async () => {
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          p8FixturePath,
+          "--key-id",
+          "KEY123",
+          "--team-id",
+          "TEAM456",
+          "--topic",
+          "com.example.app",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs P8 key configured");
+    });
+
+    it("should upload P12 certificate successfully", async () => {
+      nockControl()
+        .post(`/v1/apps/${appId}/push/certificate`)
+        .reply(200, { id: "cert-123" });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-apns", "--certificate", p8FixturePath],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs P12 certificate uploaded");
+    });
+
+    it("should output JSON for P8 key when requested", async () => {
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          p8FixturePath,
+          "--key-id",
+          "KEY123",
+          "--team-id",
+          "TEAM456",
+          "--topic",
+          "com.example.app",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("method", "p8");
+    });
+
+    it("should output JSON for P12 certificate when requested", async () => {
+      nockControl()
+        .post(`/v1/apps/${appId}/push/certificate`)
+        .reply(200, { id: "cert-123" });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-apns", "--certificate", p8FixturePath, "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("method", "p12");
+    });
+
+    it("should require either certificate or key-file", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-apns"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should require key-id when using key-file", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          p8FixturePath,
+          "--team-id",
+          "TEAM456",
+          "--topic",
+          "com.example.app",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should require team-id when using key-file", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          p8FixturePath,
+          "--key-id",
+          "KEY123",
+          "--topic",
+          "com.example.app",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should require topic when using key-file", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          p8FixturePath,
+          "--key-id",
+          "KEY123",
+          "--team-id",
+          "TEAM456",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should fail when key file not found", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          "/nonexistent/file.p8",
+          "--key-id",
+          "KEY123",
+          "--team-id",
+          "TEAM456",
+          "--topic",
+          "com.example.app",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should fail when certificate file not found", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-apns", "--certificate", "/nonexistent/cert.p12"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+
+  describe("error handling", () => {
+    standardControlApiErrorTests({
+      commandArgs: [
+        "push:config:set-apns",
+        "--key-file",
+        p8FixturePath,
+        "--key-id",
+        "KEY123",
+        "--team-id",
+        "TEAM456",
+        "--topic",
+        "com.example.app",
+      ],
+      importMetaUrl: import.meta.url,
+      setupNock: (scenario) => {
+        switch (scenario) {
+          case "401": {
+            nockControl()
+              .patch(`/v1/apps/${appId}`)
+              .reply(401, { error: "Unauthorized" });
+
+            break;
+          }
+          case "500": {
+            nockControl()
+              .patch(`/v1/apps/${appId}`)
+              .reply(500, { error: "Server Error" });
+
+            break;
+          }
+          case "network": {
+            nockControl()
+              .patch(`/v1/apps/${appId}`)
+              .replyWithError("Network error");
+
+            break;
+          }
+          // No default
+        }
+      },
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/set-fcm.test.ts b/test/unit/commands/push/config/set-fcm.test.ts
new file mode 100644
index 00000000..0831bb59
--- /dev/null
+++ b/test/unit/commands/push/config/set-fcm.test.ts
@@ -0,0 +1,165 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { resolve, join } from "node:path";
+import { mkdtempSync, writeFileSync, unlinkSync, rmdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import {
+  nockControl,
+  controlApiCleanup,
+  getControlApiContext,
+} from "../../../../helpers/control-api-test-helpers.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+  standardControlApiErrorTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:config:set-fcm command", () => {
+  let appId: string;
+  const fcmFixturePath = resolve(
+    "test/fixtures/push/test-fcm-service-account.json",
+  );
+
+  beforeEach(() => {
+    const ctx = getControlApiContext();
+    appId = ctx.appId;
+    process.env.ABLY_ACCESS_TOKEN = "fake_access_token";
+  });
+
+  afterEach(() => {
+    controlApiCleanup();
+    delete process.env.ABLY_ACCESS_TOKEN;
+  });
+
+  standardHelpTests("push:config:set-fcm", import.meta.url);
+  standardArgValidationTests("push:config:set-fcm", import.meta.url);
+  standardFlagTests("push:config:set-fcm", import.meta.url, [
+    "--json",
+    "--app",
+    "--service-account",
+  ]);
+
+  describe("functionality", () => {
+    it("should configure FCM successfully", async () => {
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-fcm", "--service-account", fcmFixturePath],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("FCM configuration updated");
+    });
+
+    it("should output JSON when requested", async () => {
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-fcm", "--service-account", fcmFixturePath, "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("appId");
+    });
+
+    it("should fail when service account file not found", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-fcm", "--service-account", "/nonexistent/file.json"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should fail when service account file is not valid JSON", async () => {
+      const invalidPath = resolve("test/fixtures/push/test-apns-key.p8");
+      const { error } = await runCommand(
+        ["push:config:set-fcm", "--service-account", invalidPath],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should require service-account flag", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-fcm"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should reject service account without type service_account", async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), "ably-cli-test-"));
+      const tempPath = join(tempDir, "wrong-type.json");
+      writeFileSync(
+        tempPath,
+        JSON.stringify({ type: "not_service_account", project_id: "test" }),
+      );
+      try {
+        const { error } = await runCommand(
+          ["push:config:set-fcm", "--service-account", tempPath],
+          import.meta.url,
+        );
+        expect(error).toBeDefined();
+      } finally {
+        unlinkSync(tempPath);
+        rmdirSync(tempDir);
+      }
+    });
+
+    it("should reject service account without project_id", async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), "ably-cli-test-"));
+      const tempPath = join(tempDir, "no-project.json");
+      writeFileSync(tempPath, JSON.stringify({ type: "service_account" }));
+      try {
+        const { error } = await runCommand(
+          ["push:config:set-fcm", "--service-account", tempPath],
+          import.meta.url,
+        );
+        expect(error).toBeDefined();
+      } finally {
+        unlinkSync(tempPath);
+        rmdirSync(tempDir);
+      }
+    });
+  });
+
+  describe("error handling", () => {
+    standardControlApiErrorTests({
+      commandArgs: ["push:config:set-fcm", "--service-account", fcmFixturePath],
+      importMetaUrl: import.meta.url,
+      setupNock: (scenario) => {
+        switch (scenario) {
+          case "401": {
+            nockControl()
+              .patch(`/v1/apps/${appId}`)
+              .reply(401, { error: "Unauthorized" });
+
+            break;
+          }
+          case "500": {
+            nockControl()
+              .patch(`/v1/apps/${appId}`)
+              .reply(500, { error: "Server Error" });
+
+            break;
+          }
+          case "network": {
+            nockControl()
+              .patch(`/v1/apps/${appId}`)
+              .replyWithError("Network error");
+
+            break;
+          }
+          // No default
+        }
+      },
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/show.test.ts b/test/unit/commands/push/config/show.test.ts
new file mode 100644
index 00000000..9299fb06
--- /dev/null
+++ b/test/unit/commands/push/config/show.test.ts
@@ -0,0 +1,221 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import {
+  nockControl,
+  controlApiCleanup,
+  getControlApiContext,
+} from "../../../../helpers/control-api-test-helpers.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+  standardControlApiErrorTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:config:show command", () => {
+  let accountId: string;
+  let appId: string;
+
+  beforeEach(() => {
+    const ctx = getControlApiContext();
+    accountId = ctx.accountId;
+    appId = ctx.appId;
+    process.env.ABLY_ACCESS_TOKEN = "fake_access_token";
+  });
+
+  afterEach(() => {
+    controlApiCleanup();
+    delete process.env.ABLY_ACCESS_TOKEN;
+  });
+
+  standardHelpTests("push:config:show", import.meta.url);
+  standardArgValidationTests("push:config:show", import.meta.url);
+  standardFlagTests("push:config:show", import.meta.url, ["--json", "--app"]);
+
+  describe("functionality", () => {
+    it("should show push config with not-configured status", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId,
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+          },
+        ]);
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs Configuration");
+      expect(stdout).toContain("FCM Configuration");
+      expect(stdout).toContain("Web Push");
+      expect(stdout).toContain("Not configured");
+      expect(stdout).toContain("Not available");
+    });
+
+    it("should show configured APNs P8 key details", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId,
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+            apnsAuthType: "token",
+            apnsSigningKey: "some-key",
+            apnsSigningKeyId: "KEY123",
+            apnsIssuerKey: "TEAM456",
+            apnsTopicHeader: "com.example.app",
+            apnsUseSandboxEndpoint: true,
+          },
+        ]);
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Configured");
+      expect(stdout).toContain("Sandbox");
+      expect(stdout).toContain("P8 Key");
+    });
+
+    it("should show configured FCM details", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId,
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+            fcmServiceAccount: "some-account",
+            fcmProjectId: "my-project",
+          },
+        ]);
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Configured");
+      expect(stdout).toContain("my-project");
+    });
+
+    it("should output JSON when requested", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl()
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(200, [
+          {
+            id: appId,
+            accountId,
+            name: "Test App",
+            status: "active",
+            created: 1640995200000,
+            modified: 1640995200000,
+            tlsOnly: false,
+          },
+        ]);
+
+      const { stdout } = await runCommand(
+        ["push:config:show", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("appId");
+      expect(result).toHaveProperty("apns");
+      expect(result).toHaveProperty("fcm");
+    });
+  });
+
+  describe("error handling", () => {
+    standardControlApiErrorTests({
+      commandArgs: ["push:config:show"],
+      importMetaUrl: import.meta.url,
+      setupNock: (scenario) => {
+        switch (scenario) {
+          case "401": {
+            nockControl().get("/v1/me").reply(401, { error: "Unauthorized" });
+
+            break;
+          }
+          case "500": {
+            nockControl()
+              .get("/v1/me")
+              .reply(200, {
+                account: { id: accountId, name: "Test" },
+                user: { email: "test@test.com" },
+              });
+            nockControl()
+              .get(`/v1/accounts/${accountId}/apps`)
+              .reply(500, { error: "Server Error" });
+
+            break;
+          }
+          case "network": {
+            nockControl().get("/v1/me").replyWithError("Network error");
+
+            break;
+          }
+          // No default
+        }
+      },
+    });
+
+    it("should handle app not found", async () => {
+      nockControl()
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test" },
+          user: { email: "test@test.com" },
+        });
+      nockControl().get(`/v1/accounts/${accountId}/apps`).reply(200, []);
+
+      const { error } = await runCommand(["push:config:show"], import.meta.url);
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/get.test.ts b/test/unit/commands/push/devices/get.test.ts
new file mode 100644
index 00000000..95482d62
--- /dev/null
+++ b/test/unit/commands/push/devices/get.test.ts
@@ -0,0 +1,97 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:devices:get command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:devices:get", import.meta.url);
+  standardArgValidationTests("push:devices:get", import.meta.url, {
+    requiredArgs: ["device-123"],
+  });
+  standardFlagTests("push:devices:get", import.meta.url, ["--json"]);
+
+  describe("functionality", () => {
+    it("should get device details with redacted token", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.get.mockResolvedValue({
+        id: "device-123",
+        platform: "ios",
+        formFactor: "phone",
+        clientId: "client-1",
+        push: {
+          state: "ACTIVE",
+          recipient: {
+            transportType: "apns",
+            deviceToken: "abcdef1234567890",
+          },
+        },
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:get", "device-123"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("device-123");
+      expect(stdout).toContain("ios");
+      expect(stdout).toContain("ACTIVE");
+      expect(stdout).toContain("abcd...7890 (redacted)");
+      expect(stdout).not.toContain("abcdef1234567890");
+    });
+
+    it("should output JSON when requested", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.get.mockResolvedValue({
+        id: "device-123",
