diff --git a/package-lock.json b/package-lock.json
index 0f328b7e..9cf5f663 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4000,9 +4000,9 @@
       }
     },
     "node_modules/@oclif/core": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/@oclif/core/-/core-4.5.1.tgz",
-      "integrity": "sha512-JAuARvXOzf75L7rqLL3TIP3OmuTf7N/cjRejkGASfRJH+09180+EGbSkPWSMCns+AaYpDMI+fdaJ6QCoa3f15A==",
+      "version": "4.5.2",
+      "resolved": "https://registry.npmjs.org/@oclif/core/-/core-4.5.2.tgz",
+      "integrity": "sha512-eQcKyrEcDYeZJKu4vUWiu0ii/1Gfev6GF4FsLSgNez5/+aQyAUCjg3ZWlurf491WiYZTXCWyKAxyPWk8DKv2MA==",
       "license": "MIT",
       "dependencies": {
         "ansi-escapes": "^4.3.2",
@@ -4042,9 +4042,9 @@
       }
     },
     "node_modules/@oclif/plugin-help": {
-      "version": "6.2.31",
-      "resolved": "https://registry.npmjs.org/@oclif/plugin-help/-/plugin-help-6.2.31.tgz",
-      "integrity": "sha512-o4xR98DEFf+VqY+M9B3ZooTm2T/mlGvyBHwHcnsPJCEnvzHqEA9xUlCUK4jm7FBXHhkppziMgCC2snsueLoIpQ==",
+      "version": "6.2.32",
+      "resolved": "https://registry.npmjs.org/@oclif/plugin-help/-/plugin-help-6.2.32.tgz",
+      "integrity": "sha512-LrmMdo9EMJciOvF8UurdoTcTMymv5npKtxMAyonZvhSvGR8YwCKnuHIh00+SO2mNtGOYam7f4xHnUmj2qmanyA==",
       "license": "MIT",
       "dependencies": {
         "@oclif/core": "^4"
@@ -13035,7 +13035,7 @@
     },
     "packages/bundle": {
       "name": "@sigstore/bundle",
-      "version": "3.1.0",
+      "version": "4.0.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@sigstore/protobuf-specs": "^0.5.0"
@@ -13046,18 +13046,18 @@
     },
     "packages/cli": {
       "name": "@sigstore/cli",
-      "version": "0.8.2",
+      "version": "0.9.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@oclif/color": "^1.0.13",
         "@oclif/core": "^4",
         "@oclif/plugin-help": "^6",
-        "@sigstore/bundle": "^3.0.0",
-        "@sigstore/oci": "^0.5.0",
-        "@sigstore/sign": "^3.0.0",
+        "@sigstore/bundle": "^4.0.0",
+        "@sigstore/oci": "^0.6.0",
+        "@sigstore/sign": "^4.0.0",
         "open": "^8.4.2",
         "openid-client": "^5.7.0",
-        "sigstore": "^3.0.0"
+        "sigstore": "^4.0.0"
       },
       "bin": {
         "sigstore": "bin/run"
@@ -13074,20 +13074,20 @@
     },
     "packages/client": {
       "name": "sigstore",
-      "version": "3.1.0",
+      "version": "4.0.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@sigstore/bundle": "^3.1.0",
-        "@sigstore/core": "^2.0.0",
+        "@sigstore/bundle": "^4.0.0",
+        "@sigstore/core": "^3.0.0",
         "@sigstore/protobuf-specs": "^0.5.0",
-        "@sigstore/sign": "^3.1.0",
-        "@sigstore/tuf": "^3.1.0",
-        "@sigstore/verify": "^2.1.0"
+        "@sigstore/sign": "^4.0.0",
+        "@sigstore/tuf": "^4.0.0",
+        "@sigstore/verify": "^3.0.0"
       },
       "devDependencies": {
         "@sigstore/jest": "^0.0.0",
-        "@sigstore/mock": "^0.10.0",
-        "@sigstore/rekor-types": "^3.0.0",
+        "@sigstore/mock": "^0.11.0",
+        "@sigstore/rekor-types": "^4.0.0",
         "@tufjs/repo-mock": "^3.0.1",
         "@types/make-fetch-happen": "^10.0.4"
       },
@@ -13097,15 +13097,15 @@
     },
     "packages/conformance": {
       "name": "@sigstore/conformance",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "dependencies": {
         "@oclif/core": "^4",
-        "@sigstore/bundle": "^3.1.0",
