diff --git a/CHANGES b/CHANGES
index 682fddb01b..4f71d0607b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,443 @@
 
+3.2.0-dev.727 | 2020-06-01 10:57:16 -0700
+
+  * Integrate review feedback
+
+    * Add deprecation for MIME_Entity::ContentType(), use GetContentType()
+
+    * Add deprecation for MIME_Entity::ContentSubType(), use GetContentSubType()
+
+    * Add deprecation for MIME_Message::BuildHeaderVal(), use ToHeaderVal()
+
+    * Add deprecation for MIME_Message::BuildHeaderTable(), use ToHeaderTable()
+
+    * Add deprecation for mime::new_string_val(), use mime::to_stringval()
+
+    * Add deprecation for ARP_Analyzer::ConstructAddrVal(), use ToAddrVal()
+
+    * Add deprecation for ARP_Analyzer::EthAddrToStr(), use ToEthAddrStr()
+
+    * Change the Func::Call() replacement to be named Func::Invoke() (Jon Siwek, Corelight)
+
+  * Switch Broker Val converter visitor to return IntrusivePtr (Jon Siwek, Corelight)
+
+  * Change BroFunc ctor to take const-ref IntrusivePtr<ID> (Jon Siwek, Corelight)
+
+  * Add version of Frame::SetElement() taking IntrusivePtr<ID>
+
+    Expect the version using raw ID* could go away eventually, but this is
+    convenience for the meantime. (Jon Siwek, Corelight)
+
+  * Change Scope/Func inits from id_list* to vector<IntrusivePtr<ID>> (Jon Siwek, Corelight)
+
+  * Change Scope::GenerateTemporary() to return IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate Scope::ReturnType(), replace with GetReturnType() (Jon Siwek, Corelight)
+
+  * Deprecate Scope::ScopeID(), replace with GetID() (Jon Siwek, Corelight)
+
+  * Switch parsing to use vector<IntrusivePtr<Attr>> from attr_list
+
+    This allows improved passing/storing of Attr references to Exprs,
+    TypeDecl, Scope, etc. (Jon Siwek, Corelight)
+
+  * Deprecate TableVal::FindAttr(), replace with GetAttr() (Jon Siwek, Corelight)
+
+  * Deprecate TypeDecl::FindAttr(), replace with GetAttr() (Jon Siwek, Corelight)
+
+  * Deprecate ID::FindAttr(), replace with GetAttr() (Jon Siwek, Corelight)
+
+  * Deprecate Attributes::FindAttr(), replace with Find() (Jon Siwek, Corelight)
+
+  * Deprecate Attributes::AddAttrs(Attributes*)
+
+    Replaced with version taking an IntrusivePtr parameter (Jon Siwek, Corelight)
+
+  * Add Attributes ctor that takes IntrusivePtrs (Jon Siwek, Corelight)
+
+  * Change Attributes to store std:vector<IntrusivePtr<Attr>>
+
+    This also changes the return type of Attributes::Attrs() from attr_list* (Jon Siwek, Corelight)
+
+  * Change Attr::SetAttrExpr() to non-template (Jon Siwek, Corelight)
+
+  * Deprecate Attr::AttrExpr(), replace with GetExpr() (Jon Siwek, Corelight)
+
+  * Deprecate ID::Attrs(), replace with GetAttrs() (Jon Siwek, Corelight)
+
+  * Remove weak_ref param from ID::SetVal()
+
+    It was not used anywhere. (Jon Siwek, Corelight)
+
+  * Store weak ref boolean along with Frame element Vals (Jon Siwek, Corelight)
+
+  * Deprecate Frame::GetElement(ID*), replace with GetElementByID() (Jon Siwek, Corelight)
+
+  * Deprecate Frame::NthElement(), replace with GetElement() (Jon Siwek, Corelight)
+
+  * Switch Frame::SetElement() to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Store IntrusivePtrs in Frame (Jon Siwek, Corelight)
+
+  * Deprecate Plugin::HookCallFunction(), replace with HookFunctionCall()
+
+    This also changes the argument type of Func::operator() to zeek::Args*
+    to allow plugins to be able to alter function arguments in place as
+    was previously documented. (Jon Siwek, Corelight)
+
+  * Switch plugin::Manager::HookCallFunction() to return IntrusivePtr
+
+    The plugin::Plugin side of things is not (yet) changed. (Jon Siwek, Corelight)
+
+  * Port remaining file analysis API to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate file analyzer construction methods taking raw RecordVal*
+
+    Replaced with versions that instead take IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate file_analysis::Analyzer::Args(), replace with GetArgs() (Jon Siwek, Corelight)
+
+  * Deprecate file_analysis::File::GetVal(), replace with ToVal() (Jon Siwek, Corelight)
+
+  * Change file_analysis::File::GetID() to return const-ref (Jon Siwek, Corelight)
+
+  * Fix build: some don't like IntrusivePtr default arg w/ incomplete type (Jon Siwek, Corelight)
+
+  * Change bro_broker::DataVal::ScriptDataType() to IntrusivePtr (Jon Siwek, Corelight)
+
+  * Change find_nested_record_types() to take IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate TypeType::Type(), replace with GetType() (Jon Siwek, Corelight)
+
+  * Add is_assignable() overload taking TypeTag (Jon Siwek, Corelight)
+
+  * Add is_atomic_type() overloads for IntrusivePtr (Jon Siwek, Corelight)
+
+  * Add same_type() overloads for IntrusivePtr args (Jon Siwek, Corelight)
+
+  * Change merge_types() to take IntrusivePtrs (Jon Siwek, Corelight)
+
+  * Deprecate IndexType::Indices(), replace with GetIndices() (Jon Siwek, Corelight)
+
+  * Add is_vector() methods taking const-ref IntrusivePtr (Jon Siwek, Corelight)
+
+  * Factor static-local nil IntrusivePtrs to global locations
+
+    Minor optimization to remove any run-time impact. (Jon Siwek, Corelight)
+
+  * Deprecate VectorVal::Lookup(), replace with At() (Jon Siwek, Corelight)
+
+  * Switch VectorVal BroValUnion to store std::vector<IntrusivePtr<Val>>
+
+    This changes the return type of AsVector() from std::vector<Val*>* (Jon Siwek, Corelight)
+
+  * Deprecate VectorVal::Insert() taking raw Val*, use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate VectorVal::Assign methods taking raw Val*
+
+    And adapt usages to pass in to alternate method taking IntrusivePtr (Jon Siwek, Corelight)
+
+  * Merge remote-tracking branch 'origin/master' into topic/jsiwek/gh-893-intrusive-ptr-migration (Jon Siwek, Corelight)
+
+  * Change EventHandler to store IntrusivePtr<Func>
+
+    Also deprecates the LocalHandler() and SetLocalHandler() methods,
+    replaced with GetFunc() and SetFunc(). (Jon Siwek, Corelight)
+
+  * Add Val::AsFuncPtr() convenience method
+
+    Since it's not trivial to store IntrusivePtr in BroValUnion and also
+    not satisfying to store IntrusivePtr*. (Jon Siwek, Corelight)
+
+  * Deprecate StringVal::Substitute(), replace with Replace() (Jon Siwek, Corelight)
+
+  * Switch a TableVal::CallChangeFunc param to IntrusivePtr (Jon Siwek, Corelight)
+
+  * Fix ambiguous ODesc::Add() call (Jon Siwek, Corelight)
+
+  * Minor TableVal::Assign() ref-counting optimization (Jon Siwek, Corelight)
+
+  * Improve TableVal HashKey management
+
+    * Deprecated ComputeHash() methods and replaced with MakeHashKey()
+      which returns std::unique_ptr<HashKey>
+
+    * Deprecated RecoverIndex() and replaced with RecreateIndex()
+      which takes HashKey& and returns IntrusivePtr.
+
+    * Updated the new TableVal Assign()/Remove() methods to take either
+      std::unique_ptr<HashKey> or HashKey& as appropriate for clarity of
+      ownership expectations. (Jon Siwek, Corelight)
+
+  * Add back in a deprecated TableVal ctor taking raw pointers (Jon Siwek, Corelight)
+
+  * Deprecate TableVal::Attrs(), replace with GetAttrs() (Jon Siwek, Corelight)
+
+  * Deprecate TableVal::Delete(), replace with Remove() (Jon Siwek, Corelight)
+
+  * Switch Func::Call(val_list*) back to returning Val*
+
+    And renamed the method returning IntrusivePtr to operator().
+    This corrects the deprecation process for Func::Call(val_list*). (Jon Siwek, Corelight)
+
+  * Deprecate TableVal::Lookup(), replace with Find()/FindOrDefault() (Jon Siwek, Corelight)
+
+  * Deprecate TableVal IsSubsetOf and EqualTo taking Val*, use Val& (Jon Siwek, Corelight)
+
+  * Deprecate ComputeHash(Val*) methods, replace with ComputeHash(Val&) (Jon Siwek, Corelight)
+
+  * Deprecate TableVal::Intersect(), replace with Intersection() (Jon Siwek, Corelight)
+
+  * Deprecate TableVal::Assign methods with Val*, add IntrusivePtr overloads (Jon Siwek, Corelight)
+
+  * Deprecate RecordVal::Lookup(const char*, bool)
+
+    Replace with GetField(const char*) and GetFieldOrDefault(const char*). (Jon Siwek, Corelight)
+
+  * Deprecate RecordVal::LookupWithDefault() replace with GetFieldOrDefault()
+
+    (The former was previously changed during this release cycle to return
+    Intrusive pointer, but this just changes it back to return Val* and
+    deprecates it). (Jon Siwek, Corelight)
+
+  * Deprecate RecordVal::Lookup(int), replace with GetField(int) (Jon Siwek, Corelight)
+
+  * Change BroValUnion to use IntrusivePtr for record field storage
+
+    This also changes the AsRecord() and AsNonConstRecord() accessors
+    to return std::vector<IntrusivePtr<Val>>* instead of val_list* (Jon Siwek, Corelight)
+
+  * Switch ASN1 Val conversion functions to return IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate RecordVal::Assign(int, Val*)
+
+    And adapt all usages to the existing overload taking IntrusivePtr. (Jon Siwek, Corelight)
+
+  * Switch RPC analyzers to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Switch RecordVal::CoerceTo() to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate TableEntryVal::Value(), replace with GetVal() (Jon Siwek, Corelight)
+
+  * Switch OpaqueVal::SerializeType() to IntrusivePtr (Jon Siwek, Corelight)
+
+  * Switch BlommFilterVal/CardinalityVal to use IntrusivePtr<BroType> (Jon Siwek, Corelight)
+
+  * Switch some TopkVal methods to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Switch TopkVal to store IntrusivePtr<BroType> (Jon Siwek, Corelight)
+
+  * Switch OpaqueVal::UnserializeType() to return IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate FuncType::ArgTypes(), replace with ParamList() (Jon Siwek, Corelight)
+
+  * Deprecate FuncType::Args(), replace with Params() (Jon Siwek, Corelight)
+
+  * Deprecate EventHandler::FType(), replace with GetType() (Jon Siwek, Corelight)
+
+  * Deprecate BroFile::FType(), replace with GetType() (Jon Siwek, Corelight)
+
+  * Deprecate Func::FType(), replace with Func::GetType() (Jon Siwek, Corelight)
+
+  * Change {Get,Set}ContentsFile() to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate BroFile::GetFile(), replace with BroFile::Get() (Jon Siwek, Corelight)
+
+  * Deprecate Val(BroFile*) ctor, replace with one using IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate Val(Func*) ctor, replace with one using IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate OpaqueVal/HashVal ctors that take OpaqueType*
+
+    Replaced with ones that take IntrusivePtr (Jon Siwek, Corelight)
+
+  * fixup! Deprecate Scope::Lookup(), replace with Scope::Find() (Jon Siwek, Corelight)
+
+  * Switch EnumType::GetVal() to return const-ref (Jon Siwek, Corelight)
+
+  * Change protected EnumVal ctor to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate RecordVal(RecordType*) ctor
+
+    Replaced with one that takes IntrusivePtr (Jon Siwek, Corelight)
+
+  * Switch zeek::id::lookup to zeek::id::find
+
+    For parity with Scope since it now uses Find instead of Lookup (Jon Siwek, Corelight)
+
+  * Use zeek::BifEvent:: for enqueue_ functions instead of BifEvent:: (Jon Siwek, Corelight)
+
+  * Replace deprecated usage of BifFunc:: with zeek::BifFunc::
+
+    Names of functions also changed slightly, like bro_fmt -> fmt_bif.
+
+    Should generally be unusual/unexpected to see somone calling these
+    directly from C++ in their plugin, but since technically possible in
+    previous versions, I also removed the "private" restriction on accessing
+    the BifReturnVal member. (Jon Siwek, Corelight)
+
+  * Deprecate names in BifConst, replace with zeek::BifConst
+
+    Some Val* types are also replaced with IntrusivePtr at the new location (Jon Siwek, Corelight)
+
+  * Deprecate all BroType* in BifType:: namespace
+
+    Replaced with equivalently named IntrusivePtr in zeek::BifType:: (Jon Siwek, Corelight)
+
+  * Change EventRegistry/EventHandler methods to use std::string{_view} (Jon Siwek, Corelight)
+
+  * Deprecate internal_handler(), replace with EventRegistry::Register()
+
+    Added a couple explicit event declarations that were missing: "net_done"
+    and "dns_mapping_name_changed". (Jon Siwek, Corelight)
+
+  * Deprecate remaining "opt_internal" functions in Var.h (Jon Siwek, Corelight)
+
+  * Remove signal_val declaration from Var.h (Jon Siwek, Corelight)
+
+  * Change zeek::id::lookup functions to use std::string_view (Jon Siwek, Corelight)
+
+  * Change Scope::Find() and Scope::Remove() to use std::string_view (Jon Siwek, Corelight)
+
+  * Change lookup_ID() to return a const-reference (Jon Siwek, Corelight)
+
+  * Deprecate Scope::Lookup(), replace with Scope::Find() (Jon Siwek, Corelight)
+
+  * Move various elements into ID.h and zeek::id namespace
+
+    * A handful of generic/useful/common global type pointers that used
+      to be in NetVar.h
+
+    * Lookup functions that used to be Var.h (Jon Siwek, Corelight)
+
+  * Trim the list of "global type pointers" from NetVar.h further
+
+    Most of them are deprecated now, with usage sites now doing the lookup
+    themselves. (Jon Siwek, Corelight)
+
+  * Deprecate global Val pointers in NetVar.h
+
+    All of these have fairly niche uses, so better maintained as
+    lookup/static closer to the usage site. (Jon Siwek, Corelight)
+
+  * Deprecate global type pointers in NetVar.h
+
+    There's analogous IntrusivePtrs in zeek::vars (Jon Siwek, Corelight)
+
+  * Add RecordVal ctor that takes IntrusivePtr (Jon Siwek, Corelight)
+
+  * Remove unused FlattenExpr (Jon Siwek, Corelight)
+
+  * Add missing "vector_coerce" to expr_name() (Jon Siwek, Corelight)
+
+  * Deprecate Expr::Type(), replace with GetType() (Jon Siwek, Corelight)
+
+  * Deprecate Val::Type(), replace with GetType() (Jon Siwek, Corelight)
+
+  * Change Val to store IntrusivePtr (Jon Siwek, Corelight)
+
+  * Remove VectorVal::vector_type member (Jon Siwek, Corelight)
+
+  * Deprecate VectorVal(VectorType*) ctora
+
+    Adds a new one taking an IntrusivePtr. (Jon Siwek, Corelight)
+
+  * Deprecate internal_list_val() (Jon Siwek, Corelight)
+
+  * Deprecate opt_internal_val() (Jon Siwek, Corelight)
+
+  * Deprecate internal_func(), replace with zeek::lookup_func() (Jon Siwek, Corelight)
+
+  * Deprecate internal_val() and internal_const_val()
+
+    Replaced with zeek::lookup_val() and zeek::lookup_const() (Jon Siwek, Corelight)
+
+  * Deprecate internal_type(), replace with zeek::lookup_type() (Jon Siwek, Corelight)
+
+  * Deprecate ID::ID_Val(), replace with ID::GetVal() (Jon Siwek, Corelight)
+
+  * Use std::move in some zeekygen::Manager methods (Jon Siwek, Corelight)
+
+  * Add Val TypeType constructor taking an IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate ID::Type(), replace with GetType() (Jon Siwek, Corelight)
+
+  * Deprecate ID::AsType(), add ID::IsType() and ID::GetType() (Jon Siwek, Corelight)
+
+  * Deprecate BroType::YieldType(), replace with Yield() (Jon Siwek, Corelight)
+
+  * Change base_type() to return const-ref, deprecate base_type_no_ref() (Jon Siwek, Corelight)
+
+  * Deprecate BroType::GetField() and BroType::HasField() (Jon Siwek, Corelight)
+
+  * Deprecate RecordType::FieldType(), replace with GetFieldType() (Jon Siwek, Corelight)
+
+  * Migrate TypeList to store IntrusivePtrs
+
+    This changes return types of TypeList::Types() and
+    IndexType::IndexTypes() to return std::vector instead of type_list* (Jon Siwek, Corelight)
+
+  * Deprecate TypeList::PureType(), replace with TypeList::GetPureType() (Jon Siwek, Corelight)
+
+  * Deprecate SetType::SetElements(), replace with SetType::Elements() (Jon Siwek, Corelight)
+
+  * Remove unused TableType::ExpandRecordIndex() (Jon Siwek, Corelight)
+
+  * Add cast_intrusive() and make use of it in two spots (Jon Siwek, Corelight)
+
+  * Give make_intrusive() access to protected EnumVal ctor (Jon Siwek, Corelight)
+
+  * Remove two superfluous IntrusivePtr NewRefs in Type.cc (Jon Siwek, Corelight)
+
+  * Change BroType::ShallowClone() to return IntrusivePtr (Jon Siwek, Corelight)
+
+  * Migrate IP.cc to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Migrate SMB analyzer to use IntrusivePtr
+
+    Deprecates the utf16_bytestring_to_utf8_val() function with replacement
+    being utf16_to_utf8_val(). (Jon Siwek, Corelight)
+
+  * Migrate ARP analyzer to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Migrate HTTP/MIME analyzers to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Migrate ICMP analyzer to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Migrate DNS analyzer to use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Migrate Tag classes to use IntrusivePtr
+
+    Deprecates various methods that previously took raw pointers (Jon Siwek, Corelight)
+
+  * Deprecate TableVal::ConvertToList() and TableVal::ConvertToPureList()
+
+    Replaced with ToListVal() and ToPureListVal() that return IntrusivePtr (Jon Siwek, Corelight)
+
+  * Switch ListVal to store IntrusivePtrs
+
+    * Deprecates ListVal::Index() methods and replaces with ListVal::Idx()
+
+    * Replaces ListVal::Vals() method with one that returns
+      std::vector<IntrusivePtr<Val>> rather than val_list (Jon Siwek, Corelight)
+
+  * Deprecant ListVal::Append(Val*) and add IntrusivePtr version (Jon Siwek, Corelight)
+
+  * Deprecate ListVal::ConvertToSet(), add ListVal::ToSetVal() (Jon Siwek, Corelight)
+
+  * Deprecate TunnelEncapsulation BuildRecordVal/BuildVectorVal methods
+
+    Replaced with ToVal methods that return IntrusivePtr (Jon Siwek, Corelight)
+
+  * Deprecate various IP/packet header Val-building methods
+
+    And supply new alternatives that use IntrusivePtr (Jon Siwek, Corelight)
+
+  * Update submodule(s)
+
+     [nomail] (Jon Siwek, Corelight)
+
+
 3.2.0-dev.573 | 2020-05-29 17:13:36 -0700
 
   * Add "Known::service_udp_requires_response" option (Jon Siwek, Corelight)
diff --git a/NEWS b/NEWS
index dbfcc64679..9276b4f753 100644
--- a/NEWS
+++ b/NEWS
@@ -96,6 +96,17 @@ Changed Functionality
 - The DCE/RPC operation string of "NetrLogonSamLogonWithFlags" has been
   corrected from "NetrLogonSameLogonWithFlags".
 
+- ``TypeList::Types()`` and ``IndexType::IndexTypes()`` now return an
+  ``std::vector`` instead of ``type_list*``
+
+- ``AsRecord()`` and ``AsNonConstRecord()`` have changed to return
+  ``std::vector<IntrusivePtr<Val>>*``.
+
+- ``AsVector()`` has changed to return ``std::vector<IntrusivePtr<Val>>*``.
+
+- ``Attributes::Attrs()`` now returns ``const std::vector<IntrusivePtr<Attr>>&``
+  instead of ``attr_list*``
+
 Removed Functionality
 ---------------------
 
@@ -108,10 +119,15 @@ Removed Functionality
 Deprecated Functionality
 ------------------------
 
-- The ``Func::Call(val_list*, ...)`` method is now deprecated.  The alternate
-  overload taking a ``zeek::Args`` (``std::vector<IntrusivePtr<Val>>``) should
-  be used instead.  There's also now a variadic template that forwards all
-  arguments.
+- The ``plugin::Plugin::HookCallFunction()`` method is deprecated.  Note
+  that compilers will not emit a deprecation warning, but the replacement
+  method to now use is called ``HookFunctionCall`` and uses ``IntrusivePtr``
+  arguments and return value.
+
+- The ``Func::Call(val_list*, ...)`` method is now deprecated.  Use ``Invoke()``
+  instead which takes a ``zeek::Args`` (``std::vector<IntrusivePtr<Val>>``).
+  There's also a variadic template for ``Invoke()`` that forwards all arguments
+  into a ``zeek::Args`` for you.
 
 - The ``EventMgr::QueueEvent()`` and EventMgr::QueueEventFast()`` methods
   are now deprecated, use ``EventMgr::Enqueue()`` instead.
@@ -135,7 +151,7 @@ Deprecated Functionality
 
 - ``Analyzer::BuildConnVal()`` is deprecated, use ``Analyzer::ConnVal()``.
 
-- ``BifEvent::generate_`` functions are deprecated, use ``BifEvent::enqueue_``.
+- ``BifEvent::generate_`` functions are deprecated, use ``zeek::BifEvent::enqueue_``.
 
 - ``binpac::bytestring_to_val()`` is deprecated, use ``binpac::to_stringval()``.
 
@@ -143,6 +159,87 @@ Deprecated Functionality
 
 - Returning ``Val*`` from BIFs is deprecated, return ``IntrusivePtr`` instead.
 
+- Various methods of converting protocol structures, like IP or packet headers,
+  to associated ``Val`` type are now deprecated, the deprecation warning
+  message will advise what new method to use instead.
+
+- Various methods of ``Tag`` classes are deprecated with the warning
+  message advising what new method to use instead.
+
+- The ``utf16_bytestring_to_utf8_val()`` function is deprecated, use
+  ``utf16_to_utf8_val()`` instead.
+
+- ``RecordType::FieldType()`` is deprecated, use ``RecordType::GetFieldType()``
+
+- ``BroType::HasField()`` and ``BroType::FieldType()`` are deprecated, use
+  the methods of ``RecordType`` directly.
+
+- ``BroType::YieldType()`` is deprecated, use ``BroType::Yield()``.
+
+- ``ID::AsType()`` is deprecated, use ``ID::IsType()`` and ``ID::GetType()``.
+
+- ``ID::Type()`` is deprecated, use ``ID::GetType()``.
+
+- ``ID::ID_Val()`` is deprecated, use ``ID::GetVal()``.
+
+- ``internal_type()`` is deprecated, use ``zeek::id::find_type()``.
+
+- ``internal_val()`` and ``internal_const_val()`` are deprecated, use
+  ``zeek::id::find_val()`` or ``zeek::id::find_const()``.
+
+- ``internal_func()`` is deprecated, use ``zeek::id::find_func()``.
+
+- ``opt_internal_val()`` is deprecated, use ``lookup_ID()`` or
+  ``zeek::id::find_val()``.
+
+- ``Val::Type()`` is deprecated, use ``Val::GetType``.
+
+- Most global type/value pointers in NetVar.h are deprecated, but one can
+  still always perform the lookup themselves.
+
+- ``Scope::Lookup()`` is deprecated, use ``Scope::Find()``.
+
+- All generated ``BroType*`` names in the ``BifType::`` namespaces are
+  deprecated, but there's an equivalent name in ``zeek::BifType::`` of
+  ``IntrusivePtr`` type to use instead.
+
+- All generated ``BifConst::`` names are deprecated, but there's an
+  equivalent name now in ``zeek::BifCont::``, and changed to ``IntrusivePtr``
+  if the old name was some ``Val*`` type.
+
+- Constructors for ``Val`` types that take a ``BroType*`` are all generally
+  deprecated, with alternatives that instead take an ``IntrusivePtr`` argument.
+
+- ``FuncType::Args()`` is deprecated, use ``FuncType::Params()``.
+
+- ``FuncType::ArgTypes()`` is deprecated, use ``FuncType::ParamList()``.
+
+- ``RecordVal::Assign(int, Val*)`` is deprecated, use the overload taking
+  ``IntrusivePtr``.
+
+- ``RecordVal::Lookup(int)`` is deprecated, use ``RecordVal::GetField(int)``.
+
+- ``RecordVal::LookupWithDefault(int)`` is deprecated, use
+  ``RecordVal::GetFieldOrDefault(int)``.
+
+- ``RecordVal::Lookup(const char*, bool)`` is deprecated, use either
+  ``RecordVal::GetField()`` or ``RecordVal::GetFieldOrDefault()``.
+
+- ``TableVal::Assign`` methods taking raw ``Val*`` are deprecated, use the
+  overloads taking ``IntrusivePtr``.
+
+- ``TableVal::Lookup()`` is deprecated, use ``TableVal::Find()`` or
+  ``TableVal::FindOrDefault()``.
+
+- ``VectorVal::Assign`` and ``Insert`` methods taking raw ``Val*`` are
+  deprecated, use the methods that take ``IntrusivePtr``.
+
+- ``VectorVal::Lookup()`` is deprecated, use ``VectorVal::At()``.
+
+- The file analysis/analyzer API has deprecated methods taking raw
+  ``RecordVal*`` for analyzer arguments and replaced those with methods
+  taking ``IntrusivePtr``.
+
 Zeek 3.1.0
 ==========
 
diff --git a/VERSION b/VERSION
index b49aa0eb5f..64c6dff9de 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.2.0-dev.573
+3.2.0-dev.727
diff --git a/aux/bifcl b/aux/bifcl
index 95fece382d..31f7e04b0d 160000
--- a/aux/bifcl
+++ b/aux/bifcl
@@ -1 +1 @@
-Subproject commit 95fece382d34bca72572cc863e1182b31a1b9945
+Subproject commit 31f7e04b0da5cfa65211208c64ac62874a065fc6
diff --git a/doc b/doc
index 89ed0528fd..23dbe360d1 160000
--- a/doc
+++ b/doc
@@ -1 +1 @@
-Subproject commit 89ed0528fda6f4648ccdd5402a21a1573c7fa3b6
+Subproject commit 23dbe360d105d1ffadc231b1d9fb06dea437b110
diff --git a/scripts/base/init-bare.zeek b/scripts/base/init-bare.zeek
index 2a90d7a339..a02a676df9 100644
--- a/scripts/base/init-bare.zeek
+++ b/scripts/base/init-bare.zeek
@@ -1870,9 +1870,6 @@ type gtp_delete_pdp_ctx_response_elements: record {
 @load base/frameworks/supervisor/api
 @load base/bif/supervisor.bif
 
-global done_with_network = F;
-event net_done(t: time) { done_with_network = T; }
-
 ## Internal function.
 function add_interface(iold: string, inew: string): string
 	{
@@ -5272,3 +5269,6 @@ const bits_per_uid: count = 96 &redef;
 ## to generate installation-unique file IDs (the *id* field of :zeek:see:`fa_file`).
 const digest_salt = "Please change this value." &redef;
 
+global done_with_network = F;
+event net_done(t: time)
+	{ done_with_network = T; }
diff --git a/src/Anon.cc b/src/Anon.cc
index 1d92892311..e6b0ee3b80 100644
--- a/src/Anon.cc
+++ b/src/Anon.cc
@@ -10,6 +10,8 @@
 #include "Val.h"
 #include "NetVar.h"
 #include "Reporter.h"
+#include "Scope.h"
+#include "ID.h"
 
 
 AnonymizeIPAddr* ip_anonymizer[NUM_ADDR_ANONYMIZATION_METHODS] = {nullptr};
@@ -354,6 +356,10 @@ AnonymizeIPAddr_A50::Node* AnonymizeIPAddr_A50::find_node(ipaddr32_t a)
 	return nullptr;
 	}
 
+static IntrusivePtr<TableVal> anon_preserve_orig_addr;
+static IntrusivePtr<TableVal> anon_preserve_resp_addr;
+static IntrusivePtr<TableVal> anon_preserve_other_addr;
+
 void init_ip_addr_anonymizers()
 	{
 	ip_anonymizer[KEEP_ORIG_ADDR] = nullptr;
@@ -361,35 +367,50 @@ void init_ip_addr_anonymizers()
 	ip_anonymizer[RANDOM_MD5] = new AnonymizeIPAddr_RandomMD5();
 	ip_anonymizer[PREFIX_PRESERVING_A50] = new AnonymizeIPAddr_A50();
 	ip_anonymizer[PREFIX_PRESERVING_MD5] = new AnonymizeIPAddr_PrefixMD5();
+
+	auto id = global_scope()->Find("preserve_orig_addr");
+
+	if ( id )
+		anon_preserve_orig_addr = cast_intrusive<TableVal>(id->GetVal());
+
+	id = global_scope()->Find("preserve_resp_addr");
+
+	if ( id )
+		anon_preserve_resp_addr = cast_intrusive<TableVal>(id->GetVal());
+
+	id = global_scope()->Find("preserve_other_addr");
+
+	if ( id )
+		anon_preserve_other_addr = cast_intrusive<TableVal>(id->GetVal());
 	}
 
 ipaddr32_t anonymize_ip(ipaddr32_t ip, enum ip_addr_anonymization_class_t cl)
 	{
 	TableVal* preserve_addr = nullptr;
-	AddrVal addr(ip);
+	auto addr = make_intrusive<AddrVal>(ip);
 
 	int method = -1;
 
 	switch ( cl ) {
 	case ORIG_ADDR: // client address
-		preserve_addr = preserve_orig_addr;
+		preserve_addr = anon_preserve_orig_addr.get();
 		method = orig_addr_anonymization;
 		break;
 
 	case RESP_ADDR: // server address
-		preserve_addr = preserve_resp_addr;
+		preserve_addr = anon_preserve_resp_addr.get();
 		method = resp_addr_anonymization;
 		break;
 
 	default:
-		preserve_addr = preserve_other_addr;
+		preserve_addr = anon_preserve_other_addr.get();
 		method = other_addr_anonymization;
 		break;
 	}
 
 	ipaddr32_t new_ip = 0;
 
-	if ( preserve_addr && preserve_addr->Lookup(&addr) )
+	if ( preserve_addr && preserve_addr->FindOrDefault(addr) )
 		new_ip = ip;
 
 	else if ( method >= 0 && method < NUM_ADDR_ANONYMIZATION_METHODS )
diff --git a/src/Attr.cc b/src/Attr.cc
index 49cbecfcba..c57f288313 100644
--- a/src/Attr.cc
+++ b/src/Attr.cc
@@ -37,6 +37,9 @@ Attr::Attr(attr_tag t)
 
 Attr::~Attr() = default;
 
+void Attr::SetAttrExpr(IntrusivePtr<Expr> e)
+	{ expr = std::move(e); }
+
 void Attr::Describe(ODesc* d) const
 	{
 	AddTag(d);
@@ -94,10 +97,10 @@ void Attr::DescribeReST(ODesc* d, bool shorten) const
 			d->Add("`");
 			}
 
-		else if ( expr->Type()->Tag() == TYPE_FUNC )
+		else if ( expr->GetType()->Tag() == TYPE_FUNC )
 			{
 			d->Add(":zeek:type:`");
-			d->Add(expr->Type()->AsFuncType()->FlavorString());
+			d->Add(expr->GetType()->AsFuncType()->FlavorString());
 			d->Add("`");
 			}
 
@@ -134,9 +137,8 @@ void Attr::AddTag(ODesc* d) const
 	}
 
 Attributes::Attributes(attr_list* a, IntrusivePtr<BroType> t, bool arg_in_record, bool is_global)
-	: type(std::move(t))
 	{
-	attrs = new attr_list(a->length());
+	attrs.reserve(a->length());
 	in_record = arg_in_record;
 	global_var = is_global;
 
@@ -152,22 +154,36 @@ Attributes::Attributes(attr_list* a, IntrusivePtr<BroType> t, bool arg_in_record
 	delete a;
 	}
 
-Attributes::~Attributes()
-	{
-	for ( const auto& attr : *attrs )
-		Unref(attr);
+Attributes::Attributes(IntrusivePtr<BroType> t,
+                       bool arg_in_record, bool is_global)
+    : Attributes(std::vector<IntrusivePtr<Attr>>{}, std::move(t),
+                 arg_in_record, is_global)
+    {}
 
-	delete attrs;
+Attributes::Attributes(std::vector<IntrusivePtr<Attr>> a,
+                       IntrusivePtr<BroType> t,
+                       bool arg_in_record, bool is_global)
+	: type(std::move(t))
+	{
+	attrs.reserve(a.size());
+	in_record = arg_in_record;
+	global_var = is_global;
+
+	SetLocationInfo(&start_location, &end_location);
+
+	// We loop through 'a' and add each attribute individually,
+	// rather than just taking over 'a' for ourselves, so that
+	// the necessary checking gets done.
+
+	for ( auto& attr : a )
+		AddAttr(std::move(attr));
 	}
 
 void Attributes::AddAttr(IntrusivePtr<Attr> attr)
 	{
-	if ( ! attrs )
-		attrs = new attr_list(1);
-
 	// We overwrite old attributes by deleting them first.
 	RemoveAttr(attr->Tag());
-	attrs->push_back(IntrusivePtr{attr}.release());
+	attrs.emplace_back(attr);
 
 	// We only check the attribute after we've added it, to facilitate
 	// generating error messages via Attributes::Describe.
@@ -176,72 +192,85 @@ void Attributes::AddAttr(IntrusivePtr<Attr> attr)
 	// For ADD_FUNC or DEL_FUNC, add in an implicit REDEF, since
 	// those attributes only have meaning for a redefinable value.
 	if ( (attr->Tag() == ATTR_ADD_FUNC || attr->Tag() == ATTR_DEL_FUNC) &&
-	     ! FindAttr(ATTR_REDEF) )
-		attrs->push_back(new Attr(ATTR_REDEF));
+	     ! Find(ATTR_REDEF) )
+		attrs.emplace_back(make_intrusive<Attr>(ATTR_REDEF));
 
 	// For DEFAULT, add an implicit OPTIONAL if it's not a global.
 	if ( ! global_var && attr->Tag() == ATTR_DEFAULT &&
-	     ! FindAttr(ATTR_OPTIONAL) )
-		attrs->push_back(new Attr(ATTR_OPTIONAL));
+	     ! Find(ATTR_OPTIONAL) )
+		attrs.emplace_back(make_intrusive<Attr>(ATTR_OPTIONAL));
+	}
+
+void Attributes::AddAttrs(const IntrusivePtr<Attributes>& a)
+	{
+	for ( const auto& attr : a->Attrs() )
+		AddAttr(attr);
 	}
 
 void Attributes::AddAttrs(Attributes* a)
 	{
-	attr_list* as = a->Attrs();
-	for ( const auto& attr : *as )
-		AddAttr({NewRef{}, attr});
+	for ( const auto& attr : a->Attrs() )
+		AddAttr(attr);
 
 	Unref(a);
 	}
 
 Attr* Attributes::FindAttr(attr_tag t) const
 	{
-	if ( ! attrs )
-		return nullptr;
-
-	for ( const auto& a : *attrs )
-		{
+	for ( const auto& a : attrs )
 		if ( a->Tag() == t )
-			return a;
-		}
+			return a.get();
 
 	return nullptr;
 	}
 
+const IntrusivePtr<Attr>& Attributes::Find(attr_tag t) const
+	{
+	for ( const auto& a : attrs )
+		if ( a->Tag() == t )
+			return a;
+
+	return Attr::nil;
+	}
+
 void Attributes::RemoveAttr(attr_tag t)
 	{
-	for ( int i = 0; i < attrs->length(); i++ )
-		if ( (*attrs)[i]->Tag() == t )
-			attrs->remove_nth(i--);
+	for ( auto it = attrs.begin(); it != attrs.end(); )
+		{
+		if ( (*it)->Tag() == t )
+			it = attrs.erase(it);
+		else
+			++it;
+		}
 	}
 
 void Attributes::Describe(ODesc* d) const
 	{
-	if ( ! attrs )
+	if ( attrs.empty() )
 		{
 		d->AddCount(0);
 		return;
 		}
 
-	d->AddCount(attrs->length());
+	d->AddCount(static_cast<uint64_t>(attrs.size()));
 
-	loop_over_list(*attrs, i)
+	for ( size_t i = 0; i < attrs.size(); ++i )
 		{
 		if ( (d->IsReadable() || d->IsPortable()) && i > 0 )
 			d->Add(", ");
 
-		(*attrs)[i]->Describe(d);
+		attrs[i]->Describe(d);
 		}
 	}
 
 void Attributes::DescribeReST(ODesc* d, bool shorten) const
 	{
-	loop_over_list(*attrs, i)
+	for ( size_t i = 0; i < attrs.size(); ++i )
 		{
 		if ( i > 0 )
 			d->Add(" ");
 
-		(*attrs)[i]->DescribeReST(d, shorten);
+		attrs[i]->DescribeReST(d, shorten);
 		}
 	}
 
@@ -262,10 +291,10 @@ void Attributes::CheckAttr(Attr* a)
 		{
 		bool is_add = a->Tag() == ATTR_ADD_FUNC;
 
-		BroType* at = a->AttrExpr()->Type();
+		const auto& at = a->GetExpr()->GetType();
 		if ( at->Tag() != TYPE_FUNC )
 			{
-			a->AttrExpr()->Error(
+			a->GetExpr()->Error(
 				is_add ?
 					"&add_func must be a function" :
 					"&delete_func must be a function");
@@ -273,9 +302,9 @@ void Attributes::CheckAttr(Attr* a)
 			}
 
 		FuncType* aft = at->AsFuncType();
-		if ( ! same_type(aft->YieldType(), type.get()) )
+		if ( ! same_type(aft->Yield(), type) )
 			{
-			a->AttrExpr()->Error(
+			a->GetExpr()->Error(
 				is_add ?
 					"&add_func function must yield same type as variable" :
 					"&delete_func function must yield same type as variable");
@@ -294,11 +323,11 @@ void Attributes::CheckAttr(Attr* a)
 			break;
 			}
 
-		BroType* atype = a->AttrExpr()->Type();
+		const auto& atype = a->GetExpr()->GetType();
 
 		if ( type->Tag() != TYPE_TABLE || (type->IsSet() && ! in_record) )
 			{
-			if ( same_type(atype, type.get()) )
+			if ( same_type(atype, type) )
 				// Ok.
 				break;
 
@@ -314,7 +343,7 @@ void Attributes::CheckAttr(Attr* a)
 				// Ok.
 				break;
 
-			auto e = check_and_promote_expr(a->AttrExpr(), type.get());
+			auto e = check_and_promote_expr(a->GetExpr().get(), type.get());
 
 			if ( e )
 				{
@@ -323,12 +352,12 @@ void Attributes::CheckAttr(Attr* a)
 				break;
 				}
 
-			a->AttrExpr()->Error("&default value has inconsistent type", type.get());
+			a->GetExpr()->Error("&default value has inconsistent type", type.get());
 			return;
 			}
 
 		TableType* tt = type->AsTableType();
-		BroType* ytype = tt->YieldType();
+		const auto& ytype = tt->Yield();
 
 		if ( ! in_record )
 			{
@@ -340,7 +369,7 @@ void Attributes::CheckAttr(Attr* a)
 					{
 					FuncType* f = atype->AsFuncType();
 					if ( ! f->CheckArgs(tt->IndexTypes()) ||
-					     ! same_type(f->YieldType(), ytype) )
+					     ! same_type(f->Yield(), ytype) )
 						Error("&default function type clash");
 
 					// Ok.
@@ -354,7 +383,7 @@ void Attributes::CheckAttr(Attr* a)
 					// Ok.
 					break;
 
-				auto e = check_and_promote_expr(a->AttrExpr(), ytype);
+				auto e = check_and_promote_expr(a->GetExpr().get(), ytype.get());
 
 				if ( e )
 					{
@@ -374,13 +403,13 @@ void Attributes::CheckAttr(Attr* a)
 			{
 			// &default applies to record field.
 
-			if ( same_type(atype, type.get()) )
+			if ( same_type(atype, type) )
 				// Ok.
 				break;
 
 			if ( (atype->Tag() == TYPE_TABLE && atype->AsTableType()->IsUnspecifiedTable()) )
 				{
-				auto e = check_and_promote_expr(a->AttrExpr(), type.get());
+				auto e = check_and_promote_expr(a->GetExpr().get(), type.get());
 
 				if ( e )
 					{
@@ -412,15 +441,13 @@ void Attributes::CheckAttr(Attr* a)
 			}
 
 		int num_expires = 0;
-		if ( attrs )
+
+		for ( const auto& a : attrs )
 			{
-			for ( const auto& a : *attrs )
-				{
-				if ( a->Tag() == ATTR_EXPIRE_READ ||
-				     a->Tag() == ATTR_EXPIRE_WRITE ||
-				     a->Tag() == ATTR_EXPIRE_CREATE )
-					num_expires++;
-				}
+			if ( a->Tag() == ATTR_EXPIRE_READ ||
+				 a->Tag() == ATTR_EXPIRE_WRITE ||
+				 a->Tag() == ATTR_EXPIRE_CREATE )
+				num_expires++;
 			}
 
 		if ( num_expires > 1 )
@@ -446,14 +473,14 @@ void Attributes::CheckAttr(Attr* a)
 			break;
 			}
 
-		const Expr* expire_func = a->AttrExpr();
+		const auto& expire_func = a->GetExpr();
 
-		if ( expire_func->Type()->Tag() != TYPE_FUNC )
+		if ( expire_func->GetType()->Tag() != TYPE_FUNC )
 			Error("&expire_func attribute is not a function");
 
-		const FuncType* e_ft = expire_func->Type()->AsFuncType();
+		const FuncType* e_ft = expire_func->GetType()->AsFuncType();
 
-		if ( e_ft->YieldType()->Tag() != TYPE_INTERVAL )
+		if ( e_ft->Yield()->Tag() != TYPE_INTERVAL )
 			{
 			Error("&expire_func must yield a value of type interval");
 			break;
@@ -464,20 +491,21 @@ void Attributes::CheckAttr(Attr* a)
 		if (the_table->IsUnspecifiedTable())
 			break;
 
-		const type_list* func_index_types = e_ft->ArgTypes()->Types();
+		const auto& func_index_types = e_ft->ParamList()->Types();
 		// Keep backwards compatibility with idx: any idiom.
-		if ( func_index_types->length() == 2 )
+		if ( func_index_types.size() == 2 )
 			{
-			if ((*func_index_types)[1]->Tag() == TYPE_ANY)
+			if (func_index_types[1]->Tag() == TYPE_ANY)
 				break;
 			}
 
-		const type_list* table_index_types = the_table->IndexTypes();
+		const auto& table_index_types = the_table->IndexTypes();
 
-		type_list expected_args;
+		type_list expected_args(1 + static_cast<int>(table_index_types.size()));
 		expected_args.push_back(type->AsTableType());
-		for (const auto& t : *table_index_types)
-			expected_args.push_back(t);
+
+		for ( const auto& t : table_index_types )
+			expected_args.push_back(t.get());
 
 		if ( ! e_ft->CheckArgs(&expected_args) )
 			Error("&expire_func argument type clash");
@@ -492,14 +520,14 @@ void Attributes::CheckAttr(Attr* a)
 			break;
 			}
 
-		const Expr* change_func = a->AttrExpr();
+		const auto& change_func = a->GetExpr();
 
-		if ( change_func->Type()->Tag() != TYPE_FUNC || change_func->Type()->AsFuncType()->Flavor() != FUNC_FLAVOR_FUNCTION )
+		if ( change_func->GetType()->Tag() != TYPE_FUNC || change_func->GetType()->AsFuncType()->Flavor() != FUNC_FLAVOR_FUNCTION )
 			Error("&on_change attribute is not a function");
 
-		const FuncType* c_ft = change_func->Type()->AsFuncType();
+		const FuncType* c_ft = change_func->GetType()->AsFuncType();
 
-		if ( c_ft->YieldType()->Tag() != TYPE_VOID )
+		if ( c_ft->Yield()->Tag() != TYPE_VOID )
 			{
 			Error("&on_change must not return a value");
 			break;
@@ -510,30 +538,30 @@ void Attributes::CheckAttr(Attr* a)
 		if ( the_table->IsUnspecifiedTable() )
 			break;
 
-		const type_list* args = c_ft->ArgTypes()->Types();
-		const type_list* t_indexes = the_table->IndexTypes();
-		if ( args->length() != ( type->IsSet() ? 2 : 3 ) + t_indexes->length() )
+		const auto& args = c_ft->ParamList()->Types();
+		const auto& t_indexes = the_table->IndexTypes();
+		if ( args.size() != ( type->IsSet() ? 2 : 3 ) + t_indexes.size() )
 			{
 			Error("&on_change function has incorrect number of arguments");
 			break;
 			}
 
-		if ( ! same_type((*args)[0], the_table->AsTableType()) )
+		if ( ! same_type(args[0], the_table->AsTableType()) )
 			{
 			Error("&on_change: first argument must be of same type as table");
 			break;
 			}
 
 		// can't check exact type here yet - the data structures don't exist yet.
-		if ( (*args)[1]->Tag() != TYPE_ENUM )
+		if ( args[1]->Tag() != TYPE_ENUM )
 			{
 			Error("&on_change: second argument must be a TableChange enum");
 			break;
 			}
 
-		for ( int i = 0; i < t_indexes->length(); i++ )
+		for ( size_t i = 0; i < t_indexes.size(); i++ )
 			{
-			if ( ! same_type((*args)[2+i], (*t_indexes)[i]) )
+			if ( ! same_type(args[2+i], t_indexes[i]) )
 				{
 				Error("&on_change: index types do not match table");
 				break;
@@ -541,7 +569,7 @@ void Attributes::CheckAttr(Attr* a)
 			}
 
 		if ( ! type->IsSet() )
-			if ( ! same_type((*args)[2+t_indexes->length()], the_table->YieldType()) )
+			if ( ! same_type(args[2+t_indexes.size()], the_table->Yield()) )
 				{
 				Error("&on_change: value type does not match table");
 				break;
@@ -587,7 +615,7 @@ void Attributes::CheckAttr(Attr* a)
 			break;
 			}
 
-		BroType* atype = a->AttrExpr()->Type();
+		const auto& atype = a->GetExpr()->GetType();
 
 		if ( atype->Tag() != TYPE_STRING ) {
 			Error("type column needs to have a string argument");
@@ -605,15 +633,15 @@ void Attributes::CheckAttr(Attr* a)
 
 bool Attributes::operator==(const Attributes& other) const
 	{
-	if ( ! attrs )
-		return other.attrs;
+	if ( attrs.empty() )
+		return other.attrs.empty();
 
-	if ( ! other.attrs )
+	if ( other.attrs.empty() )
 		return false;
 
-	for ( const auto& a : *attrs )
+	for ( const auto& a : attrs )
 		{
-		Attr* o = other.FindAttr(a->Tag());
+		const auto& o = other.Find(a->Tag());
 
 		if ( ! o )
 			return false;
@@ -622,9 +650,9 @@ bool Attributes::operator==(const Attributes& other) const
 			return false;
 		}
 
-	for ( const auto& o : *other.attrs )
+	for ( const auto& o : other.attrs )
 		{
-		Attr* a = FindAttr(o->Tag());
+		const auto& a = Find(o->Tag());
 
 		if ( ! a )
 			return false;
diff --git a/src/Attr.h b/src/Attr.h
index 7271bdd1f6..fbf60f68a4 100644
--- a/src/Attr.h
+++ b/src/Attr.h
@@ -2,6 +2,8 @@
 
 #pragma once
 
+#include <vector>
+
 #include "Obj.h"
 #include "BroList.h"
 #include "IntrusivePtr.h"
@@ -36,15 +38,21 @@ typedef enum {
 
 class Attr final : public BroObj {
 public:
+	static inline const IntrusivePtr<Attr> nil;
+
 	Attr(attr_tag t, IntrusivePtr<Expr> e);
 	explicit Attr(attr_tag t);
 	~Attr() override;
 
 	attr_tag Tag() const	{ return tag; }
+
+	[[deprecated("Remove in v4.1.  Use GetExpr().")]]
 	Expr* AttrExpr() const	{ return expr.get(); }
 
-	template<typename E>
-	void SetAttrExpr(E&& e) { expr = std::forward<E>(e); }
+	const IntrusivePtr<Expr>& GetExpr() const
+		{ return expr; }
+
+	void SetAttrExpr(IntrusivePtr<Expr> e);
 
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool shorten = false) const;
@@ -73,20 +81,32 @@ protected:
 // Manages a collection of attributes.
 class Attributes final : public BroObj {
 public:
+	[[deprecated("Remove in v4.1.  Construct using IntrusivePtrs instead.")]]
 	Attributes(attr_list* a, IntrusivePtr<BroType> t, bool in_record, bool is_global);
-	~Attributes() override;
+
+	Attributes(std::vector<IntrusivePtr<Attr>> a, IntrusivePtr<BroType> t,
+	           bool in_record, bool is_global);
+	Attributes(IntrusivePtr<BroType> t, bool in_record, bool is_global);
 
 	void AddAttr(IntrusivePtr<Attr> a);
+
+	void AddAttrs(const IntrusivePtr<Attributes>& a);
+
+	[[deprecated("Remove in v4.1. Pass IntrusivePtr instead.")]]
 	void AddAttrs(Attributes* a);	// Unref's 'a' when done
 
+	[[deprecated("Remove in v4.1. Use Find().")]]
 	Attr* FindAttr(attr_tag t) const;
 
+	const IntrusivePtr<Attr>& Find(attr_tag t) const;
+
 	void RemoveAttr(attr_tag t);
 
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool shorten = false) const;
 
-	attr_list* Attrs()	{ return attrs; }
+	const std::vector<IntrusivePtr<Attr>>& Attrs() const
+		{ return attrs; }
 
 	bool operator==(const Attributes& other) const;
 
@@ -94,7 +114,7 @@ protected:
 	void CheckAttr(Attr* attr);
 
 	IntrusivePtr<BroType> type;
-	attr_list* attrs;
+	std::vector<IntrusivePtr<Attr>> attrs;
 	bool in_record;
 	bool global_var;
 };
diff --git a/src/BroString.cc b/src/BroString.cc
index e9708d1852..2cd5059cc8 100644
--- a/src/BroString.cc
+++ b/src/BroString.cc
@@ -8,7 +8,7 @@
 #include <ctype.h>
 
 #include "Val.h"
-#include "Var.h"
+#include "ID.h"
 #include "Reporter.h"
 #include "util.h"
 
@@ -340,20 +340,17 @@ BroString::Vec* BroString::Split(const BroString::IdxVec& indices) const
 
 VectorVal* BroString:: VecToPolicy(Vec* vec)
 	{
-	VectorVal* result =
-		new VectorVal(internal_type("string_vec")->AsVectorType());
-	if ( ! result )
-		return nullptr;
+	auto result = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	for ( unsigned int i = 0; i < vec->size(); ++i )
 		{
 		BroString* string = (*vec)[i];
-		StringVal* val = new StringVal(string->Len(),
-						(const char*) string->Bytes());
-		result->Assign(i+1, val);
+		auto val = make_intrusive<StringVal>(string->Len(),
+		                                     (const char*) string->Bytes());
+		result->Assign(i+1, std::move(val));
 		}
 
-	return result;
+	return result.release();
 	}
 
 BroString::Vec* BroString::VecFromPolicy(VectorVal* vec)
@@ -363,7 +360,7 @@ BroString::Vec* BroString::VecFromPolicy(VectorVal* vec)
 	// VectorVals start at index 1!
 	for ( unsigned int i = 1; i <= vec->Size(); ++i )
 		{
-		Val* v = vec->Lookup(i);	// get the RecordVal
+		const auto& v = vec->At(i);	// get the RecordVal
 		if ( ! v )
 			continue;
 
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 13be9f65e4..e8ccafb544 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -205,6 +205,9 @@ add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/DebugCmdConstants.h
 set_source_files_properties(nb_dns.c PROPERTIES COMPILE_FLAGS
                             -fno-strict-aliasing)
 
+set_source_files_properties(legacy-netvar-init.cc PROPERTIES COMPILE_FLAGS
+                            -Wno-deprecated-declarations)
+
 set(MAIN_SRCS
     digest.cc
     net_util.cc
@@ -286,6 +289,7 @@ set(MAIN_SRCS
     Var.cc
     WeirdState.cc
     ZeekArgs.cc
+    legacy-netvar-init.cc
     bsd-getopt-long.c
     bro_inet_ntop.c
     patricia.c
diff --git a/src/CompHash.cc b/src/CompHash.cc
index f6f982685d..7bdc3eba6a 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -21,9 +21,9 @@ CompositeHash::CompositeHash(IntrusivePtr<TypeList> composite_type)
 	// If the only element is a record, don't treat it as a
 	// singleton, since it needs to be evaluated specially.
 
-	if ( type->Types()->length() == 1 )
+	if ( type->Types().size() == 1 )
 		{
-		if ( (*type->Types())[0]->Tag() == TYPE_RECORD )
+		if ( type->Types()[0]->Tag() == TYPE_RECORD )
 			{
 			is_complex_type = true;
 			is_singleton = false;
@@ -45,7 +45,7 @@ CompositeHash::CompositeHash(IntrusivePtr<TypeList> composite_type)
 		{
 		// Don't do any further key computations - we'll do them
 		// via the singleton later.
-		singleton_tag = (*type->Types())[0]->InternalType();
+		singleton_tag = type->Types()[0]->InternalType();
 		size = 0;
 		key = nullptr;
 		}
@@ -88,7 +88,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 
 	if ( type_check )
 		{
-		InternalTypeTag vt = v->Type()->InternalType();
+		InternalTypeTag vt = v->GetType()->InternalType();
 		if ( vt != t )
 			return nullptr;
 		}
@@ -138,7 +138,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 	case TYPE_INTERNAL_VOID:
 	case TYPE_INTERNAL_OTHER:
 		{
-		switch ( v->Type()->Tag() ) {
+		switch ( v->GetType()->Tag() ) {
 		case TYPE_FUNC:
 			{
 			uint32_t* kp = AlignAndPadType<uint32_t>(kp0);
@@ -180,16 +180,16 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 
 			for ( int i = 0; i < num_fields; ++i )
 				{
-				auto rv_i = rv->Lookup(i);
+				auto rv_i = rv->GetField(i).get();
 
 				Attributes* a = rt->FieldDecl(i)->attrs.get();
-				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
+				bool optional = (a && a->Find(ATTR_OPTIONAL));
 
 				if ( ! (rv_i || optional) )
 					return nullptr;
 
 				if ( ! (kp = SingleValHash(type_check, kp,
-							   rt->FieldType(i),
+							   rt->GetFieldType(i).get(),
 							   rv_i, optional)) )
 					return nullptr;
 				}
@@ -229,7 +229,7 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 			while ( tbl->NextEntry(k, it) )
 				{
 				hashkeys[k] = idx++;
-				lv->Append(tv->RecoverIndex(k).release());
+				lv->Append(tv->RecreateIndex(*k));
 				}
 
 			for ( auto& kv : hashkeys )
@@ -238,17 +238,17 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 			for ( auto& kv : hashkeys )
 				{
 				auto idx = kv.second;
-				Val* key = lv->Index(idx);
+				const auto& key = lv->Idx(idx);
 
-				if ( ! (kp1 = SingleValHash(type_check, kp1, key->Type(), key,
-				                            false)) )
+				if ( ! (kp1 = SingleValHash(type_check, kp1, key->GetType().get(),
+				                            key.get(), false)) )
 					return nullptr;
 
-				if ( ! v->Type()->IsSet() )
+				if ( ! v->GetType()->IsSet() )
 					{
-					auto val = tv->Lookup(key);
+					auto val = tv->FindOrDefault(key);
 
-					if ( ! (kp1 = SingleValHash(type_check, kp1, val->Type(),
+					if ( ! (kp1 = SingleValHash(type_check, kp1, val->GetType().get(),
 								    val.get(), false)) )
 						return nullptr;
 					}
@@ -261,12 +261,12 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 			{
 			unsigned int* kp = AlignAndPadType<unsigned int>(kp0);
 			VectorVal* vv = v->AsVectorVal();
-			VectorType* vt = v->Type()->AsVectorType();
+			VectorType* vt = v->GetType()->AsVectorType();
 			*kp = vv->Size();
 			kp1 = reinterpret_cast<char*>(kp+1);
 			for ( unsigned int i = 0; i < vv->Size(); ++i )
 				{
-				Val* val = vv->Lookup(i);
+				const auto& val = vv->At(i);
 				unsigned int* kp = AlignAndPadType<unsigned int>(kp1);
 				*kp = i;
 				kp1 = reinterpret_cast<char*>(kp+1);
@@ -277,7 +277,8 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 				if ( val )
 					{
 					if ( ! (kp1 = SingleValHash(type_check, kp1,
-					                            vt->YieldType(), val, false)) )
+					                            vt->Yield().get(), val.get(),
+					                            false)) )
 						return nullptr;
 					}
 				}
@@ -292,8 +293,8 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 			kp1 = reinterpret_cast<char*>(kp+1);
 			for ( int i = 0; i < lv->Length(); ++i )
 				{
-				Val* v = lv->Index(i);
-				if ( ! (kp1 = SingleValHash(type_check, kp1, v->Type(), v,
+				Val* v = lv->Idx(i).get();
+				if ( ! (kp1 = SingleValHash(type_check, kp1, v->GetType().get(), v,
 				                            false)) )
 					return nullptr;
 				}
@@ -333,15 +334,14 @@ char* CompositeHash::SingleValHash(bool type_check, char* kp0,
 	}
 
 
-HashKey* CompositeHash::ComputeHash(const Val* v, bool type_check) const
+std::unique_ptr<HashKey> CompositeHash::MakeHashKey(const Val& argv, bool type_check) const
 	{
-	if ( ! v )
-		reporter->InternalError("null value given to CompositeHash::ComputeHash");
+	auto v = &argv;
 
 	if ( is_singleton )
 		return ComputeSingletonHash(v, type_check);
 
-	if ( is_complex_type && v->Type()->Tag() != TYPE_LIST )
+	if ( is_complex_type && v->GetType()->Tag() != TYPE_LIST )
 		{
 		ListVal lv(TYPE_ANY);
 
@@ -349,10 +349,8 @@ HashKey* CompositeHash::ComputeHash(const Val* v, bool type_check) const
 		// re-introduce const on the recursive call, it should
 		// be okay; the only thing is that the ListVal unref's it.
 		Val* ncv = (Val*) v;
-		ncv->Ref();
-		lv.Append(ncv);
-	        HashKey* hk = ComputeHash(&lv, type_check);
-		return hk;
+		lv.Append({NewRef{}, ncv});
+		return MakeHashKey(lv, type_check);
 		}
 
 	char* k = key;
@@ -367,60 +365,62 @@ HashKey* CompositeHash::ComputeHash(const Val* v, bool type_check) const
 		type_check = false;	// no need to type-check again.
 		}
 
-	const type_list* tl = type->Types();
+	const auto& tl = type->Types();
 
-	if ( type_check && v->Type()->Tag() != TYPE_LIST )
+	if ( type_check && v->GetType()->Tag() != TYPE_LIST )
 		return nullptr;
 
-	const val_list* vl = v->AsListVal()->Vals();
-	if ( type_check && vl->length() != tl->length() )
+	auto lv = v->AsListVal();
+
+	if ( type_check && lv->Length() != static_cast<int>(tl.size()) )
 		return nullptr;
 
 	char* kp = k;
-	loop_over_list(*tl, i)
+	for ( auto i = 0u; i < tl.size(); ++i )
 		{
-		kp = SingleValHash(type_check, kp, (*tl)[i], (*vl)[i], false);
+		kp = SingleValHash(type_check, kp, tl[i].get(), lv->Idx(i).get(), false);
 		if ( ! kp )
 			return nullptr;
 		}
 
-	return new HashKey((k == key), (void*) k, kp - k);
+	return std::make_unique<HashKey>((k == key), (void*) k, kp - k);
 	}
 
-HashKey* CompositeHash::ComputeSingletonHash(const Val* v, bool type_check) const
+std::unique_ptr<HashKey> CompositeHash::ComputeSingletonHash(const Val* v, bool type_check) const
 	{
-	if ( v->Type()->Tag() == TYPE_LIST )
+	if ( v->GetType()->Tag() == TYPE_LIST )
 		{
-		const val_list* vl = v->AsListVal()->Vals();
-		if ( type_check && vl->length() != 1 )
+		auto lv = v->AsListVal();
+
+		if ( type_check && lv->Length() != 1 )
 			return nullptr;
 
-		v = (*vl)[0];
+		v = lv->Idx(0).get();
 		}
 
-	if ( type_check && v->Type()->InternalType() != singleton_tag )
+	if ( type_check && v->GetType()->InternalType() != singleton_tag )
 		return nullptr;
 
 	switch ( singleton_tag ) {
 	case TYPE_INTERNAL_INT:
 	case TYPE_INTERNAL_UNSIGNED:
-		return new HashKey(v->ForceAsInt());
+		return std::make_unique<HashKey>(v->ForceAsInt());
 
 	case TYPE_INTERNAL_ADDR:
-		return v->AsAddr().GetHashKey();
+		return v->AsAddr().MakeHashKey();
 
 	case TYPE_INTERNAL_SUBNET:
-		return v->AsSubNet().GetHashKey();
+		return v->AsSubNet().MakeHashKey();
 
 	case TYPE_INTERNAL_DOUBLE:
-		return new HashKey(v->InternalDouble());
+		return std::make_unique<HashKey>(v->InternalDouble());
 
 	case TYPE_INTERNAL_VOID:
 	case TYPE_INTERNAL_OTHER:
-		if ( v->Type()->Tag() == TYPE_FUNC )
-			return new HashKey(v->AsFunc()->GetUniqueFuncID());
+		if ( v->GetType()->Tag() == TYPE_FUNC )
+			return std::make_unique<HashKey>(v->AsFunc()->GetUniqueFuncID());
 
-		if ( v->Type()->Tag() == TYPE_PATTERN )
+		if ( v->GetType()->Tag() == TYPE_PATTERN )
 			{
 			const char* texts[2] = {
 				v->AsPattern()->PatternText(),
@@ -430,14 +430,14 @@ HashKey* CompositeHash::ComputeSingletonHash(const Val* v, bool type_check) cons
 			char* key = new char[n];
 			std::memcpy(key, texts[0], strlen(texts[0]) + 1);
 			std::memcpy(key + strlen(texts[0]) + 1, texts[1], strlen(texts[1]) + 1);
-			return new HashKey(false, key, n);
+			return std::make_unique<HashKey>(false, key, n);
 			}
 
 		reporter->InternalError("bad index type in CompositeHash::ComputeSingletonHash");
 		return nullptr;
 
 	case TYPE_INTERNAL_STRING:
-		return new HashKey(v->AsString());
+		return std::make_unique<HashKey>(v->AsString());
 
 	case TYPE_INTERNAL_ERROR:
 		return nullptr;
@@ -459,7 +459,7 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 
 	if ( type_check && v )
 		{
-		InternalTypeTag vt = v->Type()->InternalType();
+		InternalTypeTag vt = v->GetType()->InternalType();
 		if ( vt != t )
 			return 0;
 		}
@@ -514,10 +514,10 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 			for ( int i = 0; i < num_fields; ++i )
 				{
 				Attributes* a = rt->FieldDecl(i)->attrs.get();
-				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
+				bool optional = (a && a->Find(ATTR_OPTIONAL));
 
-				sz = SingleTypeKeySize(rt->FieldType(i),
-						       rv ? rv->Lookup(i) : nullptr,
+				sz = SingleTypeKeySize(rt->GetFieldType(i).get(),
+						       rv ? rv->GetField(i).get() : nullptr,
 						       type_check, sz, optional,
 						       calc_static_size);
 				if ( ! sz )
@@ -534,33 +534,25 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 
 			sz = SizeAlign(sz, sizeof(int));
 			TableVal* tv = const_cast<TableVal*>(v->AsTableVal());
-			ListVal* lv = tv->ConvertToList();
+			auto lv = tv->ToListVal();
 			for ( int i = 0; i < tv->Size(); ++i )
 				{
-				Val* key = lv->Index(i);
-				sz = SingleTypeKeySize(key->Type(), key, type_check, sz, false,
+				const auto& key = lv->Idx(i);
+				sz = SingleTypeKeySize(key->GetType().get(), key.get(), type_check, sz, false,
 				                       calc_static_size);
 				if ( ! sz )
-					{
-					Unref(lv);
 					return 0;
-					}
 
 				if ( ! bt->IsSet() )
 					{
-					auto val = tv->Lookup(key);
-					sz = SingleTypeKeySize(val->Type(), val.get(), type_check, sz,
+					auto val = tv->FindOrDefault(key);
+					sz = SingleTypeKeySize(val->GetType().get(), val.get(), type_check, sz,
 					                       false, calc_static_size);
 					if ( ! sz )
-						{
-						Unref(lv);
 						return 0;
-						}
 					}
 				}
 
-			Unref(lv);
-
 			break;
 			}
 
@@ -573,12 +565,12 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 			VectorVal* vv = const_cast<VectorVal*>(v->AsVectorVal());
 			for ( unsigned int i = 0; i < vv->Size(); ++i )
 				{
-				Val* val = vv->Lookup(i);
+				const auto& val = vv->At(i);
 				sz = SizeAlign(sz, sizeof(unsigned int));
 				sz = SizeAlign(sz, sizeof(unsigned int));
 				if ( val )
-					sz = SingleTypeKeySize(bt->AsVectorType()->YieldType(),
-					                       val, type_check, sz, false,
+					sz = SingleTypeKeySize(bt->AsVectorType()->Yield().get(),
+					                       val.get(), type_check, sz, false,
 					                       calc_static_size);
 				if ( ! sz ) return 0;
 				}
@@ -595,7 +587,7 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 			ListVal* lv = const_cast<ListVal*>(v->AsListVal());
 			for ( int i = 0; i < lv->Length(); ++i )
 				{
-				sz = SingleTypeKeySize(lv->Index(i)->Type(), lv->Index(i),
+				sz = SingleTypeKeySize(lv->Idx(i)->GetType().get(), lv->Idx(i).get(),
 				                       type_check, sz, false, calc_static_size);
 				if ( ! sz) return 0;
 				}
@@ -631,22 +623,23 @@ int CompositeHash::SingleTypeKeySize(BroType* bt, const Val* v,
 
 int CompositeHash::ComputeKeySize(const Val* v, bool type_check, bool calc_static_size) const
 	{
-	const type_list* tl = type->Types();
-	const val_list* vl = nullptr;
+	const auto& tl = type->Types();
+
 	if ( v )
 		{
-		if ( type_check && v->Type()->Tag() != TYPE_LIST )
+		if ( type_check && v->GetType()->Tag() != TYPE_LIST )
 			return 0;
 
-		vl = v->AsListVal()->Vals();
-		if ( type_check && vl->length() != tl->length() )
+		auto lv = v->AsListVal();
+
+		if ( type_check && lv->Length() != static_cast<int>(tl.size()) )
 			return 0;
 		}
 
 	int sz = 0;
-	loop_over_list(*tl, i)
+	for ( auto i = 0u; i < tl.size(); ++i )
 		{
-		sz = SingleTypeKeySize((*tl)[i], v ? v->AsListVal()->Index(i) : nullptr,
+		sz = SingleTypeKeySize(tl[i].get(), v ? v->AsListVal()->Idx(i).get() : nullptr,
 				       type_check, sz, false, calc_static_size);
 		if ( ! sz )
 			return 0;
@@ -714,19 +707,19 @@ int CompositeHash::SizeAlign(int offset, unsigned int size) const
 	return offset;
 	}
 
-IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey* k) const
+IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey& k) const
 	{
 	auto l = make_intrusive<ListVal>(TYPE_ANY);
-	const type_list* tl = type->Types();
-	const char* kp = (const char*) k->Key();
-	const char* const k_end = kp + k->Size();
+	const auto& tl = type->Types();
+	const char* kp = (const char*) k.Key();
+	const char* const k_end = kp + k.Size();
 
-	for ( const auto& type : *tl )
+	for ( const auto& type : tl )
 		{
 		IntrusivePtr<Val> v;
-		kp = RecoverOneVal(k, kp, k_end, type, &v, false);
+		kp = RecoverOneVal(k, kp, k_end, type.get(), &v, false);
 		ASSERT(v);
-		l->Append(v.release());
+		l->Append(std::move(v));
 		}
 
 	if ( kp != k_end )
@@ -735,12 +728,12 @@ IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey* k) const
 	return l;
 	}
 
-const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
+const char* CompositeHash::RecoverOneVal(const HashKey& k, const char* kp0,
 					 const char* const k_end, BroType* t,
 					 IntrusivePtr<Val>* pval, bool optional) const
 	{
 	// k->Size() == 0 for a single empty string.
-	if ( kp0 >= k_end && k->Size() > 0 )
+	if ( kp0 >= k_end && k.Size() > 0 )
 		reporter->InternalError("over-ran key in CompositeHash::RecoverVals");
 
 	TypeTag tag = t->Tag();
@@ -851,13 +844,13 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			const uint32_t* const kp = AlignType<uint32_t>(kp0);
 			kp1 = reinterpret_cast<const char*>(kp+1);
 
-			Func* f = Func::GetFuncPtrByID(*kp);
+			const auto& f = Func::GetFuncPtrByID(*kp);
 
 			if ( ! f )
 				reporter->InternalError("failed to look up unique function id %" PRIu32 " in CompositeHash::RecoverOneVal()", *kp);
 
 			*pval = make_intrusive<Val>(f);
-			auto pvt = (*pval)->Type();
+			const auto& pvt = (*pval)->GetType();
 
 			if ( ! pvt )
 				reporter->InternalError("bad aggregate Val in CompositeHash::RecoverOneVal()");
@@ -881,7 +874,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				kp1 = kp0;
 				int divider = strlen(kp0) + 1;
 				re = new RE_Matcher(kp1, kp1 + divider);
-				kp1 += k->Size();
+				kp1 += k.Size();
 				}
 			else
 				{
@@ -906,17 +899,17 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			RecordType* rt = t->AsRecordType();
 			int num_fields = rt->NumFields();
 
-			std::vector<Val*> values;
+			std::vector<IntrusivePtr<Val>> values;
 			int i;
 			for ( i = 0; i < num_fields; ++i )
 				{
 				IntrusivePtr<Val> v;
 
 				Attributes* a = rt->FieldDecl(i)->attrs.get();
-				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
+				bool optional = (a && a->Find(ATTR_OPTIONAL));
 
 				kp = RecoverOneVal(k, kp, k_end,
-				                   rt->FieldType(i), &v, optional);
+				                   rt->GetFieldType(i).get(), &v, optional);
 
 				// An earlier call to reporter->InternalError would have called abort() and broken the
 				// call tree that clang-tidy is relying on to get the error described.
@@ -928,15 +921,15 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 					break;
 					}
 
-				values.push_back(v.release());
+				values.emplace_back(std::move(v));
 				}
 
 			ASSERT(int(values.size()) == num_fields);
 
-			auto rv = make_intrusive<RecordVal>(rt);
+			auto rv = make_intrusive<RecordVal>(IntrusivePtr{NewRef{}, rt});
 
 			for ( int i = 0; i < num_fields; ++i )
-				rv->Assign(i, values[i]);
+				rv->Assign(i, std::move(values[i]));
 
 			*pval = std::move(rv);
 			kp1 = kp;
@@ -955,16 +948,16 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			for ( int i = 0; i < n; ++i )
 				{
 				IntrusivePtr<Val> key;
-				kp1 = RecoverOneVal(k, kp1, k_end, tt->Indices(), &key, false);
+				kp1 = RecoverOneVal(k, kp1, k_end, tt->GetIndices().get(), &key, false);
 
 				if ( t->IsSet() )
-					tv->Assign(key.get(), nullptr);
+					tv->Assign(std::move(key), nullptr);
 				else
 					{
 					IntrusivePtr<Val> value;
-					kp1 = RecoverOneVal(k, kp1, k_end, tt->YieldType(), &value,
+					kp1 = RecoverOneVal(k, kp1, k_end, tt->Yield().get(), &value,
 					                    false);
-					tv->Assign(key.get(), std::move(value));
+					tv->Assign(std::move(key), std::move(value));
 					}
 				}
 
@@ -979,7 +972,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			VectorType* vt = t->AsVectorType();
-			auto vv = make_intrusive<VectorVal>(vt);
+			auto vv = make_intrusive<VectorVal>(IntrusivePtr{NewRef{}, vt});
 
 			for ( unsigned int i = 0; i < n; ++i )
 				{
@@ -992,7 +985,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				IntrusivePtr<Val> value;
 
 				if ( have_val )
-					kp1 = RecoverOneVal(k, kp1, k_end, vt->YieldType(), &value,
+					kp1 = RecoverOneVal(k, kp1, k_end, vt->Yield().get(), &value,
 					                    false);
 
 				vv->Assign(index, std::move(value));
@@ -1014,9 +1007,9 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			for ( int i = 0; i < n; ++i )
 				{
 				IntrusivePtr<Val> v;
-				BroType* it = (*tl->Types())[i];
+				BroType* it = tl->Types()[i].get();
 				kp1 = RecoverOneVal(k, kp1, k_end, it, &v, false);
-				lv->Append(v.release());
+				lv->Append(std::move(v));
 				}
 
 			*pval = std::move(lv);
@@ -1040,7 +1033,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		if ( is_singleton )
 			{
 			kp1 = kp0;
-			n = k->Size();
+			n = k.Size();
 			}
 		else
 			{
diff --git a/src/CompHash.h b/src/CompHash.h
index 849245b9db..e3204fe630 100644
--- a/src/CompHash.h
+++ b/src/CompHash.h
@@ -2,6 +2,8 @@
 
 #pragma once
 
+#include <memory>
+
 #include "Type.h"
 #include "IntrusivePtr.h"
 
@@ -14,16 +16,24 @@ public:
 	~CompositeHash();
 
 	// Compute the hash corresponding to the given index val,
-	// or 0 if it fails to typecheck.
-	HashKey* ComputeHash(const Val* v, bool type_check) const;
+	// or nullptr if it fails to typecheck.
+	std::unique_ptr<HashKey> MakeHashKey(const Val& v, bool type_check) const;
+
+	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
+	HashKey* ComputeHash(const Val* v, bool type_check) const
+		{ return MakeHashKey(*v, type_check).release(); }
 
 	// Given a hash key, recover the values used to create it.
-	IntrusivePtr<ListVal> RecoverVals(const HashKey* k) const;
+	IntrusivePtr<ListVal> RecoverVals(const HashKey& k) const;
+
+	[[deprecated("Remove in v4.1.  Pass in HashKey& instead.")]]
+	IntrusivePtr<ListVal> RecoverVals(const HashKey* k) const
+		{ return RecoverVals(*k); }
 
 	unsigned int MemoryAllocation() const { return padded_sizeof(*this) + pad_size(size); }
 
 protected:
-	HashKey* ComputeSingletonHash(const Val* v, bool type_check) const;
+	std::unique_ptr<HashKey> ComputeSingletonHash(const Val* v, bool type_check) const;
 
 	// Computes the piece of the hash for Val*, returning the new kp.
 	// Used as a helper for ComputeHash in the non-singleton case.
@@ -34,7 +44,7 @@ protected:
 	// Upon return, pval will point to the recovered Val of type t.
 	// Returns and updated kp for the next Val.  Calls reporter->InternalError()
 	// upon errors, so there is no return value for invalid input.
-	const char* RecoverOneVal(const HashKey* k,
+	const char* RecoverOneVal(const HashKey& k,
 				  const char* kp, const char* const k_end,
 				  BroType* t, IntrusivePtr<Val>* pval, bool optional) const;
 
diff --git a/src/Conn.cc b/src/Conn.cc
index 5796ad898c..560882dcad 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -146,7 +146,7 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 			{
 			if ( tunnel_changed )
 				EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
-				             IntrusivePtr{AdoptRef{}, arg_encap->GetVectorVal()});
+				             arg_encap->ToVal());
 
 			delete encapsulation;
 			encapsulation = new EncapsulationStack(*arg_encap);
@@ -158,8 +158,7 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 		if ( tunnel_changed )
 			{
 			EncapsulationStack empty;
-			EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
-			             IntrusivePtr{AdoptRef{}, empty.GetVectorVal()});
+			EnqueueEvent(tunnel_changed, nullptr, ConnVal(), empty.ToVal());
 			}
 
 		delete encapsulation;
@@ -169,8 +168,7 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 	else if ( arg_encap )
 		{
 		if ( tunnel_changed )
-			EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
-			             IntrusivePtr{AdoptRef{}, arg_encap->GetVectorVal()});
+			EnqueueEvent(tunnel_changed, nullptr, ConnVal(), arg_encap->ToVal());
 
 		encapsulation = new EncapsulationStack(*arg_encap);
 		}
@@ -348,17 +346,17 @@ const IntrusivePtr<RecordVal>& Connection::ConnVal()
 	{
 	if ( ! conn_val )
 		{
-		conn_val = make_intrusive<RecordVal>(connection_type);
+		conn_val = make_intrusive<RecordVal>(zeek::id::connection);
 
 		TransportProto prot_type = ConnTransport();
 
-		auto id_val = make_intrusive<RecordVal>(conn_id);
+		auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
 		id_val->Assign(0, make_intrusive<AddrVal>(orig_addr));
 		id_val->Assign(1, val_mgr->Port(ntohs(orig_port), prot_type));
 		id_val->Assign(2, make_intrusive<AddrVal>(resp_addr));
 		id_val->Assign(3, val_mgr->Port(ntohs(resp_port), prot_type));
 
-		auto orig_endp = make_intrusive<RecordVal>(endpoint);
+		auto orig_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
 		orig_endp->Assign(0, val_mgr->Count(0));
 		orig_endp->Assign(1, val_mgr->Count(0));
 		orig_endp->Assign(4, val_mgr->Count(orig_flow_label));
@@ -369,7 +367,7 @@ const IntrusivePtr<RecordVal>& Connection::ConnVal()
 		if ( memcmp(&orig_l2_addr, &null, l2_len) != 0 )
 			orig_endp->Assign(5, make_intrusive<StringVal>(fmt_mac(orig_l2_addr, l2_len)));
 
-		auto resp_endp = make_intrusive<RecordVal>(endpoint);
+		auto resp_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
 		resp_endp->Assign(0, val_mgr->Count(0));
 		resp_endp->Assign(1, val_mgr->Count(0));
 		resp_endp->Assign(4, val_mgr->Count(resp_flow_label));
@@ -381,7 +379,7 @@ const IntrusivePtr<RecordVal>& Connection::ConnVal()
 		conn_val->Assign(1, std::move(orig_endp));
 		conn_val->Assign(2, std::move(resp_endp));
 		// 3 and 4 are set below.
-		conn_val->Assign(5, make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set}));	// service
+		conn_val->Assign(5, make_intrusive<TableVal>(zeek::id::string_set));	// service
 		conn_val->Assign(6, val_mgr->EmptyString());	// history
 
 		if ( ! uid )
@@ -390,7 +388,7 @@ const IntrusivePtr<RecordVal>& Connection::ConnVal()
 		conn_val->Assign(7, make_intrusive<StringVal>(uid.Base62("C").c_str()));
 
 		if ( encapsulation && encapsulation->Depth() > 0 )
-			conn_val->Assign(8, encapsulation->GetVectorVal());
+			conn_val->Assign(8, encapsulation->ToVal());
 
 		if ( vlan != 0 )
 			conn_val->Assign(9, val_mgr->Int(vlan));
@@ -432,7 +430,7 @@ void Connection::AppendAddl(const char* str)
 	{
 	const auto& cv = ConnVal();
 
-	const char* old = cv->Lookup(6)->AsString()->CheckString();
+	const char* old = cv->GetField(6)->AsString()->CheckString();
 	const char* format = *old ? "%s %s" : "%s%s";
 
 	cv->Assign(6, make_intrusive<StringVal>(fmt(format, old, str)));
@@ -701,7 +699,7 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label)
 		{
 		if ( conn_val )
 			{
-			RecordVal *endp = conn_val->Lookup(is_orig ? 1 : 2)->AsRecordVal();
+			RecordVal* endp = conn_val->GetField(is_orig ? 1 : 2)->AsRecordVal();
 			endp->Assign(4, val_mgr->Count(flow_label));
 			}
 
diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index 9d1ec75e87..44dd2cb5c5 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -36,7 +36,8 @@
 #include "Event.h"
 #include "Net.h"
 #include "Val.h"
-#include "Var.h"
+#include "NetVar.h"
+#include "ID.h"
 #include "Reporter.h"
 #include "IntrusivePtr.h"
 #include "iosource/Manager.h"
@@ -285,7 +286,7 @@ IntrusivePtr<ListVal> DNS_Mapping::Addrs()
 		auto addrs_val = make_intrusive<ListVal>(TYPE_ADDR);
 
 		for ( int i = 0; i < num_addrs; ++i )
-			addrs_val->Append(new AddrVal(addrs[i]));
+			addrs_val->Append(make_intrusive<AddrVal>(addrs[i]));
 		}
 
 	return addrs_val;
@@ -297,7 +298,7 @@ IntrusivePtr<TableVal> DNS_Mapping::AddrsSet() {
 	if ( ! l )
 		return empty_addr_set();
 
-	return {AdoptRef{}, l->ConvertToSet()};
+	return l->ToSetVal();
 	}
 
 IntrusivePtr<StringVal> DNS_Mapping::Host()
@@ -380,12 +381,6 @@ DNS_Mgr::DNS_Mgr(DNS_MgrMode arg_mode)
 
 	mode = arg_mode;
 
-	dns_mapping_valid = dns_mapping_unverified = dns_mapping_new_name =
-		dns_mapping_lost_name = dns_mapping_name_changed =
-			dns_mapping_altered =  nullptr;
-
-	dm_rec = nullptr;
-
 	cache_name = dir = nullptr;
 
 	asyncs_pending = 0;
@@ -455,14 +450,7 @@ void DNS_Mgr::InitSource()
 
 void DNS_Mgr::InitPostScript()
 	{
-	dns_mapping_valid = internal_handler("dns_mapping_valid");
-	dns_mapping_unverified = internal_handler("dns_mapping_unverified");
-	dns_mapping_new_name = internal_handler("dns_mapping_new_name");
-	dns_mapping_lost_name = internal_handler("dns_mapping_lost_name");
-	dns_mapping_name_changed = internal_handler("dns_mapping_name_changed");
-	dns_mapping_altered = internal_handler("dns_mapping_altered");
-
-	dm_rec = internal_type("dns_mapping")->AsRecordType();
+	dm_rec = zeek::id::find_type<RecordType>("dns_mapping");
 
 	// Registering will call Init()
 	iosource_mgr->Register(this, true);
@@ -478,8 +466,8 @@ static IntrusivePtr<TableVal> fake_name_lookup_result(const char* name)
 	hash128_t hash;
 	KeyedHash::StaticHash128(name, strlen(name), &hash);
 	auto hv = make_intrusive<ListVal>(TYPE_ADDR);
-	hv->Append(new AddrVal(reinterpret_cast<const uint32_t*>(&hash)));
-	return {AdoptRef{}, hv->ConvertToSet()};
+	hv->Append(make_intrusive<AddrVal>(reinterpret_cast<const uint32_t*>(&hash)));
+	return hv->ToSetVal();
 	}
 
 static const char* fake_text_lookup_result(const char* name)
@@ -715,11 +703,7 @@ void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* dm,
 	if ( ! e )
 		return;
 
-	mgr.Enqueue(e,
-		BuildMappingVal(dm),
-		IntrusivePtr{AdoptRef{}, l1->ConvertToSet()},
-		IntrusivePtr{AdoptRef{}, l2->ConvertToSet()}
-	);
+	mgr.Enqueue(e, BuildMappingVal(dm), l1->ToSetVal(), l2->ToSetVal());
 	}
 
 void DNS_Mgr::Event(EventHandlerPtr e, DNS_Mapping* old_dm, DNS_Mapping* new_dm)
@@ -740,7 +724,7 @@ IntrusivePtr<Val> DNS_Mgr::BuildMappingVal(DNS_Mapping* dm)
 	r->Assign(3, val_mgr->Bool(dm->Valid()));
 
 	auto h = dm->Host();
-	r->Assign(4, h ? h.release() : new StringVal("<none>"));
+	r->Assign(4, h ? std::move(h) : make_intrusive<StringVal>("<none>"));
 	r->Assign(5, dm->AddrsSet());
 
 	return r;
@@ -892,19 +876,19 @@ IntrusivePtr<ListVal> DNS_Mgr::AddrListDelta(ListVal* al1, ListVal* al2)
 
 	for ( int i = 0; i < al1->Length(); ++i )
 		{
-		const IPAddr& al1_i = al1->Index(i)->AsAddr();
+		const IPAddr& al1_i = al1->Idx(i)->AsAddr();
 
 		int j;
 		for ( j = 0; j < al2->Length(); ++j )
 			{
-			const IPAddr& al2_j = al2->Index(j)->AsAddr();
+			const IPAddr& al2_j = al2->Idx(j)->AsAddr();
 			if ( al1_i == al2_j )
 				break;
 			}
 
 		if ( j >= al2->Length() )
 			// Didn't find it.
-			delta->Append(al1->Index(i)->Ref());
+			delta->Append(al1->Idx(i));
 		}
 
 	return delta;
@@ -914,7 +898,7 @@ void DNS_Mgr::DumpAddrList(FILE* f, ListVal* al)
 	{
 	for ( int i = 0; i < al->Length(); ++i )
 		{
-		const IPAddr& al_i = al->Index(i)->AsAddr();
+		const IPAddr& al_i = al->Idx(i)->AsAddr();
 		fprintf(f, "%s%s", i > 0 ? "," : "", al_i.AsString().c_str());
 		}
 	}
diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index c0a3370487..3ff0d3c307 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -149,15 +149,7 @@ protected:
 
 	bool did_init;
 
-	// DNS-related events.
-	EventHandlerPtr dns_mapping_valid;
-	EventHandlerPtr dns_mapping_unverified;
-	EventHandlerPtr dns_mapping_new_name;
-	EventHandlerPtr dns_mapping_lost_name;
-	EventHandlerPtr dns_mapping_name_changed;
-	EventHandlerPtr dns_mapping_altered;
-
-	RecordType* dm_rec;
+	IntrusivePtr<RecordType> dm_rec;
 
 	typedef std::list<LookupCallback*> CallbackList;
 
diff --git a/src/DbgBreakpoint.cc b/src/DbgBreakpoint.cc
index e238156eec..2ad5d3ef94 100644
--- a/src/DbgBreakpoint.cc
+++ b/src/DbgBreakpoint.cc
@@ -258,8 +258,8 @@ BreakCode DbgBreakpoint::HasHit()
 			return bcHit;
 			}
 
-		if ( ! IsIntegral(yes->Type()->Tag()) &&
-		     ! IsBool(yes->Type()->Tag()) )
+		if ( ! IsIntegral(yes->GetType()->Tag()) &&
+		     ! IsBool(yes->GetType()->Tag()) )
 			{
 			PrintHitMsg();
 			debug_msg("Breakpoint condition should return an integral type");
diff --git a/src/Debug.cc b/src/Debug.cc
index ef6a41f855..3637516850 100644
--- a/src/Debug.cc
+++ b/src/Debug.cc
@@ -197,7 +197,7 @@ void get_first_statement(Stmt* list, Stmt*& first, Location& loc)
 static void parse_function_name(vector<ParseLocationRec>& result,
 				ParseLocationRec& plr, const string& s)
 	{ // function name
-	auto id = lookup_ID(s.c_str(), current_module.c_str());
+	const auto& id = lookup_ID(s.c_str(), current_module.c_str());
 
 	if ( ! id )
 		{
@@ -207,7 +207,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 		return;
 		}
 
-	if ( ! id->Type()->AsFuncType() )
+	if ( ! id->GetType()->AsFuncType() )
 		{
 		debug_msg("Function %s not declared.\n", id->Name());
 		plr.type = plrUnknown;
@@ -221,7 +221,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 		return;
 		}
 
-	const Func* func = id->ID_Val()->AsFunc();
+	const Func* func = id->GetVal()->AsFunc();
 	const vector<Func::Body>& bodies = func->GetBodies();
 
 	if ( bodies.size() == 0 )
diff --git a/src/DebugCmds.cc b/src/DebugCmds.cc
index e0d2cf843e..e36836e50a 100644
--- a/src/DebugCmds.cc
+++ b/src/DebugCmds.cc
@@ -65,7 +65,7 @@ void lookup_global_symbols_regex(const string& orig_regex, vector<ID*>& matches,
 	for ( const auto& sym : syms )
 		{
 		ID* nextid = sym.second.get();
-		if ( ! func_only || nextid->Type()->Tag() == TYPE_FUNC )
+		if ( ! func_only || nextid->GetType()->Tag() == TYPE_FUNC )
 			if ( ! regexec (&re, nextid->Name(), 0, 0, 0) )
 				matches.push_back(nextid);
 		}
diff --git a/src/Dict.h b/src/Dict.h
index d4187aa01f..22840a0dad 100644
--- a/src/Dict.h
+++ b/src/Dict.h
@@ -218,4 +218,6 @@ public:
 		{ return (T*) Dictionary::NextEntry(h, cookie, 1); }
 	T* RemoveEntry(const HashKey* key)
 		{ return (T*) Remove(key->Key(), key->Size(), key->Hash()); }
+	T* RemoveEntry(const HashKey& key)
+		{ return (T*) Remove(key.Key(), key.Size(), key.Hash()); }
 };
diff --git a/src/Discard.cc b/src/Discard.cc
index 77e83620db..6625786e3b 100644
--- a/src/Discard.cc
+++ b/src/Discard.cc
@@ -16,12 +16,12 @@
 
 Discarder::Discarder()
 	{
-	check_ip = internal_func("discarder_check_ip");
-	check_tcp = internal_func("discarder_check_tcp");
-	check_udp = internal_func("discarder_check_udp");
-	check_icmp = internal_func("discarder_check_icmp");
+	check_ip = zeek::id::find_func("discarder_check_ip");
+	check_tcp = zeek::id::find_func("discarder_check_tcp");
+	check_udp = zeek::id::find_func("discarder_check_udp");
+	check_icmp = zeek::id::find_func("discarder_check_icmp");
 
-	discarder_maxlen = static_cast<int>(opt_internal_int("discarder_maxlen"));
+	discarder_maxlen = static_cast<int>(zeek::id::find_val("discarder_maxlen")->AsCount());
 	}
 
 Discarder::~Discarder()
@@ -39,11 +39,11 @@ bool Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen)
 
 	if ( check_ip )
 		{
-		zeek::Args args{{AdoptRef{}, ip->BuildPktHdrVal()}};
+		zeek::Args args{ip->ToPktHdrVal()};
 
 		try
 			{
-			discard_packet = check_ip->Call(args)->AsBool();
+			discard_packet = check_ip->Invoke(&args)->AsBool();
 			}
 
 		catch ( InterpreterException& e )
@@ -92,13 +92,13 @@ bool Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen)
 			int th_len = tp->th_off * 4;
 
 			zeek::Args args{
-				{AdoptRef{}, ip->BuildPktHdrVal()},
+				ip->ToPktHdrVal(),
 				{AdoptRef{}, BuildData(data, th_len, len, caplen)},
 			};
 
 			try
 				{
-				discard_packet = check_tcp->Call(args)->AsBool();
+				discard_packet = check_tcp->Invoke(&args)->AsBool();
 				}
 
 			catch ( InterpreterException& e )
@@ -116,13 +116,13 @@ bool Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen)
 			int uh_len = sizeof (struct udphdr);
 
 			zeek::Args args{
-				{AdoptRef{}, ip->BuildPktHdrVal()},
+				ip->ToPktHdrVal(),
 				{AdoptRef{}, BuildData(data, uh_len, len, caplen)},
 			};
 
 			try
 				{
-				discard_packet = check_udp->Call(args)->AsBool();
+				discard_packet = check_udp->Invoke(&args)->AsBool();
 				}
 
 			catch ( InterpreterException& e )
@@ -138,11 +138,11 @@ bool Discarder::NextPacket(const IP_Hdr* ip, int len, int caplen)
 			{
 			const struct icmp* ih = (const struct icmp*) data;
 
-			zeek::Args args{{AdoptRef{}, ip->BuildPktHdrVal()}};
+			zeek::Args args{ip->ToPktHdrVal()};
 
 			try
 				{
-				discard_packet = check_icmp->Call(args)->AsBool();
+				discard_packet = check_icmp->Invoke(&args)->AsBool();
 				}
 
 			catch ( InterpreterException& e )
diff --git a/src/Discard.h b/src/Discard.h
index 01b55d6e4a..ac69db845f 100644
--- a/src/Discard.h
+++ b/src/Discard.h
@@ -4,6 +4,8 @@
 
 #include <sys/types.h> // for u_char
 
+#include "IntrusivePtr.h"
+
 class IP_Hdr;
 class Val;
 class Func;
@@ -20,10 +22,10 @@ public:
 protected:
 	Val* BuildData(const u_char* data, int hdrlen, int len, int caplen);
 
-	Func* check_ip;
-	Func* check_tcp;
-	Func* check_udp;
-	Func* check_icmp;
+	IntrusivePtr<Func> check_ip;
+	IntrusivePtr<Func> check_tcp;
+	IntrusivePtr<Func> check_udp;
+	IntrusivePtr<Func> check_icmp;
 
 	// Maximum amount of application data passed to filtering functions.
 	int discarder_maxlen;
diff --git a/src/Event.cc b/src/Event.cc
index 11e34b0117..0f8c3b468b 100644
--- a/src/Event.cc
+++ b/src/Event.cc
@@ -56,7 +56,7 @@ void Event::Dispatch(bool no_remote)
 
 	try
 		{
-		handler->Call(args, no_remote);
+		handler->Call(&args, no_remote);
 		}
 
 	catch ( InterpreterException& e )
diff --git a/src/EventHandler.cc b/src/EventHandler.cc
index fa1d90bbd2..68673801d1 100644
--- a/src/EventHandler.cc
+++ b/src/EventHandler.cc
@@ -5,27 +5,20 @@
 #include "Scope.h"
 #include "NetVar.h"
 #include "ID.h"
+#include "Var.h"
 
 #include "broker/Manager.h"
 #include "broker/Data.h"
 
-EventHandler::EventHandler(const char* arg_name)
+EventHandler::EventHandler(std::string arg_name)
 	{
-	name = copy_string(arg_name);
+	name = std::move(arg_name);
 	used = false;
-	local = nullptr;
-	type = nullptr;
 	error_handler = false;
 	enabled = true;
 	generate_always = false;
 	}
 
-EventHandler::~EventHandler()
-	{
-	Unref(local);
-	delete [] name;
-	}
-
 EventHandler::operator bool() const
 	{
 	return enabled && ((local && local->HasBodies())
@@ -33,34 +26,25 @@ EventHandler::operator bool() const
 			   || ! auto_publish.empty());
 	}
 
-FuncType* EventHandler::FType(bool check_export)
+const IntrusivePtr<FuncType>& EventHandler::GetType(bool check_export)
 	{
 	if ( type )
 		return type;
 
-	auto id = lookup_ID(name, current_module.c_str(), false, false,
-	                    check_export);
+	const auto& id = lookup_ID(name.data(), current_module.c_str(), false, false,
+	                           check_export);
 
 	if ( ! id )
-		return nullptr;
+		return FuncType::nil;
 
-	if ( id->Type()->Tag() != TYPE_FUNC )
-		return nullptr;
+	if ( id->GetType()->Tag() != TYPE_FUNC )
+		return FuncType::nil;
 
-	type = id->Type()->AsFuncType();
+	type = id->GetType<FuncType>();
 	return type;
 	}
 
-void EventHandler::SetLocalHandler(Func* f)
-	{
-	if ( local )
-		Unref(local);
-
-	Ref(f);
-	local = f;
-	}
-
-void EventHandler::Call(const zeek::Args& vl, bool no_remote)
+void EventHandler::Call(zeek::Args* vl, bool no_remote)
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Event: %s\n", Name());
@@ -75,12 +59,12 @@ void EventHandler::Call(const zeek::Args& vl, bool no_remote)
 			{
 			// Send event in form [name, xs...] where xs represent the arguments.
 			broker::vector xs;
-			xs.reserve(vl.size());
+			xs.reserve(vl->size());
 			bool valid_args = true;
 
-			for ( auto i = 0u; i < vl.size(); ++i )
+			for ( auto i = 0u; i < vl->size(); ++i )
 				{
-				auto opt_data = bro_broker::val_to_data(vl[i].get());
+				auto opt_data = bro_broker::val_to_data((*vl)[i].get());
 
 				if ( opt_data )
 					xs.emplace_back(std::move(*opt_data));
@@ -114,10 +98,10 @@ void EventHandler::Call(const zeek::Args& vl, bool no_remote)
 
 	if ( local )
 		// No try/catch here; we pass exceptions upstream.
-		local->Call(vl);
+		local->Invoke(vl);
 	}
 
-void EventHandler::NewEvent(const zeek::Args& vl)
+void EventHandler::NewEvent(zeek::Args* vl)
 	{
 	if ( ! new_event )
 		return;
@@ -126,15 +110,17 @@ void EventHandler::NewEvent(const zeek::Args& vl)
 		// new_event() is the one event we don't want to report.
 		return;
 
-	RecordType* args = FType()->Args();
+	const auto& args = GetType()->Params();
+	static auto call_argument_vector = zeek::id::find_type<VectorType>("call_argument_vector");
 	auto vargs = make_intrusive<VectorVal>(call_argument_vector);
 
 	for ( int i = 0; i < args->NumFields(); i++ )
 		{
 		const char* fname = args->FieldName(i);
-		BroType* ftype = args->FieldType(i);
+		const auto& ftype = args->GetFieldType(i);
 		auto fdefault = args->FieldDefault(i);
 
+		static auto call_argument = zeek::id::find_type<RecordType>("call_argument");
 		auto rec = make_intrusive<RecordVal>(call_argument);
 		rec->Assign(0, make_intrusive<StringVal>(fname));
 
@@ -146,8 +132,8 @@ void EventHandler::NewEvent(const zeek::Args& vl)
 		if ( fdefault )
 			rec->Assign(2, std::move(fdefault));
 
-		if ( i < static_cast<int>(vl.size()) && vl[i] )
-			rec->Assign(3, vl[i]);
+		if ( i < static_cast<int>(vl->size()) && (*vl)[i] )
+			rec->Assign(3, (*vl)[i]);
 
 		vargs->Assign(i, std::move(rec));
 		}
diff --git a/src/EventHandler.h b/src/EventHandler.h
index 59773560f6..c2a053cac8 100644
--- a/src/EventHandler.h
+++ b/src/EventHandler.h
@@ -4,23 +4,36 @@
 
 #include "BroList.h"
 #include "ZeekArgs.h"
+#include "Type.h"
+#include "Func.h"
 
 #include <unordered_set>
 #include <string>
 
-class Func;
-class FuncType;
-
 class EventHandler {
 public:
-	explicit EventHandler(const char* name);
-	~EventHandler();
+	explicit EventHandler(std::string name);
 
-	const char* Name()	{ return name; }
-	Func* LocalHandler()	{ return local; }
-	FuncType* FType(bool check_export = true);
+	const char* Name()	{ return name.data(); }
 
-	void SetLocalHandler(Func* f);
+	const IntrusivePtr<Func>& GetFunc()
+		{ return local; }
+
+	[[deprecated("Remove in v4.1.  Use GetFunc().")]]
+	Func* LocalHandler()	{ return local.get(); }
+
+	const IntrusivePtr<FuncType>& GetType(bool check_export = true);
+
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
+	FuncType* FType(bool check_export = true)
+		{ return GetType().get(); }
+
+	void SetFunc(IntrusivePtr<Func> f)
+		{ local = std::move(f); }
+
+	[[deprecated("Remove in v4.1.  Use SetFunc().")]]
+	void SetLocalHandler(Func* f)
+		{ SetFunc({NewRef{}, f}); }
 
 	void AutoPublish(std::string topic)
 		{
@@ -32,7 +45,7 @@ public:
 		auto_publish.erase(topic);
 		}
 
-	void Call(const zeek::Args& vl, bool no_remote = false);
+	void Call(zeek::Args* vl, bool no_remote = false);
 
 	// Returns true if there is at least one local or remote handler.
 	explicit operator  bool() const;
@@ -53,11 +66,11 @@ public:
 	bool GenerateAlways()	{ return generate_always; }
 
 private:
-	void NewEvent(const zeek::Args& vl);	// Raise new_event() meta event.
+	void NewEvent(zeek::Args* vl);	// Raise new_event() meta event.
 
