@@ -1,5 +1,5 @@
-import { createWriteStream, openAsBlob } from 'node:fs';
-import { stat } from 'node:fs/promises';
+import { createWriteStream } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { Writable } from 'node:stream';
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
@@ -19,6 +19,7 @@ import {
   PUBLIC_KEY_ALGORITHMS,
 } from '@opentdf/sdk';
 import { CLIError, Level, log } from './logger.js';
+import { type FileChunker, openFileChunker } from './file-chunker.js';
 import * as assertions from '@opentdf/sdk/assertions';
 import { base64 } from '@opentdf/sdk/encodings';
 import { type KeyPair } from '@opentdf/sdk/singlecontainer';
@@ -135,8 +136,7 @@ async function parseAssertionVerificationKeys(
   } catch (err) {
     // try as file name:
     try {
-      const jsonFile = await openAsBlob(s);
-      u = JSON.parse(await jsonFile.text()) as assertions.AssertionVerificationKeys;
+      u = JSON.parse(await readFile(s, 'utf8')) as assertions.AssertionVerificationKeys;
     } catch (err2) {
       const cause = asError(err2);
       throw new CLIError(
@@ -234,8 +234,7 @@ async function parseAssertionConfig(s: string): Promise<assertions.AssertionConf
   } catch (err) {
     // try as file name:
     try {
-      const jsonFile = await openAsBlob(s);
-      u = JSON.parse(await jsonFile.text()) as unknown;
+      u = JSON.parse(await readFile(s, 'utf8')) as unknown;
     } catch (err2) {
       const cause = asError(err2);
       throw new CLIError(
@@ -347,7 +346,7 @@ async function parseCreateTDFOptions(
 ): Promise<CreateTDFOptions> {
   const c: CreateTDFOptions = { ...(await parseCreateOptions(argv)), ...flags };
   if (argv.assertions?.length) {
-    // Reads from disk (parseAssertionConfig falls back to openAsBlob), so it
+    // Reads from disk (parseAssertionConfig falls back to reading a file), so it
     // stays here rather than in the pure pass.
     c.assertionConfigs = await parseAssertionConfig(argv.assertions);
   }
@@ -359,16 +358,23 @@ async function fileAsSource(file: string): Promise<Source> {
   if (!file) {
     throw new CLIError('CRITICAL', 'Must specify file or pipe');
   }
+  let location: FileChunker;
   try {
-    const stats = await stat(file);
-    if (!stats?.isFile()) {
-      throw new CLIError('CRITICAL', `File does not exist [${file}]`);
-    }
+    // Not fs.openAsBlob: Node truncates a file-backed Blob's size to 32 bits,
+    // which breaks every read of a file >= 4 GiB (DSPX-5160).
+    location = await openFileChunker(file);
   } catch (e) {
     throw new CLIError('CRITICAL', `File is not accessable [${file}]`, asError(e));
   }
-  log('DEBUG', `Using input from file [${file}]`);
-  return { type: 'file-browser', location: await openAsBlob(file) };
+  log('DEBUG', `Using input from file [${file}] (${location.size} bytes)`);
+  return { type: 'chunker', location };
+}
+
+/** Releases the file handle, if any, opened by {@link fileAsSource}. */
+async function closeSource(source?: Source): Promise<void> {
+  if (source?.type === 'chunker' && 'close' in source.location) {
+    await (source.location as FileChunker).close();
+  }
 }
 
 export const handleArgs = (args: string[]) => {
@@ -606,8 +612,10 @@ export const handleArgs = (args: string[]) => {
             platformUrl: argv.platformUrl || guessPolicyUrl(argv),
             authProvider: new InvalidAuthProvider(),
           });
+          let readOptions: ReadOptions | undefined;
           try {
-            const reader = ct.open(await parseReadOptions(argv));
+            readOptions = await parseReadOptions(argv);
+            const reader = ct.open(readOptions);
             const manifest = await reader.manifest();
             try {
               const dataAttributes = await reader.attributes();
@@ -618,6 +626,7 @@ export const handleArgs = (args: string[]) => {
             }
           } finally {
             ct.close();
+            await closeSource(readOptions?.source);
           }
         }
       )
@@ -656,10 +665,12 @@ export const handleArgs = (args: string[]) => {
             policyEndpoint: guessedPolicyEndpoint,
             platformUrl: argv.platformUrl || guessedPolicyEndpoint,
           });
+          let readOptions: ReadOptions | undefined;
           try {
             log('SILLY', `Initialized client`);
             log('DEBUG', `About to TDF3 decrypt [${String(argv.file)}]`);
-            const ct = await client.read(await parseReadOptions(argv));
+            readOptions = await parseReadOptions(argv);
+            const ct = await client.read(readOptions);
             const destination = argv.output ? createWriteStream(argv.output) : process.stdout;
             await ct.pipeTo(Writable.toWeb(destination) as WritableStream<Uint8Array>);
 