+        platform: "ios",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:get", "device-123", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("device");
+    });
+
+    it("should call SDK with correct device ID", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.get.mockResolvedValue({
+        id: "device-123",
+      });
+
+      await runCommand(["push:devices:get", "device-123"], import.meta.url);
+
+      expect(mock.push.admin.deviceRegistrations.get).toHaveBeenCalledWith(
+        "device-123",
+      );
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.get.mockRejectedValue(
+        new Error("Device not found"),
+      );
+
+      const { error } = await runCommand(
+        ["push:devices:get", "device-123"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/list.test.ts b/test/unit/commands/push/devices/list.test.ts
new file mode 100644
index 00000000..8561c829
--- /dev/null
+++ b/test/unit/commands/push/devices/list.test.ts
@@ -0,0 +1,128 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:devices:list command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:devices:list", import.meta.url);
+  standardArgValidationTests("push:devices:list", import.meta.url);
+  standardFlagTests("push:devices:list", import.meta.url, [
+    "--json",
+    "--device-id",
+    "--client-id",
+    "--state",
+    "--limit",
+  ]);
+
+  describe("functionality", () => {
+    it("should list devices successfully", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [
+          {
+            id: "device-1",
+            platform: "ios",
+            formFactor: "phone",
+            clientId: "client-1",
+            push: {
+              state: "ACTIVE",
+              recipient: { transportType: "apns" },
+            },
+          },
+        ],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:list"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("device-1");
+      expect(stdout).toContain("ios");
+      expect(stdout).toContain("ACTIVE");
+    });
+
+    it("should handle empty list", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:list"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("No device registrations found");
+    });
+
+    it("should output JSON when requested", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [{ id: "device-1", platform: "ios" }],
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:list", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("devices");
+    });
+
+    it("should pass filter params to SDK", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [],
+      });
+
+      await runCommand(
+        [
+          "push:devices:list",
+          "--device-id",
+          "dev-1",
+          "--client-id",
+          "cli-1",
+          "--state",
+          "ACTIVE",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.list).toHaveBeenCalledWith(
+        expect.objectContaining({
+          deviceId: "dev-1",
+          clientId: "cli-1",
+          state: "ACTIVE",
+        }),
+      );
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockRejectedValue(
+        new Error("API error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:devices:list"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/remove-where.test.ts b/test/unit/commands/push/devices/remove-where.test.ts
new file mode 100644
index 00000000..440676fc
--- /dev/null
+++ b/test/unit/commands/push/devices/remove-where.test.ts
@@ -0,0 +1,82 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:devices:remove-where command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:devices:remove-where", import.meta.url);
+  standardArgValidationTests("push:devices:remove-where", import.meta.url);
+  standardFlagTests("push:devices:remove-where", import.meta.url, [
+    "--json",
+    "--device-id",
+    "--client-id",
+    "--force",
+  ]);
+
+  describe("functionality", () => {
+    it("should remove devices matching filter with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:remove-where", "--client-id", "client-1", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("removed");
+      expect(
+        mock.push.admin.deviceRegistrations.removeWhere,
+      ).toHaveBeenCalledWith(expect.objectContaining({ clientId: "client-1" }));
+    });
+
+    it("should require at least one filter", async () => {
+      const { error } = await runCommand(
+        ["push:devices:remove-where", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should output JSON when requested", async () => {
+      const { stdout } = await runCommand(
+        [
+          "push:devices:remove-where",
+          "--device-id",
+          "dev-1",
+          "--force",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("removed", true);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.removeWhere.mockRejectedValue(
+        new Error("Remove failed"),
+      );
+
+      const { error } = await runCommand(
+        ["push:devices:remove-where", "--device-id", "dev-1", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/remove.test.ts b/test/unit/commands/push/devices/remove.test.ts
new file mode 100644
index 00000000..f2b807fa
--- /dev/null
+++ b/test/unit/commands/push/devices/remove.test.ts
@@ -0,0 +1,69 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:devices:remove command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:devices:remove", import.meta.url);
+  standardArgValidationTests("push:devices:remove", import.meta.url, {
+    requiredArgs: ["device-123"],
+  });
+  standardFlagTests("push:devices:remove", import.meta.url, [
+    "--json",
+    "--force",
+  ]);
+
+  describe("functionality", () => {
+    it("should remove a device with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:remove", "device-123", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("device-123");
+      expect(stdout).toContain("removed");
+      expect(mock.push.admin.deviceRegistrations.remove).toHaveBeenCalledWith(
+        "device-123",
+      );
+    });
+
+    it("should output JSON when requested", async () => {
+      const { stdout } = await runCommand(
+        ["push:devices:remove", "device-123", "--force", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("deviceId", "device-123");
+      expect(result).toHaveProperty("removed", true);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.remove.mockRejectedValue(
+        new Error("Remove failed"),
+      );
+
+      const { error } = await runCommand(
+        ["push:devices:remove", "device-123", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/save.test.ts b/test/unit/commands/push/devices/save.test.ts
new file mode 100644
index 00000000..a019a596
--- /dev/null
+++ b/test/unit/commands/push/devices/save.test.ts
@@ -0,0 +1,252 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../../helpers/standard-tests.js";
+
+describe("push:devices:save command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:devices:save", import.meta.url);
+  standardArgValidationTests("push:devices:save", import.meta.url);
+  standardFlagTests("push:devices:save", import.meta.url, [
+    "--json",
+    "--id",
+    "--platform",
+    "--form-factor",
+    "--transport-type",
+    "--device-token",
+    "--target-url",
+    "--p256dh-key",
+    "--auth-secret",
+  ]);
+
+  describe("functionality", () => {
+    it("should save a device with inline flags", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+        id: "device-1",
+        platform: "ios",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "device-1",
+          "--platform",
+          "ios",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "apns",
+          "--device-token",
+          "token123",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Device registration saved");
+      expect(mock.push.admin.deviceRegistrations.save).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: "device-1",
+          platform: "ios",
+          formFactor: "phone",
+        }),
+      );
+    });
+
+    it("should save a device with --data JSON", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+        id: "device-2",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--data",
+          '{"id":"device-2","platform":"android","formFactor":"tablet","push":{"recipient":{"transportType":"fcm","deviceToken":"tok"}}}',
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Device registration saved");
+    });
+
+    it("should output JSON when requested", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+        id: "device-1",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "device-1",
+          "--platform",
+          "ios",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "apns",
+          "--device-token",
+          "token123",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("device");
+    });
+
+    it("should save a web push device with inline flags", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+        id: "browser-1",
+        platform: "browser",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "browser-1",
+          "--platform",
+          "browser",
+          "--form-factor",
+          "desktop",
+          "--transport-type",
+          "web",
+          "--target-url",
+          "https://push.example.com",
+          "--p256dh-key",
+          "BNcRdreALRFX...",
+          "--auth-secret",
+          "tBHItJI5svbpC...",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Device registration saved");
+      expect(mock.push.admin.deviceRegistrations.save).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: "browser-1",
+          platform: "browser",
+          formFactor: "desktop",
+          push: {
+            recipient: {
+              transportType: "web",
+              targetUrl: "https://push.example.com",
+              encryptionKey: "BNcRdreALRFX...",
+              auth: "tBHItJI5svbpC...",
+            },
+          },
+        }),
+      );
+    });
+
+    it("should require web push flags for web transport", async () => {
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "browser-1",
+          "--platform",
+          "browser",
+          "--form-factor",
+          "desktop",
+          "--transport-type",
+          "web",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should require --device-token for apns transport", async () => {
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "device-1",
+          "--platform",
+          "ios",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "apns",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should require --id when not using --data", async () => {
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--platform",
+          "ios",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "apns",
+          "--device-token",
+          "token123",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockRejectedValue(
+        new Error("Save failed"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "device-1",
+          "--platform",
+          "ios",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "apns",
+          "--device-token",
+          "token123",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should handle invalid JSON in --data", async () => {
+      const { error } = await runCommand(
+        ["push:devices:save", "--data", "not-json"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/publish.test.ts b/test/unit/commands/push/publish.test.ts
new file mode 100644
index 00000000..f36e3788
--- /dev/null
+++ b/test/unit/commands/push/publish.test.ts
@@ -0,0 +1,136 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../helpers/mock-ably-rest.js";
+import {
+  standardHelpTests,
+  standardArgValidationTests,
+  standardFlagTests,
+} from "../../../helpers/standard-tests.js";
+
+describe("push:publish command", () => {
+  beforeEach(() => {
+    getMockAblyRest();
+  });
+
+  standardHelpTests("push:publish", import.meta.url);
+  standardArgValidationTests("push:publish", import.meta.url);
+  standardFlagTests("push:publish", import.meta.url, [
+    "--json",
+    "--device-id",
+    "--client-id",
+    "--title",
+    "--body",
+    "--payload",
+  ]);
+
+  describe("functionality", () => {
+    it("should publish to a device", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "dev-1",
+          "--title",
+          "Hello",
+          "--body",
+          "World",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("published");
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { deviceId: "dev-1" },
+        expect.objectContaining({
+          notification: expect.objectContaining({
+            title: "Hello",
+            body: "World",
+          }),
+        }),
+      );
+    });
+
+    it("should publish to a client", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:publish", "--client-id", "client-1", "--title", "Hi"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("published");
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { clientId: "client-1" },
+        expect.objectContaining({
+          notification: expect.objectContaining({ title: "Hi" }),
+        }),
+      );
+    });
+
+    it("should publish with full payload", async () => {
+      const mock = getMockAblyRest();
+      const payload =
+        '{"notification":{"title":"Custom"},"data":{"key":"val"}}';
+
+      const { stdout } = await runCommand(
+        ["push:publish", "--device-id", "dev-1", "--payload", payload],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("published");
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { deviceId: "dev-1" },
+        expect.objectContaining({
+          notification: { title: "Custom" },
+          data: { key: "val" },
+        }),
+      );
+    });
+
+    it("should require a recipient", async () => {
+      const { error } = await runCommand(
+        ["push:publish", "--title", "Hello"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should output JSON when requested", async () => {
+      const { stdout } = await runCommand(
+        ["push:publish", "--device-id", "dev-1", "--title", "Hi", "--json"],
+        import.meta.url,
+      );
+
+      const result = JSON.parse(stdout);
+      expect(result).toHaveProperty("type", "result");
+      expect(result).toHaveProperty("success", true);
+      expect(result).toHaveProperty("published", true);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.publish.mockRejectedValue(new Error("Publish failed"));
+
+      const { error } = await runCommand(
+        ["push:publish", "--device-id", "dev-1", "--title", "Hi"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should handle invalid JSON in --payload", async () => {
+      const { error } = await runCommand(
+        ["push:publish", "--device-id", "dev-1", "--payload", "not-json"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});