-	const char* name;
-	Func* local;
-	FuncType* type;
+	std::string name;
+	IntrusivePtr<Func> local;
+	IntrusivePtr<FuncType> type;
 	bool used;		// this handler is indeed used somewhere
 	bool enabled;
 	bool error_handler;	// this handler reports error messages.
diff --git a/src/EventLauncher.cc b/src/EventLauncher.cc
index cc32efe59e..293869c0f7 100644
--- a/src/EventLauncher.cc
+++ b/src/EventLauncher.cc
@@ -4,5 +4,6 @@
 #include "Event.h"
 #include "NetVar.h"
 #include "Conn.h"
+#include "File.h"
 
 #include "event.bif.func_def"
diff --git a/src/EventRegistry.cc b/src/EventRegistry.cc
index 7dbae7a83b..7cf05a7042 100644
--- a/src/EventRegistry.cc
+++ b/src/EventRegistry.cc
@@ -6,12 +6,32 @@
 EventRegistry::EventRegistry() = default;
 EventRegistry::~EventRegistry() noexcept = default;
 
+EventHandlerPtr EventRegistry::Register(std::string_view name)
+	{
+	// If there already is an entry in the registry, we have a
+	// local handler on the script layer.
+	EventHandler* h = event_registry->Lookup(name);
+
+	if ( h )
+		{
+		h->SetUsed();
+		return h;
+		}
+
+	h = new EventHandler(std::string(name));
+	event_registry->Register(h);
+
+	h->SetUsed();
+
+	return h;
+	}
+
 void EventRegistry::Register(EventHandlerPtr handler)
 	{
 	handlers[std::string(handler->Name())] = std::unique_ptr<EventHandler>(handler.Ptr());
 	}
 
-EventHandler* EventRegistry::Lookup(const std::string& name)
+EventHandler* EventRegistry::Lookup(std::string_view name)
 	{
 	auto it = handlers.find(name);
 	if ( it != handlers.end() )
@@ -27,7 +47,7 @@ EventRegistry::string_list EventRegistry::Match(RE_Matcher* pattern)
 	for ( const auto& entry : handlers )
 		{
 		EventHandler* v = entry.second.get();
-		if ( v->LocalHandler() && pattern->MatchExactly(v->Name()) )
+		if ( v->GetFunc() && pattern->MatchExactly(v->Name()) )
 			names.push_back(entry.first);
 		}
 
@@ -41,7 +61,7 @@ EventRegistry::string_list EventRegistry::UnusedHandlers()
 	for ( const auto& entry : handlers )
 		{
 		EventHandler* v = entry.second.get();
-		if ( v->LocalHandler() && ! v->Used() )
+		if ( v->GetFunc() && ! v->Used() )
 			names.push_back(entry.first);
 		}
 
@@ -55,7 +75,7 @@ EventRegistry::string_list EventRegistry::UsedHandlers()
 	for ( const auto& entry : handlers )
 		{
 		EventHandler* v = entry.second.get();
-		if ( v->LocalHandler() && v->Used() )
+		if ( v->GetFunc() && v->Used() )
 			names.push_back(entry.first);
 		}
 
@@ -80,13 +100,13 @@ void EventRegistry::PrintDebug()
 		{
 		EventHandler* v = entry.second.get();
 		fprintf(stderr, "Registered event %s (%s handler / %s)\n", v->Name(),
-				v->LocalHandler()? "local" : "no",
+				v->GetFunc() ? "local" : "no",
 				*v ? "active" : "not active"
 				);
 		}
 	}
 
-void EventRegistry::SetErrorHandler(const std::string& name)
+void EventRegistry::SetErrorHandler(std::string_view name)
 	{
 	EventHandler* eh = Lookup(name);
 
@@ -97,6 +117,6 @@ void EventRegistry::SetErrorHandler(const std::string& name)
 		}
 
 	reporter->InternalWarning("unknown event handler '%s' in SetErrorHandler()",
-	                          name.c_str());
+	                          std::string(name).c_str());
 	}
 
diff --git a/src/EventRegistry.h b/src/EventRegistry.h
index 31b859986b..13f3fcc5c4 100644
--- a/src/EventRegistry.h
+++ b/src/EventRegistry.h
@@ -5,6 +5,7 @@
 #include <map>
 #include <memory>
 #include <string>
+#include <string_view>
 #include <vector>
 
 class EventHandler;
@@ -17,10 +18,18 @@ public:
 	EventRegistry();
 	~EventRegistry() noexcept;
 
+	/**
+	 * Performs a lookup for an existing event handler and returns it
+	 * if one exists, or else creates one, registers it, and returns it.
+	 * @param name  The name of the event handler to lookup/register.
+	 * @return  The event handler.
+	 */
+	EventHandlerPtr Register(std::string_view name);
+
 	void Register(EventHandlerPtr handler);
 
 	// Return nil if unknown.
-	EventHandler* Lookup(const std::string& name);
+	EventHandler* Lookup(std::string_view name);
 
 	// Returns a list of all local handlers that match the given pattern.
 	// Passes ownership of list.
@@ -30,7 +39,7 @@ public:
 	// Marks a handler as handling errors. Error handler will not be called
 	// recursively to avoid infinite loops in case they trigger an error
 	// themselves.
-	void SetErrorHandler(const std::string& name);
+	void SetErrorHandler(std::string_view name);
 
 	string_list UnusedHandlers();
 	string_list UsedHandlers();
@@ -39,7 +48,7 @@ public:
 	void PrintDebug();
 
 private:
-	std::map<std::string, std::unique_ptr<EventHandler>> handlers;
+	std::map<std::string, std::unique_ptr<EventHandler>, std::less<>> handlers;
 };
 
 extern EventRegistry* event_registry;
diff --git a/src/Expr.cc b/src/Expr.cc
index eaa94ea4e6..667b563373 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -36,8 +36,8 @@ const char* expr_name(BroExprTag t)
 		"table()", "set()", "vector()",
 		"$=", "in", "<<>>",
 		"()", "function()", "event", "schedule",
-		"coerce", "record_coerce", "table_coerce",
-		"sizeof", "flatten", "cast", "is", "[:]="
+		"coerce", "record_coerce", "table_coerce", "vector_coerce",
+		"sizeof", "cast", "is", "[:]="
 	};
 
 	if ( int(t) >= NUM_EXPRS )
@@ -218,10 +218,10 @@ NameExpr::NameExpr(IntrusivePtr<ID> arg_id, bool const_init)
 	{
 	in_const_init = const_init;
 
-	if ( id->AsType() )
-		SetType(make_intrusive<TypeType>(IntrusivePtr{NewRef{}, id->AsType()}));
+	if ( id->IsType() )
+		SetType(make_intrusive<TypeType>(id->GetType()));
 	else
-		SetType({NewRef{}, id->Type()});
+		SetType(id->GetType());
 
 	EventHandler* h = event_registry->Lookup(id->Name());
 	if ( h )
@@ -232,14 +232,14 @@ IntrusivePtr<Val> NameExpr::Eval(Frame* f) const
 	{
 	IntrusivePtr<Val> v;
 
-	if ( id->AsType() )
-		return make_intrusive<Val>(id->AsType(), true);
+	if ( id->IsType() )
+		return make_intrusive<Val>(id->GetType(), true);
 
 	if ( id->IsGlobal() )
-		v = {NewRef{}, id->ID_Val()};
+		v = id->GetVal();
 
 	else if ( f )
-		v = {NewRef{}, f->GetElement(id.get())};
+		v = f->GetElementByID(id);
 
 	else
 		// No frame - evaluating for Simplify() purposes
@@ -256,7 +256,7 @@ IntrusivePtr<Val> NameExpr::Eval(Frame* f) const
 
 IntrusivePtr<Expr> NameExpr::MakeLvalue()
 	{
-	if ( id->AsType() )
+	if ( id->IsType() )
 		ExprError("Type name is not an lvalue");
 
 	if ( id->IsConst() && ! in_const_init )
@@ -273,7 +273,7 @@ void NameExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 	if ( id->IsGlobal() )
 		id->SetVal(std::move(v));
 	else
-		f->SetElement(id.get(), v.release());
+		f->SetElement(id, std::move(v));
 	}
 
 bool NameExpr::IsPure() const
@@ -310,10 +310,10 @@ void NameExpr::ExprDescribe(ODesc* d) const
 ConstExpr::ConstExpr(IntrusivePtr<Val> arg_val)
 	: Expr(EXPR_CONST), val(std::move(arg_val))
 	{
-	if ( val->Type()->Tag() == TYPE_LIST && val->AsListVal()->Length() == 1 )
-		val = {NewRef{}, val->AsListVal()->Index(0)};
+	if ( val->GetType()->Tag() == TYPE_LIST && val->AsListVal()->Length() == 1 )
+		val = val->AsListVal()->Idx(0);
 
-	SetType({NewRef{}, val->Type()});
+	SetType(val->GetType());
 	}
 
 void ConstExpr::ExprDescribe(ODesc* d) const
@@ -352,21 +352,22 @@ IntrusivePtr<Val> UnaryExpr::Eval(Frame* f) const
 	if ( ! v )
 		return nullptr;
 
-	if ( is_vector(v.get()) && Tag() != EXPR_IS && Tag() != EXPR_CAST )
+	if ( is_vector(v) && Tag() != EXPR_IS && Tag() != EXPR_CAST )
 		{
 		VectorVal* v_op = v->AsVectorVal();
-		VectorType* out_t;
-		if ( Type()->Tag() == TYPE_ANY )
-			out_t = v->Type()->AsVectorType();
-		else
-			out_t = Type()->AsVectorType();
+		IntrusivePtr<VectorType> out_t;
 
-		auto result = make_intrusive<VectorVal>(out_t);
+		if ( GetType()->Tag() == TYPE_ANY )
+			out_t = v->GetType<VectorType>();
+		else
+			out_t = GetType<VectorType>();
+
+		auto result = make_intrusive<VectorVal>(std::move(out_t));
 
 		for ( unsigned int i = 0; i < v_op->Size(); ++i )
 			{
-			Val* v_i = v_op->Lookup(i);
-			result->Assign(i, v_i ? Fold(v_i) : nullptr);
+			const auto& v_i = v_op->At(i);
+			result->Assign(i, v_i ? Fold(v_i.get()) : nullptr);
 			}
 
 		return result;
@@ -409,8 +410,6 @@ void UnaryExpr::ExprDescribe(ODesc* d) const
 		{
 		if ( is_coerce )
 			d->Add("(coerce ");
-		else if ( Tag() == EXPR_FLATTEN )
-			d->Add("flatten ");
 		else if ( Tag() != EXPR_REF )
 			d->Add(expr_name(Tag()));
 		}
@@ -420,7 +419,7 @@ void UnaryExpr::ExprDescribe(ODesc* d) const
 	if ( d->IsReadable() && is_coerce )
 		{
 		d->Add(" to ");
-		Type()->Describe(d);
+		GetType()->Describe(d);
 		d->Add(")");
 		}
 	}
@@ -440,8 +439,8 @@ IntrusivePtr<Val> BinaryExpr::Eval(Frame* f) const
 	if ( ! v2 )
 		return nullptr;
 
-	bool is_vec1 = is_vector(v1.get());
-	bool is_vec2 = is_vector(v2.get());
+	bool is_vec1 = is_vector(v1);
+	bool is_vec2 = is_vector(v2);
 
 	if ( is_vec1 && is_vec2 )
 		{ // fold pairs of elements
@@ -454,12 +453,12 @@ IntrusivePtr<Val> BinaryExpr::Eval(Frame* f) const
 			return nullptr;
 			}
 
-		auto v_result = make_intrusive<VectorVal>(Type()->AsVectorType());
+		auto v_result = make_intrusive<VectorVal>(GetType<VectorType>());
 
 		for ( unsigned int i = 0; i < v_op1->Size(); ++i )
 			{
-			if ( v_op1->Lookup(i) && v_op2->Lookup(i) )
-				v_result->Assign(i, Fold(v_op1->Lookup(i), v_op2->Lookup(i)));
+			if ( v_op1->At(i) && v_op2->At(i) )
+				v_result->Assign(i, Fold(v_op1->At(i).get(), v_op2->At(i).get()));
 			else
 				v_result->Assign(i, nullptr);
 			// SetError("undefined element in vector operation");
@@ -468,16 +467,16 @@ IntrusivePtr<Val> BinaryExpr::Eval(Frame* f) const
 		return v_result;
 		}
 
-	if ( IsVector(Type()->Tag()) && (is_vec1 || is_vec2) )
+	if ( IsVector(GetType()->Tag()) && (is_vec1 || is_vec2) )
 		{ // fold vector against scalar
 		VectorVal* vv = (is_vec1 ? v1 : v2)->AsVectorVal();
-		auto v_result = make_intrusive<VectorVal>(Type()->AsVectorType());
+		auto v_result = make_intrusive<VectorVal>(GetType<VectorType>());
 
 		for ( unsigned int i = 0; i < vv->Size(); ++i )
 			{
-			if ( Val* vv_i = vv->Lookup(i) )
-				v_result->Assign(i, is_vec1 ? Fold(vv_i, v2.get())
-				                            : Fold(v1.get(), vv_i));
+			if ( const auto& vv_i = vv->At(i) )
+				v_result->Assign(i, is_vec1 ? Fold(vv_i.get(), v2.get())
+				                            : Fold(v1.get(), vv_i.get()));
 			else
 				v_result->Assign(i, nullptr);
 
@@ -524,15 +523,15 @@ void BinaryExpr::ExprDescribe(ODesc* d) const
 
 IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
 	{
-	InternalTypeTag it = v1->Type()->InternalType();
+	InternalTypeTag it = v1->GetType()->InternalType();
 
 	if ( it == TYPE_INTERNAL_STRING )
 		return StringFold(v1, v2);
 
-	if ( v1->Type()->Tag() == TYPE_PATTERN )
+	if ( v1->GetType()->Tag() == TYPE_PATTERN )
 		return PatternFold(v1, v2);
 
-	if ( v1->Type()->IsSet() )
+	if ( v1->GetType()->IsSet() )
 		return SetFold(v1, v2);
 
 	if ( it == TYPE_INTERNAL_ADDR )
@@ -673,10 +672,7 @@ IntrusivePtr<Val> BinaryExpr::Fold(Val* v1, Val* v2) const
 		BadTag("BinaryExpr::Fold", expr_name(tag));
 	}
 
-	BroType* ret_type = Type();
-
-	if ( IsVector(ret_type->Tag()) )
-	     ret_type = ret_type->YieldType();
+	const auto& ret_type = IsVector(GetType()->Tag()) ? GetType()->Yield() : GetType();
 
 	if ( ret_type->Tag() == TYPE_INTERVAL )
 		return make_intrusive<IntervalVal>(d3, 1.0);
@@ -748,7 +744,7 @@ IntrusivePtr<Val> BinaryExpr::SetFold(Val* v1, Val* v2) const
 
 	switch ( tag ) {
 	case EXPR_AND:
-		return {AdoptRef{}, tv1->Intersect(tv2)};
+		return tv1->Intersection(*tv2);
 
 	case EXPR_OR:
 		{
@@ -771,19 +767,19 @@ IntrusivePtr<Val> BinaryExpr::SetFold(Val* v1, Val* v2) const
 		}
 
 	case EXPR_EQ:
-		res = tv1->EqualTo(tv2);
+		res = tv1->EqualTo(*tv2);
 		break;
 
 	case EXPR_NE:
-		res = ! tv1->EqualTo(tv2);
+		res = ! tv1->EqualTo(*tv2);
 		break;
 
 	case EXPR_LT:
-		res = tv1->IsSubsetOf(tv2) && tv1->Size() < tv2->Size();
+		res = tv1->IsSubsetOf(*tv2) && tv1->Size() < tv2->Size();
 		break;
 
 	case EXPR_LE:
-		res = tv1->IsSubsetOf(tv2);
+		res = tv1->IsSubsetOf(*tv2);
 		break;
 
 	case EXPR_GE:
@@ -856,16 +852,16 @@ void BinaryExpr::SwapOps()
 
 void BinaryExpr::PromoteOps(TypeTag t)
 	{
-	TypeTag bt1 = op1->Type()->Tag();
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	bool is_vec1 = IsVector(bt1);
 	bool is_vec2 = IsVector(bt2);
 
 	if ( is_vec1 )
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 	if ( is_vec2 )
-		bt2 = op2->Type()->AsVectorType()->YieldType()->Tag();
+		bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
 	if ( (is_vec1 || is_vec2) && ! (is_vec1 && is_vec2) )
 		reporter->Warning("mixing vector and scalar operands is deprecated");
@@ -892,8 +888,7 @@ CloneExpr::CloneExpr(IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	BroType* t = op->Type();
-	SetType({NewRef{}, t});
+	SetType(op->GetType());
 	}
 
 IntrusivePtr<Val> CloneExpr::Eval(Frame* f) const
@@ -918,16 +913,16 @@ IncrExpr::IncrExpr(BroExprTag arg_tag, IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	BroType* t = op->Type();
+	const auto& t = op->GetType();
 
 	if ( IsVector(t->Tag()) )
 		{
-		if ( ! IsIntegral(t->AsVectorType()->YieldType()->Tag()) )
+		if ( ! IsIntegral(t->AsVectorType()->Yield()->Tag()) )
 			ExprError("vector elements must be integral for increment operator");
 		else
 			{
 			reporter->Warning("increment/decrement operations for vectors deprecated");
-			SetType({NewRef{}, t});
+			SetType(t);
 			}
 		}
 	else
@@ -935,7 +930,7 @@ IncrExpr::IncrExpr(BroExprTag arg_tag, IntrusivePtr<Expr> arg_op)
 		if ( ! IsIntegral(t->Tag()) )
 			ExprError("requires an integral operand");
 		else
-			SetType({NewRef{}, t});
+			SetType(t);
 		}
 	}
 
@@ -950,13 +945,11 @@ IntrusivePtr<Val> IncrExpr::DoSingleEval(Frame* f, Val* v) const
 		--k;
 
 		if ( k < 0 &&
-		     v->Type()->InternalType() == TYPE_INTERNAL_UNSIGNED )
+		     v->GetType()->InternalType() == TYPE_INTERNAL_UNSIGNED )
 			RuntimeError("count underflow");
 		}
 
-	BroType* ret_type = Type();
-	if ( IsVector(ret_type->Tag()) )
-		ret_type = Type()->YieldType();
+	const auto& ret_type = IsVector(GetType()->Tag()) ? GetType()->Yield() : GetType();
 
 	if ( ret_type->Tag() == TYPE_INT )
 		return val_mgr->Int(k);
@@ -972,16 +965,16 @@ IntrusivePtr<Val> IncrExpr::Eval(Frame* f) const
 	if ( ! v )
 		return nullptr;
 
-	if ( is_vector(v.get()) )
+	if ( is_vector(v) )
 		{
 		IntrusivePtr<VectorVal> v_vec{NewRef{}, v->AsVectorVal()};
 
 		for ( unsigned int i = 0; i < v_vec->Size(); ++i )
 			{
-			Val* elt = v_vec->Lookup(i);
+			const auto& elt = v_vec->At(i);
 
 			if ( elt )
-				v_vec->Assign(i, DoSingleEval(f, elt));
+				v_vec->Assign(i, DoSingleEval(f, elt.get()));
 			else
 				v_vec->Assign(i, nullptr);
 			}
@@ -1008,7 +1001,7 @@ ComplementExpr::ComplementExpr(IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	BroType* t = op->Type();
+	const auto& t = op->GetType();
 	TypeTag bt = t->Tag();
 
 	if ( bt != TYPE_COUNT )
@@ -1028,7 +1021,7 @@ NotExpr::NotExpr(IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	TypeTag bt = op->Type()->Tag();
+	TypeTag bt = op->GetType()->Tag();
 
 	if ( ! IsIntegral(bt) && bt != TYPE_BOOL )
 		ExprError("requires an integral or boolean operand");
@@ -1047,10 +1040,7 @@ PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	BroType* t = op->Type();
-
-	if ( IsVector(t->Tag()) )
-		t = t->AsVectorType()->YieldType();
+	const auto& t = IsVector(op->GetType()->Tag()) ? op->GetType()->Yield() : op->GetType();
 
 	TypeTag bt = t->Tag();
 	IntrusivePtr<BroType> base_result_type;
@@ -1059,11 +1049,11 @@ PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
 		// Promote count and counter to int.
 		base_result_type = base_type(TYPE_INT);
 	else if ( bt == TYPE_INTERVAL || bt == TYPE_DOUBLE )
-		base_result_type = {NewRef{}, t};
+		base_result_type = t;
 	else
 		ExprError("requires an integral or double operand");
 
-	if ( is_vector(op.get()) )
+	if ( is_vector(op) )
 		SetType(make_intrusive<VectorType>(std::move(base_result_type)));
 	else
 		SetType(std::move(base_result_type));
@@ -1071,7 +1061,7 @@ PosExpr::PosExpr(IntrusivePtr<Expr> arg_op)
 
 IntrusivePtr<Val> PosExpr::Fold(Val* v) const
 	{
-	TypeTag t = v->Type()->Tag();
+	TypeTag t = v->GetType()->Tag();
 
 	if ( t == TYPE_DOUBLE || t == TYPE_INTERVAL || t == TYPE_INT )
 		return {NewRef{}, v};
@@ -1085,10 +1075,7 @@ NegExpr::NegExpr(IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	BroType* t = op->Type();
-
-	if ( IsVector(t->Tag()) )
-		t = t->AsVectorType()->YieldType();
+	const auto& t = IsVector(op->GetType()->Tag()) ? op->GetType()->Yield() : op->GetType();
 
 	TypeTag bt = t->Tag();
 	IntrusivePtr<BroType> base_result_type;
@@ -1097,11 +1084,11 @@ NegExpr::NegExpr(IntrusivePtr<Expr> arg_op)
 		// Promote count and counter to int.
 		base_result_type = base_type(TYPE_INT);
 	else if ( bt == TYPE_INTERVAL || bt == TYPE_DOUBLE )
-		base_result_type = {NewRef{}, t};
+		base_result_type = t;
 	else
 		ExprError("requires an integral or double operand");
 
-	if ( is_vector(op.get()) )
+	if ( is_vector(op) )
 		SetType(make_intrusive<VectorType>(std::move(base_result_type)));
 	else
 		SetType(std::move(base_result_type));
@@ -1109,9 +1096,9 @@ NegExpr::NegExpr(IntrusivePtr<Expr> arg_op)
 
 IntrusivePtr<Val> NegExpr::Fold(Val* v) const
 	{
-	if ( v->Type()->Tag() == TYPE_DOUBLE )
-		return make_intrusive<Val>(- v->InternalDouble(), v->Type()->Tag());
-	else if ( v->Type()->Tag() == TYPE_INTERVAL )
+	if ( v->GetType()->Tag() == TYPE_DOUBLE )
+		return make_intrusive<Val>(- v->InternalDouble(), v->GetType()->Tag());
+	else if ( v->GetType()->Tag() == TYPE_INTERVAL )
 		return make_intrusive<IntervalVal>(- v->InternalDouble(), 1.0);
 	else
 		return val_mgr->Int(- v->CoerceToInt());
@@ -1123,7 +1110,7 @@ SizeExpr::SizeExpr(IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	if ( op->Type()->InternalType() == TYPE_INTERNAL_DOUBLE )
+	if ( op->GetType()->InternalType() == TYPE_INTERNAL_DOUBLE )
 		SetType(base_type(TYPE_DOUBLE));
 	else
 		SetType(base_type(TYPE_COUNT));
@@ -1150,15 +1137,15 @@ AddExpr::AddExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( IsError() )
 		return;
 
-	TypeTag bt1 = op1->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
 
 	if ( IsVector(bt1) )
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( IsVector(bt2) )
-		bt2 = op2->Type()->AsVectorType()->YieldType()->Tag();
+		bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
 	IntrusivePtr<BroType> base_result_type;
 
@@ -1167,7 +1154,7 @@ AddExpr::AddExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	else if ( bt2 == TYPE_TIME && bt1 == TYPE_INTERVAL )
 		base_result_type = base_type(bt2);
 	else if ( BothArithmetic(bt1, bt2) )
-		PromoteType(max_type(bt1, bt2), is_vector(op1.get()) || is_vector(op2.get()));
+		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
 	else if ( BothString(bt1, bt2) )
 		base_result_type = base_type(bt1);
 	else
@@ -1175,7 +1162,7 @@ AddExpr::AddExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 
 	if ( base_result_type )
 		{
-		if ( is_vector(op1.get()) || is_vector(op2.get()) )
+		if ( is_vector(op1) || is_vector(op2) )
 			SetType(make_intrusive<VectorType>(std::move(base_result_type)));
 		else
 			SetType(std::move(base_result_type));
@@ -1185,31 +1172,31 @@ AddExpr::AddExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 void AddExpr::Canonicize()
 	{
 	if ( expr_greater(op2.get(), op1.get()) ||
-	     (op1->Type()->Tag() == TYPE_INTERVAL &&
-	      op2->Type()->Tag() == TYPE_TIME) ||
+	     (op1->GetType()->Tag() == TYPE_INTERVAL &&
+	      op2->GetType()->Tag() == TYPE_TIME) ||
 	     (op2->IsConst() && ! is_vector(op2->ExprVal()) && ! op1->IsConst()))
 		SwapOps();
 	}
 
 AddToExpr::AddToExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
-	: BinaryExpr(EXPR_ADD_TO, is_vector(arg_op1.get()) ?
+	: BinaryExpr(EXPR_ADD_TO, is_vector(arg_op1) ?
 	             std::move(arg_op1) : arg_op1->MakeLvalue(),
 	             std::move(arg_op2))
 	{
 	if ( IsError() )
 		return;
 
-	TypeTag bt1 = op1->Type()->Tag();
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( BothArithmetic(bt1, bt2) )
-		PromoteType(max_type(bt1, bt2), is_vector(op1.get()) || is_vector(op2.get()));
+		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
 	else if ( BothString(bt1, bt2) || BothInterval(bt1, bt2) )
 		SetType(base_type(bt1));
 
 	else if ( IsVector(bt1) )
 		{
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 
 		if ( IsArithmetic(bt1) )
 			{
@@ -1218,7 +1205,7 @@ AddToExpr::AddToExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 				if ( bt2 != bt1 )
 					op2 = make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
 
-				SetType({NewRef{}, op1->Type()});
+				SetType(op1->GetType());
 				}
 
 			else
@@ -1230,7 +1217,7 @@ AddToExpr::AddToExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 					  type_name(bt1), type_name(bt2)));
 
 		else
-			SetType({NewRef{}, op1->Type()});
+			SetType(op1->GetType());
 		}
 
 	else
@@ -1249,7 +1236,7 @@ IntrusivePtr<Val> AddToExpr::Eval(Frame* f) const
 	if ( ! v2 )
 		return nullptr;
 
-	if ( is_vector(v1.get()) )
+	if ( is_vector(v1) )
 		{
 		VectorVal* vv = v1->AsVectorVal();
 
@@ -1274,16 +1261,16 @@ SubExpr::SubExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( IsError() )
 		return;
 
-	const BroType* t1 = op1->Type();
-	const BroType* t2 = op2->Type();
+	const auto& t1 = op1->GetType();
+	const auto& t2 = op2->GetType();
 
 	TypeTag bt1 = t1->Tag();
 	if ( IsVector(bt1) )
-		bt1 = t1->AsVectorType()->YieldType()->Tag();
+		bt1 = t1->AsVectorType()->Yield()->Tag();
 
 	TypeTag bt2 = t2->Tag();
 	if ( IsVector(bt2) )
-		bt2 = t2->AsVectorType()->YieldType()->Tag();
+		bt2 = t2->AsVectorType()->Yield()->Tag();
 
 	IntrusivePtr<BroType> base_result_type;
 
@@ -1296,20 +1283,20 @@ SubExpr::SubExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	else if ( t1->IsSet() && t2->IsSet() )
 		{
 		if ( same_type(t1, t2) )
-			SetType({NewRef{}, op1->Type()});
+			SetType(op1->GetType());
 		else
 			ExprError("incompatible \"set\" operands");
 		}
 
 	else if ( BothArithmetic(bt1, bt2) )
-		PromoteType(max_type(bt1, bt2), is_vector(op1.get()) || is_vector(op2.get()));
+		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
 
 	else
 		ExprError("requires arithmetic operands");
 
 	if ( base_result_type )
 		{
-		if ( is_vector(op1.get()) || is_vector(op2.get()) )
+		if ( is_vector(op1) || is_vector(op2) )
 			SetType(make_intrusive<VectorType>(std::move(base_result_type)));
 		else
 			SetType(std::move(base_result_type));
@@ -1323,11 +1310,11 @@ RemoveFromExpr::RemoveFromExpr(IntrusivePtr<Expr> arg_op1,
 	if ( IsError() )
 		return;
 
-	TypeTag bt1 = op1->Type()->Tag();
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( BothArithmetic(bt1, bt2) )
-		PromoteType(max_type(bt1, bt2), is_vector(op1.get()) || is_vector(op2.get()));
+		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
 	else if ( BothInterval(bt1, bt2) )
 		SetType(base_type(bt1));
 	else
@@ -1363,32 +1350,32 @@ TimesExpr::TimesExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 
 	Canonicize();
 
-	TypeTag bt1 = op1->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
 
 	if ( IsVector(bt1) )
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( IsVector(bt2) )
-		bt2 = op2->Type()->AsVectorType()->YieldType()->Tag();
+		bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
 	if ( bt1 == TYPE_INTERVAL || bt2 == TYPE_INTERVAL )
 		{
 		if ( IsArithmetic(bt1) || IsArithmetic(bt2) )
-			PromoteType(TYPE_INTERVAL, is_vector(op1.get()) || is_vector(op2.get()) );
+			PromoteType(TYPE_INTERVAL, is_vector(op1) || is_vector(op2) );
 		else
 			ExprError("multiplication with interval requires arithmetic operand");
 		}
 	else if ( BothArithmetic(bt1, bt2) )
-		PromoteType(max_type(bt1, bt2), is_vector(op1.get()) || is_vector(op2.get()));
+		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
 	else
 		ExprError("requires arithmetic operands");
 	}
 
 void TimesExpr::Canonicize()
 	{
-	if ( expr_greater(op2.get(), op1.get()) || op2->Type()->Tag() == TYPE_INTERVAL ||
+	if ( expr_greater(op2.get(), op1.get()) || op2->GetType()->Tag() == TYPE_INTERVAL ||
 	     (op2->IsConst() && ! is_vector(op2->ExprVal()) && ! op1->IsConst()) )
 		SwapOps();
 	}
@@ -1400,23 +1387,23 @@ DivideExpr::DivideExpr(IntrusivePtr<Expr> arg_op1,
 	if ( IsError() )
 		return;
 
-	TypeTag bt1 = op1->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
 
 	if ( IsVector(bt1) )
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( IsVector(bt2) )
-		bt2 = op2->Type()->AsVectorType()->YieldType()->Tag();
+		bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
 	if ( bt1 == TYPE_INTERVAL || bt2 == TYPE_INTERVAL )
 		{
 		if ( IsArithmetic(bt1) || IsArithmetic(bt2) )
-			PromoteType(TYPE_INTERVAL, is_vector(op1.get()) || is_vector(op2.get()));
+			PromoteType(TYPE_INTERVAL, is_vector(op1) || is_vector(op2));
 		else if ( bt1 == TYPE_INTERVAL && bt2 == TYPE_INTERVAL )
 			{
-			if ( is_vector(op1.get()) || is_vector(op2.get()) )
+			if ( is_vector(op1) || is_vector(op2) )
 				SetType(make_intrusive<VectorType>(base_type(TYPE_DOUBLE)));
 			else
 				SetType(base_type(TYPE_DOUBLE));
@@ -1426,9 +1413,9 @@ DivideExpr::DivideExpr(IntrusivePtr<Expr> arg_op1,
 		}
 
 	else if ( BothArithmetic(bt1, bt2) )
-		PromoteType(max_type(bt1, bt2), is_vector(op1.get()) || is_vector(op2.get()));
+		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
 
-	else if ( bt1 == TYPE_ADDR && ! is_vector(op2.get()) &&
+	else if ( bt1 == TYPE_ADDR && ! is_vector(op2) &&
 		  (bt2 == TYPE_COUNT || bt2 == TYPE_INT) )
 		SetType(base_type(TYPE_SUBNET));
 
@@ -1440,7 +1427,7 @@ IntrusivePtr<Val> DivideExpr::AddrFold(Val* v1, Val* v2) const
 	{
 	uint32_t mask;
 
-	if ( v2->Type()->Tag() == TYPE_COUNT )
+	if ( v2->GetType()->Tag() == TYPE_COUNT )
 		mask = static_cast<uint32_t>(v2->InternalUnsigned());
 	else
 		mask = static_cast<uint32_t>(v2->InternalInt());
@@ -1467,18 +1454,18 @@ ModExpr::ModExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( IsError() )
 		return;
 
-	TypeTag bt1 = op1->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
 
 	if ( IsVector(bt1) )
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( IsVector(bt2) )
-		bt2 = op2->Type()->AsVectorType()->YieldType()->Tag();
+		bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
 	if ( BothIntegral(bt1, bt2) )
-		PromoteType(max_type(bt1, bt2), is_vector(op1.get()) || is_vector(op2.get()));
+		PromoteType(max_type(bt1, bt2), is_vector(op1) || is_vector(op2));
 	else
 		ExprError("requires integral operands");
 	}
@@ -1490,21 +1477,21 @@ BoolExpr::BoolExpr(BroExprTag arg_tag,
 	if ( IsError() )
 		return;
 
-	TypeTag bt1 = op1->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
 
 	if ( IsVector(bt1) )
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( IsVector(bt2) )
-		bt2 = op2->Type()->AsVectorType()->YieldType()->Tag();
+		bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
 	if ( BothBool(bt1, bt2) )
 		{
-		if ( is_vector(op1.get()) || is_vector(op2.get()) )
+		if ( is_vector(op1) || is_vector(op2) )
 			{
-			if ( ! (is_vector(op1.get()) && is_vector(op2.get())) )
+			if ( ! (is_vector(op1) && is_vector(op2)) )
 				reporter->Warning("mixing vector and scalar operands is deprecated");
 			SetType(make_intrusive<VectorType>(base_type(TYPE_BOOL)));
 			}
@@ -1547,8 +1534,8 @@ IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
 	if ( ! v1 )
 		return nullptr;
 
-	bool is_vec1 = is_vector(op1.get());
-	bool is_vec2 = is_vector(op2.get());
+	bool is_vec1 = is_vector(op1);
+	bool is_vec2 = is_vector(op2);
 
 	// Handle scalar op scalar
 	if ( ! is_vec1 && ! is_vec2 )
@@ -1583,9 +1570,9 @@ IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
 
 		if ( scalar_v->IsZero() == is_and )
 			{
-			result = make_intrusive<VectorVal>(Type()->AsVectorType());
+			result = make_intrusive<VectorVal>(GetType<VectorType>());
 			result->Resize(vector_v->Size());
-			result->AssignRepeat(0, result->Size(), scalar_v.get());
+			result->AssignRepeat(0, result->Size(), std::move(scalar_v));
 			}
 		else
 			result = std::move(vector_v);
@@ -1608,13 +1595,13 @@ IntrusivePtr<Val> BoolExpr::Eval(Frame* f) const
 		return nullptr;
 		}
 
-	auto result = make_intrusive<VectorVal>(Type()->AsVectorType());
+	auto result = make_intrusive<VectorVal>(GetType<VectorType>());
 	result->Resize(vec_v1->Size());
 
 	for ( unsigned int i = 0; i < vec_v1->Size(); ++i )
 		{
-		Val* op1 = vec_v1->Lookup(i);
-		Val* op2 = vec_v2->Lookup(i);
+		const auto& op1 = vec_v1->At(i);
+		const auto& op2 = vec_v2->At(i);
 		if ( op1 && op2 )
 			{
 			bool local_result = (tag == EXPR_AND_AND) ?
@@ -1637,25 +1624,25 @@ BitExpr::BitExpr(BroExprTag arg_tag,
 	if ( IsError() )
 		return;
 
-	const BroType* t1 = op1->Type();
-	const BroType* t2 = op2->Type();
+	const auto& t1 = op1->GetType();
+	const auto& t2 = op2->GetType();
 
 	TypeTag bt1 = t1->Tag();
 
 	if ( IsVector(bt1) )
-		bt1 = t1->AsVectorType()->YieldType()->Tag();
+		bt1 = t1->AsVectorType()->Yield()->Tag();
 
 	TypeTag bt2 = t2->Tag();
 
 	if ( IsVector(bt2) )
-		bt2 = t2->AsVectorType()->YieldType()->Tag();
+		bt2 = t2->AsVectorType()->Yield()->Tag();
 
 	if ( (bt1 == TYPE_COUNT || bt1 == TYPE_COUNTER) &&
 	     (bt2 == TYPE_COUNT || bt2 == TYPE_COUNTER) )
 		{
 		if ( bt1 == TYPE_COUNTER && bt2 == TYPE_COUNTER )
 			ExprError("cannot apply a bitwise operator to two \"counter\" operands");
-		else if ( is_vector(op1.get()) || is_vector(op2.get()) )
+		else if ( is_vector(op1) || is_vector(op2) )
 			SetType(make_intrusive<VectorType>(base_type(TYPE_COUNT)));
 		else
 			SetType(base_type(TYPE_COUNT));
@@ -1674,7 +1661,7 @@ BitExpr::BitExpr(BroExprTag arg_tag,
 	else if ( t1->IsSet() && t2->IsSet() )
 		{
 		if ( same_type(t1, t2) )
-			SetType({NewRef{}, op1->Type()});
+			SetType(op1->GetType());
 		else
 			ExprError("incompatible \"set\" operands");
 		}
@@ -1692,18 +1679,18 @@ EqExpr::EqExpr(BroExprTag arg_tag,
 
 	Canonicize();
 
-	const BroType* t1 = op1->Type();
-	const BroType* t2 = op2->Type();
+	const auto& t1 = op1->GetType();
+	const auto& t2 = op2->GetType();
 
 	TypeTag bt1 = t1->Tag();
 	if ( IsVector(bt1) )
-		bt1 = t1->AsVectorType()->YieldType()->Tag();
+		bt1 = t1->AsVectorType()->Yield()->Tag();
 
 	TypeTag bt2 = t2->Tag();
 	if ( IsVector(bt2) )
-		bt2 = t2->AsVectorType()->YieldType()->Tag();
+		bt2 = t2->AsVectorType()->Yield()->Tag();
 
-	if ( is_vector(op1.get()) || is_vector(op2.get()) )
+	if ( is_vector(op1) || is_vector(op2) )
 		SetType(make_intrusive<VectorType>(base_type(TYPE_BOOL)));
 	else
 		SetType(base_type(TYPE_BOOL));
@@ -1759,10 +1746,10 @@ EqExpr::EqExpr(BroExprTag arg_tag,
 
 void EqExpr::Canonicize()
 	{
-	if ( op2->Type()->Tag() == TYPE_PATTERN )
+	if ( op2->GetType()->Tag() == TYPE_PATTERN )
 		SwapOps();
 
-	else if ( op1->Type()->Tag() == TYPE_PATTERN )
+	else if ( op1->GetType()->Tag() == TYPE_PATTERN )
 		;
 
 	else if ( expr_greater(op2.get(), op1.get()) )
@@ -1771,7 +1758,7 @@ void EqExpr::Canonicize()
 
 IntrusivePtr<Val> EqExpr::Fold(Val* v1, Val* v2) const
 	{
-	if ( op1->Type()->Tag() == TYPE_PATTERN )
+	if ( op1->GetType()->Tag() == TYPE_PATTERN )
 		{
 		RE_Matcher* re = v1->AsPattern();
 		const BroString* s = v2->AsString();
@@ -1794,18 +1781,18 @@ RelExpr::RelExpr(BroExprTag arg_tag,
 
 	Canonicize();
 
-	const BroType* t1 = op1->Type();
-	const BroType* t2 = op2->Type();
+	const auto& t1 = op1->GetType();
+	const auto& t2 = op2->GetType();
 
 	TypeTag bt1 = t1->Tag();
 	if ( IsVector(bt1) )
-		bt1 = t1->AsVectorType()->YieldType()->Tag();
+		bt1 = t1->AsVectorType()->Yield()->Tag();
 
 	TypeTag bt2 = t2->Tag();
 	if ( IsVector(bt2) )
-		bt2 = t2->AsVectorType()->YieldType()->Tag();
+		bt2 = t2->AsVectorType()->Yield()->Tag();
 
-	if ( is_vector(op1.get()) || is_vector(op2.get()) )
+	if ( is_vector(op1) || is_vector(op2) )
 		SetType(make_intrusive<VectorType>(base_type(TYPE_BOOL)));
 	else
 		SetType(base_type(TYPE_BOOL));
@@ -1848,10 +1835,10 @@ CondExpr::CondExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 	: Expr(EXPR_COND),
 	  op1(std::move(arg_op1)), op2(std::move(arg_op2)), op3(std::move(arg_op3))
 	{
-	TypeTag bt1 = op1->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
 
 	if ( IsVector(bt1) )
-		bt1 = op1->Type()->AsVectorType()->YieldType()->Tag();
+		bt1 = op1->GetType()->AsVectorType()->Yield()->Tag();
 
 	if ( op1->IsError() || op2->IsError() || op3->IsError() )
 		SetError();
@@ -1861,17 +1848,17 @@ CondExpr::CondExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 
 	else
 		{
-		TypeTag bt2 = op2->Type()->Tag();
+		TypeTag bt2 = op2->GetType()->Tag();
 
-		if ( is_vector(op2.get()) )
-			bt2 = op2->Type()->AsVectorType()->YieldType()->Tag();
+		if ( is_vector(op2) )
+			bt2 = op2->GetType()->AsVectorType()->Yield()->Tag();
 
-		TypeTag bt3 = op3->Type()->Tag();
+		TypeTag bt3 = op3->GetType()->Tag();
 
 		if ( IsVector(bt3) )
-			bt3 = op3->Type()->AsVectorType()->YieldType()->Tag();
+			bt3 = op3->GetType()->AsVectorType()->Yield()->Tag();
 
-		if ( is_vector(op1.get()) && ! (is_vector(op2.get()) && is_vector(op3.get())) )
+		if ( is_vector(op1) && ! (is_vector(op2) && is_vector(op3)) )
 			{
 			ExprError("vector conditional requires vector alternatives");
 			return;
@@ -1885,7 +1872,7 @@ CondExpr::CondExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 			if ( bt3 != t )
 				op3 = make_intrusive<ArithCoerceExpr>(std::move(op3), t);
 
-			if ( is_vector(op2.get()) )
+			if ( is_vector(op2) )
 				SetType(make_intrusive<VectorType>(base_type(t)));
 			else
 				SetType(base_type(t));
@@ -1897,17 +1884,17 @@ CondExpr::CondExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 		else
 			{
 			if ( IsRecord(bt2) && IsRecord(bt3) &&
-			     ! same_type(op2->Type(), op3->Type()) )
+			     ! same_type(op2->GetType(), op3->GetType()) )
 				ExprError("operands must be of the same type");
 			else
-				SetType({NewRef{}, op2->Type()});
+				SetType(op2->GetType());
 			}
 		}
 	}
 
 IntrusivePtr<Val> CondExpr::Eval(Frame* f) const
 	{
-	if ( ! is_vector(op1.get()) )
+	if ( ! is_vector(op1) )
 		{
 		// Scalar case
 		auto false_eval = op1->Eval(f)->IsZero();
@@ -1940,17 +1927,17 @@ IntrusivePtr<Val> CondExpr::Eval(Frame* f) const
 		return nullptr;
 		}
 
-	auto result = make_intrusive<VectorVal>(Type()->AsVectorType());
+	auto result = make_intrusive<VectorVal>(GetType<VectorType>());
 	result->Resize(cond->Size());
 
 	for ( unsigned int i = 0; i < cond->Size(); ++i )
 		{
-		Val* local_cond = cond->Lookup(i);
+		const auto& local_cond = cond->At(i);
 
 		if ( local_cond )
 			{
-			Val* v = local_cond->IsZero() ? b->Lookup(i) : a->Lookup(i);
-			result->Assign(i, v ? v->Ref() : nullptr);
+			const auto& v = local_cond->IsZero() ? b->At(i) : a->At(i);
+			result->Assign(i, v);
 			}
 		else
 			result->Assign(i, nullptr);
@@ -1997,10 +1984,10 @@ RefExpr::RefExpr(IntrusivePtr<Expr> arg_op)
 	if ( IsError() )
 		return;
 
-	if ( ! ::is_assignable(op->Type()) )
+	if ( ! ::is_assignable(op->GetType()->Tag()) )
 		ExprError("illegal assignment target");
 	else
-		SetType({NewRef{}, op->Type()});
+		SetType(op->GetType());
 	}
 
 IntrusivePtr<Expr> RefExpr::MakeLvalue()
@@ -2015,7 +2002,7 @@ void RefExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 
 AssignExpr::AssignExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
                        bool arg_is_init, IntrusivePtr<Val> arg_val,
-                       attr_list* arg_attrs)
+                       const IntrusivePtr<Attributes>& attrs)
 	: BinaryExpr(EXPR_ASSIGN, arg_is_init ?
 	             std::move(arg_op1) : arg_op1->MakeLvalue(),
 	             std::move(arg_op2))
@@ -2026,7 +2013,10 @@ AssignExpr::AssignExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 	if ( IsError() )
 		return;
 
-	SetType({NewRef{}, arg_val ? arg_val->Type() : op1->Type()});
+	if ( arg_val )
+		SetType(arg_val->GetType());
+	else
+		SetType(op1->GetType());
 
 	if ( is_init )
 		{
@@ -2037,17 +2027,17 @@ AssignExpr::AssignExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2,
 
 	// We discard the status from TypeCheck since it has already
 	// generated error messages.
-	(void) TypeCheck(arg_attrs);
+	(void) TypeCheck(attrs);
 
 	val = std::move(arg_val);
 
 	SetLocationInfo(op1->GetLocationInfo(), op2->GetLocationInfo());
 	}
 
-bool AssignExpr::TypeCheck(attr_list* attrs)
+bool AssignExpr::TypeCheck(const IntrusivePtr<Attributes>& attrs)
 	{
-	TypeTag bt1 = op1->Type()->Tag();
-	TypeTag bt2 = op2->Type()->Tag();
+	TypeTag bt1 = op1->GetType()->Tag();
+	TypeTag bt2 = op2->GetType()->Tag();
 
 	if ( bt1 == TYPE_LIST && bt2 == TYPE_ANY )
 		// This is ok because we cannot explicitly declare lists on
@@ -2071,35 +2061,31 @@ bool AssignExpr::TypeCheck(attr_list* attrs)
 		}
 
 	if ( bt1 == TYPE_TABLE && bt2 == bt1 &&
-	     op2->Type()->AsTableType()->IsUnspecifiedTable() )
+	     op2->GetType()->AsTableType()->IsUnspecifiedTable() )
 		{
-		op2 = make_intrusive<TableCoerceExpr>(std::move(op2),
-		        IntrusivePtr{NewRef{}, op1->Type()->AsTableType()});
+		op2 = make_intrusive<TableCoerceExpr>(std::move(op2), op1->GetType<TableType>());
 		return true;
 		}
 
 	if ( bt1 == TYPE_TABLE && op2->Tag() == EXPR_LIST )
 		{
-		attr_list* attr_copy = nullptr;
+		std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr_copy;
 
 		if ( attrs )
-			{
-			attr_copy = new attr_list(attrs->length());
-			std::copy(attrs->begin(), attrs->end(), std::back_inserter(*attr_copy));
-			}
+			attr_copy = std::make_unique<std::vector<IntrusivePtr<Attr>>>(attrs->Attrs());
 
 		bool empty_list_assignment = (op2->AsListExpr()->Exprs().empty());
 
-		if ( op1->Type()->IsSet() )
+		if ( op1->GetType()->IsSet() )
 			op2 = make_intrusive<SetConstructorExpr>(
-			        IntrusivePtr{NewRef{}, op2->AsListExpr()}, attr_copy);
+			        cast_intrusive<ListExpr>(op2), std::move(attr_copy));
 		else
 			op2 = make_intrusive<TableConstructorExpr>(
-			        IntrusivePtr{NewRef{}, op2->AsListExpr()}, attr_copy);
+			        cast_intrusive<ListExpr>(op2), std::move(attr_copy));
 
-		if ( ! empty_list_assignment && ! same_type(op1->Type(), op2->Type()) )
+		if ( ! empty_list_assignment && ! same_type(op1->GetType(), op2->GetType()) )
 			{
-			if ( op1->Type()->IsSet() )
+			if ( op1->GetType()->IsSet() )
 				ExprError("set type mismatch in assignment");
 			else
 				ExprError("table type mismatch in assignment");
@@ -2112,10 +2098,9 @@ bool AssignExpr::TypeCheck(attr_list* attrs)
 
 	if ( bt1 == TYPE_VECTOR )
 		{
-		if ( bt2 == bt1 && op2->Type()->AsVectorType()->IsUnspecifiedVector() )
+		if ( bt2 == bt1 && op2->GetType()->AsVectorType()->IsUnspecifiedVector() )
 			{
-			op2 = make_intrusive<VectorCoerceExpr>(std::move(op2),
-			        IntrusivePtr{NewRef{}, op1->Type()->AsVectorType()});
+			op2 = make_intrusive<VectorCoerceExpr>(std::move(op2), op1->GetType<VectorType>());
 			return true;
 			}
 
@@ -2123,18 +2108,18 @@ bool AssignExpr::TypeCheck(attr_list* attrs)
 			{
 			op2 = make_intrusive<VectorConstructorExpr>(
 			        IntrusivePtr{AdoptRef{}, op2.release()->AsListExpr()},
-			        IntrusivePtr{NewRef{}, op1->Type()});
+			        op1->GetType());
 			return true;
 			}
 		}
 
-	if ( op1->Type()->Tag() == TYPE_RECORD &&
-	     op2->Type()->Tag() == TYPE_RECORD )
+	if ( op1->GetType()->Tag() == TYPE_RECORD &&
+	     op2->GetType()->Tag() == TYPE_RECORD )
 		{
-		if ( same_type(op1->Type(), op2->Type()) )
+		if ( same_type(op1->GetType(), op2->GetType()) )
 			{
-			RecordType* rt1 = op1->Type()->AsRecordType();
-			RecordType* rt2 = op2->Type()->AsRecordType();
+			RecordType* rt1 = op1->GetType()->AsRecordType();
+			RecordType* rt2 = op2->GetType()->AsRecordType();
 
 			// Make sure the attributes match as well.
 			for ( int i = 0; i < rt1->NumFields(); ++i )
@@ -2149,12 +2134,11 @@ bool AssignExpr::TypeCheck(attr_list* attrs)
 			}
 
 		// Need to coerce.
-		op2 = make_intrusive<RecordCoerceExpr>(std::move(op2),
-		        IntrusivePtr{NewRef{}, op1->Type()->AsRecordType()});
+		op2 = make_intrusive<RecordCoerceExpr>(std::move(op2), op1->GetType<RecordType>());
 		return true;
 		}
 
-	if ( ! same_type(op1->Type(), op2->Type()) )
+	if ( ! same_type(op1->GetType(), op2->GetType()) )
 		{
 		if ( bt1 == TYPE_TABLE && bt2 == TYPE_TABLE )
 			{
@@ -2179,19 +2163,20 @@ bool AssignExpr::TypeCheck(attr_list* attrs)
 					return false;
 					}
 
-				attr_list* attr_copy = nullptr;
+				std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr_copy;
 
-				if ( sce->Attrs() )
+
+				if ( sce->GetAttrs() )
 					{
-					attr_list* a = sce->Attrs()->Attrs();
-					attrs = new attr_list(a->length());
-					std::copy(a->begin(), a->end(), std::back_inserter(*attrs));
+					const auto& a = sce->GetAttrs()->Attrs();
+					attr_copy = std::make_unique<std::vector<IntrusivePtr<Attr>>>(a);
 					}
 
 				int errors_before = reporter->Errors();
 				op2 = make_intrusive<SetConstructorExpr>(
-				        IntrusivePtr{NewRef{}, ctor_list}, attr_copy,
-				        IntrusivePtr{NewRef{}, op1->Type()});
+				        IntrusivePtr{NewRef{}, ctor_list},
+				        std::move(attr_copy),
+				        op1->GetType());
 				int errors_after = reporter->Errors();
 
 				if ( errors_after > errors_before )
@@ -2230,7 +2215,7 @@ bool AssignExpr::TypeCheckArithmetics(TypeTag bt1, TypeTag bt2)
 		{
 		Warn("dangerous assignment of double to integral");
 		op2 = make_intrusive<ArithCoerceExpr>(std::move(op2), bt1);
-		bt2 = op2->Type()->Tag();
+		bt2 = op2->GetType()->Tag();
 		}
 
 	if ( bt1 == TYPE_INT )
@@ -2281,12 +2266,12 @@ IntrusivePtr<BroType> AssignExpr::InitType() const
 		return nullptr;
 		}
 
-	BroType* tl = op1->Type();
+	const auto& tl = op1->GetType();
 	if ( tl->Tag() != TYPE_LIST )
 		Internal("inconsistent list expr in AssignExpr::InitType");
 
 	return make_intrusive<TableType>(IntrusivePtr{NewRef{}, tl->AsTypeList()},
-	                                 IntrusivePtr{NewRef{}, op2->Type()});
+	                                 op2->GetType());
 	}
 
 void AssignExpr::EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const
@@ -2294,7 +2279,7 @@ void AssignExpr::EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const
 	if ( IsError() )
 		return;
 
-	TypeDecl td(nullptr, nullptr);
+	TypeDecl td;
 
 	if ( IsRecordElement(&td) )
 		{
@@ -2329,12 +2314,12 @@ void AssignExpr::EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const
 	TableVal* tv = aggr->AsTableVal();
 
 	auto index = op1->Eval(f);
-	auto v = check_and_promote(op2->Eval(f), t->YieldType(), true);
+	auto v = check_and_promote(op2->Eval(f), t->Yield().get(), true);
 
 	if ( ! index || ! v )
 		return;
 
-	if ( ! tv->Assign(index.get(), std::move(v)) )
+	if ( ! tv->Assign(std::move(index), std::move(v)) )
 		RuntimeError("type clash in table assignment");
 	}
 
@@ -2349,7 +2334,7 @@ IntrusivePtr<Val> AssignExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr)
 	if ( IsError() )
 		return nullptr;
 
-	TypeDecl td(nullptr, nullptr);
+	TypeDecl td;
 
 	if ( IsRecordElement(&td) )
 		{
@@ -2368,12 +2353,12 @@ IntrusivePtr<Val> AssignExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr)
 			return nullptr;
 			}
 
-		if ( aggr->Type()->Tag() != TYPE_RECORD )
+		if ( aggr->GetType()->Tag() != TYPE_RECORD )
 			Internal("bad aggregate in AssignExpr::InitVal");
 
 		RecordVal* aggr_r = aggr->AsRecordVal();
 
-		auto v = op2->InitVal(rt->FieldType(td.id), nullptr);
+		auto v = op2->InitVal(rt->GetFieldType(td.id).get(), nullptr);
 
 		if ( ! v )
 			return nullptr;
@@ -2390,16 +2375,15 @@ IntrusivePtr<Val> AssignExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr)
 			return nullptr;
 			}
 
-		if ( aggr->Type()->Tag() != TYPE_TABLE )
+		if ( aggr->GetType()->Tag() != TYPE_TABLE )
 			Internal("bad aggregate in AssignExpr::InitVal");
 
-		 // TODO: implement safer IntrusivePtr casts
-		IntrusivePtr<TableVal> tv{NewRef{}, aggr->AsTableVal()};
-		const TableType* tt = tv->Type()->AsTableType();
-		const BroType* yt = tv->Type()->YieldType();
+		auto tv = cast_intrusive<TableVal>(std::move(aggr));
+		const TableType* tt = tv->GetType()->AsTableType();
+		const auto& yt = tv->GetType()->Yield();
 
-		auto index = op1->InitVal(tt->Indices(), nullptr);
-		auto v = op2->InitVal(yt, nullptr);
+		auto index = op1->InitVal(tt->GetIndices().get(), nullptr);
+		auto v = op2->InitVal(yt.get(), nullptr);
 
 		if ( ! index || ! v )
 			return nullptr;
@@ -2424,7 +2408,7 @@ bool AssignExpr::IsRecordElement(TypeDecl* td) const
 		if ( td )
 			{
 			const NameExpr* n = (const NameExpr*) op1.get();
-			td->type = {NewRef{}, op2->Type()};
+			td->type = op2->GetType();
 			td->id = copy_string(n->Id()->Name());
 			}
 
@@ -2469,11 +2453,11 @@ IndexExpr::IndexExpr(IntrusivePtr<Expr> arg_op1,
 
 	if ( is_slice )
 		{
-		if ( ! IsString(op1->Type()->Tag()) && ! IsVector(op1->Type()->Tag()) )
+		if ( ! IsString(op1->GetType()->Tag()) && ! IsVector(op1->GetType()->Tag()) )
 			ExprError("slice notation indexing only supported for strings and vectors currently");
 		}
 
-	else if ( IsString(op1->Type()->Tag()) )
+	else if ( IsString(op1->GetType()->Tag()) )
 		{
 		if ( op2->AsListExpr()->Exprs().length() != 1 )
 			ExprError("invalid string index expression");
@@ -2482,19 +2466,19 @@ IndexExpr::IndexExpr(IntrusivePtr<Expr> arg_op1,
 	if ( IsError() )
 		return;
 
-	int match_type = op1->Type()->MatchesIndex(op2->AsListExpr());
+	int match_type = op1->GetType()->MatchesIndex(op2->AsListExpr());
 
 	if ( match_type == DOES_NOT_MATCH_INDEX )
 		{
 		std::string error_msg =
 		    fmt("expression with type '%s' is not a type that can be indexed",
-		        type_name(op1->Type()->Tag()));
+		        type_name(op1->GetType()->Tag()));
 		SetError(error_msg.data());
 		}
 
-	else if ( ! op1->Type()->YieldType() )
+	else if ( ! op1->GetType()->Yield() )
 		{
-		if ( IsString(op1->Type()->Tag()) && match_type == MATCHES_INDEX_SCALAR )
+		if ( IsString(op1->GetType()->Tag()) && match_type == MATCHES_INDEX_SCALAR )
 			SetType(base_type(TYPE_STRING));
 		else
 			// It's a set - so indexing it yields void.  We don't
@@ -2505,10 +2489,10 @@ IndexExpr::IndexExpr(IntrusivePtr<Expr> arg_op1,
 		}
 
 	else if ( match_type == MATCHES_INDEX_SCALAR )
-		SetType({NewRef{}, op1->Type()->YieldType()});
+		SetType(op1->GetType()->Yield());
 
 	else if ( match_type == MATCHES_INDEX_VECTOR )
-		SetType(make_intrusive<VectorType>(IntrusivePtr{NewRef{}, op1->Type()->YieldType()}));
+		SetType(make_intrusive<VectorType>(op1->GetType()->Yield()));
 
 	else
 		ExprError("Unknown MatchesIndex() return value");
@@ -2520,7 +2504,7 @@ bool IndexExpr::CanAdd() const
 		return true;	// avoid cascading the error report
 
 	// "add" only allowed if our type is "set".
-	return op1->Type()->IsSet();
+	return op1->GetType()->IsSet();
 	}
 
 bool IndexExpr::CanDel() const
@@ -2528,7 +2512,7 @@ bool IndexExpr::CanDel() const
 	if ( IsError() )
 		return true;	// avoid cascading the error report
 
-	return op1->Type()->Tag() == TYPE_TABLE;
+	return op1->GetType()->Tag() == TYPE_TABLE;
 	}
 
 void IndexExpr::Add(Frame* f)
@@ -2546,7 +2530,7 @@ void IndexExpr::Add(Frame* f)
 	if ( ! v2 )
 		return;
 
-	v1->AsTableVal()->Assign(v2.get(), nullptr);
+	v1->AsTableVal()->Assign(std::move(v2), nullptr);
 	}
 
 void IndexExpr::Delete(Frame* f)
@@ -2564,12 +2548,12 @@ void IndexExpr::Delete(Frame* f)
 	if ( ! v2 )
 		return;
 
-	v1->AsTableVal()->Delete(v2.get());
+	v1->AsTableVal()->Remove(*v2);
 	}
 
 IntrusivePtr<Expr> IndexExpr::MakeLvalue()
 	{
-	if ( IsString(op1->Type()->Tag()) )
+	if ( IsString(op1->GetType()->Tag()) )
 		ExprError("cannot assign to string index expression");
 
 	return make_intrusive<RefExpr>(IntrusivePtr{NewRef{}, this});
@@ -2587,16 +2571,16 @@ IntrusivePtr<Val> IndexExpr::Eval(Frame* f) const
 	if ( ! v2 )
 		return nullptr;
 
-	Val* indv = v2->AsListVal()->Index(0);
+	Val* indv = v2->AsListVal()->Idx(0).get();
 
 	if ( is_vector(indv) )
 		{
 		VectorVal* v_v1 = v1->AsVectorVal();
 		VectorVal* v_v2 = indv->AsVectorVal();
-		auto v_result = make_intrusive<VectorVal>(Type()->AsVectorType());
+		auto v_result = make_intrusive<VectorVal>(GetType<VectorType>());
 
 		// Booleans select each element (or not).
-		if ( IsBool(v_v2->Type()->YieldType()->Tag()) )
+		if ( IsBool(v_v2->GetType()->Yield()->Tag()) )
 			{
 			if ( v_v1->Size() != v_v2->Size() )
 				{
@@ -2606,11 +2590,8 @@ IntrusivePtr<Val> IndexExpr::Eval(Frame* f) const
 
 			for ( unsigned int i = 0; i < v_v2->Size(); ++i )
 				{
-				if ( v_v2->Lookup(i)->AsBool() )
-					{
-					auto a = v_v1->Lookup(i);
-					v_result->Assign(v_result->Size() + 1, a ? a->Ref() : nullptr);
-					}
+				if ( v_v2->At(i)->AsBool() )
+					v_result->Assign(v_result->Size() + 1, v_v1->At(i));
 				}
 			}
 		else
@@ -2620,10 +2601,7 @@ IntrusivePtr<Val> IndexExpr::Eval(Frame* f) const
 			// Probably only do this if *all* are negative.
 			v_result->Resize(v_v2->Size());
 			for ( unsigned int i = 0; i < v_v2->Size(); ++i )
-				{
-				auto a = v_v1->Lookup(v_v2->Lookup(i)->CoerceToInt());
-				v_result->Assign(i, a ? a->Ref() : nullptr);
-				}
+				v_result->Assign(i, v_v1->At(v_v2->At(i)->CoerceToInt()));
 			}
 
 		return v_result;
@@ -2649,21 +2627,21 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 
 	IntrusivePtr<Val> v;
 
-	switch ( v1->Type()->Tag() ) {
+	switch ( v1->GetType()->Tag() ) {
 	case TYPE_VECTOR:
 		{
 		VectorVal* vect = v1->AsVectorVal();
 		const ListVal* lv = v2->AsListVal();
 
 		if ( lv->Length() == 1 )
-			v = {NewRef{}, vect->Lookup(v2)};
+			v = vect->At(lv->Idx(0)->CoerceToUnsigned());
 		else
 			{
 			size_t len = vect->Size();
-			auto result = make_intrusive<VectorVal>(vect->Type()->AsVectorType());
+			auto result = make_intrusive<VectorVal>(vect->GetType<VectorType>());
 
-			bro_int_t first = get_slice_index(lv->Index(0)->CoerceToInt(), len);
-			bro_int_t last = get_slice_index(lv->Index(1)->CoerceToInt(), len);
+			bro_int_t first = get_slice_index(lv->Idx(0)->CoerceToInt(), len);
+			bro_int_t last = get_slice_index(lv->Idx(1)->CoerceToInt(), len);
 			bro_int_t sub_length = last - first;
 
 			if ( sub_length >= 0 )
@@ -2671,10 +2649,7 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 				result->Resize(sub_length);
 
 				for ( int idx = first; idx < last; idx++ )
-					{
-					auto a = vect->Lookup(idx);
-					result->Assign(idx - first, a ? a->Ref() : nullptr);
-					}
+					result->Assign(idx - first, vect->At(idx));
 				}
 
 			return result;
@@ -2683,7 +2658,7 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 		break;
 
 	case TYPE_TABLE:
-		v = v1->AsTableVal()->Lookup(v2); // Then, we jump into the TableVal here.
+		v = v1->AsTableVal()->FindOrDefault({NewRef{}, v2}); // Then, we jump into the TableVal here.
 		break;
 
 	case TYPE_STRING:
@@ -2695,7 +2670,7 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 
 		if ( lv->Length() == 1 )
 			{
-			bro_int_t idx = lv->Index(0)->AsInt();
+			bro_int_t idx = lv->Idx(0)->AsInt();
 
 			if ( idx < 0 )
 				idx += len;
@@ -2705,8 +2680,8 @@ IntrusivePtr<Val> IndexExpr::Fold(Val* v1, Val* v2) const
 			}
 		else
 			{
-			bro_int_t first = get_slice_index(lv->Index(0)->AsInt(), len);
-			bro_int_t last = get_slice_index(lv->Index(1)->AsInt(), len);
+			bro_int_t first = get_slice_index(lv->Idx(0)->AsInt(), len);
+			bro_int_t last = get_slice_index(lv->Idx(1)->AsInt(), len);
 			bro_int_t substring_len = last - first;
 
 			if ( substring_len < 0 )
@@ -2750,7 +2725,7 @@ void IndexExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 	// from the original value after the assignment already unref'd.
 	auto v_extra = v;
 
-	switch ( v1->Type()->Tag() ) {
+	switch ( v1->GetType()->Tag() ) {
 	case TYPE_VECTOR:
 		{
 		const ListVal* lv = v2->AsListVal();
@@ -2759,8 +2734,8 @@ void IndexExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 		if ( lv->Length() > 1 )
 			{
 			auto len = v1_vect->Size();
-			bro_int_t first = get_slice_index(lv->Index(0)->CoerceToInt(), len);
-			bro_int_t last = get_slice_index(lv->Index(1)->CoerceToInt(), len);
+			bro_int_t first = get_slice_index(lv->Idx(0)->CoerceToInt(), len);
+			bro_int_t last = get_slice_index(lv->Idx(1)->CoerceToInt(), len);
 
 			// Remove the elements from the vector within the slice
 			for ( auto idx = first; idx < last; idx++ )
@@ -2770,9 +2745,9 @@ void IndexExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 			VectorVal* v_vect = v->AsVectorVal();
 
 			for ( auto idx = 0u; idx < v_vect->Size(); idx++, first++ )
-				v1_vect->Insert(first, v_vect->Lookup(idx)->Ref());
+				v1_vect->Insert(first, v_vect->At(idx));
 			}
-		else if ( ! v1_vect->Assign(v2.get(), std::move(v)) )
+		else if ( ! v1_vect->Assign(lv->Idx(0)->CoerceToUnsigned(), std::move(v)) )
 			{
 			v = std::move(v_extra);
 
@@ -2780,7 +2755,7 @@ void IndexExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 				{
 				ODesc d;
 				v->Describe(&d);
-				auto vt = v->Type();
+				const auto& vt = v->GetType();
 				auto vtt = vt->Tag();
 				std::string tn = vtt == TYPE_RECORD ? vt->GetName() : type_name(vtt);
 				RuntimeErrorWithCallStack(fmt(
@@ -2794,7 +2769,7 @@ void IndexExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 		}
 
 	case TYPE_TABLE:
-		if ( ! v1->AsTableVal()->Assign(v2.get(), std::move(v)) )
+		if ( ! v1->AsTableVal()->Assign(std::move(v2), std::move(v)) )
 			{
 			v = std::move(v_extra);
 
@@ -2802,7 +2777,7 @@ void IndexExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 				{
 				ODesc d;
 				v->Describe(&d);
-				auto vt = v->Type();
+				const auto& vt = v->GetType();
 				auto vtt = vt->Tag();
 				std::string tn = vtt == TYPE_RECORD ? vt->GetName() : type_name(vtt);
 				RuntimeErrorWithCallStack(fmt(
@@ -2857,18 +2832,18 @@ FieldExpr::FieldExpr(IntrusivePtr<Expr> arg_op, const char* arg_field_name)
 	if ( IsError() )
 		return;
 
-	if ( ! IsRecord(op->Type()->Tag()) )
+	if ( ! IsRecord(op->GetType()->Tag()) )
 		ExprError("not a record");
 	else
 		{
-		RecordType* rt = op->Type()->AsRecordType();
+		RecordType* rt = op->GetType()->AsRecordType();
 		field = rt->FieldOffset(field_name);
 
 		if ( field < 0 )
 			ExprError("no such field in record");
 		else
 			{
-			SetType({NewRef{}, rt->FieldType(field)});
+			SetType(rt->GetFieldType(field));
 			td = rt->FieldDecl(field);
 
 			if ( rt->IsFieldDeprecated(field) )
@@ -2889,7 +2864,7 @@ IntrusivePtr<Expr> FieldExpr::MakeLvalue()
 
 bool FieldExpr::CanDel() const
 	{
-	return td->FindAttr(ATTR_DEFAULT) || td->FindAttr(ATTR_OPTIONAL);
+	return td->GetAttr(ATTR_DEFAULT) || td->GetAttr(ATTR_OPTIONAL);
 	}
 
 void FieldExpr::Assign(Frame* f, IntrusivePtr<Val> v)
@@ -2911,14 +2886,14 @@ void FieldExpr::Delete(Frame* f)
 
 IntrusivePtr<Val> FieldExpr::Fold(Val* v) const
 	{
-	if ( Val* result = v->AsRecordVal()->Lookup(field) )
-		return {NewRef{}, result};
+	if ( const auto& result = v->AsRecordVal()->GetField(field) )
+		return result;
 
 	// Check for &default.
-	const Attr* def_attr = td ? td->FindAttr(ATTR_DEFAULT) : nullptr;
+	const Attr* def_attr = td ? td->GetAttr(ATTR_DEFAULT).get() : nullptr;
 
 	if ( def_attr )
-		return def_attr->AttrExpr()->Eval(nullptr);
+		return def_attr->GetExpr()->Eval(nullptr);
 	else
 		{
 		RuntimeError("field value missing");
@@ -2949,11 +2924,11 @@ HasFieldExpr::HasFieldExpr(IntrusivePtr<Expr> arg_op,
 	if ( IsError() )
 		return;
 
-	if ( ! IsRecord(op->Type()->Tag()) )
+	if ( ! IsRecord(op->GetType()->Tag()) )
 		ExprError("not a record");
 	else
 		{
-		RecordType* rt = op->Type()->AsRecordType();
+		RecordType* rt = op->GetType()->AsRecordType();
 		field = rt->FieldOffset(field_name);
 
 		if ( field < 0 )
@@ -2973,7 +2948,7 @@ HasFieldExpr::~HasFieldExpr()
 IntrusivePtr<Val> HasFieldExpr::Fold(Val* v) const
 	{
 	auto rv = v->AsRecordVal();
-	return val_mgr->Bool(rv->Lookup(field));
+	return val_mgr->Bool(rv->GetField(field) != nullptr);
 	}
 
 void HasFieldExpr::ExprDescribe(ODesc* d) const
@@ -3013,9 +2988,9 @@ RecordConstructorExpr::RecordConstructorExpr(IntrusivePtr<ListExpr> constructor_
 			}
 
 		FieldAssignExpr* field = (FieldAssignExpr*) e;
-		IntrusivePtr<BroType> field_type{NewRef{}, field->Type()};
+		const auto& field_type = field->GetType();
 		char* field_name = copy_string(field->FieldName());
-		record_types->push_back(new TypeDecl(std::move(field_type), field_name));
+		record_types->push_back(new TypeDecl(field_name, field_type));
 		}
 
 	SetType(make_intrusive<RecordType>(record_types));
@@ -3032,7 +3007,10 @@ IntrusivePtr<Val> RecordConstructorExpr::InitVal(const BroType* t, IntrusivePtr<
 	if ( v )
 		{
 		RecordVal* rv = v->AsRecordVal();
-		auto ar = rv->CoerceTo(t->AsRecordType(), aggr.release());
+		auto bt = const_cast<BroType*>(t);
+		IntrusivePtr<RecordType> rt{NewRef{}, bt->AsRecordType()};
+		auto aggr_rec = cast_intrusive<RecordVal>(std::move(aggr));
+		auto ar = rv->CoerceTo(std::move(rt), std::move(aggr_rec));
 
 		if ( ar )
 			return ar;
@@ -3045,15 +3023,15 @@ IntrusivePtr<Val> RecordConstructorExpr::InitVal(const BroType* t, IntrusivePtr<
 IntrusivePtr<Val> RecordConstructorExpr::Fold(Val* v) const
 	{
 	ListVal* lv = v->AsListVal();
-	RecordType* rt = type->AsRecordType();
+	auto rt = cast_intrusive<RecordType>(type);
 
 	if ( lv->Length() != rt->NumFields() )
 		RuntimeErrorWithCallStack("inconsistency evaluating record constructor");
 
-	auto rv = make_intrusive<RecordVal>(rt);
+	auto rv = make_intrusive<RecordVal>(std::move(rt));
 
 	for ( int i = 0; i < lv->Length(); ++i )
-		rv->Assign(i, lv->Index(i)->Ref());
+		rv->Assign(i, lv->Idx(i));
 
 	return rv;
 	}
@@ -3066,10 +3044,9 @@ void RecordConstructorExpr::ExprDescribe(ODesc* d) const
 	}
 
 TableConstructorExpr::TableConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-                                           attr_list* arg_attrs,
+                                           std::unique_ptr<std::vector<IntrusivePtr<Attr>>> arg_attrs,
                                            IntrusivePtr<BroType> arg_type)
-	: UnaryExpr(EXPR_TABLE_CONSTRUCTOR, std::move(constructor_list)),
-	  attrs(nullptr)
+	: UnaryExpr(EXPR_TABLE_CONSTRUCTOR, std::move(constructor_list))
 	{
 	if ( IsError() )
 		return;
@@ -3102,9 +3079,10 @@ TableConstructorExpr::TableConstructorExpr(IntrusivePtr<ListExpr> constructor_li
 			}
 		}
 
-	attrs = arg_attrs ? new Attributes(arg_attrs, type, false, false) : nullptr;
+	if ( arg_attrs )
+		attrs = make_intrusive<Attributes>(std::move(*arg_attrs), type, false, false);
 
-	type_list* indices = type->AsTableType()->Indices()->Types();
+	const auto& indices = type->AsTableType()->GetIndices()->Types();
 	const expr_list& cle = op->AsListExpr()->Exprs();
 
 	// check and promote all index expressions in ctor list
@@ -3120,14 +3098,14 @@ TableConstructorExpr::TableConstructorExpr(IntrusivePtr<ListExpr> constructor_li
 
 		expr_list& idx_exprs = idx_expr->AsListExpr()->Exprs();
 
-		if ( idx_exprs.length() != indices->length() )
+		if ( idx_exprs.length() != static_cast<int>(indices.size()) )
 			continue;
 
 		loop_over_list(idx_exprs, j)
 			{
 			Expr* idx = idx_exprs[j];
 
-			auto promoted_idx = check_and_promote_expr(idx, (*indices)[j]);
+			auto promoted_idx = check_and_promote_expr(idx, indices[j].get());
 
 			if ( promoted_idx )
 				{
@@ -3150,8 +3128,7 @@ IntrusivePtr<Val> TableConstructorExpr::Eval(Frame* f) const
 	if ( IsError() )
 		return nullptr;
 
-	auto aggr = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, Type()->AsTableType()},
-	                                     IntrusivePtr{NewRef{}, attrs});
+	auto aggr = make_intrusive<TableVal>(GetType<TableType>(), attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	for ( const auto& expr : exprs )
@@ -3167,10 +3144,11 @@ IntrusivePtr<Val> TableConstructorExpr::InitVal(const BroType* t, IntrusivePtr<V
 	if ( IsError() )
 		return nullptr;
 
-	TableType* tt = Type()->AsTableType();
+	auto tt = GetType<TableType>();
+
 	auto tval = aggr ?
 	        IntrusivePtr<TableVal>{AdoptRef{}, aggr.release()->AsTableVal()} :
-	        make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt}, IntrusivePtr{NewRef{}, attrs});
+	        make_intrusive<TableVal>(std::move(tt), attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	for ( const auto& expr : exprs )
@@ -3187,10 +3165,9 @@ void TableConstructorExpr::ExprDescribe(ODesc* d) const
 	}
 
 SetConstructorExpr::SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
-                                       attr_list* arg_attrs,
+                                       std::unique_ptr<std::vector<IntrusivePtr<Attr>>> arg_attrs,
                                        IntrusivePtr<BroType> arg_type)
-	: UnaryExpr(EXPR_SET_CONSTRUCTOR, std::move(constructor_list)),
-	  attrs(nullptr)
+	: UnaryExpr(EXPR_SET_CONSTRUCTOR, std::move(constructor_list))
 	{
 	if ( IsError() )
 		return;
@@ -3220,19 +3197,20 @@ SetConstructorExpr::SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
 	else if ( type->Tag() != TYPE_TABLE || ! type->AsTableType()->IsSet() )
 		SetError("values in set(...) constructor do not specify a set");
 
-	attrs = arg_attrs ? new Attributes(arg_attrs, type, false, false) : nullptr;
+	if ( arg_attrs )
+		attrs = make_intrusive<Attributes>(std::move(*arg_attrs), type, false, false);
 
-	type_list* indices = type->AsTableType()->Indices()->Types();
+	const auto& indices = type->AsTableType()->GetIndices()->Types();
 	expr_list& cle = op->AsListExpr()->Exprs();
 
-	if ( indices->length() == 1 )
+	if ( indices.size() == 1 )
 		{
 		if ( ! check_and_promote_exprs_to_type(op->AsListExpr(),
-		                                       (*indices)[0]) )
+		                                       indices[0].get()) )
 			ExprError("inconsistent type in set constructor");
 		}
 
-	else if ( indices->length() > 1 )
+	else if ( indices.size() > 1 )
 		{
 		// Check/promote each expression in composite index.
 		loop_over_list(cle, i)
@@ -3241,7 +3219,7 @@ SetConstructorExpr::SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
 			ListExpr* le = ce->AsListExpr();
 
 			if ( ce->Tag() == EXPR_LIST &&
-			     check_and_promote_exprs(le, type->AsTableType()->Indices()) )
+			     check_and_promote_exprs(le, type->AsTableType()->GetIndices().get()) )
 				{
 				if ( le != cle[i] )
 					cle.replace(i, le);
@@ -3260,13 +3238,13 @@ IntrusivePtr<Val> SetConstructorExpr::Eval(Frame* f) const
 		return nullptr;
 
 	auto aggr = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, type->AsTableType()},
-	                                     IntrusivePtr{NewRef{}, attrs});
+	                                     attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	for ( const auto& expr : exprs )
 		{
 		auto element = expr->Eval(f);
-		aggr->Assign(element.get(), nullptr);
+		aggr->Assign(std::move(element), nullptr);
 		}
 
 	return aggr;
@@ -3277,18 +3255,18 @@ IntrusivePtr<Val> SetConstructorExpr::InitVal(const BroType* t, IntrusivePtr<Val
 	if ( IsError() )
 		return nullptr;
 
-	const BroType* index_type = t->AsTableType()->Indices();
-	TableType* tt = Type()->AsTableType();
+	const auto& index_type = t->AsTableType()->GetIndices();
+	auto tt = GetType<TableType>();
 	auto tval = aggr ?
 	        IntrusivePtr<TableVal>{AdoptRef{}, aggr.release()->AsTableVal()} :
-	        make_intrusive<TableVal>(IntrusivePtr{NewRef{}, tt}, IntrusivePtr{NewRef{}, attrs});
+	        make_intrusive<TableVal>(std::move(tt), attrs);
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	for ( const auto& e : exprs )
 		{
-		auto element = check_and_promote(e->Eval(nullptr), index_type, true);
+		auto element = check_and_promote(e->Eval(nullptr), index_type.get(), true);
 
-		if ( ! element || ! tval->Assign(element.get(), nullptr) )
+		if ( ! element || ! tval->Assign(std::move(element), nullptr) )
 			{
 			Error(fmt("initialization type mismatch in set"), e);
 			return nullptr;
@@ -3344,7 +3322,7 @@ VectorConstructorExpr::VectorConstructorExpr(IntrusivePtr<ListExpr> constructor_
 		}
 
 	if ( ! check_and_promote_exprs_to_type(op->AsListExpr(),
-					       type->AsVectorType()->YieldType()) )
+					       type->AsVectorType()->Yield().get()) )
 		ExprError("inconsistent types in vector constructor");
 	}
 
@@ -3353,7 +3331,7 @@ IntrusivePtr<Val> VectorConstructorExpr::Eval(Frame* f) const
 	if ( IsError() )
 		return nullptr;
 
-	auto vec = make_intrusive<VectorVal>(Type()->AsVectorType());
+	auto vec = make_intrusive<VectorVal>(GetType<VectorType>());
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	loop_over_list(exprs, i)
@@ -3375,16 +3353,16 @@ IntrusivePtr<Val> VectorConstructorExpr::InitVal(const BroType* t, IntrusivePtr<
 	if ( IsError() )
 		return nullptr;
 
-	VectorType* vt = Type()->AsVectorType();
+	auto vt = GetType<VectorType>();
 	auto vec = aggr ?
 	        IntrusivePtr<VectorVal>{AdoptRef{}, aggr.release()->AsVectorVal()} :
-	        make_intrusive<VectorVal>(vt);
+	        make_intrusive<VectorVal>(std::move(vt));
 	const expr_list& exprs = op->AsListExpr()->Exprs();
 
 	loop_over_list(exprs, i)
 		{
 		Expr* e = exprs[i];
-		auto v = check_and_promote(e->Eval(nullptr), t->YieldType(), true);
+		auto v = check_and_promote(e->Eval(nullptr), t->Yield().get(), true);
 
 		if ( ! v || ! vec->Assign(i, std::move(v)) )
 			{
@@ -3407,7 +3385,7 @@ FieldAssignExpr::FieldAssignExpr(const char* arg_field_name,
                                  IntrusivePtr<Expr> value)
 	: UnaryExpr(EXPR_FIELD_ASSIGN, std::move(value)), field_name(arg_field_name)
 	{
-	SetType({NewRef{}, op->Type()});
+	SetType(op->GetType());
 	}
 
 void FieldAssignExpr::EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f)
@@ -3435,7 +3413,7 @@ bool FieldAssignExpr::IsRecordElement(TypeDecl* td) const
 	{
 	if ( td )
 		{
-		td->type = {NewRef{}, op->Type()};
+		td->type = op->GetType();
 		td->id = copy_string(field_name.c_str());
 		}
 
@@ -3456,13 +3434,13 @@ ArithCoerceExpr::ArithCoerceExpr(IntrusivePtr<Expr> arg_op, TypeTag t)
 	if ( IsError() )
 		return;
 
-	TypeTag bt = op->Type()->Tag();
+	TypeTag bt = op->GetType()->Tag();
 	TypeTag vbt = bt;
 
 	if ( IsVector(bt) )
 		{
 		SetType(make_intrusive<VectorType>(base_type(t)));
-		vbt = op->Type()->AsVectorType()->YieldType()->Tag();
+		vbt = op->GetType()->AsVectorType()->Yield()->Tag();
 		}
 	else
 		SetType(base_type(t));
@@ -3507,20 +3485,20 @@ IntrusivePtr<Val> ArithCoerceExpr::Fold(Val* v) const
 		// invocation is being done per-element rather than on
 		// the whole vector.  Correct the type tag if necessary.
 		if ( type->Tag() == TYPE_VECTOR )
-			t = Type()->AsVectorType()->YieldType()->InternalType();
+			t = GetType()->AsVectorType()->Yield()->InternalType();
 
 		return FoldSingleVal(v, t);
 		}
 
-	t = Type()->AsVectorType()->YieldType()->InternalType();
+	t = GetType()->AsVectorType()->Yield()->InternalType();
 
 	VectorVal* vv = v->AsVectorVal();
-	auto result = make_intrusive<VectorVal>(Type()->AsVectorType());
+	auto result = make_intrusive<VectorVal>(GetType<VectorType>());
 
 	for ( unsigned int i = 0; i < vv->Size(); ++i )
 		{
-		if ( Val* elt = vv->Lookup(i) )
-			result->Assign(i, FoldSingleVal(elt, t));
+		if ( const auto& elt = vv->At(i) )
+			result->Assign(i, FoldSingleVal(elt.get(), t));
 		else
 			result->Assign(i, nullptr);
 		}
@@ -3538,16 +3516,16 @@ RecordCoerceExpr::RecordCoerceExpr(IntrusivePtr<Expr> arg_op,
 
 	SetType(std::move(r));
 
-	if ( Type()->Tag() != TYPE_RECORD )
+	if ( GetType()->Tag() != TYPE_RECORD )
 		ExprError("coercion to non-record");
 
-	else if ( op->Type()->Tag() != TYPE_RECORD )
+	else if ( op->GetType()->Tag() != TYPE_RECORD )
 		ExprError("coercion of non-record to record");
 
 	else
 		{
 		RecordType* t_r = type->AsRecordType();
-		RecordType* sub_r = op->Type()->AsRecordType();
+		RecordType* sub_r = op->GetType()->AsRecordType();
 
 		map_size = t_r->NumFields();
 		map = new int[map_size];
@@ -3566,8 +3544,8 @@ RecordCoerceExpr::RecordCoerceExpr(IntrusivePtr<Expr> arg_op,
 				break;
 				}
 
-			BroType* sub_t_i = sub_r->FieldType(i);
-			BroType* sup_t_i = t_r->FieldType(t_i);
+			const auto& sub_t_i = sub_r->GetFieldType(i);
+			const auto& sup_t_i = t_r->GetFieldType(t_i);
 
 			if ( ! same_type(sup_t_i, sub_t_i) )
 				{
@@ -3600,12 +3578,12 @@ RecordCoerceExpr::RecordCoerceExpr(IntrusivePtr<Expr> arg_op,
 					                                   sub->AsRecordType());
 					};
 
-				if ( ! is_arithmetic_promotable(sup_t_i, sub_t_i) &&
-				     ! is_record_promotable(sup_t_i, sub_t_i) )
+				if ( ! is_arithmetic_promotable(sup_t_i.get(), sub_t_i.get()) &&
+				     ! is_record_promotable(sup_t_i.get(), sub_t_i.get()) )
 					{
 					std::string error_msg = fmt(
 						"type clash for field \"%s\"", sub_r->FieldName(i));
-					Error(error_msg.c_str(), sub_t_i);
+					Error(error_msg.c_str(), sub_t_i.get());
 					SetError();
 					break;
 					}
@@ -3621,7 +3599,7 @@ RecordCoerceExpr::RecordCoerceExpr(IntrusivePtr<Expr> arg_op,
 			{
 			if ( map[i] == -1 )
 				{
-				if ( ! t_r->FieldDecl(i)->FindAttr(ATTR_OPTIONAL) )
+				if ( ! t_r->FieldDecl(i)->GetAttr(ATTR_OPTIONAL) )
 					{
 					std::string error_msg = fmt(
 						"non-optional field \"%s\" missing", t_r->FieldName(i));
@@ -3646,7 +3624,11 @@ IntrusivePtr<Val> RecordCoerceExpr::InitVal(const BroType* t, IntrusivePtr<Val>
 	if ( auto v = Eval(nullptr) )
 		{
 		RecordVal* rv = v->AsRecordVal();
-		if ( auto ar = rv->CoerceTo(t->AsRecordType(), aggr.release()) )
+		auto bt = const_cast<BroType*>(t);
+		IntrusivePtr<RecordType> rt{NewRef{}, bt->AsRecordType()};
+		auto aggr_rec = cast_intrusive<RecordVal>(std::move(aggr));
+
+		if ( auto ar = rv->CoerceTo(std::move(rt), std::move(aggr_rec)) )
 			return ar;
 		}
 
@@ -3656,8 +3638,8 @@ IntrusivePtr<Val> RecordCoerceExpr::InitVal(const BroType* t, IntrusivePtr<Val>
 
 IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 	{
-	auto val = make_intrusive<RecordVal>(Type()->AsRecordType());
-	RecordType* val_type = val->Type()->AsRecordType();
+	auto val = make_intrusive<RecordVal>(GetType<RecordType>());
+	RecordType* val_type = val->GetType()->AsRecordType();
 
 	RecordVal* rv = v->AsRecordVal();
 
@@ -3665,18 +3647,18 @@ IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 		{
 		if ( map[i] >= 0 )
 			{
-			IntrusivePtr<Val> rhs{NewRef{}, rv->Lookup(map[i])};
+			auto rhs = rv->GetField(map[i]);
 
 			if ( ! rhs )
 				{
-				const Attr* def = rv->Type()->AsRecordType()->FieldDecl(
-					map[i])->FindAttr(ATTR_DEFAULT);
+				const auto& def = rv->GetType()->AsRecordType()->FieldDecl(
+					map[i])->GetAttr(ATTR_DEFAULT);
 
 				if ( def )
-					rhs = def->AttrExpr()->Eval(nullptr);
+					rhs = def->GetExpr()->Eval(nullptr);
 				}
 
-			assert(rhs || Type()->AsRecordType()->FieldDecl(i)->FindAttr(ATTR_OPTIONAL));
+			assert(rhs || GetType()->AsRecordType()->FieldDecl(i)->GetAttr(ATTR_OPTIONAL));
 
 			if ( ! rhs )
 				{
@@ -3685,20 +3667,20 @@ IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 				continue;
 				}
 
-			BroType* rhs_type = rhs->Type();
-			BroType* field_type = val_type->FieldType(i);
+			const auto& rhs_type = rhs->GetType();
+			const auto& field_type = val_type->GetFieldType(i);
 
 			if ( rhs_type->Tag() == TYPE_RECORD &&
 			     field_type->Tag() == TYPE_RECORD &&
 			     ! same_type(rhs_type, field_type) )
 				{
-				if ( auto new_val = rhs->AsRecordVal()->CoerceTo(field_type->AsRecordType()) )
+				if ( auto new_val = rhs->AsRecordVal()->CoerceTo(cast_intrusive<RecordType>(field_type)) )
 					rhs = std::move(new_val);
 				}
 			else if ( BothArithmetic(rhs_type->Tag(), field_type->Tag()) &&
 			          ! same_type(rhs_type, field_type) )
 				{
-				if ( auto new_val = check_and_promote(rhs, field_type, false, op->GetLocationInfo()) )
+				if ( auto new_val = check_and_promote(rhs, field_type.get(), false, op->GetLocationInfo()) )
 					rhs = std::move(new_val);
 				else
 					RuntimeError("Failed type conversion");
@@ -3708,18 +3690,18 @@ IntrusivePtr<Val> RecordCoerceExpr::Fold(Val* v) const
 			}
 		else
 			{
-			if ( const Attr* def = Type()->AsRecordType()->FieldDecl(i)->FindAttr(ATTR_DEFAULT) )
+			if ( const auto& def = GetType()->AsRecordType()->FieldDecl(i)->GetAttr(ATTR_DEFAULT) )
 				{
-				auto def_val = def->AttrExpr()->Eval(nullptr);
-				BroType* def_type = def_val->Type();
-				BroType* field_type = Type()->AsRecordType()->FieldType(i);
+				auto def_val = def->GetExpr()->Eval(nullptr);
+				const auto& def_type = def_val->GetType();
+				const auto& field_type = GetType()->AsRecordType()->GetFieldType(i);
 
 				if ( def_type->Tag() == TYPE_RECORD &&
 				     field_type->Tag() == TYPE_RECORD &&
 				     ! same_type(def_type, field_type) )
 					{
 					auto tmp = def_val->AsRecordVal()->CoerceTo(
-					        field_type->AsRecordType());
+					        cast_intrusive<RecordType>(field_type));
 
 					if ( tmp )
 						def_val = std::move(tmp);
@@ -3744,10 +3726,10 @@ TableCoerceExpr::TableCoerceExpr(IntrusivePtr<Expr> arg_op,
 
 	SetType(std::move(r));
 
-	if ( Type()->Tag() != TYPE_TABLE )
+	if ( GetType()->Tag() != TYPE_TABLE )
 		ExprError("coercion to non-table");
 
-	else if ( op->Type()->Tag() != TYPE_TABLE )
+	else if ( op->GetType()->Tag() != TYPE_TABLE )
 		ExprError("coercion of non-table/set to table/set");
 	}
 
@@ -3763,8 +3745,7 @@ IntrusivePtr<Val> TableCoerceExpr::Fold(Val* v) const
 	if ( tv->Size() > 0 )
 		RuntimeErrorWithCallStack("coercion of non-empty table/set");
 
-	return make_intrusive<TableVal>(IntrusivePtr{NewRef{}, Type()->AsTableType()},
-	                                IntrusivePtr{NewRef{}, tv->Attrs()});
+	return make_intrusive<TableVal>(GetType<TableType>(), tv->GetAttrs());
 	}
 
 VectorCoerceExpr::VectorCoerceExpr(IntrusivePtr<Expr> arg_op,
@@ -3776,10 +3757,10 @@ VectorCoerceExpr::VectorCoerceExpr(IntrusivePtr<Expr> arg_op,
 
 	SetType(std::move(v));
 
-	if ( Type()->Tag() != TYPE_VECTOR )
+	if ( GetType()->Tag() != TYPE_VECTOR )
 		ExprError("coercion to non-vector");
 
-	else if ( op->Type()->Tag() != TYPE_VECTOR )
+	else if ( op->GetType()->Tag() != TYPE_VECTOR )
 		ExprError("coercion of non-vector to vector");
 	}
 
@@ -3795,54 +3776,7 @@ IntrusivePtr<Val> VectorCoerceExpr::Fold(Val* v) const
 	if ( vv->Size() > 0 )
 		RuntimeErrorWithCallStack("coercion of non-empty vector");
 
-	return make_intrusive<VectorVal>(Type()->Ref()->AsVectorType());
-	}
-
-FlattenExpr::FlattenExpr(IntrusivePtr<Expr> arg_op)
-	: UnaryExpr(EXPR_FLATTEN, std::move(arg_op))
-	{
-	if ( IsError() )
-		return;
-
-	BroType* t = op->Type();
-
-	if ( t->Tag() != TYPE_RECORD )
-		Internal("bad type in FlattenExpr::FlattenExpr");
-
-	RecordType* rt = t->AsRecordType();
-	num_fields = rt->NumFields();
-
-	auto tl = make_intrusive<TypeList>();
-
-	for ( int i = 0; i < num_fields; ++i )
-		tl->Append({NewRef{}, rt->FieldType(i)});
-
-	Unref(rt);
-	SetType(std::move(tl));
-	}
-
-IntrusivePtr<Val> FlattenExpr::Fold(Val* v) const
-	{
-	RecordVal* rv = v->AsRecordVal();
-	auto l = make_intrusive<ListVal>(TYPE_ANY);
-
-	for ( int i = 0; i < num_fields; ++i )
-		{
-		if ( Val* fv = rv->Lookup(i) )
-			{
-			l->Append(fv->Ref());
-			continue;
-			}
-
-		const RecordType* rv_t = rv->Type()->AsRecordType();
-		if ( const Attr* fa = rv_t->FieldDecl(i)->FindAttr(ATTR_DEFAULT) )
-			l->Append(fa->AttrExpr()->Eval(nullptr).release());
-
-		else
-			RuntimeError("missing field value");
-		}
-
-	return l;
+	return make_intrusive<VectorVal>(GetType<VectorType>());
 	}
 
 ScheduleTimer::ScheduleTimer(const EventHandlerPtr& arg_event, zeek::Args arg_args,
@@ -3870,7 +3804,7 @@ ScheduleExpr::ScheduleExpr(IntrusivePtr<Expr> arg_when,
 	if ( IsError() || when->IsError() || event->IsError() )
 		return;
 
-	TypeTag bt = when->Type()->Tag();
+	TypeTag bt = when->GetType()->Tag();
 
 	if ( bt != TYPE_TIME && bt != TYPE_INTERVAL )
 		ExprError("schedule expression requires a time or time interval");
@@ -3895,7 +3829,7 @@ IntrusivePtr<Val> ScheduleExpr::Eval(Frame* f) const
 
 	double dt = when_val->InternalDouble();
 
-	if ( when->Type()->Tag() == TYPE_INTERVAL )
+	if ( when->GetType()->Tag() == TYPE_INTERVAL )
 		dt += network_time;
 
 	auto args = eval_list(f, event->Args());
@@ -3947,34 +3881,33 @@ InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 	if ( IsError() )
 		return;
 
-	if ( op1->Type()->Tag() == TYPE_PATTERN )
+	if ( op1->GetType()->Tag() == TYPE_PATTERN )
 		{
-		if ( op2->Type()->Tag() != TYPE_STRING )
+		if ( op2->GetType()->Tag() != TYPE_STRING )
 			{
-			op2->Type()->Error("pattern requires string index", op1.get());
+			op2->GetType()->Error("pattern requires string index", op1.get());
 			SetError();
 			}
 		else
 			SetType(base_type(TYPE_BOOL));
 		}
 
-	else if ( op1->Type()->Tag() == TYPE_RECORD )
+	else if ( op1->GetType()->Tag() == TYPE_RECORD )
 		{
-		if ( op2->Type()->Tag() != TYPE_TABLE )
+		if ( op2->GetType()->Tag() != TYPE_TABLE )
 			{
-			op2->Type()->Error("table/set required");
+			op2->GetType()->Error("table/set required");
 			SetError();
 			}
 
 		else
 			{
-			const BroType* t1 = op1->Type();
-			const TypeList* it =
-				op2->Type()->AsTableType()->Indices();
+			const auto& t1 = op1->GetType();
+			const auto& it = op2->GetType()->AsTableType()->GetIndices();
 
 			if ( ! same_type(t1, it) )
 				{
-				t1->Error("indexing mismatch", op2->Type());
+				t1->Error("indexing mismatch", op2->GetType().get());
 				SetError();
 				}
 			else
@@ -3982,8 +3915,8 @@ InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 			}
 		}
 
-	else if ( op1->Type()->Tag() == TYPE_STRING &&
-		  op2->Type()->Tag() == TYPE_STRING )
+	else if ( op1->GetType()->Tag() == TYPE_STRING &&
+		  op2->GetType()->Tag() == TYPE_STRING )
 		SetType(base_type(TYPE_BOOL));
 
 	else
@@ -3991,16 +3924,16 @@ InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 		// Check for:	<addr> in <subnet>
 		//		<addr> in set[subnet]
 		//		<addr> in table[subnet] of ...
-		if ( op1->Type()->Tag() == TYPE_ADDR )
+		if ( op1->GetType()->Tag() == TYPE_ADDR )
 			{
-			if ( op2->Type()->Tag() == TYPE_SUBNET )
+			if ( op2->GetType()->Tag() == TYPE_SUBNET )
 				{
 				SetType(base_type(TYPE_BOOL));
 				return;
 				}
 
-			if ( op2->Type()->Tag() == TYPE_TABLE &&
-			     op2->Type()->AsTableType()->IsSubNetIndex() )
+			if ( op2->GetType()->Tag() == TYPE_TABLE &&
+			     op2->GetType()->AsTableType()->IsSubNetIndex() )
 				{
 				SetType(base_type(TYPE_BOOL));
 				return;
@@ -4012,7 +3945,7 @@ InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 
 		ListExpr* lop1 = op1->AsListExpr();
 
-		if ( ! op2->Type()->MatchesIndex(lop1) )
+		if ( ! op2->GetType()->MatchesIndex(lop1) )
 			SetError("not an index type");
 		else
 			SetType(base_type(TYPE_BOOL));
@@ -4021,14 +3954,14 @@ InExpr::InExpr(IntrusivePtr<Expr> arg_op1, IntrusivePtr<Expr> arg_op2)
 
 IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
 	{
-	if ( v1->Type()->Tag() == TYPE_PATTERN )
+	if ( v1->GetType()->Tag() == TYPE_PATTERN )
 		{
 		RE_Matcher* re = v1->AsPattern();
 		const BroString* s = v2->AsString();
 		return val_mgr->Bool(re->MatchAnywhere(s) != 0);
 		}
 
-	if ( v2->Type()->Tag() == TYPE_STRING )
+	if ( v2->GetType()->Tag() == TYPE_STRING )
 		{
 		const BroString* s1 = v1->AsString();
 		const BroString* s2 = v2->AsString();
@@ -4039,16 +3972,16 @@ IntrusivePtr<Val> InExpr::Fold(Val* v1, Val* v2) const
 		return val_mgr->Bool(res);
 		}
 
-	if ( v1->Type()->Tag() == TYPE_ADDR &&
-	     v2->Type()->Tag() == TYPE_SUBNET )
+	if ( v1->GetType()->Tag() == TYPE_ADDR &&
+	     v2->GetType()->Tag() == TYPE_SUBNET )
 		return val_mgr->Bool(v2->AsSubNetVal()->Contains(v1->AsAddr()));
 
 	bool res;
 
 	if ( is_vector(v2) )
-		res = (bool)v2->AsVectorVal()->Lookup(v1);
+		res = (bool)v2->AsVectorVal()->At(v1->AsListVal()->Idx(0)->CoerceToUnsigned());
 	else
-		res = (bool)v2->AsTableVal()->Lookup(v1, false);
+		res = (bool)v2->AsTableVal()->Find({NewRef{}, v1});
 
 	return val_mgr->Bool(res);
 	}
@@ -4063,7 +3996,7 @@ CallExpr::CallExpr(IntrusivePtr<Expr> arg_func,
 		return;
 		}
 
-	BroType* func_type = func->Type();
+	const auto& func_type = func->GetType();
 
 	if ( ! IsFunc(func_type->Tag()) )
 		{
@@ -4083,7 +4016,7 @@ CallExpr::CallExpr(IntrusivePtr<Expr> arg_func,
 		SetError("argument type mismatch in function call");
 	else
 		{
-		BroType* yield = func_type->YieldType();
+		const auto& yield = func_type->Yield();
 
 		if ( ! yield )
 			{
@@ -4111,7 +4044,7 @@ CallExpr::CallExpr(IntrusivePtr<Expr> arg_func,
 			}
 			}
 		else
-			SetType({NewRef{}, yield});
+			SetType(yield);
 
 		// Check for call to built-ins that can be statically analyzed.
 		IntrusivePtr<Val> func_val;
@@ -4197,7 +4130,8 @@ IntrusivePtr<Val> CallExpr::Eval(Frame* f) const
 		if ( f )
 			f->SetCall(this);
 
-		ret = funcv->Call(*v, f);
+		auto& args = *v;
+		ret = funcv->Invoke(&args, f);
 
 		if ( f )
 			f->SetCall(current_call);
@@ -4234,43 +4168,20 @@ void CallExpr::ExprDescribe(ODesc* d) const
 		args->Describe(d);
 	}
 
-static std::unique_ptr<id_list> shallow_copy_func_inits(const IntrusivePtr<Stmt>& body,
-                                                        const id_list* src)
-	{
-	if ( ! body )
-		return nullptr;
-
-	if ( ! src )
-		return nullptr;
-
-	if ( src->empty() )
-		return nullptr;
-
-	auto dest = std::make_unique<id_list>(src->length());
-
-	for ( ID* i : *src )
-		{
-		Ref(i);
-		dest->push_back(i);
-		}
-
-	return dest;
-	}
-
 LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
                        id_list arg_outer_ids) : Expr(EXPR_LAMBDA)
 	{
 	ingredients = std::move(arg_ing);
 	outer_ids = std::move(arg_outer_ids);
 
-	SetType({NewRef{}, ingredients->id->Type()});
+	SetType(ingredients->id->GetType());
 
 	// Install a dummy version of the function globally for use only
 	// when broker provides a closure.
-	BroFunc* dummy_func = new BroFunc(
-		ingredients->id.get(),
+	auto dummy_func = make_intrusive<BroFunc>(
+		ingredients->id,
 		ingredients->body,
-		shallow_copy_func_inits(ingredients->body, ingredients->inits).release(),
+		ingredients->inits,
 		ingredients->frame_size,
 		ingredients->priority);
 
@@ -4287,7 +4198,7 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 
 		my_name = "lambda_<" + std::to_string(h[0]) + ">";
 		auto fullname = make_full_var_name(current_module.data(), my_name.data());
-		auto id = global_scope()->Lookup(fullname);
+		const auto& id = global_scope()->Find(fullname);
 
 		if ( id )
 			// Just try again to make a unique lambda name.  If two peer
@@ -4305,10 +4216,9 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 	// Update lamb's name
 	dummy_func->SetName(my_name.c_str());
 
-	auto v = make_intrusive<Val>(dummy_func);
-	Unref(dummy_func);
+	auto v = make_intrusive<Val>(std::move(dummy_func));
 	id->SetVal(std::move(v));
-	id->SetType({NewRef{}, ingredients->id->Type()});
+	id->SetType(ingredients->id->GetType());
 	id->SetConst();
 	}
 
@@ -4320,9 +4230,9 @@ Scope* LambdaExpr::GetScope() const
 IntrusivePtr<Val> LambdaExpr::Eval(Frame* f) const
 	{
 	auto lamb = make_intrusive<BroFunc>(
-		ingredients->id.get(),
+		ingredients->id,
 		ingredients->body,
-		shallow_copy_func_inits(ingredients->body, ingredients->inits).release(),
+		ingredients->inits,
 		ingredients->frame_size,
 		ingredients->priority);
 
@@ -4332,7 +4242,7 @@ IntrusivePtr<Val> LambdaExpr::Eval(Frame* f) const
 	// Allows for lookups by the receiver.
 	lamb->SetName(my_name.c_str());
 
-	return make_intrusive<Val>(lamb.get());
+	return make_intrusive<Val>(std::move(lamb));
 	}
 
 void LambdaExpr::ExprDescribe(ODesc* d) const
@@ -4374,7 +4284,8 @@ EventExpr::EventExpr(const char* arg_name, IntrusivePtr<ListExpr> arg_args)
 		return;
 		}
 
-	FuncType* func_type = h->FType();
+	const auto& func_type = h->GetType();
+
 	if ( ! func_type )
 		{
 		Error("not an event");
@@ -4386,7 +4297,7 @@ EventExpr::EventExpr(const char* arg_name, IntrusivePtr<ListExpr> arg_args)
 		SetError("argument type mismatch in event invocation");
 	else
 		{
-		if ( func_type->YieldType() )
+		if ( func_type->Yield() )
 			{
 			Error("function invoked as an event");
 			SetError();
@@ -4452,7 +4363,7 @@ ListExpr::~ListExpr()
 void ListExpr::Append(IntrusivePtr<Expr> e)
 	{
 	exprs.push_back(e.release());
-	((TypeList*) type.get())->Append({NewRef{}, exprs.back()->Type()});
+	((TypeList*) type.get())->Append(exprs.back()->GetType());
 	}
 
 bool ListExpr::IsPure() const
@@ -4478,7 +4389,7 @@ IntrusivePtr<Val> ListExpr::Eval(Frame* f) const
 			return nullptr;
 			}
 
-		v->Append(ev.release());
+		v->Append(std::move(ev));
 		}
 
 	return v;
@@ -4519,23 +4430,23 @@ IntrusivePtr<BroType> ListExpr::InitType() const
 
 		for ( const auto& e : exprs )
 			{
-			BroType* ti = e->Type();
+			const auto& ti = e->GetType();
 
 			// Collapse any embedded sets or lists.
 			if ( ti->IsSet() || ti->Tag() == TYPE_LIST )
 				{
 				TypeList* til = ti->IsSet() ?
-					ti->AsSetType()->Indices() :
+					ti->AsSetType()->GetIndices().get() :
 					ti->AsTypeList();
 
 				if ( ! til->IsPure() ||
-				     ! til->AllMatch(til->PureType(), true) )
+				     ! til->AllMatch(til->GetPureType(), true) )
 					tl->Append({NewRef{}, til});
 				else
-					tl->Append({NewRef{}, til->PureType()});
+					tl->Append(til->GetPureType());
 				}
 			else
-				tl->Append({NewRef{}, ti});
+				tl->Append(ti);
 			}
 
 		return tl;
@@ -4556,9 +4467,9 @@ IntrusivePtr<Val> ListExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr) co
 	if ( ! aggr && type->AsTypeList()->AllMatch(t, true) )
 		{
 		auto v = make_intrusive<ListVal>(TYPE_ANY);
-		const type_list* tl = type->AsTypeList()->Types();
+		const auto& tl = type->AsTypeList()->Types();
 
-		if ( exprs.length() != tl->length() )
+		if ( exprs.length() != static_cast<int>(tl.size()) )
 			{
 			Error("index mismatch", t);
 			return nullptr;
@@ -4566,11 +4477,11 @@ IntrusivePtr<Val> ListExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr) co
 
 		loop_over_list(exprs, i)
 			{
-			auto vi = exprs[i]->InitVal((*tl)[i], nullptr);
+			auto vi = exprs[i]->InitVal(tl[i].get(), nullptr);
 			if ( ! vi )
 				return nullptr;
 
-			v->Append(vi.release());
+			v->Append(std::move(vi));
 			}
 
 		return v;
@@ -4584,9 +4495,9 @@ IntrusivePtr<Val> ListExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr) co
 			return nullptr;
 			}
 
-		const type_list* tl = t->AsTypeList()->Types();
+		const auto& tl = t->AsTypeList()->Types();
 
-		if ( exprs.length() != tl->length() )
+		if ( exprs.length() != static_cast<int>(tl.size()) )
 			{
 			Error("index mismatch", t);
 			return nullptr;
@@ -4596,12 +4507,12 @@ IntrusivePtr<Val> ListExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr) co
 
 		loop_over_list(exprs, i)
 			{
-			auto vi = exprs[i]->InitVal((*tl)[i], nullptr);
+			auto vi = exprs[i]->InitVal(tl[i].get(), nullptr);
 
 			if ( ! vi )
 				return nullptr;
 
-			v->Append(vi.release());
+			v->Append(std::move(vi));
 			}
 
 		return v;
@@ -4634,7 +4545,8 @@ IntrusivePtr<Val> ListExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr) co
 		loop_over_list(exprs, i)
 			{
 			Expr* e = exprs[i];
-			auto promoted_e = check_and_promote_expr(e, vec->Type()->AsVectorType()->YieldType());
+			const auto& vyt = vec->GetType()->AsVectorType()->Yield();
+			auto promoted_e = check_and_promote_expr(e, vyt.get());
 
 			if ( promoted_e )
 				e = promoted_e.get();
@@ -4671,9 +4583,9 @@ IntrusivePtr<Val> ListExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr) co
 
 			auto v = e->Eval(nullptr);
 
-			if ( ! same_type(v->Type(), t) )
+			if ( ! same_type(v->GetType(), t) )
 				{
-				v->Type()->Error("type clash in table initializer", t);
+				v->GetType()->Error("type clash in table initializer", t);
 				return nullptr;
 				}
 
@@ -4687,31 +4599,31 @@ IntrusivePtr<Val> ListExpr::InitVal(const BroType* t, IntrusivePtr<Val> aggr) co
 
 IntrusivePtr<Val> ListExpr::AddSetInit(const BroType* t, IntrusivePtr<Val> aggr) const
 	{
-	if ( aggr->Type()->Tag() != TYPE_TABLE )
+	if ( aggr->GetType()->Tag() != TYPE_TABLE )
 		Internal("bad aggregate in ListExpr::InitVal");
 
 	TableVal* tv = aggr->AsTableVal();
-	const TableType* tt = tv->Type()->AsTableType();
-	const TypeList* it = tt->Indices();
+	const TableType* tt = tv->GetType()->AsTableType();
+	const TypeList* it = tt->GetIndices().get();
 
 	for ( const auto& expr : exprs )
 		{
 		IntrusivePtr<Val> element;
 
-		if ( expr->Type()->IsSet() )
+		if ( expr->GetType()->IsSet() )
 			// A set to flatten.
 			element = expr->Eval(nullptr);
-		else if ( expr->Type()->Tag() == TYPE_LIST )
+		else if ( expr->GetType()->Tag() == TYPE_LIST )
 			element = expr->InitVal(it, nullptr);
 		else
-			element = expr->InitVal((*it->Types())[0], nullptr);
+			element = expr->InitVal(it->Types()[0].get(), nullptr);
 
 		if ( ! element )
 			return nullptr;
 
-		if ( element->Type()->IsSet() )
+		if ( element->GetType()->IsSet() )
 			{
-			if ( ! same_type(element->Type(), t) )
+			if ( ! same_type(element->GetType(), t) )
 				{
 				element->Error("type clash in set initializer", t);
 				return nullptr;
@@ -4723,10 +4635,10 @@ IntrusivePtr<Val> ListExpr::AddSetInit(const BroType* t, IntrusivePtr<Val> aggr)
 			continue;
 			}
 
-		if ( expr->Type()->Tag() == TYPE_LIST )
+		if ( expr->GetType()->Tag() == TYPE_LIST )
 			element = check_and_promote(std::move(element), it, true);
 		else
-			element = check_and_promote(std::move(element), (*it->Types())[0], true);
+			element = check_and_promote(std::move(element), it->Types()[0].get(), true);
 
 		if ( ! element )
 			return nullptr;
@@ -4764,11 +4676,11 @@ void ListExpr::Assign(Frame* f, IntrusivePtr<Val> v)
 	{
 	ListVal* lv = v->AsListVal();
 
-	if ( exprs.length() != lv->Vals()->length() )
+	if ( exprs.length() != lv->Length() )
 		RuntimeError("mismatch in list lengths");
 
 	loop_over_list(exprs, i)
-		exprs[i]->Assign(f, {NewRef{}, (*lv->Vals())[i]});
+		exprs[i]->Assign(f, lv->Idx(i));
 	}
 
 TraversalCode ListExpr::Traverse(TraversalCallback* cb) const
@@ -4791,7 +4703,7 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 	{
 	const expr_list& inits = init_list->AsListExpr()->Exprs();
 
-	RecordType* lhs = record->Type()->AsRecordType();
+	RecordType* lhs = record->GetType()->AsRecordType();
 
 	// The inits have two forms:
 	// 1) other records -- use all matching field names+types
@@ -4800,9 +4712,9 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 
 	for ( const auto& init : inits )
 		{
-		if ( init->Type()->Tag() == TYPE_RECORD )
+		if ( init->GetType()->Tag() == TYPE_RECORD )
 			{
-			RecordType* t = init->Type()->AsRecordType();
+			RecordType* t = init->GetType()->AsRecordType();
 
 			for ( int j = 0; j < t->NumFields(); ++j )
 				{
@@ -4810,7 +4722,7 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 				int field = lhs->FieldOffset(field_name);
 
 				if ( field >= 0 &&
-				     same_type(lhs->FieldType(field), t->FieldType(j)) )
+				     same_type(lhs->GetFieldType(field), t->GetFieldType(j)) )
 					{
 					auto fe_lhs = make_intrusive<FieldExpr>(record, field_name);
 					auto fe_rhs = make_intrusive<FieldExpr>(IntrusivePtr{NewRef{}, init}, field_name);
@@ -4851,11 +4763,11 @@ RecordAssignExpr::RecordAssignExpr(const IntrusivePtr<Expr>& record,
 CastExpr::CastExpr(IntrusivePtr<Expr> arg_op, IntrusivePtr<BroType> t)
 	: UnaryExpr(EXPR_CAST, std::move(arg_op))
 	{
-	auto stype = Op()->Type();
+	auto stype = Op()->GetType();
 
