Enforce unique interface GUIDs and add pre-commit check

- Fix duplicate interface GUIDs across the codebase so each
  interface has a unique GUID and Supports() resolves correctly.
- Add scripts/check-duplicate-guids.ps1 to detect duplicate
  GUIDs in *.pas (regex ['{...}']) and exit non-zero when found.
- Add .git/hooks/pre-commit to run the duplicate-GUID script
  before each commit (Duplicate Interface GUID Check).

CryptoLib/src/Crypto/Operators/ClpDefaultSignatureResult.pas

@@ -31,7 +31,7 @@ type
   /// Interface for default signature result operations.
   /// </summary>
   IDefaultSignatureResult = interface(IBlockResult)
-    ['{B2C3D4E5-F6A7-8901-BCDE-F12345678901}']
+    ['{A3964592-CB32-43F7-9857-D3BFD15FCF80}']
   end;
 
   /// <summary>

CryptoLib/src/Interfaces/Asn1/ClpIAsn1Encodings.pas

@@ -70,7 +70,7 @@ type
   /// Interface for constructed DER encoding.
   /// </summary>
   IConstructedDerEncoding = interface(IDerEncoding)
-    ['{E1F2A3B4-C5D6-E7F8-9A0B-1C2D3E4F5A6B}']
+    ['{24401A28-DFC0-40ED-99B0-8D4A7B0D8C1C}']
 
     /// <summary>
     /// Get the contents length.

CryptoLib/src/Interfaces/Asn1/ClpIAsn1Generators.pas

@@ -31,7 +31,7 @@ type
   /// Interface for ASN.1 generators.
   /// </summary>
   IAsn1Generator = interface(IInterface)
-    ['{B1C2D3E4-F5A6-B7C8-D9E0-F1A2B3C4D5E6}']
+    ['{28C758DF-6AAB-437E-9D54-5F70F200A216}']
     procedure AddObject(const AObj: IAsn1Encodable);
     function GetRawOutputStream(): TStream;
     procedure Close();
@@ -41,7 +41,7 @@ type
   /// Interface for BER generators.
   /// </summary>
   IBerGenerator = interface(IAsn1Generator)
-    ['{C2D3E4F5-A6B7-C8D9-E0F1-A2B3C4D5E6F7}']
+    ['{78361853-9B50-4B6B-AB16-A6F39FC44675}']
     procedure WriteHdr(ATag: Int32);
     procedure WriteBerHeader(ATag: Int32);
     procedure WriteBerBody(AContentStream: TStream);

CryptoLib/src/Interfaces/Asn1/ClpIAsn1Objects.pas

@@ -374,7 +374,7 @@ type
   /// Interface for DL bit string objects.
   /// </summary>
   IDLBitString = interface(IDerBitString)
-    ['{8BC8ED8F-DE72-5E45-BF26-AF16A7F7E8C8}']
+    ['{2D83078F-0943-485B-AA57-67CB3A489EEA}']
   end;
 
   /// <summary>
@@ -463,7 +463,7 @@ type
   /// Interface for DL tagged object objects.
   /// </summary>
   IDLTaggedObject = interface(IDerTaggedObject)
-    ['{8BC8ED8F-DE72-5E45-BF26-AF16A7F7E8C8}']
+    ['{519A9202-31EE-45FE-82C4-52A9A9BDA498}']
   end;
 
 
@@ -497,7 +497,7 @@ type
   /// Interface for DER integer objects.
   /// </summary>
   IDerInteger = interface(IAsn1Object)
-    ['{B2C3D4E5-F6A7-8901-BCDE-F12345678901}']
+    ['{928B9400-2345-4345-B213-97899840AAFF}']
     /// <summary>
     /// Get the bytes.
     /// </summary>
@@ -640,7 +640,7 @@ type
   /// Interface for DER boolean objects.
   /// </summary>
   IDerBoolean = interface(IAsn1Object)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{3E4ECCDA-E93E-4312-8F9D-BFE00004F75C}']
     /// <summary>
     /// Get the boolean value.
     /// </summary>
@@ -722,7 +722,7 @@ type
   /// Interface for ASN.1 object descriptor objects.
   /// </summary>
   IAsn1ObjectDescriptor = interface(IAsn1Object)
-    ['{E5F6A7B8-C9D0-1234-EF01-345678901234}']
+    ['{9BF87213-86ED-4A88-A4C3-816B175C3522}']
     /// <summary>
     /// Get the graphic string.
     /// </summary>
@@ -811,7 +811,7 @@ type
   /// Interface for DL external objects.
   /// </summary>
   IDLExternal = interface(IDerExternal)
-    ['{8BC8ED8F-DE72-5E45-BF26-AF16A7F7E8C8}']
+    ['{A22F9146-3F69-4425-B68C-1EC2CB4D0354}']
   end;
 