From d415eb299e7ef30383b49448c17f0ce2df19f7dd Mon Sep 17 00:00:00 2001
From: umair <umair.hussain@ably.com>
Date: Thu, 12 Mar 2026 23:32:35 +0000
Subject: [PATCH 2/8] Address CodeRabbit review feedback for push commands

- Guard deprecation warning in set-apns-p12 for JSON mode
- Use formatWarning() and formatClientId() in push channels list
- Validate --data flag parses to a JSON object in push devices save
- Validate all JSON flags (--recipient, --payload, --data, --apns, --fcm, --web) parse to objects in push publish
- Let E2E test setup failures propagate instead of silently skipping
---
 src/chat-base-command.ts                      |   1 -
 src/commands/apps/set-apns-p12.ts             |  11 +-
 src/commands/push/channels/list.ts            |   8 +-
 src/commands/push/devices/save.ts             |  17 +-
 src/commands/push/publish.ts                  |  65 ++-
 test/e2e/connections/connections.test.ts      | 437 +++++++++---------
 test/e2e/push/push-config-e2e.test.ts         |  28 +-
 .../push/test-fcm-service-account.json        |   2 +-
 test/unit/commands/push/devices/save.test.ts  |   2 +-
 9 files changed, 316 insertions(+), 255 deletions(-)

diff --git a/src/chat-base-command.ts b/src/chat-base-command.ts
index a4dace6d..177f7bac 100644
--- a/src/chat-base-command.ts
+++ b/src/chat-base-command.ts
@@ -3,7 +3,6 @@ import { ChatClient, Room, RoomStatus } from "@ably/chat";
 import { AblyBaseCommand } from "./base-command.js";
 import { productApiFlags } from "./flags.js";
 import { BaseFlags } from "./types/cli.js";
-import chalk from "chalk";
 
 import {
   formatSuccess,
diff --git a/src/commands/apps/set-apns-p12.ts b/src/commands/apps/set-apns-p12.ts
index d15cf473..c129ed0a 100644
--- a/src/commands/apps/set-apns-p12.ts
+++ b/src/commands/apps/set-apns-p12.ts
@@ -8,6 +8,7 @@ import {
   formatProgress,
   formatResource,
   formatSuccess,
+  formatWarning,
 } from "../../utils/output.js";
 
 export default class AppsSetApnsP12Command extends ControlBaseCommand {
@@ -49,9 +50,13 @@ export default class AppsSetApnsP12Command extends ControlBaseCommand {
   async run(): Promise<void> {
     const { args, flags } = await this.parse(AppsSetApnsP12Command);
 
-    this.warn(
-      'This command is deprecated. Use "ably push config set-apns" instead.',
-    );
+    if (!this.shouldOutputJson(flags)) {
+      this.logToStderr(
+        formatWarning(
+          'This command is deprecated. Use "ably push config set-apns" instead.',
+        ),
+      );
+    }
 
     // Display authentication information
     this.showAuthInfoIfNeeded(flags);
diff --git a/src/commands/push/channels/list.ts b/src/commands/push/channels/list.ts
index 23297130..7b992d14 100644
--- a/src/commands/push/channels/list.ts
+++ b/src/commands/push/channels/list.ts
@@ -4,6 +4,7 @@ import { AblyBaseCommand } from "../../../base-command.js";
 import { productApiFlags } from "../../../flags.js";
 import { BaseFlags } from "../../../types/cli.js";
 import {
+  formatClientId,
   formatCountLabel,
   formatHeading,
   formatLabel,
@@ -11,6 +12,7 @@ import {
   formatProgress,
   formatResource,
   formatSuccess,
+  formatWarning,
 } from "../../../utils/output.js";
 
 export default class PushChannelsList extends AblyBaseCommand {
@@ -71,7 +73,7 @@ export default class PushChannelsList extends AblyBaseCommand {
       }
 
       if (subscriptions.length === 0) {
-        this.log("No subscriptions found.");
+        this.log(formatWarning("No subscriptions found."));
         return;
       }
 
@@ -90,7 +92,9 @@ export default class PushChannelsList extends AblyBaseCommand {
         if (sub.deviceId)
           this.log(`  ${formatLabel("Device ID")} ${sub.deviceId}`);
         if (sub.clientId)
-          this.log(`  ${formatLabel("Client ID")} ${sub.clientId}`);
+          this.log(
+            `  ${formatLabel("Client ID")} ${formatClientId(sub.clientId)}`,
+          );
         this.log("");
       }
 
diff --git a/src/commands/push/devices/save.ts b/src/commands/push/devices/save.ts
index 40cdf589..b971b44e 100644
--- a/src/commands/push/devices/save.ts
+++ b/src/commands/push/devices/save.ts
@@ -153,7 +153,9 @@ export default class PushDevicesSave extends AblyBaseCommand {
           }
           recipient = {
             transportType,
-            deviceToken: flags["device-token"],
+            ...(transportType === "fcm"
+              ? { registrationToken: flags["device-token"] }
+              : { deviceToken: flags["device-token"] }),
           };
         }
 
@@ -225,8 +227,9 @@ export default class PushDevicesSave extends AblyBaseCommand {
       jsonString = fs.readFileSync(filePath, "utf8");
     }
 
