diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 9e78324c..0b302cc3 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -50,6 +50,32 @@ cat .cursor/rules/AI-Assistance.mdc
 5. **Remove tests without asking** - Always get permission first
 6. **NODE_ENV** - To check if the CLI is in test mode, use the `isTestMode()` helper function.
 7. **`process.exit`** - When creating a command, use `this.exit()` for consistent test mode handling.
+8. **Implement common functionality without searching first** - See "Discover Patterns" below.
+
+## 🔍 Discover Patterns Before Implementing (CRITICAL)
+
+This codebase has 50+ commands with established patterns. **Before implementing ANY common functionality, search for how existing code handles it.**
+
+### Before You Write Code
+
+1. **Find a similar command** - If adding `push foo`, look at `channels foo` or `apps foo` first
+2. **Search for the problem** - Before writing error handling, confirmation prompts, or any reusable logic: `grep -r "keyword" src/`
+3. **Check utilities** - Browse `src/utils/` and `src/base-command.ts` for existing helpers
+
+### Search Examples
+
+| If you need... | Search for... |
+|----------------|---------------|
+| Error handling in JSON mode | `grep -r "Error.*json\|jsonError" src/` |
+| User confirmation prompts | `grep -r "confirm\|prompt" src/utils/` |
+| Common flag patterns | Look at 2-3 similar commands |
+| Test patterns | Look at existing tests in same directory |
+
+### The Rule
+
+**If you're solving a problem that other commands probably solve, spend 2 minutes searching before implementing.** Finding an existing pattern is faster than inventing one and having it rejected in review.
+
+When in doubt: `grep -r "what-you-need" src/` → read how others did it → follow that pattern.
 
 ## ✅ Correct Practices
 
diff --git a/README.md b/README.md
index d97885b3..b3050432 100644
--- a/README.md
+++ b/README.md
@@ -103,12 +103,11 @@ See [MCP Server section](#mcp-server) for more details on how to use the MCP Ser
 * [`ably apps channel-rules update NAMEORID`](#ably-apps-channel-rules-update-nameorid)
 * [`ably apps create`](#ably-apps-create)
 * [`ably apps current`](#ably-apps-current)
-* [`ably apps delete [ID]`](#ably-apps-delete-id)
+* [`ably apps delete [APPID]`](#ably-apps-delete-appid)
 * [`ably apps list`](#ably-apps-list)
 * [`ably apps logs`](#ably-apps-logs)
 * [`ably apps logs history`](#ably-apps-logs-history)
 * [`ably apps logs subscribe`](#ably-apps-logs-subscribe)
-* [`ably apps set-apns-p12 ID`](#ably-apps-set-apns-p12-id)
 * [`ably apps stats [ID]`](#ably-apps-stats-id)
 * [`ably apps switch [APPID]`](#ably-apps-switch-appid)
 * [`ably apps update ID`](#ably-apps-update-id)
@@ -142,6 +141,8 @@ See [MCP Server section](#mcp-server) for more details on how to use the MCP Ser
 * [`ably channels publish CHANNEL MESSAGE`](#ably-channels-publish-channel-message)
 * [`ably channels subscribe CHANNELS`](#ably-channels-subscribe-channels)
 * [`ably config`](#ably-config)
+* [`ably config path`](#ably-config-path)
+* [`ably config show`](#ably-config-show)
 * [`ably connections`](#ably-connections)
 * [`ably connections logs [TOPIC]`](#ably-connections-logs-topic)
 * [`ably connections stats`](#ably-connections-stats)
@@ -149,7 +150,7 @@ See [MCP Server section](#mcp-server) for more details on how to use the MCP Ser
 * [`ably help [COMMANDS]`](#ably-help-commands)
 * [`ably integrations`](#ably-integrations)
 * [`ably integrations create`](#ably-integrations-create)
-* [`ably integrations delete RULEID`](#ably-integrations-delete-ruleid)
+* [`ably integrations delete INTEGRATIONID`](#ably-integrations-delete-integrationid)
 * [`ably integrations get RULEID`](#ably-integrations-get-ruleid)
 * [`ably integrations list`](#ably-integrations-list)
 * [`ably integrations update RULEID`](#ably-integrations-update-ruleid)
@@ -169,9 +170,30 @@ See [MCP Server section](#mcp-server) for more details on how to use the MCP Ser
 * [`ably logs push subscribe`](#ably-logs-push-subscribe)
 * [`ably mcp`](#ably-mcp)
 * [`ably mcp start-server`](#ably-mcp-start-server)
+* [`ably push`](#ably-push)
+* [`ably push batch-publish`](#ably-push-batch-publish)
+* [`ably push channels`](#ably-push-channels)
+* [`ably push channels list`](#ably-push-channels-list)
+* [`ably push channels list-channels`](#ably-push-channels-list-channels)
+* [`ably push channels remove`](#ably-push-channels-remove)
+* [`ably push channels remove-where`](#ably-push-channels-remove-where)
+* [`ably push channels save`](#ably-push-channels-save)
+* [`ably push config`](#ably-push-config)
+* [`ably push config clear-apns`](#ably-push-config-clear-apns)
+* [`ably push config clear-fcm`](#ably-push-config-clear-fcm)
+* [`ably push config set-apns`](#ably-push-config-set-apns)
+* [`ably push config set-fcm`](#ably-push-config-set-fcm)
+* [`ably push config show`](#ably-push-config-show)
+* [`ably push devices`](#ably-push-devices)
+* [`ably push devices get DEVICEID`](#ably-push-devices-get-deviceid)
+* [`ably push devices list`](#ably-push-devices-list)
+* [`ably push devices remove DEVICEID`](#ably-push-devices-remove-deviceid)
+* [`ably push devices remove-where`](#ably-push-devices-remove-where)
+* [`ably push devices save`](#ably-push-devices-save)
+* [`ably push publish`](#ably-push-publish)
 * [`ably queues`](#ably-queues)
 * [`ably queues create`](#ably-queues-create)
-* [`ably queues delete QUEUENAME`](#ably-queues-delete-queuename)
+* [`ably queues delete QUEUEID`](#ably-queues-delete-queueid)
 * [`ably queues list`](#ably-queues-list)
 * [`ably rooms`](#ably-rooms)
 * [`ably rooms list`](#ably-rooms-list)
@@ -182,7 +204,7 @@ See [MCP Server section](#mcp-server) for more details on how to use the MCP Ser
 * [`ably rooms messages reactions send ROOM MESSAGESERIAL REACTION`](#ably-rooms-messages-reactions-send-room-messageserial-reaction)
 * [`ably rooms messages reactions subscribe ROOM`](#ably-rooms-messages-reactions-subscribe-room)
 * [`ably rooms messages send ROOM TEXT`](#ably-rooms-messages-send-room-text)
-* [`ably rooms messages subscribe ROOM`](#ably-rooms-messages-subscribe-room)
+* [`ably rooms messages subscribe ROOMS`](#ably-rooms-messages-subscribe-rooms)
 * [`ably rooms occupancy`](#ably-rooms-occupancy)
 * [`ably rooms occupancy get ROOM`](#ably-rooms-occupancy-get-room)
 * [`ably rooms occupancy subscribe ROOM`](#ably-rooms-occupancy-subscribe-room)
@@ -535,7 +557,6 @@ COMMANDS
   ably apps delete              Delete an app
   ably apps list                List all apps in the current account
   ably apps logs                Stream or retrieve app logs
-  ably apps set-apns-p12        Upload Apple Push Notification Service P12 certificate for an app
   ably apps stats               Get app stats with optional live updates
   ably apps switch              Switch to a different Ably app
   ably apps update              Update an app
@@ -811,17 +832,17 @@ EXAMPLES
 
 _See code: [src/commands/apps/current.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/apps/current.ts)_
 
-## `ably apps delete [ID]`
+## `ably apps delete [APPID]`
 
 Delete an app
 
 ```
 USAGE
-  $ ably apps delete [ID] [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+  $ ably apps delete [APPID] [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
     [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-f] [--app <value>]
 
 ARGUMENTS
-  ID  App ID to delete (uses current app if not specified)
+  APPID  App ID to delete (uses current app if not specified)
 
 FLAGS
   -f, --force                 Skip confirmation prompt
@@ -992,48 +1013,6 @@ EXAMPLES
 
 _See code: [src/commands/apps/logs/subscribe.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/apps/logs/subscribe.ts)_
 
-## `ably apps set-apns-p12 ID`
-
-Upload Apple Push Notification Service P12 certificate for an app
-
-```
-USAGE
-  $ ably apps set-apns-p12 ID --certificate <value> [--access-token <value>] [--api-key <value>] [--client-id <value>]
-    [--env <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--password
-    <value>] [--use-for-sandbox]
-
-ARGUMENTS
-  ID  App ID to set the APNS certificate for
-
-FLAGS
-  -v, --verbose               Output verbose logs
-      --access-token=<value>  Overrides any configured access token used for the Control API
-      --api-key=<value>       Overrides any configured API key used for the product APIs
-      --certificate=<value>   (required) Path to the P12 certificate file
-      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
-                              set no client ID. Not applicable when using token authentication.
-      --endpoint=<value>      Override the endpoint for all product API calls
-      --env=<value>           Override the environment for all product API calls
-      --host=<value>          Override the host endpoint for all product API calls
-      --json                  Output in JSON format
-      --password=<value>      Password for the P12 certificate
-      --pretty-json           Output in colorized JSON format
-      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
-      --use-for-sandbox       Whether to use this certificate for the APNS sandbox environment
-
-DESCRIPTION
-  Upload Apple Push Notification Service P12 certificate for an app
-
-EXAMPLES
-  $ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12
-
-  $ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --password "YOUR_CERTIFICATE_PASSWORD"
-
-  $ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --use-for-sandbox
-```
-
-_See code: [src/commands/apps/set-apns-p12.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/apps/set-apns-p12.ts)_
-
 ## `ably apps stats [ID]`
 
 Get app stats with optional live updates
@@ -1227,7 +1206,7 @@ FLAGS
       --pretty-json           Output in colorized JSON format
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
       --token-only            Output only the token string without any formatting or additional information
-      --ttl=<value>           [default: 3600] Time to live in seconds
+      --ttl=<value>           [default: 3600] Time to live in seconds (default: 3600, 1 hour)
 
 DESCRIPTION
   Creates an Ably Token with capabilities
@@ -1279,7 +1258,7 @@ FLAGS
       --pretty-json           Output in colorized JSON format
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
       --token-only            Output only the token string without any formatting or additional information
-      --ttl=<value>           [default: 3600] Time to live in seconds
+      --ttl=<value>           [default: 3600] Time to live in seconds (default: 3600, 1 hour)
 
 DESCRIPTION
   Creates an Ably JWT token with capabilities
@@ -1772,7 +1751,7 @@ Run a subscriber benchmark test
 ```
 USAGE
   $ ably bench subscriber CHANNEL [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-d <value>]
 
 ARGUMENTS
   CHANNEL  The channel name to subscribe to
@@ -1845,13 +1824,14 @@ ARGUMENTS
   MESSAGE  The message to publish (JSON format or plain text, not needed if using --spec)
 
 FLAGS
-  -e, --encoding=<value>       The encoding for the message
-  -n, --name=<value>           The event name (if not specified in the message JSON)
+  -e, --encoding=<value>       The encoding for the message (not used with --spec)
+  -n, --name=<value>           The event name (if not specified in the message JSON, not used with --spec)
   -v, --verbose                Output verbose logs
       --access-token=<value>   Overrides any configured access token used for the Control API
       --api-key=<value>        Overrides any configured API key used for the product APIs
-      --channels=<value>       Comma-separated list of channel names to publish to
-      --channels-json=<value>  JSON array of channel names to publish to
+      --channels=<value>       Comma-separated list of channel names to publish to (mutually exclusive with
+                               --channels-json and --spec)
+      --channels-json=<value>  JSON array of channel names to publish to (mutually exclusive with --channels and --spec)
       --client-id=<value>      Overrides any default client ID when using API authentication. Use "none" to explicitly
                                set no client ID. Not applicable when using token authentication.
       --endpoint=<value>       Override the endpoint for all product API calls
@@ -1860,7 +1840,7 @@ FLAGS
       --json                   Output in JSON format
       --pretty-json            Output in colorized JSON format
       --spec=<value>           Complete batch spec JSON (either a single BatchSpec object or an array of BatchSpec
-                               objects)
+                               objects). When used, --channels, --channels-json, --name, and --encoding are ignored
       --token=<value>          Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
@@ -1904,14 +1884,14 @@ FLAGS
       --cipher=<value>        Decryption key for encrypted messages (AES-128)
       --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
                               set no client ID. Not applicable when using token authentication.
-      --direction=<option>    [default: backwards] Direction of message retrieval
+      --direction=<option>    [default: backwards] Direction of message retrieval (default: backwards)
                               <options: backwards|forwards>
       --end=<value>           End time for the history query (ISO 8601 format)
       --endpoint=<value>      Override the endpoint for all product API calls
       --env=<value>           Override the environment for all product API calls
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
-      --limit=<value>         [default: 50] Maximum number of messages to retrieve
+      --limit=<value>         [default: 50] Maximum number of messages to retrieve (default: 50)
       --pretty-json           Output in colorized JSON format
       --start=<value>         Start time for the history query (ISO 8601 format)
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
@@ -1955,7 +1935,7 @@ FLAGS
       --env=<value>           Override the environment for all product API calls
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
-      --limit=<value>         [default: 100] Maximum number of channels to return
+      --limit=<value>         [default: 100] Maximum number of channels to return (default: 100)
       --pretty-json           Output in colorized JSON format
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
@@ -2143,7 +2123,8 @@ Enter presence on a channel and listen for presence events
 ```
 USAGE
   $ ably channels presence enter CHANNEL [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-D <value>] [--data <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--data <value>] [-D <value>]
+    [--show-others] [--sequence-numbers]
 
 ARGUMENTS
   CHANNEL  Channel to enter presence on
@@ -2161,6 +2142,8 @@ FLAGS
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
       --pretty-json           Output in colorized JSON format
+      --sequence-numbers      Include sequence numbers in output
+      --show-others           Show other presence events while present (default: false)
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
@@ -2175,6 +2158,8 @@ EXAMPLES
 
   $ ably channels presence enter my-channel --token "YOUR_ABLY_TOKEN"
 
+  $ ably channels presence enter my-channel --show-others
+
   $ ably channels presence enter my-channel --json
 
   $ ably channels presence enter my-channel --pretty-json
@@ -2246,7 +2231,7 @@ ARGUMENTS
   MESSAGE  The message to publish (JSON format or plain text)
 
 FLAGS
-  -c, --count=<value>         [default: 1] Number of messages to publish
+  -c, --count=<value>         [default: 1] Number of messages to publish (default: 1)
   -d, --delay=<value>         [default: 40] Delay between messages in milliseconds (default: 40ms, max 25 msgs/sec)
   -e, --encoding=<value>      The encoding for the message
   -n, --name=<value>          The event name (if not specified in the message JSON)
@@ -2302,7 +2287,7 @@ USAGE
   $ ably channels subscribe CHANNELS... [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
     <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--cipher-algorithm
     <value>] [--cipher-key <value>] [--cipher-key-length <value>] [--cipher-mode <value>] [--delta] [-D <value>]
-    [--rewind <value>]
+    [--rewind <value>] [--sequence-numbers]
 
 ARGUMENTS
   CHANNELS...  Channel name(s) to subscribe to
@@ -2312,10 +2297,10 @@ FLAGS
   -v, --verbose                    Output verbose logs
       --access-token=<value>       Overrides any configured access token used for the Control API
       --api-key=<value>            Overrides any configured API key used for the product APIs
-      --cipher-algorithm=<value>   [default: aes] Encryption algorithm to use
+      --cipher-algorithm=<value>   [default: aes] Encryption algorithm to use (default: aes)
       --cipher-key=<value>         Encryption key for decrypting messages (hex-encoded)
-      --cipher-key-length=<value>  [default: 256] Length of encryption key in bits
-      --cipher-mode=<value>        [default: cbc] Cipher mode to use
+      --cipher-key-length=<value>  [default: 256] Length of encryption key in bits (default: 256)
+      --cipher-mode=<value>        [default: cbc] Cipher mode to use (default: cbc)
       --client-id=<value>          Overrides any default client ID when using API authentication. Use "none" to
                                    explicitly set no client ID. Not applicable when using token authentication.
       --delta                      Enable delta compression for messages
@@ -2324,7 +2309,8 @@ FLAGS
       --host=<value>               Override the host endpoint for all product API calls
       --json                       Output in JSON format
       --pretty-json                Output in colorized JSON format
-      --rewind=<value>             Number of messages to rewind when subscribing
+      --rewind=<value>             Number of messages to rewind when subscribing (default: 0)
+      --sequence-numbers           Include sequence numbers in output
       --token=<value>              Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
@@ -2356,15 +2342,88 @@ _See code: [src/commands/channels/subscribe.ts](https://github.com/ably/ably-cli
 
 ## `ably config`
 
-Open the Ably config file in the default text editor
+Manage Ably CLI configuration
 
 ```
 USAGE
   $ ably config [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-e <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Manage Ably CLI configuration
+
+EXAMPLES
+  $ ably config path
+
+  $ ably config show
+
+COMMANDS
+  ably config path              Print the path to the Ably CLI config file
+  ably config show              Display the contents of the Ably CLI config file
+```
+
+_See code: [src/commands/config/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/config/index.ts)_
+
+## `ably config path`
+
+Print the path to the Ably CLI config file
+
+```
+USAGE
+  $ ably config path [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Print the path to the Ably CLI config file
+
+EXAMPLES
+  $ ably config path
+
+  # Open in your preferred editor:
+
+  code $(ably config path)
+
+  vim $(ably config path)
+```
+
+_See code: [src/commands/config/path.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/config/path.ts)_
+
+## `ably config show`
+
+Display the contents of the Ably CLI config file
+
+```
+USAGE
+  $ ably config show [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
 
 FLAGS
-  -e, --editor=<value>        Text editor to use (defaults to $EDITOR environment variable)
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
@@ -2378,13 +2437,15 @@ FLAGS
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  Open the Ably config file in the default text editor
+  Display the contents of the Ably CLI config file
 
 EXAMPLES
-  $ ably config edit
+  $ ably config show
+
+  $ ably config show --json
 ```
 
-_See code: [src/commands/config.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/config.ts)_
+_See code: [src/commands/config/show.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/config/show.ts)_
 
 ## `ably connections`
 
@@ -2581,10 +2642,10 @@ EXAMPLES
   $ ably integrations create
 
 COMMANDS
-  ably integrations create      Create an integration rule
-  ably integrations delete      Delete an integration rule
+  ably integrations create      Create an integration
+  ably integrations delete      Delete an integration
   ably integrations get         Get an integration rule by ID
-  ably integrations list        List all integration rules
+  ably integrations list        List all integrations
   ably integrations update      Update an integration rule
 ```
 
@@ -2592,7 +2653,7 @@ _See code: [src/commands/integrations/index.ts](https://github.com/ably/ably-cli
 
 ## `ably integrations create`
 
-Create an integration rule
+Create an integration
 
 ```
 USAGE
@@ -2606,7 +2667,7 @@ FLAGS
   -v, --verbose                 Output verbose logs
       --access-token=<value>    Overrides any configured access token used for the Control API
       --api-key=<value>         Overrides any configured API key used for the product APIs
-      --app=<value>             App ID or name to create the integration rule in
+      --app=<value>             App ID or name to create the integration in
       --channel-filter=<value>  Channel filter pattern
       --client-id=<value>       Overrides any default client ID when using API authentication. Use "none" to explicitly
                                 set no client ID. Not applicable when using token authentication.
@@ -2615,19 +2676,19 @@ FLAGS
       --host=<value>            Override the host endpoint for all product API calls
       --json                    Output in JSON format
       --pretty-json             Output in colorized JSON format
-      --request-mode=<option>   [default: single] Request mode for the rule
+      --request-mode=<option>   [default: single] Request mode for the integration (default: single)
                                 <options: single|batch>
-      --rule-type=<option>      (required) Type of integration rule (http, amqp, etc.)
+      --rule-type=<option>      (required) Type of integration (http, amqp, etc.)
                                 <options: http|amqp|kinesis|firehose|pulsar|kafka|azure|azure-functions|mqtt|cloudmqtt>
       --source-type=<option>    (required) The event source type
                                 <options: channel.message|channel.presence|channel.lifecycle|presence.message>
-      --status=<option>         [default: enabled] Initial status of the rule
+      --status=<option>         [default: enabled] Initial status of the integration (default: enabled)
                                 <options: enabled|disabled>
-      --target-url=<value>      Target URL for HTTP rules
+      --target-url=<value>      Target URL for HTTP integrations
       --token=<value>           Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  Create an integration rule
+  Create an integration
 
 EXAMPLES
   $ ably integrations create --rule-type "http" --source-type "channel.message" --target-url "https://example.com/webhook"
@@ -2637,24 +2698,24 @@ EXAMPLES
 
 _See code: [src/commands/integrations/create.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/integrations/create.ts)_
 
-## `ably integrations delete RULEID`
+## `ably integrations delete INTEGRATIONID`
 
-Delete an integration rule
+Delete an integration
 
 ```
 USAGE
-  $ ably integrations delete RULEID [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>] [-f]
+  $ ably integrations delete INTEGRATIONID [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
+    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>] [-f]
 
 ARGUMENTS
-  RULEID  The rule ID to delete
+  INTEGRATIONID  The integration ID to delete
 
 FLAGS
   -f, --force                 Force deletion without confirmation
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
-      --app=<value>           App ID or name to delete the integration rule from
+      --app=<value>           App ID or name to delete the integration from
       --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
                               set no client ID. Not applicable when using token authentication.
       --endpoint=<value>      Override the endpoint for all product API calls
@@ -2665,14 +2726,14 @@ FLAGS
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  Delete an integration rule
+  Delete an integration
 
 EXAMPLES
-  $ ably integrations delete rule123
+  $ ably integrations delete integration123
 
-  $ ably integrations delete rule123 --app "My App"
+  $ ably integrations delete integration123 --app "My App"
 
-  $ ably integrations delete rule123 --force
+  $ ably integrations delete integration123 --force
 ```
 
 _See code: [src/commands/integrations/delete.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/integrations/delete.ts)_
@@ -2718,7 +2779,7 @@ _See code: [src/commands/integrations/get.ts](https://github.com/ably/ably-cli/b
 
 ## `ably integrations list`
 
-List all integration rules
+List all integrations
 
 ```
 USAGE
@@ -2729,7 +2790,7 @@ FLAGS
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
-      --app=<value>           App ID or name to list integration rules for
+      --app=<value>           App ID or name to list integrations for
       --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
                               set no client ID. Not applicable when using token authentication.
       --endpoint=<value>      Override the endpoint for all product API calls
@@ -2740,7 +2801,7 @@ FLAGS
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  List all integration rules
+  List all integrations
 
 EXAMPLES
   $ ably integrations list
@@ -3319,259 +3380,327 @@ EXAMPLES
 
 _See code: [src/commands/mcp/start-server.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/mcp/start-server.ts)_
 
-## `ably queues`
+## `ably push`
 
-Manage Ably Queues
+Manage push notifications, device registrations, and channel subscriptions
 
 ```
 USAGE
-  $ ably queues
+  $ ably push
 
 DESCRIPTION
-  Manage Ably Queues
+  Manage push notifications, device registrations, and channel subscriptions
 
 EXAMPLES
-  $ ably queues list
+  $ ably push devices list
 
-  $ ably queues create --name "my-queue"
+  $ ably push devices save --id my-device --platform android --form-factor phone --transport-type fcm --device-token TOKEN
 
-  $ ably queues delete my-queue
+  $ ably push channels save --channel alerts --device-id my-device
+
+  $ ably push publish --device-id my-device --title "Hello" --body "World"
 
 COMMANDS
-  ably queues create            Create a queue
-  ably queues delete            Delete a queue
-  ably queues list              List all queues
+  ably push batch-publish       Publish push notifications to multiple recipients in a single request (up to 10,000 notifications)
+  ably push channels            Manage push notification channel subscriptions (maps to push.admin.channelSubscriptions)
+  ably push config              Manage push notification configuration (APNs and FCM credentials)
+  ably push devices             Manage push notification device registrations (maps to push.admin.deviceRegistrations)
+  ably push publish             Publish a push notification directly to device(s) or client(s) (maps to push.admin.publish)
 ```
 
-_See code: [src/commands/queues/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/index.ts)_
+_See code: [src/commands/push/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/index.ts)_
 
-## `ably queues create`
+## `ably push batch-publish`
 
-Create a queue
+Publish push notifications to multiple recipients in a single request (up to 10,000 notifications)
 
 ```
 USAGE
-  $ ably queues create --name <value> [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
-    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>]
-    [--max-length <value>] [--region <value>] [--ttl <value>]
+  $ ably push batch-publish --payload <value> [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
+    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
 
 FLAGS
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
-      --app=<value>           App ID or name to create the queue in
       --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
                               set no client ID. Not applicable when using token authentication.
       --endpoint=<value>      Override the endpoint for all product API calls
       --env=<value>           Override the environment for all product API calls
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
-      --max-length=<value>    [default: 10000] Maximum number of messages in the queue
-      --name=<value>          (required) Name of the queue
+      --payload=<value>       (required) Batch payload as JSON array, file path, or - for stdin (required)
       --pretty-json           Output in colorized JSON format
-      --region=<value>        [default: us-east-1-a] Region for the queue
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
-      --ttl=<value>           [default: 60] Time to live for messages in seconds
 
 DESCRIPTION
-  Create a queue
+  Publish push notifications to multiple recipients in a single request (up to 10,000 notifications)
 
 EXAMPLES
-  $ ably queues create --name "my-queue"
+  $ ably push batch-publish --payload ./batch-notifications.json
 
-  $ ably queues create --name "my-queue" --ttl 3600 --max-length 100000
+  $ ably push batch-publish --payload '[{"recipient":{"deviceId":"abc"},"payload":{"notification":{"title":"Hi"}}}]'
 
-  $ ably queues create --name "my-queue" --region "eu-west-1-a" --app "My App"
+  $ cat batch.json | ably push batch-publish --payload -
 ```
 
-_See code: [src/commands/queues/create.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/create.ts)_
+_See code: [src/commands/push/batch-publish.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/batch-publish.ts)_
 
-## `ably queues delete QUEUENAME`
+## `ably push channels`
 
-Delete a queue
+Manage push notification channel subscriptions (maps to push.admin.channelSubscriptions)
 
 ```
 USAGE
-  $ ably queues delete QUEUENAME [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>] [-f]
+  $ ably push channels
 
-ARGUMENTS
-  QUEUENAME  Name of the queue to delete
+DESCRIPTION
+  Manage push notification channel subscriptions (maps to push.admin.channelSubscriptions)
+
+EXAMPLES
+  $ ably push channels save --channel alerts --device-id my-device
+
+  $ ably push channels list --channel alerts
+
+  $ ably push channels list-channels
+
+  $ ably push channels remove --channel alerts --device-id my-device
+```
+
+_See code: [src/commands/push/channels/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/channels/index.ts)_
+
+## `ably push channels list`
+
+List push channel subscriptions (maps to push.admin.channelSubscriptions.list)
+
+```
+USAGE
+  $ ably push channels list --channel <value> [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
+    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--device-id <value>]
+    [--limit <value>]
 
 FLAGS
-  -f, --force                 Force deletion without confirmation
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
-      --app=<value>           App ID or name to delete the queue from
-      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
-                              set no client ID. Not applicable when using token authentication.
+      --channel=<value>       (required) Channel name to list subscriptions for
+      --client-id=<value>     Filter by client ID
+      --device-id=<value>     Filter by device ID
       --endpoint=<value>      Override the endpoint for all product API calls
       --env=<value>           Override the environment for all product API calls
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
+      --limit=<value>         [default: 100] Maximum number of results (default: 100, max: 1000)
       --pretty-json           Output in colorized JSON format
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  Delete a queue
+  List push channel subscriptions (maps to push.admin.channelSubscriptions.list)
 
 EXAMPLES
-  $ ably queues delete my-queue
+  $ ably push channels list --channel alerts
+
+  $ ably push channels list --channel alerts --device-id my-device-123
+
+  $ ably push channels list --channel alerts --client-id user-456
 
-  $ ably queues delete my-queue --app "My App"
+  $ ably push channels list --channel alerts --limit 50
 
-  $ ably queues delete my-queue --force
+  $ ably push channels list --channel alerts --json
 ```
 
-_See code: [src/commands/queues/delete.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/delete.ts)_
+_See code: [src/commands/push/channels/list.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/channels/list.ts)_
 
-## `ably queues list`
+## `ably push channels list-channels`
 
-List all queues
+List all channels that have at least one push subscription (maps to push.admin.channelSubscriptions.listChannels)
 
 ```
 USAGE
-  $ ably queues list [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>]
+  $ ably push channels list-channels [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--limit <value>]
 
 FLAGS
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
-      --app=<value>           App ID or name to list queues for
       --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
                               set no client ID. Not applicable when using token authentication.
       --endpoint=<value>      Override the endpoint for all product API calls
       --env=<value>           Override the environment for all product API calls
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
+      --limit=<value>         [default: 100] Maximum number of results (default: 100, max: 1000)
       --pretty-json           Output in colorized JSON format
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  List all queues
+  List all channels that have at least one push subscription (maps to push.admin.channelSubscriptions.listChannels)
 
 EXAMPLES
-  $ ably queues list
+  $ ably push channels list-channels
 
-  $ ably queues list --json
+  $ ably push channels list-channels --limit 50
 
-  $ ably queues list --app "My App" --pretty-json
+  $ ably push channels list-channels --json
 ```
 
-_See code: [src/commands/queues/list.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/list.ts)_
+_See code: [src/commands/push/channels/list-channels.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/channels/list-channels.ts)_
 