   /// <summary>

CryptoLib/src/Interfaces/Asn1/ClpIAsn1Parsers.pas

@@ -76,7 +76,7 @@ type
   /// Interface for ASN.1 bit string parsers.
   /// </summary>
   IAsn1BitStringParser = interface(IAsn1Convertible)
-    ['{A2B3C4D5-E6F7-8901-2345-6789ABCDEF01}']
+    ['{3A41C418-5838-421C-8B61-2CA47A154EBA}']
 
     /// <summary>
     /// Return a stream representing the contents of the BIT STRING.

CryptoLib/src/Interfaces/Asn1/Pkcs/ClpIPkcsAsn1Objects.pas

@@ -41,7 +41,7 @@ type
   /// Interface for AttributePkcs.
   /// </summary>
   IAttributePkcs = interface(IAsn1Encodable)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF0123456789}']
+    ['{6F46BA6D-376C-4DB9-A85F-88A443FA3666}']
 
     function GetAttrType: IDerObjectIdentifier;
     function GetAttrValues: IAsn1Set;
@@ -54,7 +54,7 @@ type
   /// Interface for CertificationRequest.
   /// </summary>
   ICertificationRequest = interface(IAsn1Encodable)
-    ['{B2C3D4E5-F6A7-8901-BCDE-F0123456789A}']
+    ['{2FD51313-14E1-414E-A648-2AD4BCBA997F}']
 
     function GetCertificationRequestInfo: ICertificationRequestInfo;
     function GetSignatureAlgorithm: IAlgorithmIdentifier;
@@ -69,7 +69,7 @@ type
   /// Interface for CertificationRequestInfo.
   /// </summary>
   ICertificationRequestInfo = interface(IAsn1Encodable)
-    ['{C3D4E5F6-A7B8-9012-CDEF-0123456789AB}']
+    ['{4405808E-2B24-4F6A-BFC6-92212D567D29}']
 
     function GetVersion: IDerInteger;
     function GetSubject: IX509Name;
@@ -86,7 +86,7 @@ type
   /// Interface for PrivateKeyInfo.
   /// </summary>
   IPrivateKeyInfo = interface(IAsn1Encodable)
-    ['{E6F7A8B9-C0D1-E2F3-A4B5-C6D7E8F9A0B1}']
+    ['{B118BDBB-DDA9-446F-A2FC-E8350620E054}']
 
     function GetVersion: IDerInteger;
     function GetPrivateKeyAlgorithm: IAlgorithmIdentifier;
@@ -110,7 +110,7 @@ type
   /// Interface for RsaPrivateKeyStructure.
   /// </summary>
   IRsaPrivateKeyStructure = interface(IAsn1Encodable)
-    ['{F7A8B9C0-D1E2-F345-A6B7-C8D9E0F1A2B3}']
+    ['{2F80DE02-A5DF-4F82-8011-A6A658DF5473}']
 
     function GetModulus: TBigInteger;
     function GetPublicExponent: TBigInteger;

CryptoLib/src/Interfaces/Asn1/Pkcs/ClpIPkcsRsaAsn1Objects.pas

@@ -32,7 +32,7 @@ type
   /// Interface for RsaPrivateKeyStructure.
   /// </summary>
   IRsaPrivateKeyStructure = interface(IAsn1Encodable)
-    ['{F7A8B9C0-D1E2-F345-A6B7-C8D9E0F1A2B3}']
+    ['{3E021F89-2107-4252-A60A-FA3C00149CFA}']
 
     function GetModulus: TBigInteger;
     function GetPublicExponent: TBigInteger;

