diff --git a/config/prod/services.yml b/config/prod/services.yml
index a1ec16643..064b5d328 100644
--- a/config/prod/services.yml
+++ b/config/prod/services.yml
@@ -33,6 +33,8 @@ services:
       - ../../src/DataStore/YamlStore.php
       - ../../src/DataStore/JsonDataStore.php
       - ../../src/CloudApi/AccessTokenConnector.php
+      # SourceConfig is instantiated by the command with the SAS client.
+      - ../../src/SasApi/SourceConfig.php
       - ../../src/Command/App/From/**
     public: true
     resource: ../../src
@@ -55,10 +57,23 @@ services:
       - ../../src/Command/Api/ApiBaseCommand.php
       - ../../src/Command/Api/ApiListCommand.php
       - ../../src/Command/Api/ApiListCommandBase.php
+      # The Source config commands inherit from ConfigCommandBase instead.
+      - ../../src/Command/Source/**
       - ../../src/Command/App/From/**
   Acquia\Cli\Command\CommandBase:
     abstract: true
 
+  # Source config commands share a common abstract base (which carries the
+  # same constructor as CommandBase plus the SAS client service).
+  Acquia\Cli\Command\Source\ConfigCommandBase:
+    abstract: true
+    parent: Acquia\Cli\Command\CommandBase
+  Acquia\Cli\Command\Source\:
+    resource: ../../src/Command/Source
+    parent: Acquia\Cli\Command\Source\ConfigCommandBase
+    exclude:
+      - ../../src/Command/Source/ConfigCommandBase.php
+
   Acquia\Cli\EventListener\ExceptionListener:
     tags:
       # @see Symfony\Component\Console\ConsoleEvents
@@ -79,6 +94,9 @@ services:
   acsf.credentials:
     class: Acquia\Cli\AcsfApi\AcsfCredentials
 
+  sas.credentials:
+    class: Acquia\Cli\SasApi\SasCredentials
+
   # AcquiaCloudApi services.
   Acquia\Cli\Command\Api\ApiCommandFactory: ~
   Acquia\Cli\Command\Api\ApiBaseCommand:
@@ -132,6 +150,22 @@ services:
     arguments:
       Acquia\Cli\ApiCredentialsInterface: '@acsf.credentials'
 
+  # Sites Aggregation Service (SAS) API services.
+  # SAS shares the Accounts authentication layer with the Cloud API, so it
+  # reuses the standard cloud credentials; only the base URI differs.
+  Acquia\Cli\SasApi\SasConnectorFactory:
+    arguments:
+      $config:
+        # @see https://symfony.com/doc/current/service_container/expression_language.html
+        key: '@=service("cloud.credentials").getCloudKey()'
+        secret: '@=service("cloud.credentials").getCloudSecret()'
+        accessToken: '@=service("cloud.credentials").getCloudAccessToken()'
+        accessTokenExpiry: '@=service("cloud.credentials").getCloudAccessTokenExpiry()'
+      $baseUri: '@=service("sas.credentials").getBaseUri()'
+      $accountsUri: '@=service("cloud.credentials").getAccountsUri()'
+  Acquia\Cli\SasApi\SasConnector:
+    alias: Acquia\Cli\SasApi\SasConnectorFactory
+
   # Symfony services.
   Acquia\Cli\Application:
       arguments:
diff --git a/src/Command/Source/ConfigCommandBase.php b/src/Command/Source/ConfigCommandBase.php
new file mode 100644
index 000000000..4f291765a
--- /dev/null
+++ b/src/Command/Source/ConfigCommandBase.php
@@ -0,0 +1,171 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Command\Source;
+
+use Acquia\Cli\ApiCredentialsInterface;
+use Acquia\Cli\CloudApi\ClientService;
+use Acquia\Cli\Command\CommandBase;
+use Acquia\Cli\DataStore\AcquiaCliDatastore;
+use Acquia\Cli\DataStore\CloudDataStore;
+use Acquia\Cli\Exception\AcquiaCliException;
+use Acquia\Cli\Helpers\LocalMachineHelper;
+use Acquia\Cli\Helpers\LoopHelper;
+use Acquia\Cli\Helpers\SshHelper;
+use Acquia\Cli\Helpers\TelemetryHelper;
+use Acquia\Cli\SasApi\SasClientService;
+use Acquia\Cli\SasApi\SourceConfig;
+use Psr\Log\LoggerInterface;
+use SelfUpdate\SelfUpdateManager;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+
+/**
+ * Base class for Source config commands.
+ *
+ * Both directions are thin triggers over the SAS API: they ask SAS to run a
+ * `drush source:config:*` command on the environment. Push (import) reads
+ * config from the site's git repository into the CMS; pull (export) does the
+ * reverse and returns the exported config for the command to write to disk.
+ * No push payload travels through these commands.
+ */
+abstract class ConfigCommandBase extends CommandBase
+{
+    public function __construct(
+        LocalMachineHelper $localMachineHelper,
+        CloudDataStore $datastoreCloud,
+        AcquiaCliDatastore $datastoreAcli,
+        ApiCredentialsInterface $cloudCredentials,
+        TelemetryHelper $telemetryHelper,
+        string $projectDir,
+        ClientService $cloudApiClientService,
+        SshHelper $sshHelper,
+        string $sshDir,
+        LoggerInterface $logger,
+        SelfUpdateManager $selfUpdateManager,
+        private readonly SasClientService $sasClient,
+    ) {
+        parent::__construct(
+            $localMachineHelper,
+            $datastoreCloud,
+            $datastoreAcli,
+            $cloudCredentials,
+            $telemetryHelper,
+            $projectDir,
+            $cloudApiClientService,
+            $sshHelper,
+            $sshDir,
+            $logger,
+            $selfUpdateManager,
+        );
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->acceptEnvironmentId()
+            ->acceptSiteInstanceId()
+            ->addOption('force', 'f', InputOption::VALUE_NONE, 'Do not ask for confirmation');
+    }
+
+    /**
+     * Trigger the config operation on the environment and return the decoded response.