-## `ably rooms`
+## `ably push channels remove`
 
-Interact with Ably Chat rooms
+Remove a push channel subscription (maps to push.admin.channelSubscriptions.remove)
 
 ```
 USAGE
-  $ ably rooms
+  $ ably push channels remove --channel <value> [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
+    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--device-id <value>]
+    [-f]
+
+FLAGS
+  -f, --force                 Skip confirmation prompt
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --channel=<value>       (required) Channel to unsubscribe from
+      --client-id=<value>     Client ID to unsubscribe
+      --device-id=<value>     Device ID to unsubscribe
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  Interact with Ably Chat rooms
+  Remove a push channel subscription (maps to push.admin.channelSubscriptions.remove)
 
 EXAMPLES
-  $ ably rooms list
+  $ ably push channels remove --channel alerts --device-id my-device-123
 
-  $ ably rooms messages send my-room "Hello world!"
+  $ ably push channels remove --channel alerts --client-id user-456
 
-  $ ably rooms messages subscribe my-room
+  $ ably push channels remove --channel alerts --device-id my-device-123 --force
 
-COMMANDS
-  ably rooms list               List active chat rooms
-  ably rooms messages           Commands for working with chat messages in rooms
-  ably rooms occupancy          Commands for monitoring room occupancy
-  ably rooms presence           Manage presence on Ably chat rooms
-  ably rooms reactions          Manage reactions in Ably chat rooms
-  ably rooms typing             Commands for working with typing indicators in chat rooms
+  $ ably push channels remove --channel alerts --device-id my-device-123 --json
 ```
 
-_See code: [src/commands/rooms/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/index.ts)_
+_See code: [src/commands/push/channels/remove.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/channels/remove.ts)_
 
-## `ably rooms list`
+## `ably push channels remove-where`
 
-List active chat rooms
+Remove push channel subscriptions matching filter criteria (maps to push.admin.channelSubscriptions.removeWhere)
 
 ```
 USAGE
-  $ ably rooms list [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--limit <value>] [-p <value>]
+  $ ably push channels remove-where --channel <value> [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
+    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--device-id <value>]
+    [-f]
 
 FLAGS
-  -p, --prefix=<value>        Filter rooms by prefix
+  -f, --force                 Skip confirmation prompt
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
-      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
-                              set no client ID. Not applicable when using token authentication.
+      --channel=<value>       (required) Channel to remove subscriptions from
+      --client-id=<value>     Filter by client ID
+      --device-id=<value>     Filter by device ID
       --endpoint=<value>      Override the endpoint for all product API calls
       --env=<value>           Override the environment for all product API calls
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
-      --limit=<value>         [default: 100] Maximum number of rooms to return
       --pretty-json           Output in colorized JSON format
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  List active chat rooms
+  Remove push channel subscriptions matching filter criteria (maps to push.admin.channelSubscriptions.removeWhere)
 
 EXAMPLES
-  $ ably rooms list
+  $ ably push channels remove-where --channel alerts --device-id my-device-123 --force
 
-  $ ably rooms list --prefix my-room
+  $ ably push channels remove-where --channel alerts --client-id user-456 --force
 
-  $ ably rooms list --limit 50
+  $ ably push channels remove-where --channel alerts --device-id my-device-123 --json --force
+```
 
-  $ ably rooms list --json
+_See code: [src/commands/push/channels/remove-where.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/channels/remove-where.ts)_
+
+## `ably push channels save`
+
+Subscribe a device or client to a push-enabled channel (maps to push.admin.channelSubscriptions.save)
 
-  $ ably rooms list --pretty-json
 ```
+USAGE
+  $ ably push channels save --channel <value> [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
+    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--device-id <value>]
 
-_See code: [src/commands/rooms/list.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/list.ts)_
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --channel=<value>       (required) Channel name to subscribe to
+      --client-id=<value>     Client ID to subscribe (subscribes all of the client's devices)
+      --device-id=<value>     Device ID to subscribe
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
-## `ably rooms messages`
+DESCRIPTION
+  Subscribe a device or client to a push-enabled channel (maps to push.admin.channelSubscriptions.save)
 
-Commands for working with chat messages in rooms
+EXAMPLES
+  $ ably push channels save --channel alerts --device-id my-device-123
+
+  $ ably push channels save --channel notifications --client-id user-456
+
+  $ ably push channels save --channel alerts --device-id my-device-123 --json
+```
+
+_See code: [src/commands/push/channels/save.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/channels/save.ts)_
+
+## `ably push config`
+
+Manage push notification configuration (APNs and FCM credentials)
 
 ```
 USAGE
-  $ ably rooms messages
+  $ ably push config
 
 DESCRIPTION
-  Commands for working with chat messages in rooms
+  Manage push notification configuration (APNs and FCM credentials)
 
 EXAMPLES
-  $ ably rooms messages send my-room "Hello world!"
+  $ ably push config show
 
-  $ ably rooms messages subscribe my-room
+  $ ably push config set-apns --certificate ./cert.p12 --password SECRET
 
-  $ ably rooms messages history my-room
+  $ ably push config set-fcm --service-account ./firebase-sa.json
 
-  $ ably rooms messages reactions add my-room "message-id" "👍"
+  $ ably push config clear-apns --force
+
+  $ ably push config clear-fcm --force
 ```
 
-_See code: [src/commands/rooms/messages/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/messages/index.ts)_
+_See code: [src/commands/push/config/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/config/index.ts)_
 
-## `ably rooms messages history ROOM`
+## `ably push config clear-apns`
 
-Get historical messages from an Ably Chat room
+Remove APNs (Apple Push Notification service) configuration from an app
 
 ```
 USAGE
-  $ ably rooms messages history ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-l <value>] [--show-metadata]
-
-ARGUMENTS
-  ROOM  The room to get message history from
+  $ ably push config clear-apns [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>] [-f]
 
 FLAGS
-  -l, --limit=<value>         [default: 20] Maximum number of messages to retrieve
+  -f, --force                 Skip confirmation prompt
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
+      --app=<value>           App ID or name to clear APNs configuration for
       --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
                               set no client ID. Not applicable when using token authentication.
       --endpoint=<value>      Override the endpoint for all product API calls
@@ -3579,43 +3708,788 @@ FLAGS
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
       --pretty-json           Output in colorized JSON format
-      --show-metadata         Display message metadata if available
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  Get historical messages from an Ably Chat room
+  Remove APNs (Apple Push Notification service) configuration from an app
 
 EXAMPLES
-  $ ably rooms messages history my-room
-
-  $ ably rooms messages history --api-key "YOUR_API_KEY" my-room
-
-  $ ably rooms messages history --limit 50 my-room
+  $ ably push config clear-apns
 
-  $ ably rooms messages history --show-metadata my-room
-
-  $ ably rooms messages history my-room --json
+  $ ably push config clear-apns --app my-app
 
-  $ ably rooms messages history my-room --pretty-json
+  $ ably push config clear-apns --force
 ```
 
-_See code: [src/commands/rooms/messages/history.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/messages/history.ts)_
+_See code: [src/commands/push/config/clear-apns.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/config/clear-apns.ts)_
 
-## `ably rooms messages reactions`
+## `ably push config clear-fcm`
 
-Commands for working with message reactions in chat rooms
+Remove Firebase Cloud Messaging (FCM) configuration from an app.
 
 ```
 USAGE
-  $ ably rooms messages reactions
-
-DESCRIPTION
-  Commands for working with message reactions in chat rooms
-
-EXAMPLES
-  $ ably rooms messages reactions send my-room "message-id" "👍"
+  $ ably push config clear-fcm [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>] [-f]
 
-  $ ably rooms messages reactions subscribe my-room
+FLAGS
+  -f, --force                 Skip confirmation prompt
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --app=<value>           App ID or name to clear FCM configuration for
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Remove Firebase Cloud Messaging (FCM) configuration from an app.
+
+EXAMPLES
+  $ ably push config clear-fcm
+
+  $ ably push config clear-fcm --app my-app
+
+  $ ably push config clear-fcm --force
+```
+
+_See code: [src/commands/push/config/clear-fcm.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/config/clear-fcm.ts)_
+
+## `ably push config set-apns`
+
+Configure Apple Push Notification service (APNs) credentials for an app. Supports both certificate-based (.p12) and token-based (.p8) authentication.
+
+```
+USAGE
+  $ ably push config set-apns [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>] [--certificate
+    <value>] [--password <value>] [--key-file <value>] [--key-id <value>] [--team-id <value>] [--bundle-id <value>]
+    [--use-sandbox]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --app=<value>           App ID or name to configure
+      --bundle-id=<value>     App bundle identifier (token-based auth)
+      --certificate=<value>   Path to .p12 certificate file
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --key-file=<value>      Path to .p8 private key file (token-based auth)
+      --key-id=<value>        Key ID from Apple Developer portal (token-based auth)
+      --password=<value>      Password for the .p12 certificate
+      --pretty-json           Output in colorized JSON format
+      --team-id=<value>       Team ID from Apple Developer portal (token-based auth)
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+      --use-sandbox           Use the APNs sandbox endpoint instead of production. Use this with development
+                              certificates or when testing with sandbox device tokens.
+
+DESCRIPTION
+  Configure Apple Push Notification service (APNs) credentials for an app. Supports both certificate-based (.p12) and
+  token-based (.p8) authentication.
+
+EXAMPLES
+  $ ably push config set-apns --certificate ./cert.p12 --password SECRET
+
+  $ ably push config set-apns --certificate ./cert.p12 --password SECRET --use-sandbox
+
+  $ ably push config set-apns --key-file ./AuthKey.p8 --key-id ABC123 --team-id XYZ789 --bundle-id com.myapp
+
+  $ ably push config set-apns --key-file ./AuthKey.p8 --key-id ABC123 --team-id XYZ789 --bundle-id com.myapp --use-sandbox
+```
+
+_See code: [src/commands/push/config/set-apns.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/config/set-apns.ts)_
+
+## `ably push config set-fcm`
+
+Configure Firebase Cloud Messaging (FCM) credentials for an app using a service account JSON file.
+
+```
+USAGE
+  $ ably push config set-fcm --service-account <value> [--access-token <value>] [--api-key <value>] [--client-id <value>]
+    [--env <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app
+    <value>]
+
+FLAGS
+  -v, --verbose                  Output verbose logs
+      --access-token=<value>     Overrides any configured access token used for the Control API
+      --api-key=<value>          Overrides any configured API key used for the product APIs
+      --app=<value>              App ID or name to configure
+      --client-id=<value>        Overrides any default client ID when using API authentication. Use "none" to explicitly
+                                 set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>         Override the endpoint for all product API calls
+      --env=<value>              Override the environment for all product API calls
+      --host=<value>             Override the host endpoint for all product API calls
+      --json                     Output in JSON format
+      --pretty-json              Output in colorized JSON format
+      --service-account=<value>  (required) Path to Firebase service account JSON file
+      --token=<value>            Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Configure Firebase Cloud Messaging (FCM) credentials for an app using a service account JSON file.
+
+EXAMPLES
+  $ ably push config set-fcm --service-account ./firebase-service-account.json
+
+  $ ably push config set-fcm --app my-app --service-account ./firebase-prod.json
+```
+
+_See code: [src/commands/push/config/set-fcm.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/config/set-fcm.ts)_
+
+## `ably push config show`
+
+Show push notification configuration status for an app
+
+```
+USAGE
+  $ ably push config show [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --app=<value>           App ID or name to show configuration for
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Show push notification configuration status for an app
+
+EXAMPLES
+  $ ably push config show
+
+  $ ably push config show --app my-app
+
+  $ ably push config show --json
+```
+
+_See code: [src/commands/push/config/show.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/config/show.ts)_
+
+## `ably push devices`
+
+Manage push notification device registrations (maps to push.admin.deviceRegistrations)
+
+```
+USAGE
+  $ ably push devices
+
+DESCRIPTION
+  Manage push notification device registrations (maps to push.admin.deviceRegistrations)
+
+EXAMPLES
+  $ ably push devices list
+
+  $ ably push devices list --client-id user-123
+
+  $ ably push devices get DEVICE_ID
+
+  $ ably push devices save --id my-device --platform android --form-factor phone --transport-type fcm --device-token TOKEN
+
+  $ ably push devices remove DEVICE_ID
+
+  $ ably push devices remove-where --client-id user-123
+```
+
+_See code: [src/commands/push/devices/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/devices/index.ts)_
+
+## `ably push devices get DEVICEID`
+
+Get details of a registered push notification device (maps to push.admin.deviceRegistrations.get)
+
+```
+USAGE
+  $ ably push devices get DEVICEID [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
+
+ARGUMENTS
+  DEVICEID  The device ID to retrieve
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Get details of a registered push notification device (maps to push.admin.deviceRegistrations.get)
+
+EXAMPLES
+  $ ably push devices get DEVICE_ID
+
+  $ ably push devices get my-device-123
+
+  $ ably push devices get my-device-123 --json
+```
+
+_See code: [src/commands/push/devices/get.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/devices/get.ts)_
+
+## `ably push devices list`
+
+List registered push notification devices (maps to push.admin.deviceRegistrations.list)
+
+```
+USAGE
+  $ ably push devices list [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--device-id <value>] [--state
+    ACTIVE|FAILING|FAILED] [--limit <value>]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Filter devices by client ID
+      --device-id=<value>     Filter by device ID
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --limit=<value>         [default: 100] Maximum number of devices to return (max: 1000)
+      --pretty-json           Output in colorized JSON format
+      --state=<option>        Filter by device state
+                              <options: ACTIVE|FAILING|FAILED>
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  List registered push notification devices (maps to push.admin.deviceRegistrations.list)
+
+EXAMPLES
+  $ ably push devices list
+
+  $ ably push devices list --client-id user-123
+
+  $ ably push devices list --device-id device-456
+
+  $ ably push devices list --state ACTIVE
+
+  $ ably push devices list --limit 50
+
+  $ ably push devices list --json
+```
+
+_See code: [src/commands/push/devices/list.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/devices/list.ts)_
+
+## `ably push devices remove DEVICEID`
+
+Remove a registered push notification device (maps to push.admin.deviceRegistrations.remove)
+
+```
+USAGE
+  $ ably push devices remove DEVICEID [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-f]
+
+ARGUMENTS
+  DEVICEID  The device ID to remove
+
+FLAGS
+  -f, --force                 Skip confirmation prompt
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Remove a registered push notification device (maps to push.admin.deviceRegistrations.remove)
+
+EXAMPLES
+  $ ably push devices remove DEVICE_ID
+
+  $ ably push devices remove my-device-123
+
+  $ ably push devices remove my-device-123 --force
+
+  $ ably push devices remove my-device-123 --json
+```
+
+_See code: [src/commands/push/devices/remove.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/devices/remove.ts)_
+
+## `ably push devices remove-where`
+
+Remove all devices matching specified criteria (maps to push.admin.deviceRegistrations.removeWhere)
+
+```
+USAGE
+  $ ably push devices remove-where [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--device-id <value>] [-f]
+
+FLAGS
+  -f, --force                 Skip confirmation prompt
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Remove all devices for this client ID
+      --device-id=<value>     Remove device with this ID
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Remove all devices matching specified criteria (maps to push.admin.deviceRegistrations.removeWhere)
+
+EXAMPLES
+  $ ably push devices remove-where --client-id user-123
+
+  $ ably push devices remove-where --device-id device-prefix
+
+  $ ably push devices remove-where --client-id user-123 --force
+```
+
+_See code: [src/commands/push/devices/remove-where.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/devices/remove-where.ts)_
+
+## `ably push devices save`
+
+Register a new device or update an existing device registration (maps to push.admin.deviceRegistrations.save)
+
+```
+USAGE
+  $ ably push devices save [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--id <value>] [--platform
+    android|ios|browser] [--form-factor phone|tablet|desktop|tv|watch|car|embedded|other] [--transport-type
+    fcm|apns|web] [--device-token <value>] [--target-url <value>] [--p256dh-key <value>] [--auth-secret <value>]
+    [--metadata <value>] [--data <value>]
+
+FLAGS
+  -v, --verbose                  Output verbose logs
+      --access-token=<value>     Overrides any configured access token used for the Control API
+      --api-key=<value>          Overrides any configured API key used for the product APIs
+      --auth-secret=<value>      Web push auth secret (from PushSubscription.getKey('auth'), base64 encoded). Required
+                                 for web transport type.
+      --client-id=<value>        Client ID to associate with the device
+      --data=<value>             Full device details as JSON string or path to JSON file
+      --device-token=<value>     Device token for APNs (iOS) or FCM registration token (Android). Not used for web push.
+      --endpoint=<value>         Override the endpoint for all product API calls
+      --env=<value>              Override the environment for all product API calls
+      --form-factor=<option>     Device form factor
+                                 <options: phone|tablet|desktop|tv|watch|car|embedded|other>
+      --host=<value>             Override the host endpoint for all product API calls
+      --id=<value>               Unique device identifier
+      --json                     Output in JSON format
+      --metadata=<value>         Device metadata as JSON string
+      --p256dh-key=<value>       Web push p256dh public key (from PushSubscription.getKey('p256dh'), base64 encoded).
+                                 Required for web transport type.
+      --platform=<option>        Device platform
+                                 <options: android|ios|browser>
+      --pretty-json              Output in colorized JSON format
+      --target-url=<value>       Web push endpoint URL (from PushSubscription.endpoint). Required for web transport
+                                 type.
+      --token=<value>            Authenticate using an Ably Token or JWT Token instead of an API key
+      --transport-type=<option>  Push transport type (fcm for Android, apns for iOS, web for browsers)
+                                 <options: fcm|apns|web>
+
+DESCRIPTION
+  Register a new device or update an existing device registration (maps to push.admin.deviceRegistrations.save)
+
+EXAMPLES
+  $ ably push devices save --id my-device --platform android --form-factor phone --transport-type fcm --device-token FCM_REGISTRATION_TOKEN
+
+  $ ably push devices save --id my-device --platform ios --form-factor phone --transport-type apns --device-token APNS_DEVICE_TOKEN
+
+  $ ably push devices save --id my-device --platform browser --form-factor desktop --transport-type web --target-url https://fcm.googleapis.com/fcm/send/... --p256dh-key BASE64_P256DH_KEY --auth-secret BASE64_AUTH_SECRET
+
+  $ ably push devices save --id my-device --platform android --form-factor phone --transport-type fcm --device-token TOKEN --client-id user-123
+
+  $ ably push devices save --data ./device.json
+
+  $ ably push devices save --data '{"id":"device-1","platform":"android","formFactor":"phone","push":{"recipient":{"transportType":"fcm","registrationToken":"TOKEN"}}}'
+```
+
+_See code: [src/commands/push/devices/save.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/devices/save.ts)_
+
+## `ably push publish`
+
+Publish a push notification directly to device(s) or client(s) (maps to push.admin.publish)
+
+```
+USAGE
+  $ ably push publish [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--device-id <value>] [--title
+    <value>] [--body <value>] [--sound <value>] [--icon <value>] [--badge <value>] [--data <value>] [--payload <value>]
+    [--collapse-key <value>] [--ttl <value>] [--apns <value>] [--fcm <value>] [--web <value>]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --apns=<value>          APNs-specific overrides as JSON
+      --badge=<value>         Badge count (iOS)
+      --body=<value>          Notification body
+      --client-id=<value>     Target client ID (sends to all client's devices)
+      --collapse-key=<value>  Collapse key for notification grouping
+      --data=<value>          Custom data payload as JSON string
+      --device-id=<value>     Target device ID
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --fcm=<value>           FCM-specific overrides as JSON
+      --host=<value>          Override the host endpoint for all product API calls
+      --icon=<value>          Notification icon (Android/Web)
+      --json                  Output in JSON format
+      --payload=<value>       Full notification payload as JSON string or path to JSON file
+      --pretty-json           Output in colorized JSON format
+      --sound=<value>         Notification sound (default, or filename)
+      --title=<value>         Notification title
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+      --ttl=<value>           Time-to-live in seconds
+      --web=<value>           Web Push-specific overrides as JSON
+
+DESCRIPTION
+  Publish a push notification directly to device(s) or client(s) (maps to push.admin.publish)
+
+EXAMPLES
+  $ ably push publish --device-id my-device --title "Hello" --body "World"
+
+  $ ably push publish --client-id user-123 --title "Alert" --body "New message"
+
+  $ ably push publish --device-id my-device --title "Order" --body "Shipped" --data '{"orderId":"123"}'
+
+  $ ably push publish --device-id my-device --title "Messages" --body "3 unread" --badge 3
+
+  $ ably push publish --device-id my-device --payload ./notification.json
+
+  $ ably push publish --device-id my-device --payload '{"notification":{"title":"Hi","body":"Hello"}}'
+```
+
+_See code: [src/commands/push/publish.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/push/publish.ts)_
+
+## `ably queues`
+
+Manage Ably Queues
+
+```
+USAGE
+  $ ably queues
+
+DESCRIPTION
+  Manage Ably Queues
+
+EXAMPLES
+  $ ably queues list
+
+  $ ably queues create --name "my-queue"
+
+  $ ably queues delete my-queue
+
+COMMANDS
+  ably queues create            Create a queue
+  ably queues delete            Delete a queue
+  ably queues list              List all queues
+```
+
+_See code: [src/commands/queues/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/index.ts)_
+
+## `ably queues create`
+
+Create a queue
+
+```
+USAGE
+  $ ably queues create --name <value> [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env
+    <value>] [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>]
+    [--max-length <value>] [--region <value>] [--ttl <value>]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --app=<value>           App ID or name to create the queue in
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --max-length=<value>    [default: 10000] Maximum number of messages in the queue (default: 10000)
+      --name=<value>          (required) Name of the queue
+      --pretty-json           Output in colorized JSON format
+      --region=<value>        [default: us-east-1-a] Region for the queue (default: us-east-1-a)
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+      --ttl=<value>           [default: 60] Time to live for messages in seconds (default: 60)
+
+DESCRIPTION
+  Create a queue
+
+EXAMPLES
+  $ ably queues create --name "my-queue"
+
+  $ ably queues create --name "my-queue" --ttl 3600 --max-length 100000
+
+  $ ably queues create --name "my-queue" --region "eu-west-1-a" --app "My App"
+```
+
+_See code: [src/commands/queues/create.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/create.ts)_
+
+## `ably queues delete QUEUEID`
+
+Delete a queue
+
+```
+USAGE
+  $ ably queues delete QUEUEID [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>] [-f]
+
+ARGUMENTS
+  QUEUEID  ID of the queue to delete
+
+FLAGS
+  -f, --force                 Force deletion without confirmation
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --app=<value>           App ID or name to delete the queue from
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Delete a queue
+
+EXAMPLES
+  $ ably queues delete appAbc:us-east-1-a:foo
+
+  $ ably queues delete appAbc:us-east-1-a:foo --app "My App"
+
+  $ ably queues delete appAbc:us-east-1-a:foo --force
+```
+
+_See code: [src/commands/queues/delete.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/delete.ts)_
+
+## `ably queues list`
+
+List all queues
+
+```
+USAGE
+  $ ably queues list [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--app <value>]
+
+FLAGS
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --app=<value>           App ID or name to list queues for
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  List all queues
+
+EXAMPLES
+  $ ably queues list
+
+  $ ably queues list --json
+
+  $ ably queues list --app "My App" --pretty-json
+```
+
+_See code: [src/commands/queues/list.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/queues/list.ts)_
+
+## `ably rooms`
+
+Interact with Ably Chat rooms
+
+```
+USAGE
+  $ ably rooms
+
+DESCRIPTION
+  Interact with Ably Chat rooms
+
+EXAMPLES
+  $ ably rooms list
+
+  $ ably rooms messages send my-room "Hello world!"
+
+  $ ably rooms messages subscribe my-room
+
+COMMANDS
+  ably rooms list               List active chat rooms
+  ably rooms messages           Commands for working with chat messages in rooms
+  ably rooms occupancy          Commands for monitoring room occupancy
+  ably rooms presence           Manage presence on Ably chat rooms
+  ably rooms reactions          Manage reactions in Ably chat rooms
+  ably rooms typing             Commands for working with typing indicators in chat rooms
+```
+
+_See code: [src/commands/rooms/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/index.ts)_
+
+## `ably rooms list`
+
+List active chat rooms
+
+```
+USAGE
+  $ ably rooms list [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--limit <value>] [-p <value>]
+
+FLAGS
+  -p, --prefix=<value>        Filter rooms by prefix
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --limit=<value>         [default: 100] Maximum number of rooms to return (default: 100)
+      --pretty-json           Output in colorized JSON format
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  List active chat rooms
+
+EXAMPLES
+  $ ably rooms list
+
+  $ ably rooms list --prefix my-room
+
+  $ ably rooms list --limit 50
+
+  $ ably rooms list --json
+
+  $ ably rooms list --pretty-json
+```
+
+_See code: [src/commands/rooms/list.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/list.ts)_
+
+## `ably rooms messages`
+
+Commands for working with chat messages in rooms
+
+```
+USAGE
+  $ ably rooms messages
+
+DESCRIPTION
+  Commands for working with chat messages in rooms
+
+EXAMPLES
+  $ ably rooms messages send my-room "Hello world!"
+
+  $ ably rooms messages subscribe my-room
+
+  $ ably rooms messages history my-room
+
+  $ ably rooms messages reactions add my-room "message-id" "👍"
+```
+
+_See code: [src/commands/rooms/messages/index.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/messages/index.ts)_
+
+## `ably rooms messages history ROOM`
+
+Get historical messages from an Ably Chat room
+
+```
+USAGE
+  $ ably rooms messages history ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--end <value>] [-l <value>]
+    [--order oldestFirst|newestFirst] [--show-metadata] [--start <value>]
+
+ARGUMENTS
+  ROOM  The room to get message history from
+
+FLAGS
+  -l, --limit=<value>         [default: 50] Maximum number of messages to retrieve (default: 50)
+  -v, --verbose               Output verbose logs
+      --access-token=<value>  Overrides any configured access token used for the Control API
+      --api-key=<value>       Overrides any configured API key used for the product APIs
+      --client-id=<value>     Overrides any default client ID when using API authentication. Use "none" to explicitly
+                              set no client ID. Not applicable when using token authentication.
+      --end=<value>           End time for the history query (ISO 8601 format)
+      --endpoint=<value>      Override the endpoint for all product API calls
+      --env=<value>           Override the environment for all product API calls
+      --host=<value>          Override the host endpoint for all product API calls
+      --json                  Output in JSON format
+      --order=<option>        [default: newestFirst] Query direction: oldestFirst or newestFirst (default: newestFirst)
+                              <options: oldestFirst|newestFirst>
+      --pretty-json           Output in colorized JSON format
+      --show-metadata         Display message metadata if available
+      --start=<value>         Start time for the history query (ISO 8601 format)
+      --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
+
+DESCRIPTION
+  Get historical messages from an Ably Chat room
+
+EXAMPLES
+  $ ably rooms messages history my-room
+
+  $ ably rooms messages history --api-key "YOUR_API_KEY" my-room
+
+  $ ably rooms messages history --limit 50 my-room
+
+  $ ably rooms messages history --show-metadata my-room
+
+  $ ably rooms messages history my-room --start "2025-01-01T00:00:00Z"
+
+  $ ably rooms messages history my-room --start "2025-01-01T00:00:00Z" --end "2025-01-02T00:00:00Z"
+
+  $ ably rooms messages history my-room --order newestFirst
+
+  $ ably rooms messages history my-room --json
+
+  $ ably rooms messages history my-room --pretty-json
+```
+
+_See code: [src/commands/rooms/messages/history.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/messages/history.ts)_
+
+## `ably rooms messages reactions`
+
+Commands for working with message reactions in chat rooms
+
+```
+USAGE
+  $ ably rooms messages reactions
+
+DESCRIPTION
+  Commands for working with message reactions in chat rooms
+
+EXAMPLES
+  $ ably rooms messages reactions send my-room "message-id" "👍"
+
+  $ ably rooms messages reactions subscribe my-room
 
   $ ably rooms messages reactions remove my-room "message-id" "👍"
 ```
@@ -3722,12 +4596,13 @@ Subscribe to message reactions in a chat room
 ```
 USAGE
   $ ably rooms messages reactions subscribe ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--raw]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--raw] [-D <value>]
 
 ARGUMENTS
   ROOM  Room to subscribe to message reactions in
 
 FLAGS
+  -D, --duration=<value>      Automatically exit after the given number of seconds (0 = run indefinitely)
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
@@ -3771,7 +4646,7 @@ ARGUMENTS
   TEXT  The message text to send
 
 FLAGS
-  -c, --count=<value>         [default: 1] Number of messages to send
+  -c, --count=<value>         [default: 1] Number of messages to send (default: 1)
   -d, --delay=<value>         [default: 40] Delay between messages in milliseconds (default: 40ms, max 25 msgs/sec)
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
@@ -3807,17 +4682,18 @@ EXAMPLES
 
 _See code: [src/commands/rooms/messages/send.ts](https://github.com/ably/ably-cli/blob/v0.15.0/src/commands/rooms/messages/send.ts)_
 
-## `ably rooms messages subscribe ROOM`
+## `ably rooms messages subscribe ROOMS`
 
-Subscribe to messages in an Ably Chat room
+Subscribe to messages in one or more Ably Chat rooms
 
 ```
 USAGE
-  $ ably rooms messages subscribe ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
+  $ ably rooms messages subscribe ROOMS... [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
     [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--show-metadata] [-D <value>]
+    [--sequence-numbers]
 
 ARGUMENTS
-  ROOM  The room to subscribe to messages from
+  ROOMS...  Room name(s) to subscribe to messages from
 