CryptoLib/src/Interfaces/Asn1/Sec/ClpISecECAsn1Objects.pas

@@ -31,7 +31,7 @@ type
   /// Interface for the elliptic curve private key object from SEC 1
   /// </summary>
   IECPrivateKeyStructure = interface(IAsn1Encodable)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{1F1024CF-E179-49F8-8B4D-906078407DB3}']
 
     function GetVersion: IDerInteger;
     function GetPrivateKey: IAsn1OctetString;

CryptoLib/src/Interfaces/Asn1/X509/ClpIX509Asn1Generators.pas

@@ -33,7 +33,7 @@ type
   /// Interface for V1 TbsCertificate structure generator.
   /// </summary>
   IV1TbsCertificateGenerator = interface
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{26EA3114-5B47-49BE-9CD9-58E7A4E5C927}']
     procedure SetSerialNumber(const ASerialNumber: IDerInteger);
     procedure SetSignature(const ASignature: IAlgorithmIdentifier);
     procedure SetIssuer(const AIssuer: IX509Name);
@@ -51,7 +51,7 @@ type
   /// Interface for V3 TbsCertificate structure generator.
   /// </summary>
   IV3TbsCertificateGenerator = interface
-    ['{B2C3D4E5-F6A7-8901-BCDE-F12345678901}']
+    ['{B0863857-D467-4983-9BDA-A78DAA8D6784}']
     procedure SetSerialNumber(const ASerialNumber: IDerInteger);
     procedure SetSignature(const ASignature: IAlgorithmIdentifier);
     procedure SetIssuer(const AIssuer: IX509Name);
@@ -73,7 +73,7 @@ type
   /// Interface for V2 AttributeCertificateInfo generator.
   /// </summary>
   IV2AttributeCertificateInfoGenerator = interface
-    ['{C3D4E5F6-A7B8-9012-CDEF-012345678901}']
+    ['{50F936AE-95F8-4716-898E-7E01D0CBCE9A}']
     procedure SetHolder(const AHolder: IHolder);
     procedure AddAttribute(const AOid: String; const AValue: IAsn1Encodable); overload;
     procedure AddAttribute(const AAttribute: IAttributeX509); overload;
@@ -91,7 +91,7 @@ type
   /// Interface for V2 TbsCertList structure generator.
   /// </summary>
   IV2TbsCertListGenerator = interface
-    ['{D4E5F6A7-B8C9-0123-DEF0-123456789012}']
+    ['{AC77BA87-29B9-4BE8-A61F-E44F9A0B2FB6}']
     procedure SetSignature(const ASignature: IAlgorithmIdentifier);
     procedure SetIssuer(const AIssuer: IX509Name);
     procedure SetThisUpdate(const AThisUpdate: IAsn1UtcTime); overload;

CryptoLib/src/Interfaces/Asn1/X509/ClpIX509Asn1Objects.pas

@@ -391,7 +391,7 @@ type
   /// Interface for AttributeX509.
   /// </summary>
   IAttributeX509 = interface(IAsn1Encodable)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{8BE434FF-8DCC-4323-80E0-8DECC8B1B6A2}']
     function GetAttrType: IDerObjectIdentifier;
     function GetAttrValues: IAsn1Set;
     function GetAttributeValues: TCryptoLibGenericArray<IAsn1Encodable>;

CryptoLib/src/Interfaces/Asn1/X509/ClpIX509NameTokenizer.pas

@@ -26,7 +26,7 @@ type
   /// Interface for breaking up an X500 Name into its component tokens.
   /// </summary>
   IX509NameTokenizer = interface
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF0123456789}']
+    ['{E3DBDADD-8F1F-4472-AED5-E617920024A0}']
 
     function HasMoreTokens: Boolean;
     function NextToken: String;

CryptoLib/src/Interfaces/Crypto/Ciphers/ClpIAsymmetricBlockCipher.pas

@@ -30,7 +30,7 @@ type
   /// Base interface for a public/private key block cipher.
   /// </summary>
   IAsymmetricBlockCipher = interface(IInterface)
-    ['{D4E5F6A7-B8C9-0123-DEF0-123456789ABC}']
+    ['{88FB97DD-D496-4B3E-8A56-3111CECFC419}']
 
     /// <summary>
     /// The name of the algorithm this cipher implements.