+     */
+    abstract protected function triggerOperation(SourceConfig $sourceConfig, string $environmentId): object;
+
+    /**
+     * A short verb phrase describing the operation, e.g. "Importing configuration".
+     */
+    abstract protected function operationLabel(): string;
+
+    /**
+     * Handle a successfully completed operation.
+     *
+     * The default does nothing (push). Pull overrides this to fetch the
+     * exported payload and write it to disk.
+     *
+     * @infection-ignore-all ProtectedVisibility mutates this to private, which
+     *   is killed by the pull command overriding it, but Infection does not
+     *   attribute the subclass test's coverage back to this base declaration.
+     */
+    protected function onSuccess(SourceConfig $sourceConfig, string $operationId): int
+    {
+        $this->io->success($this->operationLabel() . ' completed successfully.');
+
+        return Command::SUCCESS;
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $this->setDirAndRequireProjectCwd($input);
+
+        $siteInstance = $this->determineSiteInstance($input);
+        if ($siteInstance === null) {
+            throw new AcquiaCliException(
+                'Could not determine a Source site instance. Run this command from a repository linked to an Acquia Cloud application, or pass --siteInstanceId.'
+            );
+        }
+
+        $environment = $siteInstance->environment;
+
+        if (!$input->getOption('force')) {
+            $answer = $this->io->confirm(
+                sprintf('%s on the %s environment?', $this->operationLabel(), $environment->name),
+                false,
+            );
+            if (!$answer) {
+                return Command::SUCCESS;
+            }
+        }
+
+        $sourceConfig = new SourceConfig($this->sasClient->getClient());
+
+        $response = $this->triggerOperation($sourceConfig, $environment->id);
+        // @todo DXBE-20: Confirm the operation ID field name with the SAS team.
+        $operationId = $response->id ?? null;
+        if (!is_string($operationId)) {
+            throw new AcquiaCliException('The SAS API response did not include an operation ID.');
+        }
+
+        $this->io->writeln(sprintf('%s submitted (operation %s). Waiting for it to complete...', $this->operationLabel(), $operationId));
+
+        if (!$this->waitForOperation($sourceConfig, $operationId)) {
+            return Command::FAILURE;
+        }
+
+        return $this->onSuccess($sourceConfig, $operationId);
+    }
+
+    /**
+     * Poll the operation until it leaves the in-progress states.
+     *
+     * @todo DXBE-20: Confirm the status field name and its values with the
+     *   SAS team. Assumes a `status` field mirroring the task gateway's
+     *   phases (pending/running/succeeded/failed).
+     */
+    private function waitForOperation(SourceConfig $sourceConfig, string $operationId): bool
+    {
+        $status = null;
+        $checkStatus = static function () use ($sourceConfig, $operationId, &$status): bool {
+            $response = $sourceConfig->getStatus($operationId);
+            $status = $response->status ?? 'unknown';
+            return !in_array($status, ['pending', 'running'], true);
+        };
+        $onDone = static function (): void {
+        };
+
+        // @infection-ignore-all The spinner message is transient (overwritten
+        // as the spinner advances) and never appears in the captured output,
+        // so its concatenation cannot be asserted by a test.
+        LoopHelper::getLoopy($this->output, $this->io, $this->operationLabel() . '...', $checkStatus, $onDone);
+
+        if ($status !== 'succeeded') {
+            $this->io->error(sprintf('%s ended with status: %s', $this->operationLabel(), $status));
+        }
+
+        return $status === 'succeeded';
+    }
+}
diff --git a/src/Command/Source/ConfigPullCommand.php b/src/Command/Source/ConfigPullCommand.php
new file mode 100644
index 000000000..49ab204e4
--- /dev/null
+++ b/src/Command/Source/ConfigPullCommand.php
@@ -0,0 +1,112 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Command\Source;
+
+use Acquia\Cli\Attribute\RequireAuth;
+use Acquia\Cli\Exception\AcquiaCliException;
+use Acquia\Cli\SasApi\SourceConfig;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Filesystem\Filesystem;
+use Symfony\Component\Yaml\Yaml;
+
+/**
+ * Trigger a Source config export on a site via the Sites Aggregation Service.
+ *
+ * Asks SAS to run a config export on the environment, which exports config
+ * from the CMS. The exported config comes back as a single YAML document keyed
+ * by collection, then config name; this command writes it out to
+ * .acquia/config/ as individual files, replacing whatever is there.
+ */
+#[RequireAuth]
+#[AsCommand(name: 'source:config:pull', description: 'Export Source configuration from a site')]
+final class ConfigPullCommand extends ConfigCommandBase
+{
+    /**
+     * The directory (relative to the project root) config is written to.
+     */
+    private const CONFIG_DIR = '.acquia/config';
+
+    /**
+     * The inline depth and indentation for dumped config YAML.
+     *
+     * @infection-ignore-all Increment/DecrementInteger on the depth is not
+     *   observable: any depth beyond the config's actual nesting produces
+     *   identical output, and the indent behavior is covered by the nested
+     *   structure test. The values only need to be "deep enough".
+     */
+    private const DUMP_DEPTH = 10;
+
+    private const DUMP_INDENT = 2;
+
+    protected function triggerOperation(SourceConfig $sourceConfig, string $environmentId): object
+    {
+        return $sourceConfig->pull($environmentId);
+    }
+
+    protected function operationLabel(): string
+    {
+        return 'Exporting configuration';
+    }
+
+    /**
+     * Fetch the exported payload and write it to .acquia/config/.