+    let parsed: unknown;
     try {
-      return JSON.parse(jsonString) as Record<string, unknown>;
+      parsed = JSON.parse(jsonString);
     } catch {
       this.fail(
         "--data must be valid JSON or a path to a JSON file (prefixed with @)",
@@ -234,5 +237,15 @@ export default class PushDevicesSave extends AblyBaseCommand {
         "pushDeviceSave",
       );
     }
+
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      this.fail(
+        "--data must be a JSON object",
+        flags as BaseFlags,
+        "pushDeviceSave",
+      );
+    }
+
+    return parsed as Record<string, unknown>;
   }
 }
diff --git a/src/commands/push/publish.ts b/src/commands/push/publish.ts
index 94c0ce1d..4479a234 100644
--- a/src/commands/push/publish.ts
+++ b/src/commands/push/publish.ts
@@ -93,10 +93,14 @@ export default class PushPublish extends AblyBaseCommand {
         recipient = { clientId: flags["client-id"] };
       } else {
         try {
-          recipient = JSON.parse(flags.recipient!) as Record<string, unknown>;
+          const parsed = JSON.parse(flags.recipient!);
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("not an object");
+          }
+          recipient = parsed as Record<string, unknown>;
         } catch {
           this.fail(
-            "--recipient must be valid JSON",
+            "--recipient must be a valid JSON object",
             flags as BaseFlags,
             "pushPublish",
           );
@@ -107,10 +111,14 @@ export default class PushPublish extends AblyBaseCommand {
       let payload: Record<string, unknown>;
       if (flags.payload) {
         try {
-          payload = JSON.parse(flags.payload) as Record<string, unknown>;
+          const parsed = JSON.parse(flags.payload);
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("not an object");
+          }
+          payload = parsed as Record<string, unknown>;
         } catch {
           this.fail(
-            "--payload must be valid JSON",
+            "--payload must be a valid JSON object",
             flags as BaseFlags,
             "pushPublish",
           );
@@ -133,10 +141,18 @@ export default class PushPublish extends AblyBaseCommand {
 
         if (flags.data) {
           try {
-            payload.data = JSON.parse(flags.data);
+            const parsed = JSON.parse(flags.data);
+            if (
+              !parsed ||
+              typeof parsed !== "object" ||
+              Array.isArray(parsed)
+            ) {
+              throw new Error("not an object");
+            }
+            payload.data = parsed;
           } catch {
             this.fail(
-              "--data must be valid JSON",
+              "--data must be a valid JSON object",
               flags as BaseFlags,
               "pushPublish",
             );
@@ -144,13 +160,30 @@ export default class PushPublish extends AblyBaseCommand {
         }
       }
 
+      // Validate that at least some payload content exists
+      if (
+        !payload!.notification &&
+        !payload!.data &&
+        Object.keys(payload!).length === 0
+      ) {
+        this.fail(
+          "No push payload provided. Use --payload, --title/--body, or --data to specify notification content",
+          flags as BaseFlags,
+          "pushPublish",
+        );
+      }
+
       // Add platform-specific overrides
       if (flags.apns) {
         try {
-          payload.apns = JSON.parse(flags.apns);
+          const parsed = JSON.parse(flags.apns);
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("not an object");
+          }
+          payload.apns = parsed;
         } catch {
           this.fail(
-            "--apns must be valid JSON",
+            "--apns must be a valid JSON object",
             flags as BaseFlags,
             "pushPublish",
           );
@@ -158,10 +191,14 @@ export default class PushPublish extends AblyBaseCommand {
       }
       if (flags.fcm) {
         try {
-          payload.fcm = JSON.parse(flags.fcm);
+          const parsed = JSON.parse(flags.fcm);
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("not an object");
+          }
+          payload.fcm = parsed;
         } catch {
           this.fail(
-            "--fcm must be valid JSON",
+            "--fcm must be a valid JSON object",
             flags as BaseFlags,
             "pushPublish",
           );
@@ -169,10 +206,14 @@ export default class PushPublish extends AblyBaseCommand {
       }
       if (flags.web) {
         try {
-          payload.web = JSON.parse(flags.web);
+          const parsed = JSON.parse(flags.web);
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("not an object");
+          }
+          payload.web = parsed;
         } catch {
           this.fail(
-            "--web must be valid JSON",
+            "--web must be a valid JSON object",
             flags as BaseFlags,
             "pushPublish",
           );
diff --git a/test/e2e/connections/connections.test.ts b/test/e2e/connections/connections.test.ts
index ee2d2ca8..b50b9540 100644
--- a/test/e2e/connections/connections.test.ts
+++ b/test/e2e/connections/connections.test.ts
@@ -152,250 +152,253 @@ describe("Connections E2E Tests", () => {
     );
   });
 
-  describe("Live Connection Monitoring E2E", () => {
-    it(
-      "should monitor live connections with real client lifecycle",
-      { timeout: 180000 },
-      async () => {
-        setupTestFailureHandler(
-          "should monitor live connections with real client lifecycle",
-        );
-
-        const cliPath = join(process.cwd(), "bin", "run.js");
-        const testChannelName = `test-live-connections-${Date.now()}`;
-        const testClientId = `test-client-${Date.now()}`;
-
-        // Step 1: Start live connection log monitoring
-        const monitorEnv = { ...process.env };
-        delete monitorEnv.ABLY_CLI_TEST_MODE;
-        const apiKey = process.env.E2E_ABLY_API_KEY;
-        if (!apiKey) {
-          throw new Error("E2E_ABLY_API_KEY environment variable is required");
-        }
-
-        // Use connection-lifecycle command which uses the correct meta channel
-        const connectionsMonitor = spawn(
-          "node",
-          [cliPath, "logs", "connection-lifecycle", "subscribe", "--json"],
-          {
-            env: { ...monitorEnv, ABLY_API_KEY: apiKey },
-          },
-        );
-
-        let monitorOutput = "";
-        const connectionEvents: Array<{
-          timestamp: number;
-          eventType: string;
-          clientId: string | null;
-          connectionId: string | null;
-        }> = [];
-
-        // Collect output from the live connection monitor
-        let eventCount = 0;
-        let jsonBuffer = "";
-        let braceDepth = 0;
-
-        connectionsMonitor.stdout?.on("data", (data) => {
-          const output = data.toString();
-          monitorOutput += output;
-
-          // Handle multi-line JSON output
-          for (const char of output) {
-            jsonBuffer += char;
-            if (char === "{") braceDepth++;
-            if (char === "}") braceDepth--;
-
-            // When we have a complete JSON object
-            if (braceDepth === 0 && jsonBuffer.trim().endsWith("}")) {
-              try {
-                const logEvent = JSON.parse(jsonBuffer.trim());
-                eventCount++;
-                jsonBuffer = ""; // Reset buffer
-
-                // Debug: log first few events to understand structure
-                if (eventCount <= 10 && process.env.ABLY_CLI_TEST_SHOW_OUTPUT) {
-                  console.log(
-                    "[TEST] Received log event:",
-                    JSON.stringify(logEvent, null, 2),
-                  );
-                }
-
-                // Also check if our test client ID appears anywhere in the event
-                const eventStr = JSON.stringify(logEvent);
-                if (eventStr.includes(testClientId)) {
-                  console.log(
-                    `[TEST] Found event containing test client ID: ${eventStr.slice(0, 200)}...`,
-                  );
-                }
-
-                // Check different possible locations for client ID
-                let foundClientId: string | null = null;
+  describe.skipIf(!process.env.E2E_ABLY_API_KEY)(
+    "Live Connection Monitoring E2E",
+    () => {
+      it(
+        "should monitor live connections with real client lifecycle",
+        { timeout: 180000 },
+        async () => {
+          setupTestFailureHandler(
+            "should monitor live connections with real client lifecycle",
+          );
 
-                // Based on actual connection lifecycle events, clientId is in data.transport.requestParams.clientId as an array
-                if (logEvent.data?.transport?.requestParams?.clientId) {
-                  const clientIdArray =
-                    logEvent.data.transport.requestParams.clientId;
-                  foundClientId = Array.isArray(clientIdArray)
-                    ? clientIdArray[0]
-                    : clientIdArray;
-                }
-                // Also check in data.clientId (for backwards compatibility)
-                else if (logEvent.data?.clientId) {
-                  foundClientId = logEvent.data.clientId;
-                }
-                // Check in data.connectionDetails.clientId
-                else if (logEvent.data?.connectionDetails?.clientId) {
-                  foundClientId = logEvent.data.connectionDetails.clientId;
-                }
+          const cliPath = join(process.cwd(), "bin", "run.js");
+          const testChannelName = `test-live-connections-${Date.now()}`;
+          const testClientId = `test-client-${Date.now()}`;
+
+          // Step 1: Start live connection log monitoring
+          const monitorEnv = { ...process.env };
+          delete monitorEnv.ABLY_CLI_TEST_MODE;
+          const apiKey = process.env.E2E_ABLY_API_KEY!;
+
+          // Use connection-lifecycle command which uses the correct meta channel
+          const connectionsMonitor = spawn(
+            "node",
+            [cliPath, "logs", "connection-lifecycle", "subscribe", "--json"],
+            {
+              env: { ...monitorEnv, ABLY_API_KEY: apiKey },
+            },
+          );
 