 FLAGS
   -D, --duration=<value>      Automatically exit after the given number of seconds (0 = run indefinitely)
@@ -3831,15 +4707,18 @@ FLAGS
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
       --pretty-json           Output in colorized JSON format
+      --sequence-numbers      Include sequence numbers in output
       --show-metadata         Display message metadata if available
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
-  Subscribe to messages in an Ably Chat room
+  Subscribe to messages in one or more Ably Chat rooms
 
 EXAMPLES
   $ ably rooms messages subscribe my-room
 
+  $ ably rooms messages subscribe room1 room2 room3
+
   $ ably rooms messages subscribe --api-key "YOUR_API_KEY" my-room
 
   $ ably rooms messages subscribe --show-metadata my-room
@@ -3919,12 +4798,13 @@ Subscribe to real-time occupancy metrics for a room
 ```
 USAGE
   $ ably rooms occupancy subscribe ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-D <value>]
 
 ARGUMENTS
   ROOM  Room to subscribe to occupancy for
 
 FLAGS
+  -D, --duration=<value>      Automatically exit after the given number of seconds (0 = run indefinitely)
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
@@ -3977,7 +4857,7 @@ Enter presence in a chat room and remain present until terminated
 USAGE
   $ ably rooms presence enter ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
     [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [--show-others] [-D <value>]
-    [--data <value>]
+    [--data <value>] [--sequence-numbers]
 
 ARGUMENTS
   ROOM  Room to enter presence on
@@ -3995,7 +4875,8 @@ FLAGS
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
       --pretty-json           Output in colorized JSON format
-      --show-others           Show other presence events while present
+      --sequence-numbers      Include sequence numbers in output
+      --show-others           Show other presence events while present (default: false)
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
 DESCRIPTION
@@ -4006,6 +4887,8 @@ EXAMPLES
 
   $ ably rooms presence enter my-room --data '{"name":"User","status":"active"}'
 
+  $ ably rooms presence enter my-room --show-others
+
   $ ably rooms presence enter my-room --duration 30
 ```
 
@@ -4118,12 +5001,13 @@ Subscribe to reactions in a chat room
 ```
 USAGE
   $ ably rooms reactions subscribe ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-D <value>]
 
 ARGUMENTS
   ROOM  Room to subscribe to reactions in
 
 FLAGS
+  -D, --duration=<value>      Automatically exit after the given number of seconds (0 = run indefinitely)
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
@@ -4218,12 +5102,13 @@ Subscribe to typing indicators in an Ably Chat room
 ```
 USAGE
   $ ably rooms typing subscribe ROOM [--access-token <value>] [--api-key <value>] [--client-id <value>] [--env <value>]
-    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v]
+    [--endpoint <value>] [--host <value>] [--json | --pretty-json] [--token <value>] [-v] [-D <value>]
 
 ARGUMENTS
   ROOM  The room to subscribe to typing indicators from
 
 FLAGS
+  -D, --duration=<value>      Automatically exit after the given number of seconds (0 = run indefinitely)
   -v, --verbose               Output verbose logs
       --access-token=<value>  Overrides any configured access token used for the Control API
       --api-key=<value>       Overrides any configured API key used for the product APIs
@@ -4459,7 +5344,7 @@ FLAGS
       --env=<value>           Override the environment for all product API calls
       --host=<value>          Override the host endpoint for all product API calls
       --json                  Output in JSON format
-      --limit=<value>         [default: 100] Maximum number of spaces to return
+      --limit=<value>         [default: 100] Maximum number of spaces to return (default: 100)
       --pretty-json           Output in colorized JSON format
       --token=<value>         Authenticate using an Ably Token or JWT Token instead of an API key
 