+     *
+     * The directory is wiped and rewritten so the local files mirror the
+     * remote state exactly — config removed in the CMS disappears locally too.
+     */
+    protected function onSuccess(SourceConfig $sourceConfig, string $operationId): int
+    {
+        $yaml = $sourceConfig->getExportPayload($operationId);
+        $payload = Yaml::parse($yaml);
+
+        if (!is_array($payload)) {
+            throw new AcquiaCliException('The SAS API returned an invalid config payload.');
+        }
+
+        $this->writePayload($payload);
+
+        $this->io->success(sprintf('Configuration exported to %s.', self::CONFIG_DIR));
+
+        return Command::SUCCESS;
+    }
+
+    /**
+     * Wipe and rewrite .acquia/config/ from the payload.
+     *
+     * The payload maps collection names to config items. The default
+     * collection ("") writes to the config root; other collections write to
+     * dotted subdirectories (language.es becomes language/es).
+     *
+     * @param array<string, array<string, mixed>> $payload
+     */
+    private function writePayload(array $payload): void
+    {
+        $configDir = $this->dir . '/' . self::CONFIG_DIR;
+        $filesystem = new Filesystem();
+
+        // Wipe the directory so the local files mirror the remote state.
+        $filesystem->remove($configDir);
+        $filesystem->mkdir($configDir);
+
+        foreach ($payload as $collection => $items) {
+            if (!is_array($items)) {
+                continue;
+            }
+            // The default collection ("") is the config root; other collections
+            // map their dotted name to a subdirectory (language.es -> language/es).
+            $collectionDir = $collection === ''
+                ? $configDir
+                : $configDir . '/' . str_replace('.', '/', $collection);
+
+            foreach ($items as $name => $values) {
+                $filesystem->dumpFile(
+                    sprintf('%s/%s.yml', $collectionDir, $name),
+                    Yaml::dump($values, self::DUMP_DEPTH, self::DUMP_INDENT),
+                );
+            }
+        }
+    }
+}
diff --git a/src/Command/Source/ConfigPushCommand.php b/src/Command/Source/ConfigPushCommand.php
new file mode 100644
index 000000000..8e836910f
--- /dev/null
+++ b/src/Command/Source/ConfigPushCommand.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Command\Source;
+
+use Acquia\Cli\Attribute\RequireAuth;
+use Acquia\Cli\SasApi\SourceConfig;
+use Symfony\Component\Console\Attribute\AsCommand;
+
+/**
+ * Trigger a Source config import on a site via the Sites Aggregation Service.
+ *
+ * Asks SAS to run `drush source:config:import` on the environment, which
+ * reads config from the site's git repository and applies it to the CMS.
+ */
+#[RequireAuth]
+#[AsCommand(name: 'source:config:push', description: 'Import deployed Source configuration on a site')]
+final class ConfigPushCommand extends ConfigCommandBase
+{
+    protected function triggerOperation(SourceConfig $sourceConfig, string $environmentId): object
+    {
+        return $sourceConfig->push($environmentId);
+    }
+
+    protected function operationLabel(): string
+    {
+        return 'Importing configuration';
+    }
+}
diff --git a/src/SasApi/SasClient.php b/src/SasApi/SasClient.php
new file mode 100644
index 000000000..1a91fef03
--- /dev/null
+++ b/src/SasApi/SasClient.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\SasApi;
+
+use AcquiaCloudApi\Connector\Client;
+
+/**
+ * Client for the Sites Aggregation Service (SAS) API.
+ *
+ * Response processing is inherited unchanged from the Cloud API client.
+ */
+class SasClient extends Client
+{
+}
diff --git a/src/SasApi/SasClientService.php b/src/SasApi/SasClientService.php
new file mode 100644
index 000000000..0287dc25a
--- /dev/null
+++ b/src/SasApi/SasClientService.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\SasApi;
+
+use Acquia\Cli\ApiCredentialsInterface;
+use Acquia\Cli\Application;
+use Acquia\Cli\CloudApi\ClientService;
+
+class SasClientService extends ClientService
+{
+    public function __construct(SasConnectorFactory $connectorFactory, Application $application, ApiCredentialsInterface $credentials)
+    {
+        parent::__construct($connectorFactory, $application, $credentials);
+    }
+
+    public function getClient(): SasClient
+    {
+        $client = SasClient::factory($this->connector);
+        // @infection-ignore-all configureClient() only sets User-Agent headers
+        // (inherited SDK behavior); its removal is not observable via the
+        // returned client in a unit test.
+        $this->configureClient($client);
+
+        return $client;
+    }
+}
diff --git a/src/SasApi/SasConnector.php b/src/SasApi/SasConnector.php
new file mode 100644
index 000000000..b19d55c50
--- /dev/null
+++ b/src/SasApi/SasConnector.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\SasApi;
+
+use AcquiaCloudApi\Connector\Connector;
+
+/**
+ * Connector for the Sites Aggregation Service (SAS) API.
+ *
+ * SAS shares the Accounts authentication layer with the Cloud API, so the
+ * parent class provides OAuth2 client-credentials tokens (Bearer auth) with
+ * no changes. The only difference is the base URI requests are sent to.