-                if (foundClientId === testClientId) {
-                  console.log(
-                    `[TEST] Found matching client ID event: ${foundClientId}`,
-                  );
-                  connectionEvents.push({
-                    timestamp: Date.now(),
-                    eventType:
-                      logEvent.event || logEvent.eventType || "connection",
-                    clientId: foundClientId,
-                    connectionId:
-                      logEvent.data?.connectionId ||
-                      logEvent.connectionId ||
-                      null,
-                  });
-                }
-              } catch {
-                // Reset buffer if parsing fails
-                if (jsonBuffer.trim()) {
-                  jsonBuffer = "";
-                  braceDepth = 0;
+          let monitorOutput = "";
+          const connectionEvents: Array<{
+            timestamp: number;
+            eventType: string;
+            clientId: string | null;
+            connectionId: string | null;
+          }> = [];
+
+          // Collect output from the live connection monitor
+          let eventCount = 0;
+          let jsonBuffer = "";
+          let braceDepth = 0;
+
+          connectionsMonitor.stdout?.on("data", (data) => {
+            const output = data.toString();
+            monitorOutput += output;
+
+            // Handle multi-line JSON output
+            for (const char of output) {
+              jsonBuffer += char;
+              if (char === "{") braceDepth++;
+              if (char === "}") braceDepth--;
+
+              // When we have a complete JSON object
+              if (braceDepth === 0 && jsonBuffer.trim().endsWith("}")) {
+                try {
+                  const logEvent = JSON.parse(jsonBuffer.trim());
+                  eventCount++;
+                  jsonBuffer = ""; // Reset buffer
+
+                  // Debug: log first few events to understand structure
+                  if (
+                    eventCount <= 10 &&
+                    process.env.ABLY_CLI_TEST_SHOW_OUTPUT
+                  ) {
+                    console.log(
+                      "[TEST] Received log event:",
+                      JSON.stringify(logEvent, null, 2),
+                    );
+                  }
+
+                  // Also check if our test client ID appears anywhere in the event
+                  const eventStr = JSON.stringify(logEvent);
+                  if (eventStr.includes(testClientId)) {
+                    console.log(
+                      `[TEST] Found event containing test client ID: ${eventStr.slice(0, 200)}...`,
+                    );
+                  }
+
+                  // Check different possible locations for client ID
+                  let foundClientId: string | null = null;
+
+                  // Based on actual connection lifecycle events, clientId is in data.transport.requestParams.clientId as an array
+                  if (logEvent.data?.transport?.requestParams?.clientId) {
+                    const clientIdArray =
+                      logEvent.data.transport.requestParams.clientId;
+                    foundClientId = Array.isArray(clientIdArray)
+                      ? clientIdArray[0]
+                      : clientIdArray;
+                  }
+                  // Also check in data.clientId (for backwards compatibility)
+                  else if (logEvent.data?.clientId) {
+                    foundClientId = logEvent.data.clientId;
+                  }
+                  // Check in data.connectionDetails.clientId
+                  else if (logEvent.data?.connectionDetails?.clientId) {
+                    foundClientId = logEvent.data.connectionDetails.clientId;
+                  }
+
+                  if (foundClientId === testClientId) {
+                    console.log(
+                      `[TEST] Found matching client ID event: ${foundClientId}`,
+                    );
+                    connectionEvents.push({
+                      timestamp: Date.now(),
+                      eventType:
+                        logEvent.event || logEvent.eventType || "connection",
+                      clientId: foundClientId,
+                      connectionId:
+                        logEvent.data?.connectionId ||
+                        logEvent.connectionId ||
+                        null,
+                    });
+                  }
+                } catch {
+                  // Reset buffer if parsing fails
+                  if (jsonBuffer.trim()) {
+                    jsonBuffer = "";
+                    braceDepth = 0;
+                  }
                 }
               }
             }
-          }
-        });
+          });
 
-        // Wait for initial connection monitoring to start and begin receiving events
-        await new Promise((resolve) => setTimeout(resolve, 10000));
+          // Wait for initial connection monitoring to start and begin receiving events
+          await new Promise((resolve) => setTimeout(resolve, 10000));
 
-        console.log(`[TEST] Events received so far: ${eventCount}`);
+          console.log(`[TEST] Events received so far: ${eventCount}`);
 
-        // Step 2: Start a channel subscriber with specific client ID (this will create a new connection)
-        const subEnv = { ...process.env };
-        delete subEnv.ABLY_CLI_TEST_MODE;
-        console.log(
-          `[TEST] Starting channel subscriber with client ID: ${testClientId}`,
-        );
-        const channelSubscriber = spawn(
-          "node",
-          [
-            cliPath,
-            "channels",
-            "subscribe",
-            testChannelName,
-            "--client-id",
-            testClientId,
-          ],
-          {
-            env: { ...subEnv, ABLY_API_KEY: apiKey },
-          },
-        );
+          // Step 2: Start a channel subscriber with specific client ID (this will create a new connection)
+          const subEnv = { ...process.env };
+          delete subEnv.ABLY_CLI_TEST_MODE;
+          console.log(
+            `[TEST] Starting channel subscriber with client ID: ${testClientId}`,
+          );
+          const channelSubscriber = spawn(
+            "node",
+            [
+              cliPath,
+              "channels",
+              "subscribe",
+              testChannelName,
+              "--client-id",
+              testClientId,
+            ],
+            {
+              env: { ...subEnv, ABLY_API_KEY: apiKey },
+            },
+          );
 
-        // Wait longer for the subscriber to establish connection and appear in monitoring
-        await new Promise((resolve) => setTimeout(resolve, 30000));
+          // Wait longer for the subscriber to establish connection and appear in monitoring
+          await new Promise((resolve) => setTimeout(resolve, 30000));
 
-        // Step 3: Close the channel subscriber
-        channelSubscriber.kill("SIGTERM");
+          // Step 3: Close the channel subscriber
+          channelSubscriber.kill("SIGTERM");
 
-        // Wait for the subscriber to fully disconnect
-        await new Promise<void>((resolve) => {
-          channelSubscriber.on("exit", () => resolve());
-          setTimeout(resolve, 5000); // Fallback timeout
-        });
+          // Wait for the subscriber to fully disconnect
+          await new Promise<void>((resolve) => {
+            channelSubscriber.on("exit", () => resolve());
+            setTimeout(resolve, 5000); // Fallback timeout
+          });
 
-        // Step 4: Wait up to 15 seconds for the disconnection event to appear
-        await new Promise((resolve) => setTimeout(resolve, 15000));
+          // Step 4: Wait up to 15 seconds for the disconnection event to appear
+          await new Promise((resolve) => setTimeout(resolve, 15000));
 
-        // Stop the connections monitor
-        connectionsMonitor.kill("SIGTERM");
+          // Stop the connections monitor
+          connectionsMonitor.kill("SIGTERM");
 
-        await new Promise<void>((resolve) => {
-          connectionsMonitor.on("exit", () => resolve());
-          setTimeout(resolve, 5000); // Fallback timeout
-        });
+          await new Promise<void>((resolve) => {
+            connectionsMonitor.on("exit", () => resolve());
+            setTimeout(resolve, 5000); // Fallback timeout
+          });
 
-        // Debug output
-        console.log(`[TEST] Total events received: ${eventCount}`);
-        console.log(
-          `[TEST] Connection events for ${testClientId}: ${connectionEvents.length}`,
-        );
-        if (
-          connectionEvents.length === 0 &&
-          process.env.ABLY_CLI_TEST_SHOW_OUTPUT
-        ) {
+          // Debug output
+          console.log(`[TEST] Total events received: ${eventCount}`);
           console.log(
-            "[TEST] Sample of monitor output:",
-            monitorOutput.slice(0, 1000),
+            `[TEST] Connection events for ${testClientId}: ${connectionEvents.length}`,
           );
-        }
-
-        // Verify we captured connection lifecycle for our specific client
-        expect(connectionEvents.length).toBeGreaterThan(0);
+          if (
+            connectionEvents.length === 0 &&
+            process.env.ABLY_CLI_TEST_SHOW_OUTPUT
+          ) {
+            console.log(
+              "[TEST] Sample of monitor output:",
+              monitorOutput.slice(0, 1000),
+            );
+          }
 
-        // Log captured events for debugging
+          // Verify we captured connection lifecycle for our specific client
+          expect(connectionEvents.length).toBeGreaterThan(0);
 
-        // Verify we got valid JSON output throughout
-        expect(monitorOutput).toContain("connectionId");
+          // Log captured events for debugging
 
-        // The test passes if we detected any connection events for our specific client ID
-        // This proves the live connection monitoring is working end-to-end
-        expect(connectionEvents.some((e) => e.clientId === testClientId)).toBe(
-          true,
-        );
-      },
-    );
+          // Verify we got valid JSON output throughout
+          expect(monitorOutput).toContain("connectionId");
 