 	SetType(std::move(t));
 
-	if ( ! can_cast_value_to_type(stype, Type()) )
+	if ( ! can_cast_value_to_type(stype.get(), GetType().get()) )
 		ExprError("cast not supported");
 	}
 
@@ -4869,20 +4781,20 @@ IntrusivePtr<Val> CastExpr::Eval(Frame* f) const
 	if ( ! v )
 		return nullptr;
 
-	auto nv = cast_value_to_type(v.get(), Type());
+	auto nv = cast_value_to_type(v.get(), GetType().get());
 
 	if ( nv )
 		return nv;
 
 	ODesc d;
 	d.Add("invalid cast of value with type '");
-	v->Type()->Describe(&d);
+	v->GetType()->Describe(&d);
 	d.Add("' to type '");
-	Type()->Describe(&d);
+	GetType()->Describe(&d);
 	d.Add("'");
 
-	if ( same_type(v->Type(), bro_broker::DataVal::ScriptDataType()) &&
-		 ! v->AsRecordVal()->Lookup(0) )
+	if ( same_type(v->GetType(), bro_broker::DataVal::ScriptDataType()) &&
+		 ! v->AsRecordVal()->GetField(0) )
 		d.Add(" (nil $data field)");
 
 	RuntimeError(d.Description());
@@ -4893,7 +4805,7 @@ void CastExpr::ExprDescribe(ODesc* d) const
 	{
 	Op()->Describe(d);
 	d->Add(" as ");
-	Type()->Describe(d);
+	GetType()->Describe(d);
 	}
 
 IsExpr::IsExpr(IntrusivePtr<Expr> arg_op, IntrusivePtr<BroType> arg_t)
@@ -4920,8 +4832,8 @@ void IsExpr::ExprDescribe(ODesc* d) const
 IntrusivePtr<Expr> get_assign_expr(IntrusivePtr<Expr> op1,
                                    IntrusivePtr<Expr> op2, bool is_init)
 	{
-	if ( op1->Type()->Tag() == TYPE_RECORD &&
-	     op2->Type()->Tag() == TYPE_LIST )
+	if ( op1->GetType()->Tag() == TYPE_RECORD &&
+	     op2->GetType()->Tag() == TYPE_LIST )
 		return make_intrusive<RecordAssignExpr>(std::move(op1), std::move(op2),
 		                                        is_init);
 
@@ -4936,7 +4848,7 @@ IntrusivePtr<Expr> get_assign_expr(IntrusivePtr<Expr> op1,
 
 IntrusivePtr<Expr> check_and_promote_expr(Expr* const e, BroType* t)
 	{
-	BroType* et = e->Type();
+	const auto& et = e->GetType();
 	TypeTag e_tag = et->Tag();
 	TypeTag t_tag = t->Tag();
 
@@ -5014,12 +4926,12 @@ IntrusivePtr<Expr> check_and_promote_expr(Expr* const e, BroType* t)
 bool check_and_promote_exprs(ListExpr* const elements, TypeList* types)
 	{
 	expr_list& el = elements->Exprs();
-	const type_list* tl = types->Types();
+	const auto& tl = types->Types();
 
-	if ( tl->length() == 1 && (*tl)[0]->Tag() == TYPE_ANY )
+	if ( tl.size() == 1 && tl[0]->Tag() == TYPE_ANY )
 		return true;
 
-	if ( el.length() != tl->length() )
+	if ( el.length() != static_cast<int>(tl.size()) )
 		{
 		types->Error("indexing mismatch", elements);
 		return false;
@@ -5028,11 +4940,11 @@ bool check_and_promote_exprs(ListExpr* const elements, TypeList* types)
 	loop_over_list(el, i)
 		{
 		Expr* e = el[i];
-		auto promoted_e = check_and_promote_expr(e, (*tl)[i]);
+		auto promoted_e = check_and_promote_expr(e, tl[i].get());
 
 		if ( ! promoted_e )
 			{
-			e->Error("type mismatch", (*tl)[i]);
+			e->Error("type mismatch", tl[i].get());
 			return false;
 			}
 
@@ -5064,7 +4976,7 @@ bool check_and_promote_args(ListExpr* const args, RecordType* types)
 		for ( int i = ntypes - 1; i >= el.length(); --i )
 			{
 			TypeDecl* td = types->FieldDecl(i);
-			Attr* def_attr = td->attrs ? td->attrs->FindAttr(ATTR_DEFAULT) : nullptr;
+			const auto& def_attr = td->attrs ? td->attrs->Find(ATTR_DEFAULT).get() : nullptr;
 
 			if ( ! def_attr )
 				{
@@ -5072,7 +4984,7 @@ bool check_and_promote_args(ListExpr* const args, RecordType* types)
 				return false;
 				}
 
-			def_elements.push_front(def_attr->AttrExpr());
+			def_elements.push_front(def_attr->GetExpr().get());
 			}
 
 		for ( const auto& elem : def_elements )
@@ -5082,7 +4994,7 @@ bool check_and_promote_args(ListExpr* const args, RecordType* types)
 	TypeList* tl = new TypeList();
 
 	for ( int i = 0; i < types->NumFields(); ++i )
-		tl->Append({NewRef{}, types->FieldType(i)});
+		tl->Append(types->GetFieldType(i));
 
 	int rval = check_and_promote_exprs(args, tl);
 	Unref(tl);
diff --git a/src/Expr.h b/src/Expr.h
index e540d45b2d..cd09920522 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -50,7 +50,6 @@ enum BroExprTag : int {
 	EXPR_TABLE_COERCE,
 	EXPR_VECTOR_COERCE,
 	EXPR_SIZE,
-	EXPR_FLATTEN,
 	EXPR_CAST,
 	EXPR_IS,
 	EXPR_INDEX_SLICE_ASSIGN,
@@ -75,7 +74,16 @@ struct function_ingredients;
 
 class Expr : public BroObj {
 public:
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	BroType* Type() const		{ return type.get(); }
+
+	const IntrusivePtr<BroType>& GetType() const
+		{ return type; }
+
+	template <class T>
+	IntrusivePtr<T> GetType() const
+		{ return cast_intrusive<T>(type); }
+
 	BroExprTag Tag() const	{ return tag; }
 
 	Expr* Ref()			{ ::Ref(this); return this; }
@@ -511,7 +519,8 @@ public:
 	// If val is given, evaluating this expression will always yield the val
 	// yet still perform the assignment.  Used for triggers.
 	AssignExpr(IntrusivePtr<Expr> op1, IntrusivePtr<Expr> op2, bool is_init,
-	           IntrusivePtr<Val> val = nullptr, attr_list* attrs = nullptr);
+	           IntrusivePtr<Val> val = nullptr,
+	           const IntrusivePtr<Attributes>& attrs = nullptr);
 
 	IntrusivePtr<Val> Eval(Frame* f) const override;
 	void EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const override;
@@ -521,7 +530,7 @@ public:
 	bool IsPure() const override;
 
 protected:
-	bool TypeCheck(attr_list* attrs = nullptr);
+	bool TypeCheck(const IntrusivePtr<Attributes>& attrs = nullptr);
 	bool TypeCheckArithmetics(TypeTag bt1, TypeTag bt2);
 
 	bool is_init;
@@ -622,11 +631,15 @@ protected:
 
 class TableConstructorExpr final : public UnaryExpr {
 public:
-	TableConstructorExpr(IntrusivePtr<ListExpr> constructor_list, attr_list* attrs,
+	TableConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
+	                     std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs,
 	                     IntrusivePtr<BroType> arg_type = nullptr);
-	~TableConstructorExpr() override { Unref(attrs); }
 
-	Attributes* Attrs() { return attrs; }
+	[[deprecated("Remove in v4.1.  Use GetAttrs().")]]
+	Attributes* Attrs() { return attrs.get(); }
+
+	const IntrusivePtr<Attributes>& GetAttrs() const
+		{ return attrs; }
 
 	IntrusivePtr<Val> Eval(Frame* f) const override;
 
@@ -635,16 +648,20 @@ protected:
 
 	void ExprDescribe(ODesc* d) const override;
 
-	Attributes* attrs;
+	IntrusivePtr<Attributes> attrs;
 };
 
 class SetConstructorExpr final : public UnaryExpr {
 public:
-	SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list, attr_list* attrs,
+	SetConstructorExpr(IntrusivePtr<ListExpr> constructor_list,
+	                   std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs,
 	                   IntrusivePtr<BroType> arg_type = nullptr);
-	~SetConstructorExpr() override { Unref(attrs); }
 
-	Attributes* Attrs() { return attrs; }
+	[[deprecated("Remove in v4.1.  Use GetAttrs().")]]
+	Attributes* Attrs() { return attrs.get(); }
+
+	const IntrusivePtr<Attributes>& GetAttrs() const
+		{ return attrs; }
 
 	IntrusivePtr<Val> Eval(Frame* f) const override;
 
@@ -653,7 +670,7 @@ protected:
 
 	void ExprDescribe(ODesc* d) const override;
 
-	Attributes* attrs;
+	IntrusivePtr<Attributes> attrs;
 };
 
 class VectorConstructorExpr final : public UnaryExpr {
@@ -726,18 +743,6 @@ protected:
 	IntrusivePtr<Val> Fold(Val* v) const override;
 };
 
-// An internal operator for flattening array indices that are records
-// into a list of individual values.
-class FlattenExpr final : public UnaryExpr {
-public:
-	explicit FlattenExpr(IntrusivePtr<Expr> op);
-
-protected:
-	IntrusivePtr<Val> Fold(Val* v) const override;
-
-	int num_fields;
-};
-
 class ScheduleTimer final : public Timer {
 public:
 	ScheduleTimer(const EventHandlerPtr& event, zeek::Args args, double t);
@@ -945,5 +950,6 @@ std::optional<std::vector<IntrusivePtr<Val>>> eval_list(Frame* f, const ListExpr
 // a canonical form.
 extern bool expr_greater(const Expr* e1, const Expr* e2);
 
-// True if the given Val* has a vector type
-inline bool is_vector(Expr* e)	{ return e->Type()->Tag() == TYPE_VECTOR; }
+// True if the given Expr* has a vector type
+inline bool is_vector(Expr* e)	{ return e->GetType()->Tag() == TYPE_VECTOR; }
+inline bool is_vector(const IntrusivePtr<Expr>& e)	{ return is_vector(e.get()); }
diff --git a/src/File.cc b/src/File.cc
index 7581b9fb3b..a496df5034 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -29,6 +29,7 @@
 #include "Event.h"
 #include "Reporter.h"
 #include "Desc.h"
+#include "Var.h"
 
 std::list<std::pair<std::string, BroFile*>> BroFile::open_files;
 
@@ -264,7 +265,7 @@ void BroFile::SetAttrs(Attributes* arg_attrs)
 	attrs = arg_attrs;
 	Ref(attrs);
 
-	if ( attrs->FindAttr(ATTR_RAW_OUTPUT) )
+	if ( attrs->Find(ATTR_RAW_OUTPUT) )
 		EnableRawOutput();
 	}
 
@@ -277,6 +278,7 @@ RecordVal* BroFile::Rotate()
 	if ( f == stdin || f == stdout || f == stderr )
 		return nullptr;
 
+	static auto rotate_info = zeek::id::find_type<RecordType>("rotate_info");
 	RecordVal* info = new RecordVal(rotate_info);
 	FILE* newf = rotate_file(name, info);
 
@@ -326,8 +328,8 @@ void BroFile::RaiseOpenEvent()
 	if ( ! ::file_opened )
 		return;
 
-	Ref(this);
-	Event* event = new ::Event(::file_opened, {make_intrusive<Val>(this)});
+	IntrusivePtr<BroFile> bf{NewRef{}, this};
+	Event* event = new ::Event(::file_opened, {make_intrusive<Val>(std::move(bf))});
 	mgr.Dispatch(event, true);
 	}
 
@@ -344,16 +346,11 @@ double BroFile::Size()
 	return s.st_size;
 	}
 
-BroFile* BroFile::GetFile(const char* name)
+IntrusivePtr<BroFile> BroFile::Get(const char* name)
 	{
 	for ( const auto &el : open_files )
-		{
 		if ( el.first == name )
-			{
-			Ref(el.second);
-			return el.second;
-			}
-		}
+			return {NewRef{}, el.second};
 
-	return new BroFile(name, "w");
+	return make_intrusive<BroFile>(name, "w");
 	}
diff --git a/src/File.h b/src/File.h
index 01409ff742..edf0b7d0f4 100644
--- a/src/File.h
+++ b/src/File.h
@@ -37,8 +37,12 @@ public:
 
 	void SetBuf(bool buffered);	// false=line buffered, true=fully buffered
 
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	BroType* FType() const	{ return t.get(); }
 
+	const IntrusivePtr<BroType>& GetType() const
+		{ return t; }
+
 	// Whether the file is open in a general sense; it might
 	// not be open as a Unix file due to our management of
 	// a finite number of FDs.
@@ -63,7 +67,10 @@ public:
 	static void CloseOpenFiles();
 
 	// Get the file with the given name, opening it if it doesn't yet exist.
-	static BroFile* GetFile(const char* name);
+	static IntrusivePtr<BroFile> Get(const char* name);
+	[[deprecated("Remove in v4.1.  Use BroFile::Get().")]]
+	static BroFile* GetFile(const char* name)
+		{ return Get(name).release(); }
 
 	void EnableRawOutput()		{ raw_output = true; }
 	bool IsRawOutput() const	{ return raw_output; }
diff --git a/src/Frame.cc b/src/Frame.cc
index 9a7fa733d6..7c1470d2dc 100644
--- a/src/Frame.cc
+++ b/src/Frame.cc
@@ -17,7 +17,7 @@ std::vector<Frame*> g_frame_stack;
 Frame::Frame(int arg_size, const BroFunc* func, const zeek::Args* fn_args)
 	{
 	size = arg_size;
-	frame = new Val*[size];
+	frame = std::make_unique<Element[]>(size);
 	function = func;
 	func_args = fn_args;
 
@@ -29,9 +29,6 @@ Frame::Frame(int arg_size, const BroFunc* func, const zeek::Args* fn_args)
 	delayed = false;
 
 	closure = nullptr;
-
-	for (int i = 0; i < size; ++i)
-		frame[i] = nullptr;
 	}
 
 Frame::~Frame()
@@ -51,9 +48,8 @@ Frame::~Frame()
 	for ( auto& i : outer_ids )
 		Unref(i);
 
-	Release();
-
-	delete [] weak_refs;
+	for ( int i = 0; i < size; ++i )
+		ClearElement(i);
 	}
 
 void Frame::AddFunctionWithClosureRef(BroFunc* func)
@@ -66,37 +62,28 @@ void Frame::AddFunctionWithClosureRef(BroFunc* func)
 	functions_with_closure_frame_reference->emplace_back(func);
 	}
 
-void Frame::SetElement(int n, Val* v, bool weak_ref)
+void Frame::SetElement(int n, Val* v)
+	{ SetElement(n, {AdoptRef{}, v}); }
+
+void Frame::SetElement(int n, IntrusivePtr<Val> v)
 	{
-	UnrefElement(n);
-	frame[n] = v;
-
-	if ( weak_ref )
-		{
-		if ( ! weak_refs )
-			{
-			weak_refs = new bool[size];
-
-			for ( auto i = 0; i < size; ++i )
-				weak_refs[i] = false;
-			}
-
-		weak_refs[n] = true;
-		}
-	else
-		{
-		if ( weak_refs )
-			weak_refs[n] = false;
-		}
+	ClearElement(n);
+	frame[n] = {std::move(v), false};
 	}
 
-void Frame::SetElement(const ID* id, Val* v)
+void Frame::SetElementWeak(int n, Val* v)
+	{
+	ClearElement(n);
+	frame[n] = {{AdoptRef{}, v}, true};
+	}
+
+void Frame::SetElement(const ID* id, IntrusivePtr<Val> v)
 	{
 	if ( closure )
 		{
 		if ( IsOuterID(id) )
 			{
-			closure->SetElement(id, v);
+			closure->SetElement(id, std::move(v));
 			return;
 			}
 		}
@@ -112,19 +99,19 @@ void Frame::SetElement(const ID* id, Val* v)
 			// id->Offset() below is otherwise responsible for keeping track
 			// of the implied reference count of the passed-in 'v' argument.
 			// i.e. if we end up storing it twice, we need an addition Ref.
-			SetElement(where->second, v->Ref());
+			SetElement(where->second, v);
 			}
 		}
 
-	SetElement(id->Offset(), v);
+	SetElement(id->Offset(), std::move(v));
 	}
 
-Val* Frame::GetElement(const ID* id) const
+const IntrusivePtr<Val>& Frame::GetElementByID(const ID* id) const
 	{
 	if ( closure )
 		{
 		if ( IsOuterID(id) )
-			return closure->GetElement(id);
+			return closure->GetElementByID(id);
 		}
 
 	// do we have an offset for it?
@@ -132,27 +119,16 @@ Val* Frame::GetElement(const ID* id) const
 		{
 		auto where = offset_map->find(std::string(id->Name()));
 		if ( where != offset_map->end() )
-			return frame[where->second];
+			return frame[where->second].val;
 		}
 
-	return frame[id->Offset()];
+	return frame[id->Offset()].val;
 	}
 
 void Frame::Reset(int startIdx)
 	{
 	for ( int i = startIdx; i < size; ++i )
-		{
-		UnrefElement(i);
-		frame[i] = nullptr;
-		}
-	}
-
-void Frame::Release()
-	{
-	for ( int i = 0; i < size; ++i )
-		UnrefElement(i);
-
-	delete [] frame;
+		ClearElement(i);
 	}
 
 void Frame::Describe(ODesc* d) const
@@ -166,14 +142,14 @@ void Frame::Describe(ODesc* d) const
 
 		for ( int i = 0; i < size; ++i )
 			 {
-			 d->Add(frame[i] != nullptr);
+			 d->Add(frame[i].val != nullptr);
 			 d->SP();
 			 }
 		}
 
 	for ( int i = 0; i < size; ++i )
-		if ( frame[i] )
-			frame[i]->Describe(d);
+		if ( frame[i].val )
+			frame[i].val->Describe(d);
 		else if ( d->IsReadable() )
 			d->Add("<nil>");
 	}
@@ -190,36 +166,36 @@ Frame* Frame::Clone() const
 	other->call = call;
 	other->trigger = trigger;
 
-	for (int i = 0; i < size; i++)
-		other->frame[i] = frame[i] ? frame[i]->Clone().release() : nullptr;
+	for ( int i = 0; i < size; i++ )
+		if ( frame[i].val )
+			other->frame[i].val = frame[i].val->Clone();
 
 	return other;
 	}
 
-static bool val_is_func(Val* v, BroFunc* func)
+static bool val_is_func(const IntrusivePtr<Val>& v, BroFunc* func)
 	{
-	if ( v->Type()->Tag() != TYPE_FUNC )
+	if ( v->GetType()->Tag() != TYPE_FUNC )
 		return false;
 
 	return v->AsFunc() == func;
 	}
 
-static void clone_if_not_func(Val** frame, int offset, BroFunc* func,
-                              Frame* other)
+void Frame::CloneNonFuncElement(int offset, BroFunc* func, Frame* other) const
 	{
-	auto v = frame[offset];
+	const auto& v = frame[offset].val;
 
 	if ( ! v )
 		return;
 
 	if ( val_is_func(v, func) )
 		{
-		other->SetElement(offset, v, true);
+		other->SetElementWeak(offset, v.get());
 		return;
 		}
 
 	auto rval = v->Clone();
-	other->SetElement(offset, rval.release());
+	other->SetElement(offset, std::move(rval));
 	}
 
 Frame* Frame::SelectiveClone(const id_list& selection, BroFunc* func) const
@@ -248,15 +224,15 @@ Frame* Frame::SelectiveClone(const id_list& selection, BroFunc* func) const
 			auto where = offset_map->find(std::string(id->Name()));
 			if ( where != offset_map->end() )
 				{
-				clone_if_not_func(frame, where->second, func, other);
+				CloneNonFuncElement(where->second, func, other);
 				continue;
 				}
 			}
 
-		if ( ! frame[id->Offset()] )
+		if ( ! frame[id->Offset()].val )
 			reporter->InternalError("Attempted to clone an id ('%s') with no associated value.", id->Name());
 
-		clone_if_not_func(frame, id->Offset(), func, other);
+		CloneNonFuncElement(id->Offset(), func, other);
 		}
 
 	/**
@@ -355,11 +331,11 @@ broker::expected<broker::data> Frame::Serialize(const Frame* target, const id_li
 		if (where != new_map.end())
 			location = where->second;
 
-		Val* val = target->frame[location];
+		const auto& val = target->frame[location].val;
 
-		TypeTag tag = val->Type()->Tag();
+		TypeTag tag = val->GetType()->Tag();
 
-		auto expected = bro_broker::val_to_data(val);
+		auto expected = bro_broker::val_to_data(val.get());
 		if ( ! expected )
 			return broker::ec::invalid_data;
 
@@ -490,7 +466,7 @@ std::pair<bool, IntrusivePtr<Frame>> Frame::Unserialize(const broker::vector& da
 		if ( ! val )
 			return std::make_pair(false, nullptr);
 
-		rf->frame[i] = val.release();
+		rf->frame[i].val = std::move(val);
 		}
 
 	return std::make_pair(true, std::move(rf));
@@ -539,12 +515,12 @@ void Frame::ClearTrigger()
 	trigger = nullptr;
 	}
 
-void Frame::UnrefElement(int n)
+void Frame::ClearElement(int n)
 	{
-	if ( weak_refs && weak_refs[n] )
-		return;
-
-	Unref(frame[n]);
+	if ( frame[n].weak_ref )
+		frame[n].val.release();
+	else
+		frame[n] = {nullptr, false};
 	}
 
 bool Frame::IsOuterID(const ID* in) const
diff --git a/src/Frame.h b/src/Frame.h
index 8716022d6e..a85254469c 100644
--- a/src/Frame.h
+++ b/src/Frame.h
@@ -11,6 +11,7 @@
 #include <string>
 #include <utility>
 #include <vector>
+#include <memory>
 
 #include <broker/data.hh>
 #include <broker/expected.hh>
@@ -41,19 +42,21 @@ public:
 	 * @param n the index to get.
 	 * @return the value at index *n* of the underlying array.
 	 */
-	Val* NthElement(int n) const	{ return frame[n]; }
+	const IntrusivePtr<Val>& GetElement(int n) const
+		{ return frame[n].val; }
+
+	[[deprecated("Remove in v4.1.  Use GetElement(int).")]]
+	Val* NthElement(int n) const	{ return frame[n].val.get(); }
 
 	/**
-	 * Sets the element at index *n* of the underlying array
-	 * to *v*.
-	 *
+	 * Sets the element at index *n* of the underlying array to *v*.
 	 * @param n the index to set
 	 * @param v the value to set it to
-	 * @param weak_ref whether the frame owns the value and should unref
-	 * it upon destruction.  Used to break circular references between
-	 * lambda functions and closure frames.
 	 */
-	void SetElement(int n, Val* v, bool weak_ref = false);
+	void SetElement(int n, IntrusivePtr<Val> v);
+
+	[[deprecated("Remove in v4.1.  Pass IntrusivePtr instead.")]]
+	void SetElement(int n, Val* v);
 
 	/**
 	 * Associates *id* and *v* in the frame. Future lookups of
@@ -62,7 +65,9 @@ public:
 	 * @param id the ID to associate
 	 * @param v the value to associate it with
 	 */
-	void SetElement(const ID* id, Val* v);
+	void SetElement(const ID* id, IntrusivePtr<Val> v);
+	void SetElement(const IntrusivePtr<ID>& id, IntrusivePtr<Val> v)
+		{ SetElement(id.get(), std::move(v)); }
 
 	/**
 	 * Gets the value associated with *id* and returns it. Returns
@@ -71,22 +76,20 @@ public:
 	 * @param id the id who's value to retreive
 	 * @return the value associated with *id*
 	 */
-	Val* GetElement(const ID* id) const;
+	const IntrusivePtr<Val>& GetElementByID(const IntrusivePtr<ID>& id) const
+		{ return GetElementByID(id.get()); }
+
+	[[deprecated("Remove in v4.1.  Use GetElementByID().")]]
+	Val* GetElement(const ID* id) const
+		{ return GetElementByID(id).get(); }
 
 	/**
 	 * Resets all of the indexes from [*startIdx, frame_size) in
-	 * the Frame. Unrefs all of the values in reset indexes.
-	 *
+	 * the Frame.
 	 * @param the first index to unref.
 	 */
 	void Reset(int startIdx);
 
-	/**
-	 * Resets all of the values in the frame and clears out the
-	 * underlying array.
-	 */
-	void Release();
-
 	/**
 	 * Describes the frame and all of its values.
 	 */
@@ -236,10 +239,37 @@ private:
 
 	using OffsetMap = std::unordered_map<std::string, int>;
 
+	struct Element {
+		IntrusivePtr<Val> val;
+		// Weak reference is used to prevent circular reference memory leaks
+		// in lambdas/closures.
+		bool weak_ref;
+	};
+
+	const IntrusivePtr<Val>& GetElementByID(const ID* id) const;
+
 	/**
-	 * Unrefs the value at offset 'n' frame unless it's a weak reference.
+	 * Sets the element at index *n* of the underlying array to *v*, but does
+	 * not take ownership of a reference count to it.  This method is used to
+	 * break circular references between lambda functions and closure frames.
+	 * @param n the index to set
+	 * @param v the value to set it to (caller has not Ref'd and Frame will
+	 * not Unref it)
 	 */
-	void UnrefElement(int n);
+	void SetElementWeak(int n, Val* v);
+
+	/**
+	 * Clone an element at an offset into other frame if not equal to a given
+	 * function (in that case just assigna weak reference).  Used to break
+	 * circular references between lambda functions and closure frames.
+	 */
+	void CloneNonFuncElement(int offset, BroFunc* func, Frame* other) const;
+
+	/**
+	 * Resets the value at offset 'n' frame (by decrementing reference
+	 * count if not a weak reference).
+	 */
+	void ClearElement(int n);
 
 	/** Have we captured this id? */
 	bool IsOuterID(const ID* in) const;
@@ -269,11 +299,7 @@ private:
 	bool delayed;
 
 	/** Associates ID's offsets with values. */
-	Val** frame;
-
-	/** Values that are weakly referenced by the frame.  Used to
-	 * prevent circular reference memory leaks in lambda/closures */
-	bool* weak_refs = nullptr;
+	std::unique_ptr<Element[]> frame;
 
 	/** The enclosing frame of this frame. */
 	Frame* closure;
diff --git a/src/Func.cc b/src/Func.cc
index cc8e0b92f3..f0cb8e693a 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -59,8 +59,7 @@ extern	RETSIGTYPE sig_handler(int signo);
 std::vector<CallInfo> call_stack;
 bool did_builtin_init = false;
 
-std::vector<Func*> Func::unique_ids;
-static const std::pair<bool, Val*> empty_hook_result(false, NULL);
+static const std::pair<bool, IntrusivePtr<Val>> empty_hook_result(false, nullptr);
 
 std::string render_call_stack()
 	{
@@ -111,19 +110,20 @@ std::string render_call_stack()
 Func::Func()
 	{
 	unique_id = unique_ids.size();
-	unique_ids.push_back(this);
+	unique_ids.push_back({NewRef{}, this});
 	}
 
 Func::Func(Kind arg_kind) : kind(arg_kind)
 	{
 	unique_id = unique_ids.size();
-	unique_ids.push_back(this);
+	unique_ids.push_back({NewRef{}, this});
 	}
 
 Func::~Func() = default;
 
-void Func::AddBody(IntrusivePtr<Stmt> /* new_body */, id_list* /* new_inits */,
-		   size_t /* new_frame_size */, int /* priority */)
+void Func::AddBody(IntrusivePtr<Stmt> /* new_body */,
+                   const std::vector<IntrusivePtr<ID>>& /* new_inits */,
+                   size_t /* new_frame_size */, int /* priority */)
 	{
 	Internal("Func::AddBody called");
 	}
@@ -147,7 +147,7 @@ void Func::DescribeDebug(ODesc* d, const zeek::Args* args) const
 	if ( args )
 		{
 		d->Add("(");
-		RecordType* func_args = FType()->Args();
+		const auto& func_args = GetType()->Params();
 		auto num_fields = static_cast<size_t>(func_args->NumFields());
 
 		for ( auto i = 0u; i < args->size(); ++i )
@@ -215,63 +215,66 @@ void Func::CopyStateInto(Func* other) const
 	other->unique_id = unique_id;
 	}
 
-std::pair<bool, Val*> Func::HandlePluginResult(std::pair<bool, Val*> plugin_result, function_flavor flavor) const
+void Func::CheckPluginResult(bool handled, const IntrusivePtr<Val>& hook_result,
+                             function_flavor flavor) const
 	{
 	// Helper function factoring out this code from BroFunc:Call() for
 	// better readability.
 
-	if( ! plugin_result.first )
+	if ( ! handled )
 		{
-		if( plugin_result.second )
+		if ( hook_result )
 			reporter->InternalError("plugin set processed flag to false but actually returned a value");
 
 		// The plugin result hasn't been processed yet (read: fall
 		// into ::Call method).
-		return plugin_result;
+		return;
 		}
 
 	switch ( flavor ) {
 	case FUNC_FLAVOR_EVENT:
-		if( plugin_result.second )
-			reporter->InternalError("plugin returned non-void result for event %s", this->Name());
+		if ( hook_result )
+			reporter->InternalError("plugin returned non-void result for event %s",
+			                        this->Name());
 
 		break;
 
 	case FUNC_FLAVOR_HOOK:
-		if ( plugin_result.second->Type()->Tag() != TYPE_BOOL )
-			reporter->InternalError("plugin returned non-bool for hook %s", this->Name());
+		if ( hook_result->GetType()->Tag() != TYPE_BOOL )
+			reporter->InternalError("plugin returned non-bool for hook %s",
+			                        this->Name());
 
 		break;
 
 	case FUNC_FLAVOR_FUNCTION:
 		{
-		BroType* yt = FType()->YieldType();
+		const auto& yt = GetType()->Yield();
 
 		if ( (! yt) || yt->Tag() == TYPE_VOID )
 			{
-			if( plugin_result.second )
-				reporter->InternalError("plugin returned non-void result for void method %s", this->Name());
+			if ( hook_result )
+				reporter->InternalError("plugin returned non-void result for void method %s",
+				                        this->Name());
 			}
 
-		else if ( plugin_result.second && plugin_result.second->Type()->Tag() != yt->Tag() && yt->Tag() != TYPE_ANY)
+		else if ( hook_result && hook_result->GetType()->Tag() != yt->Tag() && yt->Tag() != TYPE_ANY )
 			{
 			reporter->InternalError("plugin returned wrong type (got %d, expecting %d) for %s",
-						plugin_result.second->Type()->Tag(), yt->Tag(), this->Name());
+			                        hook_result->GetType()->Tag(), yt->Tag(), this->Name());
 			}
 
 		break;
 		}
 	}
-
-	return plugin_result;
 	}
 
-BroFunc::BroFunc(ID* arg_id, IntrusivePtr<Stmt> arg_body, id_list* aggr_inits,
+BroFunc::BroFunc(const IntrusivePtr<ID>& arg_id, IntrusivePtr<Stmt> arg_body,
+                 const std::vector<IntrusivePtr<ID>>& aggr_inits,
                  size_t arg_frame_size, int priority)
 	: Func(BRO_FUNC)
 	{
 	name = arg_id->Name();
-	type = {NewRef{}, arg_id->Type()};
+	type = arg_id->GetType<FuncType>();
 	frame_size = arg_frame_size;
 
 	if ( arg_body )
@@ -295,12 +298,13 @@ bool BroFunc::IsPure() const
 		[](const Body& b) { return b.stmts->IsPure(); });
 	}
 
-IntrusivePtr<Val> Func::Call(val_list* args, Frame* parent) const
+Val* Func::Call(val_list* args, Frame* parent) const
 	{
-	return Call(zeek::val_list_to_args(*args), parent);
-	}
+	auto zargs = zeek::val_list_to_args(*args);
+	return Invoke(&zargs, parent).release();
+	};
 
-IntrusivePtr<Val> BroFunc::Call(const zeek::Args& args, Frame* parent) const
+IntrusivePtr<Val> BroFunc::Invoke(zeek::Args* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -310,12 +314,14 @@ IntrusivePtr<Val> BroFunc::Call(const zeek::Args& args, Frame* parent) const
 	if ( sample_logger )
 		sample_logger->FunctionSeen(this);
 
-	std::pair<bool, Val*> plugin_result = PLUGIN_HOOK_WITH_RESULT(HOOK_CALL_FUNCTION, HookCallFunction(this, parent, args), empty_hook_result);
+	auto [handled, hook_result] = PLUGIN_HOOK_WITH_RESULT(HOOK_CALL_FUNCTION,
+	                                                      HookCallFunction(this, parent, args),
+	                                                      empty_hook_result);
 
-	plugin_result = HandlePluginResult(plugin_result,  Flavor());
+	CheckPluginResult(handled, hook_result, Flavor());
 
-	if( plugin_result.first )
-		return {AdoptRef{}, plugin_result.second};
+	if ( handled )
+		return hook_result;
 
 	if ( bodies.empty() )
 		{
@@ -324,7 +330,7 @@ IntrusivePtr<Val> BroFunc::Call(const zeek::Args& args, Frame* parent) const
 		return Flavor() == FUNC_FLAVOR_HOOK ? val_mgr->True() : nullptr;
 		}
 
-	auto f = make_intrusive<Frame>(frame_size, this, &args);
+	auto f = make_intrusive<Frame>(frame_size, this, args);
 
 	if ( closure )
 		f->CaptureClosure(closure, outer_ids);
@@ -338,15 +344,15 @@ IntrusivePtr<Val> BroFunc::Call(const zeek::Args& args, Frame* parent) const
 
 	g_frame_stack.push_back(f.get());	// used for backtracing
 	const CallExpr* call_expr = parent ? parent->GetCall() : nullptr;
-	call_stack.emplace_back(CallInfo{call_expr, this, args});
+	call_stack.emplace_back(CallInfo{call_expr, this, *args});
 
 	if ( g_trace_state.DoTrace() )
 		{
 		ODesc d;
-		DescribeDebug(&d, &args);
+		DescribeDebug(&d, args);
 
 		g_trace_state.LogTrace("%s called: %s\n",
-			FType()->FlavorString().c_str(), d.Description());
+			GetType()->FlavorString().c_str(), d.Description());
 		}
 
 	stmt_flow_type flow = FLOW_NEXT;
@@ -359,16 +365,16 @@ IntrusivePtr<Val> BroFunc::Call(const zeek::Args& args, Frame* parent) const
 				body.stmts->GetLocationInfo());
 
 		// Fill in the rest of the frame with the function's arguments.
-		for ( auto j = 0u; j < args.size(); ++j )
+		for ( auto j = 0u; j < args->size(); ++j )
 			{
-			Val* arg = args[j].get();
+			const auto& arg = (*args)[j];
 
-			if ( f->NthElement(j) != arg )
+			if ( f->GetElement(j) != arg )
 				// Either not yet set, or somebody reassigned the frame slot.
-				f->SetElement(j, arg->Ref());
+				f->SetElement(j, arg);
 			}
 
-		f->Reset(args.size());
+		f->Reset(args->size());
 
 		try
 			{
@@ -423,7 +429,7 @@ IntrusivePtr<Val> BroFunc::Call(const zeek::Args& args, Frame* parent) const
 
 	// Warn if the function returns something, but we returned from
 	// the function without an explicit return, or without a value.
-	else if ( FType()->YieldType() && FType()->YieldType()->Tag() != TYPE_VOID &&
+	else if ( GetType()->Yield() && GetType()->Yield()->Tag() != TYPE_VOID &&
 		 (flow != FLOW_RETURN /* we fell off the end */ ||
 		  ! result /* explicit return with no result */) &&
 		 ! f->HasDelayed() )
@@ -443,13 +449,14 @@ IntrusivePtr<Val> BroFunc::Call(const zeek::Args& args, Frame* parent) const
 	return result;
 	}
 
-void BroFunc::AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
+void BroFunc::AddBody(IntrusivePtr<Stmt> new_body,
+                      const std::vector<IntrusivePtr<ID>>& new_inits,
                       size_t new_frame_size, int priority)
 	{
 	if ( new_frame_size > frame_size )
 		frame_size = new_frame_size;
 
-	auto num_args = FType()->Args()->NumFields();
+	auto num_args = GetType()->Params()->NumFields();
 
 	if ( num_args > static_cast<int>(frame_size) )
 		frame_size = num_args;
@@ -567,9 +574,10 @@ void BroFunc::Describe(ODesc* d) const
 		}
 	}
 
-IntrusivePtr<Stmt> BroFunc::AddInits(IntrusivePtr<Stmt> body, id_list* inits)
+IntrusivePtr<Stmt> BroFunc::AddInits(IntrusivePtr<Stmt> body,
+                                     const std::vector<IntrusivePtr<ID>>& inits)
 	{
-	if ( ! inits || inits->length() == 0 )
+	if ( inits.empty() )
 		return body;
 
 	auto stmt_series = make_intrusive<StmtList>();
@@ -587,14 +595,14 @@ BuiltinFunc::BuiltinFunc(built_in_func arg_func, const char* arg_name,
 	name = make_full_var_name(GLOBAL_MODULE_NAME, arg_name);
 	is_pure = arg_is_pure;
 
-	auto id = lookup_ID(Name(), GLOBAL_MODULE_NAME, false);
+	const auto& id = lookup_ID(Name(), GLOBAL_MODULE_NAME, false);
 	if ( ! id )
 		reporter->InternalError("built-in function %s missing", Name());
 	if ( id->HasVal() )
 		reporter->InternalError("built-in function %s multiply defined", Name());
 
-	type = {NewRef{}, id->Type()};
-	id->SetVal(make_intrusive<Val>(this));
+	type = id->GetType<FuncType>();
+	id->SetVal(make_intrusive<Val>(IntrusivePtr{NewRef{}, this}));
 	}
 
 BuiltinFunc::~BuiltinFunc()
@@ -606,7 +614,7 @@ bool BuiltinFunc::IsPure() const
 	return is_pure;
 	}
 
-IntrusivePtr<Val> BuiltinFunc::Call(const zeek::Args& args, Frame* parent) const
+IntrusivePtr<Val> BuiltinFunc::Invoke(zeek::Args* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -616,24 +624,26 @@ IntrusivePtr<Val> BuiltinFunc::Call(const zeek::Args& args, Frame* parent) const
 	if ( sample_logger )
 		sample_logger->FunctionSeen(this);
 
-	std::pair<bool, Val*> plugin_result = PLUGIN_HOOK_WITH_RESULT(HOOK_CALL_FUNCTION, HookCallFunction(this, parent, args), empty_hook_result);
+	auto [handled, hook_result] = PLUGIN_HOOK_WITH_RESULT(HOOK_CALL_FUNCTION,
+	                                                      HookCallFunction(this, parent, args),
+	                                                      empty_hook_result);
 
-	plugin_result = HandlePluginResult(plugin_result, FUNC_FLAVOR_FUNCTION);
+	CheckPluginResult(handled, hook_result, FUNC_FLAVOR_FUNCTION);
 
-	if ( plugin_result.first )
-		return {AdoptRef{}, plugin_result.second};
+	if ( handled )
+		return hook_result;
 
 	if ( g_trace_state.DoTrace() )
 		{
 		ODesc d;
-		DescribeDebug(&d, &args);
+		DescribeDebug(&d, args);
 
 		g_trace_state.LogTrace("\tBuiltin Function called: %s\n", d.Description());
 		}
 
 	const CallExpr* call_expr = parent ? parent->GetCall() : nullptr;
-	call_stack.emplace_back(CallInfo{call_expr, this, args});
-	auto result = std::move(func(parent, &args).rval);
+	call_stack.emplace_back(CallInfo{call_expr, this, *args});
+	auto result = std::move(func(parent, args).rval);
 	call_stack.pop_back();
 
 	if ( result && g_trace_state.DoTrace() )
@@ -748,21 +758,21 @@ void builtin_error(const char* msg, BroObj* arg)
 
 void init_builtin_funcs()
 	{
-	ProcStats = internal_type("ProcStats")->AsRecordType();
-	NetStats = internal_type("NetStats")->AsRecordType();
-	MatcherStats = internal_type("MatcherStats")->AsRecordType();
-	ConnStats = internal_type("ConnStats")->AsRecordType();
-	ReassemblerStats = internal_type("ReassemblerStats")->AsRecordType();
-	DNSStats = internal_type("DNSStats")->AsRecordType();
-	GapStats = internal_type("GapStats")->AsRecordType();
-	EventStats = internal_type("EventStats")->AsRecordType();
-	TimerStats = internal_type("TimerStats")->AsRecordType();
-	FileAnalysisStats = internal_type("FileAnalysisStats")->AsRecordType();
-	ThreadStats = internal_type("ThreadStats")->AsRecordType();
-	BrokerStats = internal_type("BrokerStats")->AsRecordType();
-	ReporterStats = internal_type("ReporterStats")->AsRecordType();
+	ProcStats = zeek::id::find_type<RecordType>("ProcStats");
+	NetStats = zeek::id::find_type<RecordType>("NetStats");
+	MatcherStats = zeek::id::find_type<RecordType>("MatcherStats");
+	ConnStats = zeek::id::find_type<RecordType>("ConnStats");
+	ReassemblerStats = zeek::id::find_type<RecordType>("ReassemblerStats");
+	DNSStats = zeek::id::find_type<RecordType>("DNSStats");
+	GapStats = zeek::id::find_type<RecordType>("GapStats");
+	EventStats = zeek::id::find_type<RecordType>("EventStats");
+	TimerStats = zeek::id::find_type<RecordType>("TimerStats");
+	FileAnalysisStats = zeek::id::find_type<RecordType>("FileAnalysisStats");
+	ThreadStats = zeek::id::find_type<RecordType>("ThreadStats");
+	BrokerStats = zeek::id::find_type<RecordType>("BrokerStats");
+	ReporterStats = zeek::id::find_type<RecordType>("ReporterStats");
 
-	var_sizes = internal_type("var_sizes")->AsTableType();
+	var_sizes = zeek::id::find_type("var_sizes")->AsTableType();
 
 #include "zeek.bif.func_init"
 #include "stats.bif.func_init"
@@ -781,7 +791,7 @@ void init_builtin_funcs_subdirs()
 
 bool check_built_in_call(BuiltinFunc* f, CallExpr* call)
 	{
-	if ( f->TheFunc() != BifFunc::bro_fmt )
+	if ( f->TheFunc() != zeek::BifFunc::fmt_bif)
 		return true;
 
 	const expr_list& args = call->Args()->Exprs();
@@ -793,7 +803,7 @@ bool check_built_in_call(BuiltinFunc* f, CallExpr* call)
 		}
 
 	const Expr* fmt_str_arg = args[0];
-	if ( fmt_str_arg->Type()->Tag() != TYPE_STRING )
+	if ( fmt_str_arg->GetType()->Tag() != TYPE_STRING )
 		{
 		call->Error("first argument to fmt() needs to be a format string");
 		return false;
@@ -834,7 +844,7 @@ bool check_built_in_call(BuiltinFunc* f, CallExpr* call)
 
 // Gets a function's priority from its Scope's attributes. Errors if it sees any
 // problems.
-static int get_func_priority(const attr_list& attrs)
+static int get_func_priority(const std::vector<IntrusivePtr<Attr>>& attrs)
 	{
 	int priority = 0;
 
@@ -849,7 +859,7 @@ static int get_func_priority(const attr_list& attrs)
 			continue;
 			}
 
-		auto v = a->AttrExpr()->Eval(nullptr);
+		auto v = a->GetExpr()->Eval(nullptr);
 
 		if ( ! v )
 			{
@@ -857,7 +867,7 @@ static int get_func_priority(const attr_list& attrs)
 			continue;
 			}
 
-		if ( ! IsIntegral(v->Type()->Tag()) )
+		if ( ! IsIntegral(v->GetType()->Tag()) )
 			{
 			a->Error("expression is not of integral type");
 			continue;
@@ -875,22 +885,14 @@ function_ingredients::function_ingredients(IntrusivePtr<Scope> scope, IntrusiveP
 	inits = scope->GetInits();
 
 	this->scope = std::move(scope);
-	id = {NewRef{}, this->scope->ScopeID()};
+	id = this->scope->GetID();
 
-	auto attrs = this->scope->Attrs();
+	const auto& attrs = this->scope->Attrs();
 
 	priority = (attrs ? get_func_priority(*attrs) : 0);
 	this->body = std::move(body);
 	}
 
-function_ingredients::~function_ingredients()
-	{
-	for ( const auto& i : *inits )
-		Unref(i);
-
-	delete inits;
-	}
-
 BifReturnVal::BifReturnVal(std::nullptr_t) noexcept
 	{ }
 
diff --git a/src/Func.h b/src/Func.h
index dff2c9a36b..5b2ee5eebc 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -30,6 +30,8 @@ class Scope;
 
 class Func : public BroObj {
 public:
+	static inline const IntrusivePtr<Func> nil;
+
 	enum Kind { BRO_FUNC, BUILTIN_FUNC };
 
 	explicit Func(Kind arg_kind);
@@ -37,7 +39,7 @@ public:
 	~Func() override;
 
 	virtual bool IsPure() const = 0;
-	function_flavor Flavor() const	{ return FType()->Flavor(); }
+	function_flavor Flavor() const	{ return GetType()->Flavor(); }
 
 	struct Body {
 		IntrusivePtr<Stmt> stmts;
@@ -49,8 +51,8 @@ public:
 	const std::vector<Body>& GetBodies() const	{ return bodies; }
 	bool HasBodies() const	{ return bodies.size(); }
 
-	[[deprecated("Remove in v4.1. Use zeek::Args overload instead.")]]
-	virtual IntrusivePtr<Val> Call(val_list* args, Frame* parent = nullptr) const;
+	[[deprecated("Remove in v4.1. Use Invoke() instead.")]]
+	Val* Call(val_list* args, Frame* parent = nullptr) const;
 
 	/**
 	 * Calls a Zeek function.
@@ -58,27 +60,36 @@ public:
 	 * @param parent  the frame from which the function is being called.
 	 * @return  the return value of the function call.
 	 */
-	virtual IntrusivePtr<Val> Call(const zeek::Args& args, Frame* parent = nullptr) const = 0;
+	virtual IntrusivePtr<Val> Invoke(zeek::Args* args,
+	                                   Frame* parent = nullptr) const = 0;
 
 	/**
-	 * A version of Call() taking a variable number of individual arguments.
+	 * A version of Invoke() taking a variable number of individual arguments.
 	 */
 	template <class... Args>
 	std::enable_if_t<
 	  std::is_convertible_v<std::tuple_element_t<0, std::tuple<Args...>>,
 	                        IntrusivePtr<Val>>,
 	  IntrusivePtr<Val>>
-	Call(Args&&... args) const
-		{ return Call(zeek::Args{std::forward<Args>(args)...}); }
+	Invoke(Args&&... args) const
+		{
+		auto zargs = zeek::Args{std::forward<Args>(args)...};
+		return Invoke(&zargs);
+		}
 
 	// Add a new event handler to an existing function (event).
-	virtual void AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
+	virtual void AddBody(IntrusivePtr<Stmt> new_body,
+	                     const std::vector<IntrusivePtr<ID>>& new_inits,
 	                     size_t new_frame_size, int priority = 0);
 
 	virtual void SetScope(IntrusivePtr<Scope> newscope);
 	virtual Scope* GetScope() const		{ return scope.get(); }
 
-	virtual FuncType* FType() const { return type->AsFuncType(); }
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
+	virtual FuncType* FType() const { return type.get(); }
+
+	const IntrusivePtr<FuncType>& GetType() const
+		{ return type; }
 
 	Kind GetKind() const	{ return kind; }
 
@@ -93,8 +104,8 @@ public:
 	virtual TraversalCode Traverse(TraversalCallback* cb) const;
 
 	uint32_t GetUniqueFuncID() const { return unique_id; }
-	static Func* GetFuncPtrByID(uint32_t id)
-		{ return id >= unique_ids.size() ? nullptr : unique_ids[id]; }
+	static const IntrusivePtr<Func>& GetFuncPtrByID(uint32_t id)
+		{ return id >= unique_ids.size() ? Func::nil : unique_ids[id]; }
 
 protected:
 	Func();
@@ -102,26 +113,30 @@ protected:
 	// Copies this function's state into other.
 	void CopyStateInto(Func* other) const;
 
-	// Helper function for handling result of plugin hook.
-	std::pair<bool, Val*> HandlePluginResult(std::pair<bool, Val*> plugin_result, function_flavor flavor) const;
+	// Helper function for checking result of plugin hook.
+	void CheckPluginResult(bool handled, const IntrusivePtr<Val>& hook_result,
+	                       function_flavor flavor) const;
 
 	std::vector<Body> bodies;
 	IntrusivePtr<Scope> scope;
 	Kind kind;
 	uint32_t unique_id;
-	IntrusivePtr<BroType> type;
+	IntrusivePtr<FuncType> type;
 	std::string name;
-	static std::vector<Func*> unique_ids;
+	static inline std::vector<IntrusivePtr<Func>> unique_ids;
 };
 
 
 class BroFunc final : public Func {
 public:
-	BroFunc(ID* id, IntrusivePtr<Stmt> body, id_list* inits, size_t frame_size, int priority);
+	BroFunc(const IntrusivePtr<ID>& id, IntrusivePtr<Stmt> body,
+	        const std::vector<IntrusivePtr<ID>>& inits,
+	        size_t frame_size, int priority);
+
 	~BroFunc() override;
 
 	bool IsPure() const override;
-	IntrusivePtr<Val> Call(const zeek::Args& args, Frame* parent) const override;
+	IntrusivePtr<Val> Invoke(zeek::Args* args, Frame* parent) const override;
 
 	/**
 	 * Adds adds a closure to the function. Closures are cloned and
@@ -152,8 +167,9 @@ public:
 	 */
 	broker::expected<broker::data> SerializeClosure() const;
 
-	void AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
-		     size_t new_frame_size, int priority) override;
+	void AddBody(IntrusivePtr<Stmt> new_body,
+	             const std::vector<IntrusivePtr<ID>>& new_inits,
+	             size_t new_frame_size, int priority) override;
 
 	/** Sets this function's outer_id list. */
 	void SetOuterIDs(id_list ids)
@@ -163,7 +179,8 @@ public:
 
 protected:
 	BroFunc() : Func(BRO_FUNC)	{}
-	IntrusivePtr<Stmt> AddInits(IntrusivePtr<Stmt> body, id_list* inits);
+	IntrusivePtr<Stmt> AddInits(IntrusivePtr<Stmt> body,
+	                            const std::vector<IntrusivePtr<ID>>& inits);
 
 	/**
 	 * Clones this function along with its closures.
@@ -206,10 +223,6 @@ public:
 	[[deprecated("Remove in v4.1.  Return an IntrusivePtr instead.")]]
 	BifReturnVal(Val* v) noexcept;
 
-private:
-
-	friend class BuiltinFunc;
-
 	IntrusivePtr<Val> rval;
 };
 
@@ -221,7 +234,7 @@ public:
 	~BuiltinFunc() override;
 
 	bool IsPure() const override;
-	IntrusivePtr<Val> Call(const zeek::Args& args, Frame* parent) const override;
+	IntrusivePtr<Val> Invoke(zeek::Args* args, Frame* parent) const override;
 	built_in_func TheFunc() const	{ return func; }
 
 	void Describe(ODesc* d) const override;
@@ -256,11 +269,9 @@ struct function_ingredients {
 	// to build a function.
 	function_ingredients(IntrusivePtr<Scope> scope, IntrusivePtr<Stmt> body);
 
-	~function_ingredients();
-
 	IntrusivePtr<ID> id;
 	IntrusivePtr<Stmt> body;
-	id_list* inits;
+	std::vector<IntrusivePtr<ID>> inits;
 	int frame_size;
 	int priority;
 	IntrusivePtr<Scope> scope;
diff --git a/src/Hash.cc b/src/Hash.cc
index 22249ad11d..a5a375750b 100644
--- a/src/Hash.cc
+++ b/src/Hash.cc
@@ -40,7 +40,7 @@ void KeyedHash::InitializeSeeds(const std::array<uint32_t, SEED_INIT_SIZE>& seed
 
 void KeyedHash::InitOptions()
 	{
-	calculate_digest(Hash_SHA256, BifConst::digest_salt->Bytes(), BifConst::digest_salt->Len(), reinterpret_cast<unsigned char*>(cluster_highwayhash_key));
+	calculate_digest(Hash_SHA256, zeek::BifConst::digest_salt->Bytes(), zeek::BifConst::digest_salt->Len(), reinterpret_cast<unsigned char*>(cluster_highwayhash_key));
 	}
 
 hash64_t KeyedHash::Hash64(const void* bytes, uint64_t size)
diff --git a/src/Hash.h b/src/Hash.h
index 8e143e98f2..9e39909d58 100644
--- a/src/Hash.h
+++ b/src/Hash.h
@@ -30,8 +30,8 @@ class BroString;
 class Val;
 class Frame;
 class BifReturnVal;
-namespace BifFunc {
-	extern BifReturnVal bro_md5_hmac(Frame* frame, const zeek::Args*);
+namespace zeek::BifFunc {
+	extern BifReturnVal md5_hmac_bif(Frame* frame, const zeek::Args*);
 }
 
 typedef uint64_t hash_t;
@@ -196,7 +196,7 @@ private:
 	inline static bool seeds_initialized = false;
 
 	friend void hmac_md5(size_t size, const unsigned char* bytes, unsigned char digest[16]);
-	friend BifReturnVal BifFunc::bro_md5_hmac(Frame* frame, const zeek::Args*);
+	friend BifReturnVal zeek::BifFunc::md5_hmac_bif(Frame* frame, const zeek::Args*);
 };
 
 typedef enum {
diff --git a/src/ID.cc b/src/ID.cc
index 34289ef574..20172a5e54 100644
--- a/src/ID.cc
+++ b/src/ID.cc
@@ -19,20 +19,101 @@
 #include "zeekygen/ScriptInfo.h"
 #include "module_util.h"
 
+IntrusivePtr<RecordType> zeek::id::conn_id;
+IntrusivePtr<RecordType> zeek::id::endpoint;
+IntrusivePtr<RecordType> zeek::id::connection;
+IntrusivePtr<RecordType> zeek::id::fa_file;
+IntrusivePtr<RecordType> zeek::id::fa_metadata;
+IntrusivePtr<EnumType> zeek::id::transport_proto;
+IntrusivePtr<TableType> zeek::id::string_set;
+IntrusivePtr<TableType> zeek::id::string_array;
+IntrusivePtr<TableType> zeek::id::count_set;
+IntrusivePtr<VectorType> zeek::id::string_vec;
+IntrusivePtr<VectorType> zeek::id::index_vec;
+
+const IntrusivePtr<ID>& zeek::id::find(std::string_view name)
+	{
+	return global_scope()->Find(name);
+	}
+
+const IntrusivePtr<BroType>& zeek::id::find_type(std::string_view name)
+	{
+	auto id = global_scope()->Find(name);
+
+	if ( ! id )
+		reporter->InternalError("Failed to find type named: %s",
+		                        std::string(name).data());
+
+	return id->GetType();
+	}
+
+const IntrusivePtr<Val>& zeek::id::find_val(std::string_view name)
+	{
+	auto id = global_scope()->Find(name);
+
+	if ( ! id )
+		reporter->InternalError("Failed to find variable named: %s",
+		                        std::string(name).data());
+
+	return id->GetVal();
+	}
+
+const IntrusivePtr<Val>& zeek::id::find_const(std::string_view name)
+	{
+	auto id = global_scope()->Find(name);
+
+	if ( ! id )
+		reporter->InternalError("Failed to find variable named: %s",
+		                        std::string(name).data());
+
+	if ( ! id->IsConst() )
+		reporter->InternalError("Variable is not 'const', but expected to be: %s",
+		                        std::string(name).data());
+
+	return id->GetVal();
+	}
+
+IntrusivePtr<Func> zeek::id::find_func(std::string_view name)
+	{
+	const auto& v = zeek::id::find_val(name);
+
+	if ( ! v )
+		return nullptr;
+
+	if ( ! IsFunc(v->GetType()->Tag()) )
+		reporter->InternalError("Expected variable '%s' to be a function",
+		                        std::string(name).data());
+
+	return v->AsFuncPtr();
+	}
+
+void zeek::id::detail::init()
+	{
+	conn_id = zeek::id::find_type<RecordType>("conn_id");
+	endpoint = zeek::id::find_type<RecordType>("endpoint");
+	connection = zeek::id::find_type<RecordType>("connection");
+	fa_file = zeek::id::find_type<RecordType>("fa_file");
+	fa_metadata = zeek::id::find_type<RecordType>("fa_metadata");
+	transport_proto = zeek::id::find_type<EnumType>("transport_proto");
+	string_set = zeek::id::find_type<TableType>("string_set");
+	string_array = zeek::id::find_type<TableType>("string_array");
+	count_set = zeek::id::find_type<TableType>("count_set");
+	string_vec = zeek::id::find_type<VectorType>("string_vec");
+	index_vec = zeek::id::find_type<VectorType>("index_vec");
+	}
+
 ID::ID(const char* arg_name, IDScope arg_scope, bool arg_is_export)
 	{
 	name = copy_string(arg_name);
 	scope = arg_scope;
 	is_export = arg_is_export;
 	is_option = false;
-	val = nullptr;
 	is_const = false;
 	is_enum_const = false;
 	is_type = false;
 	offset = 0;
 
 	infer_return_type = false;
-	weak_ref = false;
 
 	SetLocationInfo(&start_location, &end_location);
 	}
@@ -40,9 +121,6 @@ ID::ID(const char* arg_name, IDScope arg_scope, bool arg_is_export)
 ID::~ID()
 	{
 	delete [] name;
-
-	if ( ! weak_ref )
-		Unref(val);
 	}
 
 std::string ID::ModuleName() const
@@ -57,19 +135,12 @@ void ID::SetType(IntrusivePtr<BroType> t)
 
 void ID::ClearVal()
 	{
-	if ( ! weak_ref )
-		Unref(val);
-
 	val = nullptr;
 	}
 
-void ID::SetVal(IntrusivePtr<Val> v, bool arg_weak_ref)
+void ID::SetVal(IntrusivePtr<Val> v)
 	{
-	if ( ! weak_ref )
-		Unref(val);
-
-	val = v.release();
-	weak_ref = arg_weak_ref;
+	val = std::move(v);
 	Modified();
 
 #ifdef DEBUG
@@ -84,14 +155,14 @@ void ID::SetVal(IntrusivePtr<Val> v, bool arg_weak_ref)
 		if ( ! handler )
 			{
 			handler = new EventHandler(name);
-			handler->SetLocalHandler(val->AsFunc());
+			handler->SetFunc(val->AsFuncPtr());
 			event_registry->Register(handler);
 			}
 		else
 			{
 			// Otherwise, internally defined events cannot
 			// have local handler.
-			handler->SetLocalHandler(val->AsFunc());
+			handler->SetFunc(val->AsFuncPtr());
 			}
 		}
 	}
@@ -124,30 +195,29 @@ void ID::SetVal(IntrusivePtr<Val> v, init_class c)
 				return;
 				}
 			else
-				v->AddTo(val, false);
+				v->AddTo(val.get(), false);
 			}
 		else
 			{
 			if ( val )
-				v->RemoveFrom(val);
+				v->RemoveFrom(val.get());
 			}
 		}
 	}
 
 void ID::SetVal(IntrusivePtr<Expr> ev, init_class c)
 	{
-	Attr* a = attrs->FindAttr(c == INIT_EXTRA ?
-					ATTR_ADD_FUNC : ATTR_DEL_FUNC);
+	const auto& a = attrs->Find(c == INIT_EXTRA ? ATTR_ADD_FUNC : ATTR_DEL_FUNC);
 
 	if ( ! a )
 		Internal("no add/delete function in ID::SetVal");
 
-	EvalFunc({NewRef{}, a->AttrExpr()}, std::move(ev));
+	EvalFunc(a->GetExpr(), std::move(ev));
 	}
 
 bool ID::IsRedefinable() const
 	{
-	return FindAttr(ATTR_REDEF) != nullptr;
+	return GetAttr(ATTR_REDEF) != nullptr;
 	}
 
 void ID::SetAttrs(IntrusivePtr<Attributes> a)
@@ -161,33 +231,34 @@ void ID::UpdateValAttrs()
 	if ( ! attrs )
 		return;
 
-	if ( val && val->Type()->Tag() == TYPE_TABLE )
+	if ( val && val->GetType()->Tag() == TYPE_TABLE )
 		val->AsTableVal()->SetAttrs(attrs);
 
-	if ( val && val->Type()->Tag() == TYPE_FILE )
+	if ( val && val->GetType()->Tag() == TYPE_FILE )
 		val->AsFile()->SetAttrs(attrs.get());
 
-	if ( Type()->Tag() == TYPE_FUNC )
+	if ( GetType()->Tag() == TYPE_FUNC )
 		{
-		Attr* attr = attrs->FindAttr(ATTR_ERROR_HANDLER);
+		const auto& attr = attrs->Find(ATTR_ERROR_HANDLER);
 
 		if ( attr )
 			event_registry->SetErrorHandler(Name());
 		}
 
-	if ( Type()->Tag() == TYPE_RECORD )
+	if ( GetType()->Tag() == TYPE_RECORD )
 		{
-		Attr* attr = attrs->FindAttr(ATTR_LOG);
+		const auto& attr = attrs->Find(ATTR_LOG);
+
 		if ( attr )
 			{
 			// Apply &log to all record fields.
-			RecordType* rt = Type()->AsRecordType();
+			RecordType* rt = GetType()->AsRecordType();
 			for ( int i = 0; i < rt->NumFields(); ++i )
 				{
 				TypeDecl* fd = rt->FieldDecl(i);
 
 				if ( ! fd->attrs )
-					fd->attrs = make_intrusive<Attributes>(new attr_list, IntrusivePtr{NewRef{}, rt->FieldType(i)}, true, IsGlobal());
+					fd->attrs = make_intrusive<Attributes>(rt->GetFieldType(i), true, IsGlobal());
 
 				fd->attrs->AddAttr(make_intrusive<Attr>(ATTR_LOG));
 				}
@@ -195,14 +266,14 @@ void ID::UpdateValAttrs()
 		}
 	}
 
-Attr* ID::FindAttr(attr_tag t) const
+const IntrusivePtr<Attr>& ID::GetAttr(attr_tag t) const
 	{
-	return attrs ? attrs->FindAttr(t) : nullptr;
+	return attrs ? attrs->Find(t) : Attr::nil;
 	}
 
 bool ID::IsDeprecated() const
 	{
-	return FindAttr(ATTR_DEPRECATED) != nullptr;
+	return GetAttr(ATTR_DEPRECATED) != nullptr;
 	}
 
 void ID::MakeDeprecated(IntrusivePtr<Expr> deprecation)
@@ -210,17 +281,18 @@ void ID::MakeDeprecated(IntrusivePtr<Expr> deprecation)
 	if ( IsDeprecated() )
 		return;
 
-	attr_list* attr = new attr_list{new Attr(ATTR_DEPRECATED, std::move(deprecation))};
-	AddAttrs(make_intrusive<Attributes>(attr, IntrusivePtr{NewRef{}, Type()}, false, IsGlobal()));
+	std::vector<IntrusivePtr<Attr>> attrv{make_intrusive<Attr>(ATTR_DEPRECATED, std::move(deprecation))};
+	AddAttrs(make_intrusive<Attributes>(std::move(attrv), GetType(), false, IsGlobal()));
 	}
 
 std::string ID::GetDeprecationWarning() const
 	{
 	std::string result;
-	Attr* depr_attr = FindAttr(ATTR_DEPRECATED);
+	const auto& depr_attr = GetAttr(ATTR_DEPRECATED);
+
 	if ( depr_attr )
 		{
-		ConstExpr* expr = static_cast<ConstExpr*>(depr_attr->AttrExpr());
+		auto expr = static_cast<ConstExpr*>(depr_attr->GetExpr().get());
 		if ( expr )
 			{
 			StringVal* text = expr->Value()->AsStringVal();
@@ -237,7 +309,7 @@ std::string ID::GetDeprecationWarning() const
 void ID::AddAttrs(IntrusivePtr<Attributes> a)
 	{
 	if ( attrs )
-		attrs->AddAttrs(a.release());
+		attrs->AddAttrs(a);
 	else
 		attrs = std::move(a);
 
@@ -260,14 +332,14 @@ void ID::SetOption()
 	// option implied redefinable
 	if ( ! IsRedefinable() )
 		{
-		attr_list* attr = new attr_list{new Attr(ATTR_REDEF)};
-		AddAttrs(make_intrusive<Attributes>(attr, IntrusivePtr{NewRef{}, Type()}, false, IsGlobal()));
+		std::vector<IntrusivePtr<Attr>> attrv{make_intrusive<Attr>(ATTR_REDEF)};
+		AddAttrs(make_intrusive<Attributes>(std::move(attrv), GetType(), false, IsGlobal()));
 		}
 	}
 
 void ID::EvalFunc(IntrusivePtr<Expr> ef, IntrusivePtr<Expr> ev)
 	{
-	auto arg1 = make_intrusive<ConstExpr>(IntrusivePtr{NewRef{}, val});
+	auto arg1 = make_intrusive<ConstExpr>(val);
 	auto args = make_intrusive<ListExpr>();
 	args->Append(std::move(arg1));
 	args->Append(std::move(ev));
@@ -290,7 +362,7 @@ TraversalCode ID::Traverse(TraversalCallback* cb) const
 		}
 
 	// FIXME: Perhaps we should be checking at other than global scope.
-	else if ( val && IsFunc(val->Type()->Tag()) &&
+	else if ( val && IsFunc(val->GetType()->Tag()) &&
 		  cb->current_scope == global_scope() )
 		{
 		tc = val->AsFunc()->Traverse(cb);
@@ -488,10 +560,8 @@ void ID::DescribeReST(ODesc* d, bool roles_only) const
 		d->Add(":Default:");
 		auto ii = zeekygen_mgr->GetIdentifierInfo(Name());
 		auto redefs = ii->GetRedefs();
-		auto iv = val;
-
-		if ( ! redefs.empty() && ii->InitialVal() )
-			iv = ii->InitialVal();
+		const auto& iv = ! redefs.empty() && ii->InitialVal() ? ii->InitialVal()
+			                                                  : val;
 
 		if ( type->InternalType() == TYPE_INTERNAL_OTHER )
 			{
diff --git a/src/ID.h b/src/ID.h
index 3735e7a843..5c0c5e84b7 100644
--- a/src/ID.h
+++ b/src/ID.h
@@ -10,12 +10,17 @@
 
 #include <map>
 #include <string>
+#include <string_view>
 #include <vector>
 
 class Val;
 class Expr;
 class Func;
 class BroType;
+class RecordType;
+class TableType;
+class VectorType;
+class EnumType;
 class Attributes;
 
 typedef enum { INIT_NONE, INIT_FULL, INIT_EXTRA, INIT_REMOVE, } init_class;
@@ -23,6 +28,8 @@ typedef enum { SCOPE_FUNCTION, SCOPE_MODULE, SCOPE_GLOBAL } IDScope;
 
 class ID final : public BroObj, public notifier::Modifiable {
 public:
+	static inline const IntrusivePtr<ID> nil;
+
 	ID(const char* name, IDScope arg_scope, bool arg_is_export);
 	~ID() override;
 
@@ -37,29 +44,44 @@ public:
 	std::string ModuleName() const;
 
 	void SetType(IntrusivePtr<BroType> t);
+
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	BroType* Type()			{ return type.get(); }
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	const BroType* Type() const	{ return type.get(); }
 
-	void MakeType()			{ is_type = true; }
-	BroType* AsType()		{ return is_type ? Type() : nullptr; }
-	const BroType* AsType() const	{ return is_type ? Type() : nullptr; }
+	const IntrusivePtr<BroType>& GetType() const
+		{ return type; }
 
-	// If weak_ref is false, the Val is assumed to be already ref'ed
-	// and will be deref'ed when the ID is deleted.
-	//
-	// If weak_ref is true, we store the Val but don't ref/deref it.
-	// That means that when the ID becomes the only one holding a
-	// reference to the Val, the Val will be destroyed (naturally,
-	// you have to take care that it will not be accessed via
-	// the ID afterwards).
-	void SetVal(IntrusivePtr<Val> v, bool weak_ref = false);
+	template <class T>
+	IntrusivePtr<T> GetType() const
+		{ return cast_intrusive<T>(type); }
+
+	[[deprecated("Remove in v4.1.  Use IsType() and GetType().")]]
+	BroType* AsType()		{ return is_type ? GetType().get() : nullptr; }
+	[[deprecated("Remove in v4.1.  Use IsType() and GetType().")]]
+	const BroType* AsType() const	{ return is_type ? GetType().get() : nullptr; }
+
+	bool IsType() const
+		{ return is_type; }
+
+	void MakeType()			{ is_type = true; }
+
+	void SetVal(IntrusivePtr<Val> v);
 
 	void SetVal(IntrusivePtr<Val> v, init_class c);
 	void SetVal(IntrusivePtr<Expr> ev, init_class c);
 
 	bool HasVal() const		{ return val != nullptr; }
-	Val* ID_Val()			{ return val; }
-	const Val* ID_Val() const	{ return val; }
+
+	[[deprecated("Remove in v4.1.  Use GetVal().")]]
+	Val* ID_Val()			{ return val.get(); }
+	[[deprecated("Remove in v4.1.  Use GetVal().")]]
+	const Val* ID_Val() const	{ return val.get(); }
+
+	const IntrusivePtr<Val>& GetVal() const
+		{ return val; }
+
 	void ClearVal();
 
 	void SetConst()			{ is_const = true; }
@@ -80,9 +102,18 @@ public:
 	void AddAttrs(IntrusivePtr<Attributes> attr);
 	void RemoveAttr(attr_tag a);
 	void UpdateValAttrs();
+
+	const IntrusivePtr<Attributes>& GetAttrs() const
+		{ return attrs; }
+
+	[[deprecated("Remove in 4.1.  Use GetAttrs().")]]
 	Attributes* Attrs() const	{ return attrs.get(); }
 
-	Attr* FindAttr(attr_tag t) const;
+	[[deprecated("Remove in 4.1.  Use GetAttr().")]]
+	Attr* FindAttr(attr_tag t) const
+		{ return GetAttr(t).get(); }
+
+	const IntrusivePtr<Attr>& GetAttr(attr_tag t) const;
 
 	bool IsDeprecated() const;
 
@@ -123,13 +154,104 @@ protected:
 	IDScope scope;
 	bool is_export;
 	bool infer_return_type;
-	bool weak_ref;
 	IntrusivePtr<BroType> type;
 	bool is_const, is_enum_const, is_type, is_option;
 	int offset;
-	Val* val;
+	IntrusivePtr<Val> val;
 	IntrusivePtr<Attributes> attrs;
 	// contains list of functions that are called when an option changes
 	std::multimap<int, IntrusivePtr<Func>> option_handlers;
 
 };
+
+namespace zeek::id {
+
+/**
+ * Lookup an ID in the global module and return it, if one exists;
+ * @param name  The identifier name to lookup.
+ * @return  The identifier, which may reference a nil object if no such
+ * name exists.
+ */
+const IntrusivePtr<ID>& find(std::string_view name);
+
+/**
+ * Lookup an ID by its name and return its type.  A fatal occurs if the ID
+ * does not exist.
+ * @param name  The identifier name to lookup
+ * @return  The type of the identifier.
+ */
+const IntrusivePtr<BroType>& find_type(std::string_view name);
+
+/**
+ * Lookup an ID by its name and return its type (as cast to @c T).
+ * A fatal occurs if the ID does not exist.
+ * @param name  The identifier name to lookup
+ * @return  The type of the identifier.
+ */
+template<class T>
+IntrusivePtr<T> find_type(std::string_view name)
+	{ return cast_intrusive<T>(find_type(name)); }
+
+/**
+ * Lookup an ID by its name and return its value.  A fatal occurs if the ID
+ * does not exist.
+ * @param name  The identifier name to lookup
+ * @return  The current value of the identifier
+ */
+const IntrusivePtr<Val>& find_val(std::string_view name);
+
+/**
+ * Lookup an ID by its name and return its value (as cast to @c T).
+ * A fatal occurs if the ID does not exist.
+ * @param name  The identifier name to lookup
+ * @return  The current value of the identifier.
+ */
+template<class T>
+IntrusivePtr<T> find_val(std::string_view name)
+	{ return cast_intrusive<T>(find_val(name)); }
+
+/**
+ * Lookup an ID by its name and return its value.  A fatal occurs if the ID
+ * does not exist or if it is not "const".
+ * @param name  The identifier name to lookup
+ * @return  The current value of the identifier
+ */
+const IntrusivePtr<Val>& find_const(std::string_view name);
+
+/**
+ * Lookup an ID by its name and return its value (as cast to @c T).
+ * A fatal occurs if the ID does not exist.
+ * @param name  The identifier name to lookup
+ * @return  The current value of the identifier.
+ */
+template<class T>
+IntrusivePtr<T> find_const(std::string_view name)
+	{ return cast_intrusive<T>(find_const(name)); }
+
+/**
+ * Lookup an ID by its name and return the function it references.
+ * A fatal occurs if the ID does not exist or if it is not a function.
+ * @param name  The identifier name to lookup
+ * @return  The current function value the identifier references.
+ */
+IntrusivePtr<Func> find_func(std::string_view name);
+
+extern IntrusivePtr<RecordType> conn_id;
+extern IntrusivePtr<RecordType> endpoint;
+extern IntrusivePtr<RecordType> connection;
+extern IntrusivePtr<RecordType> fa_file;
+extern IntrusivePtr<RecordType> fa_metadata;
+extern IntrusivePtr<EnumType> transport_proto;
+extern IntrusivePtr<TableType> string_set;
+extern IntrusivePtr<TableType> string_array;
+extern IntrusivePtr<TableType> count_set;
+extern IntrusivePtr<VectorType> string_vec;
+extern IntrusivePtr<VectorType> index_vec;
+
+namespace detail {
+
+void init();
+
+} // namespace zeek::id::detail
+
+} // namespace zeek::id
diff --git a/src/IP.cc b/src/IP.cc
index 58c0a9ef26..28109b185a 100644
--- a/src/IP.cc
+++ b/src/IP.cc
@@ -13,43 +13,15 @@
 #include "BroString.h"
 #include "Reporter.h"
 
-static RecordType* ip4_hdr_type = nullptr;
-static RecordType* ip6_hdr_type = nullptr;
-static RecordType* ip6_ext_hdr_type = nullptr;
-static RecordType* ip6_option_type = nullptr;
-static RecordType* ip6_hopopts_type = nullptr;
-static RecordType* ip6_dstopts_type = nullptr;
-static RecordType* ip6_routing_type = nullptr;
-static RecordType* ip6_fragment_type = nullptr;
-static RecordType* ip6_ah_type = nullptr;
-static RecordType* ip6_esp_type = nullptr;
-static RecordType* ip6_mob_type = nullptr;
-static RecordType* ip6_mob_msg_type = nullptr;
-static RecordType* ip6_mob_brr_type = nullptr;
-static RecordType* ip6_mob_hoti_type = nullptr;
-static RecordType* ip6_mob_coti_type = nullptr;
-static RecordType* ip6_mob_hot_type = nullptr;
-static RecordType* ip6_mob_cot_type = nullptr;
-static RecordType* ip6_mob_bu_type = nullptr;
-static RecordType* ip6_mob_back_type = nullptr;
-static RecordType* ip6_mob_be_type = nullptr;
-
-static inline RecordType* hdrType(RecordType*& type, const char* name)
+static IntrusivePtr<VectorVal> BuildOptionsVal(const u_char* data, int len)
 	{
-	if ( ! type )
-		type = internal_type(name)->AsRecordType();
-
-	return type;
-	}
-
-static VectorVal* BuildOptionsVal(const u_char* data, int len)
-	{
-	VectorVal* vv = new VectorVal(internal_type("ip6_options")->AsVectorType());
+	auto vv = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("ip6_options"));
 
 	while ( len > 0 )
 		{
+		static auto ip6_option_type = zeek::id::find_type<RecordType>("ip6_option");
 		const struct ip6_opt* opt = (const struct ip6_opt*) data;
-		RecordVal* rv = new RecordVal(hdrType(ip6_option_type, "ip6_option"));
+		auto rv = make_intrusive<RecordVal>(ip6_option_type);
 		rv->Assign(0, val_mgr->Count(opt->ip6o_type));
 
 		if ( opt->ip6o_type == 0 )
@@ -71,20 +43,21 @@ static VectorVal* BuildOptionsVal(const u_char* data, int len)
 			len -= opt->ip6o_len + off;
 			}
 
-		vv->Assign(vv->Size(), rv);
+		vv->Assign(vv->Size(), std::move(rv));
 		}
 
 	return vv;
 	}
 
-RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
+IntrusivePtr<RecordVal> IPv6_Hdr::ToVal(IntrusivePtr<VectorVal> chain) const
 	{
-	RecordVal* rv = nullptr;
+	IntrusivePtr<RecordVal> rv;
 
 	switch ( type ) {
 	case IPPROTO_IPV6:
 		{
-		rv = new RecordVal(hdrType(ip6_hdr_type, "ip6_hdr"));
+		static auto ip6_hdr_type = zeek::id::find_type<RecordType>("ip6_hdr");
+		rv = make_intrusive<RecordVal>(ip6_hdr_type);
 		const struct ip6_hdr* ip6 = (const struct ip6_hdr*)data;
 		rv->Assign(0, val_mgr->Count((ntohl(ip6->ip6_flow) & 0x0ff00000)>>20));
 		rv->Assign(1, val_mgr->Count(ntohl(ip6->ip6_flow) & 0x000fffff));
@@ -94,15 +67,16 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 		rv->Assign(5, make_intrusive<AddrVal>(IPAddr(ip6->ip6_src)));
 		rv->Assign(6, make_intrusive<AddrVal>(IPAddr(ip6->ip6_dst)));
 		if ( ! chain )
-			chain = new VectorVal(
-			    internal_type("ip6_ext_hdr_chain")->AsVectorType());
-		rv->Assign(7, chain);
+			chain = make_intrusive<VectorVal>(
+			    zeek::id::find_type<VectorType>("ip6_ext_hdr_chain"));
+		rv->Assign(7, std::move(chain));
 		}
 		break;
 
 	case IPPROTO_HOPOPTS:
 		{
-		rv = new RecordVal(hdrType(ip6_hopopts_type, "ip6_hopopts"));
+		static auto ip6_hopopts_type = zeek::id::find_type<RecordType>("ip6_hopopts");
+		rv = make_intrusive<RecordVal>(ip6_hopopts_type);
 		const struct ip6_hbh* hbh = (const struct ip6_hbh*)data;
 		rv->Assign(0, val_mgr->Count(hbh->ip6h_nxt));
 		rv->Assign(1, val_mgr->Count(hbh->ip6h_len));
@@ -114,7 +88,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 
 	case IPPROTO_DSTOPTS:
 		{
-		rv = new RecordVal(hdrType(ip6_dstopts_type, "ip6_dstopts"));
+		static auto ip6_dstopts_type = zeek::id::find_type<RecordType>("ip6_dstopts");
+		rv = make_intrusive<RecordVal>(ip6_dstopts_type);
 		const struct ip6_dest* dst = (const struct ip6_dest*)data;
 		rv->Assign(0, val_mgr->Count(dst->ip6d_nxt));
 		rv->Assign(1, val_mgr->Count(dst->ip6d_len));
@@ -125,7 +100,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 
 	case IPPROTO_ROUTING:
 		{
-		rv = new RecordVal(hdrType(ip6_routing_type, "ip6_routing"));
+		static auto ip6_routing_type = zeek::id::find_type<RecordType>("ip6_routing");
+		rv = make_intrusive<RecordVal>(ip6_routing_type);
 		const struct ip6_rthdr* rt = (const struct ip6_rthdr*)data;
 		rv->Assign(0, val_mgr->Count(rt->ip6r_nxt));
 		rv->Assign(1, val_mgr->Count(rt->ip6r_len));
@@ -138,7 +114,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 
 	case IPPROTO_FRAGMENT:
 		{
-		rv = new RecordVal(hdrType(ip6_fragment_type, "ip6_fragment"));
+		static auto ip6_fragment_type = zeek::id::find_type<RecordType>("ip6_fragment");
+		rv = make_intrusive<RecordVal>(ip6_fragment_type);
 		const struct ip6_frag* frag = (const struct ip6_frag*)data;
 		rv->Assign(0, val_mgr->Count(frag->ip6f_nxt));
 		rv->Assign(1, val_mgr->Count(frag->ip6f_reserved));
@@ -151,7 +128,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 
 	case IPPROTO_AH:
 		{
-		rv = new RecordVal(hdrType(ip6_ah_type, "ip6_ah"));
+		static auto ip6_ah_type = zeek::id::find_type<RecordType>("ip6_ah");
+		rv = make_intrusive<RecordVal>(ip6_ah_type);
 		rv->Assign(0, val_mgr->Count(((ip6_ext*)data)->ip6e_nxt));
 		rv->Assign(1, val_mgr->Count(((ip6_ext*)data)->ip6e_len));
 		rv->Assign(2, val_mgr->Count(ntohs(((uint16_t*)data)[1])));
@@ -170,7 +148,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 
 	case IPPROTO_ESP:
 		{
-		rv = new RecordVal(hdrType(ip6_esp_type, "ip6_esp"));
+		static auto ip6_esp_type = zeek::id::find_type<RecordType>("ip6_esp");
+		rv = make_intrusive<RecordVal>(ip6_esp_type);
 		const uint32_t* esp = (const uint32_t*)data;
 		rv->Assign(0, val_mgr->Count(ntohl(esp[0])));
 		rv->Assign(1, val_mgr->Count(ntohl(esp[1])));
@@ -180,7 +159,8 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 #ifdef ENABLE_MOBILE_IPV6
 	case IPPROTO_MOBILITY:
 		{
-		rv = new RecordVal(hdrType(ip6_mob_type, "ip6_mobility_hdr"));
+		static auto ip6_mob_type = zeek::id::find_type<RecordType>("ip6_mobility_hdr");
+		rv = make_intrusive<RecordVal>(ip6_mob_type);
 		const struct ip6_mobility* mob = (const struct ip6_mobility*) data;
 		rv->Assign(0, val_mgr->Count(mob->ip6mob_payload));
 		rv->Assign(1, val_mgr->Count(mob->ip6mob_len));
@@ -188,72 +168,82 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 		rv->Assign(3, val_mgr->Count(mob->ip6mob_rsv));
 		rv->Assign(4, val_mgr->Count(ntohs(mob->ip6mob_chksum)));
 
-		RecordVal* msg = new RecordVal(hdrType(ip6_mob_msg_type, "ip6_mobility_msg"));
+		static auto ip6_mob_msg_type = zeek::id::find_type<RecordType>("ip6_mobility_msg");
+		auto msg = make_intrusive<RecordVal>(ip6_mob_msg_type);
 		msg->Assign(0, val_mgr->Count(mob->ip6mob_type));
 
 		uint16_t off = sizeof(ip6_mobility);
 		const u_char* msg_data = data + off;
 
+		static auto ip6_mob_brr_type = zeek::id::find_type<RecordType>("ip6_mobility_brr");
+		static auto ip6_mob_hoti_type = zeek::id::find_type<RecordType>("ip6_mobility_hoti");
+		static auto ip6_mob_coti_type = zeek::id::find_type<RecordType>("ip6_mobility_coti");
+		static auto ip6_mob_hot_type = zeek::id::find_type<RecordType>("ip6_mobility_hot");
+		static auto ip6_mob_cot_type = zeek::id::find_type<RecordType>("ip6_mobility_cot");
+		static auto ip6_mob_bu_type = zeek::id::find_type<RecordType>("ip6_mobility_bu");
+		static auto ip6_mob_back_type = zeek::id::find_type<RecordType>("ip6_mobility_back");
+		static auto ip6_mob_be_type = zeek::id::find_type<RecordType>("ip6_mobility_be");
+
 		switch ( mob->ip6mob_type ) {
 		case 0:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_brr"));
+			auto m = make_intrusive<RecordVal>(ip6_mob_brr_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			off += sizeof(uint16_t);
 			m->Assign(1, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(1, m);
+			msg->Assign(1, std::move(m));
 			}
 			break;
 
 		case 1:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_hoti"));
+			auto m = make_intrusive<RecordVal>(ip6_mobility_hoti_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			off += sizeof(uint16_t) + sizeof(uint64_t);
 			m->Assign(2, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(2, m);
+			msg->Assign(2, std::move(m));
 			break;
 			}
 
 		case 2:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_coti"));
+			auto m = make_intrusive<RecordVal>(ip6_mobility_coti_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			off += sizeof(uint16_t) + sizeof(uint64_t);
 			m->Assign(2, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(3, m);
+			msg->Assign(3, std::move(m));
 			break;
 			}
 
 		case 3:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_hot"));
+			auto m = make_intrusive<RecordVal>(ip6_mobility_hot_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))));
 			off += sizeof(uint16_t) + 2 * sizeof(uint64_t);
 			m->Assign(3, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(4, m);
+			msg->Assign(4, std::move(m));
 			break;
 			}
 
 		case 4:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_cot"));
+			auto m = make_intrusive<RecordVal>(ip6_mobility_cot_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t))))));
 			m->Assign(2, val_mgr->Count(ntohll(*((uint64_t*)(msg_data + sizeof(uint16_t) + sizeof(uint64_t))))));
 			off += sizeof(uint16_t) + 2 * sizeof(uint64_t);
 			m->Assign(3, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(5, m);
+			msg->Assign(5, std::move(m));
 			break;
 			}
 
 		case 5:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_bu"));
+			auto m = make_intrusive<RecordVal>(ip6_mobility_bu_type);
 			m->Assign(0, val_mgr->Count(ntohs(*((uint16_t*)msg_data))));
 			m->Assign(1, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x8000));
 			m->Assign(2, val_mgr->Bool(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t)))) & 0x4000));
@@ -262,32 +252,32 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 			m->Assign(5, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
 			off += 3 * sizeof(uint16_t);
 			m->Assign(6, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(6, m);
+			msg->Assign(6, std::move(m));
 			break;
 			}
 
 		case 6:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_back"));
+			auto m = make_intrusive<RecordVal>(ip6_mobility_back_type);
 			m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data)));
 			m->Assign(1, val_mgr->Bool(*((uint8_t*)(msg_data + sizeof(uint8_t))) & 0x80));
 			m->Assign(2, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + sizeof(uint16_t))))));
 			m->Assign(3, val_mgr->Count(ntohs(*((uint16_t*)(msg_data + 2*sizeof(uint16_t))))));
 			off += 3 * sizeof(uint16_t);
 			m->Assign(4, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(7, m);
+			msg->Assign(7, std::move(m));
 			break;
 			}
 
 		case 7:
 			{
-			RecordVal* m = new RecordVal(hdrType(ip6_mob_brr_type, "ip6_mobility_be"));
+			auto m = make_intrusive<RecordVal>(ip6_mobility_be_type);
 			m->Assign(0, val_mgr->Count(*((uint8_t*)msg_data)));
 			const in6_addr* hoa = (const in6_addr*)(msg_data + sizeof(uint16_t));
 			m->Assign(1, make_intrusive<AddrVal>(IPAddr(*hoa)));
 			off += sizeof(uint16_t) + sizeof(in6_addr);
 			m->Assign(2, BuildOptionsVal(data + off, Length() - off));
-			msg->Assign(8, m);
+			msg->Assign(8, std::move(m));
 			break;
 			}
 
@@ -296,7 +286,7 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 			break;
 		}
 
-		rv->Assign(5, msg);
+		rv->Assign(5, std::move(msg));
 		}
 		break;
 #endif //ENABLE_MOBILE_IPV6
@@ -308,6 +298,14 @@ RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
 	return rv;
 	}
 
+IntrusivePtr<RecordVal> IPv6_Hdr::ToVal() const
+	{ return ToVal(nullptr); }
+
+RecordVal* IPv6_Hdr::BuildRecordVal(VectorVal* chain) const
+	{
+	return ToVal({AdoptRef{}, chain}).release();
+	}
+
 IPAddr IP_Hdr::IPHeaderSrcAddr() const
 	{
 	return ip4 ? IPAddr(ip4->ip_src) : IPAddr(ip6->ip6_src);
@@ -328,13 +326,14 @@ IPAddr IP_Hdr::DstAddr() const
 	return ip4 ? IPAddr(ip4->ip_dst) : ip6_hdrs->DstAddr();
 	}
 
-RecordVal* IP_Hdr::BuildIPHdrVal() const
+IntrusivePtr<RecordVal> IP_Hdr::ToIPHdrVal() const
 	{
-	RecordVal* rval = nullptr;
+	IntrusivePtr<RecordVal> rval;
 
 	if ( ip4 )
 		{
-		rval = new RecordVal(hdrType(ip4_hdr_type, "ip4_hdr"));
+		static auto ip4_hdr_type = zeek::id::find_type<RecordType>("ip4_hdr");
+		rval = make_intrusive<RecordVal>(ip4_hdr_type);
 		rval->Assign(0, val_mgr->Count(ip4->ip_hl * 4));
 		rval->Assign(1, val_mgr->Count(ip4->ip_tos));
 		rval->Assign(2, val_mgr->Count(ntohs(ip4->ip_len)));
@@ -346,40 +345,38 @@ RecordVal* IP_Hdr::BuildIPHdrVal() const
 		}
 	else
 		{
-		rval = ((*ip6_hdrs)[0])->BuildRecordVal(ip6_hdrs->BuildVal());
+		rval = ((*ip6_hdrs)[0])->ToVal(ip6_hdrs->ToVal());
 		}
 
 	return rval;
 	}
 
-RecordVal* IP_Hdr::BuildPktHdrVal() const
+RecordVal* IP_Hdr::BuildIPHdrVal() const
 	{
-	static RecordType* pkt_hdr_type = nullptr;
-
-	if ( ! pkt_hdr_type )
-		pkt_hdr_type = internal_type("pkt_hdr")->AsRecordType();
-
-	RecordVal* pkt_hdr = new RecordVal(pkt_hdr_type);
-	return BuildPktHdrVal(pkt_hdr, 0);
+	return ToIPHdrVal().release();
 	}
 
-RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
+IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal() const
 	{
-	static RecordType* tcp_hdr_type = nullptr;
-	static RecordType* udp_hdr_type = nullptr;
-	static RecordType* icmp_hdr_type = nullptr;
+	static auto pkt_hdr_type = zeek::id::find_type<RecordType>("pkt_hdr");
+	return ToPktHdrVal(make_intrusive<RecordVal>(pkt_hdr_type), 0);
+	}
 
-	if ( ! tcp_hdr_type )
-		{
-		tcp_hdr_type = internal_type("tcp_hdr")->AsRecordType();
-		udp_hdr_type = internal_type("udp_hdr")->AsRecordType();
-		icmp_hdr_type = internal_type("icmp_hdr")->AsRecordType();
-		}
+RecordVal* IP_Hdr::BuildPktHdrVal() const
+	{
+	return ToPktHdrVal().release();
+	}
+
+IntrusivePtr<RecordVal> IP_Hdr::ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int sindex) const
+	{
+	static auto tcp_hdr_type = zeek::id::find_type<RecordType>("tcp_hdr");
+	static auto udp_hdr_type = zeek::id::find_type<RecordType>("udp_hdr");
+	static auto icmp_hdr_type = zeek::id::find_type<RecordType>("icmp_hdr");
 
 	if ( ip4 )
-		pkt_hdr->Assign(sindex + 0, BuildIPHdrVal());
+		pkt_hdr->Assign(sindex + 0, ToIPHdrVal());
 	else
-		pkt_hdr->Assign(sindex + 1, BuildIPHdrVal());
+		pkt_hdr->Assign(sindex + 1, ToIPHdrVal());
 
 	// L4 header.
 	const u_char* data = Payload();
@@ -389,7 +386,7 @@ RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
 	case IPPROTO_TCP:
 		{
 		const struct tcphdr* tp = (const struct tcphdr*) data;
-		RecordVal* tcp_hdr = new RecordVal(tcp_hdr_type);
+		auto tcp_hdr = make_intrusive<RecordVal>(tcp_hdr_type);
 
 		int tcp_hdr_len = tp->th_off * 4;
 		int data_len = PayloadLen() - tcp_hdr_len;
@@ -404,42 +401,42 @@ RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
 		tcp_hdr->Assign(7, val_mgr->Count(tp->th_flags));
 		tcp_hdr->Assign(8, val_mgr->Count(ntohs(tp->th_win)));
 
-		pkt_hdr->Assign(sindex + 2, tcp_hdr);
+		pkt_hdr->Assign(sindex + 2, std::move(tcp_hdr));
 		break;
 		}
 
 	case IPPROTO_UDP:
 		{
 		const struct udphdr* up = (const struct udphdr*) data;
-		RecordVal* udp_hdr = new RecordVal(udp_hdr_type);
+		auto udp_hdr = make_intrusive<RecordVal>(udp_hdr_type);
 
 		udp_hdr->Assign(0, val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP));
 		udp_hdr->Assign(1, val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP));
 		udp_hdr->Assign(2, val_mgr->Count(ntohs(up->uh_ulen)));
 
-		pkt_hdr->Assign(sindex + 3, udp_hdr);
+		pkt_hdr->Assign(sindex + 3, std::move(udp_hdr));
 		break;
 		}
 
 	case IPPROTO_ICMP:
 		{
 		const struct icmp* icmpp = (const struct icmp *) data;
-		RecordVal* icmp_hdr = new RecordVal(icmp_hdr_type);
+		auto icmp_hdr = make_intrusive<RecordVal>(icmp_hdr_type);
 
 		icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp_type));
 
-		pkt_hdr->Assign(sindex + 4, icmp_hdr);
+		pkt_hdr->Assign(sindex + 4, std::move(icmp_hdr));
 		break;
 		}
 
 	case IPPROTO_ICMPV6:
 		{
 		const struct icmp6_hdr* icmpp = (const struct icmp6_hdr*) data;
-		RecordVal* icmp_hdr = new RecordVal(icmp_hdr_type);
+		auto icmp_hdr = make_intrusive<RecordVal>(icmp_hdr_type);
 
 		icmp_hdr->Assign(0, val_mgr->Count(icmpp->icmp6_type));
 
-		pkt_hdr->Assign(sindex + 4, icmp_hdr);
+		pkt_hdr->Assign(sindex + 4, std::move(icmp_hdr));
 		break;
 		}
 
@@ -453,6 +450,11 @@ RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
 	return pkt_hdr;
 	}
 
+RecordVal* IP_Hdr::BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const
+	{
+	return ToPktHdrVal({AdoptRef{}, pkt_hdr}, sindex).release();
+	}
+
 static inline bool isIPv6ExtHeader(uint8_t type)
 	{
 	switch (type) {
@@ -674,66 +676,65 @@ void IPv6_Hdr_Chain::ProcessDstOpts(const struct ip6_dest* d, uint16_t len)
 	}
 #endif
 
-VectorVal* IPv6_Hdr_Chain::BuildVal() const
+IntrusivePtr<VectorVal> IPv6_Hdr_Chain::ToVal() const
 	{
-	if ( ! ip6_ext_hdr_type )
-		{
-		ip6_ext_hdr_type = internal_type("ip6_ext_hdr")->AsRecordType();
-		ip6_hopopts_type = internal_type("ip6_hopopts")->AsRecordType();
-		ip6_dstopts_type = internal_type("ip6_dstopts")->AsRecordType();
-		ip6_routing_type = internal_type("ip6_routing")->AsRecordType();
-		ip6_fragment_type = internal_type("ip6_fragment")->AsRecordType();
-		ip6_ah_type = internal_type("ip6_ah")->AsRecordType();
-		ip6_esp_type = internal_type("ip6_esp")->AsRecordType();
-		ip6_mob_type = internal_type("ip6_mobility_hdr")->AsRecordType();
-		}
-
-	VectorVal* rval = new VectorVal(
-	    internal_type("ip6_ext_hdr_chain")->AsVectorType());
+	static auto ip6_ext_hdr_type = zeek::id::find_type<RecordType>("ip6_ext_hdr");
+	static auto ip6_hopopts_type = zeek::id::find_type<RecordType>("ip6_hopopts");
+	static auto ip6_dstopts_type = zeek::id::find_type<RecordType>("ip6_dstopts");
+	static auto ip6_routing_type = zeek::id::find_type<RecordType>("ip6_routing");
+	static auto ip6_fragment_type = zeek::id::find_type<RecordType>("ip6_fragment");
+	static auto ip6_ah_type = zeek::id::find_type<RecordType>("ip6_ah");
+	static auto ip6_esp_type = zeek::id::find_type<RecordType>("ip6_esp");
+	static auto ip6_ext_hdr_chain_type = zeek::id::find_type<VectorType>("ip6_ext_hdr_chain");
+	auto rval = make_intrusive<VectorVal>(ip6_ext_hdr_chain_type);
 
 	for ( size_t i = 1; i < chain.size(); ++i )
 		{
-		RecordVal* v = chain[i]->BuildRecordVal();
-		RecordVal* ext_hdr = new RecordVal(ip6_ext_hdr_type);
+		auto v = chain[i]->ToVal();
+		auto ext_hdr = make_intrusive<RecordVal>(ip6_ext_hdr_type);
 		uint8_t type = chain[i]->Type();
 		ext_hdr->Assign(0, val_mgr->Count(type));
 
 		switch (type) {
 		case IPPROTO_HOPOPTS:
-			ext_hdr->Assign(1, v);
+			ext_hdr->Assign(1, std::move(v));
 			break;
 		case IPPROTO_DSTOPTS:
-			ext_hdr->Assign(2, v);
+			ext_hdr->Assign(2, std::move(v));
 			break;
 		case IPPROTO_ROUTING:
-			ext_hdr->Assign(3, v);
+			ext_hdr->Assign(3, std::move(v));
 			break;
 		case IPPROTO_FRAGMENT:
-			ext_hdr->Assign(4, v);
+			ext_hdr->Assign(4, std::move(v));
 			break;
 		case IPPROTO_AH:
-			ext_hdr->Assign(5, v);
+			ext_hdr->Assign(5, std::move(v));
 			break;
 		case IPPROTO_ESP:
-			ext_hdr->Assign(6, v);
+			ext_hdr->Assign(6, std::move(v));
 			break;
 #ifdef ENABLE_MOBILE_IPV6
 		case IPPROTO_MOBILITY:
-			ext_hdr->Assign(7, v);
+			ext_hdr->Assign(7, std::move(v));
 			break;
 #endif
 		default:
 			reporter->InternalWarning("IPv6_Hdr_Chain bad header %d", type);
-			Unref(ext_hdr);
 			continue;
 		}
 
-		rval->Assign(rval->Size(), ext_hdr);
+		rval->Assign(rval->Size(), std::move(ext_hdr));
 		}
 
 	return rval;
 	}
 
+VectorVal* IPv6_Hdr_Chain::BuildVal() const
+	{
+	return ToVal().release();
+	}
+
 IP_Hdr* IP_Hdr::Copy() const
 	{
 	char* new_hdr = new char[HdrLen()];
diff --git a/src/IP.h b/src/IP.h
index bb62d30b04..3bb1a6c897 100644
--- a/src/IP.h
+++ b/src/IP.h
@@ -14,6 +14,8 @@
 
 #include <vector>
 
+#include "IntrusivePtr.h"
+
 class IPAddr;
 class RecordVal;
 class VectorVal;
@@ -134,6 +136,10 @@ public:
 	/**
 	 * Returns the script-layer record representation of the header.
 	 */
+	IntrusivePtr<RecordVal> ToVal(IntrusivePtr<VectorVal> chain) const;
+	IntrusivePtr<RecordVal> ToVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
 	RecordVal* BuildRecordVal(VectorVal* chain = nullptr) const;
 
 protected:
@@ -223,6 +229,9 @@ public:
 	 * Returns a vector of ip6_ext_hdr RecordVals that includes script-layer
 	 * representation of all extension headers in the chain.
 	 */
+	IntrusivePtr<VectorVal> ToVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
 	VectorVal* BuildVal() const;
 
 protected:
@@ -517,18 +526,27 @@ public:
 	/**
 	 * Returns an ip_hdr or ip6_hdr_chain RecordVal.
 	 */
+	IntrusivePtr<RecordVal> ToIPHdrVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToIPHdrVal() instead.")]]
 	RecordVal* BuildIPHdrVal() const;
 
 	/**
 	 * Returns a pkt_hdr RecordVal, which includes not only the IP header, but
 	 * also upper-layer (tcp/udp/icmp) headers.
 	 */
+	IntrusivePtr<RecordVal> ToPktHdrVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToPktHdrVal() instead.")]]
 	RecordVal* BuildPktHdrVal() const;
 
 	/**
 	 * Same as above, but simply add our values into the record at the
 	 * specified starting index.
 	 */
+	IntrusivePtr<RecordVal> ToPktHdrVal(IntrusivePtr<RecordVal> pkt_hdr, int sindex) const;
+
+	[[deprecated("Remove in v4.1.  Use ToPktHdrVal() instead.")]]
 	RecordVal* BuildPktHdrVal(RecordVal* pkt_hdr, int sindex) const;
 
 private:
diff --git a/src/IPAddr.cc b/src/IPAddr.cc
index f097307daf..4db211da02 100644
--- a/src/IPAddr.cc
+++ b/src/IPAddr.cc
@@ -53,8 +53,11 @@ IPAddr::IPAddr(const BroString& s)
 	}
 
 HashKey* IPAddr::GetHashKey() const
+	{ return MakeHashKey().release(); }
+
+std::unique_ptr<HashKey> IPAddr::MakeHashKey() const
 	{
-	return new HashKey((void*)in6.s6_addr, sizeof(in6.s6_addr));
+	return std::make_unique<HashKey>((void*)in6.s6_addr, sizeof(in6.s6_addr));
 	}
 
 static inline uint32_t bit_mask32(int bottom_bits)
@@ -303,6 +306,9 @@ std::string IPPrefix::AsString() const
 	}
 
 HashKey* IPPrefix::GetHashKey() const
+	{ return MakeHashKey().release(); }
+
+std::unique_ptr<HashKey> IPPrefix::MakeHashKey() const
 	{
 	struct {
 		in6_addr ip;
@@ -312,7 +318,7 @@ HashKey* IPPrefix::GetHashKey() const
 	key.ip = prefix.in6;
 	key.len = Length();
 
-	return new HashKey(&key, sizeof(key));
+	return std::make_unique<HashKey>(&key, sizeof(key));
 	}
 
 bool IPPrefix::ConvertString(const char* text, IPPrefix* result)
diff --git a/src/IPAddr.h b/src/IPAddr.h
index 6fb5a124dc..a945c8b53f 100644
--- a/src/IPAddr.h
+++ b/src/IPAddr.h
@@ -6,6 +6,7 @@
 #include <arpa/inet.h>
 #include <string.h>
 #include <string>
+#include <memory>
 
 #include "threading/SerialTypes.h"
 
@@ -247,9 +248,11 @@ public:
 		}
 
 	/**
-	 * Returns a key that can be used to lookup the IP Address in a hash
-	 * table. Passes ownership to caller.
+	 * Returns a key that can be used to lookup the IP Address in a hash table.
 	 */
+	std::unique_ptr<HashKey> MakeHashKey() const;
+
+	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
 	HashKey* GetHashKey() const;
 
 	/**
@@ -629,9 +632,11 @@ public:
 	operator std::string() const	{ return AsString(); }
 
 	/**
-	 * Returns a key that can be used to lookup the IP Prefix in a hash
-	 * table. Passes ownership to caller.
+	 * Returns a key that can be used to lookup the IP Prefix in a hash table.
 	 */
+	std::unique_ptr<HashKey> MakeHashKey() const;
+
+	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
 	HashKey* GetHashKey() const;
 
 	/** Converts the prefix into the type used internally by the
diff --git a/src/IntrusivePtr.h b/src/IntrusivePtr.h
index b6c273a3ff..6f09bd86cd 100644
--- a/src/IntrusivePtr.h
+++ b/src/IntrusivePtr.h
@@ -184,6 +184,18 @@ IntrusivePtr<T> make_intrusive(Ts&&... args)
 	return {AdoptRef{}, new T(std::forward<Ts>(args)...)};
 	}
 
+/**
+ * Casts an @c IntrusivePtr object to another by way of static_cast on
+ * the underlying pointer.
+ * @param p  The pointer of type @c U to cast to another type, @c T.
+ * @return  The pointer, as cast to type @c T.
+ */
+template <class T, class U>
+IntrusivePtr<T> cast_intrusive(IntrusivePtr<U> p) noexcept
+	{
+	return {AdoptRef{}, static_cast<T*>(p.release())};
+	}
+
 // -- comparison to nullptr ----------------------------------------------------
 
 /**
diff --git a/src/Net.cc b/src/Net.cc
index faac9e569a..d7d6f59a14 100644
--- a/src/Net.cc
+++ b/src/Net.cc
@@ -28,7 +28,7 @@ extern "C" {
 #include "Sessions.h"
 #include "Event.h"
 #include "Timer.h"
-#include "Var.h"
+#include "ID.h"
 #include "Reporter.h"
 #include "Scope.h"
 #include "Anon.h"
@@ -193,7 +193,7 @@ void net_init(const std::optional<std::string>& interface,
 			reporter->FatalError("problem opening dump file %s (%s)",
 					     writefile, pkt_dumper->ErrorMsg());
 
-		if ( ID* id = global_scope()->Lookup("trace_output_file") )
+		if ( const auto& id = global_scope()->Find("trace_output_file") )
 			id->SetVal(make_intrusive<StringVal>(writefile));
 		else
 			reporter->Error("trace_output_file not defined in bro.init");
@@ -283,7 +283,7 @@ void net_run()
 	ready.reserve(iosource_mgr->TotalSize());
 
 	while ( iosource_mgr->Size() ||
-		(BifConst::exit_only_after_terminate && ! terminating) )
+		(zeek::BifConst::exit_only_after_terminate && ! terminating) )
 		{
 		iosource_mgr->FindReadySources(&ready);
 
@@ -314,8 +314,8 @@ void net_run()
 				}
 			}
 		else if ( (have_pending_timers || communication_enabled ||
-		           BifConst::exit_only_after_terminate) &&
-			  ! pseudo_realtime )
+		           zeek::BifConst::exit_only_after_terminate) &&
+		          ! pseudo_realtime )
 			{
 			// Take advantage of the lull to get up to
 			// date on timers and events.  Because we only
@@ -331,6 +331,8 @@ void net_run()
 		current_dispatched = 0;
 		current_iosrc = nullptr;
 
+		extern int signal_val;
+
 		if ( signal_val == SIGTERM || signal_val == SIGINT )
 			// We received a signal while processing the
 			// current packet and its related events.
diff --git a/src/NetVar.cc b/src/NetVar.cc
index cb604c75ba..535350b4eb 100644
--- a/src/NetVar.cc
+++ b/src/NetVar.cc
@@ -6,6 +6,7 @@
 #include "Var.h"
 #include "EventHandler.h"
 #include "Val.h"
+#include "ID.h"
 
 RecordType* conn_id;
 RecordType* endpoint;
@@ -83,14 +84,6 @@ bool udp_content_delivery_ports_use_resp;
 double dns_session_timeout;
 double rpc_timeout;
 
-ListVal* skip_authentication;
-ListVal* direct_login_prompts;
-ListVal* login_prompts;
-ListVal* login_non_failure_msgs;
-ListVal* login_failure_msgs;
-ListVal* login_success_msgs;
-ListVal* login_timeouts;
-
 int mime_segment_length;
 int mime_segment_overlap_length;
 RecordType* mime_header_rec;
@@ -156,8 +149,6 @@ Val* pkt_profile_file;
 
 int load_sample_freq;
 