+ */
+class SasConnector extends Connector
+{
+    /**
+     * @param array<string, string|null> $config
+     */
+    public function __construct(array $config, ?string $baseUri = null, ?string $urlAccessToken = null)
+    {
+        parent::__construct($config, $baseUri, $urlAccessToken);
+    }
+}
diff --git a/src/SasApi/SasConnectorFactory.php b/src/SasApi/SasConnectorFactory.php
new file mode 100644
index 000000000..be561e391
--- /dev/null
+++ b/src/SasApi/SasConnectorFactory.php
@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\SasApi;
+
+use Acquia\Cli\CloudApi\AccessTokenConnector;
+use Acquia\Cli\ConnectorFactoryInterface;
+use AcquiaCloudApi\Connector\ConnectorInterface;
+use League\OAuth2\Client\Token\AccessToken;
+
+class SasConnectorFactory implements ConnectorFactoryInterface
+{
+    /**
+     * @param array<string, string|null> $config
+     */
+    public function __construct(protected array $config, protected ?string $baseUri = null, protected ?string $accountsUri = null)
+    {
+    }
+
+    public function createConnector(): ConnectorInterface
+    {
+        // A defined key & secret takes priority.
+        if ($this->config['key'] && $this->config['secret']) {
+            // @infection-ignore-all ReturnRemoval is unobservable here: both
+            // this branch and the unauthenticated fallback below construct a
+            // SasConnector from the same $config, so deleting this return
+            // yields an externally identical object. The auth-selection
+            // behavior is covered by the branch-selection tests.
+            return new SasConnector($this->config, $this->baseUri, $this->accountsUri);
+        }
+
+        // Fall back to a valid access token (e.g. a bot token in CI).
+        if (!empty($this->config['accessToken'])) {
+            $accessToken = $this->createAccessToken();
+            if (!$accessToken->hasExpired()) {
+                return new AccessTokenConnector([
+                    'access_token' => $accessToken,
+                    'key' => null,
+                    'secret' => null,
+                ], $this->baseUri, $this->accountsUri);
+            }
+        }
+
+        // Fall back to an unauthenticated request.
+        return new SasConnector($this->config, $this->baseUri, $this->accountsUri);
+    }
+
+    private function createAccessToken(): AccessToken
+    {
+        return new AccessToken([
+            'access_token' => $this->config['accessToken'],
+            'expires' => $this->config['accessTokenExpiry'],
+        ]);
+    }
+}
diff --git a/src/SasApi/SasCredentials.php b/src/SasApi/SasCredentials.php
new file mode 100644
index 000000000..ae8dcfde9
--- /dev/null
+++ b/src/SasApi/SasCredentials.php
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\SasApi;
+
+use Acquia\Cli\ApiCredentialsInterface;
+
+/**
+ * Configuration for the Sites Aggregation Service (SAS) API.
+ *
+ * Authentication is identical to the Cloud API (the same Accounts-issued
+ * key/secret and access token), which is why the services file feeds this
+ * class's data from the standard cloud credentials. This class exists to
+ * provide the SAS base URI, the only piece of configuration unique to SAS.
+ */
+class SasCredentials implements ApiCredentialsInterface
+{
+    public function getCloudKey(): ?string
+    {
+        // Unused: the SAS connector is configured from cloud.credentials
+        // directly. See config/prod/services.yml.
+        return null;
+    }
+
+    public function getCloudSecret(): ?string
+    {
+        // Unused: see getCloudKey().
+        return null;
+    }
+
+    /**
+     * Get the SAS API base URI.
+     *
+     * @todo DXBE-20: Confirm the env var name and the production URI with the
+     *   SAS team. Follows the ACLI_CLOUD_API_BASE_URI convention.
+     */
+    public function getBaseUri(): ?string
+    {
+        if ($uri = getenv('ACLI_SAS_API_BASE_URI')) {
+            return $uri;
+        }
+
+        return 'https://sites-aggregation-service.acquia.com/api';
+    }
+}
diff --git a/src/SasApi/SourceConfig.php b/src/SasApi/SourceConfig.php
new file mode 100644
index 000000000..5be8a424d
--- /dev/null
+++ b/src/SasApi/SourceConfig.php
@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\SasApi;
+
+use AcquiaCloudApi\Endpoints\CloudApiBase;
+
+/**
+ * SAS API endpoints for Source site configuration.
+ *
+ * Both directions are thin triggers over the SAS API: SAS runs a
+ * `drush source:config:*` command on the environment, and the config moves
+ * between the CMS and the site's git repository. Push (import) sends no
+ * payload; pull (export) returns the exported config as a YAML document once
+ * the operation completes.
+ *
+ * @todo DXBE-20: Confirm the endpoint paths and response field names with the
+ *   SAS team. The SAS endpoints do not exist yet; paths here are placeholders.
+ */
+class SourceConfig extends CloudApiBase
+{
+    /**
+     * Trigger a config import on a site environment (repo to CMS).
+     *
+     * @return object The decoded response, expected to contain an operation ID.
+     */
+    public function push(string $environmentId): object
+    {
+        return $this->client->request('post', "/environments/$environmentId/config-import");
+    }
+
+    /**
+     * Trigger a config export on a site environment (CMS to repo).
+     *
+     * @return object The decoded response, expected to contain an operation ID.
+     */
+    public function pull(string $environmentId): object
+    {
+        return $this->client->request('post', "/environments/$environmentId/config-export");
+    }
+
+    /**
+     * Get the status of a config operation.
+     *
+     * @return object The decoded response, expected to contain a status field.
+     */
+    public function getStatus(string $operationId): object
+    {
+        return $this->client->request('get', "/config-operation/$operationId");
+    }
+
+    /**
+     * Get the exported config payload for a completed export operation.
+     *
+     * @todo DXBE-20: Confirm how the YAML payload is returned (response body
+     *   vs. a field on the status resource) and its content type. Assumes a
+     *   raw YAML body here.
+     * @return string The exported config as a YAML document.
+     */
+    public function getExportPayload(string $operationId): string
+    {
+        $response = $this->client->request('get', "/config-operation/$operationId/payload");
+
+        // The client may return the body as a string (YAML) or as a decoded
+        // object carrying the YAML in a field. Handle both.