diff --git a/src/commands/apps/index.ts b/src/commands/apps/index.ts
index 651d74ed..d79d4f25 100644
--- a/src/commands/apps/index.ts
+++ b/src/commands/apps/index.ts
@@ -11,7 +11,6 @@ export default class AppsCommand extends BaseTopicCommand {
     "$ ably apps create",
     "$ ably apps update",
     "$ ably apps delete",
-    "$ ably apps set-apns-p12",
     "$ ably apps stats",
     "$ ably apps channel-rules list",
     "$ ably apps switch my-app",
diff --git a/src/commands/apps/set-apns-p12.ts b/src/commands/apps/set-apns-p12.ts
deleted file mode 100644
index 4fc1c15e..00000000
--- a/src/commands/apps/set-apns-p12.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import { Args, Flags } from "@oclif/core";
-import * as fs from "node:fs";
-import * as path from "node:path";
-
-import { ControlBaseCommand } from "../../control-base-command.js";
-
-export default class AppsSetApnsP12Command extends ControlBaseCommand {
-  static args = {
-    id: Args.string({
-      description: "App ID to set the APNS certificate for",
-      required: true,
-    }),
-  };
-
-  static description =
-    "Upload Apple Push Notification Service P12 certificate for an app";
-
-  static examples = [
-    "$ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12",
-    '$ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --password "YOUR_CERTIFICATE_PASSWORD"',
-    "$ ably apps set-apns-p12 app-id --certificate /path/to/certificate.p12 --use-for-sandbox",
-  ];
-
-  static flags = {
-    ...ControlBaseCommand.globalFlags,
-    certificate: Flags.string({
-      description: "Path to the P12 certificate file",
-      required: true,
-    }),
-    password: Flags.string({
-      description: "Password for the P12 certificate",
-    }),
-    "use-for-sandbox": Flags.boolean({
-      default: false,
-      description:
-        "Whether to use this certificate for the APNS sandbox environment",
-    }),
-  };
-
-  async run(): Promise<void> {
-    const { args, flags } = await this.parse(AppsSetApnsP12Command);
-
-    // Display authentication information
-    this.showAuthInfoIfNeeded(flags);
-
-    const controlApi = this.createControlApi(flags);
-
-    try {
-      // Validate certificate file exists
-      const certificatePath = path.resolve(flags.certificate);
-      if (!fs.existsSync(certificatePath)) {
-        this.error(`Certificate file not found: ${certificatePath}`);
-        return;
-      }
-
-      this.log(`Uploading APNS P12 certificate for app ${args.id}...`);
-
-      // Read certificate file and encode as base64
-      const certificateData = fs
-        .readFileSync(certificatePath)
-        .toString("base64");
-
-      const result = await controlApi.uploadApnsP12(args.id, certificateData, {
-        password: flags.password,
-        useForSandbox: flags["use-for-sandbox"],
-      });
-
-      if (this.shouldOutputJson(flags)) {
-        this.log(this.formatJsonOutput(result, flags));
-      } else {
-        this.log(`\nAPNS P12 certificate uploaded successfully!`);
-        this.log(`Certificate ID: ${result.id}`);
-        if (flags["use-for-sandbox"]) {
-          this.log(`Environment: Sandbox`);
-        } else {
-          this.log(`Environment: Production`);
-        }
-      }
-    } catch (error) {
-      this.error(
-        `Error uploading APNS P12 certificate: ${error instanceof Error ? error.message : String(error)}`,
-      );
-    }
-  }
-}
diff --git a/src/commands/push/batch-publish.ts b/src/commands/push/batch-publish.ts
new file mode 100644
index 00000000..5ba917c2
--- /dev/null
+++ b/src/commands/push/batch-publish.ts
@@ -0,0 +1,242 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../base-command.js";
+import chalk from "chalk";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+interface BatchItem {
+  recipient: {
+    deviceId?: string;
+    clientId?: string;
+  };
+  payload: Record<string, unknown>;
+}
+
+export default class PushBatchPublish extends AblyBaseCommand {
+  static override description =
+    "Publish push notifications to multiple recipients in a single request (up to 10,000 notifications)";
+
+  static override examples = [
+    // From JSON file
+    "$ ably push batch-publish --payload ./batch-notifications.json",
+    // From inline JSON
+    '$ ably push batch-publish --payload \'[{"recipient":{"deviceId":"abc"},"payload":{"notification":{"title":"Hi"}}}]\'',
+    // From stdin
+    "$ cat batch.json | ably push batch-publish --payload -",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    payload: Flags.string({
+      description:
+        "Batch payload as JSON array, file path, or - for stdin (required)",
+      required: true,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushBatchPublish);
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Parse batch payload
+      const batchItems = await this.parseBatchPayload(flags.payload);
+
+      // Validate batch items
+      this.validateBatchItems(batchItems);
+
+      if (batchItems.length > 10000) {
+        this.error("Batch size exceeds maximum of 10,000 notifications");
+      }
+
+      if (batchItems.length === 0) {
+        this.error("Batch payload is empty");
+      }
+
+      // Publish batch using REST API directly
+      // The SDK's push.admin.publish doesn't have a batch method,
+      // so we use the REST API directly
+      const response = await rest.request(
+        "POST",
+        "/push/batch/publish",
+        4, // API version
+        {},
+        batchItems,
+        {},
+      );
+
+      // Process response
+      const results = response.items || [];
+      const successful = results.filter(
+        (r: Record<string, unknown>) => !r.error,
+      ).length;
+      const failed = results.filter(
+        (r: Record<string, unknown>) => r.error,
+      ).length;
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              total: batchItems.length,
+              successful,
+              failed,
+              results: results.map((r: Record<string, unknown>, i: number) => ({
+                index: i,
+                success: !r.error,
+                error: r.error,
+              })),
+              success: failed === 0,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(chalk.bold("Batch Push Results\n"));
+        this.log(`${chalk.dim("Total:")}      ${batchItems.length}`);
+        this.log(
+          `${chalk.dim("Successful:")} ${chalk.green(successful.toString())}`,
+        );
+
+        if (failed > 0) {
+          this.log(
+            `${chalk.dim("Failed:")}     ${chalk.red(failed.toString())}`,
+          );
+          this.log("");
+          this.log(chalk.yellow("Failed Notifications:"));
+
+          results.forEach((r: Record<string, unknown>, i: number) => {
+            if (r.error) {
+              const error = r.error as Record<string, unknown>;
+              const recipient = batchItems[i]?.recipient;
+              const recipientStr = recipient?.deviceId
+                ? `deviceId=${recipient.deviceId}`
+                : recipient?.clientId
+                  ? `clientId=${recipient.clientId}`
+                  : "unknown";
+
+              this.log(`  - Recipient: ${recipientStr}`);
+              this.log(
+                `    Error: ${error.message || "Unknown error"} (code: ${error.code || "unknown"})`,
+              );
+            }
+          });
+        } else {
+          this.log("");
+          this.log(chalk.green("All notifications sent successfully!"));
+        }
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(`Error publishing batch notifications: ${errorMessage}`);
+      }
+    }
+  }
+
+  private async parseBatchPayload(payload: string): Promise<BatchItem[]> {
+    let jsonString: string;
+
+    if (payload === "-") {
+      // Read from stdin
+      jsonString = await this.readStdin();
+    } else if (
+      !payload.trim().startsWith("[") &&
+      !payload.trim().startsWith("{")
+    ) {
+      // It's a file path
+      const filePath = path.resolve(payload);
+
+      if (!fs.existsSync(filePath)) {
+        throw new Error(`File not found: ${filePath}`);
+      }
+
+      jsonString = fs.readFileSync(filePath, "utf8");
+    } else {
+      jsonString = payload;
+    }
+
+    try {
+      const parsed = JSON.parse(jsonString);
+
+      // Ensure it's an array
+      if (!Array.isArray(parsed)) {
+        throw new TypeError("Batch payload must be a JSON array");
+      }
+
+      return parsed as BatchItem[];
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        throw new TypeError("Invalid JSON format in batch payload");
+      }
+
+      throw error;
+    }
+  }
+
+  private async readStdin(): Promise<string> {
+    return new Promise((resolve, reject) => {
+      let data = "";
+
+      process.stdin.setEncoding("utf8");
+
+      process.stdin.on("data", (chunk) => {
+        data += chunk;
+      });
+
+      process.stdin.on("end", () => {
+        resolve(data);
+      });
+
+      process.stdin.on("error", (err) => {
+        reject(err);
+      });
+
+      // Set a timeout for stdin reading
+      setTimeout(() => {
+        if (data === "") {
+          reject(new Error("No data received from stdin"));
+        }
+      }, 5000);
+    });
+  }
+
+  private validateBatchItems(items: BatchItem[]): void {
+    items.forEach((item, index) => {
+      if (!item) {
+        throw new Error(`Item ${index}: invalid entry (null or undefined)`);
+      }
+
+      if (!item.recipient) {
+        throw new Error(`Item ${index}: missing 'recipient' field`);
+      }
+
+      if (!item.recipient.deviceId && !item.recipient.clientId) {
+        throw new Error(
+          `Item ${index}: recipient must have either 'deviceId' or 'clientId'`,
+        );
+      }
+
+      if (!item.payload) {
+        throw new Error(`Item ${index}: missing 'payload' field`);
+      }
+    });
+  }
+}
diff --git a/src/commands/push/channels/index.ts b/src/commands/push/channels/index.ts
new file mode 100644
index 00000000..abccb38e
--- /dev/null
+++ b/src/commands/push/channels/index.ts
@@ -0,0 +1,16 @@
+import { BaseTopicCommand } from "../../../base-topic-command.js";
+
+export default class PushChannels extends BaseTopicCommand {
+  protected topicName = "push:channels";
+  protected commandGroup = "push channel subscription";
+
+  static override description =
+    "Manage push notification channel subscriptions (maps to push.admin.channelSubscriptions)";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> save --channel alerts --device-id my-device",
+    "<%= config.bin %> <%= command.id %> list --channel alerts",
+    "<%= config.bin %> <%= command.id %> list-channels",
+    "<%= config.bin %> <%= command.id %> remove --channel alerts --device-id my-device",
+  ];
+}
diff --git a/src/commands/push/channels/list-channels.ts b/src/commands/push/channels/list-channels.ts
new file mode 100644
index 00000000..62c4c0cd
--- /dev/null
+++ b/src/commands/push/channels/list-channels.ts
@@ -0,0 +1,93 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import chalk from "chalk";
+
+export default class PushChannelsListChannels extends AblyBaseCommand {
+  static override description =
+    "List all channels that have at least one push subscription (maps to push.admin.channelSubscriptions.listChannels)";
+
+  static override examples = [
+    // List all channels with push subscriptions
+    "$ ably push channels list-channels",
+    // With limit
+    "$ ably push channels list-channels --limit 50",
+    // JSON output
+    "$ ably push channels list-channels --json",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    limit: Flags.integer({
+      description: "Maximum number of results (default: 100, max: 1000)",
+      default: 100,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsListChannels);
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // List channels with push subscriptions
+      const result = await rest.push.admin.channelSubscriptions.listChannels({
+        limit: Math.min(flags.limit, 1000),
+      });
+      const channels = result.items;
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              channels: channels,
+              count: channels.length,
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(
+          chalk.bold(
+            `Channels with Push Subscriptions (${channels.length} found)\n`,
+          ),
+        );
+
+        if (channels.length === 0) {
+          this.log(chalk.dim("No channels with push subscriptions found."));
+          return;
+        }
+
+        // Table header
+        this.log(chalk.dim("CHANNEL"));
+        this.log(chalk.dim("-".repeat(50)));
+
+        // List channels
+        for (const channel of channels) {
+          this.log(channel);
+        }
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(`Error listing channels: ${errorMessage}`);
+      }
+    }
+  }
+}
diff --git a/src/commands/push/channels/list.ts b/src/commands/push/channels/list.ts
new file mode 100644
index 00000000..f4a08f8d
--- /dev/null
+++ b/src/commands/push/channels/list.ts
@@ -0,0 +1,127 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import chalk from "chalk";
+
+export default class PushChannelsList extends AblyBaseCommand {
+  static override description =
+    "List push channel subscriptions (maps to push.admin.channelSubscriptions.list)";
+
+  static override examples = [
+    // List all subscriptions for a channel
+    "$ ably push channels list --channel alerts",
+    // Filter by device ID
+    "$ ably push channels list --channel alerts --device-id my-device-123",
+    // Filter by client ID
+    "$ ably push channels list --channel alerts --recipient-client-id user-456",
+    // With limit
+    "$ ably push channels list --channel alerts --limit 50",
+    // JSON output
+    "$ ably push channels list --channel alerts --json",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    channel: Flags.string({
+      description: "Channel name to list subscriptions for",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Filter by device ID",
+    }),
+    "recipient-client-id": Flags.string({
+      description: "Filter by client ID",
+    }),
+    limit: Flags.integer({
+      description: "Maximum number of results (default: 100, max: 1000)",
+      default: 100,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsList);
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Build filter params
+      const params: Record<string, string | number> = {
+        channel: flags.channel,
+        limit: Math.min(flags.limit, 1000),
+      };
+
+      if (flags["device-id"]) {
+        params.deviceId = flags["device-id"];
+      }
+
+      if (flags["recipient-client-id"]) {
+        params.clientId = flags["recipient-client-id"];
+      }
+
+      // List subscriptions
+      const result = await rest.push.admin.channelSubscriptions.list(params);
+      const subscriptions = result.items;
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              subscriptions: subscriptions.map((sub) => ({
+                channel: sub.channel,
+                deviceId: sub.deviceId,
+                clientId: sub.clientId,
+              })),
+              count: subscriptions.length,
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(
+          chalk.bold(
+            `Push Subscriptions for channel "${flags.channel}" (${subscriptions.length} found)\n`,
+          ),
+        );
+
+        if (subscriptions.length === 0) {
+          this.log(chalk.dim("No subscriptions found."));
+          return;
+        }
+
+        // Table header
+        this.log(`${chalk.dim("TYPE".padEnd(12))}${chalk.dim("ID")}`);
+        this.log(chalk.dim("-".repeat(60)));
+
+        // List subscriptions
+        for (const sub of subscriptions) {
+          if (sub.deviceId) {
+            this.log(`${"device".padEnd(12)}${sub.deviceId}`);
+          } else if (sub.clientId) {
+            this.log(`${"client".padEnd(12)}${sub.clientId}`);
+          }
+        }
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(`Error listing subscriptions: ${errorMessage}`);
+      }
+    }
+  }
+}
diff --git a/src/commands/push/channels/remove-where.ts b/src/commands/push/channels/remove-where.ts
new file mode 100644
index 00000000..9bdbf4f6
--- /dev/null
+++ b/src/commands/push/channels/remove-where.ts
@@ -0,0 +1,129 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import chalk from "chalk";
+import { promptForConfirmation } from "../../../utils/prompt-confirmation.js";
+
+export default class PushChannelsRemoveWhere extends AblyBaseCommand {
+  static override description =
+    "Remove push channel subscriptions matching filter criteria (maps to push.admin.channelSubscriptions.removeWhere)";
+
+  static override examples = [
+    // Remove all subscriptions for a device on a channel
+    "$ ably push channels remove-where --channel alerts --device-id my-device-123 --force",
+    // Remove all subscriptions for a client on a channel
+    "$ ably push channels remove-where --channel alerts --recipient-client-id user-456 --force",
+    // JSON output
+    "$ ably push channels remove-where --channel alerts --device-id my-device-123 --json --force",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    channel: Flags.string({
+      description: "Channel to remove subscriptions from",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Filter by device ID",
+    }),
+    "recipient-client-id": Flags.string({
+      description: "Filter by client ID",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsRemoveWhere);
+
+    // Validate that at least one filter is provided
+    if (!flags["device-id"] && !flags["recipient-client-id"]) {
+      this.error(
+        "At least one filter criterion (--device-id or --recipient-client-id) is required to prevent accidentally removing all subscriptions",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Build filter description for confirmation
+      const filters: string[] = [`channel=${flags.channel}`];
+      if (flags["device-id"]) filters.push(`deviceId=${flags["device-id"]}`);
+      if (flags["recipient-client-id"])
+        filters.push(`clientId=${flags["recipient-client-id"]}`);
+      const filterDescription = filters.join(", ");
+
+      // Confirm deletion unless --force is used
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const confirmed = await promptForConfirmation(
+          `Are you sure you want to remove all subscriptions matching: ${chalk.cyan(filterDescription)}?`,
+        );
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      // Build params for removeWhere
+      const params: Record<string, string> = {
+        channel: flags.channel,
+      };
+
+      if (flags["device-id"]) {
+        params.deviceId = flags["device-id"];
+      }
+
+      if (flags["recipient-client-id"]) {
+        params.clientId = flags["recipient-client-id"];
+      }
+
+      // Remove matching subscriptions
+      await rest.push.admin.channelSubscriptions.removeWhere(params);
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              channel: flags.channel,
+              deviceId: flags["device-id"],
+              clientId: flags["recipient-client-id"],
+              removed: true,
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(
+          chalk.green(
+            `Subscriptions removed successfully matching: ${filterDescription}`,
+          ),
+        );
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(`Error removing subscriptions: ${errorMessage}`);
+      }
+    }
+  }
+}
diff --git a/src/commands/push/channels/remove.ts b/src/commands/push/channels/remove.ts
new file mode 100644
index 00000000..cf69d585
--- /dev/null
+++ b/src/commands/push/channels/remove.ts
@@ -0,0 +1,136 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import * as Ably from "ably";
+import chalk from "chalk";
+import { promptForConfirmation } from "../../../utils/prompt-confirmation.js";
+
+export default class PushChannelsRemove extends AblyBaseCommand {
+  static override description =
+    "Remove a push channel subscription (maps to push.admin.channelSubscriptions.remove)";
+
+  static override examples = [
+    // Remove device subscription
+    "$ ably push channels remove --channel alerts --device-id my-device-123",
+    // Remove client subscription
+    "$ ably push channels remove --channel alerts --recipient-client-id user-456",
+    // With force flag
+    "$ ably push channels remove --channel alerts --device-id my-device-123 --force",
+    // JSON output
+    "$ ably push channels remove --channel alerts --device-id my-device-123 --json",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    channel: Flags.string({
+      description: "Channel to unsubscribe from",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Device ID to unsubscribe",
+    }),
+    "recipient-client-id": Flags.string({
+      description: "Client ID to unsubscribe",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsRemove);
+
+    // Validate that either device-id or recipient-client-id is provided
+    if (!flags["device-id"] && !flags["recipient-client-id"]) {
+      this.error(
+        "Either --device-id or --recipient-client-id must be specified",
+      );
+    }
+
+    if (flags["device-id"] && flags["recipient-client-id"]) {
+      this.error(
+        "Only one of --device-id or --recipient-client-id can be specified, not both",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      const subscriberId = flags["device-id"] || flags["recipient-client-id"];
+      const subscriberType = flags["device-id"] ? "device" : "client";
+
+      // Confirm deletion unless --force is used
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const confirmed = await promptForConfirmation(
+          `Are you sure you want to unsubscribe ${subscriberType} ${chalk.cyan(subscriberId)} from channel ${chalk.cyan(flags.channel)}?`,
+        );
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      // Build subscription object for removal
+      const subscription: Ably.PushChannelSubscription = {
+        channel: flags.channel,
+      };
+
+      if (flags["device-id"]) {
+        subscription.deviceId = flags["device-id"];
+      } else if (flags["recipient-client-id"]) {
+        subscription.clientId = flags["recipient-client-id"];
+      }
+
+      // Remove the subscription
+      await rest.push.admin.channelSubscriptions.remove(subscription);
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              channel: flags.channel,
+              deviceId: flags["device-id"],
+              clientId: flags["recipient-client-id"],
+              removed: true,
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(
+          chalk.green(
+            `Subscription removed successfully: ${subscriberType} ${subscriberId} from channel ${flags.channel}`,
+          ),
+        );
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        if (errorCode === 40400) {
+          this.error(`Subscription not found`);
+        } else {
+          this.error(`Error removing subscription: ${errorMessage}`);
+        }
+      }
+    }
+  }
+}
diff --git a/src/commands/push/channels/save.ts b/src/commands/push/channels/save.ts
new file mode 100644
index 00000000..96842b5a
--- /dev/null
+++ b/src/commands/push/channels/save.ts
@@ -0,0 +1,126 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import * as Ably from "ably";
+import chalk from "chalk";
+
+export default class PushChannelsSave extends AblyBaseCommand {
+  static override description =
+    "Subscribe a device or client to a push-enabled channel (maps to push.admin.channelSubscriptions.save)";
+
+  static override examples = [
+    // Subscribe by device ID
+    "$ ably push channels save --channel alerts --device-id my-device-123",
+    // Subscribe by client ID (subscribes all client's devices)
+    "$ ably push channels save --channel notifications --recipient-client-id user-456",
+    // With JSON output
+    "$ ably push channels save --channel alerts --device-id my-device-123 --json",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    channel: Flags.string({
+      description: "Channel name to subscribe to",
+      required: true,
+    }),
+    "device-id": Flags.string({
+      description: "Device ID to subscribe",
+    }),
+    "recipient-client-id": Flags.string({
+      description:
+        "Client ID to subscribe (subscribes all of the client's devices)",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushChannelsSave);
+
+    // Validate that either device-id or recipient-client-id is provided
+    if (!flags["device-id"] && !flags["recipient-client-id"]) {
+      this.error(
+        "Either --device-id or --recipient-client-id must be specified",
+      );
+    }
+
+    if (flags["device-id"] && flags["recipient-client-id"]) {
+      this.error(
+        "Only one of --device-id or --recipient-client-id can be specified, not both",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Build subscription object
+      const subscription: Ably.PushChannelSubscription = {
+        channel: flags.channel,
+      };
+
+      if (flags["device-id"]) {
+        subscription.deviceId = flags["device-id"];
+      } else if (flags["recipient-client-id"]) {
+        subscription.clientId = flags["recipient-client-id"];
+      }
+
+      // Save the subscription
+      const savedSubscription =
+        await rest.push.admin.channelSubscriptions.save(subscription);
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              subscription: {
+                channel: savedSubscription.channel,
+                deviceId: savedSubscription.deviceId,
+                clientId: savedSubscription.clientId,
+              },
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        const subscriberId = flags["device-id"]
+          ? `device ${chalk.cyan(flags["device-id"])}`
+          : `client ${chalk.cyan(flags["recipient-client-id"])}`;
+
+        this.log(
+          chalk.green(
+            `Successfully subscribed ${subscriberId} to channel ${chalk.cyan(flags.channel)}`,
+          ),
+        );
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        if (errorCode === 40100) {
+          this.error(
+            `Push not enabled for this channel namespace. Configure push rules in the Ably dashboard.`,
+          );
+        } else if (errorCode === 40400) {
+          this.error(
+            `Device or client not found. Ensure the device/client is registered first.`,
+          );
+        } else {
+          this.error(`Error saving subscription: ${errorMessage}`);
+        }
+      }
+    }
+  }
+}
diff --git a/src/commands/push/config/clear-apns.ts b/src/commands/push/config/clear-apns.ts
new file mode 100644
index 00000000..8dd7ca2f
--- /dev/null
+++ b/src/commands/push/config/clear-apns.ts
@@ -0,0 +1,127 @@
+import { Flags } from "@oclif/core";
+import chalk from "chalk";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+import { promptForConfirmation } from "../../../utils/prompt-confirmation.js";
+
+export default class PushConfigClearApns extends ControlBaseCommand {
+  static override description =
+    "Remove APNs (Apple Push Notification service) configuration from an app";
+
+  static override examples = [
+    "$ ably push config clear-apns",
+    "$ ably push config clear-apns --app my-app",
+    "$ ably push config clear-apns --force",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "App ID or name to clear APNs configuration for",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigClearApns);
+
+    await this.runControlCommand(
+      flags,
+      async (api) => {
+        const appId = await this.resolveAppId(flags);
+
+        // Get current app to show what will be cleared
+        // Check both new Control API field (apnsAuthType) and legacy field (apnsUsesSandboxCert)
+        // For apps configured before the Control API update, apnsAuthType may not be set
+        // while apnsUsesSandboxCert is defined
+        const app = await api.getApp(appId);
+        const hasApnsConfig =
+          (app.apnsAuthType !== null && app.apnsAuthType !== undefined) ||
+          (app.apnsUsesSandboxCert !== null &&
+            app.apnsUsesSandboxCert !== undefined);
+
+        if (!hasApnsConfig) {
+          if (this.shouldOutputJson(flags)) {
+            this.log(
+              this.formatJsonOutput(
+                {
+                  success: true,
+                  appId,
+                  message: "No APNs configuration to clear",
+                },
+                flags,
+              ),
+            );
+          } else {
+            this.log(
+              chalk.yellow(
+                `No APNs configuration found for app "${app.name}" (${appId})`,
+              ),
+            );
+          }
+          return;
+        }
+
+        // Confirm unless --force is used or in JSON mode (JSON mode should not prompt)
+        if (!flags.force && !this.shouldOutputJson(flags)) {
+          const confirmed = await promptForConfirmation(
+            `Are you sure you want to remove APNs configuration from app "${app.name}"?`,
+          );
+          if (!confirmed) {
+            this.log("Operation cancelled.");
+            return;
+          }
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(`Clearing APNs configuration for app ${appId}...`);
+        }
+
+        // Clear APNs configuration by setting fields to null/empty
+        // Include both certificate-based and token-based auth fields
+        // New field names (per Control API updates):
+        // - apnsAuthType, apnsSigningKey, apnsSigningKeyId, apnsIssuerKey, apnsTopicHeader
+        // Legacy field names (for backwards compatibility):
+        // - apnsCertificate, apnsPrivateKey
+        await api.updateApp(appId, {
+          // Token-based auth fields (new API)
+          apnsAuthType: null,
+          apnsSigningKey: null,
+          apnsSigningKeyId: null,
+          apnsIssuerKey: null,
+          apnsTopicHeader: null,
+          // Certificate-based auth fields
+          apnsCertificate: null,
+          apnsPrivateKey: null,
+          // Common fields
+          apnsUseSandboxEndpoint: null,
+        } as Record<string, unknown>);
+
+        if (this.shouldOutputJson(flags)) {
+          this.log(
+            this.formatJsonOutput(
+              {
+                success: true,
+                appId,
+                appName: app.name,
+                message: "APNs configuration cleared",
+              },
+              flags,
+            ),
+          );
+        } else {
+          this.log(
+            chalk.green(
+              `\nAPNs configuration cleared successfully for app "${app.name}"`,
+            ),
+          );
+        }
+      },
+      "Error clearing APNs configuration",
+    );
+  }
+}
diff --git a/src/commands/push/config/clear-fcm.ts b/src/commands/push/config/clear-fcm.ts
new file mode 100644
index 00000000..8d987643
--- /dev/null
+++ b/src/commands/push/config/clear-fcm.ts
@@ -0,0 +1,102 @@
+import { Flags } from "@oclif/core";
+import chalk from "chalk";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+import { promptForConfirmation } from "../../../utils/prompt-confirmation.js";
+
+export default class PushConfigClearFcm extends ControlBaseCommand {
+  static override description =
+    "Remove Firebase Cloud Messaging (FCM) configuration from an app.";
+
+  static override examples = [
+    "$ ably push config clear-fcm",
+    "$ ably push config clear-fcm --app my-app",
+    "$ ably push config clear-fcm --force",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "App ID or name to clear FCM configuration for",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      description: "Skip confirmation prompt",
+      default: false,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigClearFcm);
+
+    await this.runControlCommand(
+      flags,
+      async (api) => {
+        const appId = await this.resolveAppId(flags);
+
+        // Get current app to check if FCM is configured
+        const app = await api.getApp(appId);
+
+        if (!app.fcmServiceAccount && !app.fcmProjectId) {
+          if (this.shouldOutputJson(flags)) {
+            this.log(
+              this.formatJsonOutput(
+                {
+                  success: true,
+                  appId,
+                  message: "No FCM configuration to clear",
+                },
+                flags,
+              ),
+            );
+          } else {
+            this.log(chalk.yellow("FCM is not configured for this app."));
+          }
+          return;
+        }
+
+        // Confirm unless --force or in JSON mode (JSON mode should not prompt)
+        if (!flags.force && !this.shouldOutputJson(flags)) {
+          const confirmed = await promptForConfirmation(
+            `Are you sure you want to remove FCM configuration from app "${app.name}" (${appId})? ` +
+              `This will disable push notifications for Android devices.`,
+          );
+          if (!confirmed) {
+            this.log("Operation cancelled.");
+            return;
+          }
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(`Removing FCM configuration from app ${appId}...`);
+        }
+
+        // Clear FCM configuration by setting field to null
+        await api.updateApp(appId, {
+          fcmServiceAccount: null,
+        } as Record<string, unknown>);
+
+        if (this.shouldOutputJson(flags)) {
+          this.log(
+            this.formatJsonOutput(
+              {
+                success: true,
+                appId,
+                message: "FCM configuration cleared",
+              },
+              flags,
+            ),
+          );
+        } else {
+          this.log(chalk.green("\nFCM configuration removed successfully!"));
+          this.log(
+            chalk.dim(
+              "Push notifications to Android devices will no longer work until FCM is reconfigured.",
+            ),
+          );
+        }
+      },
+      "Error clearing FCM configuration",
+    );
+  }
+}
diff --git a/src/commands/push/config/index.ts b/src/commands/push/config/index.ts
new file mode 100644
index 00000000..901e50f2
--- /dev/null
+++ b/src/commands/push/config/index.ts
@@ -0,0 +1,17 @@
+import { BaseTopicCommand } from "../../../base-topic-command.js";
+
+export default class PushConfig extends BaseTopicCommand {
+  protected topicName = "push:config";
+  protected commandGroup = "push notification configuration";
+
+  static override description =
+    "Manage push notification configuration (APNs and FCM credentials)";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> show",
+    "<%= config.bin %> <%= command.id %> set-apns --certificate ./cert.p12 --password SECRET",
+    "<%= config.bin %> <%= command.id %> set-fcm --service-account ./firebase-sa.json",
+    "<%= config.bin %> <%= command.id %> clear-apns --force",
+    "<%= config.bin %> <%= command.id %> clear-fcm --force",
+  ];
+}
diff --git a/src/commands/push/config/set-apns.ts b/src/commands/push/config/set-apns.ts
new file mode 100644
index 00000000..bb08440f
--- /dev/null
+++ b/src/commands/push/config/set-apns.ts
@@ -0,0 +1,213 @@
+import { Flags } from "@oclif/core";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import chalk from "chalk";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+
+export default class PushConfigSetApns extends ControlBaseCommand {
+  static override description =
+    "Configure Apple Push Notification service (APNs) credentials for an app. Supports both certificate-based (.p12) and token-based (.p8) authentication.";
+
+  static override examples = [
+    // Certificate-based authentication (production)
+    "$ ably push config set-apns --certificate ./cert.p12 --password SECRET",
+    // Certificate-based authentication (sandbox - use with development certificate)
+    "$ ably push config set-apns --certificate ./cert.p12 --password SECRET --use-sandbox",
+    // Token-based authentication (production)
+    "$ ably push config set-apns --key-file ./AuthKey.p8 --key-id ABC123 --team-id XYZ789 --bundle-id com.myapp",
+    // Token-based authentication (sandbox)
+    "$ ably push config set-apns --key-file ./AuthKey.p8 --key-id ABC123 --team-id XYZ789 --bundle-id com.myapp --use-sandbox",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "App ID or name to configure",
+    }),
+    // Certificate-based auth flags
+    certificate: Flags.string({
+      description: "Path to .p12 certificate file",
+    }),
+    password: Flags.string({
+      description: "Password for the .p12 certificate",
+    }),
+    // Token-based auth flags
+    "key-file": Flags.string({
+      description: "Path to .p8 private key file (token-based auth)",
+    }),
+    "key-id": Flags.string({
+      description: "Key ID from Apple Developer portal (token-based auth)",
+    }),
+    "team-id": Flags.string({
+      description: "Team ID from Apple Developer portal (token-based auth)",
+    }),
+    "bundle-id": Flags.string({
+      description: "App bundle identifier (token-based auth)",
+    }),
+    // Sandbox endpoint flag
+    "use-sandbox": Flags.boolean({
+      default: false,
+      description:
+        "Use the APNs sandbox endpoint instead of production. " +
+        "Use this with development certificates or when testing with sandbox device tokens.",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigSetApns);
+
+    // Validate that either certificate or key-file is provided
+    if (!flags.certificate && !flags["key-file"]) {
+      this.error(
+        "Either --certificate (for .p12) or --key-file (for .p8 token auth) must be specified",
+      );
+    }
+
+    if (flags.certificate && flags["key-file"]) {
+      this.error(
+        "Cannot use both --certificate and --key-file. Choose one authentication method.",
+      );
+    }
+
+    // Validate token-based auth requires all fields
+    if (
+      flags["key-file"] &&
+      (!flags["key-id"] || !flags["team-id"] || !flags["bundle-id"])
+    ) {
+      this.error(
+        "Token-based auth requires --key-file, --key-id, --team-id, and --bundle-id",
+      );
+    }
+
+    await this.runControlCommand(
+      flags,
+      async (api) => {
+        const appId = await this.resolveAppId(flags);
+
+        if (flags.certificate) {
+          // Certificate-based authentication (P12)
+          return this.uploadP12Certificate(api, appId, flags);
+        } else {
+          // Token-based authentication (P8)
+          return this.configureTokenAuth(api, appId, flags);
+        }
+      },
+      "Error configuring APNs",
+    );
+  }
+
+  private async uploadP12Certificate(
+    api: ReturnType<typeof this.createControlApi>,
+    appId: string,
+    flags: Record<string, unknown>,
+  ): Promise<void> {
+    const certificatePath = path.resolve(flags.certificate as string);
+
+    if (!fs.existsSync(certificatePath)) {
+      this.error(`Certificate file not found: ${certificatePath}`);
+    }
+
+    this.log(`Uploading APNs P12 certificate for app ${appId}...`);
+
+    // Read certificate file as Buffer
+    const certificateData = fs.readFileSync(certificatePath);
+
+    const result = await api.uploadApnsP12(appId, certificateData, {
+      password: flags.password as string | undefined,
+    });
+
+    // Set the sandbox endpoint based on user's choice
+    // User is responsible for matching this with their certificate type
+    // (development certificate = sandbox, distribution certificate = production)
+    const useSandbox = flags["use-sandbox"] as boolean;
+    await api.updateApp(appId, {
+      apnsUseSandboxEndpoint: useSandbox,
+    } as Record<string, unknown>);
+
+    const environment = useSandbox ? "Sandbox" : "Production";
+
+    if (this.shouldOutputJson(flags)) {
+      this.log(
+        this.formatJsonOutput(
+          {
+            success: true,
+            appId,
+            authType: "certificate",
+            certificateId: result.id,
+            environment,
+          },
+          flags,
+        ),
+      );
+    } else {
+      this.log(chalk.green("\nAPNs P12 certificate uploaded successfully!"));
+      this.log(`${chalk.dim("Certificate ID:")} ${result.id}`);
+      this.log(`${chalk.dim("Environment:")}    ${environment}`);
+    }
+  }
+
+  private async configureTokenAuth(
+    api: ReturnType<typeof this.createControlApi>,
+    appId: string,
+    flags: Record<string, unknown>,
+  ): Promise<void> {
+    const keyFilePath = path.resolve(flags["key-file"] as string);
+
+    if (!fs.existsSync(keyFilePath)) {
+      this.error(`Key file not found: ${keyFilePath}`);
+    }
+
+    this.log(`Configuring APNs token-based authentication for app ${appId}...`);
+
+    // Read the P8 key file
+    const privateKey = fs.readFileSync(keyFilePath, "utf8");
+
+    // Update app with APNs token auth configuration
+    // Field name mapping (per Control API):
+    // - apnsAuthType: "token" for token-based auth
+    // - apnsSigningKey: The .p8 private key content
+    // - apnsSigningKeyId: The Key ID from Apple
+    // - apnsIssuerKey: The Team ID from Apple
+    // - apnsTopicHeader: The bundle ID / topic
+    // - apnsUseSandboxEndpoint: Whether to use sandbox (required for token auth)
+    const useSandbox = flags["use-sandbox"] as boolean;
+    await api.updateApp(appId, {
+      apnsAuthType: "token",
+      apnsSigningKey: privateKey,
+      apnsSigningKeyId: flags["key-id"] as string,
+      apnsIssuerKey: flags["team-id"] as string,
+      apnsTopicHeader: flags["bundle-id"] as string,
+      apnsUseSandboxEndpoint: useSandbox,
+    } as Record<string, unknown>);
+
+    const environment = useSandbox ? "Sandbox" : "Production";
+
+    if (this.shouldOutputJson(flags)) {
+      this.log(
+        this.formatJsonOutput(
+          {
+            success: true,
+            appId,
+            authType: "token",
+            keyId: flags["key-id"],
+            teamId: flags["team-id"],
+            bundleId: flags["bundle-id"],
+            environment,
+          },
+          flags,
+        ),
+      );
+    } else {
+      this.log(
+        chalk.green(
+          "\nAPNs token-based authentication configured successfully!",
+        ),
+      );
+      this.log(`${chalk.dim("Key ID:")}      ${flags["key-id"]}`);
+      this.log(`${chalk.dim("Team ID:")}     ${flags["team-id"]}`);
+      this.log(`${chalk.dim("Bundle ID:")}   ${flags["bundle-id"]}`);
+      this.log(`${chalk.dim("Environment:")} ${environment}`);
+    }
+  }
+}
diff --git a/src/commands/push/config/set-fcm.ts b/src/commands/push/config/set-fcm.ts
new file mode 100644
index 00000000..697a1550
--- /dev/null
+++ b/src/commands/push/config/set-fcm.ts
@@ -0,0 +1,116 @@
+import { Flags } from "@oclif/core";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import chalk from "chalk";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+
+interface ServiceAccount {
+  project_id?: string;
+  type?: string;
+  client_email?: string;
+  [key: string]: unknown;
+}
+
+export default class PushConfigSetFcm extends ControlBaseCommand {
+  static override description =
+    "Configure Firebase Cloud Messaging (FCM) credentials for an app using a service account JSON file.";
+
+  static override examples = [
+    "$ ably push config set-fcm --service-account ./firebase-service-account.json",