-double gap_report_freq;
-
 int packet_filter_default;
 
 int sig_max_group_size;
@@ -175,8 +166,6 @@ TableVal* likely_server_ports;
 
 int check_for_unused_event_handlers;
 
-int suppress_local_output;
-
 double timer_mgr_inactivity_timeout;
 
 StringVal* trace_output_file;
@@ -209,37 +198,18 @@ void init_event_handlers()
 
 void init_general_global_var()
 	{
-	table_expire_interval = opt_internal_double("table_expire_interval");
-	table_expire_delay = opt_internal_double("table_expire_delay");
-	table_incremental_step = opt_internal_int("table_incremental_step");
-
-	rotate_info = internal_type("rotate_info")->AsRecordType();
-	log_rotate_base_time = opt_internal_string("log_rotate_base_time");
-
-	peer_description =
-		internal_val("peer_description")->AsStringVal();
-
-	packet_filter_default = opt_internal_int("packet_filter_default");
-
-	sig_max_group_size = opt_internal_int("sig_max_group_size");
-
-	check_for_unused_event_handlers =
-		opt_internal_int("check_for_unused_event_handlers");
-
-	suppress_local_output = opt_internal_int("suppress_local_output");
-
-	trace_output_file = internal_val("trace_output_file")->AsStringVal();
-
-	record_all_packets = opt_internal_int("record_all_packets");
-
-	cmd_line_bpf_filter =
-		internal_val("cmd_line_bpf_filter")->AsStringVal();
-
-	global_hash_seed = opt_internal_string("global_hash_seed");
-
-	bits_per_uid = opt_internal_unsigned("bits_per_uid");
+	table_expire_interval = zeek::id::find_val("table_expire_interval")->AsInterval();
+	table_expire_delay = zeek::id::find_val("table_expire_delay")->AsInterval();
+	table_incremental_step = zeek::id::find_val("table_incremental_step")->AsCount();
+	packet_filter_default = zeek::id::find_val("packet_filter_default")->AsBool();
+	sig_max_group_size = zeek::id::find_val("sig_max_group_size")->AsCount();
+	check_for_unused_event_handlers = zeek::id::find_val("check_for_unused_event_handlers")->AsBool();
+	record_all_packets = zeek::id::find_val("record_all_packets")->AsBool();
+	bits_per_uid = zeek::id::find_val("bits_per_uid")->AsCount();
 	}
 
+extern void zeek_legacy_netvar_init();
+
 void init_net_var()
 	{
 #include "const.bif.netvar_init"
@@ -247,188 +217,105 @@ void init_net_var()
 #include "reporter.bif.netvar_init"
 #include "supervisor.bif.netvar_init"
 
-	conn_id = internal_type("conn_id")->AsRecordType();
-	endpoint = internal_type("endpoint")->AsRecordType();
-	endpoint_stats = internal_type("endpoint_stats")->AsRecordType();
-	connection_type = internal_type("connection")->AsRecordType();
-	fa_file_type = internal_type("fa_file")->AsRecordType();
-	fa_metadata_type = internal_type("fa_metadata")->AsRecordType();
-	icmp_conn = internal_type("icmp_conn")->AsRecordType();
-	icmp_context = internal_type("icmp_context")->AsRecordType();
-	signature_state = internal_type("signature_state")->AsRecordType();
-	SYN_packet = internal_type("SYN_packet")->AsRecordType();
-	pcap_packet = internal_type("pcap_packet")->AsRecordType();
-	raw_pkt_hdr_type = internal_type("raw_pkt_hdr")->AsRecordType();
-	l2_hdr_type = internal_type("l2_hdr")->AsRecordType();
-	transport_proto = internal_type("transport_proto")->AsEnumType();
-	string_set = internal_type("string_set")->AsTableType();
-	string_array = internal_type("string_array")->AsTableType();
-	string_vec = internal_type("string_vec")->AsVectorType();
-	index_vec = internal_type("index_vec")->AsVectorType();
-	mime_match = internal_type("mime_match")->AsRecordType();
-	mime_matches = internal_type("mime_matches")->AsVectorType();
+	zeek::id::detail::init();
+	zeek_legacy_netvar_init();
 
-	ignore_checksums = opt_internal_int("ignore_checksums");
-	partial_connection_ok = opt_internal_int("partial_connection_ok");
-	tcp_SYN_ack_ok = opt_internal_int("tcp_SYN_ack_ok");
-	tcp_match_undelivered = opt_internal_int("tcp_match_undelivered");
+	ignore_checksums = zeek::id::find_val("ignore_checksums")->AsBool();
+	partial_connection_ok = zeek::id::find_val("partial_connection_ok")->AsBool();
+	tcp_SYN_ack_ok = zeek::id::find_val("tcp_SYN_ack_ok")->AsBool();
+	tcp_match_undelivered = zeek::id::find_val("tcp_match_undelivered")->AsBool();
 
-	encap_hdr_size = opt_internal_int("encap_hdr_size");
+	encap_hdr_size = zeek::id::find_val("encap_hdr_size")->AsCount();
 
-	frag_timeout = opt_internal_double("frag_timeout");
+	frag_timeout = zeek::id::find_val("frag_timeout")->AsInterval();
 
-	tcp_SYN_timeout = opt_internal_double("tcp_SYN_timeout");
-	tcp_session_timer = opt_internal_double("tcp_session_timer");
-	tcp_connection_linger = opt_internal_double("tcp_connection_linger");
-	tcp_attempt_delay = opt_internal_double("tcp_attempt_delay");
-	tcp_close_delay = opt_internal_double("tcp_close_delay");
-	tcp_reset_delay = opt_internal_double("tcp_reset_delay");
-	tcp_partial_close_delay = opt_internal_double("tcp_partial_close_delay");
+	tcp_SYN_timeout = zeek::id::find_val("tcp_SYN_timeout")->AsInterval();
+	tcp_session_timer = zeek::id::find_val("tcp_session_timer")->AsInterval();
+	tcp_connection_linger = zeek::id::find_val("tcp_connection_linger")->AsInterval();
+	tcp_attempt_delay = zeek::id::find_val("tcp_attempt_delay")->AsInterval();
+	tcp_close_delay = zeek::id::find_val("tcp_close_delay")->AsInterval();
+	tcp_reset_delay = zeek::id::find_val("tcp_reset_delay")->AsInterval();
+	tcp_partial_close_delay = zeek::id::find_val("tcp_partial_close_delay")->AsInterval();
 
-	tcp_max_initial_window = opt_internal_int("tcp_max_initial_window");
-	tcp_max_above_hole_without_any_acks =
-		opt_internal_int("tcp_max_above_hole_without_any_acks");
-	tcp_excessive_data_without_further_acks =
-		opt_internal_int("tcp_excessive_data_without_further_acks");
-	tcp_max_old_segments = opt_internal_int("tcp_max_old_segments");
+	tcp_max_initial_window = zeek::id::find_val("tcp_max_initial_window")->AsCount();
+	tcp_max_above_hole_without_any_acks = zeek::id::find_val("tcp_max_above_hole_without_any_acks")->AsCount();
+	tcp_excessive_data_without_further_acks = zeek::id::find_val("tcp_excessive_data_without_further_acks")->AsCount();
+	tcp_max_old_segments = zeek::id::find_val("tcp_max_old_segments")->AsCount();
 
-	socks_address = internal_type("SOCKS::Address")->AsRecordType();
+	non_analyzed_lifetime = zeek::id::find_val("non_analyzed_lifetime")->AsInterval();
+	tcp_inactivity_timeout = zeek::id::find_val("tcp_inactivity_timeout")->AsInterval();
+	udp_inactivity_timeout = zeek::id::find_val("udp_inactivity_timeout")->AsInterval();
+	icmp_inactivity_timeout = zeek::id::find_val("icmp_inactivity_timeout")->AsInterval();
 
-	non_analyzed_lifetime = opt_internal_double("non_analyzed_lifetime");
-	tcp_inactivity_timeout = opt_internal_double("tcp_inactivity_timeout");
-	udp_inactivity_timeout = opt_internal_double("udp_inactivity_timeout");
-	icmp_inactivity_timeout = opt_internal_double("icmp_inactivity_timeout");
+	tcp_storm_thresh = zeek::id::find_val("tcp_storm_thresh")->AsCount();
+	tcp_storm_interarrival_thresh = zeek::id::find_val("tcp_storm_interarrival_thresh")->AsInterval();
 
-	tcp_storm_thresh = opt_internal_int("tcp_storm_thresh");
-	tcp_storm_interarrival_thresh =
-		opt_internal_double("tcp_storm_interarrival_thresh");
-
-	tcp_reassembler_ports_orig =
-		internal_val("tcp_reassembler_ports_orig")->AsTableVal();
-	tcp_reassembler_ports_resp =
-		internal_val("tcp_reassembler_ports_resp")->AsTableVal();
-
-	tcp_content_delivery_ports_orig =
-		internal_val("tcp_content_delivery_ports_orig")->AsTableVal();
-	tcp_content_delivery_ports_resp =
-		internal_val("tcp_content_delivery_ports_resp")->AsTableVal();
 	tcp_content_deliver_all_orig =
-		bool(internal_val("tcp_content_deliver_all_orig")->AsBool());
+		bool(zeek::id::find_val("tcp_content_deliver_all_orig")->AsBool());
 	tcp_content_deliver_all_resp =
-		bool(internal_val("tcp_content_deliver_all_resp")->AsBool());
+		bool(zeek::id::find_val("tcp_content_deliver_all_resp")->AsBool());
 
-	udp_content_delivery_ports_orig =
-		internal_val("udp_content_delivery_ports_orig")->AsTableVal();
-	udp_content_delivery_ports_resp =
-		internal_val("udp_content_delivery_ports_resp")->AsTableVal();
-	udp_content_ports =
-		internal_val("udp_content_ports")->AsTableVal();
 	udp_content_deliver_all_orig =
-		bool(internal_val("udp_content_deliver_all_orig")->AsBool());
+		bool(zeek::id::find_val("udp_content_deliver_all_orig")->AsBool());
 	udp_content_deliver_all_resp =
-		bool(internal_val("udp_content_deliver_all_resp")->AsBool());
+		bool(zeek::id::find_val("udp_content_deliver_all_resp")->AsBool());
 	udp_content_delivery_ports_use_resp =
-		bool(internal_val("udp_content_delivery_ports_use_resp")->AsBool());
+		bool(zeek::id::find_val("udp_content_delivery_ports_use_resp")->AsBool());
 
-	dns_session_timeout = opt_internal_double("dns_session_timeout");
-	rpc_timeout = opt_internal_double("rpc_timeout");
+	dns_session_timeout = zeek::id::find_val("dns_session_timeout")->AsInterval();
+	rpc_timeout = zeek::id::find_val("rpc_timeout")->AsInterval();
 
-	watchdog_interval = int(opt_internal_double("watchdog_interval"));
+	watchdog_interval = int(zeek::id::find_val("watchdog_interval")->AsInterval());
 
-	max_timer_expires = opt_internal_int("max_timer_expires");
+	max_timer_expires = zeek::id::find_val("max_timer_expires")->AsCount();
 
-	skip_authentication = internal_list_val("skip_authentication");
-	direct_login_prompts = internal_list_val("direct_login_prompts");
-	login_prompts = internal_list_val("login_prompts");
-	login_non_failure_msgs = internal_list_val("login_non_failure_msgs");
-	login_failure_msgs = internal_list_val("login_failure_msgs");
-	login_success_msgs = internal_list_val("login_success_msgs");
-	login_timeouts = internal_list_val("login_timeouts");
+	mime_segment_length = zeek::id::find_val("mime_segment_length")->AsCount();
+	mime_segment_overlap_length = zeek::id::find_val("mime_segment_overlap_length")->AsCount();
 
-	mime_segment_length = opt_internal_int("mime_segment_length");
-	mime_segment_overlap_length = opt_internal_int("mime_segment_overlap_length");
-	mime_header_rec = internal_type("mime_header_rec")->AsRecordType();
-	mime_header_list = internal_type("mime_header_list")->AsTableType();
+	http_entity_data_delivery_size = zeek::id::find_val("http_entity_data_delivery_size")->AsCount();
+	truncate_http_URI = zeek::id::find_val("truncate_http_URI")->AsInt();
 
-	http_entity_data_delivery_size = opt_internal_int("http_entity_data_delivery_size");
-	http_stats_rec = internal_type("http_stats_rec")->AsRecordType();
-	http_message_stat = internal_type("http_message_stat")->AsRecordType();
-	truncate_http_URI = opt_internal_int("truncate_http_URI");
+	dns_skip_all_auth = zeek::id::find_val("dns_skip_all_auth")->AsBool();
+	dns_skip_all_addl = zeek::id::find_val("dns_skip_all_addl")->AsBool();
+	dns_max_queries = zeek::id::find_val("dns_max_queries")->AsCount();
 
-	pm_mapping = internal_type("pm_mapping")->AsRecordType();
-	pm_mappings = internal_type("pm_mappings")->AsTableType();
-	pm_port_request = internal_type("pm_port_request")->AsRecordType();
-	pm_callit_request = internal_type("pm_callit_request")->AsRecordType();
+	stp_delta = 0.0;
+	if ( const auto& v = zeek::id::find_val("stp_delta") ) stp_delta = v->AsInterval();
+	stp_idle_min = 0.0;
+	if ( const auto& v = zeek::id::find_val("stp_idle_min") ) stp_delta = v->AsInterval();
 
-	geo_location = internal_type("geo_location")->AsRecordType();
+	orig_addr_anonymization = 0;
+	if ( const auto& id = zeek::id::find("orig_addr_anonymization") )
+		if ( const auto& v = id->GetVal() )
+			orig_addr_anonymization = v->AsInt();
+	resp_addr_anonymization = 0;
+	if ( const auto& id = zeek::id::find("resp_addr_anonymization") )
+		if ( const auto& v = id->GetVal() )
+			resp_addr_anonymization = v->AsInt();
+	other_addr_anonymization = 0;
+	if ( const auto& id = zeek::id::find("other_addr_anonymization") )
+		if ( const auto& v = id->GetVal() )
+			other_addr_anonymization = v->AsInt();
 
-	entropy_test_result = internal_type("entropy_test_result")->AsRecordType();
+	connection_status_update_interval = 0.0;
+	if ( const auto& id = zeek::id::find("connection_status_update_interval") )
+		if ( const auto& v = id->GetVal() )
+			connection_status_update_interval = v->AsInterval();
 
-	dns_msg = internal_type("dns_msg")->AsRecordType();
-	dns_answer = internal_type("dns_answer")->AsRecordType();
-	dns_soa = internal_type("dns_soa")->AsRecordType();
-	dns_edns_additional =
-		internal_type("dns_edns_additional")->AsRecordType();
-	dns_tsig_additional =
-		internal_type("dns_tsig_additional")->AsRecordType();
-	dns_rrsig_rr = internal_type("dns_rrsig_rr")->AsRecordType();
-	dns_dnskey_rr = internal_type("dns_dnskey_rr")->AsRecordType();
-	dns_nsec3_rr = internal_type("dns_nsec3_rr")->AsRecordType();
-	dns_ds_rr = internal_type("dns_ds_rr")->AsRecordType();
-	dns_skip_auth = internal_val("dns_skip_auth")->AsTableVal();
-	dns_skip_addl = internal_val("dns_skip_addl")->AsTableVal();
-	dns_skip_all_auth = opt_internal_int("dns_skip_all_auth");
-	dns_skip_all_addl = opt_internal_int("dns_skip_all_addl");
-	dns_max_queries = opt_internal_int("dns_max_queries");
+	expensive_profiling_multiple = zeek::id::find_val("expensive_profiling_multiple")->AsCount();
+	profiling_interval = zeek::id::find_val("profiling_interval")->AsInterval();
+	segment_profiling = zeek::id::find_val("segment_profiling")->AsBool();
 
-	stp_delta = opt_internal_double("stp_delta");
-	stp_idle_min = opt_internal_double("stp_idle_min");
-	stp_skip_src = internal_val("stp_skip_src")->AsTableVal();
+	pkt_profile_mode = zeek::id::find_val("pkt_profile_mode")->InternalInt();
+	pkt_profile_freq = zeek::id::find_val("pkt_profile_freq")->AsDouble();
 
-	orig_addr_anonymization = opt_internal_int("orig_addr_anonymization");
-	resp_addr_anonymization = opt_internal_int("resp_addr_anonymization");
-	other_addr_anonymization = opt_internal_int("other_addr_anonymization");
+	load_sample_freq = zeek::id::find_val("load_sample_freq")->AsCount();
 
-	preserve_orig_addr = opt_internal_table("preserve_orig_addr");
-	preserve_resp_addr = opt_internal_table("preserve_resp_addr");
-	preserve_other_addr = opt_internal_table("preserve_other_addr");
+	dpd_reassemble_first_packets = zeek::id::find_val("dpd_reassemble_first_packets")->AsBool();
+	dpd_buffer_size = zeek::id::find_val("dpd_buffer_size")->AsCount();
+	dpd_match_only_beginning = zeek::id::find_val("dpd_match_only_beginning")->AsBool();
+	dpd_late_match_stop = zeek::id::find_val("dpd_late_match_stop")->AsBool();
+	dpd_ignore_ports = zeek::id::find_val("dpd_ignore_ports")->AsBool();
 
-	connection_status_update_interval =
-		opt_internal_double("connection_status_update_interval");
-
-	profiling_file = internal_val("profiling_file");
-	expensive_profiling_multiple =
-		opt_internal_int("expensive_profiling_multiple");
-	profiling_interval = opt_internal_double("profiling_interval");
-	segment_profiling = opt_internal_int("segment_profiling");
-
-	pkt_profile_mode = opt_internal_int("pkt_profile_mode");
-	pkt_profile_freq = opt_internal_double("pkt_profile_freq");
-	pkt_profile_file = opt_internal_val("pkt_profile_file");
-
-	load_sample_freq = opt_internal_int("load_sample_freq");
-
-	gap_report_freq = opt_internal_double("gap_report_freq");
-
-	irc_join_info = internal_type("irc_join_info")->AsRecordType();
-	irc_join_list = internal_type("irc_join_list")->AsTableType();
-
-	dpd_reassemble_first_packets =
-		opt_internal_int("dpd_reassemble_first_packets");
-	dpd_buffer_size = opt_internal_int("dpd_buffer_size");
-	dpd_match_only_beginning = opt_internal_int("dpd_match_only_beginning");
-	dpd_late_match_stop = opt_internal_int("dpd_late_match_stop");
-	dpd_ignore_ports = opt_internal_int("dpd_ignore_ports");
-
-	likely_server_ports = internal_val("likely_server_ports")->AsTableVal();
-
-	timer_mgr_inactivity_timeout =
-		opt_internal_double("timer_mgr_inactivity_timeout");
-
-	script_id = internal_type("script_id")->AsRecordType();
-	id_table = internal_type("id_table")->AsTableType();
-	record_field = internal_type("record_field")->AsRecordType();
-	record_field_table = internal_type("record_field_table")->AsTableType();
-	call_argument_vector = internal_type("call_argument_vector")->AsVectorType();
-	call_argument = internal_type("call_argument")->AsRecordType();
+	timer_mgr_inactivity_timeout = zeek::id::find_val("timer_mgr_inactivity_timeout")->AsInterval();
 	}
diff --git a/src/NetVar.h b/src/NetVar.h
index 07b1b92f10..a9d286d0f0 100644
--- a/src/NetVar.h
+++ b/src/NetVar.h
@@ -7,26 +7,47 @@
 #include "EventRegistry.h"
 #include "Stats.h"
 
+[[deprecated("Remove in v4.1.  Use zeek::id::conn_id.")]]
 extern RecordType* conn_id;
+[[deprecated("Remove in v4.1.  Use zeek::id::endpoint.")]]
 extern RecordType* endpoint;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* endpoint_stats;
+[[deprecated("Remove in v4.1.  Use zeek::id::connection.")]]
 extern RecordType* connection_type;
+[[deprecated("Remove in v4.1.  Use zeek::id::fa_file.")]]
 extern RecordType* fa_file_type;
+[[deprecated("Remove in v4.1.  Use zeek::id::fa_metadata.")]]
 extern RecordType* fa_metadata_type;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* icmp_conn;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* icmp_context;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* signature_state;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* SYN_packet;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* pcap_packet;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* raw_pkt_hdr_type;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* l2_hdr_type;
+[[deprecated("Remove in v4.1.  Use zeek::id::transport_proto.")]]
 extern EnumType* transport_proto;
+[[deprecated("Remove in v4.1.  Use zeek::id::string_set.")]]
 extern TableType* string_set;
+[[deprecated("Remove in v4.1.  Use zeek::id::string_array.")]]
 extern TableType* string_array;
+[[deprecated("Remove in v4.1.  Use zeek::id::count_set.")]]
 extern TableType* count_set;
+[[deprecated("Remove in v4.1.  Use zeek::id::string_vec.")]]
 extern VectorType* string_vec;
+[[deprecated("Remove in v4.1.  Use zeek::id::index_vec.")]]
 extern VectorType* index_vec;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern VectorType* mime_matches;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* mime_match;
 
 extern int watchdog_interval;
@@ -55,6 +76,7 @@ extern int tcp_max_above_hole_without_any_acks;
 extern int tcp_excessive_data_without_further_acks;
 extern int tcp_max_old_segments;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* socks_address;
 
 extern double non_analyzed_lifetime;
@@ -65,16 +87,23 @@ extern double icmp_inactivity_timeout;
 extern int tcp_storm_thresh;
 extern double tcp_storm_interarrival_thresh;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* tcp_reassembler_ports_orig;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* tcp_reassembler_ports_resp;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* tcp_content_delivery_ports_orig;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* tcp_content_delivery_ports_resp;
 extern bool tcp_content_deliver_all_orig;
 extern bool tcp_content_deliver_all_resp;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* udp_content_delivery_ports_orig;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* udp_content_delivery_ports_resp;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* udp_content_ports;
 extern bool udp_content_deliver_all_orig;
 extern bool udp_content_deliver_all_resp;
@@ -83,43 +112,56 @@ extern bool udp_content_delivery_ports_use_resp;
 extern double dns_session_timeout;
 extern double rpc_timeout;
 
-extern ListVal* skip_authentication;
-extern ListVal* direct_login_prompts;
-extern ListVal* login_prompts;
-extern ListVal* login_non_failure_msgs;
-extern ListVal* login_failure_msgs;
-extern ListVal* login_success_msgs;
-extern ListVal* login_timeouts;
-
 extern int mime_segment_length;
 extern int mime_segment_overlap_length;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* mime_header_rec;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableType* mime_header_list;
 
 extern int http_entity_data_delivery_size;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* http_stats_rec;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* http_message_stat;
 extern int truncate_http_URI;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* pm_mapping;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableType* pm_mappings;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* pm_port_request;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* pm_callit_request;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* geo_location;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* entropy_test_result;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_msg;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_answer;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_soa;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_edns_additional;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_tsig_additional;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_rrsig_rr;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_dnskey_rr;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_nsec3_rr;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* dns_ds_rr;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* dns_skip_auth;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* dns_skip_addl;
 extern int dns_skip_all_auth;
 extern int dns_skip_all_addl;
@@ -127,6 +169,7 @@ extern int dns_max_queries;
 
 extern double stp_delta;
 extern double stp_idle_min;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* stp_skip_src;
 
 extern double table_expire_interval;
@@ -135,17 +178,24 @@ extern int table_incremental_step;
 
 extern int orig_addr_anonymization, resp_addr_anonymization;
 extern int other_addr_anonymization;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* preserve_orig_addr;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* preserve_resp_addr;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* preserve_other_addr;
 
 extern double connection_status_update_interval;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* rotate_info;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern StringVal* log_rotate_base_time;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern StringVal* peer_description;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern Val* profiling_file;
 extern double profiling_interval;
 extern int expensive_profiling_multiple;
@@ -153,6 +203,7 @@ extern int expensive_profiling_multiple;
 extern int segment_profiling;
 extern int pkt_profile_mode;
 extern double pkt_profile_freq;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern Val* pkt_profile_file;
 
 extern int load_sample_freq;
@@ -161,7 +212,9 @@ extern int packet_filter_default;
 
 extern int sig_max_group_size;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableType* irc_join_list;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* irc_join_info;
 
 extern int dpd_reassemble_first_packets;
@@ -170,27 +223,35 @@ extern int dpd_match_only_beginning;
 extern int dpd_late_match_stop;
 extern int dpd_ignore_ports;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableVal* likely_server_ports;
 
 extern int check_for_unused_event_handlers;
 
-extern int suppress_local_output;
-
 extern double timer_mgr_inactivity_timeout;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern StringVal* trace_output_file;
 
 extern int record_all_packets;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* script_id;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableType* id_table;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* record_field;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern TableType* record_field_table;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern RecordType* call_argument;
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern VectorType* call_argument_vector;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern StringVal* cmd_line_bpf_filter;
 
+[[deprecated("Remove in v4.1.  Perform your own lookup.")]]
 extern StringVal* global_hash_seed;
 
 extern bro_uint_t bits_per_uid;
diff --git a/src/Obj.cc b/src/Obj.cc
index 89edc8edff..63f22f4506 100644
--- a/src/Obj.cc
+++ b/src/Obj.cc
@@ -90,7 +90,7 @@ void BroObj::BadTag(const char* msg, const char* t1, const char* t2) const
 
 	ODesc d;
 	DoMsg(&d, out);
-	reporter->FatalError("%s", d.Description());
+	reporter->FatalErrorWithCore("%s", d.Description());
 	reporter->PopLocation();
 	}
 
diff --git a/src/OpaqueVal.cc b/src/OpaqueVal.cc
index 3970e20ab5..351d00fa19 100644
--- a/src/OpaqueVal.cc
+++ b/src/OpaqueVal.cc
@@ -37,9 +37,11 @@ OpaqueMgr* OpaqueMgr::mgr()
 	return &mgr;
 	}
 
-OpaqueVal::OpaqueVal(OpaqueType* t) : Val(t)
-	{
-	}
+OpaqueVal::OpaqueVal(OpaqueType* t) : OpaqueVal({NewRef{}, t})
+	{}
+
+OpaqueVal::OpaqueVal(IntrusivePtr<OpaqueType> t) : Val(std::move(t))
+	{}
 
 OpaqueVal::~OpaqueVal()
 	{
@@ -94,7 +96,7 @@ IntrusivePtr<OpaqueVal> OpaqueVal::Unserialize(const broker::data& data)
 	return val;
 	}
 
-broker::expected<broker::data> OpaqueVal::SerializeType(BroType* t)
+broker::expected<broker::data> OpaqueVal::SerializeType(const IntrusivePtr<BroType>& t)
 	{
 	if ( t->InternalType() == TYPE_INTERNAL_ERROR )
 		return broker::ec::invalid_data;
@@ -110,7 +112,7 @@ broker::expected<broker::data> OpaqueVal::SerializeType(BroType* t)
 	return {broker::vector{false, static_cast<uint64_t>(t->Tag())}};
 	}
 
-BroType* OpaqueVal::UnserializeType(const broker::data& data)
+IntrusivePtr<BroType> OpaqueVal::UnserializeType(const broker::data& data)
 	{
 	auto v = caf::get_if<broker::vector>(&data);
 	if ( ! (v && v->size() == 2) )
@@ -126,22 +128,21 @@ BroType* OpaqueVal::UnserializeType(const broker::data& data)
 		if ( ! name )
 			return nullptr;
 
-		ID* id = global_scope()->Lookup(*name);
+		const auto& id = global_scope()->Find(*name);
 		if ( ! id )
 			return nullptr;
 
-		BroType* t = id->AsType();
-		if ( ! t )
+		if ( ! id->IsType() )
 			return nullptr;
 
-		return t->Ref();
+		return id->GetType();
 		}
 
 	auto tag = caf::get_if<uint64_t>(&(*v)[1]);
 	if ( ! tag )
 		return nullptr;
 
-	return base_type(static_cast<TypeTag>(*tag)).release();
+	return base_type(static_cast<TypeTag>(*tag));
 	}
 
 IntrusivePtr<Val> OpaqueVal::DoClone(CloneState* state)
@@ -205,11 +206,14 @@ IntrusivePtr<StringVal> HashVal::DoGet()
 	return val_mgr->EmptyString();
 	}
 
-HashVal::HashVal(OpaqueType* t) : OpaqueVal(t)
+HashVal::HashVal(IntrusivePtr<OpaqueType> t) : OpaqueVal(std::move(t))
 	{
 	valid = false;
 	}
 
+HashVal::HashVal(OpaqueType* t) : HashVal({NewRef{}, t})
+	{}
+
 MD5Val::MD5Val() : HashVal(md5_type)
 	{
 	}
@@ -222,7 +226,7 @@ MD5Val::~MD5Val()
 
 void HashVal::digest_one(EVP_MD_CTX* h, const Val* v)
 	{
-	if ( v->Type()->Tag() == TYPE_STRING )
+	if ( v->GetType()->Tag() == TYPE_STRING )
 		{
 		const BroString* str = v->AsString();
 		hash_update(h, str->Bytes(), str->Len());
@@ -696,15 +700,6 @@ bool EntropyVal::DoUnserialize(const broker::data& data)
 BloomFilterVal::BloomFilterVal()
 	: OpaqueVal(bloomfilter_type)
 	{
-	type = nullptr;
-	hash = nullptr;
-	bloom_filter = nullptr;
-	}
-
-BloomFilterVal::BloomFilterVal(OpaqueType* t)
-	: OpaqueVal(t)
-	{
-	type = nullptr;
 	hash = nullptr;
 	bloom_filter = nullptr;
 	}
@@ -712,7 +707,6 @@ BloomFilterVal::BloomFilterVal(OpaqueType* t)
 BloomFilterVal::BloomFilterVal(probabilistic::BloomFilter* bf)
 	: OpaqueVal(bloomfilter_type)
 	{
-	type = nullptr;
 	hash = nullptr;
 	bloom_filter = bf;
 	}
@@ -729,38 +723,30 @@ IntrusivePtr<Val> BloomFilterVal::DoClone(CloneState* state)
 	return state->NewClone(this, make_intrusive<BloomFilterVal>());
 	}
 
-bool BloomFilterVal::Typify(BroType* arg_type)
+bool BloomFilterVal::Typify(IntrusivePtr<BroType> arg_type)
 	{
 	if ( type )
 		return false;
 
-	type = arg_type;
-	type->Ref();
+	type = std::move(arg_type);
 
-	auto tl = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-	tl->Append({NewRef{}, type});
+	auto tl = make_intrusive<TypeList>(type);
+	tl->Append(type);
 	hash = new CompositeHash(std::move(tl));
 
 	return true;
 	}
 
-BroType* BloomFilterVal::Type() const
-	{
-	return type;
-	}
-
 void BloomFilterVal::Add(const Val* val)
 	{
-	HashKey* key = hash->ComputeHash(val, true);
-	bloom_filter->Add(key);
-	delete key;
+	auto key = hash->MakeHashKey(*val, true);
+	bloom_filter->Add(key.get());
 	}
 
 size_t BloomFilterVal::Count(const Val* val) const
 	{
-	HashKey* key = hash->ComputeHash(val, true);
-	size_t cnt = bloom_filter->Count(key);
-	delete key;
+	auto key = hash->MakeHashKey(*val, true);
+	size_t cnt = bloom_filter->Count(key.get());
 	return cnt;
 	}
 
@@ -818,7 +804,6 @@ IntrusivePtr<BloomFilterVal> BloomFilterVal::Merge(const BloomFilterVal* x,
 
 BloomFilterVal::~BloomFilterVal()
 	{
-	Unref(type);
 	delete hash;
 	delete bloom_filter;
 	}
@@ -858,8 +843,9 @@ bool BloomFilterVal::DoUnserialize(const broker::data& data)
 	auto no_type = caf::get_if<broker::none>(&(*v)[0]);
 	if ( ! no_type )
 		{
-		BroType* t = UnserializeType((*v)[0]);
-		if ( ! (t && Typify(t)) )
+		auto t = UnserializeType((*v)[0]);
+
+		if ( ! (t && Typify(std::move(t))) )
 			return false;
 		}
 
@@ -874,7 +860,6 @@ bool BloomFilterVal::DoUnserialize(const broker::data& data)
 CardinalityVal::CardinalityVal() : OpaqueVal(cardinality_type)
 	{
 	c = nullptr;
-	type = nullptr;
 	hash = nullptr;
 	}
 
@@ -882,13 +867,11 @@ CardinalityVal::CardinalityVal(probabilistic::CardinalityCounter* arg_c)
 	: OpaqueVal(cardinality_type)
 	{
 	c = arg_c;
-	type = nullptr;
 	hash = nullptr;
 	}
 
 CardinalityVal::~CardinalityVal()
 	{
-	Unref(type);
 	delete c;
 	delete hash;
 	}
@@ -899,31 +882,24 @@ IntrusivePtr<Val> CardinalityVal::DoClone(CloneState* state)
 			       make_intrusive<CardinalityVal>(new probabilistic::CardinalityCounter(*c)));
 	}
 
-bool CardinalityVal::Typify(BroType* arg_type)
+bool CardinalityVal::Typify(IntrusivePtr<BroType> arg_type)
 	{
 	if ( type )
 		return false;
 
-	type = arg_type;
-	type->Ref();
+	type = std::move(arg_type);
 
-	auto tl = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-	tl->Append({NewRef{}, type});
+	auto tl = make_intrusive<TypeList>(type);
+	tl->Append(type);
 	hash = new CompositeHash(std::move(tl));
 
 	return true;
 	}
 
-BroType* CardinalityVal::Type() const
-	{
-	return type;
-	}
-
 void CardinalityVal::Add(const Val* val)
 	{
-	HashKey* key = hash->ComputeHash(val, true);
+	auto key = hash->MakeHashKey(*val, true);
 	c->AddElement(key->Hash());
-	delete key;
 	}
 
 IMPLEMENT_OPAQUE_VALUE(CardinalityVal)
@@ -961,8 +937,9 @@ bool CardinalityVal::DoUnserialize(const broker::data& data)
 	auto no_type = caf::get_if<broker::none>(&(*v)[0]);
 	if ( ! no_type )
 		{
-		BroType* t = UnserializeType((*v)[0]);
-                if ( ! (t && Typify(t)) )
+		auto t = UnserializeType((*v)[0]);
+
+		if ( ! (t && Typify(std::move(t))) )
 			return false;
 		}
 
@@ -982,7 +959,7 @@ ParaglobVal::ParaglobVal(std::unique_ptr<paraglob::Paraglob> p)
 
 IntrusivePtr<VectorVal> ParaglobVal::Get(StringVal* &pattern)
 	{
-	auto rval = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+	auto rval = make_intrusive<VectorVal>(zeek::id::string_vec);
 	std::string string_pattern (reinterpret_cast<const char*>(pattern->Bytes()), pattern->Len());
 
 	std::vector<std::string> matches = this->internal_paraglob->get(string_pattern);
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index 6ad65a4df3..50a4e74ce9 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -87,7 +87,9 @@ private:
  */
 class OpaqueVal : public Val {
 public:
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit OpaqueVal(OpaqueType* t);
+	explicit OpaqueVal(IntrusivePtr<OpaqueType> t);
 	~OpaqueVal() override;
 
 	/**
@@ -146,13 +148,13 @@ protected:
 	 * Helper function for derived class that need to record a type
 	 * during serialization.
 	 */
-	static broker::expected<broker::data> SerializeType(BroType* t);
+	static broker::expected<broker::data> SerializeType(const IntrusivePtr<BroType>& t);
 
 	/**
 	 * Helper function for derived class that need to restore a type
 	 * during unserialization. Returns the type at reference count +1.
 	 */
-	static BroType* UnserializeType(const broker::data& data);
+	static IntrusivePtr<BroType> UnserializeType(const broker::data& data);
 };
 
 namespace probabilistic {
@@ -183,7 +185,10 @@ protected:
 	static void digest_one(EVP_MD_CTX* h, const IntrusivePtr<Val>& v);
 
 	HashVal()	{ valid = false; }
+
+	[[deprecated("Remove in v4.1. Construct from IntrusivePtr instead.")]]
 	explicit HashVal(OpaqueType* t);
+	explicit HashVal(IntrusivePtr<OpaqueType> t);
 
 	virtual bool DoInit();
 	virtual bool DoFeed(const void* data, size_t size);
@@ -299,8 +304,10 @@ public:
 
 	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
-	BroType* Type() const;
-	bool Typify(BroType* type);
+	const IntrusivePtr<BroType>& Type() const
+		{ return type; }
+
+	bool Typify(IntrusivePtr<BroType> type);
 
 	void Add(const Val* val);
 	size_t Count(const Val* val) const;
@@ -314,7 +321,6 @@ public:
 protected:
 	friend class Val;
 	BloomFilterVal();
-	explicit BloomFilterVal(OpaqueType* t);
 
 	DECLARE_OPAQUE_VALUE(BloomFilterVal)
 private:
@@ -322,7 +328,7 @@ private:
 	BloomFilterVal(const BloomFilterVal&);
 	BloomFilterVal& operator=(const BloomFilterVal&);
 
-	BroType* type;
+	IntrusivePtr<BroType> type;
 	CompositeHash* hash;
 	probabilistic::BloomFilter* bloom_filter;
 };
@@ -337,8 +343,10 @@ public:
 
 	void Add(const Val* val);
 
-	BroType* Type() const;
-	bool Typify(BroType* type);
+	const IntrusivePtr<BroType>& Type() const
+		{ return type; }
+
+	bool Typify(IntrusivePtr<BroType> type);
 
 	probabilistic::CardinalityCounter* Get()	{ return c; };
 
@@ -347,7 +355,7 @@ protected:
 
 	DECLARE_OPAQUE_VALUE(CardinalityVal)
 private:
-	BroType* type;
+	IntrusivePtr<BroType> type;
 	CompositeHash* hash;
 	probabilistic::CardinalityCounter* c;
 };
diff --git a/src/PrefixTable.cc b/src/PrefixTable.cc
index 765108f507..b0d50b0619 100644
--- a/src/PrefixTable.cc
+++ b/src/PrefixTable.cc
@@ -43,11 +43,11 @@ void* PrefixTable::Insert(const IPAddr& addr, int width, void* data)
 void* PrefixTable::Insert(const Val* value, void* data)
 	{
 	// [elem] -> elem
-	if ( value->Type()->Tag() == TYPE_LIST &&
+	if ( value->GetType()->Tag() == TYPE_LIST &&
 	     value->AsListVal()->Length() == 1 )
-		value = value->AsListVal()->Index(0);
+		value = value->AsListVal()->Idx(0).get();
 
-	switch ( value->Type()->Tag() ) {
+	switch ( value->GetType()->Tag() ) {
 	case TYPE_ADDR:
 		return Insert(value->AsAddr(), 128, data);
 		break;
@@ -103,11 +103,11 @@ void* PrefixTable::Lookup(const IPAddr& addr, int width, bool exact) const
 void* PrefixTable::Lookup(const Val* value, bool exact) const
 	{
 	// [elem] -> elem
-	if ( value->Type()->Tag() == TYPE_LIST &&
+	if ( value->GetType()->Tag() == TYPE_LIST &&
 	     value->AsListVal()->Length() == 1 )
-		value = value->AsListVal()->Index(0);
+		value = value->AsListVal()->Idx(0).get();
 
-	switch ( value->Type()->Tag() ) {
+	switch ( value->GetType()->Tag() ) {
 	case TYPE_ADDR:
 		return Lookup(value->AsAddr(), 128, exact);
 		break;
@@ -119,7 +119,7 @@ void* PrefixTable::Lookup(const Val* value, bool exact) const
 
 	default:
 		reporter->InternalWarning("Wrong index type %d for PrefixTable",
-		                          value->Type()->Tag());
+		                          value->GetType()->Tag());
 		return nullptr;
 	}
 	}
@@ -142,11 +142,11 @@ void* PrefixTable::Remove(const IPAddr& addr, int width)
 void* PrefixTable::Remove(const Val* value)
 	{
 	// [elem] -> elem
-	if ( value->Type()->Tag() == TYPE_LIST &&
+	if ( value->GetType()->Tag() == TYPE_LIST &&
 	     value->AsListVal()->Length() == 1 )
-		value = value->AsListVal()->Index(0);
+		value = value->AsListVal()->Idx(0).get();
 
-	switch ( value->Type()->Tag() ) {
+	switch ( value->GetType()->Tag() ) {
 	case TYPE_ADDR:
 		return Remove(value->AsAddr(), 128);
 		break;
diff --git a/src/Reporter.cc b/src/Reporter.cc
index b0e1955b45..ddbe58aaa0 100644
--- a/src/Reporter.cc
+++ b/src/Reporter.cc
@@ -15,7 +15,7 @@
 #include "Net.h"
 #include "Conn.h"
 #include "Timer.h"
-#include "Var.h" // for internal_val()
+#include "ID.h"
 #include "EventHandler.h"
 #include "plugin/Plugin.h"
 #include "plugin/Manager.h"
@@ -63,13 +63,13 @@ Reporter::~Reporter()
 
 void Reporter::InitOptions()
 	{
-	info_to_stderr = internal_val("Reporter::info_to_stderr")->AsBool();
-	warnings_to_stderr = internal_val("Reporter::warnings_to_stderr")->AsBool();
-	errors_to_stderr = internal_val("Reporter::errors_to_stderr")->AsBool();
-	weird_sampling_rate = internal_val("Weird::sampling_rate")->AsCount();
-	weird_sampling_threshold = internal_val("Weird::sampling_threshold")->AsCount();
-	weird_sampling_duration = internal_val("Weird::sampling_duration")->AsInterval();
-	auto wl_val = internal_val("Weird::sampling_whitelist")->AsTableVal();
+	info_to_stderr = zeek::id::find_val("Reporter::info_to_stderr")->AsBool();
+	warnings_to_stderr = zeek::id::find_val("Reporter::warnings_to_stderr")->AsBool();
+	errors_to_stderr = zeek::id::find_val("Reporter::errors_to_stderr")->AsBool();
+	weird_sampling_rate = zeek::id::find_val("Weird::sampling_rate")->AsCount();
+	weird_sampling_threshold = zeek::id::find_val("Weird::sampling_threshold")->AsCount();
+	weird_sampling_duration = zeek::id::find_val("Weird::sampling_duration")->AsInterval();
+	auto wl_val = zeek::id::find_val("Weird::sampling_whitelist")->AsTableVal();
 	auto wl_table = wl_val->AsTable();
 
 	HashKey* k;
@@ -78,8 +78,8 @@ void Reporter::InitOptions()
 
 	while ( (v = wl_table->NextEntry(k, c)) )
 		{
-		auto index = wl_val->RecoverIndex(k);
-		std::string key = index->Index(0)->AsString()->CheckString();
+		auto index = wl_val->RecreateIndex(*k);
+		std::string key = index->Idx(0)->AsString()->CheckString();
 		weird_sampling_whitelist.emplace(move(key));
 		delete k;
 		}
@@ -349,7 +349,7 @@ void Reporter::Weird(file_analysis::File* f, const char* name, const char* addl)
 			return;
 		}
 
-	WeirdHelper(file_weird, {f->GetVal()->Ref(), new StringVal(addl)},
+	WeirdHelper(file_weird, {f->ToVal()->Ref(), new StringVal(addl)},
 	            "%s", name);
 	}
 
diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc
index e561d28e0f..732c74b4ac 100644
--- a/src/RuleCondition.cc
+++ b/src/RuleCondition.cc
@@ -6,8 +6,8 @@
 #include "Reporter.h"
 #include "Scope.h"
 #include "Func.h"
+#include "ID.h"
 #include "Val.h"
-#include "Var.h" // for internal_type()
 
 static inline bool is_established(const analyzer::tcp::TCP_Endpoint* e)
 	{
@@ -129,23 +129,24 @@ bool RuleConditionPayloadSize::DoMatch(Rule* rule, RuleEndpointState* state,
 
 RuleConditionEval::RuleConditionEval(const char* func)
 	{
-	id = global_scope()->Lookup(func);
+	id = global_scope()->Find(func).get();
 	if ( ! id )
 		{
 		rules_error("unknown identifier", func);
 		return;
 		}
 
-	if ( id->Type()->Tag() == TYPE_FUNC )
+	if ( id->GetType()->Tag() == TYPE_FUNC )
 		{
 		// Validate argument quantity and type.
-		FuncType* f = id->Type()->AsFuncType();
+		FuncType* f = id->GetType()->AsFuncType();
 
-		if ( f->YieldType()->Tag() != TYPE_BOOL )
+		if ( f->Yield()->Tag() != TYPE_BOOL )
 			rules_error("eval function type must yield a 'bool'", func);
 
+		static auto signature_state = zeek::id::find_type<RecordType>("signature_state");
 		TypeList tl;
-		tl.Append({NewRef{}, internal_type("signature_state")});
+		tl.Append(signature_state);
 		tl.Append(base_type(TYPE_STRING));
 
 		if ( ! f->CheckArgs(tl.Types()) )
@@ -163,8 +164,8 @@ bool RuleConditionEval::DoMatch(Rule* rule, RuleEndpointState* state,
 		return false;
 		}
 
-	if ( id->Type()->Tag() != TYPE_FUNC )
-		return id->ID_Val()->AsBool();
+	if ( id->GetType()->Tag() != TYPE_FUNC )
+		return id->GetVal()->AsBool();
 
 	// Call function with a signature_state value as argument.
 	zeek::Args args;
@@ -180,7 +181,7 @@ bool RuleConditionEval::DoMatch(Rule* rule, RuleEndpointState* state,
 
 	try
 		{
-		auto val = id->ID_Val()->AsFunc()->Call(args);
+		auto val = id->GetVal()->AsFunc()->Invoke(&args);
 		result = val && val->AsBool();
 		}
 
diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc
index c3d7a805f1..2e79ed185f 100644
--- a/src/RuleMatcher.cc
+++ b/src/RuleMatcher.cc
@@ -20,6 +20,7 @@
 #include "File.h"
 #include "Reporter.h"
 #include "module_util.h"
+#include "Var.h"
 
 using namespace std;
 
@@ -79,6 +80,7 @@ RuleHdrTest::RuleHdrTest(Prot arg_prot, Comp arg_comp, vector<IPPrefix> arg_v)
 Val* RuleMatcher::BuildRuleStateValue(const Rule* rule,
 					const RuleEndpointState* state) const
 	{
+	static auto signature_state = zeek::id::find_type<RecordType>("signature_state");
 	RecordVal* val = new RecordVal(signature_state);
 	val->Assign(0, make_intrusive<StringVal>(rule->ID()));
 	val->Assign(1, state->GetAnalyzer()->ConnVal());
@@ -1278,7 +1280,7 @@ static Val* get_bro_val(const char* label)
 		return nullptr;
 		}
 
-	return id->ID_Val();
+	return id->GetVal().get();
 	}
 
 
@@ -1290,7 +1292,7 @@ static bool val_to_maskedval(Val* v, maskedvalue_list* append_to,
 	{
 	MaskedValue* mval = new MaskedValue;
 
-	switch ( v->Type()->Tag() ) {
+	switch ( v->GetType()->Tag() ) {
 		case TYPE_PORT:
 			mval->val = v->AsPortVal()->Port();
 			mval->mask = 0xffffffff;
@@ -1359,18 +1361,13 @@ void id_to_maskedvallist(const char* id, maskedvalue_list* append_to,
 	if ( ! v )
 		return;
 
-	if ( v->Type()->Tag() == TYPE_TABLE )
+	if ( v->GetType()->Tag() == TYPE_TABLE )
 		{
-		ListVal* lv = v->AsTableVal()->ConvertToPureList();
-		val_list* vals = lv->Vals();
-		for ( const auto& val : *vals )
-			if ( ! val_to_maskedval(val, append_to, prefix_vector) )
-				{
-				Unref(lv);
-				return;
-				}
+		auto lv = v->AsTableVal()->ToPureListVal();
 
-		Unref(lv);
+		for ( const auto& val : lv->Vals() )
+			if ( ! val_to_maskedval(val.get(), append_to, prefix_vector) )
+				return;
 		}
 
 	else
@@ -1386,7 +1383,7 @@ char* id_to_str(const char* id)
 	if ( ! v )
 		goto error;
 
-	if ( v->Type()->Tag() != TYPE_STRING )
+	if ( v->GetType()->Tag() != TYPE_STRING )
 		{
 		rules_error("Identifier must refer to string");
 		goto error;
@@ -1409,7 +1406,7 @@ uint32_t id_to_uint(const char* id)
 	if ( ! v )
 		return 0;
 
-	TypeTag t = v->Type()->Tag();
+	TypeTag t = v->GetType()->Tag();
 
 	if ( t == TYPE_BOOL || t == TYPE_COUNT || t == TYPE_ENUM ||
 	     t == TYPE_INT || t == TYPE_PORT )
diff --git a/src/Scope.cc b/src/Scope.cc
index f8a6f6d8bf..657a27170e 100644
--- a/src/Scope.cc
+++ b/src/Scope.cc
@@ -15,58 +15,60 @@ typedef PList<Scope> scope_list;
 static scope_list scopes;
 static Scope* top_scope;
 
-
-Scope::Scope(IntrusivePtr<ID> id, attr_list* al)
-	: scope_id(std::move(id))
+Scope::Scope(IntrusivePtr<ID> id,
+             std::unique_ptr<std::vector<IntrusivePtr<Attr>>> al)
+	: scope_id(std::move(id)), attrs(std::move(al))
 	{
-	attrs = al;
 	return_type = nullptr;
 
-	inits = new id_list;
-
 	if ( id )
 		{
-		BroType* id_type = scope_id->Type();
+		const auto& id_type = scope_id->GetType();
 
 		if ( id_type->Tag() == TYPE_ERROR )
 			return;
 		else if ( id_type->Tag() != TYPE_FUNC )
 			reporter->InternalError("bad scope id");
 
-		FuncType* ft = id->Type()->AsFuncType();
-		return_type = {NewRef{}, ft->YieldType()};
+		FuncType* ft = id->GetType()->AsFuncType();
+		return_type = ft->Yield();
 		}
 	}
 
-Scope::~Scope()
+const IntrusivePtr<ID>& Scope::Find(std::string_view name) const
 	{
-	if ( attrs )
+	auto entry = local.find(name);
+
+	if ( entry != local.end() )
+		return entry->second;
+
+	return ID::nil;
+	}
+
+IntrusivePtr<ID> Scope::Remove(std::string_view name)
+	{
+	auto entry = local.find(name);
+
+	if ( entry != local.end() )
 		{
-		for ( const auto& attr : *attrs )
-			Unref(attr);
-
-		delete attrs;
+		auto id = std::move(entry->second);
+		local.erase(entry);
+		return id;
 		}
 
-	if ( inits )
-		{
-		for ( const auto& i : *inits )
-			Unref(i);
-
-		delete inits;
-		}
+	return nullptr;
 	}
 
-ID* Scope::GenerateTemporary(const char* name)
+IntrusivePtr<ID> Scope::GenerateTemporary(const char* name)
 	{
-	return new ID(name, SCOPE_FUNCTION, false);
+	return make_intrusive<ID>(name, SCOPE_FUNCTION, false);
 	}
 
-id_list* Scope::GetInits()
+std::vector<IntrusivePtr<ID>> Scope::GetInits()
 	{
-	id_list* ids = inits;
-	inits = nullptr;
-	return ids;
+	auto rval = std::move(inits);
+	inits = {};
+	return rval;
 	}
 
 void Scope::Describe(ODesc* d) const
@@ -117,9 +119,9 @@ TraversalCode Scope::Traverse(TraversalCallback* cb) const
 	}
 
 
-IntrusivePtr<ID> lookup_ID(const char* name, const char* curr_module,
-                           bool no_global, bool same_module_only,
-                           bool check_export)
+const IntrusivePtr<ID>& lookup_ID(const char* name, const char* curr_module,
+                                  bool no_global, bool same_module_only,
+                                  bool check_export)
 	{
 	std::string fullname = make_full_var_name(curr_module, name);
 
@@ -129,27 +131,26 @@ IntrusivePtr<ID> lookup_ID(const char* name, const char* curr_module,
 
 	for ( int i = scopes.length() - 1; i >= 0; --i )
 		{
-		ID* id = scopes[i]->Lookup(fullname);
+		const auto& id = scopes[i]->Find(fullname);
+
 		if ( id )
 			{
 			if ( need_export && ! id->IsExport() && ! in_debug )
 				reporter->Error("identifier is not exported: %s",
 				      fullname.c_str());
 
-			return {NewRef{}, id};
+			return id;
 			}
 		}
 
 	if ( ! no_global && (strcmp(GLOBAL_MODULE_NAME, curr_module) == 0 ||
-			     ! same_module_only) )
+	     ! same_module_only) )
 		{
 		std::string globalname = make_full_var_name(GLOBAL_MODULE_NAME, name);
-		ID* id = global_scope()->Lookup(globalname);
-		if ( id )
-			return {NewRef{}, id};
+		return global_scope()->Find(globalname);
 		}
 
-	return nullptr;
+	return ID::nil;
 	}
 
 IntrusivePtr<ID> install_ID(const char* name, const char* module_name,
@@ -188,9 +189,10 @@ void push_existing_scope(Scope* scope)
 	scopes.push_back(scope);
 	}
 
-void push_scope(IntrusivePtr<ID> id, attr_list* attrs)
+void push_scope(IntrusivePtr<ID> id,
+                std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs)
 	{
-	top_scope = new Scope(std::move(id), attrs);
+	top_scope = new Scope(std::move(id), std::move(attrs));
 	scopes.push_back(top_scope);
 	}
 
diff --git a/src/Scope.h b/src/Scope.h
index 9fec692e8c..146c5c051e 100644
--- a/src/Scope.h
+++ b/src/Scope.h
@@ -4,6 +4,7 @@
 
 #include <utility>
 #include <string>
+#include <string_view>
 #include <map>
 
 #include "Obj.h"
@@ -18,53 +19,48 @@ class ListVal;
 
 class Scope : public BroObj {
 public:
-	explicit Scope(IntrusivePtr<ID> id, attr_list* al);
-	~Scope() override;
+	explicit Scope(IntrusivePtr<ID> id,
+	               std::unique_ptr<std::vector<IntrusivePtr<Attr>>> al);
+
+	const IntrusivePtr<ID>& Find(std::string_view name) const;
 
 	template<typename N>
+	[[deprecated("Remove in v4.1.  Use Find().")]]
 	ID* Lookup(N&& name) const
-		{
-		const auto& entry = local.find(std::forward<N>(name));
-
-		if ( entry != local.end() )
-			return entry->second.get();
-
-		return nullptr;
-		}
+		{ return Find(name).get(); }
 
 	template<typename N, typename I>
 	void Insert(N&& name, I&& id) { local[std::forward<N>(name)] = std::forward<I>(id); }
 
-	template<typename N>
-	IntrusivePtr<ID> Remove(N&& name)
-		{
-		const auto& entry = local.find(std::forward<N>(name));
-
-		if ( entry != local.end() )
-			{
-			auto id = std::move(entry->second);
-			local.erase(entry);
-			return id;
-			}
-
-		return nullptr;
-		}
+	IntrusivePtr<ID> Remove(std::string_view name);
 
+	[[deprecated("Remove in v4.1.  Use GetID().")]]
 	ID* ScopeID() const		{ return scope_id.get(); }
-	attr_list* Attrs() const	{ return attrs; }
+
+	const IntrusivePtr<ID>& GetID() const
+		{ return scope_id; }
+
+	const std::unique_ptr<std::vector<IntrusivePtr<Attr>>>& Attrs() const
+		{ return attrs; }
+
+	[[deprecated("Remove in v4.1.  Use GetReturnTrype().")]]
 	BroType* ReturnType() const	{ return return_type.get(); }
 
+	const IntrusivePtr<BroType>& GetReturnType() const
+		{ return return_type; }
+
 	size_t Length() const		{ return local.size(); }
 	const auto& Vars()	{ return local; }
 
-	ID* GenerateTemporary(const char* name);
+	IntrusivePtr<ID> GenerateTemporary(const char* name);
 
 	// Returns the list of variables needing initialization, and
 	// removes it from this Scope.
-	id_list* GetInits();
+	std::vector<IntrusivePtr<ID>> GetInits();
 
 	// Adds a variable to the list.
-	void AddInit(IntrusivePtr<ID> id)		{ inits->push_back(id.release()); }
+	void AddInit(IntrusivePtr<ID> id)
+		{ inits.emplace_back(std::move(id)); }
 
 	void Describe(ODesc* d) const override;
 
@@ -72,25 +68,26 @@ public:
 
 protected:
 	IntrusivePtr<ID> scope_id;
-	attr_list* attrs;
+	std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs;
 	IntrusivePtr<BroType> return_type;
-	std::map<std::string, IntrusivePtr<ID>> local;
-	id_list* inits;
+	std::map<std::string, IntrusivePtr<ID>, std::less<>> local;
+	std::vector<IntrusivePtr<ID>> inits;
 };
 
 
 extern bool in_debug;
 
 // If no_global is true, don't search in the default "global" namespace.
-extern IntrusivePtr<ID> lookup_ID(const char* name, const char* module,
-                                  bool no_global = false,
-                                  bool same_module_only = false,
-                                  bool check_export = true);
+extern const IntrusivePtr<ID>& lookup_ID(const char* name, const char* module,
+                                         bool no_global = false,
+                                         bool same_module_only = false,
+                                         bool check_export = true);
 
 extern IntrusivePtr<ID> install_ID(const char* name, const char* module_name,
                                    bool is_global, bool is_export);
 
-extern void push_scope(IntrusivePtr<ID> id, attr_list* attrs);
+extern void push_scope(IntrusivePtr<ID> id,
+                       std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs);
 extern void push_existing_scope(Scope* scope);
 
 // Returns the one popped off.
diff --git a/src/Sessions.cc b/src/Sessions.cc
index 251d8de3a8..101fc2100e 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -54,7 +54,7 @@ void IPTunnelTimer::Dispatch(double t, bool is_expire)
 	double last_active = it->second.second;
 	double inactive_time = t > last_active ? t - last_active : 0;
 
-	if ( inactive_time >= BifConst::Tunnel::ip_tunnel_timeout )
+	if ( inactive_time >= zeek::BifConst::Tunnel::ip_tunnel_timeout )
 		// tunnel activity timed out, delete it from map
 		sessions->ip_tunnels.erase(tunnel_idx);
 
@@ -81,6 +81,7 @@ NetSessions::NetSessions()
 
 	dump_this_packet = false;
 	num_packets_processed = 0;
+	static auto pkt_profile_file = zeek::id::find_val("pkt_profile_file");
 
 	if ( pkt_profile_mode && pkt_profile_freq > 0 && pkt_profile_file )
 		pkt_profiler = new PacketProfiler(pkt_profile_mode,
@@ -123,7 +124,7 @@ void NetSessions::NextPacket(double t, const Packet* pkt)
 	SegmentProfiler prof(segment_logger, "dispatching-packet");
 
 	if ( raw_packet )
-		mgr.Enqueue(raw_packet, IntrusivePtr{AdoptRef{}, pkt->BuildPktHdrVal()});
+		mgr.Enqueue(raw_packet, pkt->ToRawPktHdrVal());
 
 	if ( pkt_profiler )
 		pkt_profiler->ProfilePkt(t, pkt->cap_len);
@@ -310,7 +311,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 		{
 		dump_this_packet = true;
 		if ( esp_packet )
-			mgr.Enqueue(esp_packet, IntrusivePtr{AdoptRef{}, ip_hdr->BuildPktHdrVal()});
+			mgr.Enqueue(esp_packet, ip_hdr->ToPktHdrVal());
 
 		// Can't do more since upper-layer payloads are going to be encrypted.
 		return;
@@ -330,8 +331,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 			}
 
 		if ( mobile_ipv6_message )
-			mgr.Enqueue(mobile_ipv6_message,
-			            IntrusivePtr{AdoptRef{}, ip_hdr->BuildPktHdrVal()});
+			mgr.Enqueue(mobile_ipv6_message, ip_hdr->ToPktHdrVal());
 
 		if ( ip_hdr->NextProto() != IPPROTO_NONE )
 			Weird("mobility_piggyback", pkt, encapsulation);
@@ -409,7 +409,7 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 
 	case IPPROTO_GRE:
 		{
-		if ( ! BifConst::Tunnel::enable_gre )
+		if ( ! zeek::BifConst::Tunnel::enable_gre )
 			{
 			Weird("GRE_tunnel", ip_hdr, encapsulation);
 			return;
@@ -561,14 +561,14 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 	case IPPROTO_IPV4:
 	case IPPROTO_IPV6:
 		{
-		if ( ! BifConst::Tunnel::enable_ip )
+		if ( ! zeek::BifConst::Tunnel::enable_ip )
 			{
 			Weird("IP_tunnel", ip_hdr, encapsulation);
 			return;
 			}
 
 		if ( encapsulation &&
-		     encapsulation->Depth() >= BifConst::Tunnel::max_depth )
+		     encapsulation->Depth() >= zeek::BifConst::Tunnel::max_depth )
 			{
 			Weird("exceeded_tunnel_max_depth", ip_hdr, encapsulation);
 			return;
@@ -686,19 +686,18 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 
 	conn->CheckFlowLabel(is_orig, ip_hdr->FlowLabel());
 
-	Val* pkt_hdr_val = nullptr;
+	IntrusivePtr<Val> pkt_hdr_val;
 
 	if ( ipv6_ext_headers && ip_hdr->NumHeaders() > 1 )
 		{
-		pkt_hdr_val = ip_hdr->BuildPktHdrVal();
+		pkt_hdr_val = ip_hdr->ToPktHdrVal();
 		conn->EnqueueEvent(ipv6_ext_headers, nullptr, conn->ConnVal(),
-		                   IntrusivePtr{AdoptRef{}, pkt_hdr_val});
+		                   pkt_hdr_val);
 		}
 
 	if ( new_packet )
 		conn->EnqueueEvent(new_packet, nullptr, conn->ConnVal(), pkt_hdr_val ?
-		                   IntrusivePtr{NewRef{}, pkt_hdr_val} :
-		                   IntrusivePtr{AdoptRef{}, ip_hdr->BuildPktHdrVal()});
+		                   std::move(pkt_hdr_val) : ip_hdr->ToPktHdrVal());
 
 	conn->NextPacket(t, is_orig, ip_hdr, len, caplen, data,
 				record_packet, record_content, pkt);
@@ -906,17 +905,17 @@ FragReassembler* NetSessions::NextFragment(double t, const IP_Hdr* ip,
 
 Connection* NetSessions::FindConnection(Val* v)
 	{
-	BroType* vt = v->Type();
+	const auto& vt = v->GetType();
 	if ( ! IsRecord(vt->Tag()) )
 		return nullptr;
 
 	RecordType* vr = vt->AsRecordType();
-	const val_list* vl = v->AsRecord();
+	auto vl = v->AsRecord();
 
 	int orig_h, orig_p;	// indices into record's value list
 	int resp_h, resp_p;
 
-	if ( vr == conn_id )
+	if ( vr == zeek::id::conn_id )
 		{
 		orig_h = 0;
 		orig_p = 1;
@@ -1220,11 +1219,11 @@ bool NetSessions::IsLikelyServerPort(uint32_t port, TransportProto proto) const
 
 	if ( ! have_cache )
 		{
-		ListVal* lv = likely_server_ports->ConvertToPureList();
+		auto likely_server_ports = zeek::id::find_val<TableVal>("likely_server_ports");
+		auto lv = likely_server_ports->ToPureListVal();
 		for ( int i = 0; i < lv->Length(); i++ )
-			port_cache.insert(lv->Index(i)->InternalUnsigned());
+			port_cache.insert(lv->Idx(i)->InternalUnsigned());
 		have_cache = true;
-		Unref(lv);
 		}
 
 	// We exploit our knowledge of PortVal's internal storage mechanism
diff --git a/src/Sessions.h b/src/Sessions.h
index 67589d8742..d5edf62291 100644
--- a/src/Sessions.h
+++ b/src/Sessions.h
@@ -243,7 +243,7 @@ protected:
 class IPTunnelTimer final : public Timer {
 public:
 	IPTunnelTimer(double t, NetSessions::IPPair p)
-	: Timer(t + BifConst::Tunnel::ip_tunnel_timeout,
+	: Timer(t + zeek::BifConst::Tunnel::ip_tunnel_timeout,
 			TIMER_IP_TUNNEL_INACTIVITY), tunnel_idx(p) {}
 
 	~IPTunnelTimer() override {}
diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc
index 02b11cf93d..bfbad2284b 100644
--- a/src/SmithWaterman.cc
+++ b/src/SmithWaterman.cc
@@ -58,25 +58,12 @@ bool BroSubstring::DoesCover(const BroSubstring* bst) const
 
 VectorVal* BroSubstring::VecToPolicy(Vec* vec)
 	{
-	RecordType* sw_substring_type =
-		internal_type("sw_substring")->AsRecordType();
-	if ( ! sw_substring_type )
-		return nullptr;
+	static auto sw_substring_type = zeek::id::find_type<RecordType>("sw_substring");
+	static auto sw_align_type = zeek::id::find_type<RecordType>("sw_align");
+	static auto sw_align_vec_type = zeek::id::find_type<VectorType>("sw_align_vec");
+	static auto sw_substring_vec_type = zeek::id::find_type<VectorType>("sw_substring_vec");
 
-	RecordType* sw_align_type =
-		internal_type("sw_align")->AsRecordType();
-	if ( ! sw_align_type )
-		return nullptr;
-
-	VectorType* sw_align_vec_type =
-		internal_type("sw_align_vec")->AsVectorType();
-	if ( ! sw_align_vec_type )
-		return nullptr;
-
-	VectorVal* result =
-		new VectorVal(internal_type("sw_substring_vec")->AsVectorType());
-	if ( ! result )
-		return nullptr;
+	auto result = make_intrusive<VectorVal>(sw_substring_vec_type);
 
 	if ( vec )
 		{
@@ -106,7 +93,7 @@ VectorVal* BroSubstring::VecToPolicy(Vec* vec)
 			}
 		}
 
-	return result;
+	return result.release();
 	}
 
 BroSubstring::Vec* BroSubstring::VecFromPolicy(VectorVal* vec)
@@ -116,23 +103,23 @@ BroSubstring::Vec* BroSubstring::VecFromPolicy(VectorVal* vec)
 	// VectorVals start at index 1!
 	for ( unsigned int i = 1; i <= vec->Size(); ++i )
 		{
-		Val* v = vec->Lookup(i);	// get the RecordVal
+		const auto& v = vec->At(i);	// get the RecordVal
 		if ( ! v )
 			continue;
 
-		const BroString* str = v->AsRecordVal()->Lookup(0)->AsString();
+		const BroString* str = v->AsRecordVal()->GetField(0)->AsString();
 		BroSubstring* substr = new BroSubstring(*str);
 
-		const VectorVal* aligns = v->AsRecordVal()->Lookup(1)->AsVectorVal();
+		const VectorVal* aligns = v->AsRecordVal()->GetField(1)->AsVectorVal();
 		for ( unsigned int j = 1; j <= aligns->Size(); ++j )
 			{
-			const RecordVal* align = aligns->AsVectorVal()->Lookup(j)->AsRecordVal();
-			const BroString* str = align->Lookup(0)->AsString();
-			int index = align->Lookup(1)->AsCount();
+			const RecordVal* align = aligns->AsVectorVal()->At(j)->AsRecordVal();
+			const BroString* str = align->GetField(0)->AsString();
+			int index = align->GetField(1)->AsCount();
 			substr->AddAlignment(str, index);
 			}
 
-		bool new_alignment = v->AsRecordVal()->Lookup(2)->AsBool();
+		bool new_alignment = v->AsRecordVal()->GetField(2)->AsBool();
 		substr->MarkNewAlignment(new_alignment);
 
 		result->push_back(substr);
diff --git a/src/Stats.cc b/src/Stats.cc
index 3c2508c7f7..24e550a3d2 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -5,7 +5,7 @@
 #include "Event.h"
 #include "Net.h"
 #include "NetVar.h"
-#include "Var.h" // for internal_type()
+#include "ID.h"
 #include "Sessions.h"
 #include "Scope.h"
 #include "DNS_Mgr.h"
@@ -257,9 +257,9 @@ void ProfileLogger::Log()
 			// contained in some other global user-visible container.
 			if ( id->HasVal() )
 				{
-				Val* v = id->ID_Val();
+				const auto& v = id->GetVal();
 
-				size = id->ID_Val()->MemoryAllocation();
+				size = v->MemoryAllocation();
 				mem += size;
 
 				bool print = false;
@@ -269,7 +269,7 @@ void ProfileLogger::Log()
 				if ( size > 100 * 1024 )
 					print = true;
 
-				if ( v->Type()->Tag() == TYPE_TABLE )
+				if ( v->GetType()->Tag() == TYPE_TABLE )
 					{
 					entries = v->AsTable()->Length();
 					total_table_entries += entries;
@@ -311,9 +311,8 @@ void ProfileLogger::Log()
 	// (and for consistency we dispatch it *now*)
 	if ( profiling_update )
 		{
-		Ref(file);
 		mgr.Dispatch(new Event(profiling_update, {
-			make_intrusive<Val>(file),
+			make_intrusive<Val>(IntrusivePtr{NewRef{}, file}),
 			val_mgr->Bool(expensive),
 		}));
 		}
@@ -342,7 +341,7 @@ SampleLogger::SampleLogger()
 	static TableType* load_sample_info = nullptr;
 
 	if ( ! load_sample_info )
-		load_sample_info = internal_type("load_sample_info")->AsTableType();
+		load_sample_info = zeek::id::find_type("load_sample_info")->AsTableType();
 
 	load_samples = new TableVal({NewRef{}, load_sample_info});
 	}
@@ -354,16 +353,14 @@ SampleLogger::~SampleLogger()
 
 void SampleLogger::FunctionSeen(const Func* func)
 	{
-	Val* idx = new StringVal(func->Name());
-	load_samples->Assign(idx, nullptr);
-	Unref(idx);
+	auto idx = make_intrusive<StringVal>(func->Name());
+	load_samples->Assign(std::move(idx), nullptr);
 	}
 
 void SampleLogger::LocationSeen(const Location* loc)
 	{
-	Val* idx = new StringVal(loc->filename);
-	load_samples->Assign(idx, nullptr);
-	Unref(idx);
+	auto idx = make_intrusive<StringVal>(loc->filename);
+	load_samples->Assign(std::move(idx), nullptr);
 	}
 
 void SampleLogger::SegmentProfile(const char* /* name */,
diff --git a/src/Stmt.cc b/src/Stmt.cc
index 9ea9639225..60b93f1201 100644
--- a/src/Stmt.cc
+++ b/src/Stmt.cc
@@ -136,7 +136,7 @@ ExprListStmt::ExprListStmt(BroStmtTag t, IntrusivePtr<ListExpr> arg_l)
 	const expr_list& e = l->Exprs();
 	for ( const auto& expr : e )
 		{
-		const BroType* t = expr->Type();
+		const auto& t = expr->GetType();
 		if ( ! t || t->Tag() == TYPE_VOID )
 			Error("value of type void illegal");
 		}
@@ -186,11 +186,11 @@ static BroFile* print_stdout = nullptr;
 
 static IntrusivePtr<EnumVal> lookup_enum_val(const char* module_name, const char* name)
 	{
-	auto id = lookup_ID(name, module_name);
+	const auto& id = lookup_ID(name, module_name);
 	assert(id);
 	assert(id->IsEnumConst());
 
-	EnumType* et = id->Type()->AsEnumType();
+	EnumType* et = id->GetType()->AsEnumType();
 
 	int index = et->Lookup(module_name, name);
 	assert(index >= 0);
@@ -200,9 +200,10 @@ static IntrusivePtr<EnumVal> lookup_enum_val(const char* module_name, const char
 
 static void print_log(const std::vector<IntrusivePtr<Val>>& vals)
 	{
-	auto plval = lookup_enum_val("Log", "PRINTLOG");
-	auto record = make_intrusive<RecordVal>(internal_type("Log::PrintLogInfo")->AsRecordType());
-	auto vec = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+	static auto plval = lookup_enum_val("Log", "PRINTLOG");
+	static auto lpli = zeek::id::find_type<RecordType>("Log::PrintLogInfo");
+	auto record = make_intrusive<RecordVal>(lpli);
+	auto vec = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	for ( const auto& val : vals )
 		{
@@ -227,7 +228,7 @@ IntrusivePtr<Val> PrintStmt::DoExec(std::vector<IntrusivePtr<Val>> vals,
 	BroFile* f = print_stdout;
 	int offset = 0;
 
-	if ( vals.size() > 0 && (vals)[0]->Type()->Tag() == TYPE_FILE )
+	if ( vals.size() > 0 && (vals)[0]->GetType()->Tag() == TYPE_FILE )
 		{
 		f = (vals)[0]->AsFile();
 		if ( ! f->IsOpen() )
@@ -237,7 +238,7 @@ IntrusivePtr<Val> PrintStmt::DoExec(std::vector<IntrusivePtr<Val>> vals,
 		}
 
 	static auto print_log_type = static_cast<BifEnum::Log::PrintLogType>(
-	        internal_val("Log::print_to_log")->AsEnum());
+	        zeek::id::find_val("Log::print_to_log")->AsEnum());
 
 	switch ( print_log_type ) {
 	case BifEnum::Log::REDIRECT_NONE:
@@ -366,7 +367,7 @@ IfStmt::IfStmt(IntrusivePtr<Expr> test,
 	: ExprStmt(STMT_IF, std::move(test)),
 	  s1(std::move(arg_s1)), s2(std::move(arg_s2))
 	{
-	if ( ! e->IsError() && ! IsBool(e->Type()->Tag()) )
+	if ( ! e->IsError() && ! IsBool(e->GetType()->Tag()) )
 		e->Error("conditional in test must be boolean");
 
 	const Location* loc1 = s1->GetLocationInfo();
@@ -530,7 +531,7 @@ void Case::Describe(ODesc* d) const
 			d->SP();
 			d->Add("type");
 			d->SP();
-			t[i]->Type()->Describe(d);
+			t[i]->GetType()->Describe(d);
 
 			if ( t[i]->Name() )
 				{
@@ -580,7 +581,7 @@ static void int_del_func(void* v)
 void SwitchStmt::Init()
 	{
 	auto t = make_intrusive<TypeList>();
-	t->Append({NewRef{}, e->Type()});
+	t->Append(e->GetType());
 	comp_hash = new CompositeHash(std::move(t));
 
 	case_label_value_map.SetDeleteFunc(int_del_func);
@@ -605,10 +606,10 @@ SwitchStmt::SwitchStmt(IntrusivePtr<Expr> index, case_list* arg_cases)
 			{
 			have_exprs = true;
 
-			if ( ! is_atomic_type(e->Type()) )
+			if ( ! is_atomic_type(e->GetType()) )
 				e->Error("switch expression must be of an atomic type when cases are expressions");
 
-			if ( ! le->Type()->AsTypeList()->AllMatch(e->Type(), false) )
+			if ( ! le->GetType()->AsTypeList()->AllMatch(e->GetType(), false) )
 				{
 				le->Error("case expression type differs from switch type", e.get());
 				continue;
@@ -677,9 +678,9 @@ SwitchStmt::SwitchStmt(IntrusivePtr<Expr> index, case_list* arg_cases)
 
 			for ( const auto& t : *tl )
 				{
-				BroType* ct = t->Type();
+				const auto& ct = t->GetType();
 
-	   			if ( ! can_cast_value_to_type(e->Type(), ct) )
+	   			if ( ! can_cast_value_to_type(e->GetType().get(), ct.get()) )
 					{
 					c->Error("cannot cast switch expression to case type");
 					continue;
@@ -718,25 +719,21 @@ SwitchStmt::~SwitchStmt()
 
 bool SwitchStmt::AddCaseLabelValueMapping(const Val* v, int idx)
 	{
-	HashKey* hk = comp_hash->ComputeHash(v, true);
+	auto hk = comp_hash->MakeHashKey(*v, true);
 
 	if ( ! hk )
 		{
 		reporter->PushLocation(e->GetLocationInfo());
 		reporter->InternalError("switch expression type mismatch (%s/%s)",
-		    type_name(v->Type()->Tag()), type_name(e->Type()->Tag()));
+		    type_name(v->GetType()->Tag()), type_name(e->GetType()->Tag()));
 		}
 
-	int* label_idx = case_label_value_map.Lookup(hk);
+	int* label_idx = case_label_value_map.Lookup(hk.get());
 
 	if ( label_idx )
-		{
-		delete hk;
 		return false;
-		}
 
-	case_label_value_map.Insert(hk, new int(idx));
-	delete hk;
+	case_label_value_map.Insert(hk.get(), new int(idx));
 	return true;
 	}
 
@@ -744,7 +741,7 @@ bool SwitchStmt::AddCaseLabelTypeMapping(ID* t, int idx)
 	{
 	for ( auto i : case_label_type_list )
 		{
-		if ( same_type(i.first->Type(), t->Type()) )
+		if ( same_type(i.first->GetType(), t->GetType()) )
 			return false;
 		}
 
@@ -762,29 +759,27 @@ std::pair<int, ID*> SwitchStmt::FindCaseLabelMatch(const Val* v) const
 	// Find matching expression cases.
 	if ( case_label_value_map.Length() )
 		{
-		HashKey* hk = comp_hash->ComputeHash(v, true);
+		auto hk = comp_hash->MakeHashKey(*v, true);
 
 		if ( ! hk )
 			{
 			reporter->PushLocation(e->GetLocationInfo());
 			reporter->Error("switch expression type mismatch (%s/%s)",
-					type_name(v->Type()->Tag()), type_name(e->Type()->Tag()));
+					type_name(v->GetType()->Tag()), type_name(e->GetType()->Tag()));
 			return std::make_pair(-1, nullptr);
 			}
 
-		if ( auto i = case_label_value_map.Lookup(hk) )
+		if ( auto i = case_label_value_map.Lookup(hk.get()) )
 			label_idx = *i;
-
-		delete hk;
 		}
 
 	// Find matching type cases.
 	for ( auto i : case_label_type_list )
 		{
 		auto id = i.first;
-		auto type = id->Type();
+		const auto& type = id->GetType();
 
-		if ( can_cast_value_to_type(v, type) )
+		if ( can_cast_value_to_type(v, type.get()) )
 			{
 			label_idx = i.second;
 			label_id = id;
@@ -815,8 +810,8 @@ IntrusivePtr<Val> SwitchStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) con
 
 		if ( matching_id )
 			{
-			auto cv = cast_value_to_type(v, matching_id->Type());
-			f->SetElement(matching_id, cv.release());
+			auto cv = cast_value_to_type(v, matching_id->GetType().get());
+			f->SetElement(matching_id, std::move(cv));
 			}
 
 		flow = FLOW_NEXT;
@@ -987,7 +982,7 @@ WhileStmt::WhileStmt(IntrusivePtr<Expr> arg_loop_condition,
 	: loop_condition(std::move(arg_loop_condition)), body(std::move(arg_body))
 	{
 	if ( ! loop_condition->IsError() &&
-	     ! IsBool(loop_condition->Type()->Tag()) )
+	     ! IsBool(loop_condition->GetType()->Tag()) )
 		loop_condition->Error("while conditional must be boolean");
 	}
 
@@ -1067,35 +1062,37 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 	loop_vars = arg_loop_vars;
 	body = nullptr;
 
-	if ( e->Type()->Tag() == TYPE_TABLE )
+	if ( e->GetType()->Tag() == TYPE_TABLE )
 		{
-		const type_list* indices = e->Type()->AsTableType()->IndexTypes();
-		if ( indices->length() != loop_vars->length() )
+		const auto& indices = e->GetType()->AsTableType()->IndexTypes();
+
+		if ( static_cast<int>(indices.size()) != loop_vars->length() )
 			{
 			e->Error("wrong index size");
 			return;
 			}
 
-		for ( int i = 0; i < indices->length(); i++ )
+		for ( auto i = 0u; i < indices.size(); i++ )
 			{
-			BroType* ind_type = (*indices)[i]->Ref();
+			const auto& ind_type = indices[i];
+			const auto& lv = (*loop_vars)[i];
+			const auto& lvt = lv->GetType();
 
-			if ( (*loop_vars)[i]->Type() )
+			if ( lvt )
 				{
-				if ( ! same_type((*loop_vars)[i]->Type(), ind_type) )
-					(*loop_vars)[i]->Type()->Error("type clash in iteration", ind_type);
+				if ( ! same_type(lvt, ind_type) )
+					lvt->Error("type clash in iteration", ind_type.get());
 				}
 
 			else
 				{
-				add_local({NewRef{}, (*loop_vars)[i]},
-						{NewRef{}, ind_type}, INIT_NONE,
-						nullptr, nullptr, VAR_REGULAR);
+				add_local({NewRef{}, lv}, ind_type, INIT_NONE,
+				          nullptr, nullptr, VAR_REGULAR);
 				}
 			}
 		}
 
-	else if ( e->Type()->Tag() == TYPE_VECTOR )
+	else if ( e->GetType()->Tag() == TYPE_VECTOR )
 		{
 		if ( loop_vars->length() != 1 )
 			{
@@ -1103,7 +1100,8 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 			return;
 			}
 
-		BroType* t = (*loop_vars)[0]->Type();
+		const auto& t = (*loop_vars)[0]->GetType();
+
 		if ( ! t )
 			add_local({NewRef{}, (*loop_vars)[0]}, base_type(TYPE_COUNT),
 						INIT_NONE, nullptr, nullptr, VAR_REGULAR);
@@ -1115,7 +1113,7 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 			}
 		}
 
-	else if ( e->Type()->Tag() == TYPE_STRING )
+	else if ( e->GetType()->Tag() == TYPE_STRING )
 		{
 		if ( loop_vars->length() != 1 )
 			{
@@ -1123,7 +1121,8 @@ ForStmt::ForStmt(id_list* arg_loop_vars, IntrusivePtr<Expr> loop_expr)
 			return;
 			}
 
-		BroType* t = (*loop_vars)[0]->Type();
+		const auto& t = (*loop_vars)[0]->GetType();
+
 		if ( ! t )
 			add_local({NewRef{}, (*loop_vars)[0]},
 					base_type(TYPE_STRING),
@@ -1145,20 +1144,19 @@ ForStmt::ForStmt(id_list* arg_loop_vars,
 	{
 	value_var = std::move(val_var);
 
-	if ( e->Type()->IsTable() )
+	if ( e->GetType()->IsTable() )
 		{
-		BroType* yield_type = e->Type()->AsTableType()->YieldType();
+		const auto& yield_type = e->GetType()->AsTableType()->Yield();
 
 		// Verify value_vars type if its already been defined
-		if ( value_var->Type() )
+		if ( value_var->GetType() )
 			{
-			if ( ! same_type(value_var->Type(), yield_type) )
-				value_var->Type()->Error("type clash in iteration", yield_type);
+			if ( ! same_type(value_var->GetType(), yield_type) )
+				value_var->GetType()->Error("type clash in iteration", yield_type.get());
 			}
 		else
 			{
-			add_local(value_var, {NewRef{}, yield_type}, INIT_NONE,
-			                 nullptr, nullptr, VAR_REGULAR);
+			add_local(value_var, yield_type, INIT_NONE, nullptr, nullptr, VAR_REGULAR);
 			}
 		}
 	else
@@ -1176,7 +1174,7 @@ IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 	{
 	IntrusivePtr<Val> ret;
 
-	if ( v->Type()->Tag() == TYPE_TABLE )
+	if ( v->GetType()->Tag() == TYPE_TABLE )
 		{
 		TableVal* tv = v->AsTableVal();
 		const PDict<TableEntryVal>* loop_vals = tv->AsTable();
@@ -1189,14 +1187,14 @@ IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 		IterCookie* c = loop_vals->InitForIteration();
 		while ( (current_tev = loop_vals->NextEntry(k, c)) )
 			{
-			auto ind_lv = tv->RecoverIndex(k);
+			auto ind_lv = tv->RecreateIndex(*k);
 			delete k;
 
 			if ( value_var )
-				f->SetElement(value_var.get(), current_tev->Value()->Ref());
+				f->SetElement(value_var, current_tev->GetVal());
 
 			for ( int i = 0; i < ind_lv->Length(); i++ )
-				f->SetElement((*loop_vars)[i], ind_lv->Index(i)->Ref());
+				f->SetElement((*loop_vars)[i], ind_lv->Idx(i));
 
 			flow = FLOW_NEXT;
 
@@ -1220,19 +1218,19 @@ IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 			}
 		}
 
-	else if ( v->Type()->Tag() == TYPE_VECTOR )
+	else if ( v->GetType()->Tag() == TYPE_VECTOR )
 		{
 		VectorVal* vv = v->AsVectorVal();
 
 		for ( auto i = 0u; i <= vv->Size(); ++i )
 			{
 			// Skip unassigned vector indices.
-			if ( ! vv->Lookup(i) )
+			if ( ! vv->At(i) )
 				continue;
 
 			// Set the loop variable to the current index, and make
 			// another pass over the loop body.
-			f->SetElement((*loop_vars)[0], val_mgr->Count(i).release());
+			f->SetElement((*loop_vars)[0], val_mgr->Count(i));
 			flow = FLOW_NEXT;
 			ret = body->Exec(f, flow);
 
@@ -1240,14 +1238,14 @@ IntrusivePtr<Val> ForStmt::DoExec(Frame* f, Val* v, stmt_flow_type& flow) const
 				break;
 			}
 		}
-	else if ( v->Type()->Tag() == TYPE_STRING )
+	else if ( v->GetType()->Tag() == TYPE_STRING )
 		{
 		StringVal* sval = v->AsStringVal();
 
 		for ( int i = 0; i < sval->Len(); ++i )
 			{
-			f->SetElement((*loop_vars)[0],
-					new StringVal(1, (const char*) sval->Bytes() + i));
+			auto sv = make_intrusive<StringVal>(1, (const char*) sval->Bytes() + i);
+			f->SetElement((*loop_vars)[0], std::move(sv));
 			flow = FLOW_NEXT;
 			ret = body->Exec(f, flow);
 
@@ -1416,21 +1414,21 @@ ReturnStmt::ReturnStmt(IntrusivePtr<Expr> arg_e)
 	{
 	Scope* s = current_scope();
 
-	if ( ! s || ! s->ScopeID() )
+	if ( ! s || ! s->GetID() )
 		{
 		Error("return statement outside of function/event");
 		return;
 		}
 
-	FuncType* ft = s->ScopeID()->Type()->AsFuncType();
-	BroType* yt = ft->YieldType();
+	FuncType* ft = s->GetID()->GetType()->AsFuncType();
+	const auto& yt = ft->Yield();
 
-	if ( s->ScopeID()->DoInferReturnType() )
+	if ( s->GetID()->DoInferReturnType() )
 		{
 		if ( e )
 			{
-			ft->SetYieldType({NewRef{}, e->Type()});
-			s->ScopeID()->SetInferReturnType(false);
+			ft->SetYieldType(e->GetType());
+			s->GetID()->SetInferReturnType(false);
 			}
 		}
 
@@ -1448,7 +1446,7 @@ ReturnStmt::ReturnStmt(IntrusivePtr<Expr> arg_e)
 
 	else
 		{
-		auto promoted_e = check_and_promote_expr(e.get(), yt);
+		auto promoted_e = check_and_promote_expr(e.get(), yt.get());
 
 		if ( promoted_e )
 			e = std::move(promoted_e);
@@ -1631,19 +1629,12 @@ void EventBodyList::Describe(ODesc* d) const
 		StmtList::Describe(d);
 	}
 
-InitStmt::InitStmt(id_list* arg_inits) : Stmt(STMT_INIT)
+InitStmt::InitStmt(std::vector<IntrusivePtr<ID>> arg_inits) : Stmt(STMT_INIT)
 	{
-	inits = arg_inits;
-	if ( arg_inits && arg_inits->length() )
-		SetLocationInfo((*arg_inits)[0]->GetLocationInfo());
-	}
+	inits = std::move(arg_inits);
 
-InitStmt::~InitStmt()
-	{
-	for ( const auto& init : *inits )
-		Unref(init);
-
-	delete inits;
+	if ( ! inits.empty() )
+		SetLocationInfo(inits[0]->GetLocationInfo());
 	}
 
 IntrusivePtr<Val> InitStmt::Exec(Frame* f, stmt_flow_type& flow) const
@@ -1651,27 +1642,28 @@ IntrusivePtr<Val> InitStmt::Exec(Frame* f, stmt_flow_type& flow) const
 	RegisterAccess();
 	flow = FLOW_NEXT;
 
-	for ( const auto& aggr : *inits )
+	for ( const auto& aggr : inits )
 		{
-		BroType* t = aggr->Type();
+		const auto& t = aggr->GetType();
 
-		Val* v = nullptr;
+		IntrusivePtr<Val> v;
 
 		switch ( t->Tag() ) {
 		case TYPE_RECORD:
-			v = new RecordVal(t->AsRecordType());
+			v = make_intrusive<RecordVal>(cast_intrusive<RecordType>(t));
 			break;
 		case TYPE_VECTOR:
-			v = new VectorVal(t->AsVectorType());
+			v = make_intrusive<VectorVal>(cast_intrusive<VectorType>(t));
 			break;
 		case TYPE_TABLE:
-			v = new TableVal({NewRef{}, t->AsTableType()}, {NewRef{}, aggr->Attrs()});
+			v = make_intrusive<TableVal>(cast_intrusive<TableType>(t),
+			                             aggr->GetAttrs());
 			break;
 		default:
 			break;
 		}
 
-		f->SetElement(aggr, v);
+		f->SetElement(aggr, std::move(v));
 		}
 
 	return nullptr;
@@ -1682,14 +1674,14 @@ void InitStmt::Describe(ODesc* d) const
 	AddTag(d);
 
 	if ( ! d->IsReadable() )
-		d->AddCount(inits->length());
+		d->AddCount(inits.size());
 
-	loop_over_list(*inits, i)
+	for ( size_t i = 0; i < inits.size(); ++i )
 		{
 		if ( ! d->IsBinary() && i > 0 )
 			d->AddSP(",");
 
-		(*inits)[i]->Describe(d);
+		inits[i]->Describe(d);
 		}
 
 	DescribeDone(d);
@@ -1700,7 +1692,7 @@ TraversalCode InitStmt::Traverse(TraversalCallback* cb) const
 	TraversalCode tc = cb->PreStmt(this);
 	HANDLE_TC_STMT_PRE(tc);
 
-	for ( const auto& init : *inits )
+	for ( const auto& init : inits )
 		{
 		tc = init->Traverse(cb);
 		HANDLE_TC_STMT_PRE(tc);
@@ -1749,7 +1741,7 @@ WhenStmt::WhenStmt(IntrusivePtr<Expr> arg_cond,
 	assert(cond);
 	assert(s1);
 
-	if ( ! cond->IsError() && ! IsBool(cond->Type()->Tag()) )
+	if ( ! cond->IsError() && ! IsBool(cond->GetType()->Tag()) )
 		cond->Error("conditional in test must be boolean");
 
 	if ( timeout )
@@ -1757,7 +1749,7 @@ WhenStmt::WhenStmt(IntrusivePtr<Expr> arg_cond,
 		if ( timeout->IsError() )
 			return;
 
-		TypeTag bt = timeout->Type()->Tag();
+		TypeTag bt = timeout->GetType()->Tag();
 		if ( bt != TYPE_TIME && bt != TYPE_INTERVAL )
 			cond->Error("when timeout requires a time or time interval");
 		}
diff --git a/src/Stmt.h b/src/Stmt.h
index 0fb57c7b23..0cc4e8ae43 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -393,20 +393,19 @@ protected:
 
 class InitStmt final : public Stmt {
 public:
-	explicit InitStmt(id_list* arg_inits);
-
-	~InitStmt() override;
+	explicit InitStmt(std::vector<IntrusivePtr<ID>> arg_inits);
 
 	IntrusivePtr<Val> Exec(Frame* f, stmt_flow_type& flow) const override;
 
-	const id_list* Inits() const	{ return inits; }
+	const std::vector<IntrusivePtr<ID>>& Inits() const
+		{ return inits; }
 
 	void Describe(ODesc* d) const override;
 
 	TraversalCode Traverse(TraversalCallback* cb) const override;
 
 protected:
-	id_list* inits;
+	std::vector<IntrusivePtr<ID>> inits;
 };
 
 class NullStmt final : public Stmt {
diff --git a/src/Tag.cc b/src/Tag.cc
index e0145afd6d..a964760fcb 100644
--- a/src/Tag.cc
+++ b/src/Tag.cc
@@ -4,37 +4,40 @@
 #include "Val.h"
 #include "IntrusivePtr.h"
 
-Tag::Tag(EnumType* etype, type_t arg_type, subtype_t arg_subtype)
+Tag::Tag(const IntrusivePtr<EnumType>& etype, type_t arg_type, subtype_t arg_subtype)
 	{
 	assert(arg_type > 0);
 
 	type = arg_type;
 	subtype = arg_subtype;
 	int64_t i = (int64_t)(type) | ((int64_t)subtype << 31);
-	Ref(etype);
-	val = etype->GetVal(i).release();
+	val = etype->GetVal(i);
 	}
 
-Tag::Tag(EnumVal* arg_val)
+Tag::Tag(EnumType* etype, type_t arg_type, subtype_t arg_subtype)
+	: Tag({NewRef{}, etype}, arg_type, arg_subtype)
+	{ }
+
+Tag::Tag(IntrusivePtr<EnumVal> arg_val)
 	{
 	assert(arg_val);
 
-	val = arg_val;
-	Ref(val);
+	val = std::move(arg_val);
 
 	int64_t i = val->InternalInt();
 	type = i & 0xffffffff;
 	subtype = (i >> 31) & 0xffffffff;
 	}
 
+Tag::Tag(EnumVal* arg_val)
+	: Tag({NewRef{}, arg_val})
+	{ }
+
 Tag::Tag(const Tag& other)
 	{
 	type = other.type;
 	subtype = other.subtype;
 	val = other.val;
-
-	if ( val )
-		Ref(val);
 	}
 
 Tag::Tag()
@@ -44,11 +47,7 @@ Tag::Tag()
 	val = nullptr;
 	}
 
-Tag::~Tag()
-	{
-	Unref(val);
-	val = nullptr;
-	}
+Tag::~Tag() = default;
 
 Tag& Tag::operator=(const Tag& other)
 	{
@@ -56,11 +55,7 @@ Tag& Tag::operator=(const Tag& other)
 		{
 		type = other.type;
 		subtype = other.subtype;
-		Unref(val);
 		val = other.val;
-
-		if ( val )
-			Ref(val);
 		}
 
 	return *this;
@@ -72,26 +67,28 @@ Tag& Tag::operator=(const Tag&& other) noexcept
 		{
 		type = other.type;
 		subtype = other.subtype;
-		Unref(val);
-		val = other.val;
-		other.val = nullptr;
+		val = std::move(other.val);
 		}
 
 	return *this;
 	}
 
-EnumVal* Tag::AsEnumVal(EnumType* etype) const
+const IntrusivePtr<EnumVal>& Tag::AsVal(const IntrusivePtr<EnumType>& etype) const
 	{
 	if ( ! val )
 		{
 		assert(type == 0 && subtype == 0);
-		Ref(etype);
-		val = etype->GetVal(0).release();
+		val = etype->GetVal(0);
 		}
 
 	return val;
 	}
 
+EnumVal* Tag::AsEnumVal(EnumType* etype) const
+	{
+	return AsVal({NewRef{}, etype}).get();
+	}
+
 std::string Tag::AsString() const
 	{
 	return fmt("%" PRIu32 "/%" PRIu32, type, subtype);
diff --git a/src/Tag.h b/src/Tag.h
index f10c59cd4b..68e7f34b80 100644
--- a/src/Tag.h
+++ b/src/Tag.h
@@ -3,6 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
+#include "IntrusivePtr.h"
 
 #include <string>
 
@@ -114,6 +115,9 @@ protected:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
+	const IntrusivePtr<EnumVal>& AsVal(const IntrusivePtr<EnumType>& etype) const;
+
+	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal(EnumType* etype) const;
 
 	/**
@@ -127,6 +131,9 @@ protected:
 	 * @param subtype The sub type, which is left to an analyzer for
 	 * interpretation. By default it's set to zero.
 	 */
+	Tag(const IntrusivePtr<EnumType>& etype, type_t type, subtype_t subtype = 0);
+
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr& instead.")]]
 	Tag(EnumType* etype, type_t type, subtype_t subtype = 0);
 
 	/**
@@ -134,10 +141,13 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Analyzer::Tag.
 	 */
+	explicit Tag(IntrusivePtr<EnumVal> val);
+
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Tag(EnumVal* val);
 
 private:
 	type_t type;            // Main type.
 	subtype_t subtype;      // Subtype.
-	mutable EnumVal* val;   // Script-layer value.
+	mutable IntrusivePtr<EnumVal> val;   // Script-layer value.
 };
diff --git a/src/Trigger.cc b/src/Trigger.cc
index f024cfbbe5..18fd850b64 100644
--- a/src/Trigger.cc
+++ b/src/Trigger.cc
@@ -50,7 +50,8 @@ TraversalCode TriggerTraversalCallback::PreExpr(const Expr* expr)
 		if ( e->Id()->IsGlobal() )
 			trigger->Register(e->Id());
 
-		Val* v = e->Id()->ID_Val();
+		Val* v = e->Id()->GetVal().get();
+
 		if ( v && v->Modifiable() )
 			trigger->Register(v);
 		break;
diff --git a/src/TunnelEncapsulation.cc b/src/TunnelEncapsulation.cc
index 2f3deb9e14..1b36a3f898 100644
--- a/src/TunnelEncapsulation.cc
+++ b/src/TunnelEncapsulation.cc
@@ -16,17 +16,17 @@ EncapsulatingConn::EncapsulatingConn(Connection* c, BifEnum::Tunnel::Type t)
 		}
 	}
 
-RecordVal* EncapsulatingConn::GetRecordVal() const
+IntrusivePtr<RecordVal> EncapsulatingConn::ToVal() const
 	{
-	RecordVal *rv = new RecordVal(BifType::Record::Tunnel::EncapsulatingConn);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::Tunnel::EncapsulatingConn);
 
-	auto id_val = make_intrusive<RecordVal>(conn_id);
+	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
 	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->Port(ntohs(src_port), proto));
 	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->Port(ntohs(dst_port), proto));
 	rv->Assign(0, std::move(id_val));
-	rv->Assign(1, BifType::Enum::Tunnel::Type->GetVal(type));
+	rv->Assign(1, zeek::BifType::Enum::Tunnel::Type->GetVal(type));
 
 	rv->Assign(2, make_intrusive<StringVal>(uid.Base62("C").c_str()));
 
diff --git a/src/TunnelEncapsulation.h b/src/TunnelEncapsulation.h
index 4fc0d19b3e..3b2a06db49 100644
--- a/src/TunnelEncapsulation.h
+++ b/src/TunnelEncapsulation.h
@@ -3,9 +3,10 @@
 #pragma once
 
 #include "zeek-config.h"
+#include "IntrusivePtr.h"
 #include "NetVar.h"
 #include "IPAddr.h"
-#include "Var.h" // for internal_type()
+#include "ID.h"
 #include "UID.h"
 
 #include <vector>
@@ -79,7 +80,11 @@ public:
 	/**
 	 * Returns record value of type "EncapsulatingConn" representing the tunnel.
 	 */
-	RecordVal* GetRecordVal() const;
+	IntrusivePtr<RecordVal> ToVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
+	RecordVal* GetRecordVal() const
+		{ return ToVal().release(); }
 
 	friend bool operator==(const EncapsulatingConn& ec1,
 	                       const EncapsulatingConn& ec2)
@@ -190,20 +195,24 @@ public:
 	 * Get the value of type "EncapsulatingConnVector" represented by the
 	 * entire encapsulation chain.
 	 */
-	VectorVal* GetVectorVal() const
+	IntrusivePtr<VectorVal> ToVal() const
 		{
-		VectorVal* vv = new VectorVal(
-		    internal_type("EncapsulatingConnVector")->AsVectorType());
+		auto vv = make_intrusive<VectorVal>(
+		    zeek::id::find_type<VectorType>("EncapsulatingConnVector"));
 
 		if ( conns )
 			{
 			for ( size_t i = 0; i < conns->size(); ++i )
-				vv->Assign(i, (*conns)[i].GetRecordVal());
+				vv->Assign(i, (*conns)[i].ToVal());
 			}
 
 		return vv;
 		}
 
+	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
+	VectorVal* GetVectorVal() const
+		{ return ToVal().release(); }
+
 	friend bool operator==(const EncapsulationStack& e1,
 	                       const EncapsulationStack& e2);
 
diff --git a/src/Type.cc b/src/Type.cc
index 934d82d926..382da6cb8c 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -69,7 +69,7 @@ BroType::BroType(TypeTag t, bool arg_base_type)
 	{
 	}
 
-BroType* BroType::ShallowClone()
+IntrusivePtr<BroType> BroType::ShallowClone()
 	{
 	switch ( tag ) {
 		case TYPE_VOID:
@@ -87,7 +87,7 @@ BroType* BroType::ShallowClone()
 		case TYPE_ADDR:
 		case TYPE_SUBNET:
 		case TYPE_ANY:
-			return new BroType(tag, base_type);
+			return make_intrusive<BroType>(tag, base_type);
 
 		default:
 			reporter->InternalError("cloning illegal base BroType");
@@ -109,9 +109,9 @@ int BroType::MatchesIndex(ListExpr* const index) const
 	return DOES_NOT_MATCH_INDEX;
 	}
 
-BroType* BroType::YieldType()
+const IntrusivePtr<BroType>& BroType::Yield() const
 	{
-	return nullptr;
+	return BroType::nil;
 	}
 
 bool BroType::HasField(const char* /* field */) const
@@ -153,12 +153,6 @@ unsigned int BroType::MemoryAllocation() const
 	return padded_sizeof(*this);
 	}
 
-TypeList::~TypeList()
-	{
-	for ( const auto& type : types )
-		Unref(type);
-	}
-
 bool TypeList::AllMatch(const BroType* t, bool is_init) const
 	{
 	for ( const auto& type : types )
@@ -169,18 +163,18 @@ bool TypeList::AllMatch(const BroType* t, bool is_init) const
 
 void TypeList::Append(IntrusivePtr<BroType> t)
 	{
-	if ( pure_type && ! same_type(t.get(), pure_type.get()) )
+	if ( pure_type && ! same_type(t, pure_type) )
 		reporter->InternalError("pure type-list violation");
 
-	types.push_back(t.release());
+	types.emplace_back(std::move(t));
 	}
 
 void TypeList::AppendEvenIfNotPure(IntrusivePtr<BroType> t)
 	{
-	if ( pure_type && ! same_type(t.get(), pure_type.get()) )
+	if ( pure_type && ! same_type(t, pure_type) )
 		pure_type = nullptr;
 
-	types.push_back(t.release());
+	types.emplace_back(std::move(t));
 	}
 
 void TypeList::Describe(ODesc* d) const
@@ -193,14 +187,14 @@ void TypeList::Describe(ODesc* d) const
 		d->Add(IsPure());
 		if ( IsPure() )
 			pure_type->Describe(d);
-		d->Add(types.length());
+		d->Add(static_cast<uint64_t>(types.size()));
 		}
 
 	if ( IsPure() )
 		pure_type->Describe(d);
 	else
 		{
-		loop_over_list(types, i)
+		for ( size_t i = 0; i < types.size(); ++i )
 			{
 			if ( i > 0 && ! d->IsBinary() )
 				d->Add(",");
@@ -212,9 +206,16 @@ void TypeList::Describe(ODesc* d) const
 
 unsigned int TypeList::MemoryAllocation() const
 	{
+	unsigned int size = 0;
+
+	for ( const auto& t : types )
+		size += t->MemoryAllocation();
+
+	size += pad_size(types.capacity() * sizeof(decltype(types)::value_type));
+
 	return BroType::MemoryAllocation()
 		+ padded_sizeof(*this) - padded_sizeof(BroType)
-		+ types.MemoryAllocation() - padded_sizeof(types);
+		+ size;
 	}
 
 IndexType::~IndexType() = default;
@@ -222,37 +223,30 @@ IndexType::~IndexType() = default;
 int IndexType::MatchesIndex(ListExpr* const index) const
 	{
 	// If we have a type indexed by subnets, addresses are ok.
-	const type_list* types = indices->Types();
+	const auto& types = indices->Types();
 	const expr_list& exprs = index->Exprs();
 
-	if ( types->length() == 1 && (*types)[0]->Tag() == TYPE_SUBNET &&
-	     exprs.length() == 1 && exprs[0]->Type()->Tag() == TYPE_ADDR )
+	if ( types.size() == 1 && types[0]->Tag() == TYPE_SUBNET &&
+	     exprs.length() == 1 && exprs[0]->GetType()->Tag() == TYPE_ADDR )
 		return MATCHES_INDEX_SCALAR;
 
-	return check_and_promote_exprs(index, Indices()) ?
+	return check_and_promote_exprs(index, GetIndices().get()) ?
 			MATCHES_INDEX_SCALAR : DOES_NOT_MATCH_INDEX;
 	}
 
-BroType* IndexType::YieldType()
-	{
-	return yield_type.get();
-	}
-
-const BroType* IndexType::YieldType() const
-	{
-	return yield_type.get();
-	}
-
 void IndexType::Describe(ODesc* d) const
 	{
 	BroType::Describe(d);
 	if ( ! d->IsBinary() )
 		d->Add("[");
-	loop_over_list(*IndexTypes(), i)
+
+	const auto& its = IndexTypes();
+
+	for ( auto i = 0u; i < its.size(); ++i )
 		{
 		if ( ! d->IsBinary() && i > 0 )
 			d->Add(",");
-		(*IndexTypes())[i]->Describe(d);
+		its[i]->Describe(d);
 		}
 	if ( ! d->IsBinary() )
 		d->Add("]");
@@ -277,12 +271,14 @@ void IndexType::DescribeReST(ODesc* d, bool roles_only) const
 	d->Add("` ");
 	d->Add("[");
 
-	loop_over_list(*IndexTypes(), i)
+	const auto& its = IndexTypes();
+
+	for ( auto i = 0u; i < its.size(); ++i )
 		{
 		if ( i > 0 )
 			d->Add(", ");
 
-		const BroType* t = (*IndexTypes())[i];
+		const auto& t = its[i];
 
 		if ( ! t->GetName().empty() )
 			{
@@ -313,8 +309,8 @@ void IndexType::DescribeReST(ODesc* d, bool roles_only) const
 
 bool IndexType::IsSubNetIndex() const
 	{
-	const type_list* types = indices->Types();
-	if ( types->length() == 1 && (*types)[0]->Tag() == TYPE_SUBNET )
+	const auto& types = indices->Types();
+	if ( types.size() == 1 && types[0]->Tag() == TYPE_SUBNET )
 		return true;
 	return false;
 	}
@@ -325,9 +321,9 @@ TableType::TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<BroType> yield)
 	if ( ! indices )
 		return;
 
-	type_list* tl = indices->Types();
+	const auto& tl = indices->Types();
 
-	for ( const auto& tli : *tl )
+	for ( const auto& tli : tl )
 		{
 		InternalTypeTag t = tli->InternalType();
 
@@ -346,29 +342,15 @@ TableType::TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<BroType> yield)
 		}
 	}
 
-TableType* TableType::ShallowClone()
+IntrusivePtr<BroType> TableType::ShallowClone()
 	{
-	return new TableType(indices, yield_type);
+	return make_intrusive<TableType>(indices, yield_type);
 	}
 
 bool TableType::IsUnspecifiedTable() const
 	{
 	// Unspecified types have an empty list of indices.
-	return indices->Types()->length() == 0;
-	}
-
-TypeList* TableType::ExpandRecordIndex(RecordType* rt) const
-	{
-	TypeList* tl = new TypeList();
-
-	int n = rt->NumFields();
-	for ( int i = 0; i < n; ++i )
-		{
-		TypeDecl* td = rt->FieldDecl(i);
-		tl->Append(td->type);
-		}
-
-	return tl;
+	return indices->Types().empty();
 	}
 
 SetType::SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<ListExpr> arg_elements)
@@ -383,28 +365,28 @@ SetType::SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<ListExpr> arg_elements
 			}
 		else
 			{
-			TypeList* tl_type = elements->Type()->AsTypeList();
-			type_list* tl = tl_type->Types();
+			TypeList* tl_type = elements->GetType()->AsTypeList();
+			const auto& tl = tl_type->Types();
 