+        if (is_string($response)) {
+            return $response;
+        }
+
+        // @todo DXBE-20: Confirm the field name with the SAS team.
+        return $response->payload ?? '';
+    }
+}
diff --git a/tests/phpunit/src/Application/KernelTest.php b/tests/phpunit/src/Application/KernelTest.php
index e0ad1a608..7bfdde9c8 100644
--- a/tests/phpunit/src/Application/KernelTest.php
+++ b/tests/phpunit/src/Application/KernelTest.php
@@ -105,6 +105,9 @@ private function getEnd(): string
   self:telemetry:disable   [telemetry:disable] Disable anonymous sharing of usage and performance data
   self:telemetry:enable    [telemetry:enable] Enable anonymous sharing of usage and performance data
   self:telemetry:toggle    [telemetry] Toggle anonymous sharing of usage and performance data
+ source
+  source:config:pull       Export Source configuration from a site
+  source:config:push       Import deployed Source configuration on a site
  ssh-key
   ssh-key:create           Create an SSH key on your local machine
   ssh-key:create-upload    Create an SSH key on your local machine and upload it to the Cloud Platform
diff --git a/tests/phpunit/src/Commands/Source/ConfigPullCommandTest.php b/tests/phpunit/src/Commands/Source/ConfigPullCommandTest.php
new file mode 100644
index 000000000..961e8d3dc
--- /dev/null
+++ b/tests/phpunit/src/Commands/Source/ConfigPullCommandTest.php
@@ -0,0 +1,202 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Tests\Commands\Source;
+
+use Acquia\Cli\Command\CommandBase;
+use Acquia\Cli\Command\Source\ConfigPullCommand;
+use Acquia\Cli\SasApi\SasClient;
+use Acquia\Cli\SasApi\SasClientService;
+use Acquia\Cli\Tests\CommandTestBase;
+use Prophecy\Prophecy\ObjectProphecy;
+use ReflectionMethod;
+use ReflectionProperty;
+
+/**
+ * @property ConfigPullCommand $command
+ */
+class ConfigPullCommandTest extends CommandTestBase
+{
+    private const SITE_ID = '0ebce493-9d09-479d-a9a8-138a206fa687';
+    private const ENVIRONMENT_ID = '3e8ecbec-ea7c-4260-8414-ef2938c859bc';
+    private const SITE_INSTANCE_ID = self::SITE_ID . '.' . self::ENVIRONMENT_ID;
+
+    private SasClientService|ObjectProphecy $sasClientServiceProphecy;
+
+    private SasClient|ObjectProphecy $sasClientProphecy;
+
+    protected function createCommand(): CommandBase
+    {
+        $this->sasClientProphecy = $this->prophet->prophesize(SasClient::class);
+        $this->sasClientServiceProphecy = $this->prophet->prophesize(SasClientService::class);
+        $this->sasClientServiceProphecy->getClient()->willReturn($this->sasClientProphecy->reveal());
+
+        return new ConfigPullCommand(
+            $this->localMachineHelper,
+            $this->datastoreCloud,
+            $this->datastoreAcli,
+            $this->cloudCredentials,
+            $this->telemetryHelper,
+            $this->acliRepoRoot,
+            $this->clientServiceProphecy->reveal(),
+            $this->sshHelper,
+            $this->sshDir,
+            $this->logger,
+            $this->selfUpdateManager,
+            $this->sasClientServiceProphecy->reveal(),
+        );
+    }
+
+    /**
+     * Mock the Cloud API calls needed to resolve a site instance from
+     * --siteInstanceId: environment, site, site instance, and codebase.
+     */
+    private function mockSiteInstanceResolution(): void
+    {
+        $environment = $this->getMockCodeBaseEnvironment();
+        $this->clientProphecy->request('get', '/v3/environments/' . self::ENVIRONMENT_ID)
+            ->willReturn($environment)
+            ->shouldBeCalled();
+
+        $site = $this->getMockSite();
+        $this->clientProphecy->request('get', '/sites/' . self::SITE_ID)
+            ->willReturn($site)
+            ->shouldBeCalled();
+
+        $siteInstance = $this->getMockSiteInstanceResponse();
+        $this->clientProphecy->request('get', '/site-instances/' . self::SITE_INSTANCE_ID)
+            ->willReturn($siteInstance)
+            ->shouldBeCalled();
+
+        $codebase = $this->getMockCodebaseResponse();
+        $this->clientProphecy->request('get', '/codebases/d3f7270e-c45f-4801-9308-5e8afe84a323')
+            ->willReturn($codebase)
+            ->shouldBeCalled();
+    }
+
+    public function testExecutePullsAndWritesPayload(): void
+    {
+        $this->mockSiteInstanceResolution();
+
+        $this->sasClientProphecy->request('post', '/environments/' . self::ENVIRONMENT_ID . '/config-export')
+            ->willReturn((object) ['id' => 'operation-123'])
+            ->shouldBeCalled();
+
+        $this->sasClientProphecy->request('get', '/config-operation/operation-123')
+            ->willReturn((object) ['status' => 'succeeded'])
+            ->shouldBeCalled();
+
+        // The payload endpoint returns the exported config as a YAML document.
+        $yaml = "\"\":\n  system.site:\n    name: 'My Site'\n";
+        $this->sasClientProphecy->request('get', '/config-operation/operation-123/payload')
+            ->willReturn((object) ['payload' => $yaml])
+            ->shouldBeCalled();
+
+        $this->executeCommand(
+            ['--siteInstanceId' => self::SITE_INSTANCE_ID, '--force' => true],
+        );
+
+        $this->assertSame(0, $this->getStatusCode());
+        $this->assertStringContainsString('Configuration exported', $this->getDisplay());
+        // The payload was written to disk.