+    "$ ably push config set-fcm --app my-app --service-account ./firebase-prod.json",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "App ID or name to configure",
+    }),
+    "service-account": Flags.string({
+      description: "Path to Firebase service account JSON file",
+      required: true,
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigSetFcm);
+
+    await this.runControlCommand(
+      flags,
+      async (api) => {
+        const appId = await this.resolveAppId(flags);
+
+        // Read and validate service account JSON
+        const serviceAccountPath = path.resolve(
+          flags["service-account"] as string,
+        );
+
+        if (!fs.existsSync(serviceAccountPath)) {
+          this.error(`Service account file not found: ${serviceAccountPath}`);
+        }
+
+        let serviceAccountJson: string;
+        let serviceAccount: ServiceAccount;
+
+        try {
+          serviceAccountJson = fs.readFileSync(serviceAccountPath, "utf8");
+          serviceAccount = JSON.parse(serviceAccountJson) as ServiceAccount;
+        } catch {
+          this.error(
+            `Invalid JSON in service account file: ${serviceAccountPath}`,
+          );
+        }
+
+        // Validate it looks like a service account
+        if (serviceAccount.type !== "service_account") {
+          this.error(
+            `Invalid service account file: expected "type": "service_account" field. ` +
+              `Got type: "${serviceAccount.type || "undefined"}"`,
+          );
+        }
+
+        if (!serviceAccount.project_id) {
+          this.error(
+            `Invalid service account file: missing "project_id" field`,
+          );
+        }
+
+        if (!this.shouldOutputJson(flags)) {
+          this.log(
+            `Configuring FCM credentials for app ${appId} with project "${serviceAccount.project_id}"...`,
+          );
+        }
+
+        // Update app with FCM configuration
+        await api.updateApp(appId, {
+          fcmServiceAccount: serviceAccountJson,
+        } as Record<string, unknown>);
+
+        if (this.shouldOutputJson(flags)) {
+          this.log(
+            this.formatJsonOutput(
+              {
+                success: true,
+                appId,
+                projectId: serviceAccount.project_id,
+                clientEmail: serviceAccount.client_email || null,
+              },
+              flags,
+            ),
+          );
+        } else {
+          this.log(chalk.green("\nFCM credentials configured successfully!"));
+          this.log(
+            `${chalk.dim("Project ID:")}     ${serviceAccount.project_id}`,
+          );
+          if (serviceAccount.client_email) {
+            this.log(
+              `${chalk.dim("Service Account:")} ${serviceAccount.client_email}`,
+            );
+          }
+        }
+      },
+      "Error configuring FCM",
+    );
+  }
+}
diff --git a/src/commands/push/config/show.ts b/src/commands/push/config/show.ts
new file mode 100644
index 00000000..6c548e1d
--- /dev/null
+++ b/src/commands/push/config/show.ts
@@ -0,0 +1,133 @@
+import { Flags } from "@oclif/core";
+import chalk from "chalk";
+
+import { ControlBaseCommand } from "../../../control-base-command.js";
+
+export default class PushConfigShow extends ControlBaseCommand {
+  static override description =
+    "Show push notification configuration status for an app";
+
+  static override examples = [
+    "$ ably push config show",
+    "$ ably push config show --app my-app",
+    "$ ably push config show --json",
+  ];
+
+  static override flags = {
+    ...ControlBaseCommand.globalFlags,
+    app: Flags.string({
+      description: "App ID or name to show configuration for",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushConfigShow);
+
+    await this.runControlCommand(
+      flags,
+      async (api) => {
+        // Resolve app ID
+        const appId = await this.resolveAppId(flags);
+
+        // Get app details
+        const app = await api.getApp(appId);
+
+        if (this.shouldOutputJson(flags)) {
+          // Extract push-related fields using new Control API response fields
+          // - apnsAuthType: 'token', 'certificate', or null (if not configured)
+          // - fcmProjectId: project ID or null (if not configured)
+          // - apnsUseSandboxEndpoint: boolean or null
+          // Also check legacy field apnsUsesSandboxCert for apps configured before API update
+          const apnsConfigured =
+            (app.apnsAuthType !== null && app.apnsAuthType !== undefined) ||
+            (app.apnsUsesSandboxCert !== null &&
+              app.apnsUsesSandboxCert !== undefined);
+          const pushConfig = {
+            appId: app.id,
+            appName: app.name,
+            apns: {
+              configured: apnsConfigured,
+              authType: app.apnsAuthType || null,
+              useSandbox:
+                app.apnsUseSandboxEndpoint ?? app.apnsUsesSandboxCert ?? false,
+            },
+            fcm: {
+              configured:
+                app.fcmProjectId !== null && app.fcmProjectId !== undefined,
+              projectId: app.fcmProjectId || null,
+            },
+          };
+          this.log(this.formatJsonOutput(pushConfig, flags));
+        } else {
+          this.log(
+            chalk.bold(
+              `Push Notification Configuration for app "${app.name}" (${app.id})\n`,
+            ),
+          );
+
+          // APNs Configuration
+          // Check both new Control API field (apnsAuthType) and legacy field (apnsUsesSandboxCert)
+          // For apps configured before the Control API update, apnsAuthType may not be set
+          this.log(chalk.cyan("APNs (iOS):"));
+          const apnsConfigured =
+            (app.apnsAuthType !== null && app.apnsAuthType !== undefined) ||
+            (app.apnsUsesSandboxCert !== null &&
+              app.apnsUsesSandboxCert !== undefined);
+
+          if (apnsConfigured) {
+            this.log(
+              `  ${chalk.dim("Status:")}      ${chalk.green("Configured")}`,
+            );
+            // Use apnsUseSandboxEndpoint (new) or fallback to apnsUsesSandboxCert (legacy)
+            const useSandbox =
+              app.apnsUseSandboxEndpoint ?? app.apnsUsesSandboxCert ?? false;
+            const environment = useSandbox ? "Sandbox" : "Production";
+            this.log(`  ${chalk.dim("Environment:")} ${environment}`);
+
+            // Use apnsAuthType to determine auth type
+            if (app.apnsAuthType === "token") {
+              this.log(`  ${chalk.dim("Auth Type:")}   Token-based (.p8)`);
+            } else {
+              this.log(
+                `  ${chalk.dim("Auth Type:")}   Certificate-based (.p12)`,
+              );
+            }
+          } else {
+            this.log(
+              `  ${chalk.dim("Status:")}      ${chalk.yellow("Not configured")}`,
+            );
+          }
+
+          this.log("");
+
+          // FCM Configuration
+          // Use new Control API response field: fcmProjectId (string or null)
+          this.log(chalk.cyan("FCM (Android):"));
+          const fcmConfigured =
+            app.fcmProjectId !== null && app.fcmProjectId !== undefined;
+
+          if (fcmConfigured) {
+            this.log(
+              `  ${chalk.dim("Status:")}      ${chalk.green("Configured")}`,
+            );
+            this.log(`  ${chalk.dim("Project ID:")}  ${app.fcmProjectId}`);
+          } else {
+            this.log(
+              `  ${chalk.dim("Status:")}      ${chalk.yellow("Not configured")}`,
+            );
+          }
+
+          // Web Push info
+          this.log("");
+          this.log(chalk.cyan("Web Push:"));
+          this.log(
+            `  ${chalk.dim("Status:")}      ${chalk.green("Available")} (no configuration required)`,
+          );
+        }
+
+        return app;
+      },
+      "Error retrieving push configuration",
+    );
+  }
+}
diff --git a/src/commands/push/devices/get.ts b/src/commands/push/devices/get.ts
new file mode 100644
index 00000000..3359e02d
--- /dev/null
+++ b/src/commands/push/devices/get.ts
@@ -0,0 +1,147 @@
+import { Args } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import chalk from "chalk";
+
+export default class PushDevicesGet extends AblyBaseCommand {
+  static override description =
+    "Get details of a registered push notification device (maps to push.admin.deviceRegistrations.get)";
+
+  static override examples = [
+    "$ ably push devices get DEVICE_ID",
+    "$ ably push devices get my-device-123",
+    "$ ably push devices get my-device-123 --json",
+  ];
+
+  static override args = {
+    deviceId: Args.string({
+      description: "The device ID to retrieve",
+      required: true,
+    }),
+  };
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+  };
+
+  async run(): Promise<void> {
+    const { args, flags } = await this.parse(PushDevicesGet);
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      const device = await rest.push.admin.deviceRegistrations.get(
+        args.deviceId,
+      );
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              device: {
+                id: device.id,
+                platform: device.platform,
+                formFactor: device.formFactor,
+                clientId: device.clientId,
+                state: device.push?.state,
+                metadata: device.metadata,
+                push: {
+                  state: device.push?.state,
+                  error: device.push?.error,
+                  // Redact sensitive recipient info
+                  recipient: device.push?.recipient
+                    ? { transportType: device.push.recipient.transportType }
+                    : undefined,
+                },
+              },
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(chalk.bold("Device Details\n"));
+
+        this.log(`${chalk.dim("Device ID:")}    ${chalk.green(device.id)}`);
+
+        if (device.clientId) {
+          this.log(`${chalk.dim("Client ID:")}    ${device.clientId}`);
+        }
+
+        this.log(`${chalk.dim("Platform:")}     ${device.platform}`);
+        this.log(`${chalk.dim("Form Factor:")}  ${device.formFactor}`);
+
+        if (device.push?.state) {
+          const stateColor =
+            device.push.state === "ACTIVE"
+              ? chalk.green
+              : device.push.state === "FAILING"
+                ? chalk.yellow
+                : chalk.red;
+          this.log(
+            `${chalk.dim("State:")}        ${stateColor(device.push.state)}`,
+          );
+        }
+
+        if (device.push?.error) {
+          this.log("");
+          this.log(chalk.red("Last Error:"));
+          this.log(`  ${chalk.dim("Message:")} ${device.push.error.message}`);
+          if (device.push.error.code) {
+            this.log(`  ${chalk.dim("Code:")} ${device.push.error.code}`);
+          }
+        }
+
+        // Show recipient info (redacted)
+        if (device.push?.recipient) {
+          this.log("");
+          this.log(chalk.dim("Push Recipient:"));
+          this.log(
+            `  ${chalk.dim("Transport:")}    ${device.push.recipient.transportType}`,
+          );
+
+          // Show redacted token for security
+          const recipient = device.push.recipient as Record<string, unknown>;
+          const token = recipient.registrationToken || recipient.deviceToken;
+
+          if (typeof token === "string" && token.length > 8) {
+            const redacted = `${token.slice(0, 4)}...${token.slice(-4)}`;
+            this.log(`  ${chalk.dim("Token:")}        ${redacted} (redacted)`);
+          }
+        }
+
+        if (device.metadata && Object.keys(device.metadata).length > 0) {
+          this.log("");
+          this.log(chalk.dim("Metadata:"));
+          for (const [key, value] of Object.entries(device.metadata)) {
+            this.log(`  ${chalk.dim(key + ":")} ${String(value)}`);
+          }
+        }
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        if (errorCode === 40400) {
+          this.error(`Device not found: ${args.deviceId}`);
+        } else {
+          this.error(`Error getting device: ${errorMessage}`);
+        }
+      }
+    }
+  }
+}
diff --git a/src/commands/push/devices/index.ts b/src/commands/push/devices/index.ts
new file mode 100644
index 00000000..e1dcf261
--- /dev/null
+++ b/src/commands/push/devices/index.ts
@@ -0,0 +1,18 @@
+import { BaseTopicCommand } from "../../../base-topic-command.js";
+
+export default class PushDevices extends BaseTopicCommand {
+  protected topicName = "push:devices";
+  protected commandGroup = "push device registration";
+
+  static override description =
+    "Manage push notification device registrations (maps to push.admin.deviceRegistrations)";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> list",
+    "<%= config.bin %> <%= command.id %> list --client-id user-123",
+    "<%= config.bin %> <%= command.id %> get DEVICE_ID",
+    "<%= config.bin %> <%= command.id %> save --id my-device --platform android --form-factor phone --transport-type fcm --device-token TOKEN",
+    "<%= config.bin %> <%= command.id %> remove DEVICE_ID",
+    "<%= config.bin %> <%= command.id %> remove-where --client-id user-123",
+  ];
+}
diff --git a/src/commands/push/devices/list.ts b/src/commands/push/devices/list.ts
new file mode 100644
index 00000000..29bf07e3
--- /dev/null
+++ b/src/commands/push/devices/list.ts
@@ -0,0 +1,149 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import * as Ably from "ably";
+import chalk from "chalk";
+
+export default class PushDevicesList extends AblyBaseCommand {
+  static override description =
+    "List registered push notification devices (maps to push.admin.deviceRegistrations.list)";
+
+  static override examples = [
+    "$ ably push devices list",
+    "$ ably push devices list --recipient-client-id user-123",
+    "$ ably push devices list --device-id device-456",
+    "$ ably push devices list --state ACTIVE",
+    "$ ably push devices list --limit 50",
+    "$ ably push devices list --json",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    "recipient-client-id": Flags.string({
+      description: "Filter devices by client ID",
+    }),
+    "device-id": Flags.string({
+      description: "Filter by device ID",
+    }),
+    state: Flags.string({
+      description: "Filter by device state",
+      options: ["ACTIVE", "FAILING", "FAILED"],
+    }),
+    limit: Flags.integer({
+      default: 100,
+      description: "Maximum number of devices to return (max: 1000)",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushDevicesList);
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Build filter params
+      const params: Ably.DeviceRegistrationParams = {};
+
+      if (flags["recipient-client-id"]) {
+        params.clientId = flags["recipient-client-id"];
+      }
+
+      if (flags["device-id"]) {
+        params.deviceId = flags["device-id"];
+      }
+
+      if (flags.state) {
+        params.state = flags.state as Ably.DevicePushState;
+      }
+
+      if (flags.limit) {
+        params.limit = Math.min(flags.limit, 1000);
+      }
+
+      // Fetch devices
+      const devicesPage =
+        await rest.push.admin.deviceRegistrations.list(params);
+      const devices = devicesPage.items;
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              devices: devices.map((device) => ({
+                id: device.id,
+                platform: device.platform,
+                formFactor: device.formFactor,
+                clientId: device.clientId,
+                state: device.push?.state,
+                metadata: device.metadata,
+              })),
+              hasMore: devicesPage.hasNext(),
+              success: true,
+              timestamp: new Date().toISOString(),
+              total: devices.length,
+            },
+            flags,
+          ),
+        );
+      } else {
+        if (devices.length === 0) {
+          this.log("No devices found.");
+          return;
+        }
+
+        this.log(
+          `Found ${chalk.cyan(devices.length.toString())} device${devices.length === 1 ? "" : "s"}:\n`,
+        );
+
+        for (const device of devices) {
+          this.log(`${chalk.green(device.id)}`);
+          this.log(`  ${chalk.dim("Platform:")} ${device.platform}`);
+          this.log(`  ${chalk.dim("Form Factor:")} ${device.formFactor}`);
+
+          if (device.clientId) {
+            this.log(`  ${chalk.dim("Client ID:")} ${device.clientId}`);
+          }
+
+          if (device.push?.state) {
+            const stateColor =
+              device.push.state === "ACTIVE"
+                ? chalk.green
+                : device.push.state === "FAILING"
+                  ? chalk.yellow
+                  : chalk.red;
+            this.log(
+              `  ${chalk.dim("State:")} ${stateColor(device.push.state)}`,
+            );
+          }
+
+          this.log(""); // Add spacing between devices
+        }
+
+        if (devicesPage.hasNext()) {
+          this.log(
+            chalk.yellow(
+              `Showing first ${devices.length} devices. Use --limit to show more.`,
+            ),
+          );
+        }
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(`Error listing devices: ${errorMessage}`);
+      }
+    }
+  }
+}
diff --git a/src/commands/push/devices/remove-where.ts b/src/commands/push/devices/remove-where.ts
new file mode 100644
index 00000000..00c00ca0
--- /dev/null
+++ b/src/commands/push/devices/remove-where.ts
@@ -0,0 +1,145 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import * as Ably from "ably";
+import chalk from "chalk";
+import { promptForConfirmation } from "../../../utils/prompt-confirmation.js";
+
+export default class PushDevicesRemoveWhere extends AblyBaseCommand {
+  static override description =
+    "Remove all devices matching specified criteria (maps to push.admin.deviceRegistrations.removeWhere)";
+
+  static override examples = [
+    "$ ably push devices remove-where --recipient-client-id user-123",
+    "$ ably push devices remove-where --device-id device-prefix",
+    "$ ably push devices remove-where --recipient-client-id user-123 --force",
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    "recipient-client-id": Flags.string({
+      description: "Remove all devices for this client ID",
+    }),
+    "device-id": Flags.string({
+      description: "Remove device with this ID",
+    }),
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushDevicesRemoveWhere);
+
+    // Require at least one filter criterion
+    if (!flags["recipient-client-id"] && !flags["device-id"]) {
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error:
+              "At least one filter criterion is required: --recipient-client-id or --device-id",
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(
+          "At least one filter criterion is required: --recipient-client-id or --device-id",
+        );
+      }
+
+      return;
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Build filter params
+      const params: Ably.DeviceRegistrationParams = {};
+
+      if (flags["recipient-client-id"]) {
+        params.clientId = flags["recipient-client-id"];
+      }
+
+      if (flags["device-id"]) {
+        params.deviceId = flags["device-id"];
+      }
+
+      // Build description of what will be removed
+      const filterDescription = this.buildFilterDescription(flags);
+
+      // Confirm deletion unless --force is used
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const confirmed = await promptForConfirmation(
+          `Are you sure you want to remove all devices ${filterDescription}?`,
+        );
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      // Remove matching devices
+      await rest.push.admin.deviceRegistrations.removeWhere(params);
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              filter: {
+                clientId: flags["recipient-client-id"],
+                deviceId: flags["device-id"],
+              },
+              removed: true,
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(
+          chalk.green(`Devices removed successfully ${filterDescription}`),
+        );
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(`Error removing devices: ${errorMessage}`);
+      }
+    }
+  }
+
+  private buildFilterDescription(flags: Record<string, unknown>): string {
+    const parts: string[] = [];
+
+    if (flags["recipient-client-id"]) {
+      parts.push(
+        `with client ID ${chalk.cyan(flags["recipient-client-id"] as string)}`,
+      );
+    }
+
+    if (flags["device-id"]) {
+      parts.push(`with device ID ${chalk.cyan(flags["device-id"] as string)}`);
+    }
+
+    return parts.join(" and ");
+  }
+}
diff --git a/src/commands/push/devices/remove.ts b/src/commands/push/devices/remove.ts
new file mode 100644
index 00000000..641eff2a
--- /dev/null
+++ b/src/commands/push/devices/remove.ts
@@ -0,0 +1,95 @@
+import { Args, Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import chalk from "chalk";
+import { promptForConfirmation } from "../../../utils/prompt-confirmation.js";
+
+export default class PushDevicesRemove extends AblyBaseCommand {
+  static override description =
+    "Remove a registered push notification device (maps to push.admin.deviceRegistrations.remove)";
+
+  static override examples = [
+    "$ ably push devices remove DEVICE_ID",
+    "$ ably push devices remove my-device-123",
+    "$ ably push devices remove my-device-123 --force",
+    "$ ably push devices remove my-device-123 --json",
+  ];
+
+  static override args = {
+    deviceId: Args.string({
+      description: "The device ID to remove",
+      required: true,
+    }),
+  };
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    force: Flags.boolean({
+      char: "f",
+      default: false,
+      description: "Skip confirmation prompt",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { args, flags } = await this.parse(PushDevicesRemove);
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Confirm deletion unless --force is used
+      if (!flags.force && !this.shouldOutputJson(flags)) {
+        const confirmed = await promptForConfirmation(
+          `Are you sure you want to remove device ${chalk.cyan(args.deviceId)}?`,
+        );
+
+        if (!confirmed) {
+          this.log("Operation cancelled.");
+          return;
+        }
+      }
+
+      // Remove the device
+      await rest.push.admin.deviceRegistrations.remove(args.deviceId);
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              deviceId: args.deviceId,
+              removed: true,
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(chalk.green(`Device removed successfully: ${args.deviceId}`));
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        if (errorCode === 40400) {
+          this.error(`Device not found: ${args.deviceId}`);
+        } else {
+          this.error(`Error removing device: ${errorMessage}`);
+        }
+      }
+    }
+  }
+}
diff --git a/src/commands/push/devices/save.ts b/src/commands/push/devices/save.ts
new file mode 100644
index 00000000..21cd9579
--- /dev/null
+++ b/src/commands/push/devices/save.ts
@@ -0,0 +1,353 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../../base-command.js";
+import * as Ably from "ably";
+import chalk from "chalk";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+export default class PushDevicesSave extends AblyBaseCommand {
+  static override description =
+    "Register a new device or update an existing device registration (maps to push.admin.deviceRegistrations.save)";
+
+  static override examples = [
+    // Android FCM
+    "$ ably push devices save --id my-device --platform android --form-factor phone --transport-type fcm --device-token FCM_REGISTRATION_TOKEN",
+    // iOS APNs
+    "$ ably push devices save --id my-device --platform ios --form-factor phone --transport-type apns --device-token APNS_DEVICE_TOKEN",
+    // Web Push (browser)
+    "$ ably push devices save --id my-device --platform browser --form-factor desktop --transport-type web --target-url https://fcm.googleapis.com/fcm/send/... --p256dh-key BASE64_P256DH_KEY --auth-secret BASE64_AUTH_SECRET",
+    // With client ID
+    "$ ably push devices save --id my-device --platform android --form-factor phone --transport-type fcm --device-token TOKEN --recipient-client-id user-123",
+    // From JSON file
+    "$ ably push devices save --data ./device.json",
+    // From inline JSON
+    '$ ably push devices save --data \'{"id":"device-1","platform":"android","formFactor":"phone","push":{"recipient":{"transportType":"fcm","registrationToken":"TOKEN"}}}\'',
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    id: Flags.string({
+      description: "Unique device identifier",
+    }),
+    platform: Flags.string({
+      description: "Device platform",
+      options: ["android", "ios", "browser"],
+    }),
+    "form-factor": Flags.string({
+      description: "Device form factor",
+      options: [
+        "phone",
+        "tablet",
+        "desktop",
+        "tv",
+        "watch",
+        "car",
+        "embedded",
+        "other",
+      ],
+    }),
+    "recipient-client-id": Flags.string({
+      description: "Client ID to associate with the device",
+    }),
+    "transport-type": Flags.string({
+      description:
+        "Push transport type (fcm for Android, apns for iOS, web for browsers)",
+      options: ["fcm", "apns", "web"],
+    }),
+    "device-token": Flags.string({
+      description:
+        "Device token for APNs (iOS) or FCM registration token (Android). Not used for web push.",
+    }),
+    "target-url": Flags.string({
+      description:
+        "Web push endpoint URL (from PushSubscription.endpoint). Required for web transport type.",
+    }),
+    "p256dh-key": Flags.string({
+      description:
+        "Web push p256dh public key (from PushSubscription.getKey('p256dh'), base64 encoded). Required for web transport type.",
+    }),
+    "auth-secret": Flags.string({
+      description:
+        "Web push auth secret (from PushSubscription.getKey('auth'), base64 encoded). Required for web transport type.",
+    }),
+    metadata: Flags.string({
+      description: "Device metadata as JSON string",
+    }),
+    data: Flags.string({
+      description: "Full device details as JSON string or path to JSON file",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushDevicesSave);
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      let deviceDetails: Ably.DeviceDetails;
+
+      if (flags.data) {
+        // Parse device details from JSON string or file
+        deviceDetails = this.parseDeviceData(flags.data);
+      } else {
+        // Build device details from individual flags
+        deviceDetails = this.buildDeviceDetails(flags);
+      }
+
+      // Validate required fields
+      this.validateDeviceDetails(deviceDetails);
+
+      // Save the device
+      const savedDevice =
+        await rest.push.admin.deviceRegistrations.save(deviceDetails);
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              device: {
+                id: savedDevice.id,
+                platform: savedDevice.platform,
+                formFactor: savedDevice.formFactor,
+                clientId: savedDevice.clientId,
+                state: savedDevice.push?.state,
+              },
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        this.log(
+          chalk.green(`Device registered successfully: ${savedDevice.id}`),
+        );
+        this.log("");
+        this.log(`${chalk.dim("Platform:")}     ${savedDevice.platform}`);
+        this.log(`${chalk.dim("Form Factor:")}  ${savedDevice.formFactor}`);
+
+        if (savedDevice.clientId) {
+          this.log(`${chalk.dim("Client ID:")}    ${savedDevice.clientId}`);
+        }
+
+        if (savedDevice.push?.state) {
+          this.log(
+            `${chalk.dim("State:")}        ${chalk.green(savedDevice.push.state)}`,
+          );
+        }
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        this.error(`Error saving device: ${errorMessage}`);
+      }
+    }
+  }
+
+  private parseDeviceData(data: string): Ably.DeviceDetails {
+    let jsonString = data;
+
+    // Check if it's a file path
+    if (!data.trim().startsWith("{")) {
+      const filePath = path.resolve(data);
+
+      if (!fs.existsSync(filePath)) {
+        throw new Error(`File not found: ${filePath}`);
+      }
+
+      jsonString = fs.readFileSync(filePath, "utf8");
+    }
+
+    try {
+      return JSON.parse(jsonString) as Ably.DeviceDetails;
+    } catch {
+      throw new Error("Invalid JSON format in --data");
+    }
+  }
+
+  private buildDeviceDetails(
+    flags: Record<string, unknown>,
+  ): Ably.DeviceDetails {
+    if (!flags.id) {
+      throw new Error("--id is required when not using --data");
+    }
+
+    if (!flags.platform) {
+      throw new Error("--platform is required when not using --data");
+    }
+
+    if (!flags["form-factor"]) {
+      throw new Error("--form-factor is required when not using --data");
+    }
+
+    if (!flags["transport-type"]) {
+      throw new Error("--transport-type is required when not using --data");
+    }
+
+    const transportType = flags["transport-type"] as string;
+
+    // Validate transport-specific required flags
+    if (transportType === "web") {
+      if (!flags["target-url"]) {
+        throw new Error("--target-url is required for web transport type");
+      }
+
+      if (!flags["p256dh-key"]) {
+        throw new Error("--p256dh-key is required for web transport type");
+      }
+
+      if (!flags["auth-secret"]) {
+        throw new Error("--auth-secret is required for web transport type");
+      }
+    } else {
+      if (!flags["device-token"]) {
+        throw new Error(
+          "--device-token is required for fcm and apns transport types",
+        );
+      }
+    }
+
+    const device: Ably.DeviceDetails = {
+      id: flags.id as string,
+      platform: flags.platform as Ably.DevicePlatform,
+      formFactor: flags["form-factor"] as Ably.DeviceFormFactor,
+      push: {
+        recipient: this.buildRecipient(transportType, flags),
+      },
+    };
+
+    if (flags["recipient-client-id"]) {
+      device.clientId = flags["recipient-client-id"] as string;
+    }
+
+    if (flags.metadata) {
+      try {
+        device.metadata = JSON.parse(flags.metadata as string);
+      } catch {
+        throw new Error("Invalid JSON format in --metadata");
+      }
+    }
+
+    return device;
+  }
+
+  private buildRecipient(
+    transportType: string,
+    flags: Record<string, unknown>,
+  ): Record<string, unknown> {
+    const recipient: Record<string, unknown> = {
+      transportType,
+    };
+
+    switch (transportType) {
+      case "fcm": {
+        recipient.registrationToken = flags["device-token"] as string;
+        break;
+      }
+
+      case "apns": {
+        recipient.deviceToken = flags["device-token"] as string;
+        break;
+      }
+
+      case "web": {
+        // Web push requires targetUrl and encryptionKey object with p256dh and auth
+        recipient.targetUrl = flags["target-url"] as string;
+        recipient.encryptionKey = {
+          p256dh: flags["p256dh-key"] as string,
+          auth: flags["auth-secret"] as string,
+        };
+        break;
+      }
+
+      default: {
+        throw new Error(`Unsupported transport type: ${transportType}`);
+      }
+    }
+
+    return recipient;
+  }
+
+  private validateDeviceDetails(device: Ably.DeviceDetails): void {
+    if (!device.id) {
+      throw new Error("Device ID is required");
+    }
+
+    if (!device.platform) {
+      throw new Error("Device platform is required");
+    }
+
+    if (!device.formFactor) {
+      throw new Error("Device form factor is required");
+    }
+
+    if (!device.push?.recipient) {
+      throw new Error("Push recipient configuration is required");
+    }
+
+    const recipient = device.push.recipient as Record<string, unknown>;
+
+    if (!recipient.transportType) {
+      throw new Error("Transport type is required in push recipient");
+    }
+
+    // Validate transport-specific fields
+    switch (recipient.transportType) {
+      case "fcm": {
+        if (!recipient.registrationToken) {
+          throw new Error("FCM registrationToken is required");
+        }
+
+        break;
+      }
+
+      case "apns": {
+        if (!recipient.deviceToken) {
+          throw new Error("APNs deviceToken is required");
+        }
+
+        break;
+      }
+
+      case "web": {
+        if (!recipient.targetUrl) {
+          throw new Error("Web push targetUrl is required");
+        }
+
+        if (!recipient.encryptionKey) {
+          throw new Error("Web push encryptionKey is required");
+        }
+
+        const encryptionKey = recipient.encryptionKey as Record<
+          string,
+          unknown
+        >;
+
+        if (!encryptionKey.p256dh) {
+          throw new Error("Web push encryptionKey.p256dh is required");
+        }
+
+        if (!encryptionKey.auth) {
+          throw new Error("Web push encryptionKey.auth is required");
+        }
+
+        break;
+      }
+    }
+  }
+}
diff --git a/src/commands/push/index.ts b/src/commands/push/index.ts
new file mode 100644
index 00000000..c2841c14
--- /dev/null
+++ b/src/commands/push/index.ts
@@ -0,0 +1,16 @@
+import { BaseTopicCommand } from "../../base-topic-command.js";
+
+export default class Push extends BaseTopicCommand {
+  protected topicName = "push";
+  protected commandGroup = "push notification";
+
+  static override description =
+    "Manage push notifications, device registrations, and channel subscriptions";
+
+  static override examples = [
+    "<%= config.bin %> <%= command.id %> devices list",
+    "<%= config.bin %> <%= command.id %> devices save --id my-device --platform android --form-factor phone --transport-type fcm --device-token TOKEN",
+    "<%= config.bin %> <%= command.id %> channels save --channel alerts --device-id my-device",
+    '<%= config.bin %> <%= command.id %> publish --device-id my-device --title "Hello" --body "World"',
+  ];
+}
diff --git a/src/commands/push/publish.ts b/src/commands/push/publish.ts
new file mode 100644
index 00000000..51be0d70
--- /dev/null
+++ b/src/commands/push/publish.ts
@@ -0,0 +1,303 @@
+import { Flags } from "@oclif/core";
+import { AblyBaseCommand } from "../../base-command.js";
+import chalk from "chalk";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+export default class PushPublish extends AblyBaseCommand {
+  static override description =
+    "Publish a push notification directly to device(s) or client(s) (maps to push.admin.publish)";
+
+  static override examples = [
+    // Simple notification to a device
+    '$ ably push publish --device-id my-device --title "Hello" --body "World"',
+    // Notification to all devices of a client
+    '$ ably push publish --recipient-client-id user-123 --title "Alert" --body "New message"',
+    // With custom data payload
+    '$ ably push publish --device-id my-device --title "Order" --body "Shipped" --data \'{"orderId":"123"}\'',
+    // iOS-specific with badge
+    '$ ably push publish --device-id my-device --title "Messages" --body "3 unread" --badge 3',
+    // Full payload from file
+    "$ ably push publish --device-id my-device --payload ./notification.json",
+    // Full payload inline
+    '$ ably push publish --device-id my-device --payload \'{"notification":{"title":"Hi","body":"Hello"}}\'',
+  ];
+
+  static override flags = {
+    ...AblyBaseCommand.globalFlags,
+    "device-id": Flags.string({
+      description: "Target device ID",
+    }),
+    "recipient-client-id": Flags.string({
+      description: "Target client ID (sends to all client's devices)",
+    }),
+    title: Flags.string({
+      description: "Notification title",
+    }),
+    body: Flags.string({
+      description: "Notification body",
+    }),
+    sound: Flags.string({
+      description: "Notification sound (default, or filename)",
+    }),
+    icon: Flags.string({
+      description: "Notification icon (Android/Web)",
+    }),
+    badge: Flags.integer({
+      description: "Badge count (iOS)",
+    }),
+    data: Flags.string({
+      description: "Custom data payload as JSON string",
+    }),
+    payload: Flags.string({
+      description:
+        "Full notification payload as JSON string or path to JSON file",
+    }),
+    "collapse-key": Flags.string({
+      description: "Collapse key for notification grouping",
+    }),
+    ttl: Flags.integer({
+      description: "Time-to-live in seconds",
+    }),
+    apns: Flags.string({
+      description: "APNs-specific overrides as JSON",
+    }),
+    fcm: Flags.string({
+      description: "FCM-specific overrides as JSON",
+    }),
+    web: Flags.string({
+      description: "Web Push-specific overrides as JSON",
+    }),
+  };
+
+  async run(): Promise<void> {
+    const { flags } = await this.parse(PushPublish);
+
+    // Validate recipient
+    if (!flags["device-id"] && !flags["recipient-client-id"]) {
+      this.error(
+        "Either --device-id or --recipient-client-id must be specified",
+      );
+    }
+
+    if (flags["device-id"] && flags["recipient-client-id"]) {
+      this.error(
+        "Only one of --device-id or --recipient-client-id can be specified, not both",
+      );
+    }
+
+    // Validate payload options
+    // When using --payload, all other notification flags are ignored since --payload
+    // provides the complete notification structure
+    const notificationFlags = [
+      "title",
+      "body",
+      "sound",
+      "icon",
+      "badge",
+      "data",
+      "collapse-key",
+      "ttl",
+      "apns",
+      "fcm",
+      "web",
+    ];
+    const usedNotificationFlags = notificationFlags.filter(
+      (flag) => flags[flag] !== undefined,
+    );
+
+    if (flags.payload && usedNotificationFlags.length > 0) {
+      this.error(
+        `Cannot use --payload with ${usedNotificationFlags.map((f) => `--${f}`).join(", ")}. ` +
+          `Use --payload for full control OR individual flags for simple notifications, not both.`,
+      );
+    }
+
+    if (!flags.payload && !flags.title && !flags.body) {
+      this.error(
+        "Either --payload or at least one of --title/--body must be specified",
+      );
+    }
+
+    try {
+      const rest = await this.createAblyRestClient(flags);
+      if (!rest) {
+        return;
+      }
+
+      // Build recipient
+      const recipient: Record<string, string> = {};
+      if (flags["device-id"]) {
+        recipient.deviceId = flags["device-id"];
+      } else if (flags["recipient-client-id"]) {
+        recipient.clientId = flags["recipient-client-id"];
+      }
+
+      // Build payload
+      let pushPayload: Record<string, unknown>;
+
+      if (flags.payload) {
+        pushPayload = this.parsePayload(flags.payload);
+      } else {
+        pushPayload = this.buildPayload(flags);
+      }
+
+      // Publish the notification
+      await rest.push.admin.publish(recipient, pushPayload);
+
+      if (this.shouldOutputJson(flags)) {
+        this.log(
+          this.formatJsonOutput(
+            {
+              recipient: {
+                deviceId: flags["device-id"],
+                clientId: flags["recipient-client-id"],
+              },
+              published: true,
+              success: true,
+              timestamp: new Date().toISOString(),
+            },
+            flags,
+          ),
+        );
+      } else {
+        const target = flags["device-id"]
+          ? `device ${chalk.cyan(flags["device-id"])}`
+          : `client ${chalk.cyan(flags["recipient-client-id"])}`;
+
+        this.log(
+          chalk.green(`Push notification sent successfully to ${target}`),
+        );
+
+        if (flags.title) {
+          this.log(`${chalk.dim("Title:")} ${flags.title}`);
+        }
+
+        if (flags.body) {
+          this.log(`${chalk.dim("Body:")}  ${flags.body}`);
+        }
+      }
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      const errorCode = (error as { code?: number }).code;
+
+      if (this.shouldOutputJson(flags)) {
+        this.jsonError(
+          {
+            error: errorMessage,
+            code: errorCode,
+            success: false,
+          },
+          flags,
+        );
+      } else {
+        if (errorCode === 40400) {
+          this.error(
+            `Device or client not found. Ensure the device/client is registered first.`,
+          );
+        } else {
+          this.error(`Error publishing notification: ${errorMessage}`);
+        }
+      }
+    }
+  }
+
+  private parsePayload(payload: string): Record<string, unknown> {
+    let jsonString = payload;
+
+    // Check if it's a file path
+    if (!payload.trim().startsWith("{") && !payload.trim().startsWith("[")) {
+      const filePath = path.resolve(payload);
+
+      if (!fs.existsSync(filePath)) {
+        throw new Error(`File not found: ${filePath}`);
+      }
+
+      jsonString = fs.readFileSync(filePath, "utf8");
+    }
+
+    try {
+      return JSON.parse(jsonString) as Record<string, unknown>;
+    } catch {
+      throw new Error("Invalid JSON format in --payload");
+    }
+  }
+
+  private buildPayload(
+    flags: Record<string, unknown>,
+  ): Record<string, unknown> {
+    const payload: Record<string, unknown> = {};
+
+    // Build notification object
+    const notification: Record<string, unknown> = {};
+
+    if (flags.title) {
+      notification.title = flags.title as string;
+    }
+
+    if (flags.body) {
+      notification.body = flags.body as string;
+    }
+
+    if (flags.sound) {
+      notification.sound = flags.sound as string;
+    }
+
+    if (flags.icon) {
+      notification.icon = flags.icon as string;
+    }
+
+    if (flags.badge !== undefined) {
+      notification.badge = flags.badge as number;
+    }
+
+    if (flags["collapse-key"]) {
+      notification.collapseKey = flags["collapse-key"] as string;
+    }
+
+    if (flags.ttl !== undefined) {
+      notification.ttl = flags.ttl as number;
+    }
+
+    if (Object.keys(notification).length > 0) {
+      payload.notification = notification;
+    }
+
+    // Add custom data
+    if (flags.data) {
+      try {
+        payload.data = JSON.parse(flags.data as string);
+      } catch {
+        throw new Error("Invalid JSON format in --data");
+      }
+    }
+
+    // Add platform-specific overrides
+    if (flags.apns) {
+      try {
+        payload.apns = JSON.parse(flags.apns as string);
+      } catch {
+        throw new Error("Invalid JSON format in --apns");
+      }
+    }
+
+    if (flags.fcm) {
+      try {
+        payload.fcm = JSON.parse(flags.fcm as string);
+      } catch {
+        throw new Error("Invalid JSON format in --fcm");
+      }
+    }
+
+    if (flags.web) {
+      try {
+        payload.web = JSON.parse(flags.web as string);
+      } catch {
+        throw new Error("Invalid JSON format in --web");
+      }
+    }
+
+    return payload;
+  }
+}
diff --git a/src/services/control-api.ts b/src/services/control-api.ts
index b4d22ecd..af479b5f 100644
--- a/src/services/control-api.ts
+++ b/src/services/control-api.ts
@@ -1,4 +1,4 @@
-import fetch, { type RequestInit } from "node-fetch";
+import fetch, { type RequestInit, FormData, Blob } from "node-fetch";
 import { getCliVersion } from "../utils/version.js";
 import isTestMode from "../utils/test-mode.js";
 