-			if ( tl->length() < 1 )
+			if ( tl.size() < 1 )
 				{
 				Error("no type given for set");
 				SetError();
 				}
 
-			else if ( tl->length() == 1 )
+			else if ( tl.size() == 1 )
 				{
-				IntrusivePtr<BroType> ft{NewRef{}, flatten_type((*tl)[0])};
+				IntrusivePtr<BroType> ft{NewRef{}, flatten_type(tl[0].get())};
 				indices = make_intrusive<TypeList>(ft);
 				indices->Append(std::move(ft));
 				}
 
 			else
 				{
-				auto t = merge_types((*tl)[0], (*tl)[1]);
+				auto t = merge_types(tl[0], tl[1]);
 
-				for ( int i = 2; t && i < tl->length(); ++i )
-					t = merge_types(t.get(), (*tl)[i]);
+				for ( size_t i = 2; t && i < tl.size(); ++i )
+					t = merge_types(t, tl[i]);
 
 				if ( ! t )
 					{
@@ -419,9 +401,9 @@ SetType::SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<ListExpr> arg_elements
 		}
 	}
 
-SetType* SetType::ShallowClone()
+IntrusivePtr<BroType> SetType::ShallowClone()
 	{
-	return new SetType(indices, elements);
+	return make_intrusive<SetType>(indices, elements);
 	}
 
 SetType::~SetType() = default;
@@ -440,7 +422,7 @@ FuncType::FuncType(IntrusivePtr<RecordType> arg_args,
 		{
 		const TypeDecl* td = args->FieldDecl(i);
 
-		if ( td->attrs && td->attrs->FindAttr(ATTR_DEFAULT) )
+		if ( td->attrs && td->attrs->Find(ATTR_DEFAULT) )
 			has_default_arg = true;
 
 		else if ( has_default_arg )
@@ -450,18 +432,18 @@ FuncType::FuncType(IntrusivePtr<RecordType> arg_args,
 			args->Error(err_str);
 			}
 
-		arg_types->Append({NewRef{}, args->FieldType(i)});
+		arg_types->Append(args->GetFieldType(i));
 		offsets[i] = i;
 		}
 
 	prototypes.emplace_back(Prototype{false, args, std::move(offsets)});
 	}
 
-FuncType* FuncType::ShallowClone()
+IntrusivePtr<BroType> FuncType::ShallowClone()
 	{
-	auto f = new FuncType();
-	f->args = {NewRef{}, args->AsRecordType()};
-	f->arg_types = {NewRef{}, arg_types->AsTypeList()};
+	auto f = make_intrusive<FuncType>();
+	f->args = args;
+	f->arg_types = arg_types;
 	f->yield = yield;
 	f->flavor = flavor;
 	f->prototypes = prototypes;
@@ -489,16 +471,6 @@ string FuncType::FlavorString() const
 
 FuncType::~FuncType() = default;
 
-BroType* FuncType::YieldType()
-	{
-	return yield.get();
-	}
-
-const BroType* FuncType::YieldType() const
-	{
-	return yield.get();
-	}
-
 int FuncType::MatchesIndex(ListExpr* const index) const
 	{
 	return check_and_promote_args(index, args.get()) ?
@@ -507,22 +479,34 @@ int FuncType::MatchesIndex(ListExpr* const index) const
 
 bool FuncType::CheckArgs(const type_list* args, bool is_init) const
 	{
-	const type_list* my_args = arg_types->Types();
+	std::vector<IntrusivePtr<BroType>> as;
+	as.reserve(args->length());
 
-	if ( my_args->length() != args->length() )
+	for ( auto a : *args )
+		as.emplace_back(NewRef{}, a);
+
+	return CheckArgs(as, is_init);
+	}
+
+bool FuncType::CheckArgs(const std::vector<IntrusivePtr<BroType>>& args,
+                         bool is_init) const
+	{
+	const auto& my_args = arg_types->Types();
+
+	if ( my_args.size() != args.size() )
 		{
-		Warn(fmt("Wrong number of arguments for function. Expected %d, got %d.",
-			args->length(), my_args->length()));
+		Warn(fmt("Wrong number of arguments for function. Expected %zu, got %zu.",
+		         args.size(), my_args.size()));
 		return false;
 		}
 
 	bool success = true;
 
-	for ( int i = 0; i < my_args->length(); ++i )
-		if ( ! same_type((*args)[i], (*my_args)[i], is_init) )
+	for ( size_t i = 0; i < my_args.size(); ++i )
+		if ( ! same_type(args[i], my_args[i], is_init) )
 			{
-			Warn(fmt("Type mismatch in function argument #%d. Expected %s, got %s.",
-				i, type_name((*args)[i]->Tag()), type_name((*my_args)[i]->Tag())));
+			Warn(fmt("Type mismatch in function argument #%zu. Expected %s, got %s.",
+				i, type_name(args[i]->Tag()), type_name(my_args[i]->Tag())));
 			success = false;
 			}
 
@@ -605,8 +589,8 @@ std::optional<FuncType::Prototype> FuncType::FindPrototype(const RecordType& arg
 
 		for ( auto i = 0; i < args.NumFields(); ++i )
 			{
-			auto ptype = p.args->FieldType(i);
-			auto desired_type = args.FieldType(i);
+			const auto& ptype = p.args->GetFieldType(i);
+			const auto& desired_type = args.GetFieldType(i);
 
 			if ( ! same_type(ptype, desired_type) ||
 			     ! streq(args.FieldName(i), p.args->FieldName(i)) )
@@ -623,12 +607,12 @@ std::optional<FuncType::Prototype> FuncType::FindPrototype(const RecordType& arg
 	return {};
 	}
 
-TypeDecl::TypeDecl(IntrusivePtr<BroType> t, const char* i, attr_list* arg_attrs, bool in_record)
+TypeDecl::TypeDecl(const char* i, IntrusivePtr<BroType> t,
+                   IntrusivePtr<Attributes> arg_attrs)
 	: type(std::move(t)),
-	  attrs(arg_attrs ? make_intrusive<Attributes>(arg_attrs, type, in_record, false) : nullptr),
+	  attrs(std::move(arg_attrs)),
 	  id(i)
-	{
-	}
+	{}
 
 TypeDecl::TypeDecl(const TypeDecl& other)
 	{
@@ -672,12 +656,12 @@ RecordType::RecordType(type_decl_list* arg_types) : BroType(TYPE_RECORD)
 
 // in this case the clone is actually not so shallow, since
 // it gets modified by everyone.
-RecordType* RecordType::ShallowClone()
+IntrusivePtr<BroType> RecordType::ShallowClone()
 	{
 	auto pass = new type_decl_list();
 	for ( const auto& type : *types )
 		pass->push_back(new TypeDecl(*type));
-	return new RecordType(pass);
+	return make_intrusive<RecordType>(pass);
 	}
 
 RecordType::~RecordType()
@@ -696,17 +680,6 @@ bool RecordType::HasField(const char* field) const
 	return FieldOffset(field) >= 0;
 	}
 
-BroType* RecordType::FieldType(const char* field) const
-	{
-	int offset = FieldOffset(field);
-	return offset >= 0 ? FieldType(offset) : nullptr;
-	}
-
-BroType* RecordType::FieldType(int field) const
-	{
-	return (*types)[field]->type.get();
-	}
-
 IntrusivePtr<Val> RecordType::FieldDefault(int field) const
 	{
 	const TypeDecl* td = FieldDecl(field);
@@ -714,9 +687,8 @@ IntrusivePtr<Val> RecordType::FieldDefault(int field) const
 	if ( ! td->attrs )
 		return nullptr;
 
-	const Attr* def_attr = td->attrs->FindAttr(ATTR_DEFAULT);
-
-	return def_attr ? def_attr->AttrExpr()->Eval(nullptr) : nullptr;
+	const auto& def_attr = td->attrs->Find(ATTR_DEFAULT);
+	return def_attr ? def_attr->GetExpr()->Eval(nullptr) : nullptr;
 	}
 
 int RecordType::FieldOffset(const char* field) const
@@ -792,25 +764,27 @@ static string container_type_name(const BroType* ft)
 	if ( ft->Tag() == TYPE_RECORD )
 		s = "record " + ft->GetName();
 	else if ( ft->Tag() == TYPE_VECTOR )
-		s = "vector of " + container_type_name(ft->YieldType());
+		s = "vector of " + container_type_name(ft->Yield().get());
 	else if ( ft->Tag() == TYPE_TABLE )
 		{
 		if ( ft->IsSet() )
 			s = "set[";
 		else
 			s = "table[";
-		const type_list* tl = ((const IndexType*) ft)->IndexTypes();
-		loop_over_list(*tl, i)
+
+		const auto& tl = ((const IndexType*) ft)->IndexTypes();
+
+		for ( auto i = 0u; i < tl.size(); ++i )
 			{
 			if ( i > 0 )
 				s += ",";
-			s += container_type_name((*tl)[i]);
+			s += container_type_name(tl[i].get());
 			}
 		s += "]";
-		if ( ft->YieldType() )
+		if ( ft->Yield() )
 			{
 			s += " of ";
-			s += container_type_name(ft->YieldType());
+			s += container_type_name(ft->Yield().get());
 			}
 		}
 	else
@@ -820,70 +794,56 @@ static string container_type_name(const BroType* ft)
 
 IntrusivePtr<TableVal> RecordType::GetRecordFieldsVal(const RecordVal* rv) const
 	{
-	auto rval = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, internal_type("record_field_table")->AsTableType()});
+	static auto record_field = zeek::id::find_type<RecordType>("record_field");
+	static auto record_field_table = zeek::id::find_type<TableType>("record_field_table");
+	auto rval = make_intrusive<TableVal>(record_field_table);
 
 	for ( int i = 0; i < NumFields(); ++i )
 		{
-		const BroType* ft = FieldType(i);
+		const auto& ft = GetFieldType(i);
 		const TypeDecl* fd = FieldDecl(i);
-		Val* fv = nullptr;
+		IntrusivePtr<Val> fv;
 
 		if ( rv )
-			fv = rv->Lookup(i);
+			fv = rv->GetField(i);
 
-		if ( fv )
-			::Ref(fv);
+		bool logged = (fd->attrs && fd->GetAttr(ATTR_LOG) != nullptr);
 
-		bool logged = (fd->attrs && fd->FindAttr(ATTR_LOG) != nullptr);
+		auto nr = make_intrusive<RecordVal>(record_field);
 
-		auto nr = make_intrusive<RecordVal>(internal_type("record_field")->AsRecordType());
-
-		string s = container_type_name(ft);
+		string s = container_type_name(ft.get());
 		nr->Assign(0, make_intrusive<StringVal>(s));
 		nr->Assign(1, val_mgr->Bool(logged));
-		nr->Assign(2, fv);
+		nr->Assign(2, std::move(fv));
 		nr->Assign(3, FieldDefault(i));
-		Val* field_name = new StringVal(FieldName(i));
-		rval->Assign(field_name, std::move(nr));
-		Unref(field_name);
+		auto field_name = make_intrusive<StringVal>(FieldName(i));
+		rval->Assign(std::move(field_name), std::move(nr));
 		}
 
 	return rval;
 	}
 
-const char* RecordType::AddFields(type_decl_list* others, attr_list* attr)
+const char* RecordType::AddFields(const type_decl_list& others,
+                                  bool add_log_attr)
 	{
 	assert(types);
 
 	bool log = false;
 
-	if ( attr )
+	for ( const auto& td : others )
 		{
-		for ( const auto& at : *attr )
-			{
-			if ( at->Tag() == ATTR_LOG )
-				log = true;
-			}
-		}
-
-	for ( const auto& td : *others )
-		{
-		if ( ! td->FindAttr(ATTR_DEFAULT) &&
-		     ! td->FindAttr(ATTR_OPTIONAL) )
-			{
-			delete others;
+		if ( ! td->GetAttr(ATTR_DEFAULT) && ! td->GetAttr(ATTR_OPTIONAL) )
 			return "extension field must be &optional or have &default";
-			}
 		}
 
 	TableVal::SaveParseTimeTableState(this);
 
-	for ( const auto& td : *others )
+	for ( const auto& td : others )
 		{
-		if ( log )
+		if ( add_log_attr )
 			{
 			if ( ! td->attrs )
-				td->attrs = make_intrusive<Attributes>(new attr_list, td->type, true, false);
+				td->attrs = make_intrusive<Attributes>(td->type, true, false);
 
 			td->attrs->AddAttr(make_intrusive<Attr>(ATTR_LOG));
 			}
@@ -891,8 +851,6 @@ const char* RecordType::AddFields(type_decl_list* others, attr_list* attr)
 		types->push_back(td);
 		}
 
-	delete others;
-
 	num_fields = types->length();
 	RecordVal::ResizeParseTimeRecords(this);
 	TableVal::RebuildParseTimeTables();
@@ -1035,9 +993,9 @@ string RecordType::GetFieldDeprecationWarning(int field, bool has_check) const
 	if ( decl)
 		{
 		string result;
-		if ( const Attr* deprecation = decl->FindAttr(ATTR_DEPRECATED) )
+		if ( const auto& deprecation = decl->GetAttr(ATTR_DEPRECATED) )
 			{
-			ConstExpr* expr = static_cast<ConstExpr*>(deprecation->AttrExpr());
+			auto expr = static_cast<ConstExpr*>(deprecation->GetExpr().get());
 			if ( expr )
 				{
 				StringVal* text = expr->Value()->AsStringVal();
@@ -1075,11 +1033,6 @@ FileType::FileType(IntrusivePtr<BroType> yield_type)
 
 FileType::~FileType() = default;
 
-BroType* FileType::YieldType()
-	{
-	return yield.get();
-	}
-
 void FileType::Describe(ODesc* d) const
 	{
 	if ( d->IsReadable() )
@@ -1128,12 +1081,12 @@ EnumType::EnumType(const EnumType* e)
 	SetName(e->GetName());
 	}
 
-EnumType* EnumType::ShallowClone()
+IntrusivePtr<BroType> EnumType::ShallowClone()
 	{
 	if ( counter == 0 )
-		return new EnumType(GetName());
+		return make_intrusive<EnumType>(GetName());
 
-	return new EnumType(this);
+	return make_intrusive<EnumType>(this);
 	}
 
 EnumType::~EnumType() = default;
@@ -1197,7 +1150,7 @@ void EnumType::CheckAndAddName(const string& module_name, const char* name,
 		// cyclic dependencies.
 		string fullname = make_full_var_name(module_name.c_str(), name);
 		if ( id->Name() != fullname
-		     || (id->HasVal() && val != id->ID_Val()->AsEnum())
+		     || (id->HasVal() && val != id->GetVal()->AsEnum())
 		     || (names.find(fullname) != names.end() && names[fullname] != val) )
 			{
 			reporter->Error("identifier or enumerator value in enumerated type definition already exists");
@@ -1209,7 +1162,7 @@ void EnumType::CheckAndAddName(const string& module_name, const char* name,
 	AddNameInternal(module_name, name, val, is_export);
 
 	if ( vals.find(val) == vals.end() )
-		vals[val] = IntrusivePtr{AdoptRef{}, new EnumVal(this, val)};
+		vals[val] = make_intrusive<EnumVal>(IntrusivePtr{NewRef{}, this}, val);
 
 	set<BroType*> types = BroType::GetAliases(GetName());
 	set<BroType*>::const_iterator it;
@@ -1258,20 +1211,17 @@ EnumType::enum_name_list EnumType::Names() const
 	return n;
 	}
 
-IntrusivePtr<EnumVal> EnumType::GetVal(bro_int_t i)
+const IntrusivePtr<EnumVal>& EnumType::GetVal(bro_int_t i)
 	{
 	auto it = vals.find(i);
-	IntrusivePtr<EnumVal> rval;
 
 	if ( it == vals.end() )
 		{
-		rval = IntrusivePtr{AdoptRef{}, new EnumVal(this, i)};
-		vals[i] = rval;
+		auto ev = make_intrusive<EnumVal>(IntrusivePtr{NewRef{}, this}, i);
+		return vals.emplace(i, std::move(ev)).first->second;
 		}
-	else
-		rval = it->second;
 
-	return rval;
+	return it->second;
 	}
 
 void EnumType::DescribeReST(ODesc* d, bool roles_only) const
@@ -1356,40 +1306,23 @@ VectorType::VectorType(IntrusivePtr<BroType> element_type)
 	{
 	}
 
-VectorType* VectorType::ShallowClone()
+IntrusivePtr<BroType> VectorType::ShallowClone()
 	{
-	return new VectorType(yield_type);
+	return make_intrusive<VectorType>(yield_type);
 	}
 
 VectorType::~VectorType() = default;
 
-BroType* VectorType::YieldType()
+const IntrusivePtr<BroType>& VectorType::Yield() const
 	{
 	// Work around the fact that we use void internally to mark a vector
 	// as being unspecified. When looking at its yield type, we need to
 	// return any as that's what other code historically expects for type
 	// comparisions.
 	if ( IsUnspecifiedVector() )
-		return base_type_no_ref(TYPE_ANY);
+		return ::base_type(TYPE_ANY);
 
-	return yield_type.get();
-	}
-
-const BroType* VectorType::YieldType() const
-	{
-	// Work around the fact that we use void internally to mark a vector
-	// as being unspecified. When looking at its yield type, we need to
-	// return any as that's what other code historically expects for type
-	// comparisions.
-	if ( IsUnspecifiedVector() )
-		{
-		auto ret = ::base_type(TYPE_ANY);
-		assert(ret);
-		// release, because this won't be held by anyone.
-		return ret.release();
-		}
-
-	return yield_type.get();
+	return yield_type;
 	}
 
 int VectorType::MatchesIndex(ListExpr* const index) const
@@ -1401,13 +1334,13 @@ int VectorType::MatchesIndex(ListExpr* const index) const
 
 	if ( el.length() == 2 )
 		return MATCHES_INDEX_VECTOR;
-	else if ( el[0]->Type()->Tag() == TYPE_VECTOR )
-		return (IsIntegral(el[0]->Type()->YieldType()->Tag()) ||
-			 IsBool(el[0]->Type()->YieldType()->Tag())) ?
+	else if ( el[0]->GetType()->Tag() == TYPE_VECTOR )
+		return (IsIntegral(el[0]->GetType()->Yield()->Tag()) ||
+			 IsBool(el[0]->GetType()->Yield()->Tag())) ?
 				MATCHES_INDEX_VECTOR : DOES_NOT_MATCH_INDEX;
 	else
-		return (IsIntegral(el[0]->Type()->Tag()) ||
-			 IsBool(el[0]->Type()->Tag())) ?
+		return (IsIntegral(el[0]->GetType()->Tag()) ||
+			 IsBool(el[0]->GetType()->Tag())) ?
 				MATCHES_INDEX_SCALAR : DOES_NOT_MATCH_INDEX;
 	}
 
@@ -1436,63 +1369,61 @@ void VectorType::DescribeReST(ODesc* d, bool roles_only) const
 		d->Add(fmt(":zeek:type:`%s`", yield_type->GetName().c_str()));
 	}
 
-BroType* base_type_no_ref(TypeTag tag)
+const IntrusivePtr<BroType>& base_type(TypeTag tag)
 	{
-	static BroType* base_types[NUM_TYPES];
+	static IntrusivePtr<BroType> base_types[NUM_TYPES];
 
-	// We could check here that "tag" actually corresponds to a BRO
-	// basic type.
-
-	int t = int(tag);
-	if ( ! base_types[t] )
+	// We could check here that "tag" actually corresponds to a basic type.
+	if ( ! base_types[tag] )
 		{
-		base_types[t] = new BroType(tag, true);
+		base_types[tag] = make_intrusive<BroType>(tag, true);
 		// Give the base types a pseudo-location for easier identification.
 		Location l(type_name(tag), 0, 0, 0, 0);
-		base_types[t]->SetLocationInfo(&l);
+		base_types[tag]->SetLocationInfo(&l);
 		}
 
-	return base_types[t];
+	return base_types[tag];
 	}
 
-
 // Returns true if t1 is initialization-compatible with t2 (i.e., if an
 // initializer with type t1 can be used to initialize a value with type t2),
 // false otherwise.  Assumes that t1's tag is different from t2's.  Note
 // that the test is in only one direction - we don't check whether t2 is
 // initialization-compatible with t1.
-static bool is_init_compat(const BroType* t1, const BroType* t2)
+static bool is_init_compat(const BroType& t1, const BroType& t2)
 	{
-	if ( t1->Tag() == TYPE_LIST )
+	if ( t1.Tag() == TYPE_LIST )
 		{
-		if ( t2->Tag() == TYPE_RECORD )
+		if ( t2.Tag() == TYPE_RECORD )
 			return true;
 		else
-			return t1->AsTypeList()->AllMatch(t2, true);
+			return t1.AsTypeList()->AllMatch(&t2, true);
 		}
 
-	if ( t1->IsSet() )
-		return same_type(t1->AsSetType()->Indices(), t2, true);
+	if ( t1.IsSet() )
+		return same_type(*t1.AsSetType()->GetIndices(), t2, true);
 
 	return false;
 	}
 
-bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_record_field_names)
+bool same_type(const BroType& arg_t1, const BroType& arg_t2,
+               bool is_init, bool match_record_field_names)
 	{
-	if ( t1 == t2 ||
-	     t1->Tag() == TYPE_ANY ||
-	     t2->Tag() == TYPE_ANY )
+	if ( &arg_t1 == &arg_t2 ||
+	     arg_t1.Tag() == TYPE_ANY ||
+	     arg_t2.Tag() == TYPE_ANY )
 		return true;
 
-	t1 = flatten_type(t1);
-	t2 = flatten_type(t2);
+	auto t1 = flatten_type(&arg_t1);
+	auto t2 = flatten_type(&arg_t2);
+
 	if ( t1 == t2 )
 		return true;
 
 	if ( t1->Tag() != t2->Tag() )
 		{
 		if ( is_init )
-			return is_init_compat(t1, t2) || is_init_compat(t2, t1);
+			return is_init_compat(*t1, *t2) || is_init_compat(*t2, *t1);
 
 		return false;
 		}
@@ -1528,8 +1459,8 @@ bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_re
 		const IndexType* it1 = (const IndexType*) t1;
 		const IndexType* it2 = (const IndexType*) t2;
 
-		TypeList* tl1 = it1->Indices();
-		TypeList* tl2 = it2->Indices();
+		const auto& tl1 = it1->GetIndices();
+		const auto& tl2 = it2->GetIndices();
 
 		if ( tl1 || tl2 )
 			{
@@ -1537,8 +1468,8 @@ bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_re
 				return false;
 			}
 
-		const BroType* y1 = t1->YieldType();
-		const BroType* y2 = t2->YieldType();
+		const auto& y1 = t1->Yield();
+		const auto& y2 = t2->Yield();
 
 		if ( y1 || y2 )
 			{
@@ -1557,14 +1488,14 @@ bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_re
 		if ( ft1->Flavor() != ft2->Flavor() )
 			return false;
 
-		if ( t1->YieldType() || t2->YieldType() )
+		if ( t1->Yield() || t2->Yield() )
 			{
-			if ( ! t1->YieldType() || ! t2->YieldType() ||
-			     ! same_type(t1->YieldType(), t2->YieldType(), is_init, match_record_field_names) )
+			if ( ! t1->Yield() || ! t2->Yield() ||
+			     ! same_type(t1->Yield(), t2->Yield(), is_init, match_record_field_names) )
 				return false;
 			}
 
-		return ft1->CheckArgs(ft2->ArgTypes()->Types(), is_init);
+		return ft1->CheckArgs(ft2->ParamList()->Types(), is_init);
 		}
 
 	case TYPE_RECORD:
@@ -1581,7 +1512,7 @@ bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_re
 			const TypeDecl* td2 = rt2->FieldDecl(i);
 
 			if ( (match_record_field_names && ! streq(td1->id, td2->id)) ||
-			     ! same_type(td1->type.get(), td2->type.get(), is_init, match_record_field_names) )
+			     ! same_type(td1->type, td2->type, is_init, match_record_field_names) )
 				return false;
 			}
 
@@ -1590,14 +1521,14 @@ bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_re
 
 	case TYPE_LIST:
 		{
-		const type_list* tl1 = t1->AsTypeList()->Types();
-		const type_list* tl2 = t2->AsTypeList()->Types();
+		const auto& tl1 = t1->AsTypeList()->Types();
+		const auto& tl2 = t2->AsTypeList()->Types();
 
-		if ( tl1->length() != tl2->length() )
+		if ( tl1.size() != tl2.size() )
 			return false;
 
-		loop_over_list(*tl1, i)
-			if ( ! same_type((*tl1)[i], (*tl2)[i], is_init, match_record_field_names) )
+		for ( auto i = 0u; i < tl1.size(); ++i )
+			if ( ! same_type(tl1[i], tl2[i], is_init, match_record_field_names) )
 				return false;
 
 		return true;
@@ -1605,7 +1536,7 @@ bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_re
 
 	case TYPE_VECTOR:
 	case TYPE_FILE:
-		return same_type(t1->YieldType(), t2->YieldType(), is_init, match_record_field_names);
+		return same_type(t1->Yield(), t2->Yield(), is_init, match_record_field_names);
 
 	case TYPE_OPAQUE:
 		{
@@ -1618,7 +1549,7 @@ bool same_type(const BroType* t1, const BroType* t2, bool is_init, bool match_re
 		{
 		auto tt1 = t1->AsTypeType();
 		auto tt2 = t2->AsTypeType();
-		return same_type(tt1->Type(), tt1->Type(),
+		return same_type(tt1->GetType(), tt1->GetType(),
 		                 is_init, match_record_field_names);
 		}
 
@@ -1650,8 +1581,8 @@ bool record_promotion_compatible(const RecordType* super_rec,
 			// Orphaned field.
 			continue;
 
-		BroType* sub_field_type = sub_rec->FieldType(i);
-		BroType* super_field_type = super_rec->FieldType(o);
+		const auto& sub_field_type = sub_rec->GetFieldType(i);
+		const auto& super_field_type = super_rec->GetFieldType(o);
 
 		if ( same_type(sub_field_type, super_field_type) )
 			continue;
@@ -1678,16 +1609,17 @@ const BroType* flatten_type(const BroType* t)
 	const TypeList* tl = t->AsTypeList();
 
 	if ( tl->IsPure() )
-		return tl->PureType();
+		return tl->GetPureType().get();
 
-	const type_list* types = tl->Types();
+	const auto& types = tl->Types();
 
-	if ( types->length() == 0 )
+	if ( types.size() == 0 )
 		reporter->InternalError("empty type list in flatten_type");
 
-	const BroType* ft = (*types)[0];
-	if ( types->length() == 1 || tl->AllMatch(ft, false) )
-		return ft;
+	const auto& ft = types[0];
+
+	if ( types.size() == 1 || tl->AllMatch(ft, false) )
+		return ft.get();
 
 	return t;
 	}
@@ -1697,9 +1629,9 @@ BroType* flatten_type(BroType* t)
 	return (BroType*) flatten_type((const BroType*) t);
 	}
 
-bool is_assignable(BroType* t)
+bool is_assignable(TypeTag t)
 	{
-	switch ( t->Tag() ) {
+	switch ( t ) {
 	case TYPE_BOOL:
 	case TYPE_INT:
 	case TYPE_COUNT:
@@ -1766,8 +1698,11 @@ TypeTag max_type(TypeTag t1, TypeTag t2)
 		}
 	}
 
-IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
+IntrusivePtr<BroType> merge_types(const IntrusivePtr<BroType>& arg_t1,
+                                  const IntrusivePtr<BroType>& arg_t2)
 	{
+	auto t1 = arg_t1.get();
+	auto t2 = arg_t2.get();
 	t1 = flatten_type(t1);
 	t2 = flatten_type(t2);
 
@@ -1813,14 +1748,14 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 		// Doing a lookup here as a roundabout way of ref-ing t1, without
 		// changing the function params which has t1 as const and also
 		// (potentially) avoiding a pitfall mentioned earlier about clones.
-		auto id = global_scope()->Lookup(t1->GetName());
+		const auto& id = global_scope()->Find(t1->GetName());
 
-		if ( id && id->AsType() && id->AsType()->Tag() == TYPE_ENUM )
+		if ( id && id->IsType() && id->GetType()->Tag() == TYPE_ENUM )
 			// It should make most sense to return the real type here rather
 			// than a copy since it may be redef'd later in parsing.  If we
 			// return a copy, then whoever is using this return value won't
 			// actually see those changes from the redef.
-			return {NewRef{}, id->AsType()};
+			return id->GetType();
 
 		std::string msg = fmt("incompatible enum types: '%s' and '%s'"
 		                      " ('%s' enum type ID is invalid)",
@@ -1835,32 +1770,29 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 		const IndexType* it1 = (const IndexType*) t1;
 		const IndexType* it2 = (const IndexType*) t2;
 
-		const type_list* tl1 = it1->IndexTypes();
-		const type_list* tl2 = it2->IndexTypes();
+		const auto& tl1 = it1->IndexTypes();
+		const auto& tl2 = it2->IndexTypes();
 		IntrusivePtr<TypeList> tl3;
 
-		if ( tl1 || tl2 )
+		if ( tl1.size() != tl2.size() )
 			{
-			if ( ! tl1 || ! tl2 || tl1->length() != tl2->length() )
-				{
-				t1->Error("incompatible types", t2);
-				return nullptr;
-				}
-
-			tl3 = make_intrusive<TypeList>();
-
-			loop_over_list(*tl1, i)
-				{
-				auto tl3_i = merge_types((*tl1)[i], (*tl2)[i]);
-				if ( ! tl3_i )
-					return nullptr;
-
-				tl3->Append(std::move(tl3_i));
-				}
+			t1->Error("incompatible types", t2);
+			return nullptr;
 			}
 
-		const BroType* y1 = t1->YieldType();
-		const BroType* y2 = t2->YieldType();
+		tl3 = make_intrusive<TypeList>();
+
+		for ( auto i = 0u; i < tl1.size(); ++i )
+			{
+			auto tl3_i = merge_types(tl1[i], tl2[i]);
+			if ( ! tl3_i )
+				return nullptr;
+
+			tl3->Append(std::move(tl3_i));
+			}
+
+		const auto& y1 = t1->Yield();
+		const auto& y2 = t2->Yield();
 		IntrusivePtr<BroType> y3;
 
 		if ( y1 || y2 )
@@ -1892,12 +1824,13 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 
 		const FuncType* ft1 = (const FuncType*) t1;
 		const FuncType* ft2 = (const FuncType*) t1;
-		auto args = merge_types(ft1->Args(), ft2->Args());
-		auto yield = t1->YieldType() ?
-			merge_types(t1->YieldType(), t2->YieldType()) : nullptr;
+		auto args = cast_intrusive<RecordType>(merge_types(ft1->Params(),
+		                                                   ft2->Params()));
+		auto yield = t1->Yield() ?
+			merge_types(t1->Yield(), t2->Yield()) : nullptr;
 
-		return make_intrusive<FuncType>(IntrusivePtr{AdoptRef{}, args.release()->AsRecordType()},
-		                                std::move(yield), ft1->Flavor());
+		return make_intrusive<FuncType>(std::move(args), std::move(yield),
+		                                ft1->Flavor());
 		}
 
 	case TYPE_RECORD:
@@ -1914,7 +1847,7 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 			{
 			const TypeDecl* td1 = rt1->FieldDecl(i);
 			const TypeDecl* td2 = rt2->FieldDecl(i);
-			auto tdl3_i = merge_types(td1->type.get(), td2->type.get());
+			auto tdl3_i = merge_types(td1->type, td2->type);
 
 			if ( ! streq(td1->id, td2->id) || ! tdl3_i )
 				{
@@ -1923,7 +1856,7 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 				return nullptr;
 				}
 
-			tdl3->push_back(new TypeDecl(std::move(tdl3_i), copy_string(td1->id)));
+			tdl3->push_back(new TypeDecl(copy_string(td1->id), std::move(tdl3_i)));
 			}
 
 		return make_intrusive<RecordType>(tdl3);
@@ -1940,12 +1873,12 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 			return nullptr;
 			}
 
-		const type_list* l1 = tl1->Types();
-		const type_list* l2 = tl2->Types();
+		const auto& l1 = tl1->Types();
+		const auto& l2 = tl2->Types();
 
-		if ( l1->length() == 0 || l2->length() == 0 )
+		if ( l1.size() == 0 || l2.size() == 0 )
 			{
-			if ( l1->length() == 0 )
+			if ( l1.size() == 0 )
 				tl1->Error("empty list");
 			else
 				tl2->Error("empty list");
@@ -1958,41 +1891,42 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 			// the initialization expression into a set of values.
 			// So the merge type of the list is the type of one
 			// of the elements, providing they're consistent.
-			return merge_types((*l1)[0], (*l2)[0]);
+			return merge_types(l1[0], l2[0]);
 			}
 
 		// Impure lists - must have the same size and match element
 		// by element.
-		if ( l1->length() != l2->length() )
+		if ( l1.size() != l2.size() )
 			{
 			tl1->Error("different number of indices", tl2);
 			return nullptr;
 			}
 
 		auto tl3 = make_intrusive<TypeList>();
-		loop_over_list(*l1, i)
-			tl3->Append(merge_types((*l1)[i], (*l2)[i]));
+
+		for ( auto i = 0u; i < l1.size(); ++i )
+			tl3->Append(merge_types(l1[i], l2[i]));
 
 		return tl3;
 		}
 
 	case TYPE_VECTOR:
-		if ( ! same_type(t1->YieldType(), t2->YieldType()) )
+		if ( ! same_type(t1->Yield(), t2->Yield()) )
 			{
 			t1->Error("incompatible types", t2);
 			return nullptr;
 			}
 
-		return make_intrusive<VectorType>(merge_types(t1->YieldType(), t2->YieldType()));
+		return make_intrusive<VectorType>(merge_types(t1->Yield(), t2->Yield()));
 
 	case TYPE_FILE:
-		if ( ! same_type(t1->YieldType(), t2->YieldType()) )
+		if ( ! same_type(t1->Yield(), t2->Yield()) )
 			{
 			t1->Error("incompatible types", t2);
 			return nullptr;
 			}
 
-		return make_intrusive<FileType>(merge_types(t1->YieldType(), t2->YieldType()));
+		return make_intrusive<FileType>(merge_types(t1->Yield(), t2->Yield()));
 
 	case TYPE_UNION:
 		reporter->InternalError("union type in merge_types()");
@@ -2006,22 +1940,22 @@ IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2)
 
 IntrusivePtr<BroType> merge_type_list(ListExpr* elements)
 	{
-	TypeList* tl_type = elements->Type()->AsTypeList();
-	type_list* tl = tl_type->Types();
+	TypeList* tl_type = elements->GetType()->AsTypeList();
+	const auto& tl = tl_type->Types();
 
-	if ( tl->length() < 1 )
+	if ( tl.size() < 1 )
 		{
 		reporter->Error("no type can be inferred for empty list");
 		return nullptr;
 		}
 
-	IntrusivePtr<BroType> t{NewRef{}, (*tl)[0]};
+	auto t = tl[0];
 
-	if ( tl->length() == 1 )
+	if ( tl.size() == 1 )
 		return t;
 
-	for ( int i = 1; t && i < tl->length(); ++i )
-		t = merge_types(t.get(), (*tl)[i]);
+	for ( size_t i = 1; t && i < tl.size(); ++i )
+		t = merge_types(t, tl[i]);
 
 	if ( ! t )
 		reporter->Error("inconsistent types in list");
@@ -2037,11 +1971,12 @@ static BroType* reduce_type(BroType* t)
 
 	else if ( t->IsSet() )
 		{
-		TypeList* tl = t->AsTableType()->Indices();
-		if ( tl->Types()->length() == 1 )
-			return (*tl->Types())[0];
+		const auto& tl = t->AsTableType()->GetIndices();
+
+		if ( tl->Types().size() == 1 )
+			return tl->Types()[0].get();
 		else
-			return tl;
+			return tl.get();
 		}
 
 	else
@@ -2058,7 +1993,7 @@ IntrusivePtr<BroType> init_type(Expr* init)
 			return nullptr;
 
 		if ( t->Tag() == TYPE_LIST &&
-		     t->AsTypeList()->Types()->length() != 1 )
+		     t->AsTypeList()->Types().size() != 1 )
 			{
 			init->Error("list used in scalar initialization");
 			return nullptr;
@@ -2095,15 +2030,18 @@ IntrusivePtr<BroType> init_type(Expr* init)
 	for ( int i = 1; t && i < el.length(); ++i )
 		{
 		auto el_t = el[i]->InitType();
-		BroType* ti = el_t ? reduce_type(el_t.get()) : nullptr;
+		IntrusivePtr<BroType> ti;
+
+		if ( el_t )
+			ti = {NewRef{}, reduce_type(el_t.get())};
 
 		if ( ! ti )
 			return nullptr;
 
-		if ( same_type(t.get(), ti) )
+		if ( same_type(t, ti) )
 			continue;
 
-		t = merge_types(t.get(), ti);
+		t = merge_types(t, ti);
 		}
 
 	if ( ! t )
@@ -2125,12 +2063,13 @@ IntrusivePtr<BroType> init_type(Expr* init)
 		t = std::move(tl);
 		}
 
-	return make_intrusive<SetType>(IntrusivePtr{AdoptRef{}, t.release()->AsTypeList()}, nullptr);
+	return make_intrusive<SetType>(cast_intrusive<TypeList>(std::move(t)),
+	                               nullptr);
 	}
 
-bool is_atomic_type(const BroType* t)
+bool is_atomic_type(const BroType& t)
 	{
-	switch ( t->InternalType() ) {
+	switch ( t.InternalType() ) {
 	case TYPE_INTERNAL_INT:
 	case TYPE_INTERNAL_UNSIGNED:
 	case TYPE_INTERNAL_DOUBLE:
diff --git a/src/Type.h b/src/Type.h
index daa6a7fb13..80cd024ce5 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -141,6 +141,8 @@ const int MATCHES_INDEX_VECTOR = 2;
 
 class BroType : public BroObj {
 public:
+	static inline const IntrusivePtr<BroType> nil;
+
 	explicit BroType(TypeTag tag, bool base_type = false);
 
 	// Performs a shallow clone operation of the Bro type.
@@ -151,7 +153,7 @@ public:
 	// Clone operations will mostly be implemented in the derived classes;
 	// in addition cloning will be limited to classes that can be reached by
 	// the script-level.
-	virtual BroType* ShallowClone();
+	virtual IntrusivePtr<BroType> ShallowClone();
 
 	TypeTag Tag() const		{ return tag; }
 	InternalTypeTag InternalType() const	{ return internal_tag; }
@@ -171,15 +173,22 @@ public:
 	// Returns the type yielded by this type.  For example, if
 	// this type is a table[string] of port, then returns the "port"
 	// type.  Returns nil if this is not an index type.
-	virtual BroType* YieldType();
+	virtual const IntrusivePtr<BroType>& Yield() const;
+
+	[[deprecated("Remove in v4.1.  Use Yield() instead.")]]
+	virtual BroType* YieldType()
+		{ return Yield().get(); }
+	[[deprecated("Remove in v4.1.  Use Yield() instead.")]]
 	virtual const BroType* YieldType() const
-		{ return ((BroType*) this)->YieldType(); }
+		{ return Yield().get(); }
 
 	// Returns true if this type is a record and contains the
 	// given field, false otherwise.
+	[[deprecated("Remove in v4.1.  Use RecordType::HasField() directly.")]]
 	virtual bool HasField(const char* field) const;
 
 	// Returns the type of the given field, or nil if no such field.
+	[[deprecated("Remove in v4.1.  Use RecordType::GetFieldType() directly.")]]
 	virtual BroType* FieldType(const char* field) const;
 
 #define CHECK_TYPE_TAG(tag_type, func_name) \
@@ -305,12 +314,12 @@ public:
 
 	bool IsSet() const
 		{
-		return tag == TYPE_TABLE && (YieldType() == nullptr);
+		return tag == TYPE_TABLE && ! Yield();
 		}
 
 	bool IsTable() const
 		{
-		return tag == TYPE_TABLE && (YieldType() != nullptr);
+		return tag == TYPE_TABLE && Yield();
 		}
 
 	BroType* Ref()		{ ::Ref(this); return this; }
@@ -353,22 +362,27 @@ public:
 		{
 		}
 
-	~TypeList() override;
-
-	const type_list* Types() const	{ return &types; }
-	type_list* Types()		{ return &types; }
+	const std::vector<IntrusivePtr<BroType>>& Types() const
+		{ return types; }
 
 	bool IsPure() const		{ return pure_type != nullptr; }
 
 	// Returns the underlying pure type, or nil if the list
 	// is not pure or is empty.
+	const IntrusivePtr<BroType>& GetPureType() const
+		{ return pure_type; }
+
+	[[deprecated("Remove in v4.1.  Use GetPureType() instead.")]]
 	BroType* PureType()		{ return pure_type.get(); }
+	[[deprecated("Remove in v4.1.  Use GetPureType() instead.")]]
 	const BroType* PureType() const	{ return pure_type.get(); }
 
 	// True if all of the types match t, false otherwise.  If
 	// is_init is true, then the matching is done in the context
 	// of an initialization.
 	bool AllMatch(const BroType* t, bool is_init) const;
+	bool AllMatch(const IntrusivePtr<BroType>& t, bool is_init) const
+		{ return AllMatch(t.get(), is_init); }
 
 	void Append(IntrusivePtr<BroType> t);
 	void AppendEvenIfNotPure(IntrusivePtr<BroType> t);
@@ -379,17 +393,24 @@ public:
 
 protected:
 	IntrusivePtr<BroType> pure_type;
-	type_list types;
+	std::vector<IntrusivePtr<BroType>> types;
 };
 
 class IndexType : public BroType {
 public:
 	int MatchesIndex(ListExpr* index) const override;
 
+	const IntrusivePtr<TypeList>& GetIndices() const
+		{ return indices; }
+
+	[[deprecated("Remove in v4.1.  Use GetIndices().")]]
 	TypeList* Indices() const		{ return indices.get(); }
-	const type_list* IndexTypes() const	{ return indices->Types(); }
-	BroType* YieldType() override;
-	const BroType* YieldType() const override;
+
+	const std::vector<IntrusivePtr<BroType>>& IndexTypes() const
+		{ return indices->Types(); }
+
+	const IntrusivePtr<BroType>& Yield() const override
+		{ return yield_type; }
 
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
@@ -415,14 +436,11 @@ class TableType : public IndexType {
 public:
 	TableType(IntrusivePtr<TypeList> ind, IntrusivePtr<BroType> yield);
 
-	TableType* ShallowClone() override;
+	IntrusivePtr<BroType> ShallowClone() override;
 
 	// Returns true if this table type is "unspecified", which is
 	// what one gets using an empty "set()" or "table()" constructor.
 	bool IsUnspecifiedTable() const;
-
-protected:
-	TypeList* ExpandRecordIndex(RecordType* rt) const;
 };
 
 class SetType final : public TableType {
@@ -430,16 +448,22 @@ public:
 	SetType(IntrusivePtr<TypeList> ind, IntrusivePtr<ListExpr> arg_elements);
 	~SetType() override;
 
-	SetType* ShallowClone() override;
+	IntrusivePtr<BroType> ShallowClone() override;
 
+	[[deprecated("Remove in v4.1.  Use Elements() isntead.")]]
 	ListExpr* SetElements() const	{ return elements.get(); }
 
+	const IntrusivePtr<ListExpr>& Elements() const
+		{ return elements; }
+
 protected:
 	IntrusivePtr<ListExpr> elements;
 };
 
 class FuncType final : public BroType {
 public:
+	static inline const IntrusivePtr<FuncType> nil;
+
 	/**
 	 * Prototype is only currently used for events and hooks which declare
 	 * multiple signature prototypes that allow users to have handlers
@@ -453,13 +477,19 @@ public:
 
 	FuncType(IntrusivePtr<RecordType> args, IntrusivePtr<BroType> yield,
 	         function_flavor f);
-	FuncType* ShallowClone() override;
+	IntrusivePtr<BroType> ShallowClone() override;
 
 	~FuncType() override;
 
+	[[deprecated("Remove in v4.1.  Use Params().")]]
 	RecordType* Args() const	{ return args.get(); }
-	BroType* YieldType() override;
-	const BroType* YieldType() const override;
+
+	const IntrusivePtr<RecordType>& Params() const
+		{ return args; }
+
+	const IntrusivePtr<BroType>& Yield() const override
+		{ return yield; }
+
 	void SetYieldType(IntrusivePtr<BroType> arg_yield)	{ yield = std::move(arg_yield); }
 	function_flavor Flavor() const { return flavor; }
 	std::string FlavorString() const;
@@ -470,9 +500,15 @@ public:
 
 	int MatchesIndex(ListExpr* index) const override;
 	bool CheckArgs(const type_list* args, bool is_init = false) const;
+	bool CheckArgs(const std::vector<IntrusivePtr<BroType>>& args,
+	               bool is_init = false) const;
 
+	[[deprecated("Remove in v4.1.  Use ParamList().")]]
 	TypeList* ArgTypes() const	{ return arg_types.get(); }
 
+	const IntrusivePtr<TypeList>& ParamList() const
+		{ return arg_types; }
+
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
 
@@ -493,6 +529,8 @@ public:
 		{ return prototypes; }
 
 protected:
+	friend IntrusivePtr<FuncType> make_intrusive<FuncType>();
+
 	FuncType() : BroType(TYPE_FUNC) { flavor = FUNC_FLAVOR_FUNCTION; }
 	IntrusivePtr<RecordType> args;
 	IntrusivePtr<TypeList> arg_types;
@@ -504,9 +542,18 @@ protected:
 class TypeType final : public BroType {
 public:
 	explicit TypeType(IntrusivePtr<BroType> t) : BroType(TYPE_TYPE), type(std::move(t)) {}
-	TypeType* ShallowClone() override { return new TypeType(type); }
+	IntrusivePtr<BroType> ShallowClone() override { return make_intrusive<TypeType>(type); }
 
+	const IntrusivePtr<BroType>& GetType() const
+		{ return type; }
+
+	template <class T>
+	IntrusivePtr<T> GetType() const
+		{ return cast_intrusive<T>(type); }
+
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	BroType* Type()			{ return type.get(); }
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
 	const BroType* Type() const	{ return type.get(); }
 
 protected:
@@ -515,18 +562,23 @@ protected:
 
 class TypeDecl final {
 public:
-	TypeDecl(IntrusivePtr<BroType> t, const char* i, attr_list* attrs = nullptr, bool in_record = false);
+	TypeDecl() = default;
+	TypeDecl(const char* i, IntrusivePtr<BroType> t, IntrusivePtr<Attributes> attrs = nullptr);
 	TypeDecl(const TypeDecl& other);
 	~TypeDecl();
 
+	[[deprecated("Remove in v4.1.  Use GetAttr().")]]
 	const Attr* FindAttr(attr_tag a) const
-		{ return attrs ? attrs->FindAttr(a) : nullptr; }
+		{ return attrs ? attrs->Find(a).get() : nullptr; }
+
+	const IntrusivePtr<Attr>& GetAttr(attr_tag a) const
+		{ return attrs ? attrs->Find(a) : Attr::nil; }
 
 	void DescribeReST(ODesc* d, bool roles_only = false) const;
 
 	IntrusivePtr<BroType> type;
 	IntrusivePtr<Attributes> attrs;
-	const char* id;
+	const char* id = nullptr;
 };
 
 typedef PList<TypeDecl> type_decl_list;
@@ -534,13 +586,53 @@ typedef PList<TypeDecl> type_decl_list;
 class RecordType final : public BroType {
 public:
 	explicit RecordType(type_decl_list* types);
-	RecordType* ShallowClone() override;
+	IntrusivePtr<BroType> ShallowClone() override;
 
 	~RecordType() override;
 
 	bool HasField(const char* field) const override;
-	BroType* FieldType(const char* field) const override;
-	BroType* FieldType(int field) const;
+
+	[[deprecated("Remove in v4.1.  Use GetFieldType() instead (note it doesn't check for invalid names).")]]
+	BroType* FieldType(const char* field) const override
+		{
+		auto offset = FieldOffset(field);
+		return offset >= 0 ? GetFieldType(offset).get() : nullptr;
+		}
+
+	[[deprecated("Remove in v4.1.  Use GetFieldType() instead.")]]
+	BroType* FieldType(int field) const
+		{ return GetFieldType(field).get(); }
+
+	/**
+	 * Looks up a field by name and returns its type.  No check for invalid
+	 * field name is performed.
+	 */
+	const IntrusivePtr<BroType>& GetFieldType(const char* field_name) const
+		{ return GetFieldType(FieldOffset(field_name)); }
+
+	/**
+	 * Looks up a field by name and returns its type as cast to @c T.
+	 * No check for invalid field name is performed.
+	 */
+	template <class T>
+	IntrusivePtr<T> GetFieldType(const char* field_name) const
+		{ return cast_intrusive<T>(GetFieldType(field_name)); }
+
+	/**
+	 * Looks up a field by its index and returns its type.  No check for
+	 * invalid field offset is performed.
+	 */
+	const IntrusivePtr<BroType>& GetFieldType(int field_index) const
+		{ return (*types)[field_index]->type; }
+
+	/**
+	 * Looks up a field by its index and returns its type as cast to @c T.
+	 * No check for invalid field offset is performed.
+	 */
+	template <class T>
+	IntrusivePtr<T> GetFieldType(int field_index) const
+		{ return cast_intrusive<T>((*types)[field_index]->type); }
+
 	IntrusivePtr<Val> FieldDefault(int field) const;
 
 	// A field's offset is its position in the type_decl_list,
@@ -565,9 +657,9 @@ public:
 	 */
 	IntrusivePtr<TableVal> GetRecordFieldsVal(const RecordVal* rv = nullptr) const;
 
-	// Returns 0 if all is ok, otherwise a pointer to an error message.
-	// Takes ownership of list.
-	const char* AddFields(type_decl_list* types, attr_list* attr);
+	// Returns null if all is ok, otherwise a pointer to an error message.
+	const char* AddFields(const type_decl_list& types,
+	                      bool add_log_attr = false);
 
 	void Describe(ODesc* d) const override;
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
@@ -577,13 +669,13 @@ public:
 	bool IsFieldDeprecated(int field) const
 		{
 		const TypeDecl* decl = FieldDecl(field);
-		return decl && decl->FindAttr(ATTR_DEPRECATED) != nullptr;
+		return decl && decl->GetAttr(ATTR_DEPRECATED) != nullptr;
 		}
 
 	bool FieldHasAttr(int field, attr_tag at) const
 		{
 		const TypeDecl* decl = FieldDecl(field);
-		return decl && decl->FindAttr(at) != nullptr;
+		return decl && decl->GetAttr(at) != nullptr;
 		}
 
 	std::string GetFieldDeprecationWarning(int field, bool has_check) const;
@@ -604,10 +696,11 @@ public:
 class FileType final : public BroType {
 public:
 	explicit FileType(IntrusivePtr<BroType> yield_type);
-	FileType* ShallowClone() override { return new FileType(yield); }
+	IntrusivePtr<BroType> ShallowClone() override { return make_intrusive<FileType>(yield); }
 	~FileType() override;
 
-	BroType* YieldType() override;
+	const IntrusivePtr<BroType>& Yield() const override
+		{ return yield; }
 
 	void Describe(ODesc* d) const override;
 
@@ -618,7 +711,7 @@ protected:
 class OpaqueType final : public BroType {
 public:
 	explicit OpaqueType(const std::string& name);
-	OpaqueType* ShallowClone() override { return new OpaqueType(name); }
+	IntrusivePtr<BroType> ShallowClone() override { return make_intrusive<OpaqueType>(name); }
 	~OpaqueType() override { };
 
 	const std::string& Name() const { return name; }
@@ -638,7 +731,7 @@ public:
 
 	explicit EnumType(const EnumType* e);
 	explicit EnumType(const std::string& arg_name);
-	EnumType* ShallowClone() override;
+	IntrusivePtr<BroType> ShallowClone() override;
 	~EnumType() override;
 
 	// The value of this name is next internal counter value, starting
@@ -660,7 +753,7 @@ public:
 
 	void DescribeReST(ODesc* d, bool roles_only = false) const override;
 
-	IntrusivePtr<EnumVal> GetVal(bro_int_t i);
+	const IntrusivePtr<EnumVal>& GetVal(bro_int_t i);
 
 protected:
 	void AddNameInternal(const std::string& module_name,
@@ -688,10 +781,10 @@ protected:
 class VectorType final : public BroType {
 public:
 	explicit VectorType(IntrusivePtr<BroType> t);
-	VectorType* ShallowClone() override;
+	IntrusivePtr<BroType> ShallowClone() override;
 	~VectorType() override;
-	BroType* YieldType() override;
-	const BroType* YieldType() const override;
+
+	const IntrusivePtr<BroType>& Yield() const override;
 
 	int MatchesIndex(ListExpr* index) const override;
 
@@ -706,33 +799,46 @@ protected:
 	IntrusivePtr<BroType> yield_type;
 };
 
-extern OpaqueType* md5_type;
-extern OpaqueType* sha1_type;
-extern OpaqueType* sha256_type;
-extern OpaqueType* entropy_type;
-extern OpaqueType* cardinality_type;
-extern OpaqueType* topk_type;
-extern OpaqueType* bloomfilter_type;
-extern OpaqueType* x509_opaque_type;
-extern OpaqueType* ocsp_resp_opaque_type;
-extern OpaqueType* paraglob_type;
+extern IntrusivePtr<OpaqueType> md5_type;
+extern IntrusivePtr<OpaqueType> sha1_type;
+extern IntrusivePtr<OpaqueType> sha256_type;
+extern IntrusivePtr<OpaqueType> entropy_type;
+extern IntrusivePtr<OpaqueType> cardinality_type;
+extern IntrusivePtr<OpaqueType> topk_type;
+extern IntrusivePtr<OpaqueType> bloomfilter_type;
+extern IntrusivePtr<OpaqueType> x509_opaque_type;
+extern IntrusivePtr<OpaqueType> ocsp_resp_opaque_type;
+extern IntrusivePtr<OpaqueType> paraglob_type;
+
+// Returns the basic (non-parameterized) type with the given type.
+const IntrusivePtr<BroType>& base_type(TypeTag tag);
 
 // Returns the basic (non-parameterized) type with the given type.
 // The reference count of the type is not increased.
-BroType* base_type_no_ref(TypeTag tag);
-
-// Returns the basic (non-parameterized) type with the given type.
-// The caller assumes responsibility for a reference to the type.
-inline IntrusivePtr<BroType> base_type(TypeTag tag)
-	{ return {NewRef{}, base_type_no_ref(tag)}; }
+[[deprecated("Remove in v4.1.  Use ::base_type() instead")]]
+inline BroType* base_type_no_ref(TypeTag tag)
+	{ return base_type(tag).get(); }
 
 // Returns the basic error type.
-inline IntrusivePtr<BroType> error_type()	{ return base_type(TYPE_ERROR); }
+inline const IntrusivePtr<BroType>& error_type()	{ return base_type(TYPE_ERROR); }
 
 // True if the two types are equivalent.  If is_init is true then the test is
 // done in the context of an initialization. If match_record_field_names is
 // true then for record types the field names have to match, too.
-extern bool same_type(const BroType* t1, const BroType* t2, bool is_init=false, bool match_record_field_names=true);
+extern bool same_type(const BroType& t1, const BroType& t2,
+                      bool is_init=false, bool match_record_field_names=true);
+inline bool same_type(const IntrusivePtr<BroType>& t1, const IntrusivePtr<BroType>& t2,
+                      bool is_init=false, bool match_record_field_names=true)
+    { return same_type(*t1, *t2, is_init, match_record_field_names); }
+inline bool same_type(const BroType* t1, const BroType* t2,
+                      bool is_init=false, bool match_record_field_names=true)
+    { return same_type(*t1, *t2, is_init, match_record_field_names); }
+inline bool same_type(const IntrusivePtr<BroType>& t1, const BroType* t2,
+                      bool is_init=false, bool match_record_field_names=true)
+    { return same_type(*t1, *t2, is_init, match_record_field_names); }
+inline bool same_type(const BroType* t1, const IntrusivePtr<BroType>& t2,
+                      bool is_init=false, bool match_record_field_names=true)
+    { return same_type(*t1, *t2, is_init, match_record_field_names); }
 
 // True if the two attribute lists are equivalent.
 extern bool same_attrs(const Attributes* a1, const Attributes* a2);
@@ -753,7 +859,8 @@ extern TypeTag max_type(TypeTag t1, TypeTag t2);
 // Given two types, returns the "merge", in which promotable types
 // are promoted to the maximum of the two.  Returns nil (and generates
 // an error message) if the types are incompatible.
-IntrusivePtr<BroType> merge_types(const BroType* t1, const BroType* t2);
+IntrusivePtr<BroType> merge_types(const IntrusivePtr<BroType>& t1,
+                                  const IntrusivePtr<BroType>& t2);
 
 // Given a list of expressions, returns a (ref'd) type reflecting
 // a merged type consistent across all of them, or nil if this
@@ -764,10 +871,16 @@ IntrusivePtr<BroType> merge_type_list(ListExpr* elements);
 IntrusivePtr<BroType> init_type(Expr* init);
 
 // Returns true if argument is an atomic type.
-bool is_atomic_type(const BroType* t);
+bool is_atomic_type(const BroType& t);
+inline bool is_atomic_type(const BroType* t)
+	{ return is_atomic_type(*t); }
+inline bool is_atomic_type(const IntrusivePtr<BroType>& t)
+	{ return is_atomic_type(*t); }
 
 // True if the given type tag corresponds to type that can be assigned to.
-extern bool is_assignable(BroType* t);
+extern bool is_assignable(TypeTag t);
+inline bool is_assignable(BroType* t)
+	{ return ::is_assignable(t->Tag()); }
 
 // True if the given type tag corresponds to an integral type.
 inline bool IsIntegral(TypeTag t) { return (t == TYPE_INT || t == TYPE_COUNT || t == TYPE_COUNTER); }
diff --git a/src/Val.cc b/src/Val.cc
index 24c423993f..a2c062d3b2 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -34,7 +34,7 @@
 #include "Conn.h"
 #include "Reporter.h"
 #include "IPAddr.h"
-#include "Var.h" // for internal_type()
+#include "ID.h"
 
 #include "broker/Data.h"
 
@@ -42,24 +42,28 @@
 
 using namespace std;
 
-Val::Val(Func* f)
-	: val(f), type(f->FType()->Ref())
-	{
-	::Ref(val.func_val);
-	}
+Val::Val(Func* f) : Val({NewRef{}, f})
+	{}
 
-static FileType* GetStringFileType() noexcept
+Val::Val(IntrusivePtr<Func> f)
+	: val(f.release()), type(val.func_val->GetType())
+	{}
+
+static const IntrusivePtr<FileType>& GetStringFileType() noexcept
 	{
-	static FileType* string_file_type = nullptr;
-	if ( ! string_file_type )
-		string_file_type = new FileType(base_type(TYPE_STRING));
+	static IntrusivePtr<FileType> string_file_type
+		= make_intrusive<FileType>(base_type(TYPE_STRING));
+
 	return string_file_type;
 	}
 
-Val::Val(BroFile* f)
-	: val(f), type(GetStringFileType()->Ref())
+Val::Val(BroFile* f) : Val({AdoptRef{}, f})
+	{}
+
+Val::Val(IntrusivePtr<BroFile> f)
+	: val(f.release()), type(GetStringFileType())
 	{
-	assert(f->FType()->Tag() == TYPE_STRING);
+	assert(val.file_val->GetType()->Tag() == TYPE_STRING);
 	}
 
 Val::~Val()
@@ -73,7 +77,6 @@ Val::~Val()
 	else if ( type->Tag() == TYPE_FILE )
 		Unref(val.file_val);
 
-	Unref(type);
 #ifdef DEBUG
 	delete [] bound_id;
 #endif
@@ -119,7 +122,7 @@ IntrusivePtr<Val> Val::DoClone(CloneState* state)
 		// Derived classes are responsible for this. Exception:
 		// Functions and files. There aren't any derived classes.
 		if ( type->Tag() == TYPE_FUNC )
-			return make_intrusive<Val>(AsFunc()->DoClone().get());
+			return make_intrusive<Val>(AsFunc()->DoClone());
 
 		if ( type->Tag() == TYPE_FILE )
 			{
@@ -150,6 +153,12 @@ IntrusivePtr<Val> Val::DoClone(CloneState* state)
 	return nullptr;
  	}
 
+IntrusivePtr<Func> Val::AsFuncPtr() const
+	{
+	CHECK_TAG(type->Tag(), TYPE_FUNC, "Val::Func", type_name)
+	return {NewRef{}, val.func_val};
+	}
+
 bool Val::IsZero() const
 	{
 	switch ( type->InternalType() ) {
@@ -266,7 +275,7 @@ IntrusivePtr<Val> Val::SizeVal() const
 
 	case TYPE_INTERNAL_OTHER:
 		if ( type->Tag() == TYPE_FUNC )
-			return val_mgr->Count(val.func_val->FType()->ArgTypes()->Types()->length());
+			return val_mgr->Count(val.func_val->GetType()->ParamList()->Types().size());
 
 		if ( type->Tag() == TYPE_FILE )
 			return make_intrusive<Val>(val.file_val->Size(), TYPE_DOUBLE);
@@ -338,7 +347,7 @@ void Val::ValDescribe(ODesc* d) const
 		else if ( type->Tag() == TYPE_FILE )
 			AsFile()->Describe(d);
 		else if ( type->Tag() == TYPE_TYPE )
-			d->Add(type->AsTypeType()->Type()->GetName());
+			d->Add(type->AsTypeType()->GetType()->GetName());
 		else
 			d->Add("<no value description>");
 		break;
@@ -372,7 +381,7 @@ void Val::ValDescribeReST(ODesc* d) const
 #ifdef DEBUG
 ID* Val::GetID() const
 	{
-	return bound_id ? global_scope()->Lookup(bound_id) : nullptr;
+	return bound_id ? global_scope()->Find(bound_id).get() : nullptr;
 	}
 
 void Val::SetID(ID* id)
@@ -412,12 +421,13 @@ bool Val::WouldOverflow(const BroType* from_type, const BroType* to_type, const
 
 IntrusivePtr<TableVal> Val::GetRecordFields()
 	{
-	auto t = Type();
+	static auto record_field_table = zeek::id::find_type<TableType>("record_field_table");
+	auto t = GetType().get();
 
 	if ( t->Tag() != TYPE_RECORD && t->Tag() != TYPE_TYPE )
 		{
 		reporter->Error("non-record value/type passed to record_fields");
-		return make_intrusive<TableVal>(IntrusivePtr{NewRef{}, internal_type("record_field_table")->AsTableType()});
+		return make_intrusive<TableVal>(record_field_table);
 		}
 
 	RecordType* rt = nullptr;
@@ -430,12 +440,12 @@ IntrusivePtr<TableVal> Val::GetRecordFields()
 		}
 	else
 		{
-		t = t->AsTypeType()->Type();
+		t = t->AsTypeType()->GetType().get();
 
 		if ( t->Tag() != TYPE_RECORD )
 			{
 			reporter->Error("non-record value/type passed to record_fields");
-			return make_intrusive<TableVal>(IntrusivePtr{NewRef{}, internal_type("record_field_table")->AsTableType()});
+			return make_intrusive<TableVal>(record_field_table);
 			}
 
 		rt = t->AsRecordType();
@@ -458,8 +468,8 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 		}
 
 	rapidjson::Value j;
-	BroType* type = val->Type();
-	switch ( type->Tag() )
+
+	switch ( val->GetType()->Tag() )
 		{
 		case TYPE_BOOL:
 			writer.Bool(val->AsBool());
@@ -526,7 +536,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 			auto* table = val->AsTable();
 			auto* tval = val->AsTableVal();
 
-			if ( tval->Type()->IsSet() )
+			if ( tval->GetType()->IsSet() )
 				writer.StartArray();
 			else
 				writer.StartObject();
@@ -536,11 +546,11 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 			auto c = table->InitForIteration();
 			while ( (entry = table->NextEntry(k, c)) )
 				{
-				auto lv = tval->RecoverIndex(k);
+				auto lv = tval->RecreateIndex(*k);
 				delete k;
-				Val* entry_key = lv->Length() == 1 ? lv->Index(0) : lv.get();
+				Val* entry_key = lv->Length() == 1 ? lv->Idx(0).get() : lv.get();
 
-				if ( tval->Type()->IsSet() )
+				if ( tval->GetType()->IsSet() )
 					BuildJSON(writer, entry_key, only_loggable, re);
 				else
 					{
@@ -555,11 +565,11 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 						// Strip quotes.
 						key_str = key_str.substr(1, key_str.length() - 2);
 
-					BuildJSON(writer, entry->Value(), only_loggable, re, key_str);
+					BuildJSON(writer, entry->GetVal().get(), only_loggable, re, key_str);
 					}
 				}
 
-			if ( tval->Type()->IsSet() )
+			if ( tval->GetType()->IsSet() )
 				writer.EndArray();
 			else
 				writer.EndObject();
@@ -572,11 +582,11 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 			writer.StartObject();
 
 			auto* rval = val->AsRecordVal();
-			auto rt = rval->Type()->AsRecordType();
+			auto rt = rval->GetType()->AsRecordType();
 
 			for ( auto i = 0; i < rt->NumFields(); ++i )
 				{
-				auto value = rval->LookupWithDefault(i);
+				auto value = rval->GetFieldOrDefault(i);
 
 				if ( value && ( ! only_loggable || rt->FieldHasAttr(i, ATTR_LOG) ) )
 					{
@@ -587,7 +597,8 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 						{
 						auto blank = make_intrusive<StringVal>("");
 						auto fn_val = make_intrusive<StringVal>(field_name);
-						auto key_val = fn_val->Substitute(re, blank.get(), false);
+						const auto& bs = *blank->AsString();
+						auto key_val = fn_val->Replace(re, bs, false);
 						key_str = key_val->ToStdString();
 						}
 					else
@@ -608,7 +619,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 			auto* lval = val->AsListVal();
 			size_t size = lval->Length();
 			for (size_t i = 0; i < size; i++)
-				BuildJSON(writer, lval->Index(i), only_loggable, re);
+				BuildJSON(writer, lval->Idx(i).get(), only_loggable, re);
 
 			writer.EndArray();
 			break;
@@ -621,7 +632,7 @@ static void BuildJSON(threading::formatter::JSON::NullDoubleWriter& writer, Val*
 			auto* vval = val->AsVectorVal();
 			size_t size = vval->SizeVal()->AsCount();
 			for (size_t i = 0; i < size; i++)
-				BuildJSON(writer, vval->Lookup(i), only_loggable, re);
+				BuildJSON(writer, vval->At(i).get(), only_loggable, re);
 
 			writer.EndArray();
 			break;
@@ -1027,7 +1038,8 @@ unsigned int StringVal::MemoryAllocation() const
 	return padded_sizeof(*this) + val.string_val->MemoryAllocation();
 	}
 
-IntrusivePtr<StringVal> StringVal::Substitute(RE_Matcher* re, StringVal* repl, bool do_all)
+IntrusivePtr<StringVal> StringVal::Replace(RE_Matcher* re,
+                                           const BroString& repl, bool do_all)
 	{
 	const u_char* s = Bytes();
 	int offset = 0;
@@ -1075,7 +1087,7 @@ IntrusivePtr<StringVal> StringVal::Substitute(RE_Matcher* re, StringVal* repl, b
 
 	// size now reflects amount of space copied.  Factor in amount
 	// of space for replacement text.
-	size += cut_points.size() * repl->Len();
+	size += cut_points.size() * repl.Len();
 
 	// And a final NUL for good health.
 	++size;
@@ -1094,8 +1106,8 @@ IntrusivePtr<StringVal> StringVal::Substitute(RE_Matcher* re, StringVal* repl, b
 		start_offset = point.second;
 
 		// Now add in replacement text.
-		memcpy(r, repl->Bytes(), repl->Len());
-		r += repl->Len();
+		memcpy(r, repl.Bytes(), repl.Len());
+		r += repl.Len();
 		}
 
 	// Copy final trailing characters.
@@ -1122,7 +1134,7 @@ IntrusivePtr<Val> StringVal::DoClone(CloneState* state)
 	}
 
 PatternVal::PatternVal(RE_Matcher* re)
-	: Val(base_type_no_ref(TYPE_PATTERN))
+	: Val(base_type(TYPE_PATTERN))
 	{
 	val.re_val = re;
 	}
@@ -1130,12 +1142,11 @@ PatternVal::PatternVal(RE_Matcher* re)
 PatternVal::~PatternVal()
 	{
 	delete AsPattern();
-	Unref(type);	// base_type() ref'd it, so did our base constructor
 	}
 
 bool PatternVal::AddTo(Val* v, bool /* is_first_init */) const
 	{
-	if ( v->Type()->Tag() != TYPE_PATTERN )
+	if ( v->GetType()->Tag() != TYPE_PATTERN )
 		{
 		v->Error("not a pattern");
 		return false;
@@ -1182,21 +1193,18 @@ IntrusivePtr<Val> PatternVal::DoClone(CloneState* state)
 	}
 
 ListVal::ListVal(TypeTag t)
-	: Val(new TypeList(t == TYPE_ANY ? nullptr : base_type(t)))
+	: Val(make_intrusive<TypeList>(t == TYPE_ANY ? nullptr : base_type(t)))
 	{
 	tag = t;
 	}
 
 ListVal::~ListVal()
 	{
-	for ( const auto& val : vals )
-		Unref(val);
-	Unref(type);
 	}
 
 IntrusivePtr<Val> ListVal::SizeVal() const
 	{
-	return val_mgr->Count(vals.length());
+	return val_mgr->Count(vals.size());
 	}
 
 RE_Matcher* ListVal::BuildRE() const
@@ -1214,28 +1222,34 @@ RE_Matcher* ListVal::BuildRE() const
 	return re;
 	}
 
-void ListVal::Append(Val* v)
+void ListVal::Append(IntrusivePtr<Val> v)
 	{
 	if ( type->AsTypeList()->IsPure() )
 		{
-		if ( v->Type()->Tag() != tag )
+		if ( v->GetType()->Tag() != tag )
 			Internal("heterogeneous list in ListVal::Append");
 		}
 
-	vals.push_back(v);
-	type->AsTypeList()->Append({NewRef{}, v->Type()});
+	const auto& vt = v->GetType();
+	vals.emplace_back(std::move(v));
+	type->AsTypeList()->Append(vt);
 	}
 
-TableVal* ListVal::ConvertToSet() const
+void ListVal::Append(Val* v)
+	{
+	Append({AdoptRef{}, v});
+	}
+
+IntrusivePtr<TableVal> ListVal::ToSetVal() const
 	{
 	if ( tag == TYPE_ANY )
 		Internal("conversion of heterogeneous list to set");
 
-	auto set_index = make_intrusive<TypeList>(
-	        IntrusivePtr{NewRef{}, type->AsTypeList()->PureType()});
+	const auto& pt = type->AsTypeList()->GetPureType();
+	auto set_index = make_intrusive<TypeList>(pt);
 	set_index->Append(base_type(tag));
 	auto s = make_intrusive<SetType>(std::move(set_index), nullptr);
-	TableVal* t = new TableVal(std::move(s));
+	auto t = make_intrusive<TableVal>(std::move(s));
 
 	for ( const auto& val : vals )
 		t->Assign(val, nullptr);
@@ -1243,19 +1257,24 @@ TableVal* ListVal::ConvertToSet() const
 	return t;
 	}
 
+TableVal* ListVal::ConvertToSet() const
+	{
+	return ToSetVal().release();
+	}
+
 void ListVal::Describe(ODesc* d) const
 	{
 	if ( d->IsBinary() || d->IsPortable() )
 		{
 		type->Describe(d);
 		d->SP();
-		d->Add(vals.length());
+		d->Add(static_cast<uint64_t>(vals.size()));
 		d->SP();
 		}
 
-	loop_over_list(vals, i)
+	for ( auto i = 0u; i < vals.size(); ++i )
 		{
-		if ( i > 0 )
+		if ( i > 0u )
 			{
 			if ( d->IsReadable() || d->IsPortable() )
 				{
@@ -1271,11 +1290,11 @@ void ListVal::Describe(ODesc* d) const
 IntrusivePtr<Val> ListVal::DoClone(CloneState* state)
 	{
 	auto lv = make_intrusive<ListVal>(tag);
-	lv->vals.resize(vals.length());
+	lv->vals.reserve(vals.size());
 	state->NewClone(this, lv);
 
 	for ( const auto& val : vals )
-		lv->Append(val->Clone(state).release());
+		lv->Append(val->Clone(state));
 
 	return lv;
 	}
@@ -1286,8 +1305,8 @@ unsigned int ListVal::MemoryAllocation() const
 	for ( const auto& val : vals )
 		size += val->MemoryAllocation();
 
-	return size + padded_sizeof(*this) + vals.MemoryAllocation() - padded_sizeof(vals)
-		+ type->MemoryAllocation();
+	size += pad_size(vals.capacity() * sizeof(decltype(vals)::value_type));
+	return size + padded_sizeof(*this) + type->MemoryAllocation();
 	}
 
 TableEntryVal* TableEntryVal::Clone(Val::CloneState* state)
@@ -1323,7 +1342,7 @@ static void table_entry_val_delete_func(void* val)
 	delete tv;
 	}
 
-static void find_nested_record_types(BroType* t, std::set<RecordType*>* found)
+static void find_nested_record_types(const IntrusivePtr<BroType>& t, std::set<RecordType*>* found)
 	{
 	if ( ! t )
 		return;
@@ -1335,35 +1354,35 @@ static void find_nested_record_types(BroType* t, std::set<RecordType*>* found)
 		found->emplace(rt);
 
 		for ( auto i = 0; i < rt->NumFields(); ++i )
-			find_nested_record_types(rt->FieldDecl(i)->type.get(), found);
+			find_nested_record_types(rt->FieldDecl(i)->type, found);
 		}
 		return;
 	case TYPE_TABLE:
-		find_nested_record_types(t->AsTableType()->Indices(), found);
-		find_nested_record_types(t->AsTableType()->YieldType(), found);
+		find_nested_record_types(t->AsTableType()->GetIndices(), found);
+		find_nested_record_types(t->AsTableType()->Yield(), found);
 		return;
 	case TYPE_LIST:
 		{
-		for ( auto& type : *t->AsTypeList()->Types() )
+		for ( const auto& type : t->AsTypeList()->Types() )
 			find_nested_record_types(type, found);
 		}
 		return;
 	case TYPE_FUNC:
-		find_nested_record_types(t->AsFuncType()->Args(), found);
-		find_nested_record_types(t->AsFuncType()->YieldType(), found);
+		find_nested_record_types(t->AsFuncType()->Params(), found);
+		find_nested_record_types(t->AsFuncType()->Yield(), found);
 		return;
 	case TYPE_VECTOR:
-		find_nested_record_types(t->AsVectorType()->YieldType(), found);
+		find_nested_record_types(t->AsVectorType()->Yield(), found);
 		return;
 	case TYPE_TYPE:
-		find_nested_record_types(t->AsTypeType()->Type(), found);
+		find_nested_record_types(t->AsTypeType()->GetType(), found);
 		return;
 	default:
 		return;
 	}
 	}
 
-TableVal::TableVal(IntrusivePtr<TableType> t, IntrusivePtr<Attributes> a) : Val(t.get())
+TableVal::TableVal(IntrusivePtr<TableType> t, IntrusivePtr<Attributes> a) : Val(t)
 	{
 	Init(std::move(t));
 	SetAttrs(std::move(a));
@@ -1371,7 +1390,7 @@ TableVal::TableVal(IntrusivePtr<TableType> t, IntrusivePtr<Attributes> a) : Val(
 	if ( ! is_parsing )
 		return;
 
-	for ( const auto& t : *table_type->IndexTypes() )
+	for ( const auto& t : table_type->IndexTypes() )
 		{
 		std::set<RecordType*> found;
 		// TODO: this likely doesn't have to be repeated for each new TableVal,
@@ -1397,8 +1416,7 @@ void TableVal::Init(IntrusivePtr<TableType> t)
 	else
 		subnets = nullptr;
 
-	table_hash = new CompositeHash(IntrusivePtr<TypeList>(NewRef{},
-	                               table_type->Indices()));
+	table_hash = new CompositeHash(table_type->GetIndices());
 	val.table_val = new PDict<TableEntryVal>;
 	val.table_val->SetDeleteFunc(table_entry_val_delete_func);
 	}
@@ -1430,9 +1448,8 @@ int TableVal::RecursiveSize() const
 	{
 	int n = AsTable()->Length();
 
-	if ( Type()->IsSet() ||
-	     const_cast<TableType*>(Type()->AsTableType())->YieldType()->Tag()
-			!= TYPE_TABLE )
+	if ( GetType()->IsSet() ||
+	     GetType()->AsTableType()->Yield()->Tag() != TYPE_TABLE )
 		return n;
 
 	PDict<TableEntryVal>* v = val.table_val;
@@ -1441,8 +1458,8 @@ int TableVal::RecursiveSize() const
 	TableEntryVal* tv;
 	while ( (tv = v->NextEntry(c)) )
 		{
-		if ( tv->Value() )
-			n += tv->Value()->AsTableVal()->RecursiveSize();
+		if ( tv->GetVal() )
+			n += tv->GetVal()->AsTableVal()->RecursiveSize();
 		}
 
 	return n;
@@ -1459,26 +1476,26 @@ void TableVal::SetAttrs(IntrusivePtr<Attributes> a)
 	CheckExpireAttr(ATTR_EXPIRE_WRITE);
 	CheckExpireAttr(ATTR_EXPIRE_CREATE);
 
-	Attr* ef = attrs->FindAttr(ATTR_EXPIRE_FUNC);
+	const auto& ef = attrs->Find(ATTR_EXPIRE_FUNC);
 
 	if ( ef )
-		expire_func = {NewRef{}, ef->AttrExpr()};
+		expire_func = ef->GetExpr();
 
-	auto cf = attrs->FindAttr(ATTR_ON_CHANGE);
+	const auto& cf = attrs->Find(ATTR_ON_CHANGE);
 
 	if ( cf )
-		change_func = {NewRef{}, cf->AttrExpr()};
+		change_func = cf->GetExpr();
 	}
 
 void TableVal::CheckExpireAttr(attr_tag at)
 	{
-	Attr* a = attrs->FindAttr(at);
+	const auto& a = attrs->Find(at);
 
 	if ( a )
 		{
-		expire_time = {NewRef{}, a->AttrExpr()};
+		expire_time = a->GetExpr();
 
-		if ( expire_time->Type()->Tag() != TYPE_INTERVAL )
+		if ( expire_time->GetType()->Tag() != TYPE_INTERVAL )
 			{
 			if ( ! expire_time->IsError() )
 				expire_time->SetError("expiration interval has wrong type");
@@ -1496,62 +1513,62 @@ void TableVal::CheckExpireAttr(attr_tag at)
 		}
 	}
 
-bool TableVal::Assign(Val* index, IntrusivePtr<Val> new_val)
+bool TableVal::Assign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
 	{
-	HashKey* k = ComputeHash(index);
+	auto k = MakeHashKey(*index);
+
 	if ( ! k )
 		{
-		index->Error("index type doesn't match table", table_type->Indices());
+		index->Error("index type doesn't match table", table_type->GetIndices().get());
 		return false;
 		}
 
-	return Assign(index, k, std::move(new_val));
+	return Assign(std::move(index), std::move(k), std::move(new_val));
 	}
 
 bool TableVal::Assign(Val* index, Val* new_val)
 	{
-	return Assign(index, {AdoptRef{}, new_val});
+	return Assign({NewRef{}, index}, {AdoptRef{}, new_val});
 	}
 
-bool TableVal::Assign(Val* index, HashKey* k, IntrusivePtr<Val> new_val)
+bool TableVal::Assign(IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
+                      IntrusivePtr<Val> new_val)
 	{
 	bool is_set = table_type->IsSet();
 
 	if ( (is_set && new_val) || (! is_set && ! new_val) )
 		InternalWarning("bad set/table in TableVal::Assign");
 
-	TableEntryVal* new_entry_val = new TableEntryVal(new_val);
+	TableEntryVal* new_entry_val = new TableEntryVal(std::move(new_val));
 	HashKey k_copy(k->Key(), k->Size(), k->Hash());
-	TableEntryVal* old_entry_val = AsNonConstTable()->Insert(k, new_entry_val);
+	TableEntryVal* old_entry_val = AsNonConstTable()->Insert(k.get(), new_entry_val);
 
 	// If the dictionary index already existed, the insert may free up the
 	// memory allocated to the key bytes, so have to assume k is invalid
 	// from here on out.
-	delete k;
 	k = nullptr;
 
 	if ( subnets )
 		{
 		if ( ! index )
 			{
-			auto v = RecoverIndex(&k_copy);
+			auto v = RecreateIndex(k_copy);
 			subnets->Insert(v.get(), new_entry_val);
 			}
 		else
-			subnets->Insert(index, new_entry_val);
+			subnets->Insert(index.get(), new_entry_val);
 		}
 
 	// Keep old expiration time if necessary.
-	if ( old_entry_val && attrs && attrs->FindAttr(ATTR_EXPIRE_CREATE) )
+	if ( old_entry_val && attrs && attrs->Find(ATTR_EXPIRE_CREATE) )
 		new_entry_val->SetExpireAccess(old_entry_val->ExpireAccessTime());
 
 	Modified();
 
 	if ( change_func )
 		{
-		auto change_index = index ? IntrusivePtr<Val>{NewRef{}, index}
-		                          : RecoverIndex(&k_copy);
-		Val* v = old_entry_val ? old_entry_val->Value() : new_val.get();
+		auto change_index = index ? std::move(index) : RecreateIndex(k_copy);
+		const auto& v = old_entry_val ? old_entry_val->GetVal() : new_entry_val->GetVal();
 		CallChangeFunc(change_index.get(), v, old_entry_val ? ELEMENT_CHANGED : ELEMENT_NEW);
 		}
 
@@ -1562,7 +1579,7 @@ bool TableVal::Assign(Val* index, HashKey* k, IntrusivePtr<Val> new_val)
 
 bool TableVal::Assign(Val* index, HashKey* k, Val* new_val)
 	{
-	return Assign(index, k, {AdoptRef{}, new_val});
+	return Assign({NewRef{}, index}, std::unique_ptr<HashKey>{k}, {AdoptRef{}, new_val});
 	}
 
 IntrusivePtr<Val> TableVal::SizeVal() const
@@ -1577,7 +1594,7 @@ bool TableVal::AddTo(Val* val, bool is_first_init) const
 
 bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const
 	{
-	if ( val->Type()->Tag() != TYPE_TABLE )
+	if ( val->GetType()->Tag() != TYPE_TABLE )
 		{
 		val->Error("not a table");
 		return false;
@@ -1585,9 +1602,9 @@ bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const
 
 	TableVal* t = val->AsTableVal();
 
-	if ( ! same_type(type, t->Type()) )
+	if ( ! same_type(type, t->GetType()) )
 		{
-		type->Error("table type clash", t->Type());
+		type->Error("table type clash", t->GetType().get());
 		return false;
 		}
 
@@ -1598,9 +1615,11 @@ bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const
 	TableEntryVal* v;
 	while ( (v = tbl->NextEntry(k, c)) )
 		{
+		std::unique_ptr<HashKey> hk{k};
+
 		if ( is_first_init && t->AsTable()->Lookup(k) )
 			{
-			auto key = table_hash->RecoverVals(k);
+			auto key = table_hash->RecoverVals(*k);
 			// ### Shouldn't complain if their values are equal.
 			key->Warn("multiple initializations for index");
 			continue;
@@ -1608,12 +1627,12 @@ bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const
 
 		if ( type->IsSet() )
 			{
-			if ( ! t->Assign(v->Value(), k, nullptr) )
+			if ( ! t->Assign(v->GetVal(), std::move(hk), nullptr) )
 				 return false;
 			}
 		else
 			{
-			if ( ! t->Assign(nullptr, k, {NewRef{}, v->Value()}) )
+			if ( ! t->Assign(nullptr, std::move(hk), v->GetVal()) )
 				 return false;
 			}
 		}
@@ -1623,7 +1642,7 @@ bool TableVal::AddTo(Val* val, bool is_first_init, bool propagate_ops) const
 
 bool TableVal::RemoveFrom(Val* val) const
 	{
-	if ( val->Type()->Tag() != TYPE_TABLE )
+	if ( val->GetType()->Tag() != TYPE_TABLE )
 		{
 		val->Error("not a table");
 		return false;
@@ -1631,9 +1650,9 @@ bool TableVal::RemoveFrom(Val* val) const
 
 	TableVal* t = val->AsTableVal();
 
-	if ( ! same_type(type, t->Type()) )
+	if ( ! same_type(type, t->GetType()) )
 		{
-		type->Error("table type clash", t->Type());
+		type->Error("table type clash", t->GetType().get());
 		return false;
 		}
 
@@ -1648,19 +1667,19 @@ bool TableVal::RemoveFrom(Val* val) const
 		// OTOH, they are both the same type, so as long as
 		// we don't have hash keys that are keyed per dictionary,
 		// it should work ...
-		t->Delete(k);
+		t->Remove(*k);
 		delete k;
 		}
 
 	return true;
 	}
 
-TableVal* TableVal::Intersect(const TableVal* tv) const
+IntrusivePtr<TableVal> TableVal::Intersection(const TableVal& tv) const
 	{
-	TableVal* result = new TableVal(table_type);
+	auto result = make_intrusive<TableVal>(table_type);
 
 	const PDict<TableEntryVal>* t0 = AsTable();
-	const PDict<TableEntryVal>* t1 = tv->AsTable();
+	const PDict<TableEntryVal>* t1 = tv.AsTable();
 	PDict<TableEntryVal>* t2 = result->AsNonConstTable();
 
 	// Figure out which is smaller; assign it to t1.
@@ -1686,10 +1705,10 @@ TableVal* TableVal::Intersect(const TableVal* tv) const
 	return result;
 	}
 
-bool TableVal::EqualTo(const TableVal* tv) const
+bool TableVal::EqualTo(const TableVal& tv) const
 	{
 	const PDict<TableEntryVal>* t0 = AsTable();
-	const PDict<TableEntryVal>* t1 = tv->AsTable();
+	const PDict<TableEntryVal>* t1 = tv.AsTable();
 
 	if ( t0->Length() != t1->Length() )
 		return false;
@@ -1713,10 +1732,10 @@ bool TableVal::EqualTo(const TableVal* tv) const
 	return true;
 	}
 
-bool TableVal::IsSubsetOf(const TableVal* tv) const
+bool TableVal::IsSubsetOf(const TableVal& tv) const
 	{
 	const PDict<TableEntryVal>* t0 = AsTable();
-	const PDict<TableEntryVal>* t1 = tv->AsTable();
+	const PDict<TableEntryVal>* t1 = tv.AsTable();
 
 	if ( t0->Length() > t1->Length() )
 		return false;
@@ -1742,26 +1761,26 @@ bool TableVal::IsSubsetOf(const TableVal* tv) const
 
 bool TableVal::ExpandAndInit(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
 	{
-	BroType* index_type = index->Type();
+	const auto& index_type = index->GetType();
 
 	if ( index_type->IsSet() )
 		{
-		index = {AdoptRef{}, index->AsTableVal()->ConvertToList()};
+		index = index->AsTableVal()->ToListVal();
 		return ExpandAndInit(std::move(index), std::move(new_val));
 		}
 
 	if ( index_type->Tag() != TYPE_LIST )
 		// Nothing to expand.
-		return CheckAndAssign(index.get(), std::move(new_val));
+		return CheckAndAssign(std::move(index), std::move(new_val));
 
 	ListVal* iv = index->AsListVal();
 	if ( iv->BaseTag() != TYPE_ANY )
 		{
-		if ( table_type->Indices()->Types()->length() != 1 )
+		if ( table_type->GetIndices()->Types().size() != 1 )
 			reporter->InternalError("bad singleton list index");
 
 		for ( int i = 0; i < iv->Length(); ++i )
-			if ( ! ExpandAndInit({NewRef{}, iv->Index(i)}, new_val) )
+			if ( ! ExpandAndInit(iv->Idx(i), new_val) )
 				return false;
 
 		return true;
@@ -1769,51 +1788,54 @@ bool TableVal::ExpandAndInit(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
 
 	else
 		{ // Compound table.
-		val_list* vl = iv->Vals();
-		loop_over_list(*vl, i)
+		int i;
+
+		for ( i = 0; i < iv->Length(); ++i )
 			{
+			const auto& v = iv->Idx(i);
 			// ### if CompositeHash::ComputeHash did flattening
 			// of 1-element lists (like ComputeSingletonHash does),
 			// then we could optimize here.
-			BroType* t = (*vl)[i]->Type();
+			const auto& t = v->GetType();
+
 			if ( t->IsSet() || t->Tag() == TYPE_LIST )
 				break;
 			}
 
-		if ( i >= vl->length() )
+		if ( i >= iv->Length() )
 			// Nothing to expand.
-			return CheckAndAssign(index.get(), std::move(new_val));
+			return CheckAndAssign(std::move(index), std::move(new_val));
 		else
-			return ExpandCompoundAndInit(vl, i, std::move(new_val));
+			return ExpandCompoundAndInit(iv, i, std::move(new_val));
 		}
 	}
 
 
-IntrusivePtr<Val> TableVal::Default(Val* index)
+IntrusivePtr<Val> TableVal::Default(const IntrusivePtr<Val>& index)
 	{
-	Attr* def_attr = FindAttr(ATTR_DEFAULT);
+	const auto& def_attr = GetAttr(ATTR_DEFAULT);
 
 	if ( ! def_attr )
 		return nullptr;
 
 	if ( ! def_val )
 		{
-		BroType* ytype = Type()->YieldType();
-		BroType* dtype = def_attr->AttrExpr()->Type();
+		const auto& ytype = GetType()->Yield();
+		const auto& dtype = def_attr->GetExpr()->GetType();
 
 		if ( dtype->Tag() == TYPE_RECORD && ytype->Tag() == TYPE_RECORD &&
 		     ! same_type(dtype, ytype) &&
 		     record_promotion_compatible(dtype->AsRecordType(),
 						 ytype->AsRecordType()) )
 			{
-			auto coerce = make_intrusive<RecordCoerceExpr>(
-			        IntrusivePtr{NewRef{}, def_attr->AttrExpr()},
-			        IntrusivePtr{NewRef{}, ytype->AsRecordType()});
+			auto rt = cast_intrusive<RecordType>(ytype);
+			auto coerce = make_intrusive<RecordCoerceExpr>(def_attr->GetExpr(),
+			                                               std::move(rt));
 			def_val = coerce->Eval(nullptr);
 			}
 
 		else
-			def_val = def_attr->AttrExpr()->Eval(nullptr);
+			def_val = def_attr->GetExpr()->Eval(nullptr);
 		}
 
 	if ( ! def_val )
@@ -1822,10 +1844,10 @@ IntrusivePtr<Val> TableVal::Default(Val* index)
 		return nullptr;
 		}
 
-	if ( def_val->Type()->Tag() != TYPE_FUNC ||
-	     same_type(def_val->Type(), Type()->YieldType()) )
+	if ( def_val->GetType()->Tag() != TYPE_FUNC ||
+	     same_type(def_val->GetType(), GetType()->Yield()) )
 		{
-		if ( def_attr->AttrExpr()->IsConst() )
+		if ( def_attr->GetExpr()->IsConst() )
 			return def_val;
 
 		try
@@ -1842,22 +1864,22 @@ IntrusivePtr<Val> TableVal::Default(Val* index)
 	const Func* f = def_val->AsFunc();
 	zeek::Args vl;
 
-	if ( index->Type()->Tag() == TYPE_LIST )
+	if ( index->GetType()->Tag() == TYPE_LIST )
 		{
-		const val_list* vl0 = index->AsListVal()->Vals();
-		vl.reserve(vl0->length());
+		auto lv = index->AsListVal();
+		vl.reserve(lv->Length());
 
-		for ( const auto& v : *vl0 )
-			vl.emplace_back(NewRef{}, v);
+		for ( const auto& v : lv->Vals() )
+			vl.emplace_back(v);
 		}
 	else
-		vl.emplace_back(NewRef{}, index);
+		vl.emplace_back(index);
 
 	IntrusivePtr<Val> result;
 
 	try
 		{
-		result = f->Call(vl);
+		result = f->Invoke(&vl);
 		}
 
 	catch ( InterpreterException& e )
@@ -1872,49 +1894,73 @@ IntrusivePtr<Val> TableVal::Default(Val* index)
 	return result;
 	}
 
-IntrusivePtr<Val> TableVal::Lookup(Val* index, bool use_default_val)
+const IntrusivePtr<Val>& TableVal::Find(const IntrusivePtr<Val>& index)
 	{
 	if ( subnets )
 		{
-		TableEntryVal* v = (TableEntryVal*) subnets->Lookup(index);
+		TableEntryVal* v = (TableEntryVal*) subnets->Lookup(index.get());
 		if ( v )
 			{
-			if ( attrs && attrs->FindAttr(ATTR_EXPIRE_READ) )
-					v->SetExpireAccess(network_time);
+			if ( attrs && attrs->Find(ATTR_EXPIRE_READ) )
+				v->SetExpireAccess(network_time);
 
-			return {NewRef{}, v->Value() ? v->Value() : this};
+			if ( v->GetVal() )
+				return v->GetVal();
+
+			return val_mgr->True();
 			}
 
-		if ( ! use_default_val )
-			return nullptr;
-
-		return Default(index);
+		return Val::nil;
 		}
 
 	const PDict<TableEntryVal>* tbl = AsTable();
 
 	if ( tbl->Length() > 0 )
 		{
-		HashKey* k = ComputeHash(index);
+		auto k = MakeHashKey(*index);
+
 		if ( k )
 			{
-			TableEntryVal* v = AsTable()->Lookup(k);
-			delete k;
+			TableEntryVal* v = AsTable()->Lookup(k.get());
 
 			if ( v )
 				{
-				if ( attrs && attrs->FindAttr(ATTR_EXPIRE_READ) )
+				if ( attrs && attrs->Find(ATTR_EXPIRE_READ) )
 					v->SetExpireAccess(network_time);
 
-				return {NewRef{}, v->Value() ? v->Value() : this};
+				if ( v->GetVal() )
+					return v->GetVal();
+
+				return val_mgr->True();
 				}
 			}
 		}
 
+	return Val::nil;
+	}
+
+IntrusivePtr<Val> TableVal::FindOrDefault(const IntrusivePtr<Val>& index)
+	{
+	if ( auto rval = Find(index) )
+		return rval;
+
+	return Default(index);
+	}
+
+Val* TableVal::Lookup(Val* index, bool use_default_val)
+	{
+	static IntrusivePtr<Val> last_default;
+	last_default = nullptr;
+	IntrusivePtr<Val> idx{NewRef{}, index};
+
+	if ( const auto& rval = Find(idx) )
+		return rval.get();
+
 	if ( ! use_default_val )
 		return nullptr;
 
-	return Default(index);
+	last_default = Default(idx);
+	return last_default.get();
 	}
 
 IntrusivePtr<VectorVal> TableVal::LookupSubnets(const SubNetVal* search)
@@ -1922,7 +1968,7 @@ IntrusivePtr<VectorVal> TableVal::LookupSubnets(const SubNetVal* search)
 	if ( ! subnets )
 		reporter->InternalError("LookupSubnets called on wrong table type");
 
-	auto result = make_intrusive<VectorVal>(internal_type("subnet_vec")->AsVectorType());
+	auto result = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("subnet_vec"));
 
 	auto matches = subnets->FindAll(search);
 	for ( auto element : matches )
@@ -1936,26 +1982,24 @@ IntrusivePtr<TableVal> TableVal::LookupSubnetValues(const SubNetVal* search)
 	if ( ! subnets )
 		reporter->InternalError("LookupSubnetValues called on wrong table type");
 
-	auto nt = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, this->Type()->AsTableType()});
+	auto nt = make_intrusive<TableVal>(this->GetType<TableType>());
 
 	auto matches = subnets->FindAll(search);
 	for ( auto element : matches )
 		{
-		SubNetVal* s = new SubNetVal(get<0>(element));
+		auto s = make_intrusive<SubNetVal>(get<0>(element));
 		TableEntryVal* entry = reinterpret_cast<TableEntryVal*>(get<1>(element));
 
-		if ( entry && entry->Value() )
-			nt->Assign(s, {NewRef{}, entry->Value()});
+		if ( entry && entry->GetVal() )
+			nt->Assign(std::move(s), entry->GetVal());
 		else
-			nt->Assign(s, nullptr); // set
+			nt->Assign(std::move(s), nullptr); // set
 
 		if ( entry )
 			{
-			if ( attrs && attrs->FindAttr(ATTR_EXPIRE_READ) )
+			if ( attrs && attrs->Find(ATTR_EXPIRE_READ) )
 				entry->SetExpireAccess(network_time);
 			}
-
-		Unref(s); // assign does not consume index
 		}
 
 	return nt;
@@ -1969,13 +2013,12 @@ bool TableVal::UpdateTimestamp(Val* index)
 		v = (TableEntryVal*) subnets->Lookup(index);
 	else
 		{
-		HashKey* k = ComputeHash(index);
+		auto k = MakeHashKey(*index);
+
 		if ( ! k )
 			return false;
 
-		v = AsTable()->Lookup(k);
-
-		delete k;
+		v = AsTable()->Lookup(k.get());
 		}
 
 	if ( ! v )
@@ -1986,12 +2029,14 @@ bool TableVal::UpdateTimestamp(Val* index)
 	return true;
 	}
 
-IntrusivePtr<ListVal> TableVal::RecoverIndex(const HashKey* k) const
+IntrusivePtr<ListVal> TableVal::RecreateIndex(const HashKey& k) const
 	{
 	return table_hash->RecoverVals(k);
 	}
 
-void TableVal::CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe)
+void TableVal::CallChangeFunc(const Val* index,
+                              const IntrusivePtr<Val>& old_value,
+                              OnChangeType tpe)
 	{
 	if ( ! change_func || ! index || in_change_func )
 		return;
@@ -2008,42 +2053,42 @@ void TableVal::CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe
 			return;
 			}
 
-		if ( thefunc->Type()->Tag() != TYPE_FUNC )
+		if ( thefunc->GetType()->Tag() != TYPE_FUNC )
 			{
 			thefunc->Error("not a function");
 			return;
 			}
 
 		const Func* f = thefunc->AsFunc();
-		const auto& index_list = *index->AsListVal()->Vals();
+		auto lv = index->AsListVal();
 
 		zeek::Args vl;
-		vl.reserve(2 + index_list.length() + table_type->IsTable());
+		vl.reserve(2 + lv->Length() + table_type->IsTable());
 		vl.emplace_back(NewRef{}, this);
 
 		switch ( tpe )
 			{
 			case ELEMENT_NEW:
-				vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_NEW));
+				vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_NEW));
 				break;
 			case ELEMENT_CHANGED:
-				vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_CHANGED));
+				vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_CHANGED));
 				break;
 			case ELEMENT_REMOVED:
-				vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_REMOVED));
+				vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_REMOVED));
 				break;
 			case ELEMENT_EXPIRED:
-				vl.emplace_back(BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_EXPIRED));
+				vl.emplace_back(zeek::BifType::Enum::TableChange->GetVal(BifEnum::TableChange::TABLE_ELEMENT_EXPIRED));
 			}
 
-		for ( const auto& v : *index->AsListVal()->Vals() )
-			vl.emplace_back(NewRef{}, v);
+		for ( const auto& v : lv->Vals() )
+			vl.emplace_back(v);
 
 		if ( table_type->IsTable() )
-			vl.emplace_back(NewRef{}, old_value);
+			vl.emplace_back(old_value);
 
 		in_change_func = true;
-		f->Call(vl);
+		f->Invoke(&vl);
 		}
 	catch ( InterpreterException& e )
 		{
@@ -2052,30 +2097,35 @@ void TableVal::CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe
 	in_change_func = false;
 	}
 
-IntrusivePtr<Val> TableVal::Delete(const Val* index)
+IntrusivePtr<Val> TableVal::Remove(const Val& index)
 	{
-	HashKey* k = ComputeHash(index);
-	TableEntryVal* v = k ? AsNonConstTable()->RemoveEntry(k) : nullptr;
-	IntrusivePtr<Val> va{NewRef{}, v ? (v->Value() ? v->Value() : this) : nullptr};
+	auto k = MakeHashKey(index);
+	TableEntryVal* v = k ? AsNonConstTable()->RemoveEntry(k.get()) : nullptr;
+	IntrusivePtr<Val> va;
 
-	if ( subnets && ! subnets->Remove(index) )
+	if ( v )
+		va = v->GetVal() ? v->GetVal() : IntrusivePtr{NewRef{}, this};
+
+	if ( subnets && ! subnets->Remove(&index) )
 		reporter->InternalWarning("index not in prefix table");
 
-	delete k;
 	delete v;
 
 	Modified();
 
 	if ( change_func )
-		CallChangeFunc(index, va.get(), ELEMENT_REMOVED);
+		CallChangeFunc(&index, va, ELEMENT_REMOVED);
 
 	return va;
 	}
 
-IntrusivePtr<Val> TableVal::Delete(const HashKey* k)
+IntrusivePtr<Val> TableVal::Remove(const HashKey& k)
 	{
 	TableEntryVal* v = AsNonConstTable()->RemoveEntry(k);
-	IntrusivePtr<Val> va{NewRef{}, v ? (v->Value() ? v->Value() : this) : nullptr};
+	IntrusivePtr<Val> va;
+
+	if ( v )
+		va = v->GetVal() ? v->GetVal() : IntrusivePtr{NewRef{}, this};
 
 	if ( subnets )
 		{
@@ -2092,15 +2142,15 @@ IntrusivePtr<Val> TableVal::Delete(const HashKey* k)
 	if ( change_func && va )
 		{
 		auto index = table_hash->RecoverVals(k);
-		CallChangeFunc(index.get(), va.get(), ELEMENT_REMOVED);
+		CallChangeFunc(index.get(), va, ELEMENT_REMOVED);
 		}
 
 	return va;
 	}
 
-ListVal* TableVal::ConvertToList(TypeTag t) const
+IntrusivePtr<ListVal> TableVal::ToListVal(TypeTag t) const
 	{
-	ListVal* l = new ListVal(t);
+	auto l = make_intrusive<ListVal>(t);
 
 	const PDict<TableEntryVal>* tbl = AsTable();
 	IterCookie* c = tbl->InitForIteration();
@@ -2108,17 +2158,17 @@ ListVal* TableVal::ConvertToList(TypeTag t) const
 	HashKey* k;
 	while ( tbl->NextEntry(k, c) )
 		{
-		auto index = table_hash->RecoverVals(k);
+		auto index = table_hash->RecoverVals(*k);
 
 		if ( t == TYPE_ANY )
-			l->Append(index.release());
+			l->Append(std::move(index));
 		else
 			{
 			// We're expecting a pure list, flatten the ListVal.
 			if ( index->Length() != 1 )
-				InternalWarning("bad index in TableVal::ConvertToList");
+				InternalWarning("bad index in TableVal::ToListVal");
 
-			l->Append(index->Index(0)->Ref());
+			l->Append(index->Idx(0));
 			}
 
 		delete k;
@@ -2127,21 +2177,31 @@ ListVal* TableVal::ConvertToList(TypeTag t) const
 	return l;
 	}
 
-ListVal* TableVal::ConvertToPureList() const
+ListVal* TableVal::ConvertToList(TypeTag t) const
 	{
-	type_list* tl = table_type->Indices()->Types();
-	if ( tl->length() != 1 )
+	return ToListVal().release();
+	}
+
+IntrusivePtr<ListVal> TableVal::ToPureListVal() const
+	{
+	const auto& tl = table_type->GetIndices()->Types();
+	if ( tl.size() != 1 )
 		{
-		InternalWarning("bad index type in TableVal::ConvertToPureList");
+		InternalWarning("bad index type in TableVal::ToPureListVal");
 		return nullptr;
 		}
 
-	return ConvertToList((*tl)[0]->Tag());
+	return ToListVal(tl[0]->Tag());
 	}
 
-Attr* TableVal::FindAttr(attr_tag t) const
+ListVal* TableVal::ConvertToPureList() const
 	{
-	return attrs ? attrs->FindAttr(t) : nullptr;
+	return ToPureListVal().release();
+	}
+
+const IntrusivePtr<Attr>& TableVal::GetAttr(attr_tag t) const
+	{
+	return attrs ? attrs->Find(t) : Attr::nil;
 	}
 
 void TableVal::Describe(ODesc* d) const
@@ -2173,7 +2233,7 @@ void TableVal::Describe(ODesc* d) const
 		if ( ! v )
 			reporter->InternalError("hash table underflow in TableVal::Describe");
 
-		auto vl = table_hash->RecoverVals(k);
+		auto vl = table_hash->RecoverVals(*k);
 		int dim = vl->Length();
 
 		if ( i > 0 )
@@ -2209,8 +2269,8 @@ void TableVal::Describe(ODesc* d) const
 			{
 			if ( d->IsReadable() )
 				d->AddSP("] =");
-			if ( v->Value() )
-				v->Value()->Describe(d);
+			if ( v->GetVal() )
+				v->GetVal()->Describe(d);
 			}
 
 		if ( d->IsReadable() && ! d->IsShort() && d->IncludeStats() )
@@ -2230,23 +2290,26 @@ void TableVal::Describe(ODesc* d) const
 		}
 	}
 
-bool TableVal::ExpandCompoundAndInit(val_list* vl, int k, IntrusivePtr<Val> new_val)
+bool TableVal::ExpandCompoundAndInit(ListVal* lv, int k, IntrusivePtr<Val> new_val)
 	{
-	Val* ind_k_v = (*vl)[k];
-	auto ind_k = ind_k_v->Type()->IsSet() ?
-	      IntrusivePtr<ListVal>{AdoptRef{}, ind_k_v->AsTableVal()->ConvertToList()} :
+	Val* ind_k_v = lv->Idx(k).get();
+	auto ind_k = ind_k_v->GetType()->IsSet() ?
+	      ind_k_v->AsTableVal()->ToListVal() :
 	      IntrusivePtr<ListVal>{NewRef{}, ind_k_v->AsListVal()};
 
 	for ( int i = 0; i < ind_k->Length(); ++i )
 		{
-		Val* ind_k_i = ind_k->Index(i);
+		const auto& ind_k_i = ind_k->Idx(i);
 		auto expd = make_intrusive<ListVal>(TYPE_ANY);
-		loop_over_list(*vl, j)
+
+		for ( auto j = 0; j < lv->Length(); ++j )
 			{
+			const auto& v = lv->Idx(j);
+
 			if ( j == k )
-				expd->Append(ind_k_i->Ref());
+				expd->Append(ind_k_i);
 			else
-				expd->Append((*vl)[j]->Ref());
+				expd->Append(v);
 			}
 
 		if ( ! ExpandAndInit(std::move(expd), new_val) )
@@ -2256,19 +2319,19 @@ bool TableVal::ExpandCompoundAndInit(val_list* vl, int k, IntrusivePtr<Val> new_
 	return true;
 	}
 
-bool TableVal::CheckAndAssign(Val* index, IntrusivePtr<Val> new_val)
+bool TableVal::CheckAndAssign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val)
 	{
 	Val* v = nullptr;
 	if ( subnets )
 		// We need an exact match here.
-		v = (Val*) subnets->Lookup(index, true);
+		v = (Val*) subnets->Lookup(index.get(), true);
 	else
-		v = Lookup(index, false).get();
+		v = Find(index).get();
 
 	if ( v )
 		index->Warn("multiple initializations for index");
 
-	return Assign(index, std::move(new_val));
+	return Assign(std::move(index), std::move(new_val));
 	}
 
 void TableVal::InitDefaultFunc(Frame* f)
@@ -2277,12 +2340,13 @@ void TableVal::InitDefaultFunc(Frame* f)
 	if ( def_val )
 		return;
 
-	Attr* def_attr = FindAttr(ATTR_DEFAULT);
+	const auto& def_attr = GetAttr(ATTR_DEFAULT);
+
 	if ( ! def_attr )
 		return;
 
-	BroType* ytype = Type()->YieldType();
-	BroType* dtype = def_attr->AttrExpr()->Type();
+	const auto& ytype = GetType()->Yield();
+	const auto& dtype = def_attr->GetExpr()->GetType();
 
 	if ( dtype->Tag() == TYPE_RECORD && ytype->Tag() == TYPE_RECORD &&
 	     ! same_type(dtype, ytype) &&
@@ -2290,7 +2354,7 @@ void TableVal::InitDefaultFunc(Frame* f)
 					 ytype->AsRecordType()) )
 		return; // TableVal::Default will handle this.
 