+        $this->assertFileExists($this->projectDir . '/.acquia/config/system.site.yml');
+    }
+
+    /**
+     * Invoke the private payload writer against a directory.
+     *
+     * @param array<string, array<string, mixed>> $payload
+     */
+    private function writePayload(string $dir, array $payload): void
+    {
+        (new ReflectionProperty($this->command, 'dir'))->setValue($this->command, $dir);
+        $method = new ReflectionMethod($this->command, 'writePayload');
+        $method->invoke($this->command, $payload);
+    }
+
+    public function testWritePayloadBuildsFilesFromCollections(): void
+    {
+        $payload = [
+            '' => [
+                'node.type.blog' => ['label' => 'Blog'],
+                'system.site' => ['name' => 'My Site'],
+            ],
+            'language.es' => [
+                'node.type.blog' => ['label' => 'Blogue'],
+            ],
+        ];
+
+        $this->writePayload($this->projectDir, $payload);
+
+        $configDir = $this->projectDir . '/.acquia/config';
+        $this->assertStringEqualsFile($configDir . '/node.type.blog.yml', "label: Blog\n");
+        $this->assertStringEqualsFile($configDir . '/system.site.yml', "name: 'My Site'\n");
+        $this->assertStringEqualsFile($configDir . '/language/es/node.type.blog.yml', "label: Blogue\n");
+    }
+
+    public function testWritePayloadWipesExistingConfig(): void
+    {
+        $configDir = $this->projectDir . '/.acquia/config';
+        mkdir($configDir, 0777, true);
+        file_put_contents($configDir . '/stale.setting.yml', "old: true\n");
+
+        $this->writePayload($this->projectDir, [
+            '' => ['system.site' => ['name' => 'My Site']],
+        ]);
+
+        $this->assertFileDoesNotExist($configDir . '/stale.setting.yml');
+        $this->assertStringEqualsFile($configDir . '/system.site.yml', "name: 'My Site'\n");
+    }
+
+    public function testWritePayloadSkipsNonArrayCollections(): void
+    {
+        // The malformed "language.fr" collection is iterated between the valid
+        // "language.en" and "language.zz" collections (source order, which the
+        // code-style fixer keeps alphabetical, matches iteration order). A
+        // continue-to-break mutation would stop the loop at "language.fr", so
+        // the valid "language.zz" collection after it must still be written.
+        $this->writePayload($this->projectDir, [
+            'language.en' => ['node.type.blog' => ['label' => 'Blog']],
+            'language.fr' => 'not-an-array',
+            'language.zz' => ['node.type.blog' => ['label' => 'Blogue']],
+        ]);
+
+        $configDir = $this->projectDir . '/.acquia/config';
+        $this->assertFileExists($configDir . '/language/en/node.type.blog.yml');
+        $this->assertFileDoesNotExist($configDir . '/language/fr');
+        $this->assertFileExists($configDir . '/language/zz/node.type.blog.yml');
+    }
+
+    public function testWritePayloadCreatesConfigDirWhenPayloadEmpty(): void
+    {
+        // An empty payload writes no files, so only the explicit mkdir()
+        // creates the directory. A mutant removing mkdir() is caught here.
+        $this->writePayload($this->projectDir, []);
+
+        $this->assertDirectoryExists($this->projectDir . '/.acquia/config');
+    }
+
+    public function testWritePayloadDumpsNestedStructureWithIndent(): void
+    {
+        $this->writePayload($this->projectDir, [
+            '' => [
+                'node.type.blog' => [
+                    'label' => 'Blog',
+                    'settings' => [
+                        'items' => ['a', 'b'],
+                    ],
+                ],
+            ],
+        ]);
+
+        $configDir = $this->projectDir . '/.acquia/config';
+        // Nested structures must be dumped with a 2-space indent and full
+        // depth; a mutant lowering the inline depth or indent args would
+        // produce different (or invalid) output.
+        $this->assertStringEqualsFile(
+            $configDir . '/node.type.blog.yml',
+            "label: Blog\nsettings:\n  items:\n    - a\n    - b\n",
+        );
+    }
+}
diff --git a/tests/phpunit/src/Commands/Source/ConfigPushCommandTest.php b/tests/phpunit/src/Commands/Source/ConfigPushCommandTest.php
new file mode 100644
index 000000000..c77c1cf38
--- /dev/null
+++ b/tests/phpunit/src/Commands/Source/ConfigPushCommandTest.php
@@ -0,0 +1,139 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Tests\Commands\Source;
+
+use Acquia\Cli\Command\CommandBase;
+use Acquia\Cli\Command\Source\ConfigPushCommand;
+use Acquia\Cli\SasApi\SasClient;
+use Acquia\Cli\SasApi\SasClientService;
+use Acquia\Cli\Tests\CommandTestBase;
+use Prophecy\Prophecy\ObjectProphecy;
+
+/**
+ * @property ConfigPushCommand $command
+ */
+class ConfigPushCommandTest extends CommandTestBase
+{
+    /**
+     * The site instance ID the tests resolve against.