+        "@sigstore/bundle": "^4.0.0",
         "@sigstore/protobuf-specs": "^0.5.0",
-        "@sigstore/tuf": "^3.1.0",
-        "@sigstore/verify": "^2.1.0",
+        "@sigstore/tuf": "^4.0.0",
+        "@sigstore/verify": "^3.0.0",
         "elliptic": "^6.6.1",
-        "sigstore": "^3.1.0"
+        "sigstore": "^4.0.0"
       },
       "bin": {
         "sigstore": "bin/run"
@@ -13121,7 +13121,7 @@
     },
     "packages/core": {
       "name": "@sigstore/core",
-      "version": "2.0.0",
+      "version": "3.0.0",
       "license": "Apache-2.0",
       "engines": {
         "node": "^20.17.0 || >=22.9.0"
@@ -13145,7 +13145,7 @@
     },
     "packages/mock": {
       "name": "@sigstore/mock",
-      "version": "0.10.0",
+      "version": "0.11.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@peculiar/webcrypto": "^1.5.0",
@@ -13160,7 +13160,7 @@
         "pvutils": "^1.1.3"
       },
       "devDependencies": {
-        "@sigstore/rekor-types": "^3.0.0",
+        "@sigstore/rekor-types": "^4.0.0",
         "make-fetch-happen": "^15.0.0"
       },
       "engines": {
@@ -13169,11 +13169,11 @@
     },
     "packages/mock-server": {
       "name": "@sigstore/mock-server",
-      "version": "0.2.2",
+      "version": "0.3.0",
       "dependencies": {
         "@oclif/color": "^1.0.13",
         "@oclif/core": "^4",
-        "@sigstore/mock": "^0.10.0",
+        "@sigstore/mock": "^0.11.0",
         "@tufjs/repo-mock": "^3.0.1",
         "express": "5.1.0"
       },
@@ -13191,7 +13191,7 @@
     },
     "packages/oci": {
       "name": "@sigstore/oci",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "license": "Apache-2.0",
       "dependencies": {
         "make-fetch-happen": "^15.0.0",
@@ -13206,7 +13206,7 @@
     },
     "packages/rekor-types": {
       "name": "@sigstore/rekor-types",
-      "version": "3.0.0",
+      "version": "4.0.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "json-schema-to-typescript": "^15.0.4",
@@ -13218,11 +13218,11 @@
     },
     "packages/sign": {
       "name": "@sigstore/sign",
-      "version": "3.1.0",
+      "version": "4.0.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@sigstore/bundle": "^3.1.0",
-        "@sigstore/core": "^2.0.0",
+        "@sigstore/bundle": "^4.0.0",
+        "@sigstore/core": "^3.0.0",
         "@sigstore/protobuf-specs": "^0.5.0",
         "make-fetch-happen": "^15.0.0",
         "proc-log": "^5.0.0",
@@ -13230,8 +13230,8 @@
       },
       "devDependencies": {
         "@sigstore/jest": "^0.0.0",
-        "@sigstore/mock": "^0.10.0",
-        "@sigstore/rekor-types": "^3.0.0",
+        "@sigstore/mock": "^0.11.0",
+        "@sigstore/rekor-types": "^4.0.0",
         "@types/make-fetch-happen": "^10.0.4",
         "@types/promise-retry": "^1.1.6"
       },
@@ -13241,7 +13241,7 @@
     },
     "packages/tuf": {
       "name": "@sigstore/tuf",
-      "version": "3.1.1",
+      "version": "4.0.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@sigstore/protobuf-specs": "^0.5.0",
@@ -13258,11 +13258,11 @@
     },
     "packages/verify": {
       "name": "@sigstore/verify",
-      "version": "2.1.1",
+      "version": "3.0.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@sigstore/bundle": "^3.1.0",
-        "@sigstore/core": "^2.0.0",
+        "@sigstore/bundle": "^4.0.0",
+        "@sigstore/core": "^3.0.0",
         "@sigstore/protobuf-specs": "^0.5.0"
       },
       "engines": {