-	def_val = def_attr->AttrExpr()->Eval(f);
+	def_val = def_attr->GetExpr()->Eval(f);
 	}
 
 void TableVal::InitTimer(double delay)
@@ -2342,7 +2406,7 @@ void TableVal::DoExpire(double t)
 
 			if ( expire_func )
 				{
-				idx = RecoverIndex(k);
+				idx = RecreateIndex(*k);
 				double secs = CallExpireFunc(idx);
 
 				// It's possible that the user-provided
@@ -2372,7 +2436,7 @@ void TableVal::DoExpire(double t)
 			if ( subnets )
 				{
 				if ( ! idx )
-					idx = RecoverIndex(k);
+					idx = RecreateIndex(*k);
 				if ( ! subnets->Remove(idx.get()) )
 					reporter->InternalWarning("index not in prefix table");
 				}
@@ -2381,8 +2445,8 @@ void TableVal::DoExpire(double t)
 			if ( change_func )
 				{
 				if ( ! idx )
-					idx = RecoverIndex(k);
-				CallChangeFunc(idx.get(), v->Value(), ELEMENT_EXPIRED);
+					idx = RecreateIndex(*k);
+				CallChangeFunc(idx.get(), v->GetVal(), ELEMENT_EXPIRED);
 				}
 
 			delete v;
@@ -2447,7 +2511,7 @@ double TableVal::CallExpireFunc(IntrusivePtr<ListVal> idx)
 			// Will have been reported already.
 			return 0;
 
-		if ( vf->Type()->Tag() != TYPE_FUNC )
+		if ( vf->GetType()->Tag() != TYPE_FUNC )
 			{
 			vf->Error("not a function");
 			return 0;
@@ -2456,19 +2520,18 @@ double TableVal::CallExpireFunc(IntrusivePtr<ListVal> idx)
 		const Func* f = vf->AsFunc();
 		zeek::Args vl;
 
-		const auto func_args = f->FType()->ArgTypes()->Types();
-
+		const auto& func_args = f->GetType()->ParamList()->Types();
 		// backwards compatibility with idx: any idiom
-		bool any_idiom = func_args->length() == 2 && func_args->back()->Tag() == TYPE_ANY;
+		bool any_idiom = func_args.size() == 2 && func_args.back()->Tag() == TYPE_ANY;
 
 		if ( ! any_idiom )
 			{
-			const auto& index_list = *idx->AsListVal()->Vals();
-			vl.reserve(1 + index_list.length());
+			auto lv = idx->AsListVal();
+			vl.reserve(1 + lv->Length());
 			vl.emplace_back(NewRef{}, this);
 
-			for ( const auto& v : index_list )
-				vl.emplace_back(NewRef{}, v);
+			for ( const auto& v : lv->Vals() )
+				vl.emplace_back(v);
 			}
 		else
 			{
@@ -2478,12 +2541,12 @@ double TableVal::CallExpireFunc(IntrusivePtr<ListVal> idx)
 			ListVal* idx_list = idx->AsListVal();
 			// Flatten if only one element
 			if ( idx_list->Length() == 1 )
-				vl.emplace_back(NewRef{}, idx_list->Index(0));
+				vl.emplace_back(idx_list->Idx(0));
 			else
 				vl.emplace_back(std::move(idx));
 			}
 
-		auto result = f->Call(vl);
+		auto result = f->Invoke(&vl);
 
 		if ( result )
 			secs = result->AsInterval();
@@ -2513,7 +2576,7 @@ IntrusivePtr<Val> TableVal::DoClone(CloneState* state)
 
 		if ( subnets )
 			{
-			auto idx = RecoverIndex(key);
+			auto idx = RecreateIndex(*key);
 			tv->subnets->Insert(idx.get(), nval);
 			}
 
@@ -2551,8 +2614,8 @@ unsigned int TableVal::MemoryAllocation() const
 	TableEntryVal* tv;
 	while ( (tv = v->NextEntry(c)) )
 		{
-		if ( tv->Value() )
-			size += tv->Value()->MemoryAllocation();
+		if ( tv->GetVal() )
+			size += tv->GetVal()->MemoryAllocation();
 		size += padded_sizeof(TableEntryVal);
 		}
 
@@ -2561,8 +2624,11 @@ unsigned int TableVal::MemoryAllocation() const
 	}
 
 HashKey* TableVal::ComputeHash(const Val* index) const
+	{ return MakeHashKey(*index).release(); }
+
+std::unique_ptr<HashKey> TableVal::MakeHashKey(const Val& index) const
 	{
-	return table_hash->ComputeHash(index, true);
+	return table_hash->MakeHashKey(index, true);
 	}
 
 void TableVal::SaveParseTimeTableState(RecordType* rt)
@@ -2603,9 +2669,7 @@ TableVal::ParseTimeTableState TableVal::DumpTableState()
 
 	while ( (val = tbl->NextEntry(key, cookie)) )
 		{
-		rval.emplace_back(RecoverIndex(key),
-		                  IntrusivePtr<Val>{NewRef{}, val->Value()});
-
+		rval.emplace_back(RecreateIndex(*key), val->GetVal());
 		delete key;
 		}
 
@@ -2616,11 +2680,10 @@ TableVal::ParseTimeTableState TableVal::DumpTableState()
 void TableVal::RebuildTable(ParseTimeTableState ptts)
 	{
 	delete table_hash;
-	table_hash = new CompositeHash(IntrusivePtr<TypeList>(NewRef{},
-	                               table_type->Indices()));
+	table_hash = new CompositeHash(table_type->GetIndices());
 
 	for ( auto& [key, val] : ptts )
-		Assign(key.get(), val.release());
+		Assign(std::move(key), std::move(val));
 	}
 
 TableVal::ParseTimeTableStates TableVal::parse_time_table_states;
@@ -2629,14 +2692,20 @@ TableVal::TableRecordDependencies TableVal::parse_time_table_record_dependencies
 
 RecordVal::RecordTypeValMap RecordVal::parse_time_records;
 
-RecordVal::RecordVal(RecordType* t, bool init_fields) : Val(t)
+RecordVal::RecordVal(RecordType* t, bool init_fields)
+	: RecordVal({NewRef{}, t}, init_fields)
+	{}
+
+RecordVal::RecordVal(IntrusivePtr<RecordType> t, bool init_fields) : Val(std::move(t))
 	{
 	origin = nullptr;
-	int n = t->NumFields();
-	val_list* vl = val.val_list_val = new val_list(n);
+	auto rt = GetType()->AsRecordType();
+	int n = rt->NumFields();
+	auto vl = val.record_val = new std::vector<IntrusivePtr<Val>>;
+	vl->reserve(n);
 
 	if ( is_parsing )
-		parse_time_records[t].emplace_back(NewRef{}, this);
+		parse_time_records[rt].emplace_back(NewRef{}, this);
 
 	if ( ! init_fields )
 		return;
@@ -2645,54 +2714,53 @@ RecordVal::RecordVal(RecordType* t, bool init_fields) : Val(t)
 	// by default).
 	for ( int i = 0; i < n; ++i )
 		{
-		Attributes* a = t->FieldDecl(i)->attrs.get();
-		Attr* def_attr = a ? a->FindAttr(ATTR_DEFAULT) : nullptr;
-		auto def = def_attr ? def_attr->AttrExpr()->Eval(nullptr) : nullptr;
-		BroType* type = t->FieldDecl(i)->type.get();
+		Attributes* a = rt->FieldDecl(i)->attrs.get();
+		Attr* def_attr = a ? a->Find(ATTR_DEFAULT).get() : nullptr;
+		auto def = def_attr ? def_attr->GetExpr()->Eval(nullptr) : nullptr;
+		const auto& type = rt->FieldDecl(i)->type;
 
 		if ( def && type->Tag() == TYPE_RECORD &&
-		     def->Type()->Tag() == TYPE_RECORD &&
-		     ! same_type(def->Type(), type) )
+		     def->GetType()->Tag() == TYPE_RECORD &&
+		     ! same_type(def->GetType(), type) )
 			{
-			auto tmp = def->AsRecordVal()->CoerceTo(type->AsRecordType());
+			auto tmp = def->AsRecordVal()->CoerceTo(cast_intrusive<RecordType>(type));
 
 			if ( tmp )
 				def = std::move(tmp);
 			}
 
-		if ( ! def && ! (a && a->FindAttr(ATTR_OPTIONAL)) )
+		if ( ! def && ! (a && a->Find(ATTR_OPTIONAL)) )
 			{
 			TypeTag tag = type->Tag();
 
 			if ( tag == TYPE_RECORD )
-				def = make_intrusive<RecordVal>(type->AsRecordType());
+				def = make_intrusive<RecordVal>(cast_intrusive<RecordType>(type));
 
 			else if ( tag == TYPE_TABLE )
 				def = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, type->AsTableType()},
 				                               IntrusivePtr{NewRef{}, a});
 
 			else if ( tag == TYPE_VECTOR )
-				def = make_intrusive<VectorVal>(type->AsVectorType());
+				def = make_intrusive<VectorVal>(cast_intrusive<VectorType>(type));
 			}
 
-		vl->push_back(def.release());
+		vl->emplace_back(std::move(def));
 		}
 	}
 
 RecordVal::~RecordVal()
 	{
-	delete_vals(AsNonConstRecord());
+	delete AsNonConstRecord();
 	}
 
 IntrusivePtr<Val> RecordVal::SizeVal() const
 	{
-	return val_mgr->Count(Type()->AsRecordType()->NumFields());
+	return val_mgr->Count(GetType()->AsRecordType()->NumFields());
 	}
 
 void RecordVal::Assign(int field, IntrusivePtr<Val> new_val)
 	{
-	Val* old_val = AsNonConstRecord()->replace(field, new_val.release());
-	Unref(old_val);
+	(*AsNonConstRecord())[field] = std::move(new_val);
 	Modified();
 	}
 
@@ -2701,19 +2769,14 @@ void RecordVal::Assign(int field, Val* new_val)
 	Assign(field, {AdoptRef{}, new_val});
 	}
 
-Val* RecordVal::Lookup(int field) const
+IntrusivePtr<Val> RecordVal::GetFieldOrDefault(int field) const
 	{
-	return (*AsRecord())[field];
-	}
-
-IntrusivePtr<Val> RecordVal::LookupWithDefault(int field) const
-	{
-	Val* val = (*AsRecord())[field];
+	const auto& val = (*AsRecord())[field];
 
 	if ( val )
-		return {NewRef{}, val};
+		return val;
 
-	return Type()->AsRecordType()->FieldDefault(field);
+	return GetType()->AsRecordType()->FieldDefault(field);
 	}
 
 void RecordVal::ResizeParseTimeRecords(RecordType* rt)
@@ -2727,16 +2790,16 @@ void RecordVal::ResizeParseTimeRecords(RecordType* rt)
 
 	for ( auto& rv : rvs )
 		{
-		auto vs = rv->val.val_list_val;
-		auto current_length = vs->length();
+		auto vs = rv->val.record_val;
+		int current_length = vs->size();
 		auto required_length = rt->NumFields();
 
 		if ( required_length > current_length )
 			{
-			vs->resize(required_length);
+			vs->reserve(required_length);
 
 			for ( auto i = current_length; i < required_length; ++i )
-				vs->replace(i, rt->FieldDefault(i).release());
+				vs->emplace_back(rt->FieldDefault(i));
 			}
 		}
 	}
@@ -2746,28 +2809,38 @@ void RecordVal::DoneParsing()
 	parse_time_records.clear();
 	}
 
-IntrusivePtr<Val> RecordVal::Lookup(const char* field, bool with_default) const
+const IntrusivePtr<Val>& RecordVal::GetField(const char* field) const
 	{
-	int idx = Type()->AsRecordType()->FieldOffset(field);
+	int idx = GetType()->AsRecordType()->FieldOffset(field);
 
 	if ( idx < 0 )
 		reporter->InternalError("missing record field: %s", field);
 
-	return with_default ? LookupWithDefault(idx) : IntrusivePtr{NewRef{}, Lookup(idx)};
+	return GetField(idx);
 	}
 
-IntrusivePtr<RecordVal> RecordVal::CoerceTo(const RecordType* t, Val* aggr, bool allow_orphaning) const
+IntrusivePtr<Val> RecordVal::GetFieldOrDefault(const char* field) const
 	{
-	if ( ! record_promotion_compatible(t->AsRecordType(), Type()->AsRecordType()) )
+	int idx = GetType()->AsRecordType()->FieldOffset(field);
+
+	if ( idx < 0 )
+		reporter->InternalError("missing record field: %s", field);
+
+	return GetFieldOrDefault(idx);
+	}
+
+IntrusivePtr<RecordVal> RecordVal::CoerceTo(IntrusivePtr<RecordType> t,
+                                            IntrusivePtr<RecordVal> aggr,
+                                            bool allow_orphaning) const
+	{
+	if ( ! record_promotion_compatible(t.get(), GetType()->AsRecordType()) )
 		return nullptr;
 
 	if ( ! aggr )
-		aggr = new RecordVal(const_cast<RecordType*>(t->AsRecordType()));
+		aggr = make_intrusive<RecordVal>(std::move(t));
 
-	RecordVal* ar = aggr->AsRecordVal();
-	RecordType* ar_t = aggr->Type()->AsRecordType();
-
-	const RecordType* rv_t = Type()->AsRecordType();
+	RecordType* ar_t = aggr->GetType()->AsRecordType();
+	const RecordType* rv_t = GetType()->AsRecordType();
 
 	int i;
 	for ( i = 0; i < rv_t->NumFields(); ++i )
@@ -2787,28 +2860,29 @@ IntrusivePtr<RecordVal> RecordVal::CoerceTo(const RecordType* t, Val* aggr, bool
 			break;
 			}
 
-		Val* v = Lookup(i);
+		const auto& v = GetField(i);
 
 		if ( ! v )
 			// Check for allowable optional fields is outside the loop, below.
 			continue;
 
-		if ( ar_t->FieldType(t_i)->Tag() == TYPE_RECORD &&
-		     ! same_type(ar_t->FieldType(t_i), v->Type()) )
+		const auto& ft = ar_t->GetFieldType(t_i);
+
+		if ( ft->Tag() == TYPE_RECORD && ! same_type(ft, v->GetType()) )
 			{
-			auto rhs = make_intrusive<ConstExpr>(IntrusivePtr{NewRef{}, v});
+			auto rhs = make_intrusive<ConstExpr>(v);
 			auto e = make_intrusive<RecordCoerceExpr>(std::move(rhs),
-			        IntrusivePtr{NewRef{}, ar_t->FieldType(t_i)->AsRecordType()});
-			ar->Assign(t_i, e->Eval(nullptr));
+			                                          cast_intrusive<RecordType>(ft));
+			aggr->Assign(t_i, e->Eval(nullptr));
 			continue;
 			}
 
-		ar->Assign(t_i, {NewRef{}, v});
+		aggr->Assign(t_i, v);
 		}
 
 	for ( i = 0; i < ar_t->NumFields(); ++i )
-		if ( ! ar->Lookup(i) &&
-			 ! ar_t->FieldDecl(i)->FindAttr(ATTR_OPTIONAL) )
+		if ( ! aggr->GetField(i) &&
+			 ! ar_t->FieldDecl(i)->GetAttr(ATTR_OPTIONAL) )
 			{
 			char buf[512];
 			snprintf(buf, sizeof(buf),
@@ -2816,39 +2890,40 @@ IntrusivePtr<RecordVal> RecordVal::CoerceTo(const RecordType* t, Val* aggr, bool
 			Error(buf);
 			}
 
-	return {AdoptRef{}, ar};
+	return aggr;
 	}
 
-IntrusivePtr<RecordVal> RecordVal::CoerceTo(RecordType* t, bool allow_orphaning)
+IntrusivePtr<RecordVal> RecordVal::CoerceTo(IntrusivePtr<RecordType> t,
+                                            bool allow_orphaning)
 	{
-	if ( same_type(Type(), t) )
+	if ( same_type(GetType(), t) )
 		return {NewRef{}, this};
 
-	return CoerceTo(t, nullptr, allow_orphaning);
+	return CoerceTo(std::move(t), nullptr, allow_orphaning);
 	}
 
 IntrusivePtr<TableVal> RecordVal::GetRecordFieldsVal() const
 	{
-	return Type()->AsRecordType()->GetRecordFieldsVal(this);
+	return GetType()->AsRecordType()->GetRecordFieldsVal(this);
 	}
 
 void RecordVal::Describe(ODesc* d) const
 	{
-	const val_list* vl = AsRecord();
-	int n = vl->length();
-	auto record_type = Type()->AsRecordType();
+	auto vl = AsRecord();
+	auto n = vl->size();
+	auto record_type = GetType()->AsRecordType();
 
 	if ( d->IsBinary() || d->IsPortable() )
 		{
 		record_type->Describe(d);
 		d->SP();
-		d->Add(n);
+		d->Add(static_cast<uint64_t>(n));
 		d->SP();
 		}
 	else
 		d->Add("[");
 
-	loop_over_list(*vl, i)
+	for ( size_t i = 0; i < n; ++i )
 		{
 		if ( ! d->IsBinary() && i > 0 )
 			d->Add(", ");
@@ -2858,7 +2933,8 @@ void RecordVal::Describe(ODesc* d) const
 		if ( ! d->IsBinary() )
 			d->Add("=");
 
-		Val* v = (*vl)[i];
+		const auto& v = (*vl)[i];
+
 		if ( v )
 			v->Describe(d);
 		else
@@ -2871,14 +2947,14 @@ void RecordVal::Describe(ODesc* d) const
 
 void RecordVal::DescribeReST(ODesc* d) const
 	{
-	const val_list* vl = AsRecord();
-	int n = vl->length();
-	auto record_type = Type()->AsRecordType();
+	auto vl = AsRecord();
+	auto n = vl->size();
+	auto record_type = GetType()->AsRecordType();
 
 	d->Add("{");
 	d->PushIndent();
 
-	loop_over_list(*vl, i)
+	for ( size_t i = 0; i < n; ++i )
 		{
 		if ( i > 0 )
 			d->NL();
@@ -2886,7 +2962,7 @@ void RecordVal::DescribeReST(ODesc* d) const
 		d->Add(record_type->FieldName(i));
 		d->Add("=");
 
-		Val* v = (*vl)[i];
+		const auto& v = (*vl)[i];
 
 		if ( v )
 			v->Describe(d);
@@ -2905,14 +2981,14 @@ IntrusivePtr<Val> RecordVal::DoClone(CloneState* state)
 	// record. As we cannot guarantee that it will ber zeroed out at the
 	// approproate time (as it seems to be guaranteed for the original record)
 	// we don't touch it.
-	auto rv = make_intrusive<RecordVal>(Type()->AsRecordType(), false);
+	auto rv = make_intrusive<RecordVal>(GetType<RecordType>(), false);
 	rv->origin = nullptr;
 	state->NewClone(this, rv);
 
-	for ( const auto& vlv : *val.val_list_val )
+	for ( const auto& vlv : *val.record_val)
 		{
 		auto v = vlv ? vlv->Clone(state) : nullptr;
-  		rv->val.val_list_val->push_back(v.release());
+  		rv->val.record_val->emplace_back(std::move(v));
 		}
 
 	return rv;
@@ -2921,15 +2997,17 @@ IntrusivePtr<Val> RecordVal::DoClone(CloneState* state)
 unsigned int RecordVal::MemoryAllocation() const
 	{
 	unsigned int size = 0;
-	const val_list* vl = AsRecord();
+	const auto& vl = *AsRecord();
 
-	for ( const auto& v : *vl )
+	for ( const auto& v : vl )
 		{
 		if ( v )
 		    size += v->MemoryAllocation();
 		}
 
-	return size + padded_sizeof(*this) + val.val_list_val->MemoryAllocation();
+	size += pad_size(vl.capacity() * sizeof(IntrusivePtr<Val>));
+	size += padded_sizeof(vl);
+	return size + padded_sizeof(*this);
 	}
 
 IntrusivePtr<Val> EnumVal::SizeVal() const
@@ -2953,19 +3031,16 @@ IntrusivePtr<Val> EnumVal::DoClone(CloneState* state)
 	return {NewRef{}, this};
 	}
 
-VectorVal::VectorVal(VectorType* t) : Val(t)
+VectorVal::VectorVal(VectorType* t) : VectorVal({NewRef{}, t})
+	{ }
+
+VectorVal::VectorVal(IntrusivePtr<VectorType> t) : Val(std::move(t))
 	{
-	vector_type = t->Ref()->AsVectorType();
-	val.vector_val = new vector<Val*>();
+	val.vector_val = new vector<IntrusivePtr<Val>>();
 	}
 
 VectorVal::~VectorVal()
 	{
-	for ( unsigned int i = 0; i < val.vector_val->size(); ++i )
-		Unref((*val.vector_val)[i]);
-
-	Unref(vector_type);
-
 	delete val.vector_val;
 	}
 
@@ -2977,64 +3052,46 @@ IntrusivePtr<Val> VectorVal::SizeVal() const
 bool VectorVal::Assign(unsigned int index, IntrusivePtr<Val> element)
 	{
 	if ( element &&
-	     ! same_type(element->Type(), vector_type->YieldType(), false) )
+	     ! same_type(element->GetType(), GetType()->AsVectorType()->Yield(), false) )
 		return false;
 
-	Val* val_at_index = nullptr;
-
-	if ( index < val.vector_val->size() )
-		val_at_index = (*val.vector_val)[index];
-	else
+	if ( index >= val.vector_val->size() )
 		val.vector_val->resize(index + 1);
 
-	Unref(val_at_index);
-
-	// Note: we do *not* Ref() the element, if any, at this point.
-	// AssignExpr::Eval() already does this; other callers must remember
-	// to do it similarly.
-	(*val.vector_val)[index] = element.release();
+	(*val.vector_val)[index] = std::move(element);
 
 	Modified();
 	return true;
 	}
 
-bool VectorVal::Assign(unsigned int index, Val* element)
-	{
-	return Assign(index, {AdoptRef{}, element});
-	}
-
 bool VectorVal::AssignRepeat(unsigned int index, unsigned int how_many,
-				Val* element)
+                             IntrusivePtr<Val> element)
 	{
 	ResizeAtLeast(index + how_many);
 
 	for ( unsigned int i = index; i < index + how_many; ++i )
-		if ( ! Assign(i, {NewRef{}, element}) )
+		if ( ! Assign(i, element) )
 			return false;
 
 	return true;
 	}
 
-bool VectorVal::Insert(unsigned int index, Val* element)
+bool VectorVal::Insert(unsigned int index, IntrusivePtr<Val> element)
 	{
 	if ( element &&
-	     ! same_type(element->Type(), vector_type->YieldType(), false) )
+	     ! same_type(element->GetType(), GetType()->AsVectorType()->Yield(), false) )
 		{
-		Unref(element);
 		return false;
 		}
 
-	vector<Val*>::iterator it;
+	vector<IntrusivePtr<Val>>::iterator it;
 
 	if ( index < val.vector_val->size() )
 		it = std::next(val.vector_val->begin(), index);
 	else
 		it = val.vector_val->end();
 
-	// Note: we do *not* Ref() the element, if any, at this point.
-	// AssignExpr::Eval() already does this; other callers must remember
-	// to do it similarly.
-	val.vector_val->insert(it, element);
+	val.vector_val->insert(it, std::move(element));
 
 	Modified();
 	return true;
@@ -3045,10 +3102,8 @@ bool VectorVal::Remove(unsigned int index)
 	if ( index >= val.vector_val->size() )
 		return false;
 
-	Val* val_at_index = (*val.vector_val)[index];
 	auto it = std::next(val.vector_val->begin(), index);
 	val.vector_val->erase(it);
-	Unref(val_at_index);
 
 	Modified();
 	return true;
@@ -3056,7 +3111,7 @@ bool VectorVal::Remove(unsigned int index)
 
 bool VectorVal::AddTo(Val* val, bool /* is_first_init */) const
 	{
-	if ( val->Type()->Tag() != TYPE_VECTOR )
+	if ( val->GetType()->Tag() != TYPE_VECTOR )
 		{
 		val->Error("not a vector");
 		return false;
@@ -3064,24 +3119,24 @@ bool VectorVal::AddTo(Val* val, bool /* is_first_init */) const
 
 	VectorVal* v = val->AsVectorVal();
 
-	if ( ! same_type(type, v->Type()) )
+	if ( ! same_type(type, v->GetType()) )
 		{
-		type->Error("vector type clash", v->Type());
+		type->Error("vector type clash", v->GetType().get());
 		return false;
 		}
 
 	auto last_idx = v->Size();
 
 	for ( auto i = 0u; i < Size(); ++i )
-		v->Assign(last_idx++, {NewRef{}, Lookup(i)});
+		v->Assign(last_idx++, At(i));
 
 	return true;
 	}
 
-Val* VectorVal::Lookup(unsigned int index) const
+const IntrusivePtr<Val>& VectorVal::At(unsigned int index) const
 	{
 	if ( index >= val.vector_val->size() )
-		return nullptr;
+		return Val::nil;
 
 	return (*val.vector_val)[index];
 	}
@@ -3105,14 +3160,14 @@ unsigned int VectorVal::ResizeAtLeast(unsigned int new_num_elements)
 
 IntrusivePtr<Val> VectorVal::DoClone(CloneState* state)
 	{
-	auto vv = make_intrusive<VectorVal>(vector_type);
+	auto vv = make_intrusive<VectorVal>(GetType<VectorType>());
 	vv->val.vector_val->reserve(val.vector_val->size());
 	state->NewClone(this, vv);
 
 	for ( unsigned int i = 0; i < val.vector_val->size(); ++i )
 		{
 		auto v = (*val.vector_val)[i]->Clone(state);
-		vv->val.vector_val->push_back(v.release());
+		vv->val.vector_val->push_back(std::move(v));
 		}
 
 	return vv;
@@ -3144,9 +3199,7 @@ IntrusivePtr<Val> check_and_promote(IntrusivePtr<Val> v, const BroType* t,
 	if ( ! v )
 		return nullptr;
 
-	BroType* vt = v->Type();
-
-	vt = flatten_type(vt);
+	BroType* vt = flatten_type(v->GetType().get());
 	t = flatten_type(t);
 
 	TypeTag t_tag = t->Tag();
@@ -3253,17 +3306,17 @@ bool same_val(const Val* /* v1 */, const Val* /* v2 */)
 
 bool is_atomic_val(const Val* v)
 	{
-	return is_atomic_type(v->Type());
+	return is_atomic_type(v->GetType());
 	}
 
 bool same_atomic_val(const Val* v1, const Val* v2)
 	{
 	// This is a very preliminary implementation of same_val(),
 	// true only for equal, simple atomic values of same type.
-	if ( v1->Type()->Tag() != v2->Type()->Tag() )
+	if ( v1->GetType()->Tag() != v2->GetType()->Tag() )
 		return false;
 
-	switch ( v1->Type()->InternalType() ) {
+	switch ( v1->GetType()->InternalType() ) {
 	case TYPE_INTERNAL_INT:
 		return v1->InternalInt() == v2->InternalInt();
 	case TYPE_INTERNAL_UNSIGNED:
@@ -3340,17 +3393,17 @@ IntrusivePtr<Val> cast_value_to_type(Val* v, BroType* t)
 
 	// Always allow casting to same type. This also covers casting 'any'
 	// to the actual type.
-	if ( same_type(v->Type(), t) )
+	if ( same_type(v->GetType(), t) )
 		return {NewRef{}, v};
 
-	if ( same_type(v->Type(), bro_broker::DataVal::ScriptDataType()) )
+	if ( same_type(v->GetType(), bro_broker::DataVal::ScriptDataType()) )
 		{
-		auto dv = v->AsRecordVal()->Lookup(0);
+		const auto& dv = v->AsRecordVal()->GetField(0);
 
 		if ( ! dv )
 			return nullptr;
 
-		return static_cast<bro_broker::DataVal*>(dv)->castTo(t);
+		return static_cast<bro_broker::DataVal*>(dv.get())->castTo(t);
 		}
 
 	return nullptr;
@@ -3366,17 +3419,17 @@ bool can_cast_value_to_type(const Val* v, BroType* t)
 
 	// Always allow casting to same type. This also covers casting 'any'
 	// to the actual type.
-	if ( same_type(v->Type(), t) )
+	if ( same_type(v->GetType(), t) )
 		return true;
 
-	if ( same_type(v->Type(), bro_broker::DataVal::ScriptDataType()) )
+	if ( same_type(v->GetType(), bro_broker::DataVal::ScriptDataType()) )
 		{
-		auto dv = v->AsRecordVal()->Lookup(0);
+		const auto& dv = v->AsRecordVal()->GetField(0);
 
 		if ( ! dv )
 			return false;
 
-		return static_cast<const bro_broker::DataVal *>(dv)->canCastTo(t);
+		return static_cast<const bro_broker::DataVal *>(dv.get())->canCastTo(t);
 		}
 
 	return false;
diff --git a/src/Val.h b/src/Val.h
index 1bcc5cc147..b6a2bf2f9c 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -80,9 +80,8 @@ union BroValUnion {
 	BroFile* file_val;
 	RE_Matcher* re_val;
 	PDict<TableEntryVal>* table_val;
-	val_list* val_list_val;
-
-	std::vector<Val*>* vector_val;
+	std::vector<IntrusivePtr<Val>>* record_val;
+	std::vector<IntrusivePtr<Val>>* vector_val;
 
 	BroValUnion() = default;
 
@@ -115,37 +114,38 @@ union BroValUnion {
 
 	constexpr BroValUnion(PDict<TableEntryVal>* value) noexcept
 		: table_val(value) {}
-
-	constexpr BroValUnion(val_list* value) noexcept
-		: val_list_val(value) {}
-
-	constexpr BroValUnion(std::vector<Val*> *value) noexcept
-		: vector_val(value) {}
 };
 
 class Val : public BroObj {
 public:
+	static inline const IntrusivePtr<Val> nil;
+
 	Val(double d, TypeTag t)
-		: val(d), type(base_type(t).release())
-		{
-		}
+		: val(d), type(base_type(t))
+		{}
 
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Val(Func* f);
+	explicit Val(IntrusivePtr<Func> f);
 
-	// Note, will unref 'f' when it's done, closing it unless
-	// class has ref'd it.
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Val(BroFile* f);
+	// Note, the file will be closed after this Val is destructed if there's
+	// no other remaining references.
+	explicit Val(IntrusivePtr<BroFile> f);
 
 	// Extra arg to differentiate from protected version.
-	Val(BroType* t, bool type_type)
-		: type(new TypeType({NewRef{}, t}))
-		{
-		}
+	Val(IntrusivePtr<BroType> t, bool type_type)
+		: type(make_intrusive<TypeType>(std::move(t)))
+		{}
+
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
+	Val(BroType* t, bool type_type) : Val({NewRef{}, t}, type_type)
+		{}
 
 	Val()
-		: val(bro_int_t(0)), type(base_type(TYPE_ERROR).release())
-		{
-		}
+		: val(bro_int_t(0)), type(base_type(TYPE_ERROR))
+		{}
 
 	~Val() override;
 
@@ -179,8 +179,17 @@ public:
 	// Remove this value from the given value (if appropriate).
 	virtual bool RemoveFrom(Val* v) const;
 
-	BroType* Type()			{ return type; }
-	const BroType* Type() const	{ return type; }
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
+	BroType* Type()			{ return type.get(); }
+	[[deprecated("Remove in v4.1.  Use GetType().")]]
+	const BroType* Type() const	{ return type.get(); }
+
+	const IntrusivePtr<BroType>& GetType() const
+		{ return type; }
+
+	template <class T>
+	IntrusivePtr<T> GetType() const
+		{ return cast_intrusive<T>(type); }
 
 #define CONST_ACCESSOR(tag, ctype, accessor, name) \
 	const ctype name() const \
@@ -208,10 +217,10 @@ public:
 	CONST_ACCESSOR(TYPE_STRING, BroString*, string_val, AsString)
 	CONST_ACCESSOR(TYPE_FUNC, Func*, func_val, AsFunc)
 	CONST_ACCESSOR(TYPE_TABLE, PDict<TableEntryVal>*, table_val, AsTable)
-	CONST_ACCESSOR(TYPE_RECORD, val_list*, val_list_val, AsRecord)
+	CONST_ACCESSOR(TYPE_RECORD, std::vector<IntrusivePtr<Val>>*, record_val, AsRecord)
 	CONST_ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile)
 	CONST_ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
-	CONST_ACCESSOR(TYPE_VECTOR, std::vector<Val*>*, vector_val, AsVector)
+	CONST_ACCESSOR(TYPE_VECTOR, std::vector<IntrusivePtr<Val>>*, vector_val, AsVector)
 
 	const IPPrefix& AsSubNet() const
 		{
@@ -222,7 +231,7 @@ public:
 	BroType* AsType() const
 		{
 		CHECK_TAG(type->Tag(), TYPE_TYPE, "Val::Type", type_name)
-		return type;
+		return type.get();
 		}
 
 	const IPAddr& AsAddr() const
@@ -245,7 +254,9 @@ public:
 	ACCESSOR(TYPE_FUNC, Func*, func_val, AsFunc)
 	ACCESSOR(TYPE_FILE, BroFile*, file_val, AsFile)
 	ACCESSOR(TYPE_PATTERN, RE_Matcher*, re_val, AsPattern)
-	ACCESSOR(TYPE_VECTOR, std::vector<Val*>*, vector_val, AsVector)
+	ACCESSOR(TYPE_VECTOR, std::vector<IntrusivePtr<Val>>*, vector_val, AsVector)
+
+	IntrusivePtr<Func> AsFuncPtr() const;
 
 	const IPPrefix& AsSubNet()
 		{
@@ -340,24 +351,21 @@ protected:
 	static IntrusivePtr<Val> MakeCount(bro_uint_t u);
 
 	template<typename V>
-	Val(V &&v, TypeTag t) noexcept
-		: val(std::forward<V>(v)), type(base_type(t).release())
-		{
-		}
+	Val(V&& v, TypeTag t) noexcept
+		: val(std::forward<V>(v)), type(base_type(t))
+		{}
 
 	template<typename V>
-	Val(V &&v, BroType* t) noexcept
-		: val(std::forward<V>(v)), type(t->Ref())
-		{
-		}
+	Val(V&& v, IntrusivePtr<BroType> t) noexcept
+		: val(std::forward<V>(v)), type(std::move(t))
+		{}
 
-	explicit Val(BroType* t)
-		: type(t->Ref())
-		{
-		}
+	explicit Val(IntrusivePtr<BroType> t) noexcept
+		: type(std::move(t))
+		{}
 
 	ACCESSOR(TYPE_TABLE, PDict<TableEntryVal>*, table_val, AsNonConstTable)
-	ACCESSOR(TYPE_RECORD, val_list*, val_list_val, AsNonConstRecord)
+	ACCESSOR(TYPE_RECORD, std::vector<IntrusivePtr<Val>>*, record_val, AsNonConstRecord)
 
 	// For internal use by the Val::Clone() methods.
 	struct CloneState {
@@ -373,7 +381,7 @@ protected:
 	virtual IntrusivePtr<Val> DoClone(CloneState* state);
 
 	BroValUnion val;
-	BroType* type;
+	IntrusivePtr<BroType> type;
 
 #ifdef DEBUG
 	// For debugging, we keep the name of the ID to which a Val is bound.
@@ -593,7 +601,12 @@ public:
 
 	unsigned int MemoryAllocation() const override;
 
-	IntrusivePtr<StringVal> Substitute(RE_Matcher* re, StringVal* repl, bool do_all);
+	IntrusivePtr<StringVal> Replace(RE_Matcher* re, const BroString& repl,
+	                                bool do_all);
+
+	[[deprecated("Remove in v4.1.  Use Replace().")]]
+	Val* Substitute(RE_Matcher* re, StringVal* repl, bool do_all)
+		{ return Replace(re, *repl->AsString(), do_all).release(); }
 
 protected:
 	void ValDescribe(ODesc* d) const override;
@@ -627,9 +640,14 @@ public:
 
 	IntrusivePtr<Val> SizeVal() const override;
 
-	int Length() const		{ return vals.length(); }
-	Val* Index(const int n)		{ return vals[n]; }
-	const Val* Index(const int n) const	{ return vals[n]; }
+	int Length() const		{ return vals.size(); }
+
+	const IntrusivePtr<Val>& Idx(size_t i) const	{ return vals[i]; }
+
+	[[deprecated("Remove in v4.1.  Use Idx() instead")]]
+	Val* Index(const int n)		{ return vals[n].get(); }
+	[[deprecated("Remove in v4.1.  Use Idx() instead")]]
+	const Val* Index(const int n) const	{ return vals[n].get(); }
 
 	// Returns an RE_Matcher() that will match any string that
 	// includes embedded within it one of the patterns listed
@@ -641,13 +659,22 @@ public:
 	// The return RE_Matcher has not yet been compiled.
 	RE_Matcher* BuildRE() const;
 
+	/**
+	 * Appends a value to the list.
+	 * @param v  the value to append.
+	 */
+	void Append(IntrusivePtr<Val> v);
+
+	[[deprecated("Remove in v4.1.  Use Append(IntrusivePtr) instead.")]]
 	void Append(Val* v);
 
 	// Returns a Set representation of the list (which must be homogeneous).
+	IntrusivePtr<TableVal> ToSetVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToSetVal() instead.")]]
 	TableVal* ConvertToSet() const;
 
-	const val_list* Vals() const	{ return &vals; }
-	val_list* Vals()		{ return &vals; }
+	const std::vector<IntrusivePtr<Val>>& Vals() const	{ return vals; }
 
 	void Describe(ODesc* d) const override;
 
@@ -656,7 +683,7 @@ public:
 protected:
 	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
-	val_list vals;
+	std::vector<IntrusivePtr<Val>> vals;
 	TypeTag tag;
 };
 
@@ -664,9 +691,8 @@ extern double bro_start_network_time;
 
 class TableEntryVal {
 public:
-	template<typename V>
-	explicit TableEntryVal(V&& v)
-		: val(std::forward<V>(v))
+	explicit TableEntryVal(IntrusivePtr<Val> v)
+		: val(std::move(v))
 		{
 		last_access_time = network_time;
 		expire_access_time =
@@ -675,8 +701,12 @@ public:
 
 	TableEntryVal* Clone(Val::CloneState* state);
 
+	[[deprecated("Remove in v4.1.  Use GetVal().")]]
 	Val* Value()	{ return val.get(); }
 
+	const IntrusivePtr<Val>& GetVal() const
+		{ return val; }
+
 	// Returns/sets time of last expiration relevant access to this value.
 	double ExpireAccessTime() const
 		{ return bro_start_network_time + expire_access_time; }
@@ -715,16 +745,45 @@ class Frame;
 class TableVal final : public Val, public notifier::Modifiable {
 public:
 	explicit TableVal(IntrusivePtr<TableType> t, IntrusivePtr<Attributes> attrs = nullptr);
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtrs instead.")]]
+	explicit TableVal(TableType* t, Attributes* attrs = nullptr)
+		: TableVal({NewRef{}, t}, {NewRef{}, attrs})
+		{}
+
 	~TableVal() override;
 
+	/**
+	 * Assigns a value at an associated index in the table (or in the
+	 * case of a set, just adds the index).
+	 * @param index  The key to assign.
+	 * @param new_val  The value to assign at the index.  For a set, this
+	 * must be nullptr.
+	 * @return  True if the assignment type-checked.
+	 */
+	bool Assign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val);
+
+	/**
+	 * Assigns a value at an associated index in the table (or in the
+	 * case of a set, just adds the index).
+	 * @param index  The key to assign.  For tables, this is allowed to be null
+	 * (if needed, the index val can be recovered from the hash key).
+	 * @param k  A precomputed hash key to use.
+	 * @param new_val  The value to assign at the index.  For a set, this
+	 * must be nullptr.
+	 * @return  True if the assignment type-checked.
+	 */
+	bool Assign(IntrusivePtr<Val> index, std::unique_ptr<HashKey> k,
+	            IntrusivePtr<Val> new_val);
+
 	// Returns true if the assignment typechecked, false if not. The
-	// methods take ownership of new_val, but not of the index. Second
-	// version takes a HashKey and Unref()'s it when done. If we're a
-	// set, new_val has to be nil. If we aren't a set, index may be nil
-	// in the second version.
-	bool Assign(Val* index, IntrusivePtr<Val> new_val);
+	// methods take ownership of new_val, but not of the index.  If we're
+	// a set, new_val has to be nil.
+	[[deprecated("Remove in v4.1.  Use IntrusivePtr overload instead.")]]
 	bool Assign(Val* index, Val* new_val);
-	bool Assign(Val* index, HashKey* k, IntrusivePtr<Val> new_val);
+
+	// Same as other Assign() method, but takes a precomuted HashKey and
+	// deletes it when done.
+	[[deprecated("Remove in v4.1.  Use IntrusivePtr overload instead.")]]
 	bool Assign(Val* index, HashKey* k, Val* new_val);
 
 	IntrusivePtr<Val> SizeVal() const override;
@@ -747,30 +806,68 @@ public:
 	// Returns true if the addition typechecked, false if not.
 	bool RemoveFrom(Val* v) const override;
 
-	// Returns a new table that is the intersection of this
-	// table and the given table.  Intersection is just done
-	// on index, not on yield value, so this really only makes
-	// sense for sets.
-	TableVal* Intersect(const TableVal* v) const;
+	/**
+	 * Returns a new table that is the intersection of this table
+	 * and the given table.  Intersection is done only on index, not on
+	 * yield value, so this generally makes most sense to use for sets,
+	 * not tables.
+	 * @param v  The intersecting table.
+	 * @return  The intersection of this table and the given one.
+	 */
+	IntrusivePtr<TableVal> Intersection(const TableVal& v) const;
+
+	[[deprecated("Remove in v4.1.  Use Intersection() instead.")]]
+	TableVal* Intersect(const TableVal* v) const
+		{ return Intersection(*v).release(); }
 
 	// Returns true if this set contains the same members as the
 	// given set.  Note that comparisons are done using hash keys,
 	// so errors can arise for compound sets such as sets-of-sets.
 	// See https://bro-tracker.atlassian.net/browse/BIT-1949.
-	bool EqualTo(const TableVal* v) const;
+	bool EqualTo(const TableVal& v) const;
+
+	[[deprecated("Remove in v4.1.  Pass TableVal& instead.")]]
+	bool EqualTo(const TableVal* v) const
+		{ return EqualTo(*v); }
 
 	// Returns true if this set is a subset (not necessarily proper)
 	// of the given set.
-	bool IsSubsetOf(const TableVal* v) const;
+	bool IsSubsetOf(const TableVal& v) const;
+
+	[[deprecated("Remove in v4.1.  Pass TableVal& instead.")]]
+	bool IsSubsetOf(const TableVal* v) const
+		{ return IsSubsetOf(*v); }
 
 	// Expands any lists in the index into multiple initializations.
 	// Returns true if the initializations typecheck, false if not.
 	bool ExpandAndInit(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val);
 
+	/**
+	 * Finds an index in the table and returns its associated value.
+	 * @param index  The index to lookup in the table.
+	 * @return  The value associated with the index.  If the index doesn't
+	 * exist, this is a nullptr.  For sets that don't really contain associated
+	 * values, a placeholder value is returned to differentiate it from
+	 * non-existent index (nullptr), but otherwise has no meaning in relation
+	 * to the set's contents.
+	 */
+	const IntrusivePtr<Val>& Find(const IntrusivePtr<Val>& index);
+
+	/**
+	 * Finds an index in the table and returns its associated value or else
+	 * the &default value.
+	 * @param index  The index to lookup in the table.
+	 * @return  The value associated with the index.  If the index doesn't
+	 * exist, instead returns the &default value.  If there's no &default
+	 * attribute, then nullptr is still returned for non-existent index.
+	 */
+	IntrusivePtr<Val> FindOrDefault(const IntrusivePtr<Val>& index);
+
 	// Returns the element's value if it exists in the table,
 	// nil otherwise.  Note, "index" is not const because we
 	// need to Ref/Unref it when calling the default function.
-	IntrusivePtr<Val> Lookup(Val* index, bool use_default_val = true);
+	[[deprecated("Remove in v4.1.  Use Find() or FindOrDefault().")]]
+	Val* Lookup(Val* index, bool use_default_val = true);
 
 	// For a table[subnet]/set[subnet], return all subnets that cover
 	// the given subnet.
@@ -786,21 +883,66 @@ public:
 	// Returns false if index does not exist.
 	bool UpdateTimestamp(Val* index);
 
-	// Returns the index corresponding to the given HashKey.
-	IntrusivePtr<ListVal> RecoverIndex(const HashKey* k) const;
+	/**
+	 * @return  The index corresponding to the given HashKey.
+	 */
+	IntrusivePtr<ListVal> RecreateIndex(const HashKey& k) const;
 
-	// Returns the element if it was in the table, false otherwise.
-	IntrusivePtr<Val> Delete(const Val* index);
-	IntrusivePtr<Val> Delete(const HashKey* k);
+	[[deprecated("Remove in v4.1.  Use RecreateIndex().")]]
+	ListVal* RecoverIndex(const HashKey* k) const
+		{ return RecreateIndex(*k).release(); }
+
+	/**
+	 * Remove an element from the table and return it.
+	 * @param index  The index to remove.
+	 * @return  The value associated with the index if it exists, else nullptr.
+	 * For a sets that don't really contain associated values, a placeholder
+	 * value is returned to differentiate it from non-existent index (nullptr),
+	 * but otherwise has no meaning in relation to the set's contents.
+	 */
+	IntrusivePtr<Val> Remove(const Val& index);
+
+	/**
+	 * Same as Remove(const Val&), but uses a precomputed hash key.
+	 * @param k  The hash key to lookup.
+	 * @return  Same as Remove(const Val&).
+	 */
+	IntrusivePtr<Val> Remove(const HashKey& k);
+
+	[[deprecated("Remove in v4.1.  Use Remove().")]]
+	Val* Delete(const Val* index)
+		{ return Remove(*index).release(); }
+
+	[[deprecated("Remove in v4.1.  Use Remove().")]]
+	Val* Delete(const HashKey* k)
+		{ return Remove(*k).release(); }
 
 	// Returns a ListVal representation of the table (which must be a set).
+	IntrusivePtr<ListVal> ToListVal(TypeTag t = TYPE_ANY) const;
+
+	// Returns a ListVal representation of the table (which must be a set
+	// with non-composite index type).
+	IntrusivePtr<ListVal> ToPureListVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToListVal() instead.")]]
 	ListVal* ConvertToList(TypeTag t=TYPE_ANY) const;
+	[[deprecated("Remove in v4.1.  Use ToPureListVal() instead.")]]
 	ListVal* ConvertToPureList() const;	// must be single index type
 
 	void SetAttrs(IntrusivePtr<Attributes> attrs);
-	Attr* FindAttr(attr_tag t) const;
+
+	[[deprecated("Remove in v4.1.  Use GetAttr().")]]
+	Attr* FindAttr(attr_tag t) const
+		{ return GetAttr(t).get(); }
+
+	const IntrusivePtr<Attr>& GetAttr(attr_tag t) const;
+
+	[[deprecated("Remove in v4.1.  Use GetAttrs().")]]
 	Attributes* Attrs()	{ return attrs.get(); }
 
+	const IntrusivePtr<Attributes>& GetAttrs() const
+		{ return attrs; }
+
 	// Returns the size of the table.
 	int Size() const;
 	int RecursiveSize() const;
@@ -828,6 +970,14 @@ public:
 			timer = nullptr;
 		}
 
+	/**
+	 * @param  The index value to hash.
+	 * @return  The hash of the index value or nullptr if
+	 * type-checking failed.
+	 */
+	std::unique_ptr<HashKey> MakeHashKey(const Val& index) const;
+
+	[[deprecated("Remove in v4.1.  Use MakeHashKey().")]]
 	HashKey* ComputeHash(const Val* index) const;
 
 	notifier::Modifiable* Modifiable() override	{ return this; }
@@ -857,11 +1007,11 @@ protected:
 	void RebuildTable(ParseTimeTableState ptts);
 
 	void CheckExpireAttr(attr_tag at);
-	bool ExpandCompoundAndInit(val_list* vl, int k, IntrusivePtr<Val> new_val);
-	bool CheckAndAssign(Val* index, IntrusivePtr<Val> new_val);
+	bool ExpandCompoundAndInit(ListVal* lv, int k, IntrusivePtr<Val> new_val);
+	bool CheckAndAssign(IntrusivePtr<Val> index, IntrusivePtr<Val> new_val);
 
-	// Calculates default value for index.  Returns 0 if none.
-	IntrusivePtr<Val> Default(Val* index);
+	// Calculates default value for index.  Returns nullptr if none.
+	IntrusivePtr<Val> Default(const IntrusivePtr<Val>& index);
 
 	// Returns true if item expiration is enabled.
 	bool ExpirationEnabled()	{ return expire_time != nullptr; }
@@ -878,7 +1028,8 @@ protected:
 	enum OnChangeType { ELEMENT_NEW, ELEMENT_CHANGED, ELEMENT_REMOVED, ELEMENT_EXPIRED };
 
 	// Calls &change_func. Does not take ownership of values. (Refs if needed).
-	void CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe);
+	void CallChangeFunc(const Val* index, const IntrusivePtr<Val>& old_value,
+	                    OnChangeType tpe);
 
 	IntrusivePtr<Val> DoClone(CloneState* state) override;
 
@@ -901,15 +1052,112 @@ protected:
 
 class RecordVal final : public Val, public notifier::Modifiable {
 public:
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit RecordVal(RecordType* t, bool init_fields = true);
+	explicit RecordVal(IntrusivePtr<RecordType> t, bool init_fields = true);
+
 	~RecordVal() override;
 
 	IntrusivePtr<Val> SizeVal() const override;
 
+	/**
+	 * Assign a value to a record field.
+	 * @param field  The field index to assign.
+	 * @param new_val  The value to assign.
+	 */
 	void Assign(int field, IntrusivePtr<Val> new_val);
+
+	/**
+	 * Assign a value of type @c T to a record field, as constructed from
+	 * the provided arguments.
+	 * @param field  The field index to assign.
+	 * @param args  A variable number of arguments to pass to constructor of
+	 * type @c T.
+	 */
+	template <class T, class... Ts>
+	void Assign(int field, Ts&&... args)
+		{ Assign(field, make_intrusive<T>(std::forward<Ts>(args)...)); }
+
+	[[deprecated("Remove in v4.1.  Assign an IntrusivePtr instead.")]]
 	void Assign(int field, Val* new_val);
-	Val* Lookup(int field) const;	// Does not Ref() value.
-	IntrusivePtr<Val> LookupWithDefault(int field) const;
+	// Note: the following nullptr method can also go upon removing the above.
+	void Assign(int field, std::nullptr_t)
+		{ Assign(field, IntrusivePtr<Val>{}); }
+
+	[[deprecated("Remove in v4.1.  Use GetField().")]]
+	Val* Lookup(int field) const	// Does not Ref() value.
+		{ return (*AsRecord())[field].get(); }
+
+	/**
+	 * Returns the value of a given field index.
+	 * @param field  The field index to retrieve.
+	 * @return  The value at the given field index.
+	 */
+	const IntrusivePtr<Val>& GetField(int field) const
+		{ return (*AsRecord())[field]; }
+
+	/**
+	 * Returns the value of a given field index as cast to type @c T.
+	 * @param field  The field index to retrieve.
+	 * @return  The value at the given field index cast to type @c T.
+	 */
+	template <class T>
+	IntrusivePtr<T> GetField(int field) const
+		{ return cast_intrusive<T>(GetField(field)); }
+
+	/**
+	 * Returns the value of a given field index if it's previously been
+	 * assigned, * or else returns the value created from evaluating the
+	 * record field's &default expression.
+	 * @param field  The field index to retrieve.
+	 * @return  The value at the given field index or the default value if
+	 * the field hasn't been assigned yet.
+	 */
+	IntrusivePtr<Val> GetFieldOrDefault(int field) const;
+
+	[[deprecated("Remove in v4.1.  Use GetFieldOrDefault().")]]
+	Val* LookupWithDefault(int field) const
+		{ return GetFieldOrDefault(field).release(); }
+
+	/**
+	 * Returns the value of a given field name.
+	 * @param field  The name of a field to retrieve.
+	 * @return  The value of the given field.  If no such field name exists,
+	 * a fatal error occurs.
+	 */
+	const IntrusivePtr<Val>& GetField(const char* field) const;
+
+	/**
+	 * Returns the value of a given field name as cast to type @c T.
+	 * @param field  The name of a field to retrieve.
+	 * @return  The value of the given field cast to type @c T.  If no such
+	 * field name exists, a fatal error occurs.
+	 */
+	template <class T>
+	IntrusivePtr<T> GetField(const char* field) const
+		{ return cast_intrusive<T>(GetField(field)); }
+
+	/**
+	 * Returns the value of a given field name if it's previously been
+	 * assigned, or else returns the value created from evaluating the record
+	 * fields' &default expression.
+	 * @param field  The name of a field to retrieve.
+	 * @return  The value of the given field.  or the default value
+	 * if the field hasn't been assigned yet.  If no such field name exists,
+	 * a fatal error occurs.
+	 */
+	IntrusivePtr<Val> GetFieldOrDefault(const char* field) const;
+
+	/**
+	 * Returns the value of a given field name or its default value
+	 * as cast to type @c T.
+	 * @param field  The name of a field to retrieve.
+	 * @return  The value of the given field or its default value cast to
+	 * type @c T.  If no such field name exists, a fatal error occurs.
+	 */
+	template <class T>
+	IntrusivePtr<T> GetFieldOrDefault(const char* field) const
+		{ return cast_intrusive<T>(GetField(field)); }
 
 	/**
 	 * Looks up the value of a field by field name.  If the field doesn't
@@ -919,7 +1167,9 @@ public:
 	 * the field has yet to be initialized.
 	 * @return the value in field \a field.
 	 */
-	IntrusivePtr<Val> Lookup(const char* field, bool with_default = false) const;
+	[[deprecated("Remove in v4.1.  Use GetField() or GetFieldOrDefault().")]]
+	Val* Lookup(const char* field, bool with_default = false) const
+		{ return with_default ? GetFieldOrDefault(field).release() : GetField(field).get(); }
 
 	void Describe(ODesc* d) const override;
 
@@ -944,8 +1194,11 @@ public:
 	//
 	// The *allow_orphaning* parameter allows for a record to be demoted
 	// down to a record type that contains less fields.
-	IntrusivePtr<RecordVal> CoerceTo(const RecordType* other, Val* aggr, bool allow_orphaning = false) const;
-	IntrusivePtr<RecordVal> CoerceTo(RecordType* other, bool allow_orphaning = false);
+	IntrusivePtr<RecordVal> CoerceTo(IntrusivePtr<RecordType> other,
+	                                 IntrusivePtr<RecordVal> aggr,
+	                                 bool allow_orphaning = false) const;
+	IntrusivePtr<RecordVal> CoerceTo(IntrusivePtr<RecordType> other,
+	                                 bool allow_orphaning = false);
 
 	unsigned int MemoryAllocation() const override;
 	void DescribeReST(ODesc* d) const override;
@@ -976,9 +1229,11 @@ protected:
 	friend class Val;
 	friend class EnumType;
 
-	EnumVal(EnumType* t, int i) : Val(bro_int_t(i), t)
-		{
-		}
+	template<class T, class... Ts>
+	friend IntrusivePtr<T> make_intrusive(Ts&&... args);
+
+	EnumVal(IntrusivePtr<EnumType> t, int i) : Val(bro_int_t(i), std::move(t))
+		{}
 
 	void ValDescribe(ODesc* d) const override;
 	IntrusivePtr<Val> DoClone(CloneState* state) override;
@@ -987,43 +1242,73 @@ protected:
 
 class VectorVal final : public Val, public notifier::Modifiable {
 public:
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit VectorVal(VectorType* t);
+	explicit VectorVal(IntrusivePtr<VectorType> t);
 	~VectorVal() override;
 
 	IntrusivePtr<Val> SizeVal() const override;
 
-	// Returns false if the type of the argument was wrong.
-	// The vector will automatically grow to accomodate the index.
-	//
+	/**
+	 * Assigns an element to a given vector index.
+	 * @param index  The index to assign.
+	 * @param element  The element value to assign.
+	 * @return  True if the element was successfully assigned, or false if
+	 * the element was the wrong type.
+	 */
+	bool Assign(unsigned int index, IntrusivePtr<Val> element);
+
 	// Note: does NOT Ref() the element! Remember to do so unless
 	//       the element was just created and thus has refcount 1.
-	//
-	bool Assign(unsigned int index, IntrusivePtr<Val> element);
-	bool Assign(unsigned int index, Val* element);
+	[[deprecated("Remove in v4.1.  Assign an IntrusivePtr instead.")]]
+	bool Assign(unsigned int index, Val* element)
+		{ return Assign(index, {AdoptRef{}, element}); }
+	// Note: the following nullptr method can also go upon removing the above.
+	void Assign(unsigned int index, std::nullptr_t)
+		{ Assign(index, IntrusivePtr<Val>{}); }
 
-	template<typename E>
-	bool Assign(Val* index, E&& element)
+	[[deprecated("Remove in v4.1.  Assign using integer index and IntrusivePtr element.")]]
+	bool Assign(Val* index, Val* element)
 		{
-		return Assign(index->AsListVal()->Index(0)->CoerceToUnsigned(),
-		              std::forward<E>(element));
+		return Assign(index->AsListVal()->Idx(0)->CoerceToUnsigned(),
+		              {AdoptRef{}, element});
 		}
 
-	// Assigns the value to how_many locations starting at index.
+	/**
+	 * Assigns a given value to multiple indices in the vector.
+	 * @param index  The starting index to assign to.
+	 * @param how_many  The number of indices to assign, counting from *index*.
+	 * @return  True if the elements were successfully assigned, or false if
+	 * the element was the wrong type.
+	 */
 	bool AssignRepeat(unsigned int index, unsigned int how_many,
-			  Val* element);
+	                  IntrusivePtr<Val> element);
+
+	[[deprecated("Remove in v4.1.  Assign an IntrusivePtr instead.")]]
+	bool AssignRepeat(unsigned int index, unsigned int how_many, Val* element)
+		{ return AssignRepeat(index, how_many, {NewRef{}, element}); }
 
 	// Add this value to the given value (if appropriate).
 	// Returns true if succcessful.
 	bool AddTo(Val* v, bool is_first_init) const override;
 
-	// Returns nil if no element was at that value.
-	// Lookup does NOT grow the vector to this size.
-	// The Val* variant assumes that the index Val* has been type-checked.
-	Val* Lookup(unsigned int index) const;
+	/**
+	 * Returns the element at a given index or nullptr if it does not exist.
+	 * @param index  The position in the vector of the element to return.
+	 * @return  The element at the given index or nullptr if the index
+	 * does not exist (it's greater than or equal to vector's current size).
+	 */
+	const IntrusivePtr<Val>& At(unsigned int index) const;
+
+	[[deprecated("Remove in v4.1.  Use At().")]]
+	Val* Lookup(unsigned int index) const
+		{ return At(index).get(); }
+
+	[[deprecated("Remove in v4.1.  Use At().")]]
 	Val* Lookup(Val* index)
 		{
-		bro_uint_t i = index->AsListVal()->Index(0)->CoerceToUnsigned();
-		return Lookup(static_cast<unsigned int>(i));
+		bro_uint_t i = index->AsListVal()->Idx(0)->CoerceToUnsigned();
+		return At(static_cast<unsigned int>(i)).get();
 		}
 
 	unsigned int Size() const { return val.vector_val->size(); }
@@ -1037,8 +1322,19 @@ public:
 
 	notifier::Modifiable* Modifiable() override	{ return this; }
 
-	// Insert an element at a specific position into the underlying vector.
-	bool Insert(unsigned int index, Val* element);
+	/**
+	 * Inserts an element at the given position in the vector.  All elements
+	 * at that original position and higher are shifted up by one.
+	 * @param index  The index to insert the element at.
+	 * @param element  The value to insert into the vector.
+	 * @return  True if the element was inserted or false if the element was
+	 * the wrong type.
+	 */
+	bool Insert(unsigned int index, IntrusivePtr<Val> element);
+
+	[[deprecated("Remove in v4.1.  Insert an IntrusivePtr instead.")]]
+	bool Insert(unsigned int index, Val* element)
+		{ return Insert(index, {AdoptRef{}, element}); }
 
 	// Removes an element at a specific position.
 	bool Remove(unsigned int index);
@@ -1046,15 +1342,12 @@ public:
 protected:
 	void ValDescribe(ODesc* d) const override;
 	IntrusivePtr<Val> DoClone(CloneState* state) override;
-
-	VectorType* vector_type;
 };
 
 // Checks the given value for consistency with the given type.  If an
-// exact match, returns it.  If promotable, returns the promoted version,
-// Unref()'ing the original.  If not a match, generates an error message
-// and returns nil, also Unref()'ing v.  If is_init is true, then
-// the checking is done in the context of an initialization.
+// exact match, returns it.  If promotable, returns the promoted version.
+// If not a match, generates an error message and return nil.  If is_init is
+// true, then the checking is done in the context of an initialization.
 extern IntrusivePtr<Val> check_and_promote(IntrusivePtr<Val> v,
                                            const BroType* t, bool is_init,
                                            const Location* expr_location = nullptr);
@@ -1068,7 +1361,8 @@ extern void describe_vals(const std::vector<IntrusivePtr<Val>>& vals,
 extern void delete_vals(val_list* vals);
 
 // True if the given Val* has a vector type.
-inline bool is_vector(Val* v)	{ return  v->Type()->Tag() == TYPE_VECTOR; }
+inline bool is_vector(Val* v)	{ return  v->GetType()->Tag() == TYPE_VECTOR; }
+inline bool is_vector(const IntrusivePtr<Val>& v)	{ return is_vector(v.get()); }
 
 // Returns v casted to type T if the type supports that. Returns null if not.
 //
diff --git a/src/Var.cc b/src/Var.cc
index b170c20ddc..af1665d92a 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -15,6 +15,7 @@
 #include "EventRegistry.h"
 #include "Traverse.h"
 #include "module_util.h"
+#include "ID.h"
 
 static IntrusivePtr<Val> init_val(Expr* init, const BroType* t,
                                   IntrusivePtr<Val> aggr)
@@ -29,19 +30,20 @@ static IntrusivePtr<Val> init_val(Expr* init, const BroType* t,
 		}
 	}
 
-static bool add_prototype(ID* id, BroType* t, attr_list* attrs,
+static bool add_prototype(const IntrusivePtr<ID>& id, BroType* t,
+                          std::vector<IntrusivePtr<Attr>>* attrs,
                           const IntrusivePtr<Expr>& init)
 	{
-	if ( ! IsFunc(id->Type()->Tag()) )
+	if ( ! IsFunc(id->GetType()->Tag()) )
 		return false;
 
 	if ( ! IsFunc(t->Tag()) )
 		{
-		t->Error("type incompatible with previous definition", id);
+		t->Error("type incompatible with previous definition", id.get());
 		return false;
 		}
 
-	auto canon_ft = id->Type()->AsFuncType();
+	auto canon_ft = id->GetType()->AsFuncType();
 	auto alt_ft = t->AsFuncType();
 
 	if ( canon_ft->Flavor() != alt_ft->Flavor() )
@@ -62,8 +64,8 @@ static bool add_prototype(ID* id, BroType* t, attr_list* attrs,
 		return false;
 		}
 
-	auto canon_args = canon_ft->Args();
-	auto alt_args = alt_ft->Args();
+	const auto& canon_args = canon_ft->Params();
+	const auto& alt_args = alt_ft->Params();
 
 	if ( auto p = canon_ft->FindPrototype(*alt_args); p )
 		{
@@ -101,18 +103,20 @@ static bool add_prototype(ID* id, BroType* t, attr_list* attrs,
 			if ( a->Tag() == ATTR_DEPRECATED )
 				deprecated = true;
 
-	FuncType::Prototype p{deprecated, {NewRef{}, alt_args}, std::move(offsets)};
+	FuncType::Prototype p{deprecated, alt_args, std::move(offsets)};
 	canon_ft->AddPrototype(std::move(p));
 	return true;
 	}
 
-static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
-                     IntrusivePtr<Expr> init, attr_list* attr, decl_type dt,
+static void make_var(const IntrusivePtr<ID>& id, IntrusivePtr<BroType> t, init_class c,
+                     IntrusivePtr<Expr> init,
+                     std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr,
+                     decl_type dt,
                      bool do_init)
 	{
-	if ( id->Type() )
+	if ( id->GetType() )
 		{
-		if ( id->IsRedefinable() || (! init && attr && ! IsFunc(id->Type()->Tag())) )
+		if ( id->IsRedefinable() || (! init && attr && ! IsFunc(id->GetType()->Tag())) )
 			{
 			BroObj* redef_obj = init ? (BroObj*) init.get() : (BroObj*) t.get();
 			if ( dt != VAR_REDEF )
@@ -121,8 +125,8 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 
 		else if ( dt != VAR_REDEF || init || ! attr )
 			{
-			if ( IsFunc(id->Type()->Tag()) )
-				add_prototype(id, t.get(), attr, init);
+			if ( IsFunc(id->GetType()->Tag()) )
+				add_prototype(id, t.get(), attr.get(), init);
 			else
 				id->Error("already defined", init.get());
 
@@ -132,17 +136,17 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 
 	if ( dt == VAR_REDEF )
 		{
-		if ( ! id->Type() )
+		if ( ! id->GetType() )
 			{
 			id->Error("\"redef\" used but not previously defined");
 			return;
 			}
 
 		if ( ! t )
-			t = {NewRef{}, id->Type()};
+			t = id->GetType();
 		}
 
-	if ( id->Type() && id->Type()->Tag() != TYPE_ERROR )
+	if ( id->GetType() && id->GetType()->Tag() != TYPE_ERROR )
 		{
 		if ( dt != VAR_REDEF &&
 		     (! init || ! do_init || (! t && ! (t = init_type(init.get())))) )
@@ -152,7 +156,7 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 			}
 
 		// Allow redeclaration in order to initialize.
-		if ( ! same_type(t.get(), id->Type()) )
+		if ( ! same_type(t, id->GetType()) )
 			{
 			id->Error("redefinition changes type", init.get());
 			return;
@@ -162,7 +166,7 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 	if ( t && t->IsSet() )
 		{ // Check for set with explicit elements.
 		SetType* st = t->AsTableType()->AsSetType();
-		ListExpr* elements = st->SetElements();
+		const auto& elements = st->Elements();
 
 		if ( elements )
 			{
@@ -172,7 +176,7 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 				return;
 				}
 
-			init = {NewRef{}, elements};
+			init = elements;
 			}
 		}
 
@@ -195,7 +199,7 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 	id->SetType(t);
 
 	if ( attr )
-		id->AddAttrs(make_intrusive<Attributes>(attr, t, false, id->IsGlobal()));
+		id->AddAttrs(make_intrusive<Attributes>(std::move(*attr), t, false, id->IsGlobal()));
 
 	if ( init )
 		{
@@ -203,16 +207,16 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 		case EXPR_TABLE_CONSTRUCTOR:
 			{
 			TableConstructorExpr* ctor = (TableConstructorExpr*) init.get();
-			if ( ctor->Attrs() )
-				id->AddAttrs({NewRef{}, ctor->Attrs()});
+			if ( ctor->GetAttrs() )
+				id->AddAttrs(ctor->GetAttrs());
 			}
 			break;
 
 		case EXPR_SET_CONSTRUCTOR:
 			{
 			SetConstructorExpr* ctor = (SetConstructorExpr*) init.get();
-			if ( ctor->Attrs() )
-				id->AddAttrs({NewRef{}, ctor->Attrs()});
+			if ( ctor->GetAttrs() )
+				id->AddAttrs(ctor->GetAttrs());
 			}
 			break;
 
@@ -229,8 +233,8 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 			// intention clearly isn't to overwrite entire existing table val.
 			c = INIT_EXTRA;
 
-		if ( init && ((c == INIT_EXTRA && id->FindAttr(ATTR_ADD_FUNC)) ||
-		              (c == INIT_REMOVE && id->FindAttr(ATTR_DEL_FUNC)) ))
+		if ( init && ((c == INIT_EXTRA && id->GetAttr(ATTR_ADD_FUNC)) ||
+		              (c == INIT_REMOVE && id->GetAttr(ATTR_DEL_FUNC)) ))
 			// Just apply the function.
 			id->SetVal(init, c);
 
@@ -240,7 +244,7 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 
 			if ( t->Tag() == TYPE_RECORD )
 				{
-				aggr = make_intrusive<RecordVal>(t->AsRecordType());
+				aggr = make_intrusive<RecordVal>(cast_intrusive<RecordType>(t));
 
 				if ( init && t )
 					// Have an initialization and type is not deduced.
@@ -249,11 +253,11 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 				}
 
 			else if ( t->Tag() == TYPE_TABLE )
-				aggr = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, t->AsTableType()},
-				                                IntrusivePtr{NewRef{}, id->Attrs()});
+				aggr = make_intrusive<TableVal>(cast_intrusive<TableType>(t),
+				                                id->GetAttrs());
 
 			else if ( t->Tag() == TYPE_VECTOR )
-				aggr = make_intrusive<VectorVal>(t->AsVectorType());
+				aggr = make_intrusive<VectorVal>(cast_intrusive<VectorType>(t));
 
 			IntrusivePtr<Val> v;
 
@@ -297,23 +301,27 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 		// For events, add a function value (without any body) here so that
 		// we can later access the ID even if no implementations have been
 		// defined.
-		Func* f = new BroFunc(id, nullptr, nullptr, 0, 0);
-		id->SetVal(make_intrusive<Val>(f));
+		std::vector<IntrusivePtr<ID>> inits;
+		auto f = make_intrusive<BroFunc>(id, nullptr, inits, 0, 0);
+		id->SetVal(make_intrusive<Val>(std::move(f)));
 		}
 	}
 
 
-void add_global(ID* id, IntrusivePtr<BroType> t, init_class c,
-                IntrusivePtr<Expr> init, attr_list* attr, decl_type dt)
+void add_global(const IntrusivePtr<ID>& id, IntrusivePtr<BroType> t,
+                init_class c, IntrusivePtr<Expr> init,
+                std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr,
+                decl_type dt)
 	{
-	make_var(id, std::move(t), c, std::move(init), attr, dt, true);
+	make_var(id, std::move(t), c, std::move(init), std::move(attr), dt, true);
 	}
 
 IntrusivePtr<Stmt> add_local(IntrusivePtr<ID> id, IntrusivePtr<BroType> t,
                              init_class c, IntrusivePtr<Expr> init,
-                             attr_list* attr, decl_type dt)
+                             std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr,
+                             decl_type dt)
 	{
-	make_var(id.get(), std::move(t), c, init, attr, dt, false);
+	make_var(id, std::move(t), c, init, std::move(attr), dt, false);
 
 	if ( init )
 		{
@@ -325,10 +333,9 @@ IntrusivePtr<Stmt> add_local(IntrusivePtr<ID> id, IntrusivePtr<BroType> t,
 		        *init->GetLocationInfo() : no_location;
 
 		auto name_expr = make_intrusive<NameExpr>(id, dt == VAR_CONST);
-		auto attrs = id->Attrs() ? id->Attrs()->Attrs() : nullptr;
 		auto assign_expr = make_intrusive<AssignExpr>(std::move(name_expr),
 		                                              std::move(init), 0,
-		                                              nullptr, attrs);
+		                                              nullptr, id->GetAttrs());
 		auto stmt = make_intrusive<ExprStmt>(std::move(assign_expr));
 		stmt->SetLocationInfo(&location);
 		return stmt;
@@ -345,13 +352,14 @@ extern IntrusivePtr<Expr> add_and_assign_local(IntrusivePtr<ID> id,
                                                IntrusivePtr<Expr> init,
                                                IntrusivePtr<Val> val)
 	{
-	make_var(id.get(), nullptr, INIT_FULL, init, nullptr, VAR_REGULAR, false);
+	make_var(id, nullptr, INIT_FULL, init, nullptr, VAR_REGULAR, false);
 	auto name_expr = make_intrusive<NameExpr>(std::move(id));
 	return make_intrusive<AssignExpr>(std::move(name_expr), std::move(init),
 	                                  false, std::move(val));
 	}
 
-void add_type(ID* id, IntrusivePtr<BroType> t, attr_list* attr)
+void add_type(ID* id, IntrusivePtr<BroType> t,
+              std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr)
 	{
 	std::string new_type_name = id->Name();
 	std::string old_type_name = t->GetName();
@@ -363,7 +371,7 @@ void add_type(ID* id, IntrusivePtr<BroType> t, attr_list* attr)
 		tnew = std::move(t);
 	else
 		// Clone the type to preserve type name aliasing.
-		tnew = {AdoptRef{}, t->ShallowClone()};
+		tnew = t->ShallowClone();
 
 	BroType::AddAlias(new_type_name, tnew.get());
 
@@ -376,7 +384,7 @@ void add_type(ID* id, IntrusivePtr<BroType> t, attr_list* attr)
 	id->MakeType();
 
 	if ( attr )
-		id->SetAttrs(make_intrusive<Attributes>(attr, tnew, false, false));
+		id->SetAttrs(make_intrusive<Attributes>(std::move(*attr), tnew, false, false));
 	}
 
 static void transfer_arg_defaults(RecordType* args, RecordType* recv)
@@ -386,39 +394,36 @@ static void transfer_arg_defaults(RecordType* args, RecordType* recv)
 		TypeDecl* args_i = args->FieldDecl(i);
 		TypeDecl* recv_i = recv->FieldDecl(i);
 
-		Attr* def = args_i->attrs ? args_i->attrs->FindAttr(ATTR_DEFAULT) : nullptr;
+		const auto& def = args_i->attrs ? args_i->attrs->Find(ATTR_DEFAULT) : nullptr;
 
 		if ( ! def )
 			continue;
 
 		if ( ! recv_i->attrs )
 			{
-			attr_list* a = new attr_list{def};
-			recv_i->attrs = make_intrusive<Attributes>(a, recv_i->type, true, false);
+			std::vector<IntrusivePtr<Attr>> a{def};
+			recv_i->attrs = make_intrusive<Attributes>(std::move(a),
+			                                           recv_i->type,
+			                                           true, false);
 			}
 
-		else if ( ! recv_i->attrs->FindAttr(ATTR_DEFAULT) )
-			recv_i->attrs->AddAttr({NewRef{}, def});
+		else if ( ! recv_i->attrs->Find(ATTR_DEFAULT) )
+			recv_i->attrs->AddAttr(def);
 		}
 	}
 
-static Attr* find_attr(const attr_list* al, attr_tag tag)
+static Attr* find_attr(const std::vector<IntrusivePtr<Attr>>* al, attr_tag tag)
 	{
 	if ( ! al )
 		return nullptr;
 
-	for ( int i = 0; i < al->length(); ++i )
+	for ( size_t i = 0; i < al->size(); ++i )
 		if ( (*al)[i]->Tag() == tag )
-			return (*al)[i];
+			return (*al)[i].get();
 
 	return nullptr;
 	}
 
-static bool has_attr(const attr_list* al, attr_tag tag)
-	{
-	return find_attr(al, tag) != nullptr;
-	}
-
 static std::optional<FuncType::Prototype> func_type_check(const FuncType* decl, const FuncType* impl)
 	{
 	if ( decl->Flavor() != impl->Flavor() )
@@ -436,30 +441,32 @@ static std::optional<FuncType::Prototype> func_type_check(const FuncType* decl,
 		return {};
 		}
 
-	return decl->FindPrototype(*impl->Args());
+	return decl->FindPrototype(*impl->Params());
 	}
 
 static bool canonical_arg_types_match(const FuncType* decl, const FuncType* impl)
 	{
-	auto canon_args = decl->Args();
-	auto impl_args = impl->Args();
+	const auto& canon_args = decl->Params();
+	const auto& impl_args = impl->Params();
 
 	if ( canon_args->NumFields() != impl_args->NumFields() )
 		return false;
 
 	for ( auto i = 0; i < canon_args->NumFields(); ++i )
-		if ( ! same_type(canon_args->FieldType(i), impl_args->FieldType(i)) )
+		if ( ! same_type(canon_args->GetFieldType(i), impl_args->GetFieldType(i)) )
 			return false;
 
 	return true;
 	}
 
-void begin_func(ID* id, const char* module_name, function_flavor flavor,
-                bool is_redef, IntrusivePtr<FuncType> t, attr_list* attrs)
+void begin_func(IntrusivePtr<ID> id, const char* module_name,
+                function_flavor flavor, bool is_redef,
+                IntrusivePtr<FuncType> t,
+                std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs)
 	{
 	if ( flavor == FUNC_FLAVOR_EVENT )
 		{
-		const BroType* yt = t->YieldType();
+		const auto& yt = t->Yield();
 
 		if ( yt && yt->Tag() != TYPE_VOID )
 			id->Error("event cannot yield a value", t.get());
@@ -469,9 +476,9 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 
 	std::optional<FuncType::Prototype> prototype;
 
-	if ( id->Type() )
+	if ( id->GetType() )
 		{
-		auto decl = id->Type()->AsFuncType();
+		auto decl = id->GetType()->AsFuncType();
 		prototype = func_type_check(decl, t.get());
 
 		if ( prototype )
@@ -482,20 +489,20 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 				// params, automatically transfer any that are missing
 				// (convenience so that implementations don't need to specify
 				// the &default expression again).
-				transfer_arg_defaults(prototype->args.get(), t->Args());
+				transfer_arg_defaults(prototype->args.get(), t->Params().get());
 				}
 			else
 				{
 				// Warn for trying to use &default parameters in hook/event
 				// handler body when it already has a declaration since only
 				// &default in the declaration has any effect.
-				auto args = t->Args();
+				const auto& args = t->Params();
 
 				for ( int i = 0; i < args->NumFields(); ++i )
 					{
 					auto f = args->FieldDecl(i);
 
-					if ( f->attrs && f->attrs->FindAttr(ATTR_DEFAULT) )
+					if ( f->attrs && f->attrs->Find(ATTR_DEFAULT) )
 						{
 						reporter->PushLocation(args->GetLocationInfo());
 						reporter->Warning(
@@ -507,7 +514,7 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 				}
 
 			if ( prototype->deprecated )
-				t->Warn("use of deprecated prototype", id);
+				t->Warn("use of deprecated prototype", id.get());
 			}
 		else
 			{
@@ -516,7 +523,7 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 			if ( canonical_arg_types_match(decl, t.get()) )
 				prototype = decl->Prototypes()[0];
 			else
-				t->Error("use of undeclared alternate prototype", id);
+				t->Error("use of undeclared alternate prototype", id.get());
 			}
 		}
 
@@ -525,7 +532,7 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 
 	if ( id->HasVal() )
 		{
-		function_flavor id_flavor = id->ID_Val()->AsFunc()->Flavor();
+		function_flavor id_flavor = id->GetVal()->AsFunc()->Flavor();
 
 		if ( id_flavor != flavor )
 			id->Error("inconsistent function flavor", t.get());
@@ -552,9 +559,9 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 	else
 		id->SetType(t);
 
-	push_scope({NewRef{}, id}, attrs);
+	push_scope(std::move(id), std::move(attrs));
 
-	RecordType* args = t->Args();
+	const auto& args = t->Params();
 	int num_args = args->NumFields();
 
 	for ( int i = 0; i < num_args; ++i )
@@ -572,8 +579,9 @@ void begin_func(ID* id, const char* module_name, function_flavor flavor,
 			arg_id->SetOffset(prototype->offsets[i]);
 		}
 
-	if ( Attr* depr_attr = find_attr(attrs, ATTR_DEPRECATED) )
-		id->MakeDeprecated({NewRef{}, depr_attr->AttrExpr()});
+	if ( Attr* depr_attr = find_attr(current_scope()->Attrs().get(),
+	                                 ATTR_DEPRECATED) )
+		current_scope()->GetID()->MakeDeprecated(depr_attr->GetExpr());
 	}
 
 class OuterIDBindingFinder : public TraversalCallback {
@@ -608,7 +616,7 @@ TraversalCode OuterIDBindingFinder::PreExpr(const Expr* expr)
 		return TC_CONTINUE;
 
 	for ( const auto& scope : scopes )
-		if ( scope->Lookup(e->Id()->Name()) )
+		if ( scope->Find(e->Id()->Name()) )
 			// Shadowing is not allowed, so if it's found at inner scope, it's
 			// not something we have to worry about also being at outer scope.
 			return TC_CONTINUE;
@@ -630,25 +638,25 @@ void end_func(IntrusivePtr<Stmt> body)
 	auto ingredients = std::make_unique<function_ingredients>(pop_scope(), std::move(body));
 
 	if ( ingredients->id->HasVal() )
-		ingredients->id->ID_Val()->AsFunc()->AddBody(
+		ingredients->id->GetVal()->AsFunc()->AddBody(
 			ingredients->body,
 			ingredients->inits,
 			ingredients->frame_size,
 			ingredients->priority);
 	else
 		{
-		Func* f = new BroFunc(
-			ingredients->id.get(),
+		auto f = make_intrusive<BroFunc>(
+			ingredients->id,
 			ingredients->body,
 			ingredients->inits,
 			ingredients->frame_size,
 			ingredients->priority);
 
-		ingredients->id->SetVal(make_intrusive<Val>(f));
+		ingredients->id->SetVal(make_intrusive<Val>(std::move(f)));
 		ingredients->id->SetConst();
 		}
 
-	ingredients->id->ID_Val()->AsFunc()->SetScope(ingredients->scope);
+	ingredients->id->GetVal()->AsFunc()->SetScope(ingredients->scope);
 	// Note: ideally, something would take ownership of this memory until the
 	// end of script execution, but that's essentially the same as the
 	// lifetime of the process at the moment, so ok to "leak" it.
@@ -657,12 +665,7 @@ void end_func(IntrusivePtr<Stmt> body)
 
 Val* internal_val(const char* name)
 	{
-	auto id = lookup_ID(name, GLOBAL_MODULE_NAME);
-
-	if ( ! id )
-		reporter->InternalError("internal variable %s missing", name);
-
-	return id->ID_Val();
+	return zeek::id::find_val(name).get();
 	}
 
 id_list gather_outer_ids(Scope* scope, Stmt* body)
@@ -687,70 +690,73 @@ id_list gather_outer_ids(Scope* scope, Stmt* body)
 
 Val* internal_const_val(const char* name)
 	{
-	auto id = lookup_ID(name, GLOBAL_MODULE_NAME);
-	if ( ! id )
-		reporter->InternalError("internal variable %s missing", name);
-
-	if ( ! id->IsConst() )
-		reporter->InternalError("internal variable %s is not constant", name);
-
-	return id->ID_Val();
+	return zeek::id::find_const(name).get();
 	}
 
 Val* opt_internal_val(const char* name)
 	{
-	auto id = lookup_ID(name, GLOBAL_MODULE_NAME);
-	return id ? id->ID_Val() : nullptr;
+	const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME);
+	return id ? id->GetVal().get() : nullptr;
 	}
 
 double opt_internal_double(const char* name)
 	{
-	Val* v = opt_internal_val(name);
+	const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME);
+	if ( ! id ) return 0.0;
+	const auto& v = id->GetVal();
 	return v ? v->InternalDouble() : 0.0;
 	}
 
 bro_int_t opt_internal_int(const char* name)
 	{
-	Val* v = opt_internal_val(name);
+	const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME);
+	if ( ! id ) return 0;
+	const auto& v = id->GetVal();
 	return v ? v->InternalInt() : 0;
 	}
 
 bro_uint_t opt_internal_unsigned(const char* name)
 	{
-	Val* v = opt_internal_val(name);
+	const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME);
+	if ( ! id ) return 0;
+	const auto& v = id->GetVal();
 	return v ? v->InternalUnsigned() : 0;
 	}
 
 StringVal* opt_internal_string(const char* name)
 	{
-	Val* v = opt_internal_val(name);
+	const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME);
+	if ( ! id ) return nullptr;
+	const auto& v = id->GetVal();
 	return v ? v->AsStringVal() : nullptr;
 	}
 
 TableVal* opt_internal_table(const char* name)
 	{
-	Val* v = opt_internal_val(name);
+	const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME);
+	if ( ! id ) return nullptr;
+	const auto& v = id->GetVal();
 	return v ? v->AsTableVal() : nullptr;
 	}
 
 ListVal* internal_list_val(const char* name)
 	{
-	auto id = lookup_ID(name, GLOBAL_MODULE_NAME);
+	const auto& id = lookup_ID(name, GLOBAL_MODULE_NAME);
 	if ( ! id )
 		return nullptr;
 
-	Val* v = id->ID_Val();
+	Val* v = id->GetVal().get();
 
 	if ( v )
 		{
-		if ( v->Type()->Tag() == TYPE_LIST )
+		if ( v->GetType()->Tag() == TYPE_LIST )
 			return (ListVal*) v;
 
-		else if ( v->Type()->IsSet() )
+		else if ( v->GetType()->IsSet() )
 			{
 			TableVal* tv = v->AsTableVal();
-			ListVal* lv = tv->ConvertToPureList();
-			return lv;
+			auto lv = tv->ToPureListVal();
+			return lv.release();
 			}
 
 		else
@@ -762,16 +768,13 @@ ListVal* internal_list_val(const char* name)
 
 BroType* internal_type(const char* name)
 	{
-	auto id = lookup_ID(name, GLOBAL_MODULE_NAME);
-	if ( ! id )
-		reporter->InternalError("internal type %s missing", name);
-
-	return id->Type();
+	return zeek::id::find_type(name).get();
 	}
 
 Func* internal_func(const char* name)
 	{
-	Val* v = internal_val(name);
+	const auto& v = zeek::id::find_val(name);
+
 	if ( v )
 		return v->AsFunc();
 	else
@@ -780,19 +783,5 @@ Func* internal_func(const char* name)
 
 EventHandlerPtr internal_handler(const char* name)
 	{
-	// If there already is an entry in the registry, we have a
-	// local handler on the script layer.
-	EventHandler* h = event_registry->Lookup(name);
-	if ( h )
-		{
-		h->SetUsed();
-		return h;
-		}
-
-	h = new EventHandler(name);
-	event_registry->Register(h);
-
-	h->SetUsed();
-
-	return h;
+	return event_registry->Register(name);
 	}
diff --git a/src/Var.h b/src/Var.h
index 92af4cd5e9..935e276f86 100644
--- a/src/Var.h
+++ b/src/Var.h
@@ -17,40 +17,69 @@ class ListVal;
 
 typedef enum { VAR_REGULAR, VAR_CONST, VAR_REDEF, VAR_OPTION, } decl_type;
 
-extern void add_global(ID* id, IntrusivePtr<BroType> t, init_class c,
-                       IntrusivePtr<Expr> init, attr_list* attr, decl_type dt);
+extern void add_global(const IntrusivePtr<ID>& id,
+                       IntrusivePtr<BroType> t,
+                       init_class c,
+                       IntrusivePtr<Expr> init,
+                       std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr,
+                       decl_type dt);
 
 extern IntrusivePtr<Stmt> add_local(IntrusivePtr<ID> id,
-                                    IntrusivePtr<BroType> t, init_class c,
-                                    IntrusivePtr<Expr> init, attr_list* attr,
+                                    IntrusivePtr<BroType> t,
+                                    init_class c,
+                                    IntrusivePtr<Expr> init,
+                                    std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr,
                                     decl_type dt);
 
 extern IntrusivePtr<Expr> add_and_assign_local(IntrusivePtr<ID> id,
                                                IntrusivePtr<Expr> init,
                                                IntrusivePtr<Val> val = nullptr);
 
-extern void add_type(ID* id, IntrusivePtr<BroType> t, attr_list* attr);
+extern void add_type(ID* id, IntrusivePtr<BroType> t,
+                     std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attr);
 
-extern void begin_func(ID* id, const char* module_name, function_flavor flavor,
-                       bool is_redef, IntrusivePtr<FuncType> t,
-                       attr_list* attrs = nullptr);
+extern void begin_func(IntrusivePtr<ID> id, const char* module_name,
+                       function_flavor flavor, bool is_redef,
+                       IntrusivePtr<FuncType> t,
+                       std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs = nullptr);
 
 extern void end_func(IntrusivePtr<Stmt> body);
 
 // Gather all IDs referenced inside a body that aren't part of a given scope.
 extern id_list gather_outer_ids(Scope* scope, Stmt* body);
 
+[[deprecated("Remove in v4.1.  Use zeek::id::find_val().")]]
 extern Val* internal_val(const char* name);
-extern Val* internal_const_val(const char* name); // internal error if not const
-extern Val* opt_internal_val(const char* name);	// returns nil if not defined
-extern double opt_internal_double(const char* name);
-extern bro_int_t opt_internal_int(const char* name);
-extern bro_uint_t opt_internal_unsigned(const char* name);
-extern StringVal* opt_internal_string(const char* name);
-extern TableVal* opt_internal_table(const char* name);	// nil if not defined
-extern ListVal* internal_list_val(const char* name);
-extern BroType* internal_type(const char* name);
-extern Func* internal_func(const char* name);
-extern EventHandlerPtr internal_handler(const char* name);
 
-extern int signal_val;	// 0 if no signal pending
+[[deprecated("Remove in v4.1.  Use zeek::id::find_const().")]]
+extern Val* internal_const_val(const char* name); // internal error if not const
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find() or zeek::id::find_val().")]]
+extern Val* opt_internal_val(const char* name);	// returns nil if not defined
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find() or zeek::id::find_val().")]]
+extern double opt_internal_double(const char* name);
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find() or zeek::id::find_val().")]]
+extern bro_int_t opt_internal_int(const char* name);
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find() or zeek::id::find_val().")]]
+extern bro_uint_t opt_internal_unsigned(const char* name);
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find() or zeek::id::find_val().")]]
+extern StringVal* opt_internal_string(const char* name);
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find() or zeek::id::find_val().")]]
+extern TableVal* opt_internal_table(const char* name);	// nil if not defined
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find(), zeek::id::find_val(), and/or TableVal::ToPureListVal().")]]
+extern ListVal* internal_list_val(const char* name);
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find_type().")]]
+extern BroType* internal_type(const char* name);
+
+[[deprecated("Remove in v4.1.  Use zeek::id::find_func().")]]
+extern Func* internal_func(const char* name);
+
+[[deprecated("Remove in v4.1.  Use event_registry->Register().")]]
+extern EventHandlerPtr internal_handler(const char* name);
diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc
index 85398f19f1..d974a16188 100644
--- a/src/analyzer/Analyzer.cc
+++ b/src/analyzer/Analyzer.cc
@@ -687,13 +687,8 @@ void Analyzer::ProtocolConfirmation(Tag arg_tag)
 	if ( ! protocol_confirmation )
 		return;
 
-	EnumVal* tval = arg_tag ? arg_tag.AsEnumVal() : tag.AsEnumVal();
-
-	mgr.Enqueue(protocol_confirmation,
-		ConnVal(),
-		IntrusivePtr{NewRef{}, tval},
-		val_mgr->Count(id)
-	);
+	const auto& tval = arg_tag ? arg_tag.AsVal() : tag.AsVal();
+	mgr.Enqueue(protocol_confirmation, ConnVal(), tval, val_mgr->Count(id));
 	}
 
 void Analyzer::ProtocolViolation(const char* reason, const char* data, int len)
@@ -701,27 +696,21 @@ void Analyzer::ProtocolViolation(const char* reason, const char* data, int len)
 	if ( ! protocol_violation )
 		return;
 
-	StringVal* r;
+	IntrusivePtr<StringVal> r;
 
 	if ( data && len )
 		{
 		const char *tmp = copy_string(reason);
-		r = new StringVal(fmt("%s [%s%s]", tmp,
+		r = make_intrusive<StringVal>(fmt("%s [%s%s]", tmp,
 					fmt_bytes(data, min(40, len)),
 					len > 40 ? "..." : ""));
 		delete [] tmp;
 		}
 	else
-		r = new StringVal(reason);
+		r = make_intrusive<StringVal>(reason);
 
-	EnumVal* tval = tag.AsEnumVal();
-
-	mgr.Enqueue(protocol_violation,
-		ConnVal(),
-		IntrusivePtr{NewRef{}, tval},
-		val_mgr->Count(id),
-		IntrusivePtr{AdoptRef{}, r}
-	);
+	const auto& tval = tag.AsVal();
+	mgr.Enqueue(protocol_violation, ConnVal(), tval, val_mgr->Count(id), std::move(r));
 	}
 
 void Analyzer::AddTimer(analyzer_timer_func timer, double t,
@@ -923,12 +912,12 @@ void TransportLayerAnalyzer::Done()
 	}
 
 void TransportLayerAnalyzer::SetContentsFile(unsigned int /* direction */,
-						BroFile* /* f */)
+						IntrusivePtr<BroFile> /* f */)
 	{
 	reporter->Error("analyzer type does not support writing to a contents file");
 	}
 
-BroFile* TransportLayerAnalyzer::GetContentsFile(unsigned int /* direction */) const
+IntrusivePtr<BroFile> TransportLayerAnalyzer::GetContentsFile(unsigned int /* direction */) const
 	{
 	reporter->Error("analyzer type does not support writing to a contents file");
 	return nullptr;
diff --git a/src/analyzer/Analyzer.h b/src/analyzer/Analyzer.h
index 859c5400e2..76ef088633 100644
--- a/src/analyzer/Analyzer.h
+++ b/src/analyzer/Analyzer.h
@@ -911,7 +911,7 @@ public:
 	 * @param f The file to record to.
 	 *
 	 */
-	virtual void SetContentsFile(unsigned int direction, BroFile* f);
+	virtual void SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f);
 
 	/**
 	 * Returns an associated contents file, if any.  This must only be
@@ -921,7 +921,7 @@ public:
 	 * @param direction One of the CONTENTS_* constants indicating which
 	 * direction the query is for.
 	 */
-	virtual BroFile* GetContentsFile(unsigned int direction) const;
+	virtual IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const;
 
 	/**
 	 * Associates a PIA with this analyzer. A PIA takes the
diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc
index c9c3546f60..343641d99c 100644
--- a/src/analyzer/Manager.cc
+++ b/src/analyzer/Manager.cc
@@ -90,18 +90,16 @@ void Manager::InitPreScript()
 
 void Manager::InitPostScript()
 	{
-	auto id = global_scope()->Lookup("Tunnel::vxlan_ports");
+	const auto& id = global_scope()->Find("Tunnel::vxlan_ports");
 
-	if ( ! (id && id->ID_Val()) )
+	if ( ! (id && id->GetVal()) )
 		reporter->FatalError("Tunnel::vxlan_ports not defined");
 
-	auto table_val = id->ID_Val()->AsTableVal();
-	auto port_list = table_val->ConvertToPureList();
+	auto table_val = id->GetVal()->AsTableVal();
+	auto port_list = table_val->ToPureListVal();
 
 	for ( auto i = 0; i < port_list->Length(); ++i )
-		vxlan_ports.emplace_back(port_list->Index(i)->AsPortVal()->Port());
-
-	Unref(port_list);
+		vxlan_ports.emplace_back(port_list->Idx(i)->AsPortVal()->Port());
 	}
 
 void Manager::DumpDebug()
@@ -440,13 +438,15 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
 
 		if ( tcp_contents && ! reass )
 			{
+			static auto tcp_content_delivery_ports_orig = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_orig");
+			static auto tcp_content_delivery_ports_resp = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_resp");
 			const auto& dport = val_mgr->Port(ntohs(conn->RespPort()), TRANSPORT_TCP);
 
 			if ( ! reass )
-				reass = (bool)tcp_content_delivery_ports_orig->Lookup(dport.get());
+				reass = (bool)tcp_content_delivery_ports_orig->FindOrDefault(dport);
 
 			if ( ! reass )
-				reass = (bool)tcp_content_delivery_ports_resp->Lookup(dport.get());
+				reass = (bool)tcp_content_delivery_ports_resp->FindOrDefault(dport);
 			}
 
 		if ( reass )
@@ -462,8 +462,10 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
 			uint16_t resp_port = ntohs(conn->RespPort());
 			if ( resp_port == 22 || resp_port == 23 || resp_port == 513 )
 				{
-				AddrVal src(conn->OrigAddr());
-				if ( ! stp_skip_src->Lookup(&src) )
+				static auto stp_skip_src = zeek::id::find_val<TableVal>("stp_skip_src");
+				auto src = make_intrusive<AddrVal>(conn->OrigAddr());
+
+				if ( ! stp_skip_src->FindOrDefault(src) )
 					tcp->AddChildAnalyzer(new stepping_stone::SteppingStone_Analyzer(conn), false);
 				}
 			}
@@ -574,8 +576,9 @@ void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp,
 void Manager::ScheduleAnalyzer(const IPAddr& orig, const IPAddr& resp, PortVal* resp_p,
 			       Val* analyzer, double timeout)
 	{
-	EnumVal* ev = analyzer->AsEnumVal();
-	return ScheduleAnalyzer(orig, resp, resp_p->Port(), resp_p->PortType(), Tag(ev), timeout);
+	IntrusivePtr<EnumVal> ev{NewRef{}, analyzer->AsEnumVal()};
+	return ScheduleAnalyzer(orig, resp, resp_p->Port(), resp_p->PortType(),
+	                        Tag(std::move(ev)), timeout);
 	}
 
 Manager::tag_set Manager::GetScheduled(const Connection* conn)
@@ -626,8 +629,7 @@ bool Manager::ApplyScheduledAnalyzers(Connection* conn, bool init, TransportLaye
 
 		if ( scheduled_analyzer_applied )
 			conn->EnqueueEvent(scheduled_analyzer_applied, nullptr,
-			                   conn->ConnVal(),
-			                   IntrusivePtr{NewRef{}, it->AsEnumVal()});
+			                   conn->ConnVal(), it->AsVal());
 
 		DBG_ANALYZER_ARGS(conn, "activated %s analyzer as scheduled",
 		                  analyzer_mgr->GetComponentName(*it).c_str());
diff --git a/src/analyzer/Tag.cc b/src/analyzer/Tag.cc
index 128449175e..228668e15d 100644
--- a/src/analyzer/Tag.cc
+++ b/src/analyzer/Tag.cc
@@ -6,7 +6,7 @@
 const analyzer::Tag analyzer::Tag::Error;
 
 analyzer::Tag::Tag(type_t type, subtype_t subtype)
-	: ::Tag(analyzer_mgr->GetTagEnumType(), type, subtype)
+	: ::Tag(analyzer_mgr->GetTagType(), type, subtype)
 	{
 	}
 
@@ -16,7 +16,20 @@ analyzer::Tag& analyzer::Tag::operator=(const analyzer::Tag& other)
 	return *this;
 	}
 
+const IntrusivePtr<EnumVal>& analyzer::Tag::AsVal() const
+	{
+	return ::Tag::AsVal(analyzer_mgr->GetTagType());
+	}
+
 EnumVal* analyzer::Tag::AsEnumVal() const
 	{
-	return ::Tag::AsEnumVal(analyzer_mgr->GetTagEnumType());
+	return AsVal().get();
 	}
+
+analyzer::Tag::Tag(IntrusivePtr<EnumVal> val)
+	: ::Tag(std::move(val))
+	{ }
+
+analyzer::Tag::Tag(EnumVal* val)
+	: ::Tag({NewRef{}, val})
+	{ }
diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h
index 46545e4bd1..39cdc3ed45 100644
--- a/src/analyzer/Tag.h
+++ b/src/analyzer/Tag.h
@@ -83,6 +83,9 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
+	const IntrusivePtr<EnumVal>& AsVal() const;
+
+	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
 
 	static const Tag Error;
@@ -109,7 +112,10 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Analyzer::Tag.
 	 */
-	explicit Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(IntrusivePtr<EnumVal> val);
+
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead")]]
+	explicit Tag(EnumVal* val);
 };
 
 }
diff --git a/src/analyzer/analyzer.bif b/src/analyzer/analyzer.bif
index efb52e785f..849b75d693 100644
--- a/src/analyzer/analyzer.bif
+++ b/src/analyzer/analyzer.bif
@@ -41,11 +41,12 @@ function Analyzer::__schedule_analyzer%(orig: addr, resp: addr, resp_p: port,
 
 function __name%(atype: Analyzer::Tag%) : string
 	%{
-	return make_intrusive<StringVal>(analyzer_mgr->GetComponentName(atype));
+	const auto& n = analyzer_mgr->GetComponentName(IntrusivePtr{NewRef{}, atype->AsEnumVal()});
+	return make_intrusive<StringVal>(n);
 	%}
 
 function __tag%(name: string%) : Analyzer::Tag
 	%{
 	analyzer::Tag t = analyzer_mgr->GetComponentTag(name->CheckString());
-	return IntrusivePtr{NewRef{}, t.AsEnumVal()};
+	return t.AsVal();
 	%}
diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc
index 25a48e45a8..4d8b83b8b8 100644
--- a/src/analyzer/protocol/arp/ARP.cc
+++ b/src/analyzer/protocol/arp/ARP.cc
@@ -192,10 +192,10 @@ void ARP_Analyzer::BadARP(const struct arp_pkthdr* hdr, const char* msg)
 		return;
 
 	mgr.Enqueue(bad_arp,
-		IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_spa(hdr))},
-		IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_sha(hdr))},
-		IntrusivePtr{AdoptRef{}, ConstructAddrVal(ar_tpa(hdr))},
-		IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) ar_tha(hdr))},
+		ToAddrVal(ar_spa(hdr)),
+		ToEthAddrStr((const u_char*) ar_sha(hdr)),
+		ToAddrVal(ar_tpa(hdr)),
+		ToEthAddrStr((const u_char*) ar_tha(hdr)),
 		make_intrusive<StringVal>(msg)
 	);
 	}
@@ -214,25 +214,31 @@ void ARP_Analyzer::RREvent(EventHandlerPtr e,
 		return;
 
 	mgr.Enqueue(e,
-		IntrusivePtr{AdoptRef{}, EthAddrToStr(src)},
-		IntrusivePtr{AdoptRef{}, EthAddrToStr(dst)},
-		IntrusivePtr{AdoptRef{}, ConstructAddrVal(spa)},
-		IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) sha)},
-		IntrusivePtr{AdoptRef{}, ConstructAddrVal(tpa)},
-		IntrusivePtr{AdoptRef{}, EthAddrToStr((const u_char*) tha)}
+		ToEthAddrStr(src),
+		ToEthAddrStr(dst),
+		ToAddrVal(spa),
+		ToEthAddrStr((const u_char*) sha),
+		ToAddrVal(tpa),
+		ToEthAddrStr((const u_char*) tha)
 	);
 	}
 
 AddrVal* ARP_Analyzer::ConstructAddrVal(const void* addr)
+	{ return ToAddrVal(addr).release(); }
+
+IntrusivePtr<AddrVal> ARP_Analyzer::ToAddrVal(const void* addr)
 	{
 	// ### For now, we only handle IPv4 addresses.
-	return new AddrVal(*(const uint32_t*) addr);
+	return make_intrusive<AddrVal>(*(const uint32_t*) addr);
 	}
 
 StringVal* ARP_Analyzer::EthAddrToStr(const u_char* addr)
+	{ return ToEthAddrStr(addr).release(); }
+
+IntrusivePtr<StringVal> ARP_Analyzer::ToEthAddrStr(const u_char* addr)
 	{
 	char buf[1024];
 	snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
 			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
-	return new StringVal(buf);
+	return make_intrusive<StringVal>(buf);
 	}
diff --git a/src/analyzer/protocol/arp/ARP.h b/src/analyzer/protocol/arp/ARP.h
index 9037a42b27..d1de7de01f 100644
--- a/src/analyzer/protocol/arp/ARP.h
+++ b/src/analyzer/protocol/arp/ARP.h
@@ -45,10 +45,16 @@ public:
 			const char* tpa, const char* tha);
 
 protected:
+
+	[[deprecated("Remove in v4.1.  Use ToAddrVal().")]]
 	AddrVal* ConstructAddrVal(const void* addr);
+	[[deprecated("Remove in v4.1.  Use ToEthAddrStr().")]]
 	StringVal* EthAddrToStr(const u_char* addr);
+
+	IntrusivePtr<AddrVal> ToAddrVal(const void* addr);
+	IntrusivePtr<StringVal> ToEthAddrStr(const u_char* addr);
 	void BadARP(const struct arp_pkthdr* hdr, const char* string);
 	void Corrupted(const char* string);
 };
 
-} } // namespace analyzer::* 
+} } // namespace analyzer::*
diff --git a/src/analyzer/protocol/asn1/asn1.pac b/src/analyzer/protocol/asn1/asn1.pac
index a1fc14e1a3..61ef62630d 100644
--- a/src/analyzer/protocol/asn1/asn1.pac
+++ b/src/analyzer/protocol/asn1/asn1.pac
@@ -3,12 +3,12 @@
 %}
 
 %header{
-	Val* asn1_integer_to_val(const ASN1Encoding* i, TypeTag t);
-	Val* asn1_integer_to_val(const ASN1Integer* i, TypeTag t);
-	StringVal* asn1_oid_to_val(const ASN1Encoding* oid);
-	StringVal* asn1_oid_to_val(const ASN1ObjectIdentifier* oid);
-	StringVal* asn1_octet_string_to_val(const ASN1Encoding* s);
-	StringVal* asn1_octet_string_to_val(const ASN1OctetString* s);
+	IntrusivePtr<Val> asn1_integer_to_val(const ASN1Encoding* i, TypeTag t);
+	IntrusivePtr<Val> asn1_integer_to_val(const ASN1Integer* i, TypeTag t);
+	IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1Encoding* oid);
+	IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1ObjectIdentifier* oid);
+	IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1Encoding* s);
+	IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1OctetString* s);
 %}
 
 ############################## ASN.1 Encodings
@@ -102,35 +102,35 @@ function binary_to_int64(bs: bytestring): int64
 
 %code{
 
-Val* asn1_integer_to_val(const ASN1Integer* i, TypeTag t)
+IntrusivePtr<Val> asn1_integer_to_val(const ASN1Integer* i, TypeTag t)
 	{
 	return asn1_integer_to_val(i->encoding(), t);
 	}
 
-Val* asn1_integer_to_val(const ASN1Encoding* i, TypeTag t)
+IntrusivePtr<Val> asn1_integer_to_val(const ASN1Encoding* i, TypeTag t)
 	{
 	auto v = binary_to_int64(i->content());
 
 	switch ( t ) {
 	case TYPE_BOOL:
-		return val_mgr->Bool(v)->Ref();
+		return val_mgr->Bool(v);
 	case TYPE_INT:
-		return val_mgr->Int(v).release();
+		return val_mgr->Int(v);
 	case TYPE_COUNT:
 	case TYPE_COUNTER:
-		return val_mgr->Count(v).release();
+		return val_mgr->Count(v);
 	default:
 		reporter->Error("bad asn1_integer_to_val tag: %s", type_name(t));
-		return val_mgr->Count(v).release();
+		return val_mgr->Count(v);
 	}
 	}
 
-StringVal* asn1_oid_to_val(const ASN1ObjectIdentifier* oid)
+IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1ObjectIdentifier* oid)
 	{
 	return asn1_oid_to_val(oid->encoding());
 	}
 
-StringVal* asn1_oid_to_val(const ASN1Encoding* oid)
+IntrusivePtr<StringVal> asn1_oid_to_val(const ASN1Encoding* oid)
 	{
 	vector<uint64> oid_components;
 	vector<vector<uint8> > subidentifiers;
@@ -152,7 +152,7 @@ StringVal* asn1_oid_to_val(const ASN1Encoding* oid)
 
 	if ( ! subidentifier.empty() || subidentifiers.size() < 1 )
 		// Underflow.
-		return val_mgr->EmptyString()->Ref()->AsStringVal();
+		return val_mgr->EmptyString();
 
 	for ( size_t i = 0; i < subidentifiers.size(); ++i )
 		{
@@ -191,17 +191,17 @@ StringVal* asn1_oid_to_val(const ASN1Encoding* oid)
 			}
 		}
 