@@ -696,6 +707,7 @@ export const handleArgs = (args: string[]) => {
             console.assert(!argv.dpop || dpopToken, 'DPoP requested but absent');
           } finally {
             client.close();
+            await closeSource(readOptions?.source);
           }
         }
       )
@@ -720,30 +732,34 @@ export const handleArgs = (args: string[]) => {
             throw new CLIError('CRITICAL', 'oidcEndpoint must be specified');
           }
           const createOptions = await parseCreateTDFOptions(argv, createFlags);
-          const authProvider = await processAuth(argv);
-          log('DEBUG', `Initialized auth provider ${JSON.stringify(authProvider)}`);
-          const guessedPolicyEndpoint = guessPolicyUrl(argv);
-
-          const client = new OpenTDF({
-            authProvider,
-            defaultCreateOptions: {
-              defaultKASEndpoint: argv.kasEndpoint,
-            },
-            disableDPoP: !argv.dpop,
-            policyEndpoint: guessedPolicyEndpoint,
-            platformUrl: argv.platformUrl || guessedPolicyEndpoint,
-          });
           try {
-            log('SILLY', `Initialized client`);
-            log('DEBUG', `TDF Create`);
-            const ct: DecoratedStream = await client.createTDF(createOptions);
-            if (!ct) {
-              throw new CLIError('CRITICAL', 'Encrypt configuration error: No output?');
+            const authProvider = await processAuth(argv);
+            log('DEBUG', `Initialized auth provider ${JSON.stringify(authProvider)}`);
+            const guessedPolicyEndpoint = guessPolicyUrl(argv);
+
+            const client = new OpenTDF({
+              authProvider,
+              defaultCreateOptions: {
+                defaultKASEndpoint: argv.kasEndpoint,
+              },
+              disableDPoP: !argv.dpop,
+              policyEndpoint: guessedPolicyEndpoint,
+              platformUrl: argv.platformUrl || guessedPolicyEndpoint,
+            });
+            try {
+              log('SILLY', `Initialized client`);
+              log('DEBUG', `TDF Create`);
+              const ct: DecoratedStream = await client.createTDF(createOptions);
+              if (!ct) {
+                throw new CLIError('CRITICAL', 'Encrypt configuration error: No output?');
+              }
+              const destination = argv.output ? createWriteStream(argv.output) : process.stdout;
+              await ct.pipeTo(Writable.toWeb(destination) as WritableStream<Uint8Array>);
+            } finally {
+              client.close();
             }
-            const destination = argv.output ? createWriteStream(argv.output) : process.stdout;
-            await ct.pipeTo(Writable.toWeb(destination) as WritableStream<Uint8Array>);
           } finally {
-            client.close();
+            await closeSource(createOptions.source);
           }
         }
       )
 
@@ -0,0 +1,89 @@
+import { type FileHandle, open } from 'node:fs/promises';
+import { type Chunker } from '@opentdf/sdk';
+
+/**
+ * Largest single `FileHandle.read` we issue. Node rejects reads longer than
+ * 2^31-1 bytes, so larger ranges are read in a loop.
+ */
+const MAX_READ = 1 << 30;
+
+/**
+ * A {@link Chunker} over a local file, plus the means to release it.
+ */
+export type FileChunker = Chunker & {
+  /** File size in bytes, taken from `fstat` when the file was opened. */
+  readonly size: number;
+  /** Closes the underlying file handle. Safe to call more than once. */
+  close(): Promise<void>;
+};
+
+/**
+ * Resolve chunker-style `[byteStart, byteEnd)` arguments against a known size,
+ * using the same rules as `Uint8Array.prototype.slice`: negative values count
+ * back from the end, and results are clamped to `[0, size]`.
+ */
+export function resolveRange(
+  size: number,
+  byteStart?: number,
+  byteEnd?: number
+): [start: number, end: number] {
+  const clamp = (n: number) => Math.min(Math.max(n < 0 ? size + n : n, 0), size);
+  const start = byteStart === undefined ? 0 : clamp(byteStart);
+  const end = byteEnd === undefined ? size : clamp(byteEnd);
+  return [start, Math.max(start, end)];
+}
+
+/**
+ * Opens a local file for random access by explicit byte position.
+ *
+ * This exists because `fs.openAsBlob()` cannot be used for files of 4 GiB or
+ * more: Node reports a file-backed Blob's `size` modulo 2^32, so `slice()`
+ * with a negative offset (which the zip reader uses to find the central
+ * directory) reads from the wrong place. See nodejs/node#66207 and DSPX-5160.
+ *
+ * `FileHandle.read` takes a numeric position, which is exact up to 2^53, so
+ * this works for any file size the SDK can otherwise handle.
+ *
+ * The returned function can be passed as `{ type: 'chunker', location }` to
+ * both decrypt (random access) and encrypt (read sequentially in chunks until
+ * an empty chunk is returned). Call `close()` when finished.
+ */
+export async function openFileChunker(path: string): Promise<FileChunker> {
+  const handle: FileHandle = await open(path, 'r');
+  let size: number;
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile()) {
+      throw new Error(`not a regular file [${path}]`);
+    }
+    size = stats.size;
+  } catch (e) {
+    await handle.close();
+    throw e;
+  }
+  let closed: Promise<void> | undefined;
+
+  const chunker = async (byteStart?: number, byteEnd?: number): Promise<Uint8Array> => {
+    if (closed) {
+      throw new Error(`file is closed [${path}]`);
+    }
+    const [start, end] = resolveRange(size, byteStart, byteEnd);
+    const buf = new Uint8Array(end - start);
+    let filled = 0;
+    while (filled < buf.length) {
+      const length = Math.min(buf.length - filled, MAX_READ);
+      const { bytesRead } = await handle.read(buf, filled, length, start + filled);
+      if (bytesRead === 0) {
+        // File shrank since it was opened; return what we have.
+        return buf.subarray(0, filled);
+      }
+      filled += bytesRead;
+    }
+    return buf;
+  };
+
+  return Object.assign(chunker, {
+    size,
+    close: () => (closed ??= handle.close()),
+  });
+}