-    it(
-      "should handle live connection monitoring gracefully on cleanup",
-      { timeout: 60000 },
-      async () => {
-        setupTestFailureHandler(
-          "should handle live connection monitoring gracefully on cleanup",
-        );
+          // The test passes if we detected any connection events for our specific client ID
+          // This proves the live connection monitoring is working end-to-end
+          expect(
+            connectionEvents.some((e) => e.clientId === testClientId),
+          ).toBe(true);
+        },
+      );
 
-        const cliPath = join(process.cwd(), "bin", "run.js");
+      it(
+        "should handle live connection monitoring gracefully on cleanup",
+        { timeout: 60000 },
+        async () => {
+          setupTestFailureHandler(
+            "should handle live connection monitoring gracefully on cleanup",
+          );
 
-        // Start live connection log monitoring
-        const connectionsMonitor = spawn(
-          "node",
-          [cliPath, "logs", "connection", "subscribe"],
-          {
-            env: {
-              ...process.env,
-              ABLY_CLI_TEST_MODE: "false",
+          const cliPath = join(process.cwd(), "bin", "run.js");
+
+          // Start live connection log monitoring
+          const connectionsMonitor = spawn(
+            "node",
+            [cliPath, "logs", "connection", "subscribe"],
+            {
+              env: {
+                ...process.env,
+                ABLY_CLI_TEST_MODE: "false",
+              },
             },
-          },
-        );
+          );
 
-        connectionsMonitor.stdout?.on("data", () => {
-          // Just consume the output
-        });
+          connectionsMonitor.stdout?.on("data", () => {
+            // Just consume the output
+          });
 
-        // Wait for some output
-        await new Promise((resolve) => setTimeout(resolve, 8000));
+          // Wait for some output
+          await new Promise((resolve) => setTimeout(resolve, 8000));
 
-        // Gracefully terminate
-        connectionsMonitor.kill("SIGTERM");
+          // Gracefully terminate
+          connectionsMonitor.kill("SIGTERM");
 
-        await new Promise<void>((resolve) => {
-          const doResolve = () => {
-            expect(true).toBe(true);
-            resolve();
-          };
+          await new Promise<void>((resolve) => {
+            const doResolve = () => {
+              expect(true).toBe(true);
+              resolve();
+            };
 
-          connectionsMonitor.on("exit", () => doResolve());
-          setTimeout(doResolve, 5000); // Fallback timeout
-        });
-      },
-    );
-  });
+            connectionsMonitor.on("exit", () => doResolve());
+            setTimeout(doResolve, 5000); // Fallback timeout
+          });
+        },
+      );
+    },
+  );
 });
diff --git a/test/e2e/push/push-config-e2e.test.ts b/test/e2e/push/push-config-e2e.test.ts
index 5fa9bb78..a360e9e3 100644
--- a/test/e2e/push/push-config-e2e.test.ts
+++ b/test/e2e/push/push-config-e2e.test.ts
@@ -41,23 +41,19 @@ describe("Push Config E2E Tests", () => {
       logErrors: false,
     });
 
-    try {
-      // Create a dedicated test app for push config tests
-      const appName = `E2E Push Config Test ${Date.now()}`;
-      const createResult = await runCommand(
-        ["apps", "create", "--name", appName, "--json"],
-        {
-          env: { ABLY_ACCESS_TOKEN: accessToken },
-        },
-      );
+    // Create a dedicated test app for push config tests
+    // Let setup failures propagate — only missing credentials should skip
+    const appName = `E2E Push Config Test ${Date.now()}`;
+    const createResult = await runCommand(
+      ["apps", "create", "--name", appName, "--json"],
+      {
+        env: { ABLY_ACCESS_TOKEN: accessToken },
+      },
+    );
 
-      const result = JSON.parse(createResult.stdout);
-      testAppId = result.app.id;
-      console.log(`Created test app for push config: ${testAppId}`);
-    } catch (error) {
-      console.error("Failed to create test app:", error);
-      shouldSkip = true;
-    }
+    const result = JSON.parse(createResult.stdout);
+    testAppId = result.app.id;
+    console.log(`Created test app for push config: ${testAppId}`);
   });
 
   afterAll(async () => {
diff --git a/test/fixtures/push/test-fcm-service-account.json b/test/fixtures/push/test-fcm-service-account.json
index 76131da4..d35a78dd 100644
--- a/test/fixtures/push/test-fcm-service-account.json
+++ b/test/fixtures/push/test-fcm-service-account.json
@@ -2,7 +2,7 @@
   "type": "service_account",
   "project_id": "test-project-id",
   "private_key_id": "test-key-id",
-  "private_key": "-----BEGIN RSA PRIVATE KEY-----\nFAKE+KEY+FOR+TESTING\n-----END RSA PRIVATE KEY-----\n",
+  "private_key": "fake-key-for-testing",
   "client_email": "test@test-project-id.iam.gserviceaccount.com",
   "client_id": "123456789",
   "auth_uri": "https://accounts.google.com/o/oauth2/auth",
diff --git a/test/unit/commands/push/devices/save.test.ts b/test/unit/commands/push/devices/save.test.ts
index a019a596..7ed3bd22 100644
--- a/test/unit/commands/push/devices/save.test.ts
+++ b/test/unit/commands/push/devices/save.test.ts
@@ -71,7 +71,7 @@ describe("push:devices:save command", () => {
         [
           "push:devices:save",
           "--data",
-          '{"id":"device-2","platform":"android","formFactor":"tablet","push":{"recipient":{"transportType":"fcm","deviceToken":"tok"}}}',
+          '{"id":"device-2","platform":"android","formFactor":"tablet","push":{"recipient":{"transportType":"fcm","registrationToken":"tok"}}}',
         ],
         import.meta.url,
       );

From 14ce8a3f2e41c27c9ecdcf7de8accf8c32762d16 Mon Sep 17 00:00:00 2001
From: Marat Alekperov <m.alekperov@gmail.com>
Date: Sat, 14 Mar 2026 02:36:42 +0100
Subject: [PATCH 3/8] fix(push): fix payload file path support and
 batch-publish validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three bugs found during manual testing of push publish commands:

1. `push publish --payload <file>` failed with "--payload must be a valid
   JSON object" because the command only accepted inline JSON strings.
   Added file path support: both `@filepath` (curl-style) and bare paths
   starting with `./`, `../`, or `/` are now resolved and read from disk.

2. `push batch-publish --payload <file>` required the undocumented `@`
   prefix (e.g. `@./file.json`). Bare path support added here too,
   consistent with the fix above.

3. `push batch-publish` validator checked `entry.notification` and
   `entry.data` at the top level of each batch item, but the Ably batch
   publish API uses `{recipient, payload: {notification, data}}` — the
   notification content is nested under `payload`. This caused all
   batch-publish calls with correctly-formatted payloads to be rejected
   with "Item at index 0 must have a 'notification' or 'data' field".
   Validator updated to check `entry.payload.notification` /
   `entry.payload.data`. The inline example in the command was also wrong
   (missing `payload` wrapper) and has been corrected.

Tests updated to use the correct `{recipient, payload: {notification}}`
batch item format.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/commands/push/batch-publish.ts            | 23 +++++++++++--
 src/commands/push/publish.ts                  | 32 ++++++++++++++++++-
 test/unit/commands/push/batch-publish.test.ts |  8 ++---
 3 files changed, 55 insertions(+), 8 deletions(-)

diff --git a/src/commands/push/batch-publish.ts b/src/commands/push/batch-publish.ts
index 2326142c..493b3f08 100644
--- a/src/commands/push/batch-publish.ts
+++ b/src/commands/push/batch-publish.ts
@@ -16,7 +16,7 @@ export default class PushBatchPublish extends AblyBaseCommand {
     "Publish push notifications to multiple recipients in a batch";
 
   static override examples = [
-    '<%= config.bin %> <%= command.id %> --payload \'[{"recipient":{"deviceId":"dev1"},"notification":{"title":"Hello"}}]\'',
+    '<%= config.bin %> <%= command.id %> --payload \'[{"recipient":{"deviceId":"dev1"},"payload":{"notification":{"title":"Hello","body":"World"}}}]\'',
     "<%= config.bin %> <%= command.id %> --payload @batch.json",
     "cat batch.json | <%= config.bin %> <%= command.id %> --payload -",
     "<%= config.bin %> <%= command.id %> --payload @batch.json --json",
@@ -52,6 +52,20 @@ export default class PushBatchPublish extends AblyBaseCommand {
           );
         }
         jsonString = fs.readFileSync(filePath, "utf8");
+      } else if (
+        flags.payload.startsWith("/") ||
+        flags.payload.startsWith("./") ||
+        flags.payload.startsWith("../")
+      ) {
+        const filePath = path.resolve(flags.payload);
+        if (!fs.existsSync(filePath)) {
+          this.fail(
+            `File not found: ${filePath}`,
+            flags as BaseFlags,
+            "pushBatchPublish",
+          );
+        }
+        jsonString = fs.readFileSync(filePath, "utf8");
       } else {
         jsonString = flags.payload;
       }
@@ -93,9 +107,12 @@ export default class PushBatchPublish extends AblyBaseCommand {
           );
         }
 