-	return new StringVal(rval);
+	return make_intrusive<StringVal>(rval);
 	}
 
-StringVal* asn1_octet_string_to_val(const ASN1OctetString* s)
+IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1OctetString* s)
 	{
 	return asn1_octet_string_to_val(s->encoding());
 	}
 
-StringVal* asn1_octet_string_to_val(const ASN1Encoding* s)
+IntrusivePtr<StringVal> asn1_octet_string_to_val(const ASN1Encoding* s)
 	{
 	bytestring const& bs = s->content();
-	return new StringVal(bs.length(), reinterpret_cast<const char*>(bs.data()));
+	return make_intrusive<StringVal>(bs.length(), reinterpret_cast<const char*>(bs.data()));
 	}
 %}
diff --git a/src/analyzer/protocol/ayiya/ayiya-analyzer.pac b/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
index 935e05d749..30a263d2bc 100644
--- a/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
+++ b/src/analyzer/protocol/ayiya/ayiya-analyzer.pac
@@ -18,7 +18,7 @@ flow AYIYA_Flow
 		Connection *c = connection()->bro_analyzer()->Conn();
 		const EncapsulationStack* e = c->GetEncapsulation();
 
-		if ( e && e->Depth() >= BifConst::Tunnel::max_depth )
+		if ( e && e->Depth() >= zeek::BifConst::Tunnel::max_depth )
 			{
 			reporter->Weird(c, "tunnel_depth");
 			return false;
diff --git a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
index eac30667fa..4172929eab 100644
--- a/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
+++ b/src/analyzer/protocol/bittorrent/BitTorrentTracker.cc
@@ -15,11 +15,11 @@
 
 using namespace analyzer::bittorrent;
 
-static TableType* bt_tracker_headers = nullptr;
-static RecordType* bittorrent_peer;
-static TableType* bittorrent_peer_set;
-static RecordType* bittorrent_benc_value;
-static TableType* bittorrent_benc_dir;
+static IntrusivePtr<TableType> bt_tracker_headers;
+static IntrusivePtr<RecordType> bittorrent_peer;
+static IntrusivePtr<TableType> bittorrent_peer_set;
+static IntrusivePtr<RecordType> bittorrent_benc_value;
+static IntrusivePtr<TableType> bittorrent_benc_dir;
 
 BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
 : tcp::TCP_ApplicationAnalyzer("BITTORRENTTRACKER", c)
@@ -27,15 +27,15 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
 	if ( ! bt_tracker_headers )
 		{
 		bt_tracker_headers =
-			internal_type("bt_tracker_headers")->AsTableType();
+			zeek::id::find_type<TableType>("bt_tracker_headers");
 		bittorrent_peer =
-			internal_type("bittorrent_peer")->AsRecordType();
+			zeek::id::find_type<RecordType>("bittorrent_peer");
 		bittorrent_peer_set =
-			internal_type("bittorrent_peer_set")->AsTableType();
+			zeek::id::find_type<TableType>("bittorrent_peer_set");
 		bittorrent_benc_value =
-			internal_type("bittorrent_benc_value")->AsRecordType();
+			zeek::id::find_type<RecordType>("bittorrent_benc_value");
 		bittorrent_benc_dir =
-			internal_type("bittorrent_benc_dir")->AsTableType();
+			zeek::id::find_type<TableType>("bittorrent_benc_dir");
 		}
 
 	keep_alive = false;
@@ -45,7 +45,7 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
 	req_buf_pos = req_buf;
 	req_buf_len = 0;
 	req_val_uri = nullptr;
-	req_val_headers = new TableVal({NewRef{}, bt_tracker_headers});
+	req_val_headers = new TableVal(bt_tracker_headers);
 
 	res_state = BTT_RES_STATUS;
 	res_allow_blank_line = false;
@@ -53,9 +53,9 @@ BitTorrentTracker_Analyzer::BitTorrentTracker_Analyzer(Connection* c)
 	res_buf_pos = res_buf;
 	res_buf_len = 0;
 	res_status = 0;
-	res_val_headers = new TableVal({NewRef{}, bt_tracker_headers});
-	res_val_peers = new TableVal({NewRef{}, bittorrent_peer_set});
-	res_val_benc = new TableVal({NewRef{}, bittorrent_benc_dir});
+	res_val_headers = new TableVal(bt_tracker_headers);
+	res_val_peers = new TableVal(bittorrent_peer_set);
+	res_val_benc = new TableVal(bittorrent_benc_dir);
 
 	InitBencParser();
 
@@ -136,8 +136,7 @@ void BitTorrentTracker_Analyzer::ClientRequest(int len, const u_char* data)
 			req_buf_len -= (req_buf_pos - req_buf);
 			memmove(req_buf, req_buf_pos, req_buf_len);
 			req_buf_pos = req_buf;
-			req_val_headers =
-				new TableVal({NewRef{}, bt_tracker_headers});
+			req_val_headers = new TableVal(bt_tracker_headers);
 			}
 		}
 	}
@@ -199,9 +198,9 @@ void BitTorrentTracker_Analyzer::ServerReply(int len, const u_char* data)
 		res_buf_pos = res_buf;
 		res_status = 0;
 
-		res_val_headers = new TableVal({NewRef{}, bt_tracker_headers});
-		res_val_peers = new TableVal({NewRef{}, bittorrent_peer_set});
-		res_val_benc = new TableVal({NewRef{}, bittorrent_benc_dir});
+		res_val_headers = new TableVal(bt_tracker_headers);
+		res_val_peers = new TableVal(bittorrent_peer_set);
+		res_val_benc = new TableVal(bittorrent_benc_dir);
 
 		InitBencParser();
 		}
@@ -478,35 +477,29 @@ void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name,
 			uint32_t ad = extract_uint32((u_char*) value);
 			uint16_t pt = ntohs((value[4] << 8) | value[5]);
 
-			RecordVal* peer = new RecordVal(bittorrent_peer);
+			auto peer = make_intrusive<RecordVal>(bittorrent_peer);
 			peer->Assign(0, make_intrusive<AddrVal>(ad));
 			peer->Assign(1, val_mgr->Port(pt, TRANSPORT_TCP));
-			res_val_peers->Assign(peer, nullptr);
-
-			Unref(peer);
+			res_val_peers->Assign(std::move(peer), nullptr);
 			}
 		}
 	else
 		{
-		StringVal* name_ = new StringVal(name_len, name);
+		auto name_ = make_intrusive<StringVal>(name_len, name);
 		auto benc_value = make_intrusive<RecordVal>(bittorrent_benc_value);
 		benc_value->Assign(type, make_intrusive<StringVal>(value_len, value));
-		res_val_benc->Assign(name_, std::move(benc_value));
-
-		Unref(name_);
+		res_val_benc->Assign(std::move(name_), std::move(benc_value));
 		}
 	}
 
 void BitTorrentTracker_Analyzer::ResponseBenc(int name_len, char* name,
 				enum btt_benc_types type, bro_int_t value)
 	{
-	RecordVal* benc_value = new RecordVal(bittorrent_benc_value);
-	StringVal* name_ = new StringVal(name_len, name);
+	auto benc_value = make_intrusive<RecordVal>(bittorrent_benc_value);
+	auto name_ = make_intrusive<StringVal>(name_len, name);
 
 	benc_value->Assign(type, val_mgr->Int(value));
-	res_val_benc->Assign(name_, benc_value);
-
-	Unref(name_);
+	res_val_benc->Assign(std::move(name_), std::move(benc_value));
 	}
 
 void BitTorrentTracker_Analyzer::ResponseBody(void)
diff --git a/src/analyzer/protocol/bittorrent/bittorrent-analyzer.pac b/src/analyzer/protocol/bittorrent/bittorrent-analyzer.pac
index 27ae99f0df..f6dbb95dda 100644
--- a/src/analyzer/protocol/bittorrent/bittorrent-analyzer.pac
+++ b/src/analyzer/protocol/bittorrent/bittorrent-analyzer.pac
@@ -61,7 +61,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		handshake_ok = true;
 		if ( ::bittorrent_peer_handshake )
 			{
-			BifEvent::enqueue_bittorrent_peer_handshake(
+			zeek::BifEvent::enqueue_bittorrent_peer_handshake(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -79,7 +79,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_keep_alive )
 			{
-			BifEvent::enqueue_bittorrent_peer_keep_alive(
+			zeek::BifEvent::enqueue_bittorrent_peer_keep_alive(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig());
@@ -92,7 +92,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_choke )
 			{
-			BifEvent::enqueue_bittorrent_peer_choke(
+			zeek::BifEvent::enqueue_bittorrent_peer_choke(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig());
@@ -105,7 +105,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_unchoke )
 			{
-			BifEvent::enqueue_bittorrent_peer_unchoke(
+			zeek::BifEvent::enqueue_bittorrent_peer_unchoke(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig());
@@ -118,7 +118,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_interested )
 			{
-			BifEvent::enqueue_bittorrent_peer_interested(
+			zeek::BifEvent::enqueue_bittorrent_peer_interested(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig());
@@ -131,7 +131,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_not_interested )
 			{
-			BifEvent::enqueue_bittorrent_peer_not_interested(
+			zeek::BifEvent::enqueue_bittorrent_peer_not_interested(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig());
@@ -144,7 +144,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_have )
 			{
-			BifEvent::enqueue_bittorrent_peer_have(
+			zeek::BifEvent::enqueue_bittorrent_peer_have(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -158,7 +158,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_bitfield )
 			{
-			BifEvent::enqueue_bittorrent_peer_bitfield(
+			zeek::BifEvent::enqueue_bittorrent_peer_bitfield(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -173,7 +173,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_request )
 			{
-			BifEvent::enqueue_bittorrent_peer_request(
+			zeek::BifEvent::enqueue_bittorrent_peer_request(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -188,7 +188,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_piece )
 			{
-			BifEvent::enqueue_bittorrent_peer_piece(
+			zeek::BifEvent::enqueue_bittorrent_peer_piece(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -203,7 +203,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_cancel )
 			{
-			BifEvent::enqueue_bittorrent_peer_cancel(
+			zeek::BifEvent::enqueue_bittorrent_peer_cancel(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -217,7 +217,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_port )
 			{
-			BifEvent::enqueue_bittorrent_peer_port(
+			zeek::BifEvent::enqueue_bittorrent_peer_port(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -231,7 +231,7 @@ flow BitTorrent_Flow(is_orig: bool) {
 		%{
 		if ( ::bittorrent_peer_unknown )
 			{
-			BifEvent::enqueue_bittorrent_peer_unknown(
+			zeek::BifEvent::enqueue_bittorrent_peer_unknown(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc
index 58c186a06a..28f9a95c52 100644
--- a/src/analyzer/protocol/conn-size/ConnSize.cc
+++ b/src/analyzer/protocol/conn-size/ConnSize.cc
@@ -170,12 +170,12 @@ void ConnSize_Analyzer::SetDurationThreshold(double duration)
 void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val)
 	{
 	// RecordType *connection_type is decleared in NetVar.h
-	RecordVal *orig_endp = conn_val->Lookup("orig")->AsRecordVal();
-	RecordVal *resp_endp = conn_val->Lookup("resp")->AsRecordVal();
+	RecordVal* orig_endp = conn_val->GetField("orig")->AsRecordVal();
+	RecordVal* resp_endp = conn_val->GetField("resp")->AsRecordVal();
 
 	// endpoint is the RecordType from NetVar.h
-	int pktidx = endpoint->FieldOffset("num_pkts");
-	int bytesidx = endpoint->FieldOffset("num_bytes_ip");
+	int pktidx = zeek::id::endpoint->FieldOffset("num_pkts");
+	int bytesidx = zeek::id::endpoint->FieldOffset("num_bytes_ip");
 
 	if ( pktidx < 0 )
 		reporter->InternalError("'endpoint' record missing 'num_pkts' field");
diff --git a/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac b/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac
index de06b8e29b..c6bdbd3ab8 100644
--- a/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac
+++ b/src/analyzer/protocol/dce-rpc/dce_rpc-analyzer.pac
@@ -37,12 +37,12 @@ refine connection DCE_RPC_Conn += {
 		%{
 		if ( dce_rpc_message )
 			{
-			BifEvent::enqueue_dce_rpc_message(bro_analyzer(),
+			zeek::BifEvent::enqueue_dce_rpc_message(bro_analyzer(),
 			                                  bro_analyzer()->Conn(),
 			                                  ${header.is_orig},
 			                                  fid,
 			                                  ${header.PTYPE},
-			                                  BifType::Enum::DCE_RPC::PType->GetVal(${header.PTYPE}));
+			                                  zeek::BifType::Enum::DCE_RPC::PType->GetVal(${header.PTYPE}));
 			}
 		return true;
 		%}
@@ -51,7 +51,7 @@ refine connection DCE_RPC_Conn += {
 		%{
 		if ( dce_rpc_bind )
 			{
-			BifEvent::enqueue_dce_rpc_bind(bro_analyzer(),
+			zeek::BifEvent::enqueue_dce_rpc_bind(bro_analyzer(),
 			                               bro_analyzer()->Conn(),
 			                               fid,
 			                               ${req.id},
@@ -67,7 +67,7 @@ refine connection DCE_RPC_Conn += {
 		%{
 		if ( dce_rpc_alter_context )
 			{
-			BifEvent::enqueue_dce_rpc_alter_context(bro_analyzer(),
+			zeek::BifEvent::enqueue_dce_rpc_alter_context(bro_analyzer(),
 			                                        bro_analyzer()->Conn(),
 			                                        fid,
 			                                        ${req.id},
@@ -92,7 +92,7 @@ refine connection DCE_RPC_Conn += {
 			else
 				sec_addr = make_intrusive<StringVal>(${bind.sec_addr}.length(), (const char*) ${bind.sec_addr}.begin());
 
-			BifEvent::enqueue_dce_rpc_bind_ack(bro_analyzer(),
+			zeek::BifEvent::enqueue_dce_rpc_bind_ack(bro_analyzer(),
 			                                   bro_analyzer()->Conn(),
 			                                   fid,
 			                                   std::move(sec_addr));
@@ -104,7 +104,7 @@ refine connection DCE_RPC_Conn += {
 		%{
 		if ( dce_rpc_alter_context_resp )
 			{
-			BifEvent::enqueue_dce_rpc_alter_context_resp(bro_analyzer(),
+			zeek::BifEvent::enqueue_dce_rpc_alter_context_resp(bro_analyzer(),
 			                                             bro_analyzer()->Conn(),
 			                                             fid);
 			}
@@ -115,7 +115,7 @@ refine connection DCE_RPC_Conn += {
 		%{
 		if ( dce_rpc_request )
 			{
-			BifEvent::enqueue_dce_rpc_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_dce_rpc_request(bro_analyzer(),
 			                                  bro_analyzer()->Conn(),
 			                                  fid,
 			                                  ${req.context_id},
@@ -132,7 +132,7 @@ refine connection DCE_RPC_Conn += {
 		%{
 		if ( dce_rpc_response )
 			{
-			BifEvent::enqueue_dce_rpc_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_dce_rpc_response(bro_analyzer(),
 			                                   bro_analyzer()->Conn(),
 			                                   fid,
 			                                   ${resp.context_id},
diff --git a/src/analyzer/protocol/dce-rpc/dce_rpc-protocol.pac b/src/analyzer/protocol/dce-rpc/dce_rpc-protocol.pac
index db1b487178..5263b20c93 100644
--- a/src/analyzer/protocol/dce-rpc/dce_rpc-protocol.pac
+++ b/src/analyzer/protocol/dce-rpc/dce_rpc-protocol.pac
@@ -210,14 +210,14 @@ flow DCE_RPC_Flow(is_orig: bool) {
 				flowbuf->NewFrame(0, true);
 				flowbuf->BufferData(frag.begin(), frag.end());
 
-				if ( fb.size() > BifConst::DCE_RPC::max_cmd_reassembly )
+				if ( fb.size() > zeek::BifConst::DCE_RPC::max_cmd_reassembly )
 					{
 					reporter->Weird(connection()->bro_analyzer()->Conn(),
 					                "too_many_dce_rpc_msgs_in_reassembly");
 					connection()->bro_analyzer()->SetSkip(true);
 					}
 
-				if ( flowbuf->data_length() > (int)BifConst::DCE_RPC::max_frag_data )
+				if ( flowbuf->data_length() > (int)zeek::BifConst::DCE_RPC::max_frag_data )
 					{
 					reporter->Weird(connection()->bro_analyzer()->Conn(),
 					                "too_much_dce_rpc_fragment_data");
@@ -233,7 +233,7 @@ flow DCE_RPC_Flow(is_orig: bool) {
 			auto& flowbuf = it->second;
 			flowbuf->BufferData(frag.begin(), frag.end());
 
-			if ( flowbuf->data_length() > (int)BifConst::DCE_RPC::max_frag_data )
+			if ( flowbuf->data_length() > (int)zeek::BifConst::DCE_RPC::max_frag_data )
 				{
 				reporter->Weird(connection()->bro_analyzer()->Conn(),
 				                "too_much_dce_rpc_fragment_data");
diff --git a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
index 887069dc4e..37ab13e57c 100644
--- a/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
+++ b/src/analyzer/protocol/dhcp/dhcp-analyzer.pac
@@ -19,8 +19,8 @@ refine flow DHCP_Flow += {
 		%{
 		if ( ! options )
 			{
-			options = make_intrusive<RecordVal>(BifType::Record::DHCP::Options);
-			all_options = make_intrusive<VectorVal>(index_vec);
+			options = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::Options);
+			all_options = make_intrusive<VectorVal>(zeek::id::index_vec);
 			options->Assign(0, all_options);
 			}
 
@@ -53,7 +53,7 @@ refine flow DHCP_Flow += {
 			std::string mac_str = fmt_mac(${msg.chaddr}.data(), ${msg.chaddr}.length());
 			double secs = static_cast<double>(${msg.secs});
 
-			auto dhcp_msg_val = make_intrusive<RecordVal>(BifType::Record::DHCP::Msg);
+			auto dhcp_msg_val = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::Msg);
 			dhcp_msg_val->Assign(0, val_mgr->Count(${msg.op}));
 			dhcp_msg_val->Assign(1, val_mgr->Count(${msg.type}));
 			dhcp_msg_val->Assign(2, val_mgr->Count(${msg.xid}));
@@ -91,7 +91,7 @@ refine flow DHCP_Flow += {
 
 			init_options();
 
-			BifEvent::enqueue_dhcp_message(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_dhcp_message(connection()->bro_analyzer(),
 			                               connection()->bro_analyzer()->Conn(),
 			                               ${msg.is_orig},
 			                               std::move(dhcp_msg_val),
diff --git a/src/analyzer/protocol/dhcp/dhcp-options.pac b/src/analyzer/protocol/dhcp/dhcp-options.pac
index 848aa05868..96dfd8bacf 100644
--- a/src/analyzer/protocol/dhcp/dhcp-options.pac
+++ b/src/analyzer/protocol/dhcp/dhcp-options.pac
@@ -57,7 +57,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_router_option(v: OptionValue): bool
 		%{
-		VectorVal* router_list = new VectorVal(BifType::Vector::DHCP::Addrs);
+		auto router_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_routers = ${v.router_list}->size();
 		vector<uint32>* rlist = ${v.router_list};
 
@@ -67,7 +67,7 @@ refine flow DHCP_Flow += {
 			router_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
-		${context.flow}->options->Assign(2, router_list);
+		${context.flow}->options->Assign(2, std::move(router_list));
 
 		return true;
 		%}
@@ -91,7 +91,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_timeserver_option(v: OptionValue): bool
 		%{
-		VectorVal* timeserver_list = new VectorVal(BifType::Vector::DHCP::Addrs);
+		auto timeserver_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.timeserver_list}->size();
 		vector<uint32>* rlist = ${v.timeserver_list};
 
@@ -101,7 +101,7 @@ refine flow DHCP_Flow += {
 			timeserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
-		${context.flow}->options->Assign(26, timeserver_list);
+		${context.flow}->options->Assign(26, std::move(timeserver_list));
 
 		return true;
 		%}
@@ -125,7 +125,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_nameserver_option(v: OptionValue): bool
 		%{
-		VectorVal* nameserver_list = new VectorVal(BifType::Vector::DHCP::Addrs);
+		auto nameserver_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.nameserver_list}->size();
 		vector<uint32>* rlist = ${v.nameserver_list};
 
@@ -135,7 +135,7 @@ refine flow DHCP_Flow += {
 			nameserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
-		${context.flow}->options->Assign(27, nameserver_list);
+		${context.flow}->options->Assign(27, std::move(nameserver_list));
 
 		return true;
 		%}
@@ -159,7 +159,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_dns_server_option(v: OptionValue): bool
 		%{
-		VectorVal* server_list = new VectorVal(BifType::Vector::DHCP::Addrs);
+		auto server_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.dns_server_list}->size();
 		vector<uint32>* rlist = ${v.dns_server_list};
 
@@ -169,7 +169,7 @@ refine flow DHCP_Flow += {
 			server_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
-		${context.flow}->options->Assign(3, server_list);
+		${context.flow}->options->Assign(3, std::move(server_list));
 		return true;
 		%}
 };
@@ -298,7 +298,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_ntpserver_option(v: OptionValue): bool
 		%{
-		VectorVal* ntpserver_list = new VectorVal(BifType::Vector::DHCP::Addrs);
+		auto ntpserver_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.ntpserver_list}->size();
 		vector<uint32>* rlist = ${v.ntpserver_list};
 
@@ -308,7 +308,7 @@ refine flow DHCP_Flow += {
 			ntpserver_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
-		${context.flow}->options->Assign(28, ntpserver_list);
+		${context.flow}->options->Assign(28, std::move(ntpserver_list));
 
 		return true;
 		%}
@@ -356,7 +356,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_nbns_option(v: OptionValue): bool
 		%{
-		VectorVal* server_list = new VectorVal(BifType::Vector::DHCP::Addrs);
+		auto server_list = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::Addrs);
 		int num_servers = ${v.nbns}->size();
 		vector<uint32>* rlist = ${v.nbns};
 
@@ -366,7 +366,7 @@ refine flow DHCP_Flow += {
 			server_list->Assign(i, make_intrusive<AddrVal>(htonl(raddr)));
 			}
 
-		${context.flow}->options->Assign(9, server_list);
+		${context.flow}->options->Assign(9, std::move(server_list));
 		return true;
 		%}
 };
@@ -462,7 +462,7 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_par_req_list_option(v: OptionValue): bool
 		%{
-		VectorVal* params = new VectorVal(index_vec);
+		auto params = make_intrusive<VectorVal>(zeek::id::index_vec);
 		int num_parms = ${v.par_req_list}->size();
 		vector<uint8>* plist = ${v.par_req_list};
 
@@ -472,7 +472,7 @@ refine flow DHCP_Flow += {
 			params->Assign(i, val_mgr->Count(param));
 			}
 
-		${context.flow}->options->Assign(13, params);
+		${context.flow}->options->Assign(13, std::move(params));
 
 		return true;
 		%}
@@ -625,11 +625,11 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_client_id_option(v: OptionValue): bool
 		%{
-		RecordVal* client_id = new RecordVal(BifType::Record::DHCP::ClientID);
+		auto client_id = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientID);
 		client_id->Assign(0, val_mgr->Count(${v.client_id.hwtype}));
 		client_id->Assign(1, make_intrusive<StringVal>(fmt_mac(${v.client_id.hwaddr}.begin(), ${v.client_id.hwaddr}.length())));
 
-		${context.flow}->options->Assign(19, client_id);
+		${context.flow}->options->Assign(19, std::move(client_id));
 
 		return true;
 		%}
@@ -685,14 +685,14 @@ refine casetype OptionValue += {
 refine flow DHCP_Flow += {
 	function process_client_fqdn_option(v: OptionValue): bool
 		%{
-		RecordVal* client_fqdn = new RecordVal(BifType::Record::DHCP::ClientFQDN);
+		auto client_fqdn = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::ClientFQDN);
 		client_fqdn->Assign(0, val_mgr->Count(${v.client_fqdn.flags}));
 		client_fqdn->Assign(1, val_mgr->Count(${v.client_fqdn.rcode1}));
 		client_fqdn->Assign(2, val_mgr->Count(${v.client_fqdn.rcode2}));
 		const char* domain_name = reinterpret_cast<const char*>(${v.client_fqdn.domain_name}.begin());
 		client_fqdn->Assign(3, make_intrusive<StringVal>(${v.client_fqdn.domain_name}.length(), domain_name));
 
-		${context.flow}->options->Assign(21, client_fqdn);
+		${context.flow}->options->Assign(21, std::move(client_fqdn));
 
 		return true;
 		%}
@@ -743,22 +743,22 @@ refine flow DHCP_Flow += {
 
 	function process_relay_agent_inf_option(v: OptionValue): bool
 		%{
-		VectorVal* relay_agent_sub_opt = new VectorVal(BifType::Vector::DHCP::SubOpts);
+		auto relay_agent_sub_opt = make_intrusive<VectorVal>(zeek::BifType::Vector::DHCP::SubOpts);
 
 		uint16 i = 0;
 
 		for ( auto ptrsubopt = ${v.relay_agent_inf}->begin();
 		      ptrsubopt != ${v.relay_agent_inf}->end(); ++ptrsubopt )
 			{
-			auto r = new RecordVal(BifType::Record::DHCP::SubOpt);
+			auto r = make_intrusive<RecordVal>(zeek::BifType::Record::DHCP::SubOpt);
 			r->Assign(0, val_mgr->Count((*ptrsubopt)->code()));
 			r->Assign(1, to_stringval((*ptrsubopt)->value()));
 
-			relay_agent_sub_opt->Assign(i, r);
+			relay_agent_sub_opt->Assign(i, std::move(r));
 			++i;
 			}
 
-		${context.flow}->options->Assign(22, relay_agent_sub_opt);
+		${context.flow}->options->Assign(22, std::move(relay_agent_sub_opt));
 		return true;
 		%}
 };
diff --git a/src/analyzer/protocol/dnp3/dnp3-analyzer.pac b/src/analyzer/protocol/dnp3/dnp3-analyzer.pac
index 9ce8892790..189128b39d 100644
--- a/src/analyzer/protocol/dnp3/dnp3-analyzer.pac
+++ b/src/analyzer/protocol/dnp3/dnp3-analyzer.pac
@@ -29,7 +29,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_header_block )
 			{
-			BifEvent::enqueue_dnp3_header_block(
+			zeek::BifEvent::enqueue_dnp3_header_block(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), len, ctrl, dest_addr, src_addr);
@@ -42,7 +42,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_application_request_header )
 			{
-			BifEvent::enqueue_dnp3_application_request_header(
+			zeek::BifEvent::enqueue_dnp3_application_request_header(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -57,7 +57,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_application_response_header )
 			{
-			BifEvent::enqueue_dnp3_application_response_header(
+			zeek::BifEvent::enqueue_dnp3_application_response_header(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(),
@@ -73,7 +73,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_object_header )
 			{
-			BifEvent::enqueue_dnp3_object_header(
+			zeek::BifEvent::enqueue_dnp3_object_header(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), obj_type, qua_field, number, rf_low, rf_high);
@@ -86,7 +86,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_object_prefix )
 			{
-			BifEvent::enqueue_dnp3_object_prefix(
+			zeek::BifEvent::enqueue_dnp3_object_prefix(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), prefix_value);
@@ -99,7 +99,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_response_data_object )
 			{
-			BifEvent::enqueue_dnp3_response_data_object(
+			zeek::BifEvent::enqueue_dnp3_response_data_object(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), data_value);
@@ -113,7 +113,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_attribute_common )
 			{
-			BifEvent::enqueue_dnp3_attribute_common(
+			zeek::BifEvent::enqueue_dnp3_attribute_common(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), data_type_code, leng, to_stringval(attribute_obj) );
@@ -127,7 +127,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_crob )
 			{
-			BifEvent::enqueue_dnp3_crob(
+			zeek::BifEvent::enqueue_dnp3_crob(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), control_code, count8, on_time, off_time, status_code);
@@ -141,7 +141,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_pcb )
 			{
-			BifEvent::enqueue_dnp3_pcb(
+			zeek::BifEvent::enqueue_dnp3_pcb(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), control_code, count8, on_time, off_time, status_code);
@@ -155,7 +155,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_counter_32wFlag )
 			{
-			BifEvent::enqueue_dnp3_counter_32wFlag(
+			zeek::BifEvent::enqueue_dnp3_counter_32wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, count_value);
@@ -169,7 +169,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_counter_16wFlag )
 			{
-			BifEvent::enqueue_dnp3_counter_16wFlag(
+			zeek::BifEvent::enqueue_dnp3_counter_16wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, count_value);
@@ -183,7 +183,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_counter_32woFlag )
 			{
-			BifEvent::enqueue_dnp3_counter_32woFlag(
+			zeek::BifEvent::enqueue_dnp3_counter_32woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), count_value);
@@ -197,7 +197,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_counter_16woFlag )
 			{
-			BifEvent::enqueue_dnp3_counter_16woFlag(
+			zeek::BifEvent::enqueue_dnp3_counter_16woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), count_value);
@@ -211,7 +211,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_counter_32wFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_counter_32wFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_counter_32wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, count_value);
@@ -225,7 +225,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_counter_16wFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_counter_16wFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_counter_16wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, count_value);
@@ -239,7 +239,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_counter_32wFlagTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_counter_32wFlagTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_counter_32wFlagTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, count_value, bytestring_to_time(time48));
@@ -253,7 +253,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_counter_16wFlagTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_counter_16wFlagTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_counter_16wFlagTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, count_value, bytestring_to_time(time48));
@@ -267,7 +267,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_counter_32woFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_counter_32woFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_counter_32woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), count_value);
@@ -281,7 +281,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_counter_16woFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_counter_16woFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_counter_16woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), count_value);
@@ -295,7 +295,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_32wFlag )
 			{
-			BifEvent::enqueue_dnp3_analog_input_32wFlag(
+			zeek::BifEvent::enqueue_dnp3_analog_input_32wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value);
@@ -309,7 +309,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_16wFlag )
 			{
-			BifEvent::enqueue_dnp3_analog_input_16wFlag(
+			zeek::BifEvent::enqueue_dnp3_analog_input_16wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value);
@@ -323,7 +323,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_32woFlag )
 			{
-			BifEvent::enqueue_dnp3_analog_input_32woFlag(
+			zeek::BifEvent::enqueue_dnp3_analog_input_32woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), value);
@@ -337,7 +337,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_16woFlag )
 			{
-			BifEvent::enqueue_dnp3_analog_input_16woFlag(
+			zeek::BifEvent::enqueue_dnp3_analog_input_16woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), value);
@@ -351,7 +351,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_SPwFlag )
 			{
-			BifEvent::enqueue_dnp3_analog_input_SPwFlag(
+			zeek::BifEvent::enqueue_dnp3_analog_input_SPwFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value);
@@ -365,7 +365,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_DPwFlag )
 			{
-			BifEvent::enqueue_dnp3_analog_input_DPwFlag(
+			zeek::BifEvent::enqueue_dnp3_analog_input_DPwFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value_low, value_high);
@@ -379,7 +379,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_32wFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_32wFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_32wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value);
@@ -393,7 +393,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_16wFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_16wFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_16wFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value);
@@ -407,7 +407,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_32wTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_32wTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_32wTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value, bytestring_to_time(time48));
@@ -421,7 +421,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_16wTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_16wTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_16wTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value, bytestring_to_time(time48));
@@ -435,7 +435,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_32woFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_32woFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_32woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), frozen_value);
@@ -449,7 +449,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_16woFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_16woFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_16woFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), frozen_value);
@@ -463,7 +463,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_SPwFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_SPwFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_SPwFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value);
@@ -477,7 +477,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_DPwFlag )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_DPwFlag(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_DPwFlag(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value_low, frozen_value_high);
@@ -491,7 +491,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_32woTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_32woTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_32woTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value);
@@ -505,7 +505,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_16woTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_16woTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_16woTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value);
@@ -519,7 +519,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_32wTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_32wTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_32wTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value, bytestring_to_time(time48));
@@ -533,7 +533,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_16wTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_16wTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_16wTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value, bytestring_to_time(time48));
@@ -547,7 +547,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_SPwoTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_SPwoTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_SPwoTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value);
@@ -561,7 +561,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_DPwoTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_DPwoTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_DPwoTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value_low, value_high);
@@ -575,7 +575,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_SPwTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_SPwTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_SPwTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value, bytestring_to_time(time48));
@@ -589,7 +589,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_analog_input_event_DPwTime )
 			{
-			BifEvent::enqueue_dnp3_analog_input_event_DPwTime(
+			zeek::BifEvent::enqueue_dnp3_analog_input_event_DPwTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, value_low, value_high, bytestring_to_time(time48));
@@ -603,7 +603,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_32woTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_32woTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_32woTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value);
@@ -617,7 +617,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_16woTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_16woTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_16woTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value);
@@ -631,7 +631,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_32wTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_32wTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_32wTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value, bytestring_to_time(time48));
@@ -645,7 +645,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_16wTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_16wTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_16wTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value, bytestring_to_time(time48));
@@ -659,7 +659,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_SPwoTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_SPwoTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_SPwoTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value);
@@ -673,7 +673,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_DPwoTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_DPwoTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_DPwoTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value_low, frozen_value_high);
@@ -687,7 +687,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_SPwTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_SPwTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_SPwTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value, bytestring_to_time(time48));
@@ -701,7 +701,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_frozen_analog_input_event_DPwTime )
 			{
-			BifEvent::enqueue_dnp3_frozen_analog_input_event_DPwTime(
+			zeek::BifEvent::enqueue_dnp3_frozen_analog_input_event_DPwTime(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), flag, frozen_value_low, frozen_value_high, bytestring_to_time(time48));
@@ -715,7 +715,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_file_transport )
 			{
-			BifEvent::enqueue_dnp3_file_transport(
+			zeek::BifEvent::enqueue_dnp3_file_transport(
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), file_handle, block_num, to_stringval(file_data));
@@ -729,7 +729,7 @@ flow DNP3_Flow(is_orig: bool) {
 		%{
 		if ( ::dnp3_debug_byte )
 			{
-			BifEvent::enqueue_dnp3_debug_byte (
+			zeek::BifEvent::enqueue_dnp3_debug_byte (
 				connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig(), to_stringval(debug));
diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc
index 19f40757c1..5368c7cb41 100644
--- a/src/analyzer/protocol/dns/DNS.cc
+++ b/src/analyzer/protocol/dns/DNS.cc
@@ -51,7 +51,7 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
 		analyzer->EnqueueConnEvent(dns_message,
 			analyzer->ConnVal(),
 			val_mgr->Bool(is_query),
-			IntrusivePtr{AdoptRef{}, msg.BuildHdrVal()},
+			msg.BuildHdrVal(),
 			val_mgr->Count(len)
 		);
 
@@ -85,16 +85,18 @@ void DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query)
 
 	analyzer->ProtocolConfirmation();
 
-	AddrVal server(analyzer->Conn()->RespAddr());
-
 	int skip_auth = dns_skip_all_auth;
 	int skip_addl = dns_skip_all_addl;
 	if ( msg.ancount > 0 )
 		{ // We did an answer, so can potentially skip auth/addl.
+		static auto dns_skip_auth = zeek::id::find_val<TableVal>("dns_skip_auth");
+		static auto dns_skip_addl = zeek::id::find_val<TableVal>("dns_skip_addl");
+		auto server = make_intrusive<AddrVal>(analyzer->Conn()->RespAddr());
+
 		skip_auth = skip_auth || msg.nscount == 0 ||
-				dns_skip_auth->Lookup(&server);
+				dns_skip_auth->FindOrDefault(server);
 		skip_addl = skip_addl || msg.arcount == 0 ||
-				dns_skip_addl->Lookup(&server);
+				dns_skip_addl->FindOrDefault(server);
 		}
 
 	if ( skip_auth && skip_addl )
@@ -135,7 +137,7 @@ void DNS_Interpreter::EndMessage(DNS_MsgInfo* msg)
 	if ( dns_end )
 		analyzer->EnqueueConnEvent(dns_end,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()}
+			msg->BuildHdrVal()
 		);
 	}
 
@@ -229,8 +231,7 @@ bool DNS_Interpreter::ParseAnswer(DNS_MsgInfo* msg,
 	// Note that the exact meaning of some of these fields will be
 	// re-interpreted by other, more adventurous RR types.
 
-	Unref(msg->query_name);
-	msg->query_name = new StringVal(new BroString(name, name_end - name, true));
+	msg->query_name = make_intrusive<StringVal>(new BroString(name, name_end - name, true));
 	msg->atype = RR_Type(ExtractShort(data, len));
 	msg->aclass = ExtractShort(data, len);
 	msg->ttl = ExtractLong(data, len);
@@ -338,8 +339,8 @@ bool DNS_Interpreter::ParseAnswer(DNS_MsgInfo* msg,
 			if ( dns_unknown_reply && ! msg->skip_event )
 				analyzer->EnqueueConnEvent(dns_unknown_reply,
 					analyzer->ConnVal(),
-					IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-					IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()}
+					msg->BuildHdrVal(),
+					msg->BuildAnswerVal()
 				);
 
 			analyzer->Weird("DNS_RR_unknown_type", fmt("%d", msg->atype));
@@ -551,8 +552,8 @@ bool DNS_Interpreter::ParseRR_Name(DNS_MsgInfo* msg,
 	if ( reply_event && ! msg->skip_event )
 		analyzer->EnqueueConnEvent(reply_event,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			make_intrusive<StringVal>(new BroString(name, name_end - name, true))
 		);
 
@@ -593,6 +594,7 @@ bool DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg,
 
 	if ( dns_SOA_reply && ! msg->skip_event )
 		{
+		static auto dns_soa = zeek::id::find_type<RecordType>("dns_soa");
 		auto r = make_intrusive<RecordVal>(dns_soa);
 		r->Assign(0, make_intrusive<StringVal>(new BroString(mname, mname_end - mname, true)));
 		r->Assign(1, make_intrusive<StringVal>(new BroString(rname, rname_end - rname, true)));
@@ -604,8 +606,8 @@ bool DNS_Interpreter::ParseRR_SOA(DNS_MsgInfo* msg,
 
 		analyzer->EnqueueConnEvent(dns_SOA_reply,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			std::move(r)
 		);
 		}
@@ -634,8 +636,8 @@ bool DNS_Interpreter::ParseRR_MX(DNS_MsgInfo* msg,
 	if ( dns_MX_reply && ! msg->skip_event )
 		analyzer->EnqueueConnEvent(dns_MX_reply,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
 			val_mgr->Count(preference)
 		);
@@ -675,8 +677,8 @@ bool DNS_Interpreter::ParseRR_SRV(DNS_MsgInfo* msg,
 	if ( dns_SRV_reply && ! msg->skip_event )
 		analyzer->EnqueueConnEvent(dns_SRV_reply,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
 			val_mgr->Count(priority),
 			val_mgr->Count(weight),
@@ -696,8 +698,8 @@ bool DNS_Interpreter::ParseRR_EDNS(DNS_MsgInfo* msg,
 	if ( dns_EDNS_addl && ! msg->skip_event )
 		analyzer->EnqueueConnEvent(dns_EDNS_addl,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildEDNS_Val()}
+			msg->BuildHdrVal(),
+			msg->BuildEDNS_Val()
 		);
 
 	// Currently EDNS supports the movement of type:data pairs
@@ -773,8 +775,8 @@ bool DNS_Interpreter::ParseRR_TSIG(DNS_MsgInfo* msg,
 
 		analyzer->EnqueueConnEvent(dns_TSIG_addl,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildTSIG_Val(&tsig)}
+			msg->BuildHdrVal(),
+			msg->BuildTSIG_Val(&tsig)
 		);
 		}
 
@@ -874,9 +876,9 @@ bool DNS_Interpreter::ParseRR_RRSIG(DNS_MsgInfo* msg,
 
 		analyzer->EnqueueConnEvent(dns_RRSIG,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildRRSIG_Val(&rrsig)}
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
+			msg->BuildRRSIG_Val(&rrsig)
 		);
 		}
 
@@ -969,9 +971,9 @@ bool DNS_Interpreter::ParseRR_DNSKEY(DNS_MsgInfo* msg,
 
 		analyzer->EnqueueConnEvent(dns_DNSKEY,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildDNSKEY_Val(&dnskey)}
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
+			msg->BuildDNSKEY_Val(&dnskey)
 		);
 		}
 
@@ -999,7 +1001,7 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg,
 
 	int typebitmaps_len = rdlength - (data - data_start);
 
-	auto char_strings = make_intrusive<VectorVal>(string_vec);
+	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	while ( typebitmaps_len > 0 && len > 0 )
 		{
@@ -1021,8 +1023,8 @@ bool DNS_Interpreter::ParseRR_NSEC(DNS_MsgInfo* msg,
 	if ( dns_NSEC )
 		analyzer->EnqueueConnEvent(dns_NSEC,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			make_intrusive<StringVal>(new BroString(name, name_end - name, true)),
 			std::move(char_strings)
 		);
@@ -1074,7 +1076,7 @@ bool DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg,
 
 	int typebitmaps_len = rdlength - (data - data_start);
 
-	VectorVal* char_strings = new VectorVal(string_vec);
+	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	while ( typebitmaps_len > 0 && len > 0 )
 		{
@@ -1103,17 +1105,15 @@ bool DNS_Interpreter::ParseRR_NSEC3(DNS_MsgInfo* msg,
 		nsec3.nsec_salt = salt_val;
 		nsec3.nsec_hlen = hash_len;
 		nsec3.nsec_hash = hash_val;
-		nsec3.bitmaps = char_strings;
+		nsec3.bitmaps = std::move(char_strings);
 
 		analyzer->EnqueueConnEvent(dns_NSEC3,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildNSEC3_Val(&nsec3)}
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
+			msg->BuildNSEC3_Val(&nsec3)
 		);
 		}
-	else
-		Unref(char_strings);
 
 	return true;
 	}
@@ -1167,9 +1167,9 @@ bool DNS_Interpreter::ParseRR_DS(DNS_MsgInfo* msg,
 
 		analyzer->EnqueueConnEvent(dns_DS,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildDS_Val(&ds)}
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
+			msg->BuildDS_Val(&ds)
 		);
 		}
 
@@ -1190,8 +1190,8 @@ bool DNS_Interpreter::ParseRR_A(DNS_MsgInfo* msg,
 	if ( dns_A_reply && ! msg->skip_event )
 		analyzer->EnqueueConnEvent(dns_A_reply,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			make_intrusive<AddrVal>(htonl(addr))
 		);
 
@@ -1226,8 +1226,8 @@ bool DNS_Interpreter::ParseRR_AAAA(DNS_MsgInfo* msg,
 	if ( event && ! msg->skip_event )
 		analyzer->EnqueueConnEvent(event,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			make_intrusive<AddrVal>(addr)
 		);
 
@@ -1252,8 +1252,9 @@ bool DNS_Interpreter::ParseRR_HINFO(DNS_MsgInfo* msg,
 	return true;
 	}
 
-static StringVal* extract_char_string(analyzer::Analyzer* analyzer,
-                                      const u_char*& data, int& len, int& rdlen)
+static IntrusivePtr<StringVal>
+extract_char_string(analyzer::Analyzer* analyzer,
+                    const u_char*& data, int& len, int& rdlen)
 	{
 	if ( rdlen <= 0 )
 		return nullptr;
@@ -1270,8 +1271,7 @@ static StringVal* extract_char_string(analyzer::Analyzer* analyzer,
 		return nullptr;
 		}
 
-	StringVal* rval = new StringVal(str_size,
-	                                reinterpret_cast<const char*>(data));
+	auto rval = make_intrusive<StringVal>(str_size, reinterpret_cast<const char*>(data));
 
 	rdlen -= str_size;
 	len -= str_size;
@@ -1291,17 +1291,17 @@ bool DNS_Interpreter::ParseRR_TXT(DNS_MsgInfo* msg,
 		return true;
 		}
 
-	auto char_strings = make_intrusive<VectorVal>(string_vec);
-	StringVal* char_string;
+	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
+	IntrusivePtr<StringVal> char_string;
 
 	while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) )
-		char_strings->Assign(char_strings->Size(), char_string);
+		char_strings->Assign(char_strings->Size(), std::move(char_string));
 
 	if ( dns_TXT_reply )
 		analyzer->EnqueueConnEvent(dns_TXT_reply,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			std::move(char_strings)
 		);
 
@@ -1319,17 +1319,17 @@ bool DNS_Interpreter::ParseRR_SPF(DNS_MsgInfo* msg,
 		return true;
 		}
 
-	auto char_strings = make_intrusive<VectorVal>(string_vec);
-	StringVal* char_string;
+	auto char_strings = make_intrusive<VectorVal>(zeek::id::string_vec);
+	IntrusivePtr<StringVal> char_string;
 
 	while ( (char_string = extract_char_string(analyzer, data, len, rdlength)) )
-		char_strings->Assign(char_strings->Size(), char_string);
+		char_strings->Assign(char_strings->Size(), std::move(char_string));
 
 	if ( dns_SPF_reply )
 		analyzer->EnqueueConnEvent(dns_SPF_reply,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			std::move(char_strings)
 		);
 
@@ -1369,8 +1369,8 @@ bool DNS_Interpreter::ParseRR_CAA(DNS_MsgInfo* msg,
 	if ( dns_CAA_reply )
 		analyzer->EnqueueConnEvent(dns_CAA_reply,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
-			IntrusivePtr{AdoptRef{}, msg->BuildAnswerVal()},
+			msg->BuildHdrVal(),
+			msg->BuildAnswerVal(),
 			val_mgr->Count(flags),
 			make_intrusive<StringVal>(tag),
 			make_intrusive<StringVal>(value)
@@ -1397,7 +1397,7 @@ void DNS_Interpreter::SendReplyOrRejectEvent(DNS_MsgInfo* msg,
 
 	analyzer->EnqueueConnEvent(event,
 		analyzer->ConnVal(),
-		IntrusivePtr{AdoptRef{}, msg->BuildHdrVal()},
+		msg->BuildHdrVal(),
 		make_intrusive<StringVal>(question_name),
 		val_mgr->Count(qtype),
 		val_mgr->Count(qclass)
@@ -1428,7 +1428,6 @@ DNS_MsgInfo::DNS_MsgInfo(DNS_RawMsgHdr* hdr, int arg_is_query)
 	id = ntohs(hdr->id);
 	is_query = arg_is_query;
 
-	query_name = nullptr;
 	atype = TYPE_ALL;
 	aclass = 0;
 	ttl = 0;
@@ -1437,14 +1436,10 @@ DNS_MsgInfo::DNS_MsgInfo(DNS_RawMsgHdr* hdr, int arg_is_query)
 	skip_event = 0;
 	}
 
-DNS_MsgInfo::~DNS_MsgInfo()
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildHdrVal()
 	{
-	Unref(query_name);
-	}
-
-Val* DNS_MsgInfo::BuildHdrVal()
-	{
-	RecordVal* r = new RecordVal(dns_msg);
+	static auto dns_msg = zeek::id::find_type<RecordType>("dns_msg");
+	auto r = make_intrusive<RecordVal>(dns_msg);
 
 	r->Assign(0, val_mgr->Count(id));
 	r->Assign(1, val_mgr->Count(opcode));
@@ -1463,11 +1458,11 @@ Val* DNS_MsgInfo::BuildHdrVal()
 	return r;
 	}
 
-Val* DNS_MsgInfo::BuildAnswerVal()
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildAnswerVal()
 	{
-	RecordVal* r = new RecordVal(dns_answer);
+	static auto dns_answer = zeek::id::find_type<RecordType>("dns_answer");
+	auto r = make_intrusive<RecordVal>(dns_answer);
 
-	Ref(query_name);
 	r->Assign(0, val_mgr->Count(int(answer_type)));
 	r->Assign(1, query_name);
 	r->Assign(2, val_mgr->Count(atype));
@@ -1477,13 +1472,13 @@ Val* DNS_MsgInfo::BuildAnswerVal()
 	return r;
 	}
 
-Val* DNS_MsgInfo::BuildEDNS_Val()
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildEDNS_Val()
 	{
 	// We have to treat the additional record type in EDNS differently
 	// than a regular resource record.
-	RecordVal* r = new RecordVal(dns_edns_additional);
+	static auto dns_edns_additional = zeek::id::find_type<RecordType>("dns_edns_additional");
+	auto r = make_intrusive<RecordVal>(dns_edns_additional);
 
-	Ref(query_name);
 	r->Assign(0, val_mgr->Count(int(answer_type)));
 	r->Assign(1, query_name);
 
@@ -1513,12 +1508,12 @@ Val* DNS_MsgInfo::BuildEDNS_Val()
 	return r;
 	}
 
-Val* DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
 	{
-	RecordVal* r = new RecordVal(dns_tsig_additional);
+	static auto dns_tsig_additional = zeek::id::find_type<RecordType>("dns_tsig_additional");
+	auto r = make_intrusive<RecordVal>(dns_tsig_additional);
 	double rtime = tsig->time_s + tsig->time_ms / 1000.0;
 
-	Ref(query_name);
 	// r->Assign(0, val_mgr->Count(int(answer_type)));
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
@@ -1533,11 +1528,11 @@ Val* DNS_MsgInfo::BuildTSIG_Val(struct TSIG_DATA* tsig)
 	return r;
 	}
 
-Val* DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
 	{
-	RecordVal* r = new RecordVal(dns_rrsig_rr);
+	static auto dns_rrsig_rr = zeek::id::find_type<RecordType>("dns_rrsig_rr");
+	auto r = make_intrusive<RecordVal>(dns_rrsig_rr);
 
-	Ref(query_name);
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
 	r->Assign(2, val_mgr->Count(rrsig->type_covered));
@@ -1554,11 +1549,11 @@ Val* DNS_MsgInfo::BuildRRSIG_Val(RRSIG_DATA* rrsig)
 	return r;
 	}
 
-Val* DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
 	{
-	RecordVal* r = new RecordVal(dns_dnskey_rr);
+	static auto dns_dnskey_rr = zeek::id::find_type<RecordType>("dns_dnskey_rr");
+	auto r = make_intrusive<RecordVal>(dns_dnskey_rr);
 
-	Ref(query_name);
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
 	r->Assign(2, val_mgr->Count(dnskey->dflags));
@@ -1570,11 +1565,11 @@ Val* DNS_MsgInfo::BuildDNSKEY_Val(DNSKEY_DATA* dnskey)
 	return r;
 	}
 
-Val* DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
 	{
-	RecordVal* r = new RecordVal(dns_nsec3_rr);
+	static auto dns_nsec3_rr = zeek::id::find_type<RecordType>("dns_nsec3_rr");
+	auto r = make_intrusive<RecordVal>(dns_nsec3_rr);
 
-	Ref(query_name);
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
 	r->Assign(2, val_mgr->Count(nsec3->nsec_flags));
@@ -1584,17 +1579,17 @@ Val* DNS_MsgInfo::BuildNSEC3_Val(NSEC3_DATA* nsec3)
 	r->Assign(6, make_intrusive<StringVal>(nsec3->nsec_salt));
 	r->Assign(7, val_mgr->Count(nsec3->nsec_hlen));
 	r->Assign(8, make_intrusive<StringVal>(nsec3->nsec_hash));
-	r->Assign(9, nsec3->bitmaps);
+	r->Assign(9, std::move(nsec3->bitmaps));
 	r->Assign(10, val_mgr->Count(is_query));
 
 	return r;
 	}
 
-Val* DNS_MsgInfo::BuildDS_Val(DS_DATA* ds)
+IntrusivePtr<RecordVal> DNS_MsgInfo::BuildDS_Val(DS_DATA* ds)
 	{
-	RecordVal* r = new RecordVal(dns_ds_rr);
+	static auto dns_ds_rr = zeek::id::find_type<RecordType>("dns_ds_rr");
+	auto r = make_intrusive<RecordVal>(dns_ds_rr);
 
-	Ref(query_name);
 	r->Assign(0, query_name);
 	r->Assign(1, val_mgr->Count(int(answer_type)));
 	r->Assign(2, val_mgr->Count(ds->key_tag));
diff --git a/src/analyzer/protocol/dns/DNS.h b/src/analyzer/protocol/dns/DNS.h
index 5b7666ac5a..ff6ae42de8 100644
--- a/src/analyzer/protocol/dns/DNS.h
+++ b/src/analyzer/protocol/dns/DNS.h
@@ -165,7 +165,7 @@ struct NSEC3_DATA {
 	BroString* nsec_salt;
 	unsigned short nsec_hlen;
 	BroString* nsec_hash;
-	VectorVal* bitmaps;
+	IntrusivePtr<VectorVal> bitmaps;
 };
 
 struct DS_DATA {
@@ -178,16 +178,15 @@ struct DS_DATA {
 class DNS_MsgInfo {
 public:
 	DNS_MsgInfo(DNS_RawMsgHdr* hdr, int is_query);
-	~DNS_MsgInfo();
 
-	Val* BuildHdrVal();
-	Val* BuildAnswerVal();
-	Val* BuildEDNS_Val();
-	Val* BuildTSIG_Val(struct TSIG_DATA*);
-	Val* BuildRRSIG_Val(struct RRSIG_DATA*);
-	Val* BuildDNSKEY_Val(struct DNSKEY_DATA*);
-	Val* BuildNSEC3_Val(struct NSEC3_DATA*);
-	Val* BuildDS_Val(struct DS_DATA*);
+	IntrusivePtr<RecordVal> BuildHdrVal();
+	IntrusivePtr<RecordVal> BuildAnswerVal();
+	IntrusivePtr<RecordVal> BuildEDNS_Val();
+	IntrusivePtr<RecordVal> BuildTSIG_Val(struct TSIG_DATA*);
+	IntrusivePtr<RecordVal> BuildRRSIG_Val(struct RRSIG_DATA*);
+	IntrusivePtr<RecordVal> BuildDNSKEY_Val(struct DNSKEY_DATA*);
+	IntrusivePtr<RecordVal> BuildNSEC3_Val(struct NSEC3_DATA*);
+	IntrusivePtr<RecordVal> BuildDS_Val(struct DS_DATA*);
 
 	int id;
 	int opcode;	///< query type, see DNS_Opcode
@@ -204,7 +203,7 @@ public:
 	int arcount;	///< number of additional RRs
 	int is_query;	///< whether it came from the session initiator
 
-	StringVal* query_name;
+	IntrusivePtr<StringVal> query_name;
 	RR_Type atype;
 	int aclass;	///< normally = 1, inet
 	uint32_t ttl;
diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif
index 6dff964042..204481b575 100644
--- a/src/analyzer/protocol/ftp/functions.bif
+++ b/src/analyzer/protocol/ftp/functions.bif
@@ -6,7 +6,7 @@ type ftp_port: record;
 
 static IntrusivePtr<Val> parse_port(const char* line)
 	{
-	auto r = make_intrusive<RecordVal>(BifType::Record::ftp_port);
+	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::ftp_port);
 
 	int bytes[6];
 	if ( line && sscanf(line, "%d,%d,%d,%d,%d,%d",
@@ -49,7 +49,7 @@ static IntrusivePtr<Val> parse_port(const char* line)
 
 static IntrusivePtr<Val> parse_eftp(const char* line)
 	{
-	auto r = make_intrusive<RecordVal>(BifType::Record::ftp_port);
+	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::ftp_port);
 
 	int net_proto = 0;	// currently not used
 	IPAddr addr;	// unspecified IPv6 address (all 128 bits zero)
diff --git a/src/analyzer/protocol/gssapi/gssapi-analyzer.pac b/src/analyzer/protocol/gssapi/gssapi-analyzer.pac
index b92468c04d..48c3e086fd 100644
--- a/src/analyzer/protocol/gssapi/gssapi-analyzer.pac
+++ b/src/analyzer/protocol/gssapi/gssapi-analyzer.pac
@@ -61,7 +61,7 @@ refine connection GSSAPI_Conn += {
 		%{
 		if ( gssapi_neg_result )
 			{
-			BifEvent::enqueue_gssapi_neg_result(bro_analyzer(),
+			zeek::BifEvent::enqueue_gssapi_neg_result(bro_analyzer(),
 			                                    bro_analyzer()->Conn(),
 			                                    binary_to_int64(${val.neg_state.encoding.content}));
 			}
diff --git a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
index a804dfbbcd..00eae1b5f1 100644
--- a/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
+++ b/src/analyzer/protocol/gtpv1/gtpv1-analyzer.pac
@@ -6,7 +6,7 @@
 %code{
 IntrusivePtr<RecordVal> BuildGTPv1Hdr(const GTPv1_Header* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(BifType::Record::gtpv1_hdr);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::gtpv1_hdr);
 
 	rv->Assign(0, val_mgr->Count(pdu->version()));
 	rv->Assign(1, val_mgr->Bool(pdu->pt_flag()));
@@ -35,7 +35,7 @@ static IntrusivePtr<Val> BuildIMSI(const InformationElement* ie)
 
 static IntrusivePtr<Val> BuildRAI(const InformationElement* ie)
 	{
-	auto ev = make_intrusive<RecordVal>(BifType::Record::gtp_rai);
+	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_rai);
 	ev->Assign(0, val_mgr->Count(ie->rai()->mcc()));
 	ev->Assign(1, val_mgr->Count(ie->rai()->mnc()));
 	ev->Assign(2, val_mgr->Count(ie->rai()->lac()));
@@ -83,9 +83,9 @@ static IntrusivePtr<Val> BuildTraceType(const InformationElement* ie)
 	return val_mgr->Count(ie->trace_type()->value());
 	}
 
-Val* BuildEndUserAddr(const InformationElement* ie)
+IntrusivePtr<Val> BuildEndUserAddr(const InformationElement* ie)
 	{
-	RecordVal* ev = new RecordVal(BifType::Record::gtp_end_user_addr);
+	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_end_user_addr);
 	ev->Assign(0, val_mgr->Count(ie->end_user_addr()->pdp_type_org()));
 	ev->Assign(1, val_mgr->Count(ie->end_user_addr()->pdp_type_num()));
 
@@ -114,23 +114,23 @@ Val* BuildEndUserAddr(const InformationElement* ie)
 	return ev;
 	}
 
-Val* BuildAccessPointName(const InformationElement* ie)
+IntrusivePtr<Val> BuildAccessPointName(const InformationElement* ie)
 	{
 	BroString* bs = new BroString((const u_char*) ie->ap_name()->value().data(),
 	                              ie->ap_name()->value().length(), false);
-	return new StringVal(bs);
+	return make_intrusive<StringVal>(bs);
 	}
 
-Val* BuildProtoConfigOptions(const InformationElement* ie)
+IntrusivePtr<Val> BuildProtoConfigOptions(const InformationElement* ie)
 	{
 	const u_char* d = (const u_char*) ie->proto_config_opts()->value().data();
 	int len = ie->proto_config_opts()->value().length();
-	return new StringVal(new BroString(d, len, false));
+	return make_intrusive<StringVal>(new BroString(d, len, false));
 	}
 
-Val* BuildGSN_Addr(const InformationElement* ie)
+IntrusivePtr<Val> BuildGSN_Addr(const InformationElement* ie)
 	{
-	RecordVal* ev = new RecordVal(BifType::Record::gtp_gsn_addr);
+	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_gsn_addr);
 
 	int len = ie->gsn_addr()->value().length();
 	const uint8* d = ie->gsn_addr()->value().data();
@@ -147,16 +147,16 @@ Val* BuildGSN_Addr(const InformationElement* ie)
 	return ev;
 	}
 
-Val* BuildMSISDN(const InformationElement* ie)
+IntrusivePtr<Val> BuildMSISDN(const InformationElement* ie)
 	{
 	const u_char* d = (const u_char*) ie->msisdn()->value().data();
 	int len = ie->msisdn()->value().length();
-	return new StringVal(new BroString(d, len, false));
+	return make_intrusive<StringVal>(new BroString(d, len, false));
 	}
 
-Val* BuildQoS_Profile(const InformationElement* ie)
+IntrusivePtr<Val> BuildQoS_Profile(const InformationElement* ie)
 	{
-	RecordVal* ev = new RecordVal(BifType::Record::gtp_qos_profile);
+	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_qos_profile);
 
 	const u_char* d = (const u_char*) ie->qos_profile()->data().data();
 	int len = ie->qos_profile()->data().length();
@@ -167,30 +167,30 @@ Val* BuildQoS_Profile(const InformationElement* ie)
 	return ev;
 	}
 
-Val* BuildTrafficFlowTemplate(const InformationElement* ie)
+IntrusivePtr<Val> BuildTrafficFlowTemplate(const InformationElement* ie)
 	{
 	const uint8* d = ie->traffic_flow_template()->value().data();
 	int len = ie->traffic_flow_template()->value().length();
-	return new StringVal(new BroString((const u_char*) d, len, false));
+	return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
 	}
 
-Val* BuildTriggerID(const InformationElement* ie)
+IntrusivePtr<Val> BuildTriggerID(const InformationElement* ie)
 	{
 	const uint8* d = ie->trigger_id()->value().data();
 	int len = ie->trigger_id()->value().length();
-	return new StringVal(new BroString((const u_char*) d, len, false));
+	return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
 	}
 
-Val* BuildOMC_ID(const InformationElement* ie)
+IntrusivePtr<Val> BuildOMC_ID(const InformationElement* ie)
 	{
 	const uint8* d = ie->omc_id()->value().data();
 	int len = ie->omc_id()->value().length();
-	return new StringVal(new BroString((const u_char*) d, len, false));
+	return make_intrusive<StringVal>(new BroString((const u_char*) d, len, false));
 	}
 
-Val* BuildPrivateExt(const InformationElement* ie)
+IntrusivePtr<Val> BuildPrivateExt(const InformationElement* ie)
 	{
-	RecordVal* ev = new RecordVal(BifType::Record::gtp_private_extension);
+	auto ev = make_intrusive<RecordVal>(zeek::BifType::Record::gtp_private_extension);
 
 	const uint8* d = ie->private_ext()->value().data();
 	int len = ie->private_ext()->value().length();
@@ -216,16 +216,16 @@ static IntrusivePtr<Val> BuildChargingID(const InformationElement* ie)
 	return val_mgr->Count(ie->charging_id()->value());;
 	}
 
-Val* BuildChargingGatewayAddr(const InformationElement* ie)
+IntrusivePtr<Val> BuildChargingGatewayAddr(const InformationElement* ie)
 	{
 	const uint8* d = ie->charging_gateway_addr()->value().data();
 	int len = ie->charging_gateway_addr()->value().length();
 	if ( len == 4 )
-		return new AddrVal(IPAddr(IPv4, (const uint32*) d, IPAddr::Network));
+		return make_intrusive<AddrVal>(IPAddr(IPv4, (const uint32*) d, IPAddr::Network));
 	else if ( len == 16 )
-		return new AddrVal(IPAddr(IPv6, (const uint32*) d, IPAddr::Network));
+		return make_intrusive<AddrVal>(IPAddr(IPv6, (const uint32*) d, IPAddr::Network));
 	else
-		return 0;
+		return nullptr;
 	}
 
 static IntrusivePtr<Val> BuildTeardownInd(const InformationElement* ie)
@@ -238,7 +238,7 @@ void CreatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	if ( ! ::gtpv1_create_pdp_ctx_request ) return;
 
 	auto rv = make_intrusive<RecordVal>(
-	  BifType::Record::gtp_create_pdp_ctx_request_elements);
+	  zeek::BifType::Record::gtp_create_pdp_ctx_request_elements);
 
 	const vector<InformationElement *> * v = pdu->create_pdp_ctx_request();
 
@@ -328,7 +328,7 @@ void CreatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 		}
 		}
 
-	BifEvent::enqueue_gtpv1_create_pdp_ctx_request(a, a->Conn(),
+	zeek::BifEvent::enqueue_gtpv1_create_pdp_ctx_request(a, a->Conn(),
 	                                               BuildGTPv1Hdr(pdu), std::move(rv));
 	}
 
@@ -338,7 +338,7 @@ void CreatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	    return;
 
 	auto rv = make_intrusive<RecordVal>(
-	  BifType::Record::gtp_create_pdp_ctx_response_elements);
+	  zeek::BifType::Record::gtp_create_pdp_ctx_response_elements);
 
 	const vector<InformationElement *> * v = pdu->create_pdp_ctx_response();
 
@@ -397,7 +397,7 @@ void CreatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 		}
 		}
 
-	BifEvent::enqueue_gtpv1_create_pdp_ctx_response(a, a->Conn(),
+	zeek::BifEvent::enqueue_gtpv1_create_pdp_ctx_response(a, a->Conn(),
 	                                                BuildGTPv1Hdr(pdu), std::move(rv));
 	}
 
@@ -407,7 +407,7 @@ void UpdatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	    return;
 
 	auto rv = make_intrusive<RecordVal>(
-	  BifType::Record::gtp_update_pdp_ctx_request_elements);
+	  zeek::BifType::Record::gtp_update_pdp_ctx_request_elements);
 
 	const vector<InformationElement *> * v = pdu->update_pdp_ctx_request();
 
@@ -475,7 +475,7 @@ void UpdatePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 		}
 		}
 
-	BifEvent::enqueue_gtpv1_update_pdp_ctx_request(a, a->Conn(),
+	zeek::BifEvent::enqueue_gtpv1_update_pdp_ctx_request(a, a->Conn(),
 	                                               BuildGTPv1Hdr(pdu), std::move(rv));
 	}
 
@@ -485,7 +485,7 @@ void UpdatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	    return;
 
 	auto rv = make_intrusive<RecordVal>(
-	  BifType::Record::gtp_update_pdp_ctx_response_elements);
+	  zeek::BifType::Record::gtp_update_pdp_ctx_response_elements);
 
 	const vector<InformationElement *> * v = pdu->update_pdp_ctx_response();
 
@@ -535,7 +535,7 @@ void UpdatePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 		}
 		}
 
-	BifEvent::enqueue_gtpv1_update_pdp_ctx_response(a, a->Conn(),
+	zeek::BifEvent::enqueue_gtpv1_update_pdp_ctx_response(a, a->Conn(),
 	                                                BuildGTPv1Hdr(pdu), std::move(rv));
 	}
 
@@ -545,7 +545,7 @@ void DeletePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	    return;
 
 	auto rv = make_intrusive<RecordVal>(
-	  BifType::Record::gtp_delete_pdp_ctx_request_elements);
+	  zeek::BifType::Record::gtp_delete_pdp_ctx_request_elements);
 
 	const vector<InformationElement *> * v = pdu->delete_pdp_ctx_request();
 
@@ -569,7 +569,7 @@ void DeletePDP_Request(const BroAnalyzer& a, const GTPv1_Header* pdu)
 		}
 		}
 
-	BifEvent::enqueue_gtpv1_delete_pdp_ctx_request(a, a->Conn(),
+	zeek::BifEvent::enqueue_gtpv1_delete_pdp_ctx_request(a, a->Conn(),
 	                                               BuildGTPv1Hdr(pdu), std::move(rv));
 	}
 
@@ -579,7 +579,7 @@ void DeletePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 	    return;
 
 	auto rv = make_intrusive<RecordVal>(
-	  BifType::Record::gtp_delete_pdp_ctx_response_elements);
+	  zeek::BifType::Record::gtp_delete_pdp_ctx_response_elements);
 
 	const vector<InformationElement *> * v = pdu->delete_pdp_ctx_response();
 
@@ -600,7 +600,7 @@ void DeletePDP_Response(const BroAnalyzer& a, const GTPv1_Header* pdu)
 		}
 		}
 
-	BifEvent::enqueue_gtpv1_delete_pdp_ctx_response(a, a->Conn(),
+	zeek::BifEvent::enqueue_gtpv1_delete_pdp_ctx_response(a, a->Conn(),
 	                                                BuildGTPv1Hdr(pdu), std::move(rv));
 	}
 %}
@@ -652,7 +652,7 @@ flow GTPv1_Flow(is_orig: bool)
 
 		connection()->set_valid(is_orig(), false);
 
-		if ( e && e->Depth() >= BifConst::Tunnel::max_depth )
+		if ( e && e->Depth() >= zeek::BifConst::Tunnel::max_depth )
 			{
 			reporter->Weird(c, "tunnel_depth");
 			return false;
@@ -679,7 +679,7 @@ flow GTPv1_Flow(is_orig: bool)
 			}
 
 		if ( ::gtpv1_message )
-			BifEvent::enqueue_gtpv1_message(a, c, BuildGTPv1Hdr(pdu));
+			zeek::BifEvent::enqueue_gtpv1_message(a, c, BuildGTPv1Hdr(pdu));
 
 		switch ( ${pdu.msg_type} ) {
 		case 16:
@@ -738,7 +738,7 @@ flow GTPv1_Flow(is_orig: bool)
 			{
 			connection()->set_valid(is_orig(), true);
 
-			if ( (! BifConst::Tunnel::delay_gtp_confirmation) ||
+			if ( (! zeek::BifConst::Tunnel::delay_gtp_confirmation) ||
 			     (connection()->valid(true) && connection()->valid(false)) )
 				a->ProtocolConfirmation();
 			}
@@ -759,8 +759,8 @@ flow GTPv1_Flow(is_orig: bool)
 			}
 
 		if ( ::gtpv1_g_pdu_packet )
-			BifEvent::enqueue_gtpv1_g_pdu_packet(a, c, BuildGTPv1Hdr(pdu),
-			                                     {AdoptRef{}, inner->BuildPktHdrVal()});
+			zeek::BifEvent::enqueue_gtpv1_g_pdu_packet(a, c, BuildGTPv1Hdr(pdu),
+			                                     inner->ToPktHdrVal());
 
 		EncapsulatingConn ec(c, BifEnum::Tunnel::GTPv1);
 
diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index 94412b110f..c8f2689dca 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -613,9 +613,10 @@ HTTP_Message::~HTTP_Message()
 	delete [] entity_data_buffer;
 	}
 
-Val* HTTP_Message::BuildMessageStat(bool interrupted, const char* msg)
+IntrusivePtr<RecordVal> HTTP_Message::BuildMessageStat(bool interrupted, const char* msg)
 	{
-	RecordVal* stat = new RecordVal(http_message_stat);
+	static auto http_message_stat = zeek::id::find_type<RecordType>("http_message_stat");
+	auto stat = make_intrusive<RecordVal>(http_message_stat);
 	int field = 0;
 	stat->Assign(field++, make_intrusive<Val>(start_time, TYPE_TIME));
 	stat->Assign(field++, val_mgr->Bool(interrupted));
@@ -652,7 +653,7 @@ void HTTP_Message::Done(bool interrupted, const char* detail)
 		GetAnalyzer()->EnqueueConnEvent(http_message_done,
 			analyzer->ConnVal(),
 			val_mgr->Bool(is_orig),
-			IntrusivePtr{AdoptRef{}, BuildMessageStat(interrupted, detail)}
+			BuildMessageStat(interrupted, detail)
 		);
 
 	MyHTTP_Analyzer()->HTTP_MessageDone(is_orig, this);
@@ -737,21 +738,16 @@ void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist)
 		analyzer->EnqueueConnEvent(http_all_headers,
 			analyzer->ConnVal(),
 			val_mgr->Bool(is_orig),
-			IntrusivePtr{AdoptRef{}, BuildHeaderTable(hlist)}
+			ToHeaderTable(hlist)
 		);
 
 	if ( http_content_type )
-		{
-		StringVal* ty = current_entity->ContentType();
-		StringVal* subty = current_entity->ContentSubType();
-
 		analyzer->EnqueueConnEvent(http_content_type,
 			analyzer->ConnVal(),
 			val_mgr->Bool(is_orig),
-			IntrusivePtr{NewRef{}, ty},
-			IntrusivePtr{NewRef{}, subty}
+			current_entity->GetContentType(),
+			current_entity->GetContentSubType()
 		);
-		}
 	}
 
 void HTTP_Message::SubmitTrailingHeaders(mime::MIME_HeaderList& /* hlist */)
@@ -814,7 +810,7 @@ void HTTP_Message::SetPlainDelivery(int64_t length)
 	{
 	content_line->SetPlainDelivery(length);
 
-	if ( length > 0 && BifConst::skip_http_data )
+	if ( length > 0 && zeek::BifConst::skip_http_data )
 		content_line->SkipBytesAfterThisLine(length);
 	}
 
@@ -842,12 +838,9 @@ HTTP_Analyzer::HTTP_Analyzer(Connection* conn)
 	reply_state = EXPECT_REPLY_LINE;
 
 	request_ongoing = 0;
-	request_method = request_URI = nullptr;
-	unescaped_URI = nullptr;
 
 	reply_ongoing = 0;
 	reply_code = 0;
-	reply_reason_phrase = nullptr;
 
 	connect_request = false;
 	pia = nullptr;
@@ -863,14 +856,6 @@ HTTP_Analyzer::HTTP_Analyzer(Connection* conn)
 	AddSupportAnalyzer(content_line_resp);
 	}
 
-HTTP_Analyzer::~HTTP_Analyzer()
-	{
-	Unref(request_method);
-	Unref(request_URI);
-	Unref(unescaped_URI);
-	Unref(reply_reason_phrase);
-	}
-
 void HTTP_Analyzer::Done()
 	{
 	if ( IsFinished() )
@@ -889,11 +874,7 @@ void HTTP_Analyzer::Done()
 
 	GenStats();
 
-	while ( ! unanswered_requests.empty() )
-		{
-		Unref(unanswered_requests.front());
-		unanswered_requests.pop();
-		}
+	unanswered_requests = {};
 
 	file_mgr->EndOfFile(GetAnalyzerTag(), Conn(), true);
 
@@ -947,7 +928,7 @@ void HTTP_Analyzer::DeliverStream(int len, const u_char* data, bool is_orig)
 		return;
 		}
 
-	// HTTP_Event("HTTP line", new_string_val(length, line));
+	// HTTP_Event("HTTP line", to_string_val(length, line));
 
 	if ( is_orig )
 		{
@@ -970,7 +951,7 @@ void HTTP_Analyzer::DeliverStream(int len, const u_char* data, bool is_orig)
 
 				request_state = EXPECT_REQUEST_MESSAGE;
 				request_ongoing = 1;
-				unanswered_requests.push(request_method->Ref());
+				unanswered_requests.push(request_method);
 				HTTP_Request();
 				InitHTTPMessage(content_line, request_message,
 						is_orig, HTTP_BODY_MAYBE, len);
@@ -980,7 +961,7 @@ void HTTP_Analyzer::DeliverStream(int len, const u_char* data, bool is_orig)
 				{
 				if ( ! RequestExpected() )
 					HTTP_Event("crud_trailing_HTTP_request",
-						   mime::new_string_val(line, end_of_line));
+						   mime::to_string_val(line, end_of_line));
 				else
 					{
 					// We do see HTTP requests with a
@@ -1171,6 +1152,7 @@ void HTTP_Analyzer::GenStats()
 	{
 	if ( http_stats )
 		{
+		static auto http_stats_rec = zeek::id::find_type<RecordType>("http_stats_rec");
 		auto r = make_intrusive<RecordVal>(http_stats_rec);
 		r->Assign(0, val_mgr->Count(num_requests));
 		r->Assign(1, val_mgr->Count(num_replies));
@@ -1260,7 +1242,7 @@ int HTTP_Analyzer::HTTP_RequestLine(const char* line, const char* end_of_line)
 		return -1;
 		}
 
-	request_method = new StringVal(end_of_method - line, line);
+	request_method = make_intrusive<StringVal>(end_of_method - line, line);
 
 	Conn()->Match(Rule::HTTP_REQUEST,
 			(const u_char*) unescaped_URI->AsString()->Bytes(),
@@ -1322,17 +1304,17 @@ bool HTTP_Analyzer::ParseRequest(const char* line, const char* end_of_line)
 			version_end = version_start + 3;
 			if ( skip_whitespace(version_end, end_of_line) != end_of_line )
 				HTTP_Event("crud after HTTP version is ignored",
-					   mime::new_string_val(line, end_of_line));
+					   mime::to_string_val(line, end_of_line));
 			}
 		else
-			HTTP_Event("bad_HTTP_version", mime::new_string_val(line, end_of_line));
+			HTTP_Event("bad_HTTP_version", mime::to_string_val(line, end_of_line));
 		}
 
 	// NormalizeURI(line, end_of_uri);
 
-	request_URI = new StringVal(end_of_uri - line, line);
-	unescaped_URI = new StringVal(unescape_URI((const u_char*) line,
-					(const u_char*) end_of_uri, this));
+	request_URI = make_intrusive<StringVal>(end_of_uri - line, line);
+	unescaped_URI = make_intrusive<StringVal>(
+	    unescape_URI((const u_char*) line, (const u_char*) end_of_uri, this));
 
 	return true;
 	}
@@ -1351,7 +1333,7 @@ HTTP_Analyzer::HTTP_VersionNumber HTTP_Analyzer::HTTP_Version(int len, const cha
 		}
 	else
 		{
-	        HTTP_Event("bad_HTTP_version", mime::new_string_val(len, data));
+		HTTP_Event("bad_HTTP_version", mime::to_string_val(len, data));
 		return {};
 		}
 	}
@@ -1370,23 +1352,21 @@ void HTTP_Analyzer::SetVersion(HTTP_VersionNumber* version, HTTP_VersionNumber n
 
 void HTTP_Analyzer::HTTP_Event(const char* category, const char* detail)
 	{
-	HTTP_Event(category, new StringVal(detail));
+	HTTP_Event(category, make_intrusive<StringVal>(detail));
 	}
 
-void HTTP_Analyzer::HTTP_Event(const char* category, StringVal* detail)
+void HTTP_Analyzer::HTTP_Event(const char* category, IntrusivePtr<StringVal> detail)
 	{
 	if ( http_event )
 		// DEBUG_MSG("%.6f http_event\n", network_time);
 		EnqueueConnEvent(http_event,
 			ConnVal(),
 			make_intrusive<StringVal>(category),
-			IntrusivePtr{AdoptRef{}, detail}
-		);
-	else
-		Unref(detail);
+			std::move(detail));
 	}
 
-StringVal* HTTP_Analyzer::TruncateURI(StringVal* uri)
+IntrusivePtr<StringVal>
+HTTP_Analyzer::TruncateURI(const IntrusivePtr<StringVal>& uri)
 	{
 	const BroString* str = uri->AsString();
 
@@ -1395,13 +1375,10 @@ StringVal* HTTP_Analyzer::TruncateURI(StringVal* uri)
 		u_char* s = new u_char[truncate_http_URI + 4];
 		memcpy(s, str->Bytes(), truncate_http_URI);
 		memcpy(s + truncate_http_URI, "...", 4);
-		return new StringVal(new BroString(true, s, truncate_http_URI+3));
+		return make_intrusive<StringVal>(new BroString(true, s, truncate_http_URI+3));
 		}
 	else
-		{
-		Ref(uri);
 		return uri;
-		}
 	}
 
 void HTTP_Analyzer::HTTP_Request()
@@ -1418,9 +1395,9 @@ void HTTP_Analyzer::HTTP_Request()
 		// DEBUG_MSG("%.6f http_request\n", network_time);
 		EnqueueConnEvent(http_request,
 			ConnVal(),
-			IntrusivePtr{NewRef{}, request_method},
-			IntrusivePtr{AdoptRef{}, TruncateURI(request_URI->AsStringVal())},
-			IntrusivePtr{AdoptRef{}, TruncateURI(unescaped_URI->AsStringVal())},
+			request_method,
+			TruncateURI(request_URI),
+			TruncateURI(unescaped_URI),
 			make_intrusive<StringVal>(fmt("%.1f", request_version.ToDouble()))
 		);
 	}
@@ -1433,14 +1410,11 @@ void HTTP_Analyzer::HTTP_Reply()
 			make_intrusive<StringVal>(fmt("%.1f", reply_version.ToDouble())),
 			val_mgr->Count(reply_code),
 			reply_reason_phrase ?
-				IntrusivePtr{NewRef{}, reply_reason_phrase} :
+				reply_reason_phrase :
 				make_intrusive<StringVal>("<empty>")
 		);
 	else
-		{
-		Unref(reply_reason_phrase);
 		reply_reason_phrase = nullptr;
-		}
 	}
 
 void HTTP_Analyzer::RequestMade(bool interrupted, const char* msg)
@@ -1455,11 +1429,9 @@ void HTTP_Analyzer::RequestMade(bool interrupted, const char* msg)
 
 	// DEBUG_MSG("%.6f request made\n", network_time);
 
-	Unref(request_method);
-	Unref(unescaped_URI);
-	Unref(request_URI);
-
-	request_method = request_URI = unescaped_URI = nullptr;
+	request_method = nullptr;
+	unescaped_URI = nullptr;
+	request_URI = nullptr;
 
 	num_request_lines = 0;
 
@@ -1484,16 +1456,10 @@ void HTTP_Analyzer::ReplyMade(bool interrupted, const char* msg)
 	// 1xx replies do not indicate the final response to a request,
 	// so don't pop an unanswered request in that case.
 	if ( (reply_code < 100 || reply_code >= 200) && ! unanswered_requests.empty() )
-		{
-		Unref(unanswered_requests.front());
 		unanswered_requests.pop();
-		}
 
 	if ( reply_reason_phrase )
-		{
-		Unref(reply_reason_phrase);
 		reply_reason_phrase = nullptr;
-		}
 
 	// unanswered requests = 1 because there is no pop after 101.
 	if ( reply_code == 101 && unanswered_requests.size() == 1 && upgrade_connection &&
@@ -1543,7 +1509,7 @@ int HTTP_Analyzer::HTTP_ReplyLine(const char* line, const char* end_of_line)
 		// ##TODO: some server replies with an HTML document
 		// without a status line and a MIME header, when the
 		// request is malformed.
-		HTTP_Event("bad_HTTP_reply", mime::new_string_val(line, end_of_line));
+		HTTP_Event("bad_HTTP_reply", mime::to_string_val(line, end_of_line));
 		return 0;
 		}
 
@@ -1556,7 +1522,7 @@ int HTTP_Analyzer::HTTP_ReplyLine(const char* line, const char* end_of_line)
 	if ( rest >= end_of_line )
 		{
 		HTTP_Event("HTTP_reply_code_missing",
-				mime::new_string_val(line, end_of_line));
+				mime::to_string_val(line, end_of_line));
 		return 0;
 		}
 
@@ -1565,7 +1531,7 @@ int HTTP_Analyzer::HTTP_ReplyLine(const char* line, const char* end_of_line)
 	if ( rest + 3 > end_of_line )
 		{
 		HTTP_Event("HTTP_reply_code_missing",
-			mime::new_string_val(line, end_of_line));
+			mime::to_string_val(line, end_of_line));
 		return 0;
 		}
 
@@ -1578,14 +1544,14 @@ int HTTP_Analyzer::HTTP_ReplyLine(const char* line, const char* end_of_line)
 	if ( rest >= end_of_line )
 		{
 		HTTP_Event("HTTP_reply_reason_phrase_missing",
-			mime::new_string_val(line, end_of_line));
+			mime::to_string_val(line, end_of_line));
 		// Tolerate missing reason phrase?
 		return 1;
 		}
 
 	rest = skip_whitespace(rest, end_of_line);
 	reply_reason_phrase =
-		new StringVal(end_of_line - rest, (const char *) rest);
+	    make_intrusive<StringVal>(end_of_line - rest, (const char *) rest);
 
 	return 1;
 	}
@@ -1669,12 +1635,15 @@ void HTTP_Analyzer::HTTP_Header(bool is_orig, mime::MIME_Header* h)
 		if ( DEBUG_http )
 			DEBUG_MSG("%.6f http_header\n", network_time);
 
+		auto upper_hn = mime::to_string_val(h->get_name());
+		upper_hn->ToUpper();
+
 		EnqueueConnEvent(http_header,
 			ConnVal(),
 			val_mgr->Bool(is_orig),
-			IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())},
-			IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())->ToUpper()},
-			IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_value())}
+			mime::to_string_val(h->get_name()),
+			std::move(upper_hn),
+			mime::to_string_val(h->get_value())
 		);
 		}
 	}
diff --git a/src/analyzer/protocol/http/HTTP.h b/src/analyzer/protocol/http/HTTP.h
index 20a1e1f239..63ddfbbb7c 100644
--- a/src/analyzer/protocol/http/HTTP.h
+++ b/src/analyzer/protocol/http/HTTP.h
@@ -145,19 +145,18 @@ protected:
 
 	HTTP_Entity* current_entity;
 
-	Val* BuildMessageStat(bool interrupted, const char* msg);
+	IntrusivePtr<RecordVal> BuildMessageStat(bool interrupted, const char* msg);
 };
 
 class HTTP_Analyzer final : public tcp::TCP_ApplicationAnalyzer {
 public:
 	HTTP_Analyzer(Connection* conn);
-	~HTTP_Analyzer() override;
 
 	void HTTP_Header(bool is_orig, mime::MIME_Header* h);
 	void HTTP_EntityData(bool is_orig, BroString* entity_data);
 	void HTTP_MessageDone(bool is_orig, HTTP_Message* message);
 	void HTTP_Event(const char* category, const char* detail);
-	void HTTP_Event(const char* category, StringVal *detail);
+	void HTTP_Event(const char* category, IntrusivePtr<StringVal> detail);
 
 	void SkipEntityData(bool is_orig);
 
@@ -238,7 +237,7 @@ protected:
 	int HTTP_ReplyCode(const char* code_str);
 	int ExpectReplyMessageBody();
 
-	StringVal* TruncateURI(StringVal* uri);
+	IntrusivePtr<StringVal> TruncateURI(const IntrusivePtr<StringVal>& uri);
 
 	int request_state, reply_state;
 	int num_requests, num_replies;
@@ -258,19 +257,19 @@ protected:
 	// in a reply.
 	std::string upgrade_protocol;
 
-	Val* request_method;
+	IntrusivePtr<StringVal> request_method;
 
 	// request_URI is in the original form (may contain '%<hex><hex>'
 	// sequences).
-	Val* request_URI;
+	IntrusivePtr<StringVal> request_URI;
 
 	// unescaped_URI does not contain escaped sequences.
-	Val* unescaped_URI;
+	IntrusivePtr<StringVal> unescaped_URI;
 
-	std::queue<Val*> unanswered_requests;
+	std::queue<IntrusivePtr<StringVal>> unanswered_requests;
 
 	int reply_code;
-	Val* reply_reason_phrase;
+	IntrusivePtr<StringVal> reply_reason_phrase;
 
 	tcp::ContentLine_Analyzer* content_line_orig;
 	tcp::ContentLine_Analyzer* content_line_resp;
diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc
index 7363c3c429..664a5a8cdd 100644
--- a/src/analyzer/protocol/icmp/ICMP.cc
+++ b/src/analyzer/protocol/icmp/ICMP.cc
@@ -30,7 +30,7 @@ ICMP_Analyzer::ICMP_Analyzer(Connection* c)
 void ICMP_Analyzer::Done()
 	{
 	TransportLayerAnalyzer::Done();
-	Unref(icmp_conn_val);
+	icmp_conn_val = nullptr;
 	matcher_state.FinishEndpointMatcher();
 	}
 
@@ -204,7 +204,7 @@ void ICMP_Analyzer::ICMP_Sent(const struct icmp* icmpp, int len, int caplen,
 	if ( icmp_sent )
 		EnqueueConnEvent(icmp_sent,
 			ConnVal(),
-			IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, icmpv6, ip_hdr)}
+			BuildICMPVal(icmpp, len, icmpv6, ip_hdr)
 		);
 
 	if ( icmp_sent_payload )
@@ -213,18 +213,20 @@ void ICMP_Analyzer::ICMP_Sent(const struct icmp* icmpp, int len, int caplen,
 
 		EnqueueConnEvent(icmp_sent_payload,
 			ConnVal(),
-			IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, icmpv6, ip_hdr)},
+			BuildICMPVal(icmpp, len, icmpv6, ip_hdr),
 			make_intrusive<StringVal>(payload)
 		);
 		}
 	}
 
-RecordVal* ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
-                                       int icmpv6, const IP_Hdr* ip_hdr)
+IntrusivePtr<RecordVal>
+ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
+                            int icmpv6, const IP_Hdr* ip_hdr)
 	{
 	if ( ! icmp_conn_val )
 		{
-		icmp_conn_val = new RecordVal(icmp_conn);
+		static auto icmp_conn = zeek::id::find_type<RecordType>("icmp_conn");
+		icmp_conn_val = make_intrusive<RecordVal>(icmp_conn);
 
 		icmp_conn_val->Assign(0, make_intrusive<AddrVal>(Conn()->OrigAddr()));
 		icmp_conn_val->Assign(1, make_intrusive<AddrVal>(Conn()->RespAddr()));
@@ -235,8 +237,6 @@ RecordVal* ICMP_Analyzer::BuildICMPVal(const struct icmp* icmpp, int len,
 		icmp_conn_val->Assign(6, val_mgr->Bool(icmpv6));
 		}
 
-	Ref(icmp_conn_val);
-
 	return icmp_conn_val;
 	}
 
@@ -305,7 +305,7 @@ TransportProto ICMP_Analyzer::GetContextProtocol(const IP_Hdr* ip_hdr, uint32_t*
 	return proto;
 	}
 
-RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
+IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
 	{
 	const IP_Hdr ip_hdr_data((const struct ip*) data, false);
 	const IP_Hdr* ip_hdr = &ip_hdr_data;
@@ -351,15 +351,16 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
 			}
 		}
 
-	RecordVal* iprec = new RecordVal(icmp_context);
-	RecordVal* id_val = new RecordVal(conn_id);
+	static auto icmp_context = zeek::id::find_type<RecordType>("icmp_context");
+	auto iprec = make_intrusive<RecordVal>(icmp_context);
+	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
 
 	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->Port(src_port, proto));
 	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->Port(dst_port, proto));
 
-	iprec->Assign(0, id_val);
+	iprec->Assign(0, std::move(id_val));
 	iprec->Assign(1, val_mgr->Count(ip_len));
 	iprec->Assign(2, val_mgr->Count(proto));
 	iprec->Assign(3, val_mgr->Count(frag_offset));
@@ -371,7 +372,7 @@ RecordVal* ICMP_Analyzer::ExtractICMP4Context(int len, const u_char*& data)
 	return iprec;
 	}
 
-RecordVal* ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
+IntrusivePtr<RecordVal> ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
 	{
 	int DF = 0, MF = 0, bad_hdr_len = 0;
 	TransportProto proto = TRANSPORT_UNKNOWN;
@@ -410,15 +411,16 @@ RecordVal* ICMP_Analyzer::ExtractICMP6Context(int len, const u_char*& data)
 			}
 		}
 
-	RecordVal* iprec = new RecordVal(icmp_context);
-	RecordVal* id_val = new RecordVal(conn_id);
+	static auto icmp_context = zeek::id::find_type<RecordType>("icmp_context");
+	auto iprec = make_intrusive<RecordVal>(icmp_context);
+	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
 
 	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
 	id_val->Assign(1, val_mgr->Port(src_port, proto));
 	id_val->Assign(2, make_intrusive<AddrVal>(dst_addr));
 	id_val->Assign(3, val_mgr->Port(dst_port, proto));
 
-	iprec->Assign(0, id_val);
+	iprec->Assign(0, std::move(id_val));
 	iprec->Assign(1, val_mgr->Count(ip_len));
 	iprec->Assign(2, val_mgr->Count(proto));
 	iprec->Assign(3, val_mgr->Count(frag_offset));
@@ -457,8 +459,8 @@ void ICMP_Analyzer::Describe(ODesc* d) const
 
 void ICMP_Analyzer::UpdateConnVal(RecordVal *conn_val)
 	{
-	RecordVal *orig_endp = conn_val->Lookup("orig")->AsRecordVal();
-	RecordVal *resp_endp = conn_val->Lookup("resp")->AsRecordVal();
+	const auto& orig_endp = conn_val->GetField("orig");
+	const auto& resp_endp = conn_val->GetField("resp");
 
 	UpdateEndpointVal(orig_endp, true);
 	UpdateEndpointVal(resp_endp, false);
@@ -467,11 +469,13 @@ void ICMP_Analyzer::UpdateConnVal(RecordVal *conn_val)
 	Analyzer::UpdateConnVal(conn_val);
 	}
 
-void ICMP_Analyzer::UpdateEndpointVal(RecordVal* endp, bool is_orig)
+void ICMP_Analyzer::UpdateEndpointVal(const IntrusivePtr<Val>& endp_arg, bool is_orig)
 	{
 	Conn()->EnableStatusUpdateTimer();
 
 	int size = is_orig ? request_len : reply_len;
+	auto endp = endp_arg->AsRecordVal();
+
 	if ( size < 0 )
 		{
 		endp->Assign(0, val_mgr->Count(0));
@@ -516,7 +520,7 @@ void ICMP_Analyzer::Echo(double t, const struct icmp* icmpp, int len,
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr)},
+		BuildICMPVal(icmpp, len, ip_hdr->NextProto() != IPPROTO_ICMP, ip_hdr),
 		val_mgr->Count(iid),
 		val_mgr->Count(iseq),
 		make_intrusive<StringVal>(payload)
@@ -544,7 +548,7 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
+		BuildICMPVal(icmpp, len, 1, ip_hdr),
 		val_mgr->Count(icmpp->icmp_num_addrs), // Cur Hop Limit
 		val_mgr->Bool(icmpp->icmp_wpa & 0x80), // Managed
 		val_mgr->Bool(icmpp->icmp_wpa & 0x40), // Other
@@ -555,7 +559,7 @@ void ICMP_Analyzer::RouterAdvert(double t, const struct icmp* icmpp, int len,
 		make_intrusive<IntervalVal>((double)ntohs(icmpp->icmp_lifetime), Seconds),
 		make_intrusive<IntervalVal>((double)ntohl(reachable), Milliseconds),
 		make_intrusive<IntervalVal>((double)ntohl(retrans), Milliseconds),
-		IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)}
+		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
 
@@ -577,12 +581,12 @@ void ICMP_Analyzer::NeighborAdvert(double t, const struct icmp* icmpp, int len,
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
+		BuildICMPVal(icmpp, len, 1, ip_hdr),
 		val_mgr->Bool(icmpp->icmp_num_addrs & 0x80), // Router
 		val_mgr->Bool(icmpp->icmp_num_addrs & 0x40), // Solicited
 		val_mgr->Bool(icmpp->icmp_num_addrs & 0x20), // Override
 		make_intrusive<AddrVal>(tgtaddr),
-		IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)}
+		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
 
@@ -604,9 +608,9 @@ void ICMP_Analyzer::NeighborSolicit(double t, const struct icmp* icmpp, int len,
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
+		BuildICMPVal(icmpp, len, 1, ip_hdr),
 		make_intrusive<AddrVal>(tgtaddr),
-		IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)}
+		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
 
@@ -631,10 +635,10 @@ void ICMP_Analyzer::Redirect(double t, const struct icmp* icmpp, int len,
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
+		BuildICMPVal(icmpp, len, 1, ip_hdr),
 		make_intrusive<AddrVal>(tgtaddr),
 		make_intrusive<AddrVal>(dstaddr),
-		IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)}
+		BuildNDOptionsVal(caplen - opt_offset, data + opt_offset)
 	);
 	}
 
@@ -649,8 +653,8 @@ void ICMP_Analyzer::RouterSolicit(double t, const struct icmp* icmpp, int len,
 
 	EnqueueConnEvent(f,
 		ConnVal(),
-		IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
-		IntrusivePtr{AdoptRef{}, BuildNDOptionsVal(caplen, data)}
+		BuildICMPVal(icmpp, len, 1, ip_hdr),
+		BuildNDOptionsVal(caplen, data)
 	);
 	}
 
@@ -674,9 +678,9 @@ void ICMP_Analyzer::Context4(double t, const struct icmp* icmpp,
 	if ( f )
 		EnqueueConnEvent(f,
 			ConnVal(),
-			IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 0, ip_hdr)},
+			BuildICMPVal(icmpp, len, 0, ip_hdr),
 			val_mgr->Count(icmpp->icmp_code),
-			IntrusivePtr{AdoptRef{}, ExtractICMP4Context(caplen, data)}
+			ExtractICMP4Context(caplen, data)
 		);
 	}
 
@@ -712,26 +716,19 @@ void ICMP_Analyzer::Context6(double t, const struct icmp* icmpp,
 	if ( f )
 		EnqueueConnEvent(f,
 			ConnVal(),
-			IntrusivePtr{AdoptRef{}, BuildICMPVal(icmpp, len, 1, ip_hdr)},
+			BuildICMPVal(icmpp, len, 1, ip_hdr),
 			val_mgr->Count(icmpp->icmp_code),
-			IntrusivePtr{AdoptRef{}, ExtractICMP6Context(caplen, data)}
+			ExtractICMP6Context(caplen, data)
 		);
 	}
 
-VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
+IntrusivePtr<VectorVal> ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 	{
-	static RecordType* icmp6_nd_option_type = nullptr;
-	static RecordType* icmp6_nd_prefix_info_type = nullptr;
+	static auto icmp6_nd_option_type = zeek::id::find_type<RecordType>("icmp6_nd_option");
+	static auto icmp6_nd_prefix_info_type = zeek::id::find_type<RecordType>("icmp6_nd_prefix_info");
 
-	if ( ! icmp6_nd_option_type )
-		{
-		icmp6_nd_option_type = internal_type("icmp6_nd_option")->AsRecordType();
-		icmp6_nd_prefix_info_type =
-		        internal_type("icmp6_nd_prefix_info")->AsRecordType();
-		}
-
-	VectorVal* vv = new VectorVal(
-	        internal_type("icmp6_nd_options")->AsVectorType());
+	auto vv = make_intrusive<VectorVal>(
+	        zeek::id::find_type<VectorType>("icmp6_nd_options"));
 
 	while ( caplen > 0 )
 		{
@@ -751,7 +748,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 			break;
 			}
 
-		RecordVal* rv = new RecordVal(icmp6_nd_option_type);
+		auto rv = make_intrusive<RecordVal>(icmp6_nd_option_type);
 		rv->Assign(0, val_mgr->Count(type));
 		rv->Assign(1, val_mgr->Count(length));
 
@@ -785,7 +782,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 			{
 			if ( caplen >= 30 )
 				{
-				RecordVal* info = new RecordVal(icmp6_nd_prefix_info_type);
+				auto info = make_intrusive<RecordVal>(icmp6_nd_prefix_info_type);
 				uint8_t prefix_len = *((const uint8_t*)(data));
 				bool L_flag = (*((const uint8_t*)(data + 1)) & 0x80) != 0;
 				bool A_flag = (*((const uint8_t*)(data + 1)) & 0x40) != 0;
@@ -798,7 +795,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 				info->Assign(3, make_intrusive<IntervalVal>((double)ntohl(valid_life), Seconds));
 				info->Assign(4, make_intrusive<IntervalVal>((double)ntohl(prefer_life), Seconds));
 				info->Assign(5, make_intrusive<AddrVal>(IPAddr(prefix)));
-				rv->Assign(3, info);
+				rv->Assign(3, std::move(info));
 				}
 
 			else
@@ -848,7 +845,7 @@ VectorVal* ICMP_Analyzer::BuildNDOptionsVal(int caplen, const u_char* data)
 		data += length;
 		caplen -= length;
 
-		vv->Assign(vv->Size(), rv);
+		vv->Assign(vv->Size(), std::move(rv));
 		}
 
 	return vv;
diff --git a/src/analyzer/protocol/icmp/ICMP.h b/src/analyzer/protocol/icmp/ICMP.h
index 93626e0f63..74ecb3a322 100644
--- a/src/analyzer/protocol/icmp/ICMP.h
+++ b/src/analyzer/protocol/icmp/ICMP.h
@@ -51,13 +51,13 @@ protected:
 
 	void Describe(ODesc* d) const;
 
-	RecordVal* BuildICMPVal(const struct icmp* icmpp, int len, int icmpv6,
-	                        const IP_Hdr* ip_hdr);
+	IntrusivePtr<RecordVal> BuildICMPVal(const struct icmp* icmpp, int len,
+	                                     int icmpv6, const IP_Hdr* ip_hdr);
 
 	void NextICMP4(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr );
 
-	RecordVal* ExtractICMP4Context(int len, const u_char*& data);
+	IntrusivePtr<RecordVal> ExtractICMP4Context(int len, const u_char*& data);
 
 	void Context4(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr);
@@ -68,15 +68,15 @@ protected:
 	void NextICMP6(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr );
 
-	RecordVal* ExtractICMP6Context(int len, const u_char*& data);
+	IntrusivePtr<RecordVal> ExtractICMP6Context(int len, const u_char*& data);
 
 	void Context6(double t, const struct icmp* icmpp, int len, int caplen,
 			const u_char*& data, const IP_Hdr* ip_hdr);
 
 	// RFC 4861 Neighbor Discover message options
-	VectorVal* BuildNDOptionsVal(int caplen, const u_char* data);
+	IntrusivePtr<VectorVal> BuildNDOptionsVal(int caplen, const u_char* data);
 
-	RecordVal* icmp_conn_val;
+	IntrusivePtr<RecordVal> icmp_conn_val;
 	int type;
 	int code;
 	int request_len, reply_len;
@@ -84,7 +84,7 @@ protected:
 	RuleMatcherState matcher_state;
 
 private:
-	void UpdateEndpointVal(RecordVal* endp, bool is_orig);
+	void UpdateEndpointVal(const IntrusivePtr<Val>& endp, bool is_orig);
 };
 
 // Returns the counterpart type to the given type (e.g., the counterpart
diff --git a/src/analyzer/protocol/imap/imap-analyzer.pac b/src/analyzer/protocol/imap/imap-analyzer.pac
index 51afb21f0e..677e3789ec 100644
--- a/src/analyzer/protocol/imap/imap-analyzer.pac
+++ b/src/analyzer/protocol/imap/imap-analyzer.pac
@@ -45,7 +45,7 @@ refine connection IMAP_Conn += {
 				bro_analyzer()->StartTLS();
 
 				if ( imap_starttls )
-					BifEvent::enqueue_imap_starttls(bro_analyzer(), bro_analyzer()->Conn());
+					zeek::BifEvent::enqueue_imap_starttls(bro_analyzer(), bro_analyzer()->Conn());
 				}
 			else
 				reporter->Weird(bro_analyzer()->Conn(), "IMAP: server refused StartTLS");
@@ -59,7 +59,7 @@ refine connection IMAP_Conn += {
 		if ( ! imap_capabilities )
 			return true;
 
-		auto capv = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+		auto capv = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		for ( unsigned int i = 0; i< capabilities->size(); i++ )
 			{
@@ -67,7 +67,7 @@ refine connection IMAP_Conn += {
 			capv->Assign(i, make_intrusive<StringVal>(capability.length(), (const char*)capability.data()));
 			}
 
-		BifEvent::enqueue_imap_capabilities(bro_analyzer(), bro_analyzer()->Conn(), std::move(capv));
+		zeek::BifEvent::enqueue_imap_capabilities(bro_analyzer(), bro_analyzer()->Conn(), std::move(capv));
 		return true;
 		%}
 
diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc
index e844e7e21b..583206bbf7 100644
--- a/src/analyzer/protocol/irc/IRC.cc
+++ b/src/analyzer/protocol/irc/IRC.cc
@@ -44,6 +44,8 @@ inline void IRC_Analyzer::SkipLeadingWhitespace(string& str)
 
 void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 	{
+	static auto irc_join_list = zeek::id::find_type<TableType>("irc_join_list");
+	static auto irc_join_info = zeek::id::find_type<RecordType>("irc_join_info");
 	tcp::TCP_ApplicationAnalyzer::DeliverStream(length, line, orig);
 
 	if ( starttls )
@@ -271,14 +273,14 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( parts.size() > 0 && parts[0][0] == ':' )
 				parts[0] = parts[0].substr(1);
 
-			auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
+			auto set = make_intrusive<TableVal>(zeek::id::string_set);
 
 			for ( unsigned int i = 0; i < parts.size(); ++i )
 				{
 				if ( parts[i][0] == '@' )
 					parts[i] = parts[i].substr(1);
 				auto idx = make_intrusive<StringVal>(parts[i].c_str());
-				set->Assign(idx.get(), nullptr);
+				set->Assign(std::move(idx), nullptr);
 				}
 
 			EnqueueConnEvent(irc_names_info,
@@ -464,12 +466,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			if ( parts.size() > 0 && parts[0][0] == ':' )
 				parts[0] = parts[0].substr(1);
 
-			auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
+			auto set = make_intrusive<TableVal>(zeek::id::string_set);
 
 			for ( unsigned int i = 0; i < parts.size(); ++i )
 				{
 				auto idx = make_intrusive<StringVal>(parts[i].c_str());
-				set->Assign(idx.get(), nullptr);
+				set->Assign(std::move(idx), nullptr);
 				}
 
 			EnqueueConnEvent(irc_whois_channel_line,
@@ -836,7 +838,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				nickname = prefix.substr(0, pos);
 			}
 
-		auto list = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, irc_join_list});
+		auto list = make_intrusive<TableVal>(irc_join_list);
 
 		vector<string> channels = SplitWords(parts[0], ',');
 		vector<string> passwords;
@@ -847,7 +849,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 		string empty_string = "";
 		for ( unsigned int i = 0; i < channels.size(); ++i )
 			{
-			RecordVal* info = new RecordVal(irc_join_info);
+			auto info = make_intrusive<RecordVal>(irc_join_info);
 			info->Assign(0, make_intrusive<StringVal>(nickname.c_str()));
 			info->Assign(1, make_intrusive<StringVal>(channels[i].c_str()));
 			if ( i < passwords.size() )
@@ -856,8 +858,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
 			// User mode.
 			info->Assign(3, make_intrusive<StringVal>(empty_string.c_str()));
-			list->Assign(info, nullptr);
-			Unref(info);
+			list->Assign(std::move(info), nullptr);
 			}
 
 		EnqueueConnEvent(irc_join_message,
@@ -881,7 +882,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			parts[1] = parts[1].substr(1);
 
 		vector<string> users = SplitWords(parts[1], ',');
-		auto list = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, irc_join_list});
+		auto list = make_intrusive<TableVal>(irc_join_list);
 
 		string empty_string = "";
 
@@ -917,7 +918,7 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			info->Assign(2, make_intrusive<StringVal>(empty_string.c_str()));
 			// User mode:
 			info->Assign(3, make_intrusive<StringVal>(mode.c_str()));
-			list->Assign(info.get(), nullptr);
+			list->Assign(std::move(info), nullptr);
 			}
 
 		EnqueueConnEvent(irc_join_message,
@@ -951,12 +952,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 			nick = nick.substr(0, pos);
 
 		vector<string> channelList = SplitWords(channels, ',');
-		auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
+		auto set = make_intrusive<TableVal>(zeek::id::string_set);
 
 		for ( unsigned int i = 0; i < channelList.size(); ++i )
 			{
 			auto idx = make_intrusive<StringVal>(channelList[i].c_str());
-			set->Assign(idx.get(), nullptr);
+			set->Assign(std::move(idx), nullptr);
 			}
 
 		EnqueueConnEvent(irc_part_message,
diff --git a/src/analyzer/protocol/krb/KRB.cc b/src/analyzer/protocol/krb/KRB.cc
index da8af91e8e..5d66d7942a 100644
--- a/src/analyzer/protocol/krb/KRB.cc
+++ b/src/analyzer/protocol/krb/KRB.cc
@@ -35,10 +35,10 @@ static void warn_krb(const char* msg, krb5_context ctx, krb5_error_code code)
 
 void KRB_Analyzer::Initialize_Krb()
 	{
-	if ( BifConst::KRB::keytab->Len() == 0 )
+	if ( zeek::BifConst::KRB::keytab->Len() == 0 )
 		return; // no keytab set
 
-	const char* keytab_filename = BifConst::KRB::keytab->CheckString();
+	const char* keytab_filename = zeek::BifConst::KRB::keytab->CheckString();
 	if ( access(keytab_filename, R_OK) != 0 )
 		{
 		reporter->Warning("KRB: Can't access keytab (%s)", keytab_filename);
diff --git a/src/analyzer/protocol/krb/krb-analyzer.pac b/src/analyzer/protocol/krb/krb-analyzer.pac
index b45dea41b4..928cdf4fd5 100644
--- a/src/analyzer/protocol/krb/krb-analyzer.pac
+++ b/src/analyzer/protocol/krb/krb-analyzer.pac
@@ -1,14 +1,14 @@
 %header{
-RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts);
-RecordVal* proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer);
+IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts);
+IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer);
 
 bool proc_error_arguments(RecordVal* rv, const std::vector<KRB_ERROR_Arg*>* args, int64 error_code);
 %}
 