CryptoLib/src/Interfaces/Crypto/Engines/ClpIRsaBlindedEngine.pas

@@ -30,7 +30,7 @@ type
   /// Wraps IRsa with random blinding for side-channel protection.
   /// </summary>
   IRsaBlindedEngine = interface(IAsymmetricBlockCipher)
-    ['{F6A7B8C9-D0E1-2345-F012-3456789ABCDE}']
+    ['{14EA4B56-B8CF-4D6E-BE9C-1C6D522A06E8}']
   end;
 
 implementation

CryptoLib/src/Interfaces/Crypto/Engines/ClpIRsaCoreEngine.pas

@@ -29,7 +29,7 @@ type
   /// Interface for the core RSA engine.
   /// </summary>
   IRsaCoreEngine = interface(IRsa)
-    ['{E5F6A7B8-C9D0-1234-EF01-23456789ABCD}']
+    ['{F5EE4B7D-FD1B-41CE-9EFC-39DB87599C05}']
   end;
 
 implementation

CryptoLib/src/Interfaces/Crypto/Engines/ClpIRsaEngine.pas

@@ -30,7 +30,7 @@ type
   /// This is a wrapper around IRsa that provides byte[] processing.
   /// </summary>
   IRsaEngine = interface(IAsymmetricBlockCipher)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{8EF00CAE-9F23-443A-B487-9AAE95039EAA}']
   end;
 
 implementation

CryptoLib/src/Interfaces/Crypto/Generators/ClpIRsaGenerators.pas

@@ -28,7 +28,7 @@ uses
 
 type
   IRsaKeyPairGenerator = interface(IAsymmetricCipherKeyPairGenerator)
-    ['{A7B8C9D0-E1F2-3456-0123-456789ABCDEF}']
+    ['{2259ACEB-6CF5-4AC9-9255-9A7DD432B0D2}']
   end;
 
   IRsaBlindingFactorGenerator = interface(IInterface)

CryptoLib/src/Interfaces/Crypto/Operators/ClpIBlockResult.pas

@@ -29,7 +29,7 @@ type
   /// Interface for operators that reduce their input to a single block.
   /// </summary>
   IBlockResult = interface
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF0123456789}']
+    ['{24451130-411B-405A-8121-CAA0DD11B26D}']
 
     /// <summary>
     /// Return the final result of the operation.

CryptoLib/src/Interfaces/Crypto/Operators/ClpISignatureFactory.pas

@@ -31,7 +31,7 @@ type
   /// Base interface for operators that serve as stream-based signature calculators.
   /// </summary>
   ISignatureFactory = interface
-    ['{D4E5F6A7-B8C9-0123-DEF0-123456789ABC}']
+    ['{891A7077-58D2-4CBF-B509-2C651C004932}']
 
     /// <summary>
     /// The algorithm details object for this calculator.

CryptoLib/src/Interfaces/Crypto/Operators/ClpIStreamCalculator.pas

@@ -30,7 +30,7 @@ type
   /// which reduce a stream of data to a single value.
   /// </summary>
   IStreamCalculator<TResult> = interface
-    ['{C3D4E5F6-A7B8-9012-CDEF-0123456789AB}']
+    ['{6323F6FD-A832-4190-85C7-8B7F26E961C3}']
 
     /// <summary>
     /// Return a "sink" stream which only exists to update the implementing object.

CryptoLib/src/Interfaces/Crypto/Operators/ClpIVerifier.pas

@@ -29,7 +29,7 @@ type
   /// Interface for operators that reduce their input to the validation of a signature.
   /// </summary>
   IVerifier = interface
-    ['{B2C3D4E5-F6A7-8901-BCDE-F0123456789A}']
+    ['{480DB7F4-646F-4E2D-A1B1-52C8491731A2}']
 
     /// <summary>
     /// Return true if the passed in data matches what is expected by the verification result.