+     */
+    private const SITE_ID = '0ebce493-9d09-479d-a9a8-138a206fa687';
+    private const ENVIRONMENT_ID = '3e8ecbec-ea7c-4260-8414-ef2938c859bc';
+    private const SITE_INSTANCE_ID = self::SITE_ID . '.' . self::ENVIRONMENT_ID;
+
+    private SasClientService|ObjectProphecy $sasClientServiceProphecy;
+
+    private SasClient|ObjectProphecy $sasClientProphecy;
+
+    protected function createCommand(): CommandBase
+    {
+        $this->sasClientProphecy = $this->prophet->prophesize(SasClient::class);
+        $this->sasClientServiceProphecy = $this->prophet->prophesize(SasClientService::class);
+        $this->sasClientServiceProphecy->getClient()->willReturn($this->sasClientProphecy->reveal());
+
+        return new ConfigPushCommand(
+            $this->localMachineHelper,
+            $this->datastoreCloud,
+            $this->datastoreAcli,
+            $this->cloudCredentials,
+            $this->telemetryHelper,
+            $this->acliRepoRoot,
+            $this->clientServiceProphecy->reveal(),
+            $this->sshHelper,
+            $this->sshDir,
+            $this->logger,
+            $this->selfUpdateManager,
+            $this->sasClientServiceProphecy->reveal(),
+        );
+    }
+
+    /**
+     * Mock the Cloud API calls needed to resolve a site instance from
+     * --siteInstanceId: environment, site, site instance, and codebase.
+     */
+    private function mockSiteInstanceResolution(): void
+    {
+        $environment = $this->getMockCodeBaseEnvironment();
+        $this->clientProphecy->request('get', '/v3/environments/' . self::ENVIRONMENT_ID)
+            ->willReturn($environment)
+            ->shouldBeCalled();
+
+        $site = $this->getMockSite();
+        $this->clientProphecy->request('get', '/sites/' . self::SITE_ID)
+            ->willReturn($site)
+            ->shouldBeCalled();
+
+        $siteInstance = $this->getMockSiteInstanceResponse();
+        $this->clientProphecy->request('get', '/site-instances/' . self::SITE_INSTANCE_ID)
+            ->willReturn($siteInstance)
+            ->shouldBeCalled();
+
+        $codebase = $this->getMockCodebaseResponse();
+        $this->clientProphecy->request('get', '/codebases/d3f7270e-c45f-4801-9308-5e8afe84a323')
+            ->willReturn($codebase)
+            ->shouldBeCalled();
+    }
+
+    public function testExecutePushesAndPollsToCompletion(): void
+    {
+        $this->mockSiteInstanceResolution();
+
+        // The push trigger returns an operation ID.
+        $this->sasClientProphecy->request('post', '/environments/' . self::ENVIRONMENT_ID . '/config-import')
+            ->willReturn((object) ['id' => 'operation-123'])
+            ->shouldBeCalled();
+
+        // The status poll immediately reports success.
+        $this->sasClientProphecy->request('get', '/config-operation/operation-123')
+            ->willReturn((object) ['status' => 'succeeded'])
+            ->shouldBeCalled();
+
+        $this->executeCommand(
+            ['--siteInstanceId' => self::SITE_INSTANCE_ID, '--force' => true],
+        );
+
+        $this->assertSame(0, $this->getStatusCode());
+        $this->assertStringContainsString('Importing configuration submitted (operation operation-123)', $this->getDisplay());
+        $this->assertStringContainsString('Importing configuration completed successfully.', $this->getDisplay());
+    }
+
+    public function testExecuteThrowsWhenOperationIdMissing(): void
+    {
+        $this->mockSiteInstanceResolution();
+
+        // The push trigger returns a response with no operation ID.
+        $this->sasClientProphecy->request('post', '/environments/' . self::ENVIRONMENT_ID . '/config-import')
+            ->willReturn((object) [])
+            ->shouldBeCalled();
+
+        $this->expectException(\Acquia\Cli\Exception\AcquiaCliException::class);
+        $this->expectExceptionMessage('did not include an operation ID');
+
+        $this->executeCommand(
+            ['--siteInstanceId' => self::SITE_INSTANCE_ID, '--force' => true],
+        );
+    }
+
+    public function testExecuteFailsWhenOperationFails(): void
+    {
+        $this->mockSiteInstanceResolution();
+
+        $this->sasClientProphecy->request('post', '/environments/' . self::ENVIRONMENT_ID . '/config-import')
+            ->willReturn((object) ['id' => 'operation-456'])
+            ->shouldBeCalled();
+
+        // The status poll reports failure.
+        $this->sasClientProphecy->request('get', '/config-operation/operation-456')
+            ->willReturn((object) ['status' => 'failed'])
+            ->shouldBeCalled();
+
+        $this->executeCommand(
+            ['--siteInstanceId' => self::SITE_INSTANCE_ID, '--force' => true],
+        );
+
+        $this->assertSame(1, $this->getStatusCode());
+        $this->assertStringContainsString('failed', $this->getDisplay());
+    }
+}
diff --git a/tests/phpunit/src/SasApi/SasClientServiceTest.php b/tests/phpunit/src/SasApi/SasClientServiceTest.php
new file mode 100644
index 000000000..2a77e4a76
--- /dev/null
+++ b/tests/phpunit/src/SasApi/SasClientServiceTest.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Tests\SasApi;
+
+use Acquia\Cli\CloudApi\CloudCredentials;
+use Acquia\Cli\SasApi\SasClient;
+use Acquia\Cli\SasApi\SasClientService;
+use Acquia\Cli\SasApi\SasConnectorFactory;
+use Acquia\Cli\Tests\TestBase;
+use PHPUnit\Framework\Attributes\CoversClass;
+
+/**
+ * Unit tests for the SasClientService.
+ */
+#[CoversClass(SasClientService::class)]
+class SasClientServiceTest extends TestBase
+{
+    public function testGetClientReturnsConfiguredSasClient(): void
+    {
+        $factory = new SasConnectorFactory(
+            ['key' => 'k', 'secret' => 's', 'accessToken' => null, 'accessTokenExpiry' => null],
+            'https://sas.example.com',
+            'https://accounts.example.com',
+        );
+        $service = new SasClientService($factory, $this->application, new CloudCredentials($this->datastoreCloud));
+
+        $client = $service->getClient();
+
+        // The parent constructor must have run for the connector to be set and
+        // a client to be produced.