@@ -11,7 +11,11 @@ export interface ControlApiOptions {
 export interface App {
   accountId: string;
   apnsUsesSandboxCert?: boolean;
+  // New push config response fields (from Control API updates)
+  apnsAuthType?: "certificate" | "token" | null;
+  apnsUseSandboxEndpoint?: boolean | null;
   created: number;
+  fcmProjectId?: string | null;
   id: string;
   modified: number;
   name: string;
@@ -484,24 +488,58 @@ export class ControlApi {
   // Upload Apple Push Notification Service P12 certificate for an app
   async uploadApnsP12(
     appId: string,
-    certificateData: string,
+    certificateData: Buffer,
     options: {
       password?: string;
-      useForSandbox?: boolean;
     } = {},
   ): Promise<{ id: string }> {
-    const data = {
-      p12Certificate: certificateData,
-      password: options.password,
-      useForSandbox: options.useForSandbox,
-    };
+    // This endpoint requires multipart/form-data
+    const formData = new FormData();
 
-    // App ID-specific operations don't need account ID in the path
-    return this.request<{ id: string }>(
-      `/apps/${appId}/push/certificate`,
-      "POST",
-      data,
-    );
+    // Add the certificate file
+    const blob = new Blob([certificateData], {
+      type: "application/x-pkcs12",
+    });
+    formData.append("p12File", blob, "certificate.p12");
+
+    // Add the password (required by the API)
+    formData.append("p12Pass", options.password || "");
+
+    const url = this.controlHost.includes("local")
+      ? `http://${this.controlHost}/api/v1/apps/${appId}/pkcs12`
+      : `https://${this.controlHost}/v1/apps/${appId}/pkcs12`;
+
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.accessToken}`,
+        "Ably-Agent": `ably-cli/${getCliVersion()}`,
+      },
+      body: formData,
+    });
+
+    if (!response.ok) {
+      const responseBody = await response.text();
+      let responseData: unknown = responseBody;
+      try {
+        responseData = JSON.parse(responseBody);
+      } catch {
+        /* Ignore parsing errors */
+      }
+
+      let errorMessage = `API request failed (${response.status} ${response.statusText})`;
+      if (
+        typeof responseData === "object" &&
+        responseData !== null &&
+        "message" in responseData &&
+        typeof responseData.message === "string"
+      ) {
+        errorMessage += `: ${responseData.message}`;
+      }
+      throw new Error(errorMessage);
+    }
+
+    return (await response.json()) as { id: string };
   }
 