CryptoLib/src/Interfaces/Crypto/Operators/ClpIVerifierFactory.pas

@@ -31,7 +31,7 @@ type
   /// Base interface for operators that serve as stream-based signature verifiers.
   /// </summary>
   IVerifierFactory = interface
-    ['{E5F6A7B8-C9D0-1234-EF01-23456789ABCD}']
+    ['{2212002D-33CE-488F-8510-9B22B216FD74}']
 
     /// <summary>
     /// The algorithm details object for this verifier.

CryptoLib/src/Interfaces/Crypto/Operators/ClpIVerifierFactoryProvider.pas

@@ -30,7 +30,7 @@ type
   /// Base interface for a provider to support the dynamic creation of signature verifiers.
   /// </summary>
   IVerifierFactoryProvider = interface
-    ['{F6A7B8C9-D0E1-2345-F012-3456789ABCDE}']
+    ['{484B3126-A8AA-4512-91F2-1EFCAC0DAD4E}']
 
     /// <summary>
     /// Return a signature verifier for signature algorithm described in the passed in algorithm details object.

CryptoLib/src/Interfaces/Crypto/Parameters/ClpIECParameters.pas

@@ -59,7 +59,7 @@ type
   end;
 
   IECNamedDomainParameters = interface(IECDomainParameters)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{31F8B2D3-B992-41B1-AD08-7CFAD97CD8D1}']
 
     function GetName: IDerObjectIdentifier;
 

CryptoLib/src/Interfaces/Crypto/Parameters/ClpIIesParameters.pas

@@ -67,7 +67,7 @@ type
   /// and IES parameters for engine.Init(forEncryption, priv, pub, iesParams).
   /// </summary>
   IIesCipherParameters = interface(ICipherParameters)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{CD600F5E-F903-4E27-BA79-ECF46B21EC6D}']
 
     function GetPrivateKey: ICipherParameters;
     function GetPublicKey: ICipherParameters;

CryptoLib/src/Interfaces/Crypto/Parameters/ClpIRsaParameters.pas

@@ -29,7 +29,7 @@ uses
 
 type
   IRsaKeyParameters = interface(IAsymmetricKeyParameter)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{1660B435-4AB3-4475-97E0-4D1241C10900}']
 
     function GetModulus: TBigInteger;
     function GetExponent: TBigInteger;
@@ -42,7 +42,7 @@ type
   end;
 
   IRsaPrivateCrtKeyParameters = interface(IRsaKeyParameters)
-    ['{B2C3D4E5-F6A7-8901-BCDE-F12345678901}']
+    ['{F7678089-D9A1-4EBC-8A2E-3BA9FE8D36D0}']
 
     function GetPublicExponent: TBigInteger;
     function GetP: TBigInteger;
@@ -61,7 +61,7 @@ type
   end;
 
   IRsaKeyGenerationParameters = interface(IKeyGenerationParameters)
-    ['{C3D4E5F6-A7B8-9012-CDEF-123456789012}']
+    ['{0A123755-1AFA-439D-AF17-EF0520B5337A}']
 
     function GetPublicExponent: TBigInteger;
     function GetCertainty: Int32;

CryptoLib/src/Interfaces/Math/EC/Abc/ClpIZTauElement.pas

@@ -29,7 +29,7 @@ type
   /// Interface for an element of Z[tau], where lambda = u + v*tau.
   /// </summary>
   IZTauElement = interface(IInterface)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{F6E791EA-EBF1-4224-9210-43099D52F317}']
 
     function GetU: TBigInteger;
     function GetV: TBigInteger;

CryptoLib/src/Interfaces/Math/EC/ClpIECCommon.pas

@@ -110,7 +110,7 @@ type
   end;
 
   IAbstractF2mCurve = interface(IECCurve)
-    ['{B2C3D4E5-F6A7-8901-BCDE-F12345678901}']
+    ['{E8DC6D63-BA59-43E4-B3D5-5ACC8E26400B}']
     function GetIsKoblitz: Boolean;
     function SolveQuadraticEquation(const ABeta: IECFieldElement): IECFieldElement;
     property IsKoblitz: Boolean read GetIsKoblitz;