+        $this->assertInstanceOf(SasClient::class, $client);
+    }
+}
diff --git a/tests/phpunit/src/SasApi/SasConnectorFactoryTest.php b/tests/phpunit/src/SasApi/SasConnectorFactoryTest.php
new file mode 100644
index 000000000..b12952235
--- /dev/null
+++ b/tests/phpunit/src/SasApi/SasConnectorFactoryTest.php
@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Tests\SasApi;
+
+use Acquia\Cli\CloudApi\AccessTokenConnector;
+use Acquia\Cli\SasApi\SasConnector;
+use Acquia\Cli\SasApi\SasConnectorFactory;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Unit tests for the SasConnectorFactory. Ensures the factory returns the
+ * correct connector type depending on the available credentials.
+ */
+#[CoversClass(SasConnectorFactory::class)]
+class SasConnectorFactoryTest extends TestCase
+{
+    /**
+     * @return array<int, array{0: array<string, string|null>, 1: class-string}>
+     */
+    public static function connectorProvider(): array
+    {
+        return [
+            // An expired access token falls back to an unauthenticated connector.
+            'expired token' => [
+                ['key' => null, 'secret' => null, 'accessToken' => 'tok', 'accessTokenExpiry' => (string) (time() - 3600)],
+                SasConnector::class,
+            ],
+            // Key & secret take priority and produce the standard connector.
+            'key+secret' => [
+                ['key' => 'k', 'secret' => 's', 'accessToken' => null, 'accessTokenExpiry' => null],
+                SasConnector::class,
+            ],
+            // Key without secret is not enough for key/secret auth.
+            'key only' => [
+                ['key' => 'k', 'secret' => null, 'accessToken' => null, 'accessTokenExpiry' => null],
+                SasConnector::class,
+            ],
+            // Key without secret must NOT enter the key/secret branch (which
+            // requires both); with a valid token present it must fall through
+            // to the token branch. A "&&" mutated to "||" would wrongly return
+            // a SasConnector here.
+            'key only + valid token' => [
+                ['key' => 'k', 'secret' => null, 'accessToken' => 'tok', 'accessTokenExpiry' => (string) (time() + 3600)],
+                AccessTokenConnector::class,
+            ],
+            // No credentials at all: unauthenticated connector.
+            'no credentials' => [
+                ['key' => null, 'secret' => null, 'accessToken' => null, 'accessTokenExpiry' => null],
+                SasConnector::class,
+            ],
+            // Secret without key is not enough either.
+            'secret only' => [
+                ['key' => null, 'secret' => 's', 'accessToken' => null, 'accessTokenExpiry' => null],
+                SasConnector::class,
+            ],
+            // Symmetrically, secret without key must also fall through.
+            'secret only + valid token' => [
+                ['key' => null, 'secret' => 's', 'accessToken' => 'tok', 'accessTokenExpiry' => (string) (time() + 3600)],
+                AccessTokenConnector::class,
+            ],
+            // A valid (unexpired) access token produces an AccessTokenConnector.
+            'valid token' => [
+                ['key' => null, 'secret' => null, 'accessToken' => 'tok', 'accessTokenExpiry' => (string) (time() + 3600)],
+                AccessTokenConnector::class,
+            ],
+        ];
+    }
+
+    /**
+     * @param array<string, string|null> $config
+     */
+    #[DataProvider('connectorProvider')]
+    public function testCreateConnectorSelectsCorrectType(array $config, string $expectedClass): void
+    {
+        $factory = new SasConnectorFactory($config, 'https://sas.example.com', 'https://accounts.example.com');
+        // Assert the exact concrete class so a flipped condition (&&/||, or a
+        // negated operand) that routes to the wrong branch fails the test.
+        $this->assertSame($expectedClass, get_class($factory->createConnector()));
+    }
+
+    public function testAccessTokenConnectorSelectedForValidToken(): void
+    {
+        // A valid token yields an AccessTokenConnector. Asserting the type is
+        // enough: it only happens when the access-token branch is taken.
+        $factory = new SasConnectorFactory(
+            ['key' => null, 'secret' => null, 'accessToken' => 'tok', 'accessTokenExpiry' => (string) (time() + 3600)],
+            'https://sas.example.com',
+        );
+        $this->assertInstanceOf(AccessTokenConnector::class, $factory->createConnector());
+    }
+}
diff --git a/tests/phpunit/src/SasApi/SasConnectorTest.php b/tests/phpunit/src/SasApi/SasConnectorTest.php
new file mode 100644
index 000000000..2ce964ce6
--- /dev/null
+++ b/tests/phpunit/src/SasApi/SasConnectorTest.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Acquia\Cli\Tests\SasApi;
+
+use Acquia\Cli\SasApi\SasConnector;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Unit tests for the SasConnector.
+ */
+#[CoversClass(SasConnector::class)]
+class SasConnectorTest extends TestCase
+{
+    public function testConstructorSetsBaseUri(): void
+    {
+        $connector = new SasConnector(
+            ['key' => 'k', 'secret' => 's'],
+            'https://sas.example.com',
+        );
+
+        // The base URI is passed through to the parent connector.
+        $this->assertSame('https://sas.example.com', $connector->getBaseUri());
+    }
+
+    public function testConstructorDefaultsToCloudBaseUriWhenNotOverridden(): void
+    {
+        $connector = new SasConnector(['key' => 'k', 'secret' => 's']);
+
+        // With no override, the parent default applies.
+        $this->assertNotEmpty($connector->getBaseUri());
+    }
+}