   private async request<T>(
diff --git a/test/e2e/push/channels-e2e.test.ts b/test/e2e/push/channels-e2e.test.ts
new file mode 100644
index 00000000..8963439f
--- /dev/null
+++ b/test/e2e/push/channels-e2e.test.ts
@@ -0,0 +1,197 @@
+import {
+  describe,
+  it,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll,
+  expect,
+} from "vitest";
+import * as Ably from "ably";
+import {
+  E2E_API_KEY,
+  SHOULD_SKIP_E2E,
+  forceExit,
+  cleanupTrackedResources,
+  setupTestFailureHandler,
+  resetTestTracking,
+  createAblyClient,
+} from "../../helpers/e2e-test-helper.js";
+import { runCommand } from "../../helpers/command-helpers.js";
+
+describe.skipIf(SHOULD_SKIP_E2E)("Push Channel Subscriptions E2E Tests", () => {
+  let testDeviceIdBase: string;
+  let client: Ably.Rest;
+  let testDeviceId: string;
+
+  beforeAll(async () => {
+    process.on("SIGINT", forceExit);
+
+    // Generate unique device ID base for this test run
+    testDeviceIdBase = `cli-e2e-channel-test-${Date.now()}`;
+    testDeviceId = `${testDeviceIdBase}-device`;
+
+    // Create Ably client for verification
+    client = createAblyClient();
+
+    // Create a test device for subscription tests
+    await client.push.admin.deviceRegistrations.save({
+      id: testDeviceId,
+      platform: "android",
+      formFactor: "phone",
+      clientId: "e2e-channel-test-user",
+      push: {
+        recipient: {
+          transportType: "fcm",
+          registrationToken: `fake-fcm-channel-test-${Date.now()}`,
+        },
+      },
+    });
+  });
+
+  afterAll(async () => {
+    // Cleanup test device
+    try {
+      await client.push.admin.deviceRegistrations.remove(testDeviceId);
+    } catch {
+      // Ignore cleanup errors
+    }
+
+    process.removeListener("SIGINT", forceExit);
+  });
+
+  beforeEach(() => {
+    resetTestTracking();
+  });
+
+  afterEach(async () => {
+    setupTestFailureHandler();
+    await cleanupTrackedResources();
+  });
+
+  describe("push channels save - validation", () => {
+    it("should error when neither device-id nor client-id provided", async () => {
+      const result = await runCommand(
+        ["push", "channels", "save", "--channel", "test-channel"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "Either --device-id or --recipient-client-id must be specified",
+      );
+    });
+
+    it("should error when both device-id and client-id provided", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "channels",
+          "save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "device1",
+          "--recipient-client-id",
+          "client1",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "Only one of --device-id or --recipient-client-id can be specified",
+      );
+    });
+  });
+
+  describe("push channels list - validation", () => {
+    it("should require --channel flag", async () => {
+      const result = await runCommand(["push", "channels", "list"], {
+        env: { ABLY_API_KEY: E2E_API_KEY || "" },
+        timeoutMs: 30000,
+      });
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("Missing required flag channel");
+    });
+  });
+
+  describe("push channels list-channels", () => {
+    it("should list channels (may be empty if no push subscriptions)", async () => {
+      const result = await runCommand(["push", "channels", "list-channels"], {
+        env: { ABLY_API_KEY: E2E_API_KEY || "" },
+        timeoutMs: 30000,
+      });
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Channels with Push Subscriptions");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const result = await runCommand(
+        ["push", "channels", "list-channels", "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.channels).toBeInstanceOf(Array);
+    });
+  });
+
+  describe("push channels remove - validation", () => {
+    it("should error when neither device-id nor client-id provided", async () => {
+      const result = await runCommand(
+        ["push", "channels", "remove", "--channel", "test-channel", "--force"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "Either --device-id or --recipient-client-id must be specified",
+      );
+    });
+  });
+
+  describe("push channels remove-where - validation", () => {
+    it("should require at least one filter criterion", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "channels",
+          "remove-where",
+          "--channel",
+          "test-channel",
+          "--force",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("At least one filter criterion");
+    });
+  });
+
+  // Note: Tests that require push-enabled channels are not included here
+  // because the test environment doesn't have push configured for channels.
+  // The validation tests above verify the CLI command structure is correct.
+  // Full integration tests would require a push-enabled namespace configuration.
+});
diff --git a/test/e2e/push/devices-e2e.test.ts b/test/e2e/push/devices-e2e.test.ts
new file mode 100644
index 00000000..aa5ebbfd
--- /dev/null
+++ b/test/e2e/push/devices-e2e.test.ts
@@ -0,0 +1,505 @@
+import {
+  describe,
+  it,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll,
+  expect,
+} from "vitest";
+import * as Ably from "ably";
+import {
+  E2E_API_KEY,
+  SHOULD_SKIP_E2E,
+  forceExit,
+  cleanupTrackedResources,
+  setupTestFailureHandler,
+  resetTestTracking,
+  createAblyClient,
+} from "../../helpers/e2e-test-helper.js";
+import { runCommand } from "../../helpers/command-helpers.js";
+
+describe.skipIf(SHOULD_SKIP_E2E)("Push Devices E2E Tests", () => {
+  let testDeviceIdBase: string;
+  let client: Ably.Rest;
+
+  beforeAll(async () => {
+    process.on("SIGINT", forceExit);
+
+    // Generate unique device ID base for this test run
+    testDeviceIdBase = `cli-e2e-test-${Date.now()}`;
+
+    // Create Ably client for verification
+    client = createAblyClient();
+  });
+
+  afterAll(() => {
+    process.removeListener("SIGINT", forceExit);
+  });
+
+  beforeEach(() => {
+    // Clear tracked commands and output files before each test
+    resetTestTracking();
+  });
+
+  afterEach(async () => {
+    // Set up failure handler for debug output
+    setupTestFailureHandler();
+    await cleanupTrackedResources();
+  });
+
+  describe("push devices save", () => {
+    it("should register an Android device with FCM token", async () => {
+      const deviceId = `${testDeviceIdBase}-android-save`;
+      const fakeToken = `fake-fcm-token-${Date.now()}`;
+
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "save",
+          "--id",
+          deviceId,
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          fakeToken,
+          "--recipient-client-id",
+          "e2e-test-user",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Device registered successfully");
+      expect(result.stdout).toContain(deviceId);
+      expect(result.stdout).toContain("android");
+
+      // Verify with SDK
+      const device = await client.push.admin.deviceRegistrations.get(deviceId);
+      expect(device.id).toBe(deviceId);
+      expect(device.platform).toBe("android");
+      expect(device.formFactor).toBe("phone");
+      expect(device.clientId).toBe("e2e-test-user");
+
+      // Cleanup
+      await client.push.admin.deviceRegistrations.remove(deviceId);
+    });
+
+    it("should register an iOS device with APNs token", async () => {
+      const deviceId = `${testDeviceIdBase}-ios-save`;
+      const fakeToken = `fake-apns-token-${Date.now()}`;
+
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "save",
+          "--id",
+          deviceId,
+          "--platform",
+          "ios",
+          "--form-factor",
+          "tablet",
+          "--transport-type",
+          "apns",
+          "--device-token",
+          fakeToken,
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Device registered successfully");
+      expect(result.stdout).toContain("ios");
+      expect(result.stdout).toContain("tablet");
+
+      // Cleanup
+      await client.push.admin.deviceRegistrations.remove(deviceId);
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const deviceId = `${testDeviceIdBase}-json-save`;
+      const fakeToken = `fake-fcm-token-json-${Date.now()}`;
+
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "save",
+          "--id",
+          deviceId,
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          fakeToken,
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.device).toBeDefined();
+      expect(json.device.id).toBe(deviceId);
+      expect(json.device.platform).toBe("android");
+
+      // Cleanup
+      await client.push.admin.deviceRegistrations.remove(deviceId);
+    });
+  });
+
+  describe("push devices get", () => {
+    let testDeviceId: string;
+
+    beforeAll(async () => {
+      // Create a test device for get tests
+      testDeviceId = `${testDeviceIdBase}-get-test`;
+      await client.push.admin.deviceRegistrations.save({
+        id: testDeviceId,
+        platform: "android",
+        formFactor: "phone",
+        clientId: "e2e-get-test-user",
+        push: {
+          recipient: {
+            transportType: "fcm",
+            registrationToken: `fake-token-get-${Date.now()}`,
+          },
+        },
+      });
+    });
+
+    afterAll(async () => {
+      // Cleanup test device
+      try {
+        await client.push.admin.deviceRegistrations.remove(testDeviceId);
+      } catch {
+        // Ignore cleanup errors
+      }
+    });
+
+    it("should get device details by ID", async () => {
+      const result = await runCommand(
+        ["push", "devices", "get", testDeviceId],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Device Details");
+      expect(result.stdout).toContain(testDeviceId);
+      expect(result.stdout).toContain("android");
+      expect(result.stdout).toContain("phone");
+      expect(result.stdout).toContain("e2e-get-test-user");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const result = await runCommand(
+        ["push", "devices", "get", testDeviceId, "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.device).toBeDefined();
+      expect(json.device.id).toBe(testDeviceId);
+      expect(json.device.platform).toBe("android");
+      expect(json.device.clientId).toBe("e2e-get-test-user");
+    });
+
+    it("should handle non-existent device", async () => {
+      const result = await runCommand(
+        ["push", "devices", "get", "non-existent-device-12345"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      // Command should fail with non-zero exit code
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("not found");
+    });
+  });
+
+  describe("push devices list", () => {
+    const listTestDevices: string[] = [];
+
+    beforeAll(async () => {
+      // Create multiple test devices for list tests
+      for (let i = 0; i < 3; i++) {
+        const deviceId = `${testDeviceIdBase}-list-${i}`;
+        listTestDevices.push(deviceId);
+
+        await client.push.admin.deviceRegistrations.save({
+          id: deviceId,
+          platform: i % 2 === 0 ? "android" : "ios",
+          formFactor: "phone",
+          clientId: "e2e-list-test-user",
+          push: {
+            recipient: {
+              transportType: i % 2 === 0 ? "fcm" : "apns",
+              ...(i % 2 === 0
+                ? { registrationToken: `fake-fcm-list-${i}-${Date.now()}` }
+                : { deviceToken: `fake-apns-list-${i}-${Date.now()}` }),
+            },
+          },
+        });
+      }
+    });
+
+    afterAll(async () => {
+      // Cleanup test devices
+      for (const deviceId of listTestDevices) {
+        try {
+          await client.push.admin.deviceRegistrations.remove(deviceId);
+        } catch {
+          // Ignore cleanup errors
+        }
+      }
+    });
+
+    it("should list devices", async () => {
+      const result = await runCommand(["push", "devices", "list"], {
+        env: { ABLY_API_KEY: E2E_API_KEY || "" },
+        timeoutMs: 30000,
+      });
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Found");
+      expect(result.stdout).toContain("device");
+    });
+
+    it("should filter by client ID", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "list",
+          "--recipient-client-id",
+          "e2e-list-test-user",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      // All our test devices have this client ID
+      for (const deviceId of listTestDevices) {
+        expect(result.stdout).toContain(deviceId);
+      }
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "list",
+          "--recipient-client-id",
+          "e2e-list-test-user",
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.devices).toBeInstanceOf(Array);
+      expect(json.devices.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it("should respect --limit flag", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "list",
+          "--recipient-client-id",
+          "e2e-list-test-user",
+          "--limit",
+          "2",
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.devices.length).toBeLessThanOrEqual(2);
+    });
+  });
+
+  describe("push devices remove", () => {
+    it("should remove a device by ID", async () => {
+      const deviceId = `${testDeviceIdBase}-remove-test`;
+
+      // First create a device
+      await client.push.admin.deviceRegistrations.save({
+        id: deviceId,
+        platform: "android",
+        formFactor: "phone",
+        push: {
+          recipient: {
+            transportType: "fcm",
+            registrationToken: `fake-remove-${Date.now()}`,
+          },
+        },
+      });
+
+      // Remove using CLI with --force to skip confirmation
+      const result = await runCommand(
+        ["push", "devices", "remove", deviceId, "--force"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("removed successfully");
+      expect(result.stdout).toContain(deviceId);
+
+      // Verify device is gone
+      await expect(
+        client.push.admin.deviceRegistrations.get(deviceId),
+      ).rejects.toMatchObject({ code: 40400 });
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const deviceId = `${testDeviceIdBase}-remove-json`;
+
+      // First create a device
+      await client.push.admin.deviceRegistrations.save({
+        id: deviceId,
+        platform: "ios",
+        formFactor: "phone",
+        push: {
+          recipient: {
+            transportType: "apns",
+            deviceToken: `fake-remove-json-${Date.now()}`,
+          },
+        },
+      });
+
+      const result = await runCommand(
+        ["push", "devices", "remove", deviceId, "--force", "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.removed).toBe(true);
+      expect(json.deviceId).toBe(deviceId);
+    });
+  });
+
+  describe("push devices remove-where", () => {
+    it("should remove devices by client ID", async () => {
+      const clientIdForRemoval = `e2e-remove-where-${Date.now()}`;
+      const deviceIds: string[] = [];
+
+      // Create multiple devices with same client ID
+      for (let i = 0; i < 2; i++) {
+        const deviceId = `${testDeviceIdBase}-remove-where-${i}`;
+        deviceIds.push(deviceId);
+
+        await client.push.admin.deviceRegistrations.save({
+          id: deviceId,
+          platform: "android",
+          formFactor: "phone",
+          clientId: clientIdForRemoval,
+          push: {
+            recipient: {
+              transportType: "fcm",
+              registrationToken: `fake-remove-where-${i}-${Date.now()}`,
+            },
+          },
+        });
+      }
+
+      // Remove using CLI
+      const result = await runCommand(
+        [
+          "push",
+          "devices",
+          "remove-where",
+          "--recipient-client-id",
+          clientIdForRemoval,
+          "--force",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("removed successfully");
+
+      // Verify all devices are gone
+      for (const deviceId of deviceIds) {
+        await expect(
+          client.push.admin.deviceRegistrations.get(deviceId),
+        ).rejects.toMatchObject({ code: 40400 });
+      }
+    });
+
+    it("should require at least one filter criterion", async () => {
+      const result = await runCommand(
+        ["push", "devices", "remove-where", "--force"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "At least one filter criterion is required",
+      );
+    });
+  });
+});
diff --git a/test/e2e/push/publish-e2e.test.ts b/test/e2e/push/publish-e2e.test.ts
new file mode 100644
index 00000000..23ee17a7
--- /dev/null
+++ b/test/e2e/push/publish-e2e.test.ts
@@ -0,0 +1,360 @@
+import {
+  describe,
+  it,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll,
+  expect,
+} from "vitest";
+import * as Ably from "ably";
+import {
+  E2E_API_KEY,
+  SHOULD_SKIP_E2E,
+  forceExit,
+  cleanupTrackedResources,
+  setupTestFailureHandler,
+  resetTestTracking,
+  createAblyClient,
+} from "../../helpers/e2e-test-helper.js";
+import { runCommand } from "../../helpers/command-helpers.js";
+
+describe.skipIf(SHOULD_SKIP_E2E)("Push Publish E2E Tests", () => {
+  let testDeviceId: string;
+  let client: Ably.Rest;
+
+  beforeAll(async () => {
+    process.on("SIGINT", forceExit);
+
+    // Generate unique device ID for this test run
+    testDeviceId = `cli-e2e-publish-test-${Date.now()}`;
+
+    // Create Ably client
+    client = createAblyClient();
+
+    // Create a test device for publish tests
+    await client.push.admin.deviceRegistrations.save({
+      id: testDeviceId,
+      platform: "android",
+      formFactor: "phone",
+      clientId: "e2e-publish-test-user",
+      push: {
+        recipient: {
+          transportType: "fcm",
+          registrationToken: `fake-fcm-publish-test-${Date.now()}`,
+        },
+      },
+    });
+  });
+
+  afterAll(async () => {
+    // Cleanup test device
+    try {
+      await client.push.admin.deviceRegistrations.remove(testDeviceId);
+    } catch {
+      // Ignore cleanup errors
+    }
+
+    process.removeListener("SIGINT", forceExit);
+  });
+
+  beforeEach(() => {
+    resetTestTracking();
+  });
+
+  afterEach(async () => {
+    setupTestFailureHandler();
+    await cleanupTrackedResources();
+  });
+
+  describe("push publish", () => {
+    it("should publish a simple notification to a device", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          testDeviceId,
+          "--title",
+          "Test Title",
+          "--body",
+          "Test Body",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("sent successfully");
+      expect(result.stdout).toContain(testDeviceId);
+    });
+
+    it("should publish with JSON output", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          testDeviceId,
+          "--title",
+          "JSON Test",
+          "--body",
+          "Testing JSON output",
+          "--json",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.published).toBe(true);
+      expect(json.recipient.deviceId).toBe(testDeviceId);
+    });
+
+    it("should publish with custom data payload", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          testDeviceId,
+          "--title",
+          "Data Test",
+          "--body",
+          "With custom data",
+          "--data",
+          '{"orderId":"12345","action":"view"}',
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("sent successfully");
+    });
+
+    it("should publish with full payload", async () => {
+      const payload = JSON.stringify({
+        notification: {
+          title: "Full Payload Test",
+          body: "Testing full payload",
+        },
+        data: {
+          key: "value",
+        },
+      });
+
+      const result = await runCommand(
+        ["push", "publish", "--device-id", testDeviceId, "--payload", payload],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("sent successfully");
+    });
+
+    it("should publish to a client ID", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--recipient-client-id",
+          "e2e-publish-test-user",
+          "--title",
+          "Client Test",
+          "--body",
+          "To client",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("sent successfully");
+      expect(result.stdout).toContain("e2e-publish-test-user");
+    });
+
+    it("should error when neither device-id nor client-id provided", async () => {
+      const result = await runCommand(
+        ["push", "publish", "--title", "Test", "--body", "Test"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "Either --device-id or --recipient-client-id must be specified",
+      );
+    });
+
+    it("should error when both device-id and client-id provided", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          "device1",
+          "--recipient-client-id",
+          "client1",
+          "--title",
+          "Test",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain(
+        "Only one of --device-id or --recipient-client-id can be specified",
+      );
+    });
+
+    it("should error when no payload or title/body provided", async () => {
+      const result = await runCommand(
+        ["push", "publish", "--device-id", testDeviceId],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("--payload");
+    });
+
+    it("should error when payload and title both provided", async () => {
+      const result = await runCommand(
+        [
+          "push",
+          "publish",
+          "--device-id",
+          testDeviceId,
+          "--payload",
+          '{"notification":{"title":"Test"}}',
+          "--title",
+          "Conflict",
+        ],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("Cannot use --payload with --title");
+    });
+  });
+
+  describe("push batch-publish", () => {
+    it("should batch publish notifications", async () => {
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: testDeviceId },
+          payload: { notification: { title: "Batch 1", body: "First" } },
+        },
+        {
+          recipient: { deviceId: testDeviceId },
+          payload: { notification: { title: "Batch 2", body: "Second" } },
+        },
+      ]);
+
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", batchPayload],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+      expect(result.stdout).toContain("Batch Push Results");
+      expect(result.stdout).toContain("Total:");
+      expect(result.stdout).toContain("2");
+    });
+
+    it("should batch publish with JSON output", async () => {
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: testDeviceId },
+          payload: { notification: { title: "JSON Batch", body: "Test" } },
+        },
+      ]);
+
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", batchPayload, "--json"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.total).toBe(1);
+      expect(json.results).toBeInstanceOf(Array);
+    });
+
+    it("should error with invalid batch payload format", async () => {
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", '{"not":"an array"}'],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      // Check for part of the error message (full message may wrap across lines)
+      expect(result.stderr).toContain("must be a JSON");
+    });
+
+    it("should error with empty batch payload", async () => {
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", "[]"],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("empty");
+    });
+
+    it("should error with missing recipient in batch item", async () => {
+      const batchPayload = JSON.stringify([
+        { payload: { notification: { title: "No recipient" } } },
+      ]);
+
+      const result = await runCommand(
+        ["push", "batch-publish", "--payload", batchPayload],
+        {
+          env: { ABLY_API_KEY: E2E_API_KEY || "" },
+          timeoutMs: 30000,
+        },
+      );
+
+      expect(result.exitCode).not.toBe(0);
+      expect(result.stderr).toContain("recipient");
+    });
+  });
+});
diff --git a/test/fixtures/push/README.md b/test/fixtures/push/README.md
new file mode 100644
index 00000000..8273b2c0
--- /dev/null
+++ b/test/fixtures/push/README.md
@@ -0,0 +1,31 @@
+# Push Notifications Test Fixtures
+
+These are **FAKE test files** for testing the CLI's push configuration commands.
+They contain fake/invalid credentials that won't work with real push services.
+
+## Files
+
+| File | Purpose | Used by |
+|------|---------|---------|
+| `test-fcm-service-account.json` | Firebase Cloud Messaging service account | `push config set-fcm` |
+| `test-apns-key.p8` | APNs Token Auth signing key | `push config set-apns --p8-key` |
+| `test-apns-cert.pem` | APNs Certificate Auth - PEM certificate | `push config set-apns --certificate` |
+| `test-apns-private-key.pem` | APNs Certificate Auth - PEM private key | `push config set-apns --private-key` |
+
+## Usage in Tests
+
+These fixtures are used by unit tests to validate file parsing and command behavior
+without making actual API calls. The Ably Control API validates credentials with
+the push services (Google/Apple), so these fake credentials will be accepted by
+the CLI but rejected by the API.
+
+## Test Values
+
+### FCM
+- Project ID: `test-project-12345`
+- Client Email: `firebase-adminsdk-test@test-project-12345.iam.gserviceaccount.com`
+
+### APNs Token Auth
+- Key ID: `ABC123DEFG`
+- Team ID: `TEAM123456`
+- Topic: `com.example.testapp`
diff --git a/test/fixtures/push/test-apns-cert.pem b/test/fixtures/push/test-apns-cert.pem
new file mode 100644
index 00000000..c3afd90e
--- /dev/null
+++ b/test/fixtures/push/test-apns-cert.pem
@@ -0,0 +1,8 @@
+-----BEGIN CERTIFICATE-----
+MIICpDCCAYwCCQDU+pQ4P9K5TjANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
+b2NhbGhvc3QwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjAUMRIwEAYD
+VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
+TestCertificateDataForDevelopmentPurposesOnlyDoNotUseInProduction
+ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuv
+wxyz0123456789TestCertificateDataForDevelopmentPurposesOnly
+-----END CERTIFICATE-----
diff --git a/test/fixtures/push/test-apns-key.p8 b/test/fixtures/push/test-apns-key.p8
new file mode 100644
index 00000000..f3a07487
--- /dev/null
+++ b/test/fixtures/push/test-apns-key.p8
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgTestKeyForDevelopment
+OnlyDoNotUseInProductionAbCdEfGhIjKlMnOpQrStUvWxYz0123456789abcdefg
+hijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ01234oA
+oGCCqGSM49AwEHoUQDQgAETestPublicKeyDataHereForTestingPurposesOnly
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/push/test-apns-private-key.pem b/test/fixtures/push/test-apns-private-key.pem
new file mode 100644
index 00000000..4c9f9ee5
--- /dev/null
+++ b/test/fixtures/push/test-apns-private-key.pem
@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC7TestPrivateKey
+DataForDevelopmentPurposesOnlyDoNotUseInProductionABCDEFGHIJKLMNOP
+QRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz0123456789Test
+PrivateKeyDataForDevelopmentPurposesOnlyDoNotUseInProduction
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/push/test-fcm-service-account.json b/test/fixtures/push/test-fcm-service-account.json
new file mode 100644
index 00000000..a0be1def
--- /dev/null
+++ b/test/fixtures/push/test-fcm-service-account.json
@@ -0,0 +1,12 @@
+{
+  "type": "service_account",
+  "project_id": "test-project-12345",
+  "private_key_id": "abc123def456ghi789jkl012mno345pqr678stu9",
+  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC7test\nkeydata1234567890abcdefghijklmnopqrstuvwxyzABCDEFGH\nIJKLMNOPQRSTUVWXYZ0123456789testprivatekeyfor\ndevelopmentpurposesonlydonotuseinproduction\n-----END PRIVATE KEY-----\n",
+  "client_email": "firebase-adminsdk-test@test-project-12345.iam.gserviceaccount.com",
+  "client_id": "123456789012345678901",
+  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+  "token_uri": "https://oauth2.googleapis.com/token",
+  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/firebase-adminsdk-test%40test-project-12345.iam.gserviceaccount.com"
+}
diff --git a/test/helpers/mock-ably-rest.ts b/test/helpers/mock-ably-rest.ts
index 04403248..4fad3008 100644
--- a/test/helpers/mock-ably-rest.ts
+++ b/test/helpers/mock-ably-rest.ts
@@ -74,14 +74,17 @@ export interface MockPush {
     publish: Mock;
     channelSubscriptions: {
       list: Mock;
+      listChannels: Mock;
       save: Mock;
       remove: Mock;
+      removeWhere: Mock;
     };
     deviceRegistrations: {
       list: Mock;
       get: Mock;
       save: Mock;
       remove: Mock;
+      removeWhere: Mock;
     };
   };
 }
@@ -185,15 +188,20 @@ function createMockPush(): MockPush {
     admin: {
       publish: vi.fn().mockImplementation(async () => {}),
       channelSubscriptions: {
-        list: vi.fn().mockResolvedValue({ items: [] }),
+        list: vi.fn().mockResolvedValue({ items: [], hasNext: () => false }),
+        listChannels: vi
+          .fn()
+          .mockResolvedValue({ items: [], hasNext: () => false }),
         save: vi.fn().mockImplementation(async () => {}),
         remove: vi.fn().mockImplementation(async () => {}),
+        removeWhere: vi.fn().mockImplementation(async () => {}),
       },
       deviceRegistrations: {
-        list: vi.fn().mockResolvedValue({ items: [] }),
+        list: vi.fn().mockResolvedValue({ items: [], hasNext: () => false }),
         get: vi.fn().mockResolvedValue(null),
         save: vi.fn().mockImplementation(async () => {}),
         remove: vi.fn().mockImplementation(async () => {}),
+        removeWhere: vi.fn().mockImplementation(async () => {}),
       },
     },
   };
diff --git a/test/unit/commands/apps/set-apns-p12.test.ts b/test/unit/commands/apps/set-apns-p12.test.ts
deleted file mode 100644
index 5ceb4bab..00000000
--- a/test/unit/commands/apps/set-apns-p12.test.ts
+++ /dev/null
@@ -1,166 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { runCommand } from "@oclif/test";
-import nock from "nock";
-import { resolve } from "node:path";
-import { mkdirSync, writeFileSync, existsSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { getMockConfigManager } from "../../../helpers/mock-config-manager.js";
-
-describe("apps:set-apns-p12 command", () => {
-  let testTempDir: string;
-  let testCertFile: string;
-
-  beforeEach(() => {
-    // Create temp directory for test certificate file
-    testTempDir = resolve(tmpdir(), `ably-cli-test-apns-p12-${Date.now()}`);
-    mkdirSync(testTempDir, { recursive: true, mode: 0o700 });
-
-    // Create a fake certificate file
-    testCertFile = resolve(testTempDir, "test-cert.p12");
-    writeFileSync(testCertFile, "fake-certificate-data");
-  });
-
-  afterEach(() => {
-    nock.cleanAll();
-
-    if (existsSync(testTempDir)) {
-      rmSync(testTempDir, { recursive: true, force: true });
-    }
-  });
-
-  describe("successful certificate upload", () => {
-    it("should upload APNS P12 certificate successfully", async () => {
-      const appId = getMockConfigManager().getCurrentAppId()!;
-      nock("https://control.ably.net")
-        .post(`/v1/apps/${appId}/push/certificate`)
-        .reply(200, {
-          id: "cert-123",
-          appId,
-        });
-
-      const { stdout } = await runCommand(
-        ["apps:set-apns-p12", appId, "--certificate", testCertFile],
-        import.meta.url,
-      );
-
-      expect(stdout).toContain("APNS P12 certificate uploaded successfully");
-    });
-
-    it("should upload certificate with password", async () => {
-      const appId = getMockConfigManager().getCurrentAppId()!;
-      nock("https://control.ably.net")
-        .post(`/v1/apps/${appId}/push/certificate`)
-        .reply(200, {
-          id: "cert-123",
-          appId,
-        });
-
-      const { stdout } = await runCommand(
-        [
-          "apps:set-apns-p12",
-          appId,
-          "--certificate",
-          testCertFile,
-          "--password",
-          "test-password",
-        ],
-        import.meta.url,
-      );
-
-      expect(stdout).toContain("APNS P12 certificate uploaded successfully");
-    });
-
-    it("should upload certificate for sandbox environment", async () => {
-      const appId = getMockConfigManager().getCurrentAppId()!;
-      nock("https://control.ably.net")
-        .post(`/v1/apps/${appId}/push/certificate`)
-        .reply(200, {
-          id: "cert-123",
-          appId,
-        });
-
-      const { stdout } = await runCommand(
-        [
-          "apps:set-apns-p12",
-          appId,
-          "--certificate",
-          testCertFile,
-          "--use-for-sandbox",
-        ],
-        import.meta.url,
-      );
-
-      expect(stdout).toContain("APNS P12 certificate uploaded successfully");
-      expect(stdout).toContain("Sandbox");
-    });
-  });
-
-  describe("error handling", () => {
-    it("should require app ID argument", async () => {
-      const { error } = await runCommand(
-        ["apps:set-apns-p12", "--certificate", testCertFile],
-        import.meta.url,
-      );
-
-      expect(error).toBeDefined();
-      expect(error!.message).toMatch(/Missing 1 required arg/);
-    });
-
-    it("should require certificate flag", async () => {
-      const appId = getMockConfigManager().getCurrentAppId()!;
-      const { error } = await runCommand(
-        ["apps:set-apns-p12", appId],
-        import.meta.url,
-      );
-
-      expect(error).toBeDefined();
-      expect(error!.message).toMatch(/Missing required flag.*certificate/);
-    });
-
-    it("should error when certificate file does not exist", async () => {
-      const appId = getMockConfigManager().getCurrentAppId()!;
-      const { error } = await runCommand(
-        [
-          "apps:set-apns-p12",
-          appId,
-          "--certificate",
-          "/nonexistent/path/cert.p12",
-        ],
-        import.meta.url,
-      );
-
-      expect(error).toBeDefined();
-      expect(error!.message).toMatch(/not found/);
-    });
-
-    it("should handle API errors", async () => {
-      const appId = getMockConfigManager().getCurrentAppId()!;
-      nock("https://control.ably.net")
-        .post(`/v1/apps/${appId}/push/certificate`)
-        .reply(400, { error: "Invalid certificate" });
-
-      const { error } = await runCommand(
-        ["apps:set-apns-p12", appId, "--certificate", testCertFile],
-        import.meta.url,
-      );
-
-      expect(error).toBeDefined();
-      expect(error!.message).toMatch(/400/);
-    });
-
-    it("should handle 401 authentication error", async () => {
-      const appId = getMockConfigManager().getCurrentAppId()!;
-      nock("https://control.ably.net")
-        .post(`/v1/apps/${appId}/push/certificate`)
-        .reply(401, { error: "Unauthorized" });
-
-      const { error } = await runCommand(
-        ["apps:set-apns-p12", appId, "--certificate", testCertFile],
-        import.meta.url,
-      );
-
-      expect(error).toBeDefined();
-      expect(error!.message).toMatch(/401/);
-    });
-  });
-});
diff --git a/test/unit/commands/push/batch-publish.test.ts b/test/unit/commands/push/batch-publish.test.ts
new file mode 100644
index 00000000..b98b24e4
--- /dev/null
+++ b/test/unit/commands/push/batch-publish.test.ts
@@ -0,0 +1,275 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../helpers/mock-ably-rest.js";
+
+describe("push:batch-publish command", () => {
+  beforeEach(() => {
+    // Set up default mock behavior for this test suite
+    const mock = getMockAblyRest();
+    mock.request.mockResolvedValue({
+      items: [],
+      statusCode: 200,
+      success: true,
+    });
+  });
+
+  describe("successful batch publish", () => {
+    it("should publish batch notifications with inline JSON", async () => {
+      const mock = getMockAblyRest();
+      mock.request.mockResolvedValue({
+        items: [{}, {}],
+        statusCode: 200,
+        success: true,
+      });
+
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: "device-1" },
+          payload: { notification: { title: "Hello 1" } },
+        },
+        {
+          recipient: { deviceId: "device-2" },
+          payload: { notification: { title: "Hello 2" } },
+        },
+      ]);
+
+      const { stdout } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload],
+        import.meta.url,
+      );
+
+      expect(mock.request).toHaveBeenCalledWith(
+        "POST",
+        "/push/batch/publish",
+        4,
+        {},
+        expect.arrayContaining([
+          expect.objectContaining({
+            recipient: { deviceId: "device-1" },
+            payload: { notification: { title: "Hello 1" } },
+          }),
+          expect.objectContaining({
+            recipient: { deviceId: "device-2" },
+            payload: { notification: { title: "Hello 2" } },
+          }),
+        ]),
+        {},
+      );
+      expect(stdout).toContain("2");
+      expect(stdout).toContain("Successful");
+    });
+
+    it("should handle mixed results (some failures)", async () => {
+      const mock = getMockAblyRest();
+      mock.request.mockResolvedValue({
+        items: [{}, { error: { message: "Device not found", code: 40400 } }],
+        statusCode: 200,
+        success: true,
+      });
+
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: "device-1" },
+          payload: { notification: { title: "Hello 1" } },
+        },
+        {
+          recipient: { deviceId: "non-existent" },
+          payload: { notification: { title: "Hello 2" } },
+        },
+      ]);
+
+      const { stdout } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Successful");
+      expect(stdout).toContain("Failed");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+      mock.request.mockResolvedValue({
+        items: [{}, {}],
+        statusCode: 200,
+        success: true,
+      });
+
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: "device-1" },
+          payload: { notification: { title: "Hello 1" } },
+        },
+        {
+          recipient: { clientId: "client-1" },
+          payload: { notification: { title: "Hello 2" } },
+        },
+      ]);
+
+      const { stdout } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload, "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.total).toBe(2);
+      expect(output.successful).toBe(2);
+      expect(output.failed).toBe(0);
+      expect(output.results).toHaveLength(2);
+    });
+
+    it("should support client ID recipients", async () => {
+      const mock = getMockAblyRest();
+      mock.request.mockResolvedValue({
+        items: [{}],
+        statusCode: 200,
+        success: true,
+      });
+
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { clientId: "user-123" },
+          payload: { notification: { title: "User notification" } },
+        },
+      ]);
+
+      const { stdout } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload],
+        import.meta.url,
+      );
+
+      expect(mock.request).toHaveBeenCalledWith(
+        "POST",
+        "/push/batch/publish",
+        4,
+        {},
+        expect.arrayContaining([
+          expect.objectContaining({
+            recipient: { clientId: "user-123" },
+          }),
+        ]),
+        {},
+      );
+      expect(stdout).toContain("Successful");
+    });
+  });
+
+  describe("validation", () => {
+    it("should require --payload flag", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*required.*flag.*payload/i);
+    });
+
+    it("should reject empty batch payload", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", "[]"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/empty/i);
+    });
+
+    it("should reject invalid JSON", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", "[{invalid-json}]"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/invalid json/i);
+    });
+
+    it("should reject non-array JSON", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", '{"not":"array"}'],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/must be.*json array/i);
+    });
+
+    it("should reject items without recipient", async () => {
+      const batchPayload = JSON.stringify([
+        { payload: { notification: { title: "Hello" } } },
+      ]);
+
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*recipient/i);
+    });
+
+    it("should reject items without recipient deviceId or clientId", async () => {
+      const batchPayload = JSON.stringify([
+        {
+          recipient: {},
+          payload: { notification: { title: "Hello" } },
+        },
+      ]);
+
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/deviceId.*clientId/i);
+    });
+
+    it("should reject items without payload", async () => {
+      const batchPayload = JSON.stringify([
+        { recipient: { deviceId: "device-1" } },
+      ]);
+
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*payload/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.request.mockRejectedValue(new Error("API Error"));
+
+      const batchPayload = JSON.stringify([
+        {
+          recipient: { deviceId: "device-1" },
+          payload: { notification: { title: "Hello" } },
+        },
+      ]);
+
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", batchPayload],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should report file not found error", async () => {
+      const { error } = await runCommand(
+        ["push:batch-publish", "--payload", "/non/existent/file.json"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/file not found/i);
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/list-channels.test.ts b/test/unit/commands/push/channels/list-channels.test.ts
new file mode 100644
index 00000000..c41939af
--- /dev/null
+++ b/test/unit/commands/push/channels/list-channels.test.ts
@@ -0,0 +1,95 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:channels:list-channels command", () => {
+  beforeEach(() => {
+    // Set up default mock behavior for this test suite
+    const mock = getMockAblyRest();
+    mock.push.admin.channelSubscriptions.listChannels.mockResolvedValue({
+      items: ["alerts", "notifications", "updates"],
+      hasNext: () => false,
+    });
+  });
+
+  describe("successful listing", () => {
+    it("should list channels with push subscriptions", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:channels:list-channels"],
+        import.meta.url,
+      );
+
+      expect(
+        mock.push.admin.channelSubscriptions.listChannels,
+      ).toHaveBeenCalledOnce();
+      expect(stdout).toContain("alerts");
+      expect(stdout).toContain("notifications");
+      expect(stdout).toContain("updates");
+    });
+
+    it("should respect --limit flag", async () => {
+      const mock = getMockAblyRest();
+
+      await runCommand(
+        ["push:channels:list-channels", "--limit", "50"],
+        import.meta.url,
+      );
+
+      expect(
+        mock.push.admin.channelSubscriptions.listChannels,
+      ).toHaveBeenCalledWith(expect.objectContaining({ limit: 50 }));
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:channels:list-channels", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.channels).toBeDefined();
+      expect(output.channels).toHaveLength(3);
+      expect(output.channels).toContain("alerts");
+      expect(output.count).toBe(3);
+      expect(
+        mock.push.admin.channelSubscriptions.listChannels,
+      ).toHaveBeenCalledOnce();
+    });
+
+    it("should handle empty result set", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.listChannels.mockResolvedValue({
+        items: [],
+        hasNext: () => false,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list-channels"],
+        import.meta.url,
+      );
+
+      expect(stdout).toMatch(/no.*channels.*found/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.listChannels.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:channels:list-channels"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/list.test.ts b/test/unit/commands/push/channels/list.test.ts
new file mode 100644
index 00000000..7501b152
--- /dev/null
+++ b/test/unit/commands/push/channels/list.test.ts
@@ -0,0 +1,160 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:channels:list command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.channelSubscriptions.list.mockReset();
+    mock.push.admin.channelSubscriptions.list.mockResolvedValue({
+      items: [
+        { channel: "alerts", deviceId: "device-1" },
+        { channel: "alerts", clientId: "client-1" },
+      ],
+      hasNext: () => false,
+    });
+  });
+
+  describe("successful listing", () => {
+    it("should list subscriptions for a channel", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:channels:list", "--channel", "alerts"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.list).toHaveBeenCalledWith(
+        expect.objectContaining({ channel: "alerts" }),
+      );
+      expect(stdout).toContain("device-1");
+      expect(stdout).toContain("client-1");
+    });
+
+    it("should filter by --device-id", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockResolvedValue({
+        items: [{ channel: "alerts", deviceId: "device-1" }],
+        hasNext: () => false,
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:list",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.list).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "alerts",
+          deviceId: "device-1",
+        }),
+      );
+      expect(stdout).toContain("device-1");
+    });
+
+    it("should filter by --recipient-client-id", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockResolvedValue({
+        items: [{ channel: "alerts", clientId: "client-1" }],
+        hasNext: () => false,
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:list",
+          "--channel",
+          "alerts",
+          "--recipient-client-id",
+          "client-1",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.list).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "alerts",
+          clientId: "client-1",
+        }),
+      );
+      expect(stdout).toContain("client-1");
+    });
+
+    it("should respect --limit flag", async () => {
+      const mock = getMockAblyRest();
+
+      await runCommand(
+        ["push:channels:list", "--channel", "alerts", "--limit", "50"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.list).toHaveBeenCalledWith(
+        expect.objectContaining({ limit: 50 }),
+      );
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:channels:list", "--channel", "alerts", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.subscriptions).toBeDefined();
+      expect(output.subscriptions).toHaveLength(2);
+      expect(output.count).toBe(2);
+      expect(mock.push.admin.channelSubscriptions.list).toHaveBeenCalledOnce();
+    });
+
+    it("should handle empty result set", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockResolvedValue({
+        items: [],
+        hasNext: () => false,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:channels:list", "--channel", "alerts"],
+        import.meta.url,
+      );
+
+      expect(stdout).toMatch(/no.*subscriptions.*found/i);
+    });
+  });
+
+  describe("validation", () => {
+    it("should require --channel flag", async () => {
+      const { error } = await runCommand(
+        ["push:channels:list"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*required.*flag.*channel/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.list.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:channels:list", "--channel", "alerts"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/remove-where.test.ts b/test/unit/commands/push/channels/remove-where.test.ts
new file mode 100644
index 00000000..e1e46105
--- /dev/null
+++ b/test/unit/commands/push/channels/remove-where.test.ts
@@ -0,0 +1,136 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:channels:remove-where command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.channelSubscriptions.removeWhere.mockReset();
+    mock.push.admin.channelSubscriptions.removeWhere.mockResolvedValue();
+  });
+
+  describe("successful removal", () => {
+    it("should remove subscriptions by --device-id with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove-where",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(
+        mock.push.admin.channelSubscriptions.removeWhere,
+      ).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "alerts",
+          deviceId: "device-1",
+        }),
+      );
+      expect(stdout).toContain("removed successfully");
+    });
+
+    it("should remove subscriptions by --recipient-client-id with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove-where",
+          "--channel",
+          "alerts",
+          "--recipient-client-id",
+          "client-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(
+        mock.push.admin.channelSubscriptions.removeWhere,
+      ).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "alerts",
+          clientId: "client-1",
+        }),
+      );
+      expect(stdout).toContain("removed successfully");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove-where",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+          "--force",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.removed).toBe(true);
+      expect(output.channel).toBe("alerts");
+      expect(output.deviceId).toBe("device-1");
+      expect(
+        mock.push.admin.channelSubscriptions.removeWhere,
+      ).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("validation", () => {
+    it("should require --channel flag", async () => {
+      const { error } = await runCommand(
+        ["push:channels:remove-where", "--device-id", "device-1", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*required.*flag.*channel/i);
+    });
+
+    it("should require at least one filter criterion", async () => {
+      const { error } = await runCommand(
+        ["push:channels:remove-where", "--channel", "alerts", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/filter.*required|device-id.*client-id/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.removeWhere.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:channels:remove-where",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/remove.test.ts b/test/unit/commands/push/channels/remove.test.ts
new file mode 100644
index 00000000..2303cb87
--- /dev/null
+++ b/test/unit/commands/push/channels/remove.test.ts
@@ -0,0 +1,175 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:channels:remove command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.channelSubscriptions.remove.mockReset();
+    mock.push.admin.channelSubscriptions.remove.mockResolvedValue();
+  });
+
+  describe("successful removal", () => {
+    it("should remove a device subscription with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.remove).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "alerts",
+          deviceId: "device-1",
+        }),
+      );
+      expect(stdout).toContain("removed successfully");
+    });
+
+    it("should remove a client subscription with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "alerts",
+          "--recipient-client-id",
+          "client-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.remove).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "alerts",
+          clientId: "client-1",
+        }),
+      );
+      expect(stdout).toContain("removed successfully");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+          "--force",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.removed).toBe(true);
+      expect(output.channel).toBe("alerts");
+      expect(output.deviceId).toBe("device-1");
+      expect(
+        mock.push.admin.channelSubscriptions.remove,
+      ).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("validation", () => {
+    it("should require --channel flag", async () => {
+      const { error } = await runCommand(
+        ["push:channels:remove", "--device-id", "device-1", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*required.*flag.*channel/i);
+    });
+
+    it("should require either --device-id or --recipient-client-id", async () => {
+      const { error } = await runCommand(
+        ["push:channels:remove", "--channel", "alerts", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(
+        /device-id.*client-id.*must be specified/i,
+      );
+    });
+
+    it("should not allow both --device-id and --recipient-client-id", async () => {
+      const { error } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+          "--recipient-client-id",
+          "client-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/only one.*not both/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle subscription not found (404)", async () => {
+      const mock = getMockAblyRest();
+      const error = new Error("Subscription not found");
+      (error as Error & { code: number }).code = 40400;
+      mock.push.admin.channelSubscriptions.remove.mockRejectedValue(error);
+
+      const { error: cmdError } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "non-existent-device",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(cmdError).toBeDefined();
+      expect(cmdError!.message).toMatch(/not found/i);
+    });
+
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.remove.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:channels:remove",
+          "--channel",
+          "alerts",
+          "--device-id",
+          "device-1",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/channels/save.test.ts b/test/unit/commands/push/channels/save.test.ts
new file mode 100644
index 00000000..8e14d6ae
--- /dev/null
+++ b/test/unit/commands/push/channels/save.test.ts
@@ -0,0 +1,197 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:channels:save command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.channelSubscriptions.save.mockReset();
+    mock.push.admin.channelSubscriptions.save.mockResolvedValue({
+      channel: "test-channel",
+      deviceId: "test-device-id",
+    });
+  });
+
+  describe("successful subscription", () => {
+    it("should subscribe a device to a channel", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "test-device-id",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.save).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "test-channel",
+          deviceId: "test-device-id",
+        }),
+      );
+      expect(stdout).toContain("Successfully subscribed");
+      expect(stdout).toContain("test-channel");
+    });
+
+    it("should subscribe a client to a channel", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.save.mockResolvedValue({
+        channel: "test-channel",
+        clientId: "test-client-id",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "test-channel",
+          "--recipient-client-id",
+          "test-client-id",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.channelSubscriptions.save).toHaveBeenCalledWith(
+        expect.objectContaining({
+          channel: "test-channel",
+          clientId: "test-client-id",
+        }),
+      );
+      expect(stdout).toContain("Successfully subscribed");
+      expect(stdout).toContain("test-client-id");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "test-device-id",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.subscription).toBeDefined();
+      expect(output.subscription.channel).toBe("test-channel");
+      expect(output.subscription.deviceId).toBe("test-device-id");
+      expect(mock.push.admin.channelSubscriptions.save).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("validation", () => {
+    it("should require --channel flag", async () => {
+      const { error } = await runCommand(
+        ["push:channels:save", "--device-id", "test-device-id"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*required.*flag.*channel/i);
+    });
+
+    it("should require either --device-id or --recipient-client-id", async () => {
+      const { error } = await runCommand(
+        ["push:channels:save", "--channel", "test-channel"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(
+        /device-id.*client-id.*must be specified/i,
+      );
+    });
+
+    it("should not allow both --device-id and --recipient-client-id", async () => {
+      const { error } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "device-1",
+          "--recipient-client-id",
+          "client-1",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/only one.*not both/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle push not enabled error (40100)", async () => {
+      const mock = getMockAblyRest();
+      const error = new Error("Push not enabled");
+      (error as Error & { code: number }).code = 40100;
+      mock.push.admin.channelSubscriptions.save.mockRejectedValue(error);
+
+      const { error: cmdError } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "test-device-id",
+        ],
+        import.meta.url,
+      );
+
+      expect(cmdError).toBeDefined();
+      expect(cmdError!.message).toMatch(/push not enabled/i);
+    });
+
+    it("should handle device/client not found error (40400)", async () => {
+      const mock = getMockAblyRest();
+      const error = new Error("Not found");
+      (error as Error & { code: number }).code = 40400;
+      mock.push.admin.channelSubscriptions.save.mockRejectedValue(error);
+
+      const { error: cmdError } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "non-existent-device",
+        ],
+        import.meta.url,
+      );
+
+      expect(cmdError).toBeDefined();
+      expect(cmdError!.message).toMatch(/not found/i);
+    });
+
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.channelSubscriptions.save.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:channels:save",
+          "--channel",
+          "test-channel",
+          "--device-id",
+          "test-device-id",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/clear-apns.test.ts b/test/unit/commands/push/config/clear-apns.test.ts
new file mode 100644
index 00000000..529b6afc
--- /dev/null
+++ b/test/unit/commands/push/config/clear-apns.test.ts
@@ -0,0 +1,185 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import nock from "nock";
+import { getMockConfigManager } from "../../../../helpers/mock-config-manager.js";
+
+// Helper to set up common mocks for Control API
+function setupControlApiMocks(
+  appId: string,
+  appConfig: Record<string, unknown> = {},
+) {
+  const mockConfig = getMockConfigManager();
+  const accountId = mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+  // Mock /me endpoint (called by listApps -> getMe)
+  nock("https://control.ably.net")
+    .get("/v1/me")
+    .reply(200, {