CryptoLib/src/Interfaces/Pem/ClpIPemObjects.pas

@@ -35,7 +35,7 @@ type
   /// Interface for PEM header objects.
   /// </summary>
   IPemHeader = interface(IInterface)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{ED7A5DF3-5307-427B-8B47-63820438FEF1}']
 
     function GetName: String;
     function GetValue: String;
@@ -80,7 +80,7 @@ type
   /// Interface for PEM objects.
   /// </summary>
   IPemObject = interface(IPemObjectGenerator)
-    ['{C3D4E5F6-A7B8-9012-CDEF-0123456789AB}']
+    ['{9D65BB7D-721A-48B4-963B-13DBA970705A}']
 
     function GetType: String;
     function GetHeaders: TCryptoLibGenericArray<IPemHeader>;
@@ -104,7 +104,7 @@ type
   /// Interface for PEM reader.
   /// </summary>
   IPemReader = interface(IInterface)
-    ['{D4E5F6A7-B8C9-0123-DEF0-123456789ABC}']
+    ['{0139877B-ED23-46C7-BE39-E5010AC26507}']
 
     function GetReader: TStream;
 
@@ -124,7 +124,7 @@ type
   /// Interface for PEM writer.
   /// </summary>
   IPemWriter = interface(IInterface)
-    ['{E5F6A7B8-C9D0-1234-EF01-23456789ABCD}']
+    ['{E534B37C-C6B0-4066-9AB9-758BDAD3C3A0}']
 
     function GetWriter: TStream;
 
@@ -151,7 +151,7 @@ type
   /// Interface for PEM parser.
   /// </summary>
   IPemParser = interface(IInterface)
-    ['{F6A7B8C9-D0E1-2345-F012-3456789ABCDE}']
+    ['{8C91EC3F-A5D3-4714-8A3E-A68C381FF754}']
 
     /// <summary>
     /// Read a PEM object from the stream and return it as an ASN.1 sequence.

CryptoLib/src/Interfaces/Pkcs/ClpIPkcs10CertificationRequest.pas

@@ -33,7 +33,7 @@ type
   /// Interface for Pkcs10CertificationRequest (PKCS#10 CSR with verify/get public key/extensions).
   /// </summary>
   IPkcs10CertificationRequest = interface(ICertificationRequest)
-    ['{D4E5F6A7-B8C9-0123-DEF0-123456789ABC}']
+    ['{3F108F81-6586-481E-A8CB-488D2AE5226F}']
 
     function GetPublicKey: IAsymmetricKeyParameter;
     function GetRequestedExtensions: IX509Extensions;

CryptoLib/src/Interfaces/Rngs/Providers/ClpIRandomSourceProvider.pas

@@ -29,7 +29,7 @@ type
   /// Interface for random source providers.
   /// </summary>
   IRandomSourceProvider = interface(IInterface)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF0123456789}']
+    ['{36D4B411-F510-418F-9ADB-DB8136DCFCA5}']
 
     /// <summary>Fill byte array with random bytes from implementing source.</summary>
     procedure GetBytes(const AData: TCryptoLibByteArray);

CryptoLib/src/Interfaces/X509/ClpIX509Attribute.pas

@@ -30,7 +30,7 @@ type
   /// Class for carrying the values in an X.509 Attribute.
   /// </summary>
   IX509Attribute = interface
-    ['{B1C2D3E4-F5A6-7890-BCDE-F12345678901}']
+    ['{B43958A4-2E0A-4F18-A7AC-0DF88F32B6B3}']
 
     function GetOid: String;
     function GetValues: TCryptoLibGenericArray<IAsn1Encodable>;

CryptoLib/src/Interfaces/X509/ClpIX509CertificateParser.pas

@@ -31,7 +31,7 @@ type
   /// Interface for X.509 certificate parser.
   /// </summary>
   IX509CertificateParser = interface(IInterface)
-    ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+    ['{B1119A4C-2901-4CC1-895E-6285385059F2}']
 
     /// <summary>
     /// Read a certificate from a byte array.