-        if (!entry.notification && !entry.data) {
+        const itemPayload = entry.payload as
+          | Record<string, unknown>
+          | undefined;
+        if (!itemPayload?.notification && !itemPayload?.data) {
           this.fail(
-            `Item at index ${index} must have a "notification" or "data" field`,
+            `Item at index ${index} must have a "payload.notification" or "payload.data" field`,
             flags as BaseFlags,
             "pushBatchPublish",
           );
diff --git a/src/commands/push/publish.ts b/src/commands/push/publish.ts
index 4479a234..7207b5fb 100644
--- a/src/commands/push/publish.ts
+++ b/src/commands/push/publish.ts
@@ -1,4 +1,6 @@
 import { Flags } from "@oclif/core";
+import * as fs from "node:fs";
+import * as path from "node:path";
 
 import { AblyBaseCommand } from "../../base-command.js";
 import { productApiFlags } from "../../flags.js";
@@ -110,8 +112,36 @@ export default class PushPublish extends AblyBaseCommand {
       // Build notification payload
       let payload: Record<string, unknown>;
       if (flags.payload) {
+        let jsonString: string;
+        if (flags.payload.startsWith("@")) {
+          const filePath = path.resolve(flags.payload.slice(1));
+          if (!fs.existsSync(filePath)) {
+            this.fail(
+              `File not found: ${filePath}`,
+              flags as BaseFlags,
+              "pushPublish",
+            );
+          }
+          jsonString = fs.readFileSync(filePath, "utf8");
+        } else if (
+          flags.payload.startsWith("/") ||
+          flags.payload.startsWith("./") ||
+          flags.payload.startsWith("../")
+        ) {
+          const filePath = path.resolve(flags.payload);
+          if (!fs.existsSync(filePath)) {
+            this.fail(
+              `File not found: ${filePath}`,
+              flags as BaseFlags,
+              "pushPublish",
+            );
+          }
+          jsonString = fs.readFileSync(filePath, "utf8");
+        } else {
+          jsonString = flags.payload;
+        }
         try {
-          const parsed = JSON.parse(flags.payload);
+          const parsed = JSON.parse(jsonString);
           if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
             throw new Error("not an object");
           }
diff --git a/test/unit/commands/push/batch-publish.test.ts b/test/unit/commands/push/batch-publish.test.ts
index 7017e5c6..ca75ac0a 100644
--- a/test/unit/commands/push/batch-publish.test.ts
+++ b/test/unit/commands/push/batch-publish.test.ts
@@ -23,7 +23,7 @@ describe("push:batch-publish command", () => {
     it("should batch publish notifications", async () => {
       const mock = getMockAblyRest();
       const payload =
-        '[{"recipient":{"deviceId":"dev-1"},"notification":{"title":"Hello"}}]';
+        '[{"recipient":{"deviceId":"dev-1"},"payload":{"notification":{"title":"Hello"}}}]';
 
       const { stdout } = await runCommand(
         ["push:batch-publish", "--payload", payload],
@@ -43,7 +43,7 @@ describe("push:batch-publish command", () => {
     it("should output JSON when requested", async () => {
       getMockAblyRest();
       const payload =
-        '[{"recipient":{"deviceId":"dev-1"},"notification":{"title":"Hello"}}]';
+        '[{"recipient":{"deviceId":"dev-1"},"payload":{"notification":{"title":"Hello"}}}]';
 
       const { stdout } = await runCommand(
         ["push:batch-publish", "--payload", payload, "--json"],
@@ -98,7 +98,7 @@ describe("push:batch-publish command", () => {
     });
 
     it("should reject items missing notification and data", async () => {
-      const payload = '[{"recipient":{"deviceId":"dev-1"}}]';
+      const payload = '[{"recipient":{"deviceId":"dev-1"},"payload":{}}]';
 
       const { error } = await runCommand(
         ["push:batch-publish", "--payload", payload],
@@ -115,7 +115,7 @@ describe("push:batch-publish command", () => {
       mock.request.mockRejectedValue(new Error("Batch publish failed"));
 
       const payload =
-        '[{"recipient":{"deviceId":"dev-1"},"notification":{"title":"Hello"}}]';
+        '[{"recipient":{"deviceId":"dev-1"},"payload":{"notification":{"title":"Hello"}}}]';
 
       const { error } = await runCommand(
         ["push:batch-publish", "--payload", payload],

From f7d2ef84bd2015179bc20ae1a31a887f38ba7192 Mon Sep 17 00:00:00 2001
From: Marat Alekperov <m.alekperov@gmail.com>
Date: Sat, 14 Mar 2026 03:08:28 +0100
Subject: [PATCH 4/8] fix(push): correct APNs P12 upload endpoint path

The uploadApnsP12 method was calling POST /apps/{appId}/push/certificate
which returns 404. The correct path per the Control API OpenAPI spec is
POST /apps/{appId}/pkcs12.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/services/control-api.ts | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/services/control-api.ts b/src/services/control-api.ts
index 8639ce48..9a2417d3 100644
--- a/src/services/control-api.ts
+++ b/src/services/control-api.ts
@@ -494,11 +494,7 @@ export class ControlApi {
     };
 
     // App ID-specific operations don't need account ID in the path
-    return this.request<{ id: string }>(
-      `/apps/${appId}/push/certificate`,
-      "POST",
-      data,
-    );
+    return this.request<{ id: string }>(`/apps/${appId}/pkcs12`, "POST", data);
   }
 
   private async request<T>(

From 2667d2ee976b7ed0aa104a128d80e6ce80bc49e5 Mon Sep 17 00:00:00 2001
From: Marat Alekperov <m.alekperov@gmail.com>
Date: Sat, 14 Mar 2026 03:42:54 +0100
Subject: [PATCH 5/8] fix(push): fix APNs P12 upload to use multipart/form-data

The uploadApnsP12 method had three bugs found during manual testing:

1. Wrong content type: the method was sending the certificate as
   base64-encoded JSON, but POST /apps/{id}/pkcs12 requires
   multipart/form-data with fields p12File (binary) and p12Pass
   (string), as defined in the Control API OpenAPI spec.

2. Wrong field names: the original code sent { p12Certificate, password,
   useForSandbox } but the API schema defines { p12File, p12Pass } only.
   useForSandbox is not part of the pkcs12 endpoint schema at all.

3. Sandbox flag handling: since useForSandbox cannot be sent to the
   pkcs12 endpoint, uploadApnsP12 now handles it as a follow-up
   PATCH /apps/{id} with { apnsUseSandboxEndpoint } when the flag is set.
   This is the correct endpoint for that field per the app_patch schema.

Updated callers (push config set-apns, apps set-apns-p12) to pass a
Buffer instead of a base64 string.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/commands/push/config/set-apns.ts |  2 +-
 src/services/control-api.ts          | 35 +++++++++++++++++++---------
 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/src/commands/push/config/set-apns.ts b/src/commands/push/config/set-apns.ts
index f595bde6..571daa68 100644
--- a/src/commands/push/config/set-apns.ts
+++ b/src/commands/push/config/set-apns.ts
@@ -84,7 +84,7 @@ export default class PushConfigSetApns extends ControlBaseCommand {
             );
           }
 
-          const certificateData = fs.readFileSync(certPath).toString("base64");
+          const certificateData = fs.readFileSync(certPath);
 
           const result = await controlApi.uploadApnsP12(
             appId,
diff --git a/src/services/control-api.ts b/src/services/control-api.ts
index 9a2417d3..03619995 100644
--- a/src/services/control-api.ts
+++ b/src/services/control-api.ts
@@ -481,20 +481,32 @@ export class ControlApi {
   // Upload Apple Push Notification Service P12 certificate for an app
   async uploadApnsP12(
     appId: string,
-    certificateData: string,
+    certificateData: Buffer | string,
     options: {
       password?: string;
       useForSandbox?: boolean;
     } = {},
-  ): Promise<{ id: string }> {
-    const data = {
-      p12Certificate: certificateData,
-      password: options.password,
-      useForSandbox: options.useForSandbox,
-    };
+  ): Promise<App> {
+    const certBuffer =
+      typeof certificateData === "string"
+        ? Buffer.from(certificateData, "base64")
+        : certificateData;
+    const formData = new FormData();
+    formData.append(
+      "p12File",
+      new Blob([certBuffer], { type: "application/x-pkcs12" }),
+      "certificate.p12",
+    );
+    formData.append("p12Pass", options.password ?? "");
 
-    // App ID-specific operations don't need account ID in the path
-    return this.request<{ id: string }>(`/apps/${appId}/pkcs12`, "POST", data);
+    if (options.useForSandbox !== undefined) {
+      await this.request<App>(`/apps/${appId}/pkcs12`, "POST", formData);
+      return this.updateApp(appId, {
+        apnsUseSandboxEndpoint: options.useForSandbox,
+      });
+    }
+
+    return this.request<App>(`/apps/${appId}/pkcs12`, "POST", formData);
   }
 
   private async request<T>(
@@ -506,18 +518,19 @@ export class ControlApi {
       ? `http://${this.controlHost}/api/v1${path}`
       : `https://${this.controlHost}/v1${path}`;
 
+    const isFormData = body instanceof FormData;
     const options: RequestInit = {
       headers: {
         Accept: "application/json",
         Authorization: `Bearer ${this.accessToken}`,
-        "Content-Type": "application/json",
+        ...(!isFormData && { "Content-Type": "application/json" }),
         "Ably-Agent": `ably-cli/${getCliVersion()}`,
       },
       method,
     };
 
     if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
-      options.body = JSON.stringify(body);
+      options.body = isFormData ? body : JSON.stringify(body);
     }
 
     const response = await fetch(url, options);

From f6e1fd944367381bad5fd180ee97227e2f0f85d5 Mon Sep 17 00:00:00 2001
From: Marat Alekperov <m.alekperov@gmail.com>
Date: Sat, 14 Mar 2026 14:48:51 +0100
Subject: [PATCH 6/8] fix(push): fix uploadApnsP12 triggering spurious PATCH on
 default sandbox flag

The condition `useForSandbox !== undefined` was always true because both
`--use-for-sandbox` (apps:set-apns-p12) and `--sandbox` (push:config:set-apns)
default to `false` rather than `undefined`. This caused every P12 upload to
make an extra PATCH /apps/{id} request even when sandbox mode wasn't requested,
breaking nock intercepts in tests and sending unnecessary API calls in production.