+      account: { id: accountId, name: "Test Account" },
+      user: { email: "test@example.com" },
+    });
+
+  // Mock listApps endpoint (called by getApp -> listApps)
+  nock("https://control.ably.net")
+    .get(`/v1/accounts/${accountId}/apps`)
+    .reply(200, [
+      {
+        id: appId,
+        name: "Test App",
+        ...appConfig,
+      },
+    ]);
+}
+
+describe("push:config:clear-apns command", () => {
+  afterEach(() => {
+    nock.cleanAll();
+  });
+
+  describe("when APNs is configured", () => {
+    it("should clear APNs configuration with --force flag", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      // Use apnsAuthType to indicate APNs is configured (new Control API field)
+      setupControlApiMocks(appId, {
+        apnsAuthType: "certificate",
+      });
+
+      // Mock updateApp to clear APNs
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-apns", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs configuration cleared successfully");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      // Use apnsAuthType to indicate APNs is configured (new Control API field)
+      setupControlApiMocks(appId, {
+        apnsAuthType: "certificate",
+      });
+
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-apns", "--force", "--json"],
+        import.meta.url,
+      );
+
+      // Extract JSON from output (command may log progress messages)
+      const jsonMatch = stdout.match(/\{[\s\S]*\}/);
+      expect(jsonMatch).not.toBeNull();
+      const output = JSON.parse(jsonMatch![0]);
+      expect(output.success).toBe(true);
+      expect(output.appId).toBe(appId);
+      expect(output.message).toBe("APNs configuration cleared");
+    });
+  });
+
+  describe("when APNs is not configured", () => {
+    it("should handle no APNs config to clear", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // No APNs configuration - apnsAuthType is null
+        apnsAuthType: null,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-apns", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toMatch(/no apns configuration/i);
+    });
+
+    it("should show message when no config exists in JSON mode", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // No APNs configuration - apnsAuthType is null
+        apnsAuthType: null,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-apns", "--force", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.message).toBe("No APNs configuration to clear");
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors when getting app info", async () => {
+      const mockConfig = getMockConfigManager();
+      const accountId =
+        mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+      // Mock /me endpoint
+      nock("https://control.ably.net")
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test Account" },
+          user: { email: "test@example.com" },
+        });
+
+      // Mock listApps to fail
+      nock("https://control.ably.net")
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(500, { error: "Server error" });
+
+      const { error } = await runCommand(
+        ["push:config:clear-apns", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/500/);
+    });
+
+    it("should handle API errors when clearing config", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      // Use apnsAuthType to indicate APNs is configured (new Control API field)
+      setupControlApiMocks(appId, {
+        apnsAuthType: "certificate",
+      });
+
+      nock("https://control.ably.net")
+        .patch(`/v1/apps/${appId}`)
+        .reply(400, { error: "Failed to update" });
+
+      const { error } = await runCommand(
+        ["push:config:clear-apns", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/400/);
+    });
+
+    it("should handle 401 authentication error", async () => {
+      // Mock /me to fail with 401
+      nock("https://control.ably.net")
+        .get("/v1/me")
+        .reply(401, { error: "Unauthorized" });
+
+      const { error } = await runCommand(
+        ["push:config:clear-apns", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/401/);
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/clear-fcm.test.ts b/test/unit/commands/push/config/clear-fcm.test.ts
new file mode 100644
index 00000000..86f046dd
--- /dev/null
+++ b/test/unit/commands/push/config/clear-fcm.test.ts
@@ -0,0 +1,163 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import nock from "nock";
+import { getMockConfigManager } from "../../../../helpers/mock-config-manager.js";
+
+// Helper to set up common mocks for Control API
+function setupControlApiMocks(
+  appId: string,
+  appConfig: Record<string, unknown> = {},
+) {
+  const mockConfig = getMockConfigManager();
+  const accountId = mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+  // Mock /me endpoint (called by listApps -> getMe)
+  nock("https://control.ably.net")
+    .get("/v1/me")
+    .reply(200, {
+      account: { id: accountId, name: "Test Account" },
+      user: { email: "test@example.com" },
+    });
+
+  // Mock listApps endpoint (called by getApp -> listApps)
+  nock("https://control.ably.net")
+    .get(`/v1/accounts/${accountId}/apps`)
+    .reply(200, [
+      {
+        id: appId,
+        name: "Test App",
+        ...appConfig,
+      },
+    ]);
+}
+
+describe("push:config:clear-fcm command", () => {
+  afterEach(() => {
+    nock.cleanAll();
+  });
+
+  describe("when FCM is configured", () => {
+    it("should clear FCM configuration with --force flag", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        fcmServiceAccount: "{ ... }",
+        fcmProjectId: "test-project",
+      });
+
+      // Mock updateApp to clear FCM
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-fcm", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("FCM configuration removed successfully");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        fcmServiceAccount: "{ ... }",
+        fcmProjectId: "test-project",
+      });
+
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-fcm", "--force", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.message).toBe("FCM configuration cleared");
+    });
+  });
+
+  describe("when FCM is not configured", () => {
+    it("should report that FCM is not configured", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // No FCM configuration
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:clear-fcm", "--force"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("FCM is not configured");
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors when getting app", async () => {
+      const mockConfig = getMockConfigManager();
+      const accountId =
+        mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+      // Mock /me endpoint
+      nock("https://control.ably.net")
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test Account" },
+          user: { email: "test@example.com" },
+        });
+
+      // Mock listApps to fail
+      nock("https://control.ably.net")
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(500, { error: "Internal server error" });
+
+      const { error } = await runCommand(
+        ["push:config:clear-fcm", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/500/);
+    });
+
+    it("should handle API errors when clearing FCM", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        fcmServiceAccount: "{ ... }",
+        fcmProjectId: "test-project",
+      });
+
+      nock("https://control.ably.net")
+        .patch(`/v1/apps/${appId}`)
+        .reply(400, { error: "Bad request" });
+
+      const { error } = await runCommand(
+        ["push:config:clear-fcm", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/400/);
+    });
+
+    it("should handle 401 authentication error", async () => {
+      // Mock /me to fail with 401
+      nock("https://control.ably.net")
+        .get("/v1/me")
+        .reply(401, { error: "Unauthorized" });
+
+      const { error } = await runCommand(
+        ["push:config:clear-fcm", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/401/);
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/set-apns.test.ts b/test/unit/commands/push/config/set-apns.test.ts
new file mode 100644
index 00000000..d643adb9
--- /dev/null
+++ b/test/unit/commands/push/config/set-apns.test.ts
@@ -0,0 +1,454 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import nock from "nock";
+import { resolve } from "node:path";
+import { mkdirSync, writeFileSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { getMockConfigManager } from "../../../../helpers/mock-config-manager.js";
+
+// Helper to set up common mocks for Control API
+function setupControlApiMocks(appId: string) {
+  const mockConfig = getMockConfigManager();
+  const accountId = mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+  // Mock /me endpoint (called by listApps -> getMe)
+  nock("https://control.ably.net")
+    .get("/v1/me")
+    .reply(200, {
+      account: { id: accountId, name: "Test Account" },
+      user: { email: "test@example.com" },
+    });
+
+  // Mock listApps endpoint (called by getApp -> listApps)
+  nock("https://control.ably.net")
+    .get(`/v1/accounts/${accountId}/apps`)
+    .reply(200, [
+      {
+        id: appId,
+        name: "Test App",
+      },
+    ]);
+}
+
+describe("push:config:set-apns command", () => {
+  let testTempDir: string;
+  let validP12File: string;
+  let validP8File: string;
+
+  beforeEach(() => {
+    // Create temp directory for test files
+    testTempDir = resolve(tmpdir(), `ably-cli-test-apns-${Date.now()}`);
+    mkdirSync(testTempDir, { recursive: true, mode: 0o700 });
+
+    // Create mock P12 certificate file (just needs to exist for validation)
+    validP12File = resolve(testTempDir, "cert.p12");
+    writeFileSync(validP12File, Buffer.from("mock p12 certificate data"));
+
+    // Create mock P8 key file
+    validP8File = resolve(testTempDir, "AuthKey.p8");
+    writeFileSync(
+      validP8File,
+      "-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgtest\n-----END PRIVATE KEY-----\n",
+    );
+  });
+
+  afterEach(() => {
+    nock.cleanAll();
+
+    if (existsSync(testTempDir)) {
+      rmSync(testTempDir, { recursive: true, force: true });
+    }
+  });
+
+  describe("certificate-based authentication (P12)", () => {
+    it("should configure APNs with P12 certificate", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net")
+        .post(`/v1/apps/${appId}/pkcs12`)
+        .reply(200, {
+          id: "cert-123",
+        });
+
+      // Mock updateApp call to set apnsUseSandboxEndpoint
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-apns", "--certificate", validP12File],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs P12 certificate uploaded successfully");
+      expect(stdout).toContain("Environment:");
+      expect(stdout).toContain("Production");
+    });
+
+    it("should configure APNs with P12 certificate and password", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net")
+        .post(`/v1/apps/${appId}/pkcs12`)
+        .reply(200, {
+          id: "cert-456",
+        });
+
+      // Mock updateApp call to set apnsUseSandboxEndpoint
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--certificate",
+          validP12File,
+          "--password",
+          "secret123",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs P12 certificate uploaded successfully");
+    });
+
+    it("should output JSON when --json flag is used with P12", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net")
+        .post(`/v1/apps/${appId}/pkcs12`)
+        .reply(200, {
+          id: "cert-789",
+        });
+
+      // Mock updateApp call to set apnsUseSandboxEndpoint
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-apns", "--certificate", validP12File, "--json"],
+        import.meta.url,
+      );
+
+      // Extract JSON from output (command may log progress messages)
+      const jsonMatch = stdout.match(/\{[\s\S]*\}/);
+      expect(jsonMatch).not.toBeNull();
+      const output = JSON.parse(jsonMatch![0]);
+      expect(output.success).toBe(true);
+      expect(output.authType).toBe("certificate");
+      expect(output.certificateId).toBe("cert-789");
+      expect(output.environment).toBe("Production");
+    });
+
+    it("should set sandbox endpoint when --use-sandbox flag is used with P12", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net")
+        .post(`/v1/apps/${appId}/pkcs12`)
+        .reply(200, {
+          id: "cert-sandbox",
+        });
+
+      // Verify that apnsUseSandboxEndpoint is set to true
+      let capturedBody: Record<string, unknown> | undefined;
+      nock("https://control.ably.net")
+        .patch(`/v1/apps/${appId}`, (body: Record<string, unknown>) => {
+          capturedBody = body;
+          return true;
+        })
+        .reply(200, {
+          id: appId,
+          name: "Test App",
+        });
+
+      const { stdout } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--certificate",
+          validP12File,
+          "--use-sandbox",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("APNs P12 certificate uploaded successfully");
+      expect(stdout).toContain("Environment:");
+      expect(stdout).toContain("Sandbox");
+      expect(capturedBody).toBeDefined();
+      expect(capturedBody!.apnsUseSandboxEndpoint).toBe(true);
+    });
+  });
+
+  describe("token-based authentication (P8)", () => {
+    it("should configure APNs with token-based auth", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          validP8File,
+          "--key-id",
+          "ABC123XYZ",
+          "--team-id",
+          "TEAMID123",
+          "--bundle-id",
+          "com.example.app",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain(
+        "APNs token-based authentication configured successfully",
+      );
+    });
+
+    it("should send correct API field names for token auth", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      // Verify the correct field names are sent to the API
+      // Per Control API spec:
+      // - apnsAuthType: "token"
+      // - apnsSigningKey: The .p8 key content
+      // - apnsSigningKeyId: The Key ID
+      // - apnsIssuerKey: The Team ID
+      // - apnsTopicHeader: The Bundle ID
+      let capturedBody: Record<string, unknown> | undefined;
+      nock("https://control.ably.net")
+        .patch(`/v1/apps/${appId}`, (body: Record<string, unknown>) => {
+          capturedBody = body;
+          return true;
+        })
+        .reply(200, {
+          id: appId,
+          name: "Test App",
+        });
+
+      await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          validP8File,
+          "--key-id",
+          "ABC123XYZ",
+          "--team-id",
+          "TEAMID123",
+          "--bundle-id",
+          "com.example.app",
+        ],
+        import.meta.url,
+      );
+
+      // Verify the correct field names were sent
+      expect(capturedBody).toBeDefined();
+      expect(capturedBody!.apnsAuthType).toBe("token");
+      expect(capturedBody!.apnsSigningKeyId).toBe("ABC123XYZ");
+      expect(capturedBody!.apnsIssuerKey).toBe("TEAMID123");
+      expect(capturedBody!.apnsTopicHeader).toBe("com.example.app");
+      expect(capturedBody!.apnsSigningKey).toContain("BEGIN PRIVATE KEY");
+      // Verify old incorrect field names are NOT present
+      expect(capturedBody!.applePushKeyId).toBeUndefined();
+      expect(capturedBody!.applePushTeamId).toBeUndefined();
+      expect(capturedBody!.applePushBundleId).toBeUndefined();
+    });
+
+    it("should output JSON when --json flag is used with P8", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          validP8File,
+          "--key-id",
+          "ABC123XYZ",
+          "--team-id",
+          "TEAMID123",
+          "--bundle-id",
+          "com.example.app",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      // Extract JSON from output (command may log progress messages)
+      const jsonMatch = stdout.match(/\{[\s\S]*\}/);
+      expect(jsonMatch).not.toBeNull();
+      const output = JSON.parse(jsonMatch![0]);
+      expect(output.success).toBe(true);
+      expect(output.authType).toBe("token");
+      expect(output.keyId).toBe("ABC123XYZ");
+      expect(output.teamId).toBe("TEAMID123");
+      expect(output.bundleId).toBe("com.example.app");
+    });
+  });
+
+  describe("validation", () => {
+    it("should require either --certificate or --key-file", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-apns"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/--certificate.*--key-file.*must be/i);
+    });
+
+    it("should not allow both --certificate and --key-file", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--certificate",
+          validP12File,
+          "--key-file",
+          validP8File,
+          "--key-id",
+          "ABC123",
+          "--team-id",
+          "TEAM123",
+          "--bundle-id",
+          "com.example",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/cannot use both/i);
+    });
+
+    it("should require all token auth params when using --key-file", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          validP8File,
+          "--key-id",
+          "ABC123",
+          // Missing --team-id and --bundle-id
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(
+        /--key-file.*--key-id.*--team-id.*--bundle-id/i,
+      );
+    });
+
+    it("should error when certificate file does not exist", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-apns", "--certificate", "/nonexistent/cert.p12"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/not found/i);
+    });
+
+    it("should error when key file does not exist", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          "/nonexistent/key.p8",
+          "--key-id",
+          "ABC123",
+          "--team-id",
+          "TEAM123",
+          "--bundle-id",
+          "com.example",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/not found/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle P12 upload API errors", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net")
+        .post(`/v1/apps/${appId}/pkcs12`)
+        .reply(400, { error: "Invalid certificate" });
+
+      const { error } = await runCommand(
+        ["push:config:set-apns", "--certificate", validP12File],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/400/);
+    });
+
+    it("should handle token auth API errors", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      nock("https://control.ably.net")
+        .patch(`/v1/apps/${appId}`)
+        .reply(400, { error: "Invalid configuration" });
+
+      const { error } = await runCommand(
+        [
+          "push:config:set-apns",
+          "--key-file",
+          validP8File,
+          "--key-id",
+          "ABC123XYZ",
+          "--team-id",
+          "TEAMID123",
+          "--bundle-id",
+          "com.example.app",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/400/);
+    });
+
+    it("should handle 401 authentication error", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId);
+
+      // Mock pkcs12 endpoint to return 401
+      nock("https://control.ably.net")
+        .post(`/v1/apps/${appId}/pkcs12`)
+        .reply(401, { error: "Unauthorized" });
+
+      const { error } = await runCommand(
+        ["push:config:set-apns", "--certificate", validP12File],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/401/);
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/set-fcm.test.ts b/test/unit/commands/push/config/set-fcm.test.ts
new file mode 100644
index 00000000..6d843a49
--- /dev/null
+++ b/test/unit/commands/push/config/set-fcm.test.ts
@@ -0,0 +1,216 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import nock from "nock";
+import { resolve } from "node:path";
+import { mkdirSync, writeFileSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { getMockConfigManager } from "../../../../helpers/mock-config-manager.js";
+
+describe("push:config:set-fcm command", () => {
+  let testTempDir: string;
+  let validServiceAccountFile: string;
+  let invalidTypeFile: string;
+  let missingProjectIdFile: string;
+  let invalidJsonFile: string;
+
+  beforeEach(() => {
+    // Create temp directory for test files
+    testTempDir = resolve(tmpdir(), `ably-cli-test-fcm-${Date.now()}`);
+    mkdirSync(testTempDir, { recursive: true, mode: 0o700 });
+
+    // Create valid service account file
+    validServiceAccountFile = resolve(testTempDir, "valid-sa.json");
+    writeFileSync(
+      validServiceAccountFile,
+      JSON.stringify({
+        type: "service_account",
+        project_id: "test-project-123",
+        private_key_id: "key-id-123",
+        private_key:
+          "-----BEGIN PRIVATE KEY-----\ntest\n-----END PRIVATE KEY-----\n",
+        client_email:
+          "firebase-adminsdk@test-project-123.iam.gserviceaccount.com",
+        client_id: "123456789",
+        auth_uri: "https://accounts.google.com/o/oauth2/auth",
+        token_uri: "https://oauth2.googleapis.com/token",
+      }),
+    );
+
+    // Create file with wrong type
+    invalidTypeFile = resolve(testTempDir, "invalid-type.json");
+    writeFileSync(
+      invalidTypeFile,
+      JSON.stringify({
+        type: "wrong_type",
+        project_id: "test-project",
+      }),
+    );
+
+    // Create file missing project_id
+    missingProjectIdFile = resolve(testTempDir, "missing-project.json");
+    writeFileSync(
+      missingProjectIdFile,
+      JSON.stringify({
+        type: "service_account",
+      }),
+    );
+
+    // Create invalid JSON file
+    invalidJsonFile = resolve(testTempDir, "invalid.json");
+    writeFileSync(invalidJsonFile, "not valid json {{{");
+  });
+
+  afterEach(() => {
+    nock.cleanAll();
+
+    if (existsSync(testTempDir)) {
+      rmSync(testTempDir, { recursive: true, force: true });
+    }
+  });
+
+  describe("successful configuration", () => {
+    it("should configure FCM with valid service account", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-fcm", "--service-account", validServiceAccountFile],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("FCM credentials configured successfully");
+      expect(stdout).toContain("test-project-123");
+    });
+
+    it("should show client email in output", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:set-fcm", "--service-account", validServiceAccountFile],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain(
+        "firebase-adminsdk@test-project-123.iam.gserviceaccount.com",
+      );
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      nock("https://control.ably.net").patch(`/v1/apps/${appId}`).reply(200, {
+        id: appId,
+        name: "Test App",
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:config:set-fcm",
+          "--service-account",
+          validServiceAccountFile,
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.projectId).toBe("test-project-123");
+      expect(output.clientEmail).toBe(
+        "firebase-adminsdk@test-project-123.iam.gserviceaccount.com",
+      );
+    });
+  });
+
+  describe("error handling", () => {
+    it("should require service-account flag", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-fcm"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/Missing required flag.*service-account/);
+    });
+
+    it("should error when service account file does not exist", async () => {
+      const { error } = await runCommand(
+        [
+          "push:config:set-fcm",
+          "--service-account",
+          "/nonexistent/path/sa.json",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/not found/);
+    });
+
+    it("should error when file contains invalid JSON", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-fcm", "--service-account", invalidJsonFile],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/Invalid JSON/);
+    });
+
+    it("should error when service account type is wrong", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-fcm", "--service-account", invalidTypeFile],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/expected.*service_account/);
+    });
+
+    it("should error when project_id is missing", async () => {
+      const { error } = await runCommand(
+        ["push:config:set-fcm", "--service-account", missingProjectIdFile],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/missing.*project_id/);
+    });
+
+    it("should handle API errors", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      nock("https://control.ably.net")
+        .patch(`/v1/apps/${appId}`)
+        .reply(400, { error: "Invalid request" });
+
+      const { error } = await runCommand(
+        ["push:config:set-fcm", "--service-account", validServiceAccountFile],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/400/);
+    });
+
+    it("should handle 401 authentication error", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      nock("https://control.ably.net")
+        .patch(`/v1/apps/${appId}`)
+        .reply(401, { error: "Unauthorized" });
+
+      const { error } = await runCommand(
+        ["push:config:set-fcm", "--service-account", validServiceAccountFile],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/401/);
+    });
+  });
+});
diff --git a/test/unit/commands/push/config/show.test.ts b/test/unit/commands/push/config/show.test.ts
new file mode 100644
index 00000000..16e6a8f7
--- /dev/null
+++ b/test/unit/commands/push/config/show.test.ts
@@ -0,0 +1,265 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import nock from "nock";
+import { getMockConfigManager } from "../../../../helpers/mock-config-manager.js";
+
+// Helper to set up common mocks for Control API
+function setupControlApiMocks(
+  appId: string,
+  appConfig: Record<string, unknown> = {},
+) {
+  const mockConfig = getMockConfigManager();
+  const accountId = mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+  // Mock /me endpoint (called by listApps -> getMe)
+  nock("https://control.ably.net")
+    .get("/v1/me")
+    .reply(200, {
+      account: { id: accountId, name: "Test Account" },
+      user: { email: "test@example.com" },
+    });
+
+  // Mock listApps endpoint (called by getApp -> listApps)
+  nock("https://control.ably.net")
+    .get(`/v1/accounts/${accountId}/apps`)
+    .reply(200, [
+      {
+        id: appId,
+        name: "Test App",
+        ...appConfig,
+      },
+    ]);
+}
+
+describe("push:config:show command", () => {
+  afterEach(() => {
+    nock.cleanAll();
+  });
+
+  describe("show configuration", () => {
+    // Tests using NEW Control API response fields:
+    // - apnsAuthType: 'token' | 'certificate' | null
+    // - fcmProjectId: string | null
+    // - apnsUseSandboxEndpoint: boolean | null
+
+    it("should show push config with APNs certificate and FCM configured", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // New fields from Control API
+        apnsAuthType: "certificate",
+        apnsUseSandboxEndpoint: false,
+        fcmProjectId: "my-project-123",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Test App");
+      expect(stdout).toContain("APNs");
+      expect(stdout).toContain("Configured");
+      expect(stdout).toContain("FCM");
+      expect(stdout).toContain("Certificate-based");
+    });
+
+    it("should show APNs token-based auth type", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // New field: apnsAuthType indicates token-based auth
+        apnsAuthType: "token",
+        apnsUseSandboxEndpoint: true,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Token-based");
+      expect(stdout).toContain("Sandbox"); // Because apnsUseSandboxEndpoint is true
+    });
+
+    it("should show certificate-based auth type", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // New field: apnsAuthType indicates certificate-based auth
+        apnsAuthType: "certificate",
+        apnsUseSandboxEndpoint: false,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Certificate-based");
+      expect(stdout).toContain("Production"); // Because apnsUseSandboxEndpoint is false
+    });
+
+    it("should show not configured status when no config exists", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // New fields: null values indicate not configured
+        apnsAuthType: null,
+        fcmProjectId: null,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Not configured");
+    });
+
+    it("should output JSON with new response format", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        // New Control API response fields
+        apnsAuthType: "token",
+        apnsUseSandboxEndpoint: false,
+        fcmProjectId: "my-project-123",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.appId).toBe(appId);
+      expect(output.appName).toBe("Test App");
+      expect(output.apns.configured).toBe(true);
+      expect(output.apns.authType).toBe("token");
+      expect(output.apns.useSandbox).toBe(false);
+      expect(output.fcm.configured).toBe(true);
+      expect(output.fcm.projectId).toBe("my-project-123");
+    });
+
+    it("should output JSON when not configured", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        apnsAuthType: null,
+        fcmProjectId: null,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.apns.configured).toBe(false);
+      expect(output.apns.authType).toBe(null);
+      expect(output.fcm.configured).toBe(false);
+      expect(output.fcm.projectId).toBe(null);
+    });
+
+    it("should show FCM project ID when configured", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        fcmProjectId: "firebase-project-456",
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("firebase-project-456");
+    });
+
+    it("should show Web Push as available", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {});
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Web Push");
+      expect(stdout).toContain("Available");
+    });
+
+    it("should fallback to legacy apnsUsesSandboxCert when apnsUseSandboxEndpoint is not present", async () => {
+      const appId = getMockConfigManager().getCurrentAppId()!;
+      setupControlApiMocks(appId, {
+        apnsAuthType: "certificate",
+        // Legacy field only (for backwards compatibility)
+        apnsUsesSandboxCert: true,
+        // New field is undefined
+      });
+
+      const { stdout } = await runCommand(
+        ["push:config:show"],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Sandbox");
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mockConfig = getMockConfigManager();
+      const accountId =
+        mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+      // Mock /me endpoint
+      nock("https://control.ably.net")
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test Account" },
+          user: { email: "test@example.com" },
+        });
+
+      // Mock listApps to fail
+      nock("https://control.ably.net")
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(500, { error: "Server error" });
+
+      const { error } = await runCommand(["push:config:show"], import.meta.url);
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/500/);
+    });
+
+    it("should handle 401 authentication error", async () => {
+      // Mock /me to fail with 401
+      nock("https://control.ably.net")
+        .get("/v1/me")
+        .reply(401, { error: "Unauthorized" });
+
+      const { error } = await runCommand(["push:config:show"], import.meta.url);
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/401/);
+    });
+
+    it("should handle app not found error", async () => {
+      const mockConfig = getMockConfigManager();
+      const accountId =
+        mockConfig.getCurrentAccount()?.accountId || "test-account";
+
+      // Mock /me endpoint
+      nock("https://control.ably.net")
+        .get("/v1/me")
+        .reply(200, {
+          account: { id: accountId, name: "Test Account" },
+          user: { email: "test@example.com" },
+        });
+
+      // Mock listApps to return empty (app not found)
+      nock("https://control.ably.net")
+        .get(`/v1/accounts/${accountId}/apps`)
+        .reply(200, []);
+
+      const { error } = await runCommand(["push:config:show"], import.meta.url);
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/not found/i);
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/get.test.ts b/test/unit/commands/push/devices/get.test.ts
new file mode 100644
index 00000000..50580d54
--- /dev/null
+++ b/test/unit/commands/push/devices/get.test.ts
@@ -0,0 +1,118 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:devices:get command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.deviceRegistrations.get.mockReset();
+    mock.push.admin.deviceRegistrations.get.mockResolvedValue({
+      id: "test-device-id",
+      platform: "android",
+      formFactor: "phone",
+      clientId: "test-client",
+      push: {
+        state: "ACTIVE",
+        recipient: {
+          transportType: "fcm",
+          registrationToken: "fake-fcm-token-12345",
+        },
+      },
+    });
+  });
+
+  describe("successful retrieval", () => {
+    it("should get device details by ID", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:get", "test-device-id"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.get).toHaveBeenCalledWith(
+        "test-device-id",
+      );
+      expect(stdout).toContain("test-device-id");
+      expect(stdout).toContain("android");
+      expect(stdout).toContain("phone");
+    });
+
+    it("should display client ID when present", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:get", "test-device-id"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.get).toHaveBeenCalledOnce();
+      expect(stdout).toContain("test-client");
+    });
+
+    it("should redact device token in output", async () => {
+      const { stdout } = await runCommand(
+        ["push:devices:get", "test-device-id"],
+        import.meta.url,
+      );
+
+      // Token should be redacted
+      expect(stdout).toContain("redacted");
+      expect(stdout).not.toContain("fake-fcm-token-12345");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:get", "test-device-id", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.device).toBeDefined();
+      expect(output.device.id).toBe("test-device-id");
+      expect(output.device.platform).toBe("android");
+      expect(mock.push.admin.deviceRegistrations.get).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle device not found (404)", async () => {
+      const mock = getMockAblyRest();
+      const error = new Error("Device not found");
+      (error as Error & { code: number }).code = 40400;
+      mock.push.admin.deviceRegistrations.get.mockRejectedValue(error);
+
+      const { error: cmdError } = await runCommand(
+        ["push:devices:get", "non-existent-device"],
+        import.meta.url,
+      );
+
+      expect(cmdError).toBeDefined();
+      expect(cmdError!.message).toMatch(/not found/i);
+    });
+
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.get.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:devices:get", "test-device-id"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+
+    it("should require device ID argument", async () => {
+      const { error } = await runCommand(["push:devices:get"], import.meta.url);
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/Missing.*argument|device.*id/i);
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/list.test.ts b/test/unit/commands/push/devices/list.test.ts
new file mode 100644
index 00000000..fb7388b6
--- /dev/null
+++ b/test/unit/commands/push/devices/list.test.ts
@@ -0,0 +1,176 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:devices:list command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.deviceRegistrations.list.mockReset();
+    mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+      items: [
+        {
+          id: "device-1",
+          platform: "android",
+          formFactor: "phone",
+          clientId: "client-1",
+          push: { state: "ACTIVE" },
+        },
+        {
+          id: "device-2",
+          platform: "ios",
+          formFactor: "tablet",
+          push: { state: "ACTIVE" },
+        },
+      ],
+      hasNext: () => false,
+    });
+  });
+
+  describe("successful listing", () => {
+    it("should list all devices", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:list"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.list).toHaveBeenCalledOnce();
+      expect(stdout).toContain("device-1");
+      expect(stdout).toContain("device-2");
+      expect(stdout).toContain("android");
+      expect(stdout).toContain("ios");
+    });
+
+    it("should filter by --recipient-client-id", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [
+          {
+            id: "device-1",
+            platform: "android",
+            formFactor: "phone",
+            clientId: "client-1",
+            push: { state: "ACTIVE" },
+          },
+        ],
+        hasNext: () => false,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:list", "--recipient-client-id", "client-1"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.list).toHaveBeenCalledWith(
+        expect.objectContaining({ clientId: "client-1" }),
+      );
+      expect(stdout).toContain("device-1");
+    });
+
+    it("should filter by --device-id", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [
+          {
+            id: "device-1",
+            platform: "android",
+            formFactor: "phone",
+            push: { state: "ACTIVE" },
+          },
+        ],
+        hasNext: () => false,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:list", "--device-id", "device-1"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.list).toHaveBeenCalledWith(
+        expect.objectContaining({ deviceId: "device-1" }),
+      );
+      expect(stdout).toContain("device-1");
+    });
+
+    it("should respect --limit flag", async () => {
+      const mock = getMockAblyRest();
+
+      await runCommand(["push:devices:list", "--limit", "5"], import.meta.url);
+
+      expect(mock.push.admin.deviceRegistrations.list).toHaveBeenCalledWith(
+        expect.objectContaining({ limit: 5 }),
+      );
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:list", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.devices).toBeDefined();
+      expect(output.devices).toHaveLength(2);
+      expect(output.devices[0].id).toBe("device-1");
+      expect(mock.push.admin.deviceRegistrations.list).toHaveBeenCalledOnce();
+    });
+
+    it("should handle empty result set", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [],
+        hasNext: () => false,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:list"],
+        import.meta.url,
+      );
+
+      expect(stdout).toMatch(/no.*devices|0.*found/i);
+    });
+
+    it("should indicate when more results exist", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockResolvedValue({
+        items: [
+          {
+            id: "device-1",
+            platform: "android",
+            formFactor: "phone",
+            push: { state: "ACTIVE" },
+          },
+        ],
+        hasNext: () => true,
+      });
+
+      const { stdout } = await runCommand(
+        ["push:devices:list", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.hasMore).toBe(true);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.list.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:devices:list"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/remove-where.test.ts b/test/unit/commands/push/devices/remove-where.test.ts
new file mode 100644
index 00000000..5c4ca6d9
--- /dev/null
+++ b/test/unit/commands/push/devices/remove-where.test.ts
@@ -0,0 +1,107 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:devices:remove-where command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.deviceRegistrations.removeWhere.mockReset();
+    mock.push.admin.deviceRegistrations.removeWhere.mockResolvedValue();
+  });
+
+  describe("successful removal", () => {
+    it("should remove devices by --recipient-client-id with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:remove-where",
+          "--recipient-client-id",
+          "test-client",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(
+        mock.push.admin.deviceRegistrations.removeWhere,
+      ).toHaveBeenCalledWith(
+        expect.objectContaining({ clientId: "test-client" }),
+      );
+      expect(stdout).toContain("removed successfully");
+    });
+
+    it("should remove devices by --device-id with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:remove-where", "--device-id", "test-device", "--force"],
+        import.meta.url,
+      );
+
+      expect(
+        mock.push.admin.deviceRegistrations.removeWhere,
+      ).toHaveBeenCalledWith(
+        expect.objectContaining({ deviceId: "test-device" }),
+      );
+      expect(stdout).toContain("removed successfully");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:remove-where",
+          "--recipient-client-id",
+          "test-client",
+          "--force",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.removed).toBe(true);
+      expect(output.filter).toBeDefined();
+      expect(output.filter.clientId).toBe("test-client");
+      expect(
+        mock.push.admin.deviceRegistrations.removeWhere,
+      ).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("validation", () => {
+    it("should require at least one filter criterion", async () => {
+      const { error } = await runCommand(
+        ["push:devices:remove-where", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/filter.*required|client-id.*device-id/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.removeWhere.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:devices:remove-where",
+          "--recipient-client-id",
+          "test-client",
+          "--force",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/remove.test.ts b/test/unit/commands/push/devices/remove.test.ts
new file mode 100644
index 00000000..e1757b0e
--- /dev/null
+++ b/test/unit/commands/push/devices/remove.test.ts
@@ -0,0 +1,84 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:devices:remove command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.deviceRegistrations.remove.mockReset();
+    mock.push.admin.deviceRegistrations.remove.mockResolvedValue();
+  });
+
+  describe("successful removal", () => {
+    it("should remove a device by ID with --force", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:remove", "test-device-id", "--force"],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.remove).toHaveBeenCalledWith(
+        "test-device-id",
+      );
+      expect(stdout).toContain("removed successfully");
+      expect(stdout).toContain("test-device-id");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        ["push:devices:remove", "test-device-id", "--force", "--json"],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.deviceId).toBe("test-device-id");
+      expect(mock.push.admin.deviceRegistrations.remove).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("validation", () => {
+    it("should require device ID argument", async () => {
+      const { error } = await runCommand(
+        ["push:devices:remove", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/Missing.*argument|device.*id/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle device not found", async () => {
+      const mock = getMockAblyRest();
+      const error = new Error("Device not found");
+      (error as Error & { code: number }).code = 40400;
+      mock.push.admin.deviceRegistrations.remove.mockRejectedValue(error);
+
+      const { error: cmdError } = await runCommand(
+        ["push:devices:remove", "non-existent-device", "--force"],
+        import.meta.url,
+      );
+
+      expect(cmdError).toBeDefined();
+    });
+
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.remove.mockRejectedValue(
+        new Error("API Error"),
+      );
+
+      const { error } = await runCommand(
+        ["push:devices:remove", "test-device-id", "--force"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});
diff --git a/test/unit/commands/push/devices/save.test.ts b/test/unit/commands/push/devices/save.test.ts
new file mode 100644
index 00000000..d07080b9
--- /dev/null
+++ b/test/unit/commands/push/devices/save.test.ts
@@ -0,0 +1,336 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../../helpers/mock-ably-rest.js";
+
+describe("push:devices:save command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.deviceRegistrations.save.mockReset();
+    mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+      id: "test-device-id",
+      platform: "android",
+      formFactor: "phone",
+      push: {
+        state: "ACTIVE",
+        recipient: {
+          transportType: "fcm",
+          registrationToken: "fake-fcm-token",
+        },
+      },
+    });
+  });
+
+  describe("successful registration", () => {
+    it("should register an Android device with FCM", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device-id",
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          "fake-fcm-token",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.save).toHaveBeenCalledOnce();
+      expect(stdout).toContain("Device registered successfully");
+      expect(stdout).toContain("test-device-id");
+    });
+
+    it("should register an iOS device with APNs", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+        id: "ios-device-id",
+        platform: "ios",
+        formFactor: "tablet",
+        push: {
+          state: "ACTIVE",
+          recipient: {
+            transportType: "apns",
+            deviceToken: "fake-apns-token",
+          },
+        },
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "ios-device-id",
+          "--platform",
+          "ios",
+          "--form-factor",
+          "tablet",
+          "--transport-type",
+          "apns",
+          "--device-token",
+          "fake-apns-token",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.save).toHaveBeenCalledOnce();
+      expect(stdout).toContain("Device registered successfully");
+      expect(stdout).toContain("ios-device-id");
+    });
+
+    it("should register a browser device with web push", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+        id: "web-device-id",
+        platform: "browser",
+        formFactor: "desktop",
+        push: {
+          state: "ACTIVE",
+          recipient: {
+            transportType: "web",
+            targetUrl: "https://example.com/push",
+            encryptionKey: {
+              p256dh: "test-p256dh",
+              auth: "test-auth",
+            },
+          },
+        },
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "web-device-id",
+          "--platform",
+          "browser",
+          "--form-factor",
+          "desktop",
+          "--transport-type",
+          "web",
+          "--target-url",
+          "https://example.com/push",
+          "--p256dh-key",
+          "test-p256dh",
+          "--auth-secret",
+          "test-auth",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.deviceRegistrations.save).toHaveBeenCalledOnce();
+      expect(stdout).toContain("Device registered successfully");
+      expect(stdout).toContain("web-device-id");
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device-id",
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          "fake-fcm-token",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.device).toBeDefined();
+      expect(output.device.id).toBe("test-device-id");
+      expect(mock.push.admin.deviceRegistrations.save).toHaveBeenCalledOnce();
+    });
+
+    it("should include client ID when provided", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockResolvedValue({
+        id: "test-device-id",
+        clientId: "test-client",
+        platform: "android",
+        formFactor: "phone",
+        push: {
+          state: "ACTIVE",
+          recipient: {
+            transportType: "fcm",
+            registrationToken: "fake-fcm-token",
+          },
+        },
+      });
+
+      const { stdout } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device-id",
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          "fake-fcm-token",
+          "--recipient-client-id",
+          "test-client",
+        ],
+        import.meta.url,
+      );
+
+      expect(stdout).toContain("Client ID");
+      expect(stdout).toContain("test-client");
+    });
+  });
+
+  describe("validation errors", () => {
+    it("should require --device-token for FCM transport", async () => {
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device",
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/device-token.*required/i);
+    });
+
+    it("should require --device-token for APNs transport", async () => {
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device",
+          "--platform",
+          "ios",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "apns",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/device-token.*required/i);
+    });
+
+    it("should require --target-url for web transport", async () => {
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device",
+          "--platform",
+          "browser",
+          "--form-factor",
+          "desktop",
+          "--transport-type",
+          "web",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/target-url.*required/i);
+    });
+
+    it("should require --id flag", async () => {
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          "fake-token",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/--id.*required/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockRejectedValue(
+        new Error("API Error: Device registration failed"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device-id",
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          "fake-fcm-token",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/error/i);
+    });
+
+    it("should handle network errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.deviceRegistrations.save.mockRejectedValue(
+        new Error("Network error"),
+      );
+
+      const { error } = await runCommand(
+        [
+          "push:devices:save",
+          "--id",
+          "test-device-id",
+          "--platform",
+          "android",
+          "--form-factor",
+          "phone",
+          "--transport-type",
+          "fcm",
+          "--device-token",
+          "fake-fcm-token",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/network/i);
+    });
+  });
+});
diff --git a/test/unit/commands/push/publish.test.ts b/test/unit/commands/push/publish.test.ts
new file mode 100644
index 00000000..d7261569
--- /dev/null
+++ b/test/unit/commands/push/publish.test.ts
@@ -0,0 +1,338 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { runCommand } from "@oclif/test";
+import { getMockAblyRest } from "../../../helpers/mock-ably-rest.js";
+
+describe("push:publish command", () => {
+  beforeEach(() => {
+    const mock = getMockAblyRest();
+    mock.push.admin.publish.mockReset();
+    mock.push.admin.publish.mockResolvedValue();
+  });
+
+  describe("successful publish", () => {
+    it("should publish notification to a device", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--title",
+          "Hello",
+          "--body",
+          "World",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { deviceId: "test-device" },
+        expect.objectContaining({
+          notification: expect.objectContaining({
+            title: "Hello",
+            body: "World",
+          }),
+        }),
+      );
+      expect(stdout).toContain("sent successfully");
+      expect(stdout).toContain("test-device");
+    });
+
+    it("should publish notification to a client", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:publish",
+          "--recipient-client-id",
+          "test-client",
+          "--title",
+          "Alert",
+          "--body",
+          "Message",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { clientId: "test-client" },
+        expect.objectContaining({
+          notification: expect.objectContaining({
+            title: "Alert",
+            body: "Message",
+          }),
+        }),
+      );
+      expect(stdout).toContain("sent successfully");
+      expect(stdout).toContain("test-client");
+    });
+
+    it("should include optional notification fields", async () => {
+      const mock = getMockAblyRest();
+
+      await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--title",
+          "Test",
+          "--sound",
+          "default",
+          "--icon",
+          "notification_icon",
+          "--badge",
+          "5",
+          "--collapse-key",
+          "group1",
+          "--ttl",
+          "3600",
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { deviceId: "test-device" },
+        expect.objectContaining({
+          notification: expect.objectContaining({
+            title: "Test",
+            sound: "default",
+            icon: "notification_icon",
+            badge: 5,
+            collapseKey: "group1",
+            ttl: 3600,
+          }),
+        }),
+      );
+    });
+
+    it("should include custom data payload", async () => {
+      const mock = getMockAblyRest();
+
+      await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--title",
+          "Order",
+          "--data",
+          '{"orderId":"123","status":"shipped"}',
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { deviceId: "test-device" },
+        expect.objectContaining({
+          notification: expect.objectContaining({ title: "Order" }),
+          data: { orderId: "123", status: "shipped" },
+        }),
+      );
+    });
+
+    it("should include platform-specific overrides", async () => {
+      const mock = getMockAblyRest();
+
+      await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--title",
+          "Test",
+          "--apns",
+          '{"aps":{"alert":"custom"}}',
+          "--fcm",
+          '{"android":{"priority":"high"}}',
+          "--web",
+          '{"notification":{"requireInteraction":true}}',
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { deviceId: "test-device" },
+        expect.objectContaining({
+          apns: { aps: { alert: "custom" } },
+          fcm: { android: { priority: "high" } },
+          web: { notification: { requireInteraction: true } },
+        }),
+      );
+    });
+
+    it("should publish with inline JSON payload", async () => {
+      const mock = getMockAblyRest();
+
+      await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--payload",
+          '{"notification":{"title":"From payload","body":"Test body"}}',
+        ],
+        import.meta.url,
+      );
+
+      expect(mock.push.admin.publish).toHaveBeenCalledWith(
+        { deviceId: "test-device" },
+        { notification: { title: "From payload", body: "Test body" } },
+      );
+    });
+
+    it("should output JSON when --json flag is used", async () => {
+      const mock = getMockAblyRest();
+
+      const { stdout } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--title",
+          "Hello",
+          "--json",
+        ],
+        import.meta.url,
+      );
+
+      const output = JSON.parse(stdout);
+      expect(output.success).toBe(true);
+      expect(output.published).toBe(true);
+      expect(output.recipient.deviceId).toBe("test-device");
+      expect(mock.push.admin.publish).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe("validation", () => {
+    it("should require either --device-id or --recipient-client-id", async () => {
+      const { error } = await runCommand(
+        ["push:publish", "--title", "Hello"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(
+        /device-id.*client-id.*must be specified/i,
+      );
+    });
+
+    it("should not allow both --device-id and --recipient-client-id", async () => {
+      const { error } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "device-1",
+          "--recipient-client-id",
+          "client-1",
+          "--title",
+          "Hello",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/only one.*not both/i);
+    });
+
+    it("should require --payload or at least --title or --body", async () => {
+      const { error } = await runCommand(
+        ["push:publish", "--device-id", "test-device"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(
+        /payload.*title.*body.*must be specified/i,
+      );
+    });
+
+    it("should not allow --payload with --title or --body", async () => {
+      const { error } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--payload",
+          '{"notification":{}}',
+          "--title",
+          "Hello",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/cannot use --payload with --title/i);
+    });
+
+    it("should reject invalid JSON in --data", async () => {
+      const { error } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--title",
+          "Hello",
+          "--data",
+          "{invalid-json}",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/invalid json/i);
+    });
+
+    it("should reject invalid JSON in --payload", async () => {
+      const { error } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "test-device",
+          "--payload",
+          "{invalid-json}",
+        ],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+      expect(error!.message).toMatch(/invalid json/i);
+    });
+  });
+
+  describe("error handling", () => {
+    it("should handle device/client not found (404)", async () => {
+      const mock = getMockAblyRest();
+      const error = new Error("Device not found");
+      (error as Error & { code: number }).code = 40400;
+      mock.push.admin.publish.mockRejectedValue(error);
+
+      const { error: cmdError } = await runCommand(
+        [
+          "push:publish",
+          "--device-id",
+          "non-existent-device",
+          "--title",
+          "Hello",
+        ],
+        import.meta.url,
+      );
+
+      expect(cmdError).toBeDefined();
+      expect(cmdError!.message).toMatch(/not found/i);
+    });
+
+    it("should handle API errors", async () => {
+      const mock = getMockAblyRest();
+      mock.push.admin.publish.mockRejectedValue(new Error("API Error"));
+
+      const { error } = await runCommand(
+        ["push:publish", "--device-id", "test-device", "--title", "Hello"],
+        import.meta.url,
+      );
+
+      expect(error).toBeDefined();
+    });
+  });
+});