CryptoLib/src/Interfaces/X509/ClpIX509Extension.pas

@@ -30,7 +30,7 @@ type
   /// Interface for X509Extension (helper class, not ASN1Encodable).
   /// </summary>
   IX509Extension = interface
-    ['{E6F7A8B9-C0D1-E2F3-A4B5-C6D7E8F9A0B1}']
+    ['{3C3A86D2-15E7-4692-8386-01708589F045}']
 
     function GetIsCritical: Boolean;
     function GetValue: IAsn1OctetString;

CryptoLib/src/Interfaces/X509/ClpIX509Generators.pas

@@ -39,7 +39,7 @@ uses
 
 type
   IX509V1CertificateGenerator = interface
-    ['{C2D3E4F5-A6B7-8901-CDEF-234567890123}']
+    ['{8B7E875E-C0AE-4CB6-9F89-C86D1EA230BE}']
     procedure Reset;
     procedure SetSerialNumber(const ASerialNumber: TBigInteger);
     procedure SetIssuerDN(const AIssuer: IX509Name);
@@ -55,7 +55,7 @@ type
   end;
 
   IX509V3CertificateGenerator = interface
-    ['{D3E4F5A6-B7C8-9012-DEF0-345678901234}']
+    ['{0B5BDF63-032B-4348-BBD1-30E75BA32731}']
     procedure Reset;
     procedure SetSerialNumber(const ASerialNumber: TBigInteger);
     procedure SetIssuerDN(const AIssuer: IX509Name);

CryptoLib/src/X509/ClpX509Certificate.pas

@@ -65,7 +65,7 @@ type
   strict private
   type
     ICachedEncoding = interface(IInterface)
-      ['{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}']
+      ['{32BC4E66-D9CB-437A-8DE1-E074EDBDAAE6}']
       function GetEncoding: TCryptoLibByteArray;
       function GetEncoded: TCryptoLibByteArray;
     end;

scripts/check-duplicate-guids.ps1

@@ -0,0 +1,49 @@
+<#
+.SYNOPSIS
+  Checks that no two interface GUIDs in *.pas files are identical.
+.DESCRIPTION
+  Extracts all ['{...}'] GUIDs from *.pas, groups by GUID, and exits with
+  non-zero if any GUID appears more than once (reporting file:line for each).
+.EXAMPLE
+  .\scripts\check-duplicate-guids.ps1
+#>
+
+$ErrorActionPreference = 'Stop'
+
+# Repo root: script lives in <repo>/scripts/check-duplicate-guids.ps1
+$root = if ($PSScriptRoot) { Split-Path $PSScriptRoot -Parent } else { Get-Location }
+$pasFiles = Get-ChildItem -Path $root -Filter '*.pas' -Recurse -File -ErrorAction SilentlyContinue |
+  Where-Object { $_.FullName -notmatch '\.git\\' }
+
+# Use Select-String for fast single-pass scan over all files (no full file read per line)
+$guidPattern = "\['\{([0-9A-Fa-f-]+)\}'\]"
+$matches = Select-String -LiteralPath $pasFiles.FullName -Pattern $guidPattern -AllMatches -ErrorAction SilentlyContinue
+
+$locationsByGuid = @{}
+foreach ($m in $matches) {
+  $guid = $m.Matches.Groups[1].Value.ToUpperInvariant()
+  $relPath = $m.Path.Replace($root, '').TrimStart('\', '/')
+  $entry = "${relPath}:$($m.LineNumber)"
+  if (-not $locationsByGuid.ContainsKey($guid)) {
+    $locationsByGuid[$guid] = [System.Collections.ArrayList]::new()
+  }
+  [void]$locationsByGuid[$guid].Add($entry)
+}
+
+$duplicates = $locationsByGuid.GetEnumerator() | Where-Object { $_.Value.Count -gt 1 }
+if ($duplicates) {
+  Write-Host 'Duplicate interface GUIDs found. Each GUID must be unique across the codebase.' -ForegroundColor Red
+  Write-Host ''
+  foreach ($d in $duplicates) {
+    Write-Host "GUID: {$($d.Key)}" -ForegroundColor Yellow
+    foreach ($loc in $d.Value) {
+      Write-Host "  $loc"
+    }
+    Write-Host ''
+  }
+  Write-Host 'Generate a new GUID: [guid]::NewGuid().ToString(''B'').ToUpperInvariant()' -ForegroundColor Cyan
+  exit 1
+}
+
+Write-Host 'No duplicate interface GUIDs found.' -ForegroundColor Green
+exit 0