Fix: change condition to truthy check (`if (options.useForSandbox)`) so the
sandbox PATCH is only made when explicitly set to true.

Also add missing nock interceptor for the PATCH in the sandbox test case of
apps:set-apns-p12, and fix nock path from /push/certificate to /pkcs12 in
both test files.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/services/control-api.ts                     |  2 +-
 test/unit/commands/apps/set-apns-p12.test.ts    | 11 ++++++-----
 test/unit/commands/push/config/set-apns.test.ts |  4 ++--
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/services/control-api.ts b/src/services/control-api.ts
index 03619995..844fccd3 100644
--- a/src/services/control-api.ts
+++ b/src/services/control-api.ts
@@ -499,7 +499,7 @@ export class ControlApi {
     );
     formData.append("p12Pass", options.password ?? "");
 
-    if (options.useForSandbox !== undefined) {
+    if (options.useForSandbox) {
       await this.request<App>(`/apps/${appId}/pkcs12`, "POST", formData);
       return this.updateApp(appId, {
         apnsUseSandboxEndpoint: options.useForSandbox,
diff --git a/test/unit/commands/apps/set-apns-p12.test.ts b/test/unit/commands/apps/set-apns-p12.test.ts
index 37e19b8d..6239c4e4 100644
--- a/test/unit/commands/apps/set-apns-p12.test.ts
+++ b/test/unit/commands/apps/set-apns-p12.test.ts
@@ -39,7 +39,7 @@ describe("apps:set-apns-p12 command", () => {
   describe("functionality", () => {
     it("should upload APNS P12 certificate successfully", async () => {
       const appId = getMockConfigManager().getCurrentAppId()!;
-      nockControl().post(`/v1/apps/${appId}/push/certificate`).reply(200, {
+      nockControl().post(`/v1/apps/${appId}/pkcs12`).reply(200, {
         id: "cert-123",
         appId,
       });
@@ -54,7 +54,7 @@ describe("apps:set-apns-p12 command", () => {
 
     it("should upload certificate with password", async () => {
       const appId = getMockConfigManager().getCurrentAppId()!;
-      nockControl().post(`/v1/apps/${appId}/push/certificate`).reply(200, {
+      nockControl().post(`/v1/apps/${appId}/pkcs12`).reply(200, {
         id: "cert-123",
         appId,
       });
@@ -76,10 +76,11 @@ describe("apps:set-apns-p12 command", () => {
 
     it("should upload certificate for sandbox environment", async () => {
       const appId = getMockConfigManager().getCurrentAppId()!;
-      nockControl().post(`/v1/apps/${appId}/push/certificate`).reply(200, {
+      nockControl().post(`/v1/apps/${appId}/pkcs12`).reply(200, {
         id: "cert-123",
         appId,
       });
+      nockControl().patch(`/v1/apps/${appId}`).reply(200, { id: appId });
 
       const { stdout } = await runCommand(
         [
@@ -144,7 +145,7 @@ describe("apps:set-apns-p12 command", () => {
     it("should handle API errors", async () => {
       const appId = getMockConfigManager().getCurrentAppId()!;
       nockControl()
-        .post(`/v1/apps/${appId}/push/certificate`)
+        .post(`/v1/apps/${appId}/pkcs12`)
         .reply(400, { error: "Invalid certificate" });
 
       const { error } = await runCommand(
@@ -159,7 +160,7 @@ describe("apps:set-apns-p12 command", () => {
     it("should handle 401 authentication error", async () => {
       const appId = getMockConfigManager().getCurrentAppId()!;
       nockControl()
-        .post(`/v1/apps/${appId}/push/certificate`)
+        .post(`/v1/apps/${appId}/pkcs12`)
         .reply(401, { error: "Unauthorized" });
 
       const { error } = await runCommand(
diff --git a/test/unit/commands/push/config/set-apns.test.ts b/test/unit/commands/push/config/set-apns.test.ts
index dcbea72a..1506a349 100644
--- a/test/unit/commands/push/config/set-apns.test.ts
+++ b/test/unit/commands/push/config/set-apns.test.ts
@@ -62,7 +62,7 @@ describe("push:config:set-apns command", () => {
 
     it("should upload P12 certificate successfully", async () => {
       nockControl()
-        .post(`/v1/apps/${appId}/push/certificate`)
+        .post(`/v1/apps/${appId}/pkcs12`)
         .reply(200, { id: "cert-123" });
 
       const { stdout } = await runCommand(
@@ -100,7 +100,7 @@ describe("push:config:set-apns command", () => {
 
     it("should output JSON for P12 certificate when requested", async () => {
       nockControl()
-        .post(`/v1/apps/${appId}/push/certificate`)
+        .post(`/v1/apps/${appId}/pkcs12`)
         .reply(200, { id: "cert-123" });
 
       const { stdout } = await runCommand(

From f0f980ac9c766f5923566fe68923e3cc62e1c91b Mon Sep 17 00:00:00 2001
From: Marat Alekperov <m.alekperov@gmail.com>
Date: Sat, 14 Mar 2026 15:00:00 +0100
Subject: [PATCH 7/8] fix(e2e): fix batch-publish e2e tests to use correct
 nested payload format

Ably batch push API requires {recipient, payload: {notification}} not
the flat {recipient, notification} format used in these tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 test/e2e/push/publish-e2e.test.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/e2e/push/publish-e2e.test.ts b/test/e2e/push/publish-e2e.test.ts
index cf53ac5a..27296e31 100644
--- a/test/e2e/push/publish-e2e.test.ts
+++ b/test/e2e/push/publish-e2e.test.ts
@@ -240,11 +240,11 @@ describe.skipIf(SHOULD_SKIP_E2E)("Push Publish E2E Tests", () => {
       const batchPayload = JSON.stringify([
         {
           recipient: { deviceId: testDeviceId },
-          notification: { title: "Batch 1", body: "First" },
+          payload: { notification: { title: "Batch 1", body: "First" } },
         },
         {
           recipient: { deviceId: testDeviceId },
-          notification: { title: "Batch 2", body: "Second" },
+          payload: { notification: { title: "Batch 2", body: "Second" } },
         },
       ]);
 
@@ -264,7 +264,7 @@ describe.skipIf(SHOULD_SKIP_E2E)("Push Publish E2E Tests", () => {
       const batchPayload = JSON.stringify([
         {
           recipient: { deviceId: testDeviceId },
-          notification: { title: "JSON Batch", body: "Test" },
+          payload: { notification: { title: "JSON Batch", body: "Test" } },
         },
       ]);
 

From 045eaddb7c72af249b39e5dcd3b920f92fb62ab1 Mon Sep 17 00:00:00 2001
From: Marat Alekperov <m.alekperov@gmail.com>
Date: Sat, 14 Mar 2026 15:46:27 +0100
Subject: [PATCH 8/8] fix(push): also send fcmProjectId when updating FCM
 service account

The Control API stores fcmProjectId as a separate field from
fcmServiceAccount. Not sending it meant the dashboard kept showing
the old project ID after updating the service account.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/commands/push/config/set-fcm.ts | 1 +
 src/services/control-api.ts         | 1 +
 2 files changed, 2 insertions(+)

diff --git a/src/commands/push/config/set-fcm.ts b/src/commands/push/config/set-fcm.ts
index b9dedf6c..6e03fecd 100644
--- a/src/commands/push/config/set-fcm.ts
+++ b/src/commands/push/config/set-fcm.ts
@@ -82,6 +82,7 @@ export default class PushConfigSetFcm extends ControlBaseCommand {
         }
 
         await controlApi.updateApp(appId, {
+          fcmProjectId: parsed.project_id as string,
           fcmServiceAccount: contents,
         });
 
diff --git a/src/services/control-api.ts b/src/services/control-api.ts
index 844fccd3..0b1fc1ba 100644
--- a/src/services/control-api.ts
+++ b/src/services/control-api.ts
@@ -20,6 +20,7 @@ export interface App {
   apnsUseSandboxEndpoint?: boolean | null;
   apnsUsesSandboxCert?: boolean;
   created: number;
+  fcmProjectId?: string | null;
   fcmServiceAccount?: string | null;
   id: string;
   modified: number;