 %code{
-RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts)
+IntrusivePtr<RecordVal> proc_krb_kdc_options(const KRB_KDC_Options* opts)
 {
-	RecordVal* rv = new RecordVal(BifType::Record::KRB::KDC_Options);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Options);
 
 	rv->Assign(0, val_mgr->Bool(opts->forwardable()));
 	rv->Assign(1, val_mgr->Bool(opts->forwarded()));
@@ -27,9 +27,9 @@ RecordVal* proc_krb_kdc_options(const KRB_KDC_Options* opts)
 	return rv;
 }
 
-RecordVal* proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer)
+IntrusivePtr<RecordVal> proc_krb_kdc_req_arguments(KRB_KDC_REQ* msg, const BroAnalyzer bro_analyzer)
 {
-	RecordVal* rv = new RecordVal(BifType::Record::KRB::KDC_Request);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Request);
 
 	rv->Assign(0, asn1_integer_to_val(msg->pvno()->data(), TYPE_COUNT));
 	rv->Assign(1, asn1_integer_to_val(msg->msg_type()->data(), TYPE_COUNT));
@@ -179,8 +179,8 @@ refine connection KRB_Conn += {
 			if ( ! krb_as_request )
 				return false;
 
-			RecordVal* rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer());
-			BifEvent::enqueue_krb_as_request(bro_analyzer(), bro_analyzer()->Conn(), {AdoptRef{}, rv});
+			auto rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer());
+			zeek::BifEvent::enqueue_krb_as_request(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv));
 			return true;
 			}
 
@@ -189,8 +189,8 @@ refine connection KRB_Conn += {
 			if ( ! krb_tgs_request )
 				return false;
 
-			RecordVal* rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer());
-			BifEvent::enqueue_krb_tgs_request(bro_analyzer(), bro_analyzer()->Conn(), {AdoptRef{}, rv});
+			auto rv = proc_krb_kdc_req_arguments(${msg}, bro_analyzer());
+			zeek::BifEvent::enqueue_krb_tgs_request(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv));
 			return true;
 			}
 
@@ -203,7 +203,7 @@ refine connection KRB_Conn += {
 		auto msg_type = binary_to_int64(${msg.msg_type.data.content});
 		auto make_arg = [this, msg]() -> IntrusivePtr<RecordVal>
 			{
-			auto rv = make_intrusive<RecordVal>(BifType::Record::KRB::KDC_Response);
+			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::KDC_Response);
 
 			rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, TYPE_COUNT));
 			rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, TYPE_COUNT));
@@ -223,7 +223,7 @@ refine connection KRB_Conn += {
 			if ( ! krb_as_response )
 				return false;
 
-			BifEvent::enqueue_krb_as_response(bro_analyzer(), bro_analyzer()->Conn(), make_arg());
+			zeek::BifEvent::enqueue_krb_as_response(bro_analyzer(), bro_analyzer()->Conn(), make_arg());
 			return true;
 			}
 
@@ -232,7 +232,7 @@ refine connection KRB_Conn += {
 			if ( ! krb_tgs_response )
 				return false;
 
-			BifEvent::enqueue_krb_tgs_response(bro_analyzer(), bro_analyzer()->Conn(), make_arg());
+			zeek::BifEvent::enqueue_krb_tgs_response(bro_analyzer(), bro_analyzer()->Conn(), make_arg());
 			return true;
 			}
 
@@ -244,11 +244,11 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_error )
 			{
-			auto rv = make_intrusive<RecordVal>(BifType::Record::KRB::Error_Msg);
+			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Error_Msg);
 			proc_error_arguments(rv.get(), ${msg.args1}, 0);
 			rv->Assign(4, asn1_integer_to_val(${msg.error_code}, TYPE_COUNT));
 			proc_error_arguments(rv.get(), ${msg.args2}, binary_to_int64(${msg.error_code.encoding.content}));
-			BifEvent::enqueue_krb_error(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv));
+			zeek::BifEvent::enqueue_krb_error(bro_analyzer(), bro_analyzer()->Conn(), std::move(rv));
 			}
 		return true;
 		%}
@@ -258,17 +258,17 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_ap_request )
 			{
-			auto rv = make_intrusive<RecordVal>(BifType::Record::KRB::AP_Options);
+			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::AP_Options);
 			rv->Assign(0, val_mgr->Bool(${msg.ap_options.use_session_key}));
 			rv->Assign(1, val_mgr->Bool(${msg.ap_options.mutual_required}));
 
 			auto rvticket = proc_ticket(${msg.ticket});
-			auto authenticationinfo = bro_analyzer()->GetAuthenticationInfo(rvticket->Lookup(2)->AsString(), rvticket->Lookup(4)->AsString(), rvticket->Lookup(3)->AsCount());
+			auto authenticationinfo = bro_analyzer()->GetAuthenticationInfo(rvticket->GetField(2)->AsString(), rvticket->GetField(4)->AsString(), rvticket->GetField(3)->AsCount());
 
 			if ( authenticationinfo )
 				rvticket->Assign(5, authenticationinfo);
 
-			BifEvent::enqueue_krb_ap_request(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_krb_ap_request(bro_analyzer(), bro_analyzer()->Conn(),
 						      std::move(rvticket), std::move(rv));
 			}
 		return true;
@@ -279,7 +279,7 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_ap_response )
 			{
-			BifEvent::enqueue_krb_ap_response(bro_analyzer(), bro_analyzer()->Conn());
+			zeek::BifEvent::enqueue_krb_ap_response(bro_analyzer(), bro_analyzer()->Conn());
 			}
 		return true;
 		%}
@@ -289,7 +289,7 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_safe )
 			{
-			auto rv = make_intrusive<RecordVal>(BifType::Record::KRB::SAFE_Msg);
+			auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::SAFE_Msg);
 
 			rv->Assign(0, asn1_integer_to_val(${msg.pvno.data}, TYPE_COUNT));
 			rv->Assign(1, asn1_integer_to_val(${msg.msg_type.data}, TYPE_COUNT));
@@ -337,7 +337,7 @@ refine connection KRB_Conn += {
 						break;
 					}
 				}
-			BifEvent::enqueue_krb_safe(bro_analyzer(), bro_analyzer()->Conn(), ${msg.is_orig}, std::move(rv));
+			zeek::BifEvent::enqueue_krb_safe(bro_analyzer(), bro_analyzer()->Conn(), ${msg.is_orig}, std::move(rv));
 			}
 		return true;
 		%}
@@ -347,7 +347,7 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_priv )
 			{
-			BifEvent::enqueue_krb_priv(bro_analyzer(), bro_analyzer()->Conn(), ${msg.is_orig});
+			zeek::BifEvent::enqueue_krb_priv(bro_analyzer(), bro_analyzer()->Conn(), ${msg.is_orig});
 			}
 		return true;
 		%}
@@ -357,7 +357,7 @@ refine connection KRB_Conn += {
 		bro_analyzer()->ProtocolConfirmation();
 		if ( krb_cred )
 			{
-			BifEvent::enqueue_krb_cred(bro_analyzer(), bro_analyzer()->Conn(), ${msg.is_orig},
+			zeek::BifEvent::enqueue_krb_cred(bro_analyzer(), bro_analyzer()->Conn(), ${msg.is_orig},
 						    		   proc_tickets(${msg.tickets}));
 			}
 		return true;
diff --git a/src/analyzer/protocol/krb/krb-padata.pac b/src/analyzer/protocol/krb/krb-padata.pac
index 35e99ff4d9..957df4e789 100644
--- a/src/analyzer/protocol/krb/krb-padata.pac
+++ b/src/analyzer/protocol/krb/krb-padata.pac
@@ -7,13 +7,13 @@
 %}
 
 %header{
-VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error);
+IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error);
 %}
 
 %code{
-VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error)
+IntrusivePtr<VectorVal> proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_analyzer, bool is_error)
 {
-	VectorVal* vv = new VectorVal(internal_type("KRB::Type_Value_Vector")->AsVectorType());
+	auto vv = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Type_Value_Vector"));
 
 	if ( ! data->data()->has_padata() )
 		return vv;
@@ -36,26 +36,26 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
 				break;
 			case PA_PW_SALT:
 				{
-				RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
+				auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 				type_val->Assign(0, val_mgr->Count(element->data_type()));
 				type_val->Assign(1, to_stringval(element->pa_data_element()->pa_pw_salt()->encoding()->content()));
-				vv->Assign(vv->Size(), type_val);
+				vv->Assign(vv->Size(), std::move(type_val));
 				break;
 				}
 			case PA_ENCTYPE_INFO:
 				{
-				RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
+				auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 				type_val->Assign(0, val_mgr->Count(element->data_type()));
 				type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info()->salt()));
-				vv->Assign(vv->Size(), type_val);
+				vv->Assign(vv->Size(), std::move(type_val));
 				break;
 				}
 			case PA_ENCTYPE_INFO2:
 				{
-				RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
+				auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 				type_val->Assign(0, val_mgr->Count(element->data_type()));
 				type_val->Assign(1, to_stringval(element->pa_data_element()->pf_enctype_info2()->salt()));
-				vv->Assign(vv->Size(), type_val);
+				vv->Assign(vv->Size(), std::move(type_val));
 				break;
 				}
 			case PA_PW_AS_REQ:
@@ -110,10 +110,10 @@ VectorVal* proc_padata(const KRB_PA_Data_Sequence* data, const BroAnalyzer bro_a
 				{
 				if ( ! is_error && element->pa_data_element()->unknown()->meta()->length() > 0 )
 					{
-					RecordVal * type_val = new RecordVal(BifType::Record::KRB::Type_Value);
+					auto type_val = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 					type_val->Assign(0, val_mgr->Count(element->data_type()));
 					type_val->Assign(1, to_stringval(element->pa_data_element()->unknown()->content()));
-					vv->Assign(vv->Size(), type_val);
+					vv->Assign(vv->Size(), std::move(type_val));
 					}
 				break;
 				}
diff --git a/src/analyzer/protocol/krb/krb-types.pac b/src/analyzer/protocol/krb/krb-types.pac
index 8a70075785..20ef1ea3bb 100644
--- a/src/analyzer/protocol/krb/krb-types.pac
+++ b/src/analyzer/protocol/krb/krb-types.pac
@@ -3,10 +3,10 @@
 %header{
 IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname);
 
-VectorVal* proc_cipher_list(const Array* list);
+IntrusivePtr<VectorVal> proc_cipher_list(const Array* list);
 
-VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list);
-RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr);
+IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list);
+IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr);
 
 IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list);
 IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket);
@@ -25,17 +25,17 @@ IntrusivePtr<Val> GetStringFromPrincipalName(const KRB_Principal_Name* pname)
 	return make_intrusive<StringVal>("unknown");
 }
 
-VectorVal* proc_cipher_list(const Array* list)
+IntrusivePtr<VectorVal> proc_cipher_list(const Array* list)
 {
-	VectorVal* ciphers = new VectorVal(internal_type("index_vec")->AsVectorType());
+	auto ciphers = make_intrusive<VectorVal>(zeek::id::index_vec);
 	for ( uint i = 0; i < list->data()->size(); ++i )
 		ciphers->Assign(ciphers->Size(), asn1_integer_to_val((*list->data())[i], TYPE_COUNT));
 	return ciphers;
 }
 
-VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list)
+IntrusivePtr<VectorVal> proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses* list)
 {
-	VectorVal* addrs = new VectorVal(internal_type("KRB::Host_Address_Vector")->AsVectorType());
+	auto addrs = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Host_Address_Vector"));
 
 	for ( uint i = 0; i < list->addresses()->size(); ++i )
 		{
@@ -45,9 +45,9 @@ VectorVal* proc_host_address_list(const BroAnalyzer a, const KRB_Host_Addresses*
 	return addrs;
 }
 
-RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
+IntrusivePtr<RecordVal> proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
 {
-	RecordVal* rv = new RecordVal(BifType::Record::KRB::Host_Address);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Host_Address);
 	const auto& addr_bytes = addr->address()->data()->content();
 
 	switch ( binary_to_int64(addr->addr_type()->encoding()->content()) )
@@ -85,16 +85,16 @@ RecordVal* proc_host_address(const BroAnalyzer a, const KRB_Host_Address* addr)
 			break;
 		}
 
-	RecordVal* unk = new RecordVal(BifType::Record::KRB::Type_Value);
+	auto unk = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Type_Value);
 	unk->Assign(0, asn1_integer_to_val(addr->addr_type(), TYPE_COUNT));
 	unk->Assign(1, to_stringval(addr_bytes));
-	rv->Assign(2, unk);
+	rv->Assign(2, std::move(unk));
 	return rv;
 }
 
 IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list)
 	{
-	auto tickets = make_intrusive<VectorVal>(internal_type("KRB::Ticket_Vector")->AsVectorType());
+	auto tickets = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("KRB::Ticket_Vector"));
 
 	for ( uint i = 0; i < list->tickets()->size(); ++i )
 		{
@@ -107,7 +107,7 @@ IntrusivePtr<VectorVal> proc_tickets(const KRB_Ticket_Sequence* list)
 
 IntrusivePtr<RecordVal> proc_ticket(const KRB_Ticket* ticket)
 	{
-	auto rv = make_intrusive<RecordVal>(BifType::Record::KRB::Ticket);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::KRB::Ticket);
 
 	rv->Assign(0, asn1_integer_to_val(ticket->tkt_vno()->data(), TYPE_COUNT));
 	rv->Assign(1, to_stringval(ticket->realm()->data()->content()));
diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc
index a2bff4e67d..63d9c12541 100644
--- a/src/analyzer/protocol/login/Login.cc
+++ b/src/analyzer/protocol/login/Login.cc
@@ -11,6 +11,7 @@
 #include "RE.h"
 #include "Reporter.h"
 #include "Event.h"
+#include "Var.h"
 
 #include "events.bif.h"
 
@@ -44,16 +45,24 @@ Login_Analyzer::Login_Analyzer(const char* name, Connection* conn)
 
 	if ( ! re_skip_authentication )
 		{
+		IntrusivePtr<ListVal> skip_authentication = zeek::id::find_val("skip_authentication")->AsTableVal()->ToPureListVal();
+		IntrusivePtr<ListVal> direct_login_prompts = zeek::id::find_val("direct_login_prompts")->AsTableVal()->ToPureListVal();
+		IntrusivePtr<ListVal> login_prompts = zeek::id::find_val("login_prompts")->AsTableVal()->ToPureListVal();
+		IntrusivePtr<ListVal> login_non_failure_msgs = zeek::id::find_val("login_non_failure_msgs")->AsTableVal()->ToPureListVal();
+		IntrusivePtr<ListVal> login_failure_msgs = zeek::id::find_val("login_failure_msgs")->AsTableVal()->ToPureListVal();
+		IntrusivePtr<ListVal> login_success_msgs = zeek::id::find_val("login_success_msgs")->AsTableVal()->ToPureListVal();
+		IntrusivePtr<ListVal> login_timeouts = zeek::id::find_val("login_timeouts")->AsTableVal()->ToPureListVal();
+
 #ifdef USE_PERFTOOLS_DEBUG
 		HeapLeakChecker::Disabler disabler;
 #endif
-		re_skip_authentication = init_RE(skip_authentication);
-		re_direct_login_prompts = init_RE(direct_login_prompts);
-		re_login_prompts = init_RE(login_prompts);
-		re_login_non_failure_msgs = init_RE(login_non_failure_msgs);
-		re_login_failure_msgs = init_RE(login_failure_msgs);
-		re_login_success_msgs = init_RE(login_success_msgs);
-		re_login_timeouts = init_RE(login_timeouts);
+		re_skip_authentication = init_RE(skip_authentication.get());
+		re_direct_login_prompts = init_RE(direct_login_prompts.get());
+		re_login_prompts = init_RE(login_prompts.get());
+		re_login_non_failure_msgs = init_RE(login_non_failure_msgs.get());
+		re_login_failure_msgs = init_RE(login_failure_msgs.get());
+		re_login_success_msgs = init_RE(login_success_msgs.get());
+		re_login_timeouts = init_RE(login_timeouts.get());
 		}
 	}
 
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index 8f5c00f811..dbe81f41a9 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -109,18 +109,27 @@ bool is_lws(char ch)
 	}
 
 StringVal* new_string_val(int length, const char* data)
-	{
-	return new StringVal(length, data);
-	}
+	{ return to_string_val(length, data).release(); }
 
 StringVal* new_string_val(const char* data, const char* end_of_data)
-	{
-	return new StringVal(end_of_data - data, data);
-	}
+	{ return to_string_val(data, end_of_data).release(); }
 
 StringVal* new_string_val(const data_chunk_t buf)
+	{ return to_string_val(buf).release(); }
+
+IntrusivePtr<StringVal> to_string_val(int length, const char* data)
 	{
-	return new_string_val(buf.length, buf.data);
+	return make_intrusive<StringVal>(length, data);
+	}
+
+IntrusivePtr<StringVal> to_string_val(const char* data, const char* end_of_data)
+	{
+	return make_intrusive<StringVal>(end_of_data - data, data);
+	}
+
+IntrusivePtr<StringVal> to_string_val(const data_chunk_t buf)
+	{
+	return to_string_val(buf.length, buf.data);
 	}
 
 static data_chunk_t get_data_chunk(BroString* s)
@@ -551,8 +560,8 @@ void MIME_Entity::init()
 
 	need_to_parse_parameters = 0;
 
-	content_type_str = new StringVal("TEXT");
-	content_subtype_str = new StringVal("PLAIN");
+	content_type_str = make_intrusive<StringVal>("TEXT");
+	content_subtype_str = make_intrusive<StringVal>("PLAIN");
 
 	content_encoding_str = nullptr;
 	multipart_boundary = nullptr;
@@ -581,8 +590,6 @@ MIME_Entity::~MIME_Entity()
 		            "missing MIME_Entity::EndOfData() before ~MIME_Entity");
 
 	delete current_header_line;
-	Unref(content_type_str);
-	Unref(content_subtype_str);
 	delete content_encoding_str;
 	delete multipart_boundary;
 
@@ -804,10 +811,10 @@ bool MIME_Entity::ParseContentTypeField(MIME_Header* h)
 	data += offset;
 	len -= offset;
 
-	Unref(content_type_str);
-	content_type_str = (new StringVal(ty.length, ty.data))->ToUpper();
-	Unref(content_subtype_str);
-	content_subtype_str = (new StringVal(subty.length, subty.data))->ToUpper();
+	content_type_str = make_intrusive<StringVal>(ty.length, ty.data);
+	content_type_str->ToUpper();
+	content_subtype_str = make_intrusive<StringVal>(subty.length, subty.data);
+	content_subtype_str->ToUpper();
 
 	ParseContentType(ty, subty);
 
@@ -1290,26 +1297,33 @@ void MIME_Entity::DebugPrintHeaders()
 	}
 
 RecordVal* MIME_Message::BuildHeaderVal(MIME_Header* h)
+	{ return ToHeaderVal(h).release(); }
+
+IntrusivePtr<RecordVal> MIME_Message::ToHeaderVal(MIME_Header* h)
 	{
-	RecordVal* header_record = new RecordVal(mime_header_rec);
-	header_record->Assign(0, new_string_val(h->get_name()));
-	header_record->Assign(1, new_string_val(h->get_name())->ToUpper());
-	header_record->Assign(2, new_string_val(h->get_value()));
+	static auto mime_header_rec = zeek::id::find_type<RecordType>("mime_header_rec");
+	auto header_record = make_intrusive<RecordVal>(mime_header_rec);
+	header_record->Assign(0, to_string_val(h->get_name()));
+	auto upper_hn = to_string_val(h->get_name());
+	upper_hn->ToUpper();
+	header_record->Assign(1, std::move(upper_hn));
+	header_record->Assign(2, to_string_val(h->get_value()));
 	return header_record;
 	}
 
 TableVal* MIME_Message::BuildHeaderTable(MIME_HeaderList& hlist)
+	{ return ToHeaderTable(hlist).release(); }
+
+IntrusivePtr<TableVal> MIME_Message::ToHeaderTable(MIME_HeaderList& hlist)
 	{
-	TableVal* t = new TableVal({NewRef{}, mime_header_list});
+	static auto mime_header_list = zeek::id::find_type<TableType>("mime_header_list");
+	auto t = make_intrusive<TableVal>(mime_header_list);
 
 	for ( unsigned int i = 0; i < hlist.size(); ++i )
 		{
 		auto index = val_mgr->Count(i + 1);	// index starting from 1
-
 		MIME_Header* h = hlist[i];
-		RecordVal* header_record = BuildHeaderVal(h);
-
-		t->Assign(index.get(), header_record);
+		t->Assign(std::move(index), ToHeaderVal(h));
 		}
 
 	return t;
@@ -1428,7 +1442,7 @@ void MIME_Mail::SubmitHeader(MIME_Header* h)
 	if ( mime_one_header )
 		analyzer->EnqueueConnEvent(mime_one_header,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, BuildHeaderVal(h)}
+			ToHeaderVal(h)
 		);
 	}
 
@@ -1437,7 +1451,7 @@ void MIME_Mail::SubmitAllHeaders(MIME_HeaderList& hlist)
 	if ( mime_all_headers )
 		analyzer->EnqueueConnEvent(mime_all_headers,
 			analyzer->ConnVal(),
-			IntrusivePtr{AdoptRef{}, BuildHeaderTable(hlist)}
+			ToHeaderTable(hlist)
 		);
 	}
 
diff --git a/src/analyzer/protocol/mime/MIME.h b/src/analyzer/protocol/mime/MIME.h
index 000ad77d15..50fdb8366b 100644
--- a/src/analyzer/protocol/mime/MIME.h
+++ b/src/analyzer/protocol/mime/MIME.h
@@ -97,8 +97,12 @@ public:
 
 	MIME_Entity* Parent() const { return parent; }
 	int MIMEContentType() const { return content_type; }
-	StringVal* ContentType() const { return content_type_str; }
-	StringVal* ContentSubType() const { return content_subtype_str; }
+	[[deprecated("Remove in v4.1.  Use GetContentType().")]]
+	StringVal* ContentType() const { return content_type_str.get(); }
+	[[deprecated("Remove in v4.1.  Use GetContentSubType().")]]
+	StringVal* ContentSubType() const { return content_subtype_str.get(); }
+	const IntrusivePtr<StringVal>& GetContentType() const { return content_type_str; }
+	const IntrusivePtr<StringVal>& GetContentSubType() const { return content_subtype_str; }
 	int ContentTransferEncoding() const { return content_encoding; }
 
 protected:
@@ -154,8 +158,8 @@ protected:
 	int current_field_type;
 	int need_to_parse_parameters;
 
-	StringVal* content_type_str;
-	StringVal* content_subtype_str;
+	IntrusivePtr<StringVal> content_type_str;
+	IntrusivePtr<StringVal> content_subtype_str;
 	BroString* content_encoding_str;
 	BroString* multipart_boundary;
 
@@ -225,8 +229,13 @@ protected:
 	MIME_Entity* top_level;
 	bool finished;
 
+	[[deprecated("Remove in v4.1.  Use ToHeaderVal().")]]
 	RecordVal* BuildHeaderVal(MIME_Header* h);
+	[[deprecated("Remove in v4.1.  Use ToHeaderTable().")]]
 	TableVal* BuildHeaderTable(MIME_HeaderList& hlist);
+
+	IntrusivePtr<RecordVal> ToHeaderVal(MIME_Header* h);
+	IntrusivePtr<TableVal> ToHeaderTable(MIME_HeaderList& hlist);
 };
 
 class MIME_Mail final : public MIME_Message {
@@ -265,9 +274,15 @@ protected:
 
 
 extern bool is_null_data_chunk(data_chunk_t b);
+[[deprecated("Remove in v4.1.  Use analyzer::mime::to_string_val().")]]
 extern StringVal* new_string_val(int length, const char* data);
+[[deprecated("Remove in v4.1.  Use analyzer::mime::to_string_val().")]]
 extern StringVal* new_string_val(const char* data, const char* end_of_data);
+[[deprecated("Remove in v4.1.  Use analyzer::mime::to_string_val().")]]
 extern StringVal* new_string_val(const data_chunk_t buf);
+extern IntrusivePtr<StringVal> to_string_val(int length, const char* data);
+extern IntrusivePtr<StringVal> to_string_val(const char* data, const char* end_of_data);
+extern IntrusivePtr<StringVal> to_string_val(const data_chunk_t buf);
 extern int fputs(data_chunk_t b, FILE* fp);
 extern bool istrequal(data_chunk_t s, const char* t);
 extern bool is_lws(char ch);
diff --git a/src/analyzer/protocol/modbus/modbus-analyzer.pac b/src/analyzer/protocol/modbus/modbus-analyzer.pac
index c4668a775c..9d5de6a705 100644
--- a/src/analyzer/protocol/modbus/modbus-analyzer.pac
+++ b/src/analyzer/protocol/modbus/modbus-analyzer.pac
@@ -16,7 +16,7 @@
 %code{
 	IntrusivePtr<VectorVal> bytestring_to_coils(const bytestring& coils, uint quantity)
 		{
-		auto modbus_coils = make_intrusive<VectorVal>(BifType::Vector::ModbusCoils);
+		auto modbus_coils = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusCoils);
 
 		for ( uint i = 0; i < quantity; i++ )
 			{
@@ -29,7 +29,7 @@
 
 	IntrusivePtr<RecordVal> HeaderToVal(ModbusTCP_TransportHeader* header)
 		{
-		auto modbus_header = make_intrusive<RecordVal>(BifType::Record::ModbusHeaders);
+		auto modbus_header = make_intrusive<RecordVal>(zeek::BifType::Record::ModbusHeaders);
 		modbus_header->Assign(0, val_mgr->Count(header->tid()));
 		modbus_header->Assign(1, val_mgr->Count(header->pid()));
 		modbus_header->Assign(2, val_mgr->Count(header->uid()));
@@ -40,7 +40,7 @@
 	IntrusivePtr<VectorVal> create_vector_of_count()
 		{
 		auto vt = make_intrusive<VectorType>(base_type(TYPE_COUNT));
-		auto vv = make_intrusive<VectorVal>(vt.get());
+		auto vv = make_intrusive<VectorVal>(std::move(vt));
 		return vv;
 		}
 
@@ -88,7 +88,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_message )
 			{
-			BifEvent::enqueue_modbus_message(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_message(connection()->bro_analyzer(),
 			                                 connection()->bro_analyzer()->Conn(),
 			                                 HeaderToVal(header),
 			                                 is_orig());
@@ -117,7 +117,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_exception )
 			{
-			BifEvent::enqueue_modbus_exception(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_exception(connection()->bro_analyzer(),
 			                                   connection()->bro_analyzer()->Conn(),
 			                                   HeaderToVal(header),
 			                                   ${message.code});
@@ -131,7 +131,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_read_coils_request )
 			{
-			BifEvent::enqueue_modbus_read_coils_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_coils_request(connection()->bro_analyzer(),
 			                                            connection()->bro_analyzer()->Conn(),
 			                                            HeaderToVal(header),
 			                                            ${message.start_address},
@@ -146,7 +146,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_read_coils_response )
 			{
-			BifEvent::enqueue_modbus_read_coils_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_coils_response(connection()->bro_analyzer(),
 			                                             connection()->bro_analyzer()->Conn(),
 			                                             HeaderToVal(header),
 			                                             bytestring_to_coils(${message.bits}, ${message.bits}.length()*8));
@@ -159,7 +159,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_read_discrete_inputs_request )
 			{
-			BifEvent::enqueue_modbus_read_discrete_inputs_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_discrete_inputs_request(connection()->bro_analyzer(),
 			                                                      connection()->bro_analyzer()->Conn(),
 			                                                      HeaderToVal(header),
 			                                                      ${message.start_address}, ${message.quantity});
@@ -173,7 +173,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_read_discrete_inputs_response )
 			{
-			BifEvent::enqueue_modbus_read_discrete_inputs_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_discrete_inputs_response(connection()->bro_analyzer(),
 			                                                       connection()->bro_analyzer()->Conn(),
 			                                                       HeaderToVal(header),
 			                                                       bytestring_to_coils(${message.bits}, ${message.bits}.length()*8));
@@ -188,7 +188,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_read_holding_registers_request )
 			{
-			BifEvent::enqueue_modbus_read_holding_registers_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_holding_registers_request(connection()->bro_analyzer(),
 			                                                        connection()->bro_analyzer()->Conn(),
 			                                                        HeaderToVal(header),
 			                                                        ${message.start_address}, ${message.quantity});
@@ -209,7 +209,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_holding_registers_response )
 			{
-			auto t = make_intrusive<VectorVal>(BifType::Vector::ModbusRegisters);
+			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i=0; i < ${message.registers}->size(); ++i )
 				{
@@ -217,7 +217,7 @@ refine flow ModbusTCP_Flow += {
 				t->Assign(i, r);
 				}
 
-			BifEvent::enqueue_modbus_read_holding_registers_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_holding_registers_response(connection()->bro_analyzer(),
 			                                                         connection()->bro_analyzer()->Conn(),
 			                                                         HeaderToVal(header),
 			                                                         std::move(t));
@@ -232,7 +232,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_read_input_registers_request )
 			{
-			BifEvent::enqueue_modbus_read_input_registers_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_input_registers_request(connection()->bro_analyzer(),
 			                                                      connection()->bro_analyzer()->Conn(),
 			                                                      HeaderToVal(header),
 			                                                      ${message.start_address}, ${message.quantity});
@@ -253,7 +253,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_input_registers_response )
 			{
-			auto t = make_intrusive<VectorVal>(BifType::Vector::ModbusRegisters);
+			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i=0; i < (${message.registers})->size(); ++i )
 				{
@@ -261,7 +261,7 @@ refine flow ModbusTCP_Flow += {
 				t->Assign(i, r);
 				}
 
-			BifEvent::enqueue_modbus_read_input_registers_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_input_registers_response(connection()->bro_analyzer(),
 			                                                       connection()->bro_analyzer()->Conn(),
 			                                                       HeaderToVal(header),
 			                                                       std::move(t));
@@ -288,7 +288,7 @@ refine flow ModbusTCP_Flow += {
 				return false;
 				}
 
-			BifEvent::enqueue_modbus_write_single_coil_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_single_coil_request(connection()->bro_analyzer(),
 			                                                   connection()->bro_analyzer()->Conn(),
 			                                                   HeaderToVal(header),
 			                                                   ${message.address},
@@ -315,7 +315,7 @@ refine flow ModbusTCP_Flow += {
 				return false;
 				}
 
-			BifEvent::enqueue_modbus_write_single_coil_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_single_coil_response(connection()->bro_analyzer(),
 			                                                    connection()->bro_analyzer()->Conn(),
 			                                                    HeaderToVal(header),
 			                                                    ${message.address},
@@ -331,7 +331,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_write_single_register_request )
 			{
-			BifEvent::enqueue_modbus_write_single_register_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_single_register_request(connection()->bro_analyzer(),
 			                                                       connection()->bro_analyzer()->Conn(),
 			                                                       HeaderToVal(header),
 			                                                       ${message.address}, ${message.value});
@@ -345,7 +345,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_write_single_register_response )
 			{
-			BifEvent::enqueue_modbus_write_single_register_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_single_register_response(connection()->bro_analyzer(),
 			                                                        connection()->bro_analyzer()->Conn(),
 			                                                        HeaderToVal(header),
 			                                                        ${message.address}, ${message.value});
@@ -360,7 +360,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_write_multiple_coils_request )
 			{
-			BifEvent::enqueue_modbus_write_multiple_coils_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_multiple_coils_request(connection()->bro_analyzer(),
 			                                                      connection()->bro_analyzer()->Conn(),
 			                                                      HeaderToVal(header),
 			                                                      ${message.start_address},
@@ -375,7 +375,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_write_multiple_coils_response )
 			{
-			BifEvent::enqueue_modbus_write_multiple_coils_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_multiple_coils_response(connection()->bro_analyzer(),
 			                                                       connection()->bro_analyzer()->Conn(),
 			                                                       HeaderToVal(header),
 			                                                       ${message.start_address}, ${message.quantity});
@@ -397,7 +397,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_write_multiple_registers_request )
 			{
-			auto t = make_intrusive<VectorVal>(BifType::Vector::ModbusRegisters);
+			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i = 0; i < (${message.registers}->size()); ++i )
 				{
@@ -405,7 +405,7 @@ refine flow ModbusTCP_Flow += {
 				t->Assign(i, r);
 				}
 
-				BifEvent::enqueue_modbus_write_multiple_registers_request(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_modbus_write_multiple_registers_request(connection()->bro_analyzer(),
 				                                                          connection()->bro_analyzer()->Conn(),
 				                                                          HeaderToVal(header),
 				                                                          ${message.start_address}, std::move(t));
@@ -419,7 +419,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_write_multiple_registers_response )
 			{
-			BifEvent::enqueue_modbus_write_multiple_registers_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_multiple_registers_response(connection()->bro_analyzer(),
 			                                                           connection()->bro_analyzer()->Conn(),
 			                                                           HeaderToVal(header),
 			                                                           ${message.start_address}, ${message.quantity});
@@ -447,7 +447,7 @@ refine flow ModbusTCP_Flow += {
 			//	t->Assign(i, l);
 			//	}
 
-			BifEvent::enqueue_modbus_read_file_record_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_file_record_request(connection()->bro_analyzer(),
 			                                                  connection()->bro_analyzer()->Conn(),
 			                                                  HeaderToVal(header));
 			}
@@ -468,7 +468,7 @@ refine flow ModbusTCP_Flow += {
 			//	t->Assign(i, r);
 			//	}
 
-			BifEvent::enqueue_modbus_read_file_record_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_file_record_response(connection()->bro_analyzer(),
 			                                                   connection()->bro_analyzer()->Conn(),
 			                                                   HeaderToVal(header));
 			}
@@ -500,7 +500,7 @@ refine flow ModbusTCP_Flow += {
 			//		}
 			//	}
 
-			BifEvent::enqueue_modbus_write_file_record_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_file_record_request(connection()->bro_analyzer(),
 			                                                   connection()->bro_analyzer()->Conn(),
 			                                                   HeaderToVal(header));
 			}
@@ -532,7 +532,7 @@ refine flow ModbusTCP_Flow += {
 			//		t->Assign(i, k);
 			//		}
 
-			BifEvent::enqueue_modbus_write_file_record_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_write_file_record_response(connection()->bro_analyzer(),
 			                                                    connection()->bro_analyzer()->Conn(),
 			                                                    HeaderToVal(header));
 			}
@@ -545,7 +545,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_mask_write_register_request )
 			{
-			BifEvent::enqueue_modbus_mask_write_register_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_mask_write_register_request(connection()->bro_analyzer(),
 			                                                     connection()->bro_analyzer()->Conn(),
 			                                                     HeaderToVal(header),
 			                                                     ${message.address},
@@ -560,7 +560,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_mask_write_register_response )
 			{
-			BifEvent::enqueue_modbus_mask_write_register_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_mask_write_register_response(connection()->bro_analyzer(),
 			                                                      connection()->bro_analyzer()->Conn(),
 			                                                      HeaderToVal(header),
 			                                                      ${message.address},
@@ -582,7 +582,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_write_multiple_registers_request )
 			{
-			auto t = make_intrusive<VectorVal>(BifType::Vector::ModbusRegisters);
+			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i = 0; i < ${message.write_register_values}->size(); ++i )
 				{
@@ -590,7 +590,7 @@ refine flow ModbusTCP_Flow += {
 				t->Assign(i, r);
 				}
 
-			BifEvent::enqueue_modbus_read_write_multiple_registers_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_write_multiple_registers_request(connection()->bro_analyzer(),
 			                                                               connection()->bro_analyzer()->Conn(),
 			                                                               HeaderToVal(header),
 			                                                               ${message.read_start_address},
@@ -614,7 +614,7 @@ refine flow ModbusTCP_Flow += {
 
 		if ( ::modbus_read_write_multiple_registers_response )
 			{
-			auto t = make_intrusive<VectorVal>(BifType::Vector::ModbusRegisters);
+			auto t = make_intrusive<VectorVal>(zeek::BifType::Vector::ModbusRegisters);
 
 			for ( unsigned int i = 0; i < ${message.registers}->size(); ++i )
 				{
@@ -622,7 +622,7 @@ refine flow ModbusTCP_Flow += {
 				t->Assign(i, r);
 				}
 
-			BifEvent::enqueue_modbus_read_write_multiple_registers_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_write_multiple_registers_response(connection()->bro_analyzer(),
 			                                                                connection()->bro_analyzer()->Conn(),
 			                                                                HeaderToVal(header),
 			                                                                std::move(t));
@@ -636,7 +636,7 @@ refine flow ModbusTCP_Flow += {
 		%{
 		if ( ::modbus_read_fifo_queue_request )
 			{
-			BifEvent::enqueue_modbus_read_fifo_queue_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_fifo_queue_request(connection()->bro_analyzer(),
 			                                                 connection()->bro_analyzer()->Conn(),
 			                                                 HeaderToVal(header),
 			                                                 ${message.start_address});
@@ -666,7 +666,7 @@ refine flow ModbusTCP_Flow += {
 				t->Assign(i, r);
 				}
 
-			BifEvent::enqueue_modbus_read_fifo_queue_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_modbus_read_fifo_queue_response(connection()->bro_analyzer(),
 			                                                  connection()->bro_analyzer()->Conn(),
 			                                                  HeaderToVal(header),
 			                                                  std::move(t));
diff --git a/src/analyzer/protocol/mqtt/MQTT.cc b/src/analyzer/protocol/mqtt/MQTT.cc
index 7addafb3f9..4514f4d907 100644
--- a/src/analyzer/protocol/mqtt/MQTT.cc
+++ b/src/analyzer/protocol/mqtt/MQTT.cc
@@ -9,20 +9,10 @@
 
 using namespace analyzer::MQTT;
 
-const ::ID* MQTT_Analyzer::max_payload_size = nullptr;
-
 MQTT_Analyzer::MQTT_Analyzer(Connection* c)
 	: tcp::TCP_ApplicationAnalyzer("MQTT", c)
 	{
 	interp = new binpac::MQTT::MQTT_Conn(this);
-
-	if ( ! max_payload_size )
-		{
-		max_payload_size = global_scope()->Lookup("MQTT::max_payload_size");
-
-		if ( ! max_payload_size )
-			reporter->FatalError("option not defined: 'MQTT::max_payload_size'");
-		}
 	}
 
 MQTT_Analyzer::~MQTT_Analyzer()
diff --git a/src/analyzer/protocol/mqtt/MQTT.h b/src/analyzer/protocol/mqtt/MQTT.h
index 5997d3430f..a1c4e36a2d 100644
--- a/src/analyzer/protocol/mqtt/MQTT.h
+++ b/src/analyzer/protocol/mqtt/MQTT.h
@@ -23,8 +23,6 @@ public:
 	static analyzer::Analyzer* InstantiateAnalyzer(Connection* conn)
 		{ return new MQTT_Analyzer(conn); }
 
-	static const ::ID* max_payload_size;
-
 protected:
 	binpac::MQTT::MQTT_Conn* interp;
 
diff --git a/src/analyzer/protocol/mqtt/commands/connack.pac b/src/analyzer/protocol/mqtt/commands/connack.pac
index a1d139f93e..c2954efa8a 100644
--- a/src/analyzer/protocol/mqtt/commands/connack.pac
+++ b/src/analyzer/protocol/mqtt/commands/connack.pac
@@ -15,10 +15,10 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_connack )
 			{
-			auto m = make_intrusive<RecordVal>(BifType::Record::MQTT::ConnectAckMsg);
+			auto m = make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::ConnectAckMsg);
 			m->Assign(0, val_mgr->Count(${msg.return_code}));
 			m->Assign(1, val_mgr->Bool(${msg.session_present}));
-			BifEvent::enqueue_mqtt_connack(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_connack(connection()->bro_analyzer(),
 			                               connection()->bro_analyzer()->Conn(),
 			                               std::move(m));
 			}
diff --git a/src/analyzer/protocol/mqtt/commands/connect.pac b/src/analyzer/protocol/mqtt/commands/connect.pac
index a355097a63..407313cc8a 100644
--- a/src/analyzer/protocol/mqtt/commands/connect.pac
+++ b/src/analyzer/protocol/mqtt/commands/connect.pac
@@ -44,7 +44,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_connect )
 			{
-			auto m = make_intrusive<RecordVal>(BifType::Record::MQTT::ConnectMsg);
+			auto m = make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::ConnectMsg);
 			m->Assign(0, make_intrusive<StringVal>(${msg.protocol_name.str}.length(),
 			                           reinterpret_cast<const char*>(${msg.protocol_name.str}.begin())));
 			m->Assign(1, val_mgr->Count(${msg.protocol_version}));
@@ -75,7 +75,7 @@ refine flow MQTT_Flow += {
 				                            reinterpret_cast<const char*>(${msg.pass.str}.begin())));
 				}
 
-			BifEvent::enqueue_mqtt_connect(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_connect(connection()->bro_analyzer(),
 			                               connection()->bro_analyzer()->Conn(),
 			                               std::move(m));
 			}
diff --git a/src/analyzer/protocol/mqtt/commands/disconnect.pac b/src/analyzer/protocol/mqtt/commands/disconnect.pac
index d9f49e20c6..8a3050a3a9 100644
--- a/src/analyzer/protocol/mqtt/commands/disconnect.pac
+++ b/src/analyzer/protocol/mqtt/commands/disconnect.pac
@@ -11,7 +11,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_disconnect )
 			{
-			BifEvent::enqueue_mqtt_disconnect(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_disconnect(connection()->bro_analyzer(),
 			                                  connection()->bro_analyzer()->Conn());
 			}
 
diff --git a/src/analyzer/protocol/mqtt/commands/pingreq.pac b/src/analyzer/protocol/mqtt/commands/pingreq.pac
index 2c436f0091..3aad0b854d 100644
--- a/src/analyzer/protocol/mqtt/commands/pingreq.pac
+++ b/src/analyzer/protocol/mqtt/commands/pingreq.pac
@@ -11,7 +11,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_pingreq )
 			{
-			BifEvent::enqueue_mqtt_pingreq(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_pingreq(connection()->bro_analyzer(),
 			                               connection()->bro_analyzer()->Conn());
 			}
 
diff --git a/src/analyzer/protocol/mqtt/commands/pingresp.pac b/src/analyzer/protocol/mqtt/commands/pingresp.pac
index a4295775a5..dc0cb227ba 100644
--- a/src/analyzer/protocol/mqtt/commands/pingresp.pac
+++ b/src/analyzer/protocol/mqtt/commands/pingresp.pac
@@ -11,7 +11,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_pingresp )
 			{
-			BifEvent::enqueue_mqtt_pingresp(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_pingresp(connection()->bro_analyzer(),
 			                                connection()->bro_analyzer()->Conn());
 			}
 
diff --git a/src/analyzer/protocol/mqtt/commands/puback.pac b/src/analyzer/protocol/mqtt/commands/puback.pac
index b8a6ef57fe..1a3e6454fe 100644
--- a/src/analyzer/protocol/mqtt/commands/puback.pac
+++ b/src/analyzer/protocol/mqtt/commands/puback.pac
@@ -13,7 +13,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_puback )
 			{
-			BifEvent::enqueue_mqtt_puback(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_puback(connection()->bro_analyzer(),
 			                              connection()->bro_analyzer()->Conn(),
 			                              is_orig,
 			                              ${msg.msg_id});
diff --git a/src/analyzer/protocol/mqtt/commands/pubcomp.pac b/src/analyzer/protocol/mqtt/commands/pubcomp.pac
index f1cf1657a0..28e5650efe 100644
--- a/src/analyzer/protocol/mqtt/commands/pubcomp.pac
+++ b/src/analyzer/protocol/mqtt/commands/pubcomp.pac
@@ -13,7 +13,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_pubcomp )
 			{
-			BifEvent::enqueue_mqtt_pubcomp(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_pubcomp(connection()->bro_analyzer(),
 			                               connection()->bro_analyzer()->Conn(),
 			                               is_orig,
 			                               ${msg.msg_id});
diff --git a/src/analyzer/protocol/mqtt/commands/publish.pac b/src/analyzer/protocol/mqtt/commands/publish.pac
index a2ded3783d..cd7ceef2b3 100644
--- a/src/analyzer/protocol/mqtt/commands/publish.pac
+++ b/src/analyzer/protocol/mqtt/commands/publish.pac
@@ -23,25 +23,26 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_publish )
 			{
-			auto m = make_intrusive<RecordVal>(BifType::Record::MQTT::PublishMsg);
+			auto m = make_intrusive<RecordVal>(zeek::BifType::Record::MQTT::PublishMsg);
 			m->Assign(0, val_mgr->Bool(${msg.dup}));
 			m->Assign(1, val_mgr->Count(${msg.qos}));
 			m->Assign(2, val_mgr->Bool(${msg.retain}));
-			m->Assign(3, new StringVal(${msg.topic.str}.length(),
-			                           reinterpret_cast<const char*>(${msg.topic.str}.begin())));
+			m->Assign<StringVal>(3, ${msg.topic.str}.length(),
+			                     reinterpret_cast<const char*>(${msg.topic.str}.begin()));
 
 			auto len = ${msg.payload}.length();
-			auto max = analyzer::MQTT::MQTT_Analyzer::max_payload_size->ID_Val()->AsCount();
+			static auto max_payload_size = zeek::id::find("MQTT::max_payload_size");
+			auto max = max_payload_size->GetVal()->AsCount();
 
 			if ( len > static_cast<int>(max) )
 				len = max;
 
-			m->Assign(4, new StringVal(len,
-			                           reinterpret_cast<const char*>(${msg.payload}.begin())));
+			m->Assign<StringVal>(4, len,
+			                     reinterpret_cast<const char*>(${msg.payload}.begin()));
 
 			m->Assign(5, val_mgr->Count(${msg.payload}.length()));
 
-			BifEvent::enqueue_mqtt_publish(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_publish(connection()->bro_analyzer(),
 			                               connection()->bro_analyzer()->Conn(),
 			                               ${pdu.is_orig},
 			                               ${msg.qos} == 0 ? 0 : ${msg.msg_id},
diff --git a/src/analyzer/protocol/mqtt/commands/pubrec.pac b/src/analyzer/protocol/mqtt/commands/pubrec.pac
index 84724db804..7aa128ad3c 100644
--- a/src/analyzer/protocol/mqtt/commands/pubrec.pac
+++ b/src/analyzer/protocol/mqtt/commands/pubrec.pac
@@ -13,7 +13,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_pubrec )
 			{
-			BifEvent::enqueue_mqtt_pubrec(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_pubrec(connection()->bro_analyzer(),
 			                              connection()->bro_analyzer()->Conn(),
 			                              is_orig,
 			                              ${msg.msg_id});
diff --git a/src/analyzer/protocol/mqtt/commands/pubrel.pac b/src/analyzer/protocol/mqtt/commands/pubrel.pac
index 0f329eb3dd..1c11d61289 100644
--- a/src/analyzer/protocol/mqtt/commands/pubrel.pac
+++ b/src/analyzer/protocol/mqtt/commands/pubrel.pac
@@ -13,7 +13,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_pubrel )
 			{
-			BifEvent::enqueue_mqtt_pubrel(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_pubrel(connection()->bro_analyzer(),
 			                              connection()->bro_analyzer()->Conn(),
 			                              is_orig,
 			                              ${msg.msg_id});
diff --git a/src/analyzer/protocol/mqtt/commands/suback.pac b/src/analyzer/protocol/mqtt/commands/suback.pac
index 1f0adf5e32..79f4d09a05 100644
--- a/src/analyzer/protocol/mqtt/commands/suback.pac
+++ b/src/analyzer/protocol/mqtt/commands/suback.pac
@@ -14,7 +14,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_suback )
 			{
-			BifEvent::enqueue_mqtt_suback(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_suback(connection()->bro_analyzer(),
 			                              connection()->bro_analyzer()->Conn(),
 			                              ${msg.msg_id},
 			                              ${msg.granted_QoS});
diff --git a/src/analyzer/protocol/mqtt/commands/subscribe.pac b/src/analyzer/protocol/mqtt/commands/subscribe.pac
index 2ee0d1592b..755101b41f 100644
--- a/src/analyzer/protocol/mqtt/commands/subscribe.pac
+++ b/src/analyzer/protocol/mqtt/commands/subscribe.pac
@@ -19,19 +19,19 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_subscribe )
 			{
-			auto topics = make_intrusive<VectorVal>(string_vec);
-			auto qos_levels = make_intrusive<VectorVal>(index_vec);
+			auto topics = make_intrusive<VectorVal>(zeek::id::string_vec);
+			auto qos_levels = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			for ( auto topic: *${msg.topics} )
 				{
-				auto subscribe_topic = new StringVal(${topic.name.str}.length(),
+				auto subscribe_topic = make_intrusive<StringVal>(${topic.name.str}.length(),
 				                                     reinterpret_cast<const char*>(${topic.name.str}.begin()));
 				auto qos = val_mgr->Count(${topic.requested_QoS});
-				topics->Assign(topics->Size(), subscribe_topic);
-				qos_levels->Assign(qos_levels->Size(), qos);
+				topics->Assign(topics->Size(), std::move(subscribe_topic));
+				qos_levels->Assign(qos_levels->Size(), std::move(qos));
 				}
 
-			BifEvent::enqueue_mqtt_subscribe(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_subscribe(connection()->bro_analyzer(),
 			                                 connection()->bro_analyzer()->Conn(),
 			                                 ${msg.msg_id},
 			                                 std::move(topics),
diff --git a/src/analyzer/protocol/mqtt/commands/unsuback.pac b/src/analyzer/protocol/mqtt/commands/unsuback.pac
index 3c368188a3..168d55e1bd 100644
--- a/src/analyzer/protocol/mqtt/commands/unsuback.pac
+++ b/src/analyzer/protocol/mqtt/commands/unsuback.pac
@@ -13,7 +13,7 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_unsuback )
 			{
-			BifEvent::enqueue_mqtt_unsuback(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_unsuback(connection()->bro_analyzer(),
 			                                connection()->bro_analyzer()->Conn(),
 			                                ${msg.msg_id});
 			}
diff --git a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac
index 670b312d5b..944e005c7b 100644
--- a/src/analyzer/protocol/mqtt/commands/unsubscribe.pac
+++ b/src/analyzer/protocol/mqtt/commands/unsubscribe.pac
@@ -14,16 +14,16 @@ refine flow MQTT_Flow += {
 		%{
 		if ( mqtt_unsubscribe )
 			{
-			auto topics = make_intrusive<VectorVal>(string_vec);
+			auto topics = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 			for ( auto topic: *${msg.topics} )
 				{
-				auto unsubscribe_topic = new StringVal(${topic.str}.length(),
+				auto unsubscribe_topic = make_intrusive<StringVal>(${topic.str}.length(),
 				                                  reinterpret_cast<const char*>(${topic.str}.begin()));
-				topics->Assign(topics->Size(), unsubscribe_topic);
+				topics->Assign(topics->Size(), std::move(unsubscribe_topic));
 				}
 
-			BifEvent::enqueue_mqtt_unsubscribe(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mqtt_unsubscribe(connection()->bro_analyzer(),
 			                                   connection()->bro_analyzer()->Conn(),
 			                                   ${msg.msg_id},
 			                                   std::move(topics));
diff --git a/src/analyzer/protocol/mysql/mysql-analyzer.pac b/src/analyzer/protocol/mysql/mysql-analyzer.pac
index f49fbe5625..8c94ecdec6 100644
--- a/src/analyzer/protocol/mysql/mysql-analyzer.pac
+++ b/src/analyzer/protocol/mysql/mysql-analyzer.pac
@@ -6,11 +6,11 @@ refine flow MySQL_Flow += {
 		if ( mysql_server_version )
 			{
 			if ( ${msg.version} == 10 )
-				BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(),
 				                                       connection()->bro_analyzer()->Conn(),
 				                                       make_intrusive<StringVal>(c_str(${msg.handshake10.server_version})));
 			if ( ${msg.version} == 9 )
-				BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_mysql_server_version(connection()->bro_analyzer(),
 				                                       connection()->bro_analyzer()->Conn(),
 				                                       make_intrusive<StringVal>(c_str(${msg.handshake9.server_version})));
 			}
@@ -25,11 +25,11 @@ refine flow MySQL_Flow += {
 		if ( mysql_handshake )
 			{
 			if ( ${msg.version} == 10 )
-				BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(),
 				                                  connection()->bro_analyzer()->Conn(),
 				                                  make_intrusive<StringVal>(c_str(${msg.v10_response.username})));
 			if ( ${msg.version} == 9 )
-				BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_mysql_handshake(connection()->bro_analyzer(),
 				                                  connection()->bro_analyzer()->Conn(),
 				                                  make_intrusive<StringVal>(c_str(${msg.v9_response.username})));
 			}
@@ -39,7 +39,7 @@ refine flow MySQL_Flow += {
 	function proc_mysql_command_request_packet(msg: Command_Request_Packet): bool
 		%{
 		if ( mysql_command_request )
-			BifEvent::enqueue_mysql_command_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mysql_command_request(connection()->bro_analyzer(),
 			                                        connection()->bro_analyzer()->Conn(),
 			                                        ${msg.command},
 			                                        to_stringval(${msg.arg}));
@@ -49,7 +49,7 @@ refine flow MySQL_Flow += {
 	function proc_err_packet(msg: ERR_Packet): bool
 		%{
 		if ( mysql_error )
-			BifEvent::enqueue_mysql_error(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mysql_error(connection()->bro_analyzer(),
 			                              connection()->bro_analyzer()->Conn(),
 			                              ${msg.code},
 			                              to_stringval(${msg.msg}));
@@ -59,7 +59,7 @@ refine flow MySQL_Flow += {
 	function proc_ok_packet(msg: OK_Packet): bool
 		%{
 		if ( mysql_ok )
-			BifEvent::enqueue_mysql_ok(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_mysql_ok(connection()->bro_analyzer(),
 			                           connection()->bro_analyzer()->Conn(),
 			                           ${msg.rows});
 		return true;
@@ -71,7 +71,7 @@ refine flow MySQL_Flow += {
 			{
 			// This is a bit fake...
 			if ( mysql_ok )
-				BifEvent::enqueue_mysql_ok(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_mysql_ok(connection()->bro_analyzer(),
 				                           connection()->bro_analyzer()->Conn(),
 				                           0);
 			}
@@ -82,8 +82,8 @@ refine flow MySQL_Flow += {
 		if ( ! mysql_result_row )
 			return true;
 
-		auto vt = internal_type("string_vec")->AsVectorType();
-		auto vv = make_intrusive<VectorVal>(vt);
+		auto vt = zeek::id::string_vec;
+		auto vv = make_intrusive<VectorVal>(std::move(vt));
 
 		auto& bstring = ${msg.row.first_field.val};
 		auto ptr = reinterpret_cast<const char*>(bstring.data());
@@ -98,7 +98,7 @@ refine flow MySQL_Flow += {
 			vv->Assign(vv->Size(), make_intrusive<StringVal>(bstring.length(), ptr));
 			}
 
-		BifEvent::enqueue_mysql_result_row(connection()->bro_analyzer(),
+		zeek::BifEvent::enqueue_mysql_result_row(connection()->bro_analyzer(),
 		                                   connection()->bro_analyzer()->Conn(),
 		                                   std::move(vv));
 
diff --git a/src/analyzer/protocol/ncp/NCP.cc b/src/analyzer/protocol/ncp/NCP.cc
index 31a39023e9..180d1164c9 100644
--- a/src/analyzer/protocol/ncp/NCP.cc
+++ b/src/analyzer/protocol/ncp/NCP.cc
@@ -129,7 +129,7 @@ int FrameBuffer::Deliver(int &len, const u_char* &data)
 
 		if ( msg_len > buf_len )
 			{
-			if ( msg_len > BifConst::NCP::max_frame_size )
+			if ( msg_len > zeek::BifConst::NCP::max_frame_size )
 				return 1;
 
 			buf_len = msg_len;
diff --git a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
index a8cc0f8f02..46a7396e45 100644
--- a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
+++ b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
@@ -1,84 +1,36 @@
+%header{
+	IntrusivePtr<Val> filetime2brotime(uint64_t ts);
+	IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val);
+	IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val);
+%}
 
-refine connection NTLM_Conn += {
-
-	# This is replicated from the SMB analyzer. :(
-	function filetime2brotime(ts: uint64): Val
-		%{
+%code{
+	// This is replicated from the SMB analyzer. :(
+	IntrusivePtr<Val> filetime2brotime(uint64_t ts)
+		{
 		double secs = (ts / 10000000.0);
 
 		// Bro can't support times back to the 1600's
 		// so we subtract a lot of seconds.
-		Val* bro_ts = new Val(secs - 11644473600.0, TYPE_TIME);
+		auto bro_ts = make_intrusive<Val>(secs - 11644473600.0, TYPE_TIME);
 
 		return bro_ts;
-		%}
+		}
 
-	function build_version_record(val: NTLM_Version): BroVal
-		%{
-		RecordVal* result = new RecordVal(BifType::Record::NTLM::Version);
+	IntrusivePtr<RecordVal> build_version_record(NTLM_Version* val)
+		{
+		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Version);
 		result->Assign(0, val_mgr->Count(${val.major_version}));
 		result->Assign(1, val_mgr->Count(${val.minor_version}));
 		result->Assign(2, val_mgr->Count(${val.build_number}));
 		result->Assign(3, val_mgr->Count(${val.ntlm_revision}));
 
 		return result;
-		%}
+		}
 
-	function build_av_record(val: NTLM_AV_Pair_Sequence, len: uint16): BroVal
-		%{
-		RecordVal* result = new RecordVal(BifType::Record::NTLM::AVs);
-		for ( uint i = 0; ; i++ )
-			{
-			if ( i >= ${val.pairs}->size() )
-				{
-				if ( len != 0 )
-					// According to spec, the TargetInfo MUST be a sequence of
-					// AV_PAIRs and terminated by the null AV_PAIR when the
-					// TargetInfoLen is non-zero, so this is in violation.
-					bro_analyzer()->ProtocolViolation("NTLM AV Pair loop underflow");
-
-				return result;
-				}
-
-			switch ( ${val.pairs[i].id} )
-				{
-				case 0:
-					return result;
-				case 1:
-					result->Assign(0, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].nb_computer_name.data}));
-					break;
-				case 2:
-					result->Assign(1, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].nb_domain_name.data}));
-					break;
-				case 3:
-					result->Assign(2, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_computer_name.data}));
-					break;
-				case 4:
-					result->Assign(3, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_domain_name.data}));
-					break;
-				case 5:
-					result->Assign(4, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_tree_name.data}));
-					break;
-				case 6:
-					result->Assign(5, val_mgr->Bool(${val.pairs[i].constrained_auth}));
-					break;
-				case 7:
-					result->Assign(6, filetime2brotime(${val.pairs[i].timestamp}));
-					break;
-				case 8:
-					result->Assign(7, val_mgr->Count(${val.pairs[i].single_host.machine_id}));
-					break;
-				case 9:
-					result->Assign(8, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].target_name.data}));
-					break;
-				}
-			}
-		return result;
-		%}
-
-	function build_negotiate_flag_record(val: NTLM_Negotiate_Flags): BroVal
-		%{
-		RecordVal* flags = new RecordVal(BifType::Record::NTLM::NegotiateFlags);
+	IntrusivePtr<RecordVal> build_negotiate_flag_record(NTLM_Negotiate_Flags* val)
+		{
+		auto flags = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::NegotiateFlags);
 		flags->Assign(0, val_mgr->Bool(${val.negotiate_56}));
 		flags->Assign(1, val_mgr->Bool(${val.negotiate_key_exch}));
 		flags->Assign(2, val_mgr->Bool(${val.negotiate_128}));
@@ -103,6 +55,61 @@ refine connection NTLM_Conn += {
 		flags->Assign(21, val_mgr->Bool(${val.negotiate_unicode}));
 
 		return flags;
+		}
+%}
+
+refine connection NTLM_Conn += {
+
+	function build_av_record(val: NTLM_AV_Pair_Sequence, len: uint16): BroVal
+		%{
+		RecordVal* result = new RecordVal(zeek::BifType::Record::NTLM::AVs);
+		for ( uint i = 0; ; i++ )
+			{
+			if ( i >= ${val.pairs}->size() )
+				{
+				if ( len != 0 )
+					// According to spec, the TargetInfo MUST be a sequence of
+					// AV_PAIRs and terminated by the null AV_PAIR when the
+					// TargetInfoLen is non-zero, so this is in violation.
+					bro_analyzer()->ProtocolViolation("NTLM AV Pair loop underflow");
+
+				return result;
+				}
+
+			switch ( ${val.pairs[i].id} )
+				{
+				case 0:
+					return result;
+				case 1:
+					result->Assign(0, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].nb_computer_name.data}));
+					break;
+				case 2:
+					result->Assign(1, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].nb_domain_name.data}));
+					break;
+				case 3:
+					result->Assign(2, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_computer_name.data}));
+					break;
+				case 4:
+					result->Assign(3, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_domain_name.data}));
+					break;
+				case 5:
+					result->Assign(4, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].dns_tree_name.data}));
+					break;
+				case 6:
+					result->Assign(5, val_mgr->Bool(${val.pairs[i].constrained_auth}));
+					break;
+				case 7:
+					result->Assign(6, filetime2brotime(${val.pairs[i].timestamp}));
+					break;
+				case 8:
+					result->Assign(7, val_mgr->Count(${val.pairs[i].single_host.machine_id}));
+					break;
+				case 9:
+					result->Assign(8, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.pairs[i].target_name.data}));
+					break;
+				}
+			}
+		return result;
 		%}
 
 	function proc_ntlm_negotiate(val: NTLM_Negotiate): bool
@@ -110,19 +117,19 @@ refine connection NTLM_Conn += {
 		if ( ! ntlm_negotiate )
 			return true;
 
-		auto result = make_intrusive<RecordVal>(BifType::Record::NTLM::Negotiate);
+		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Negotiate);
 		result->Assign(0, build_negotiate_flag_record(${val.flags}));
 
 		if ( ${val}->has_domain_name() )
-		        result->Assign(1, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.domain_name.string.data}));
+		        result->Assign(1, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.domain_name.string.data}));
 
 		if ( ${val}->has_workstation() )
-		        result->Assign(2, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.workstation.string.data}));
+		        result->Assign(2, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.workstation.string.data}));
 
 		if ( ${val}->has_version() )
 		        result->Assign(3, build_version_record(${val.version}));
 
-		BifEvent::enqueue_ntlm_negotiate(bro_analyzer(),
+		zeek::BifEvent::enqueue_ntlm_negotiate(bro_analyzer(),
 		                                 bro_analyzer()->Conn(),
 		                                 std::move(result));
 
@@ -134,19 +141,19 @@ refine connection NTLM_Conn += {
 		if ( ! ntlm_challenge )
 			return true;
 
-		auto result = make_intrusive<RecordVal>(BifType::Record::NTLM::Challenge);
+		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Challenge);
 		result->Assign(0, build_negotiate_flag_record(${val.flags}));
 
 		if ( ${val}->has_target_name() )
-			result->Assign(1, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.target_name.string.data}));
+			result->Assign(1, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.target_name.string.data}));
 
 		if ( ${val}->has_version() )
 			result->Assign(2, build_version_record(${val.version}));
 
 		if ( ${val}->has_target_info() )
-			result->Assign(3, build_av_record(${val.target_info},  ${val.target_info_fields.length}));
+			result->Assign(3, {AdoptRef{}, build_av_record(${val.target_info},  ${val.target_info_fields.length})});
 
-		BifEvent::enqueue_ntlm_challenge(bro_analyzer(),
+		zeek::BifEvent::enqueue_ntlm_challenge(bro_analyzer(),
 		                                 bro_analyzer()->Conn(),
 		                                 std::move(result));
 
@@ -158,17 +165,17 @@ refine connection NTLM_Conn += {
 		if ( ! ntlm_authenticate )
 			return true;
 
-		auto result = make_intrusive<RecordVal>(BifType::Record::NTLM::Authenticate);
+		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::NTLM::Authenticate);
 		result->Assign(0, build_negotiate_flag_record(${val.flags}));
 
 		if ( ${val}->has_domain_name() > 0 )
-			result->Assign(1, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.domain_name.string.data}));
+			result->Assign(1, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.domain_name.string.data}));
 
 		if ( ${val}->has_user_name() > 0 )
-			result->Assign(2, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.user_name.string.data}));
+			result->Assign(2, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.user_name.string.data}));
 
 		if ( ${val}->has_workstation() > 0 )
-			result->Assign(3, utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), ${val.workstation.string.data}));
+			result->Assign(3, utf16_to_utf8_val(bro_analyzer()->Conn(), ${val.workstation.string.data}));
 
 		if ( ${val}->has_encrypted_session_key() > 0 )
 			result->Assign(4, to_stringval(${val.encrypted_session_key.string.data}));
@@ -176,7 +183,7 @@ refine connection NTLM_Conn += {
 		if ( ${val}->has_version() )
 			result->Assign(5, build_version_record(${val.version}));
 
-		BifEvent::enqueue_ntlm_authenticate(bro_analyzer(),
+		zeek::BifEvent::enqueue_ntlm_authenticate(bro_analyzer(),
 		                                    bro_analyzer()->Conn(),
 		                                    std::move(result));
 		return true;
diff --git a/src/analyzer/protocol/ntp/ntp-analyzer.pac b/src/analyzer/protocol/ntp/ntp-analyzer.pac
index afac5ce304..bd9af501d1 100644
--- a/src/analyzer/protocol/ntp/ntp-analyzer.pac
+++ b/src/analyzer/protocol/ntp/ntp-analyzer.pac
@@ -8,34 +8,33 @@
 %}
 
 %header{
-	Val* proc_ntp_short(const NTP_Short_Time* t);
-	Val* proc_ntp_timestamp(const NTP_Time* t);
+	IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t);
+	IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t);
+	IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm);
+	IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm);
+	IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7);
 %}
 
 
 %code{
-	Val* proc_ntp_short(const NTP_Short_Time* t)
+	IntrusivePtr<Val> proc_ntp_short(const NTP_Short_Time* t)
 		{
 		if ( t->seconds() == 0 && t->fractions() == 0 )
-			return new Val(0.0, TYPE_INTERVAL);
-		return new Val(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL);
+			return make_intrusive<Val>(0.0, TYPE_INTERVAL);
+		return make_intrusive<Val>(t->seconds() + t->fractions()*FRAC_16, TYPE_INTERVAL);
 		}
 
-	Val* proc_ntp_timestamp(const NTP_Time* t)
+	IntrusivePtr<Val> proc_ntp_timestamp(const NTP_Time* t)
 		{
 		if ( t->seconds() == 0 && t->fractions() == 0)
-			return new Val(0.0, TYPE_TIME);
-		return new Val(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32, TYPE_TIME);
+			return make_intrusive<Val>(0.0, TYPE_TIME);
+		return make_intrusive<Val>(EPOCH_OFFSET + t->seconds() + t->fractions()*FRAC_32, TYPE_TIME);
 		}
-%}
 
-
-refine flow NTP_Flow += {
-
-	# This builds the standard msg record
-	function BuildNTPStdMsg(nsm: NTP_std_msg): BroVal
-		%{
-		RecordVal* rv = new RecordVal(BifType::Record::NTP::StandardMessage);
+	// This builds the standard msg record
+	IntrusivePtr<RecordVal> BuildNTPStdMsg(NTP_std_msg* nsm)
+		{
+		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::StandardMessage);
 
 		rv->Assign(0, val_mgr->Count(${nsm.stratum}));
 		rv->Assign(1, make_intrusive<Val>(pow(2, ${nsm.poll}), TYPE_INTERVAL));
@@ -83,12 +82,12 @@ refine flow NTP_Flow += {
 			}
 
 		return rv;
-		%}
+		}
 
-	# This builds the control msg record
-	function BuildNTPControlMsg(ncm: NTP_control_msg): BroVal
-		%{
-		RecordVal* rv = new RecordVal(BifType::Record::NTP::ControlMessage);
+	// This builds the control msg record
+	IntrusivePtr<RecordVal> BuildNTPControlMsg(NTP_control_msg* ncm)
+		{
+		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::ControlMessage);
 
 		rv->Assign(0, val_mgr->Count(${ncm.OpCode}));
 		rv->Assign(1, val_mgr->Bool(${ncm.R}));
@@ -108,12 +107,12 @@ refine flow NTP_Flow += {
 			}
 
 		return rv;
-		%}
+		}
 
-	# This builds the mode7 msg record
-	function BuildNTPMode7Msg(m7: NTP_mode7_msg): BroVal
-		%{
-		RecordVal* rv = new RecordVal(BifType::Record::NTP::Mode7Message);
+	// This builds the mode7 msg record
+	IntrusivePtr<RecordVal> BuildNTPMode7Msg(NTP_mode7_msg* m7)
+		{
+		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::Mode7Message);
 
 		rv->Assign(0, val_mgr->Count(${m7.request_code}));
 		rv->Assign(1, val_mgr->Bool(${m7.auth_bit}));
@@ -125,7 +124,11 @@ refine flow NTP_Flow += {
 			rv->Assign(5, to_stringval(${m7.data}));
 
 		return rv;
-		%}
+		}
+%}
+
+
+refine flow NTP_Flow += {
 
 
 	function proc_ntp_message(msg: NTP_PDU): bool
@@ -135,7 +138,7 @@ refine flow NTP_Flow += {
 		if ( ! ntp_message )
 			return false;
 
-		auto rv = make_intrusive<RecordVal>(BifType::Record::NTP::Message);
+		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::NTP::Message);
 		rv->Assign(0, val_mgr->Count(${msg.version}));
 		rv->Assign(1, val_mgr->Count(${msg.mode}));
 
@@ -147,7 +150,7 @@ refine flow NTP_Flow += {
 		else if ( ${msg.mode} == 7 )
 			rv->Assign(4, BuildNTPMode7Msg(${msg.mode7}));
 
-		BifEvent::enqueue_ntp_message(connection()->bro_analyzer(),
+		zeek::BifEvent::enqueue_ntp_message(connection()->bro_analyzer(),
 		                              connection()->bro_analyzer()->Conn(),
 		                              is_orig(), std::move(rv));
 		return true;
diff --git a/src/analyzer/protocol/pia/PIA.cc b/src/analyzer/protocol/pia/PIA.cc
index fe5797d6d1..8e0d7e9295 100644
--- a/src/analyzer/protocol/pia/PIA.cc
+++ b/src/analyzer/protocol/pia/PIA.cc
@@ -156,12 +156,11 @@ void PIA_UDP::ActivateAnalyzer(analyzer::Tag tag, const Rule* rule)
 		if ( protocol_late_match )
 			{
 			// Queue late match event
-			EnumVal *tval = tag ? tag.AsEnumVal() : GetAnalyzerTag().AsEnumVal();
+			if ( ! tag )
+				tag = GetAnalyzerTag();
 
-			mgr.Enqueue(protocol_late_match,
-			    ConnVal(),
-			    IntrusivePtr{NewRef{}, tval}
-			);
+			const auto& tval = tag.AsVal();
+			mgr.Enqueue(protocol_late_match, ConnVal(), tval);
 			}
 
 		pkt_buffer.state = dpd_late_match_stop ? SKIPPING : MATCHING_ONLY;
@@ -304,12 +303,11 @@ void PIA_TCP::ActivateAnalyzer(analyzer::Tag tag, const Rule* rule)
 		if ( protocol_late_match )
 			{
 			// Queue late match event
-			EnumVal *tval = tag ? tag.AsEnumVal() : GetAnalyzerTag().AsEnumVal();
+			if ( ! tag )
+				tag = GetAnalyzerTag();
 
-			mgr.Enqueue(protocol_late_match,
-			    ConnVal(),
-			    IntrusivePtr{NewRef{}, tval}
-			);
+			const auto& tval = tag.AsVal();
+			mgr.Enqueue(protocol_late_match, ConnVal(), tval);
 			}
 
 		stream_buffer.state = dpd_late_match_stop ? SKIPPING : MATCHING_ONLY;
diff --git a/src/analyzer/protocol/radius/radius-analyzer.pac b/src/analyzer/protocol/radius/radius-analyzer.pac
index 713e249e4e..02c500e676 100644
--- a/src/analyzer/protocol/radius/radius-analyzer.pac
+++ b/src/analyzer/protocol/radius/radius-analyzer.pac
@@ -7,21 +7,21 @@ refine flow RADIUS_Flow += {
 		if ( ! radius_message )
 			return false;
 
-		auto result = make_intrusive<RecordVal>(BifType::Record::RADIUS::Message);
+		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::RADIUS::Message);
 		result->Assign(0, val_mgr->Count(${msg.code}));
 		result->Assign(1, val_mgr->Count(${msg.trans_id}));
 		result->Assign(2, to_stringval(${msg.authenticator}));
 
 		if ( ${msg.attributes}->size() )
 			{
-			TableVal* attributes = new TableVal({NewRef{}, BifType::Table::RADIUS::Attributes});
+			auto attributes = make_intrusive<TableVal>(zeek::BifType::Table::RADIUS::Attributes);
 
 			for ( uint i = 0; i < ${msg.attributes}->size(); ++i )
 				{
 				auto index = val_mgr->Count(${msg.attributes[i].code});
 
 				// Do we already have a vector of attributes for this type?
-				auto current = attributes->Lookup(index.get());
+				auto current = attributes->FindOrDefault(index);
 				IntrusivePtr<Val> val = to_stringval(${msg.attributes[i].value});
 
 				if ( current )
@@ -32,16 +32,16 @@ refine flow RADIUS_Flow += {
 
 				else
 					{
-					VectorVal* attribute_list = new VectorVal(BifType::Vector::RADIUS::AttributeList);
+					auto attribute_list = make_intrusive<VectorVal>(zeek::BifType::Vector::RADIUS::AttributeList);
 					attribute_list->Assign((unsigned int)0, std::move(val));
-					attributes->Assign(index.get(), attribute_list);
+					attributes->Assign(std::move(index), std::move(attribute_list));
 					}
 				}
 
-			result->Assign(3, attributes);
-		}
+			result->Assign(3, std::move(attributes));
+			}
 
-		BifEvent::enqueue_radius_message(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), std::move(result));
+		zeek::BifEvent::enqueue_radius_message(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), std::move(result));
 		return true;
 		%}
 
@@ -50,7 +50,7 @@ refine flow RADIUS_Flow += {
 		if ( ! radius_attribute )
 			return false;
 
-		BifEvent::enqueue_radius_attribute(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_radius_attribute(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
 		                                    ${attr.code}, to_stringval(${attr.value}));
 		return true;
 		%}
diff --git a/src/analyzer/protocol/rdp/RDP.cc b/src/analyzer/protocol/rdp/RDP.cc
index 1509064221..0d1f77a70d 100644
--- a/src/analyzer/protocol/rdp/RDP.cc
+++ b/src/analyzer/protocol/rdp/RDP.cc
@@ -75,7 +75,7 @@ void RDP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
 		else
 			{
 			if ( rdp_native_encrypted_data )
-				BifEvent::enqueue_rdp_native_encrypted_data(
+				zeek::BifEvent::enqueue_rdp_native_encrypted_data(
 				        interp->bro_analyzer(), interp->bro_analyzer()->Conn(),
 				        orig, len);
 			}
diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac
index 962202a2f2..4f1f9ef39a 100644
--- a/src/analyzer/protocol/rdp/rdp-analyzer.pac
+++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac
@@ -9,7 +9,7 @@ refine flow RDP_Flow += {
 		%{
 		if ( rdp_connect_request )
 			{
-			BifEvent::enqueue_rdp_connect_request(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_connect_request(connection()->bro_analyzer(),
 			                                      connection()->bro_analyzer()->Conn(),
 			                                      to_stringval(${cr.cookie_value}),
 			                                      ${cr.rdp_neg_req} ? ${cr.rdp_neg_req.flags} : 0);
@@ -22,7 +22,7 @@ refine flow RDP_Flow += {
 		%{
 		if ( rdp_negotiation_response )
 			{
-			BifEvent::enqueue_rdp_negotiation_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_negotiation_response(connection()->bro_analyzer(),
 			                                           connection()->bro_analyzer()->Conn(),
 			                                           ${nr.selected_protocol},
 			                                           ${nr.flags});
@@ -35,7 +35,7 @@ refine flow RDP_Flow += {
 		%{
 		if ( rdp_negotiation_failure )
 			{
-			BifEvent::enqueue_rdp_negotiation_failure(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_negotiation_failure(connection()->bro_analyzer(),
 			                                          connection()->bro_analyzer()->Conn(),
 			                                          ${nf.failure_code},
 			                                          ${nf.flags});
@@ -50,7 +50,7 @@ refine flow RDP_Flow += {
 		connection()->bro_analyzer()->ProtocolConfirmation();
 
 		if ( rdp_gcc_server_create_response )
-			BifEvent::enqueue_rdp_gcc_server_create_response(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_gcc_server_create_response(connection()->bro_analyzer(),
 			                                                 connection()->bro_analyzer()->Conn(),
 			                                                 ${gcc_response.result});
 
@@ -64,7 +64,7 @@ refine flow RDP_Flow += {
 
 		if ( rdp_client_core_data )
 			{
-			auto ec_flags = make_intrusive<RecordVal>(BifType::Record::RDP::EarlyCapabilityFlags);
+			auto ec_flags = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::EarlyCapabilityFlags);
 			ec_flags->Assign(0, val_mgr->Bool(${ccore.SUPPORT_ERRINFO_PDU}));
 			ec_flags->Assign(1, val_mgr->Bool(${ccore.WANT_32BPP_SESSION}));
 			ec_flags->Assign(2, val_mgr->Bool(${ccore.SUPPORT_STATUSINFO_PDU}));
@@ -75,7 +75,7 @@ refine flow RDP_Flow += {
 			ec_flags->Assign(7, val_mgr->Bool(${ccore.SUPPORT_DYNAMIC_TIME_ZONE}));
 			ec_flags->Assign(8, val_mgr->Bool(${ccore.SUPPORT_HEARTBEAT_PDU}));
 
-			auto ccd = make_intrusive<RecordVal>(BifType::Record::RDP::ClientCoreData);
+			auto ccd = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientCoreData);
 			ccd->Assign(0, val_mgr->Count(${ccore.version_major}));
 			ccd->Assign(1, val_mgr->Count(${ccore.version_minor}));
 			ccd->Assign(2, val_mgr->Count(${ccore.desktop_width}));
@@ -84,20 +84,20 @@ refine flow RDP_Flow += {
 			ccd->Assign(5, val_mgr->Count(${ccore.sas_sequence}));
 			ccd->Assign(6, val_mgr->Count(${ccore.keyboard_layout}));
 			ccd->Assign(7, val_mgr->Count(${ccore.client_build}));
-			ccd->Assign(8, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.client_name}));
+			ccd->Assign(8, utf16_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.client_name}));
 			ccd->Assign(9, val_mgr->Count(${ccore.keyboard_type}));
 			ccd->Assign(10, val_mgr->Count(${ccore.keyboard_sub}));
 			ccd->Assign(11, val_mgr->Count(${ccore.keyboard_function_key}));
-			ccd->Assign(12, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.ime_file_name}));
+			ccd->Assign(12, utf16_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.ime_file_name}));
 			ccd->Assign(13, val_mgr->Count(${ccore.post_beta2_color_depth}));
 			ccd->Assign(14, val_mgr->Count(${ccore.client_product_id}));
 			ccd->Assign(15, val_mgr->Count(${ccore.serial_number}));
 			ccd->Assign(16, val_mgr->Count(${ccore.high_color_depth}));
 			ccd->Assign(17, val_mgr->Count(${ccore.supported_color_depths}));
 			ccd->Assign(18, std::move(ec_flags));
-			ccd->Assign(19, utf16_bytestring_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.dig_product_id}));
+			ccd->Assign(19, utf16_to_utf8_val(connection()->bro_analyzer()->Conn(), ${ccore.dig_product_id}));
 
-			BifEvent::enqueue_rdp_client_core_data(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_client_core_data(connection()->bro_analyzer(),
 			                                       connection()->bro_analyzer()->Conn(),
 			                                       std::move(ccd));
 			}
@@ -110,11 +110,11 @@ refine flow RDP_Flow += {
 		if ( ! rdp_client_security_data )
 			return false;
 
-		auto csd = make_intrusive<RecordVal>(BifType::Record::RDP::ClientSecurityData);
+		auto csd = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientSecurityData);
 		csd->Assign(0, val_mgr->Count(${csec.encryption_methods}));
 		csd->Assign(1, val_mgr->Count(${csec.ext_encryption_methods}));
 
-		BifEvent::enqueue_rdp_client_security_data(connection()->bro_analyzer(),
+		zeek::BifEvent::enqueue_rdp_client_security_data(connection()->bro_analyzer(),
 		                                           connection()->bro_analyzer()->Conn(),
 		                                           std::move(csd));
 		return true;
@@ -127,11 +127,11 @@ refine flow RDP_Flow += {
 
 		if ( ${cnetwork.channel_def_array}->size() )
 			{
-			auto channels = make_intrusive<VectorVal>(BifType::Vector::RDP::ClientChannelList);
+			auto channels = make_intrusive<VectorVal>(zeek::BifType::Vector::RDP::ClientChannelList);
 
 			for ( uint i = 0; i < ${cnetwork.channel_def_array}->size(); ++i )
 				{
-				auto channel_def = make_intrusive<RecordVal>(BifType::Record::RDP::ClientChannelDef);
+				auto channel_def = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientChannelDef);
 
 				channel_def->Assign(0, to_stringval(${cnetwork.channel_def_array[i].name}));
 				channel_def->Assign(1, val_mgr->Count(${cnetwork.channel_def_array[i].options}));
@@ -151,7 +151,7 @@ refine flow RDP_Flow += {
 				channels->Assign(channels->Size(), std::move(channel_def));
 				}
 
-			BifEvent::enqueue_rdp_client_network_data(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_client_network_data(connection()->bro_analyzer(),
 			                                          connection()->bro_analyzer()->Conn(),
 			                                          std::move(channels));
 			}
@@ -164,7 +164,7 @@ refine flow RDP_Flow += {
 		if ( ! rdp_client_cluster_data )
 			return false;
 
-		auto ccld = make_intrusive<RecordVal>(BifType::Record::RDP::ClientClusterData);
+		auto ccld = make_intrusive<RecordVal>(zeek::BifType::Record::RDP::ClientClusterData);
 		ccld->Assign(0, val_mgr->Count(${ccluster.flags}));
 		ccld->Assign(1, val_mgr->Count(${ccluster.redir_session_id}));
 		ccld->Assign(2, val_mgr->Bool(${ccluster.REDIRECTION_SUPPORTED}));
@@ -172,7 +172,7 @@ refine flow RDP_Flow += {
 		ccld->Assign(4, val_mgr->Bool(${ccluster.REDIRECTED_SESSIONID_FIELD_VALID}));
 		ccld->Assign(5, val_mgr->Bool(${ccluster.REDIRECTED_SMARTCARD}));
 
-		BifEvent::enqueue_rdp_client_cluster_data(connection()->bro_analyzer(),
+		zeek::BifEvent::enqueue_rdp_client_cluster_data(connection()->bro_analyzer(),
 		                                          connection()->bro_analyzer()->Conn(),
 		                                          std::move(ccld));
 		return true;
@@ -183,7 +183,7 @@ refine flow RDP_Flow += {
 		connection()->bro_analyzer()->ProtocolConfirmation();
 
 		if ( rdp_server_security )
-			BifEvent::enqueue_rdp_server_security(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_server_security(connection()->bro_analyzer(),
 			                                       connection()->bro_analyzer()->Conn(),
 			                                       ${ssd.encryption_method},
 			                                       ${ssd.encryption_level});
@@ -195,7 +195,7 @@ refine flow RDP_Flow += {
 		%{
 		if ( rdp_server_certificate )
 			{
-			BifEvent::enqueue_rdp_server_certificate(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_server_certificate(connection()->bro_analyzer(),
 			                                          connection()->bro_analyzer()->Conn(),
 			                                          ${cert.cert_type},
 			                                          ${cert.permanently_issued});
diff --git a/src/analyzer/protocol/rdp/rdp-protocol.pac b/src/analyzer/protocol/rdp/rdp-protocol.pac
index 4d7ac79df2..ca88d90284 100644
--- a/src/analyzer/protocol/rdp/rdp-protocol.pac
+++ b/src/analyzer/protocol/rdp/rdp-protocol.pac
@@ -383,7 +383,7 @@ refine connection RDP_Conn += {
 
 		if ( rdp_begin_encryption )
 			{
-			BifEvent::enqueue_rdp_begin_encryption(bro_analyzer(),
+			zeek::BifEvent::enqueue_rdp_begin_encryption(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
 			                                       ${method});
 			}
diff --git a/src/analyzer/protocol/rdp/rdpeudp-analyzer.pac b/src/analyzer/protocol/rdp/rdpeudp-analyzer.pac
index a5744b637c..9e2730ba60 100644
--- a/src/analyzer/protocol/rdp/rdpeudp-analyzer.pac
+++ b/src/analyzer/protocol/rdp/rdpeudp-analyzer.pac
@@ -45,7 +45,7 @@ refine connection RDPEUDP_Conn += {
 			orig_lossy_ = true;
 
 		if ( rdpeudp_syn )
-			BifEvent::enqueue_rdpeudp_syn(bro_analyzer(), bro_analyzer()->Conn());
+			zeek::BifEvent::enqueue_rdpeudp_syn(bro_analyzer(), bro_analyzer()->Conn());
 
 		state_ = NEED_SYNACK;
 		return true;
@@ -60,7 +60,7 @@ refine connection RDPEUDP_Conn += {
 			return false;
 
 		if ( rdpeudp_synack )
-			BifEvent::enqueue_rdpeudp_synack(bro_analyzer(), bro_analyzer()->Conn());
+			zeek::BifEvent::enqueue_rdpeudp_synack(bro_analyzer(), bro_analyzer()->Conn());
 
 		bro_analyzer()->ProtocolConfirmation();
 		state_ = NEED_ACK;
@@ -79,11 +79,11 @@ refine connection RDPEUDP_Conn += {
 			state_ = ESTABLISHED;
 
 			if ( rdpeudp_established )
-				BifEvent::enqueue_rdpeudp_established(bro_analyzer(), bro_analyzer()->Conn(), 1);
+				zeek::BifEvent::enqueue_rdpeudp_established(bro_analyzer(), bro_analyzer()->Conn(), 1);
 			}
 
 		if ( state_ == ESTABLISHED && rdpeudp_data )
-			BifEvent::enqueue_rdpeudp_data(bro_analyzer(),
+			zeek::BifEvent::enqueue_rdpeudp_data(bro_analyzer(),
 							bro_analyzer()->Conn(),
 							is_orig,
 							1,
@@ -102,13 +102,13 @@ refine connection RDPEUDP_Conn += {
 		if ( state_ == NEED_ACK )
 			{
 			if ( rdpeudp_established )
-				BifEvent::enqueue_rdpeudp_established(bro_analyzer(), bro_analyzer()->Conn(), 2);
+				zeek::BifEvent::enqueue_rdpeudp_established(bro_analyzer(), bro_analyzer()->Conn(), 2);
 
 			state_ = ESTABLISHED;
 			}
 
 		if ( state_ == ESTABLISHED && rdpeudp_data )
-			BifEvent::enqueue_rdpeudp_data(bro_analyzer(),
+			zeek::BifEvent::enqueue_rdpeudp_data(bro_analyzer(),
 							bro_analyzer()->Conn(),
 							is_orig,
 							2,
diff --git a/src/analyzer/protocol/rfb/rfb-analyzer.pac b/src/analyzer/protocol/rfb/rfb-analyzer.pac
index 80f6c2c58b..b3e99e1af2 100644
--- a/src/analyzer/protocol/rfb/rfb-analyzer.pac
+++ b/src/analyzer/protocol/rfb/rfb-analyzer.pac
@@ -4,7 +4,7 @@ refine flow RFB_Flow += {
 		if ( client )
 			{
 			if ( rfb_client_version )
-				BifEvent::enqueue_rfb_client_version(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_rfb_client_version(connection()->bro_analyzer(),
 				                                     connection()->bro_analyzer()->Conn(),
 				                                     to_stringval(major),
 				                                     to_stringval(minor));
@@ -14,7 +14,7 @@ refine flow RFB_Flow += {
 		else
 			{
 			if ( rfb_server_version )
-				BifEvent::enqueue_rfb_server_version(connection()->bro_analyzer(),
+				zeek::BifEvent::enqueue_rfb_server_version(connection()->bro_analyzer(),
 				                                     connection()->bro_analyzer()->Conn(),
 				                                     to_stringval(major),
 				                                     to_stringval(minor));
@@ -26,21 +26,21 @@ refine flow RFB_Flow += {
 	function proc_rfb_share_flag(shared: bool) : bool
 		%{
 		if ( rfb_share_flag )
-			BifEvent::enqueue_rfb_share_flag(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), shared);
+			zeek::BifEvent::enqueue_rfb_share_flag(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), shared);
 		return true;
 		%}
 
 	function proc_security_types(msg: RFBSecurityType) : bool
 		%{
 		if ( rfb_authentication_type )
-			BifEvent::enqueue_rfb_authentication_type(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), ${msg.sectype});
+			zeek::BifEvent::enqueue_rfb_authentication_type(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), ${msg.sectype});
 		return true;
 		%}
 
 	function proc_security_types37(msg: RFBAuthTypeSelected) : bool
 		%{
 		if ( rfb_authentication_type )
-			BifEvent::enqueue_rfb_authentication_type(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), ${msg.type});
+			zeek::BifEvent::enqueue_rfb_authentication_type(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), ${msg.type});
 		return true;
 		%}
 
@@ -50,7 +50,7 @@ refine flow RFB_Flow += {
 			{
 			auto vec_ptr = ${msg.name};
 			auto name_ptr = &((*vec_ptr)[0]);
-			BifEvent::enqueue_rfb_server_parameters(
+			zeek::BifEvent::enqueue_rfb_server_parameters(
 			    connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
 			    make_intrusive<StringVal>(${msg.name}->size(), (const char*)name_ptr),
 			    ${msg.width},
@@ -62,7 +62,7 @@ refine flow RFB_Flow += {
 	function proc_handle_security_result(result : uint32) : bool
 		%{
 		if ( rfb_auth_result )
-			BifEvent::enqueue_rfb_auth_result(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), result);
+			zeek::BifEvent::enqueue_rfb_auth_result(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), result);
 		return true;
 		%}
 };
diff --git a/src/analyzer/protocol/rpc/MOUNT.cc b/src/analyzer/protocol/rpc/MOUNT.cc
index cddb49c547..a3b9ab071a 100644
--- a/src/analyzer/protocol/rpc/MOUNT.cc
+++ b/src/analyzer/protocol/rpc/MOUNT.cc
@@ -22,7 +22,7 @@ bool MOUNT_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 
 	uint32_t proc = c->Proc();
 	// The call arguments, depends on the call type obviously ...
-	Val *callarg = nullptr;
+	IntrusivePtr<RecordVal> callarg;
 
 	switch ( proc ) {
 		case BifEnum::MOUNT3::PROC_NULL:
@@ -41,7 +41,6 @@ bool MOUNT_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 		break;
 
 	default:
-		callarg = nullptr;
 		if ( proc < BifEnum::MOUNT3::PROC_END_OF_PROCS )
 			{
 			// We know the procedure but haven't implemented it.
@@ -58,19 +57,10 @@ bool MOUNT_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 	}
 
 	if ( ! buf )
-		{
-		// There was a parse error while trying to extract the call
-		// arguments. However, we don't know where exactly it
-		// happened and whether Vals where already allocated (e.g., a
-		// RecordVal was allocated but we failed to fill it). So we
-		// Unref() the call arguments, and we are fine.
-		Unref(callarg);
-		callarg = nullptr;
+		// There was a parse error while trying to extract the call arguments.
 		return false;
-		}
-
-	c->AddVal(callarg); // It's save to AddVal(0).
 
+	c->AddVal(callarg);
 	return true;
 	}
 
@@ -79,7 +69,7 @@ bool MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_statu
 			       double last_time, int reply_len)
 	{
 	EventHandlerPtr event = nullptr;
-	Val* reply = nullptr;
+	IntrusivePtr<Val> reply;
 	BifEnum::MOUNT3::status_t mount_status = BifEnum::MOUNT3::MNT3_OK;
 	bool rpc_success = ( rpc_status == BifEnum::RPC_SUCCESS );
 
@@ -119,14 +109,12 @@ bool MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_statu
 		break;
 
 	case BifEnum::MOUNT3::PROC_UMNT:
-		reply = nullptr;
 		n = 0;
 		mount_status = BifEnum::MOUNT3::MNT3_OK;
 		event = mount_proc_umnt;
 		break;
 
 	case BifEnum::MOUNT3::PROC_UMNT_ALL:
-		reply = nullptr;
 		n = 0;
 		mount_status = BifEnum::MOUNT3::MNT3_OK;
 		event = mount_proc_umnt;
@@ -139,7 +127,7 @@ bool MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_statu
 			// Otherwise DeliverRPC would complain about
 			// excess_RPC.
 			n = 0;
-			reply = BifType::Enum::MOUNT3::proc_t->GetVal(c->Proc()).release();
+			reply = zeek::BifType::Enum::MOUNT3::proc_t->GetVal(c->Proc());
 			event = mount_proc_not_implemented;
 			}
 		else
@@ -148,9 +136,7 @@ bool MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_statu
 
 	if ( rpc_success && ! buf )
 		{
-		// There was a parse error. We have to unref the reply. (see
-		// also comments in RPC_BuildCall.
-		Unref(reply);
+		// There was a parse error.
 		reply = nullptr;
 		return false;
 		}
@@ -163,21 +149,20 @@ bool MOUNT_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_statu
 	// optional and all are set to 0 ...
 	if ( event )
 		{
-		Val *request = c->TakeRequestVal();
+		auto request = c->TakeRequestVal();
 
 		auto vl = event_common_vl(c, rpc_status, mount_status,
 					start_time, last_time, reply_len, (bool)request + (bool)reply);
 
 		if ( request )
-			vl.emplace_back(AdoptRef{}, request);
+			vl.emplace_back(std::move(request));
 
 		if ( reply )
-			vl.emplace_back(AdoptRef{}, reply);
+			vl.emplace_back(reply);
 
 		analyzer->EnqueueConnEvent(event, std::move(vl));
 		}
-	else
-		Unref(reply);
+
 	return true;
 	}
 
@@ -192,16 +177,16 @@ zeek::Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c,
 	zeek::Args vl;
 	vl.reserve(2 + extra_elements);
 	vl.emplace_back(analyzer->ConnVal());
-	auto auxgids = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+	auto auxgids = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 	for (size_t i = 0; i < c->AuxGIDs().size(); ++i)
 		{
 		auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i]));
 		}
 
-	auto info = make_intrusive<RecordVal>(BifType::Record::MOUNT3::info_t);
-	info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status));
-	info->Assign(1, BifType::Enum::MOUNT3::status_t->GetVal(mount_status));
+	auto info = make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::info_t);
+	info->Assign(0, zeek::BifType::Enum::rpc_status->GetVal(rpc_status));
+	info->Assign(1, zeek::BifType::Enum::MOUNT3::status_t->GetVal(mount_status));
 	info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME));
 	info->Assign(3, make_intrusive<Val>(c->LastTime() - c->StartTime(), TYPE_INTERVAL));
 	info->Assign(4, val_mgr->Count(c->RPCLen()));
@@ -218,13 +203,14 @@ zeek::Args MOUNT_Interp::event_common_vl(RPC_CallInfo *c,
 	return vl;
 	}
 
-EnumVal* MOUNT_Interp::mount3_auth_flavor(const u_char*& buf, int& n)
+IntrusivePtr<EnumVal> MOUNT_Interp::mount3_auth_flavor(const u_char*& buf, int& n)
     {
 	BifEnum::MOUNT3::auth_flavor_t t = (BifEnum::MOUNT3::auth_flavor_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::MOUNT3::auth_flavor_t->GetVal(t).release();
+	auto rval = zeek::BifType::Enum::MOUNT3::auth_flavor_t->GetVal(t);
+	return rval;
     }
 
-StringVal* MOUNT_Interp::mount3_fh(const u_char*& buf, int& n)
+IntrusivePtr<StringVal> MOUNT_Interp::mount3_fh(const u_char*& buf, int& n)
 	{
 	int fh_n;
 	const u_char* fh = extract_XDR_opaque(buf, n, fh_n, 64);
@@ -232,10 +218,10 @@ StringVal* MOUNT_Interp::mount3_fh(const u_char*& buf, int& n)
 	if ( ! fh )
 		return nullptr;
 
-	return new StringVal(new BroString(fh, fh_n, false));
+	return make_intrusive<StringVal>(new BroString(fh, fh_n, false));
 	}
 
-StringVal* MOUNT_Interp::mount3_filename(const u_char*& buf, int& n)
+IntrusivePtr<StringVal> MOUNT_Interp::mount3_filename(const u_char*& buf, int& n)
 	{
 	int name_len;
 	const u_char* name = extract_XDR_opaque(buf, n, name_len);
@@ -243,20 +229,20 @@ StringVal* MOUNT_Interp::mount3_filename(const u_char*& buf, int& n)
 	if ( ! name )
 		return nullptr;
 
-	return new StringVal(new BroString(name, name_len, false));
+	return make_intrusive<StringVal>(new BroString(name, name_len, false));
 	}
 
-RecordVal* MOUNT_Interp::mount3_dirmntargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> MOUNT_Interp::mount3_dirmntargs(const u_char*& buf, int& n)
 	{
-	RecordVal* dirmntargs = new RecordVal(BifType::Record::MOUNT3::dirmntargs_t);
+	auto dirmntargs = make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::dirmntargs_t);
 	dirmntargs->Assign(0, mount3_filename(buf, n));
 	return dirmntargs;
 	}
 
-RecordVal* MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n,
+IntrusivePtr<RecordVal> MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n,
 		     BifEnum::MOUNT3::status_t status)
 	{
-	RecordVal* rep = new RecordVal(BifType::Record::MOUNT3::mnt_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::MOUNT3::mnt_reply_t);
 
 	if ( status == BifEnum::MOUNT3::MNT3_OK )
 		{
@@ -272,9 +258,8 @@ RecordVal* MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n,
 			auth_flavors_count = max_auth_flavors;
 			}
 
-		VectorType* enum_vector = new VectorType(base_type(TYPE_ENUM));
-		VectorVal* auth_flavors = new VectorVal(enum_vector);
-		Unref(enum_vector);
+		auto enum_vector = make_intrusive<VectorType>(base_type(TYPE_ENUM));
+		auto auth_flavors = make_intrusive<VectorVal>(std::move(enum_vector));
 
 		for ( auto i = 0u; i < auth_flavors_count; ++i )
 			auth_flavors->Assign(auth_flavors->Size(),
@@ -284,7 +269,7 @@ RecordVal* MOUNT_Interp::mount3_mnt_reply(const u_char*& buf, int& n,
 			// Prevent further "excess RPC" weirds
 			n = 0;
 
-		rep->Assign(1, auth_flavors);
+		rep->Assign(1, std::move(auth_flavors));
 		}
 	else
 		{
diff --git a/src/analyzer/protocol/rpc/MOUNT.h b/src/analyzer/protocol/rpc/MOUNT.h
index b3b2683f8e..0409db7404 100644
--- a/src/analyzer/protocol/rpc/MOUNT.h
+++ b/src/analyzer/protocol/rpc/MOUNT.h
@@ -29,12 +29,12 @@ protected:
 	// to 0. However, the methods might still return an allocated Val * !
 	// So, you might want to Unref() the Val if buf is 0. Method names
 	// are based on the type names of RFC 1813.
-	EnumVal*   mount3_auth_flavor(const u_char*& buf, int& n);
-	StringVal* mount3_fh(const u_char*& buf, int& n);
-	RecordVal* mount3_dirmntargs(const u_char*&buf, int &n);
-	StringVal* mount3_filename(const u_char*& buf, int& n);
+	IntrusivePtr<EnumVal>   mount3_auth_flavor(const u_char*& buf, int& n);
+	IntrusivePtr<StringVal> mount3_fh(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> mount3_dirmntargs(const u_char*&buf, int &n);
+	IntrusivePtr<StringVal> mount3_filename(const u_char*& buf, int& n);
 
-	RecordVal* mount3_mnt_reply(const u_char*& buf, int& n, BifEnum::MOUNT3::status_t status);
+	IntrusivePtr<RecordVal> mount3_mnt_reply(const u_char*& buf, int& n, BifEnum::MOUNT3::status_t status);
 };
 
 class MOUNT_Analyzer : public RPC_Analyzer {
diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc
index d1d7ff4b0e..68a054dc6d 100644
--- a/src/analyzer/protocol/rpc/NFS.cc
+++ b/src/analyzer/protocol/rpc/NFS.cc
@@ -22,7 +22,7 @@ bool NFS_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 
 	uint32_t proc = c->Proc();
 	// The call arguments, depends on the call type obviously ...
-	Val *callarg = nullptr;
+	IntrusivePtr<Val> callarg;
 
 	switch ( proc ) {
 	case BifEnum::NFS3::PROC_NULL:
@@ -95,7 +95,6 @@ bool NFS_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 		break;
 
 	default:
-		callarg = nullptr;
 		if ( proc < BifEnum::NFS3::PROC_END_OF_PROCS )
 			{
 			// We know the procedure but haven't implemented it.
@@ -112,18 +111,10 @@ bool NFS_Interp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n)
 	}
 
 	if ( ! buf )
-		{
-		// There was a parse error while trying to extract the call
-		// arguments. However, we don't know where exactly it
-		// happened and whether Vals where already allocated (e.g., a
-		// RecordVal was allocated but we failed to fill it). So we
-		// Unref() the call arguments, and we are fine.
-		Unref(callarg);
-		callarg = nullptr;
+		// There was a parse error while trying to extract the call arguments.
 		return false;
-		}
 
-	c->AddVal(callarg); // It's save to AddVal(0).
+	c->AddVal(std::move(callarg));
 
 	return true;
 	}
@@ -133,7 +124,7 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 			       double last_time, int reply_len)
 	{
 	EventHandlerPtr event = nullptr;
-	Val *reply = nullptr;
+	IntrusivePtr<Val> reply;
 	BifEnum::NFS3::status_t nfs_status = BifEnum::NFS3::NFS3ERR_OK;
 	bool rpc_success = ( rpc_status == BifEnum::RPC_SUCCESS );
 
@@ -184,7 +175,7 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 
 	case BifEnum::NFS3::PROC_READ:
 		bro_uint_t offset;
-		offset = c->RequestVal()->AsRecordVal()->Lookup(1)->AsCount();
+		offset = c->RequestVal()->AsRecordVal()->GetField(1)->AsCount();
 		reply = nfs3_read_reply(buf, n, nfs_status, offset);
 		event = nfs_proc_read;
 		break;
@@ -251,7 +242,7 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 			// Otherwise DeliverRPC would complain about
 			// excess_RPC.
 			n = 0;
-			reply = BifType::Enum::NFS3::proc_t->GetVal(c->Proc()).release();
+			reply = zeek::BifType::Enum::NFS3::proc_t->GetVal(c->Proc());
 			event = nfs_proc_not_implemented;
 			}
 		else
@@ -259,13 +250,8 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 	}
 
 	if ( rpc_success && ! buf )
-		{
-		// There was a parse error. We have to unref the reply. (see
-		// also comments in RPC_BuildCall.
-		Unref(reply);
-		reply = nullptr;
+		// There was a parse error.
 		return false;
-		}
 
 	// Note: if reply == 0, it won't be added to the val_list for the
 	// event. While we can check for that on the policy layer it's kinda
@@ -275,26 +261,24 @@ bool NFS_Interp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status rpc_status,
 	// optional and all are set to 0 ...
 	if ( event )
 		{
-		Val *request = c->TakeRequestVal();
+		auto request = c->TakeRequestVal();
 
 		auto vl = event_common_vl(c, rpc_status, nfs_status,
 					start_time, last_time, reply_len, (bool)request + (bool)reply);
 
 		if ( request )
-			vl.emplace_back(AdoptRef{}, request);
+			vl.emplace_back(std::move(request));
 
 		if ( reply )
-			vl.emplace_back(AdoptRef{}, reply);
+			vl.emplace_back(std::move(reply));
 
 		analyzer->EnqueueConnEvent(event, std::move(vl));
 		}
-	else
-		Unref(reply);
 
 	return true;
 	}
 
-StringVal* NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size)
+IntrusivePtr<StringVal> NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size)
 	{
 	int data_n;
 
@@ -302,18 +286,18 @@ StringVal* NFS_Interp::nfs3_file_data(const u_char*& buf, int& n, uint64_t offse
 	const u_char *data = extract_XDR_opaque(buf, n, data_n, 1 << 30, true);
 
 	// check whether we have to deliver data to the event
-	if ( ! BifConst::NFS3::return_data )
+	if ( ! zeek::BifConst::NFS3::return_data )
 		return nullptr;
 
-	if ( BifConst::NFS3::return_data_first_only && offset != 0 )
+	if ( zeek::BifConst::NFS3::return_data_first_only && offset != 0 )
 		return nullptr;
 
 	// Ok, so we want to return some data
 	data_n = std::min(data_n, size);
-	data_n = std::min(data_n, int(BifConst::NFS3::return_data_max));
+	data_n = std::min(data_n, int(zeek::BifConst::NFS3::return_data_max));
 
 	if ( data && data_n > 0 )
-		return new StringVal(new BroString(data, data_n, false));
+		return make_intrusive<StringVal>(new BroString(data, data_n, false));
 
 	return nullptr;
 	}
@@ -328,14 +312,14 @@ zeek::Args NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_
 	zeek::Args vl;
 	vl.reserve(2 + extra_elements);
 	vl.emplace_back(analyzer->ConnVal());
-	auto auxgids = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+	auto auxgids = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 	for ( size_t i = 0; i < c->AuxGIDs().size(); ++i )
 		auxgids->Assign(i, val_mgr->Count(c->AuxGIDs()[i]));
 
-	auto info = make_intrusive<RecordVal>(BifType::Record::NFS3::info_t);
-	info->Assign(0, BifType::Enum::rpc_status->GetVal(rpc_status));
-	info->Assign(1, BifType::Enum::NFS3::status_t->GetVal(nfs_status));
+	auto info = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::info_t);
+	info->Assign(0, zeek::BifType::Enum::rpc_status->GetVal(rpc_status));
+	info->Assign(1, zeek::BifType::Enum::NFS3::status_t->GetVal(nfs_status));
 	info->Assign(2, make_intrusive<Val>(c->StartTime(), TYPE_TIME));
 	info->Assign(3, make_intrusive<Val>(c->LastTime()-c->StartTime(), TYPE_INTERVAL));
 	info->Assign(4, val_mgr->Count(c->RPCLen()));
@@ -352,7 +336,7 @@ zeek::Args NFS_Interp::event_common_vl(RPC_CallInfo *c, BifEnum::rpc_status rpc_
 	return vl;
 	}
 
-StringVal* NFS_Interp::nfs3_fh(const u_char*& buf, int& n)
+IntrusivePtr<StringVal> NFS_Interp::nfs3_fh(const u_char*& buf, int& n)
 	{
 	int fh_n;
 	const u_char* fh = extract_XDR_opaque(buf, n, fh_n, 64);
@@ -360,13 +344,13 @@ StringVal* NFS_Interp::nfs3_fh(const u_char*& buf, int& n)
 	if ( ! fh )
 		return nullptr;
 
-	return new StringVal(new BroString(fh, fh_n, false));
+	return make_intrusive<StringVal>(new BroString(fh, fh_n, false));
 	}
 
 
-RecordVal* NFS_Interp::nfs3_sattr(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr(const u_char*& buf, int& n)
 	{
-	RecordVal* attrs = new RecordVal(BifType::Record::NFS3::sattr_t);
+	auto attrs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattr_t);
 
 	attrs->Assign(0, nullptr); // mode
 	int mode_set_it =  extract_XDR_uint32(buf, n);
@@ -395,9 +379,9 @@ RecordVal* NFS_Interp::nfs3_sattr(const u_char*& buf, int& n)
 	return attrs;
 	}
 
-RecordVal* NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	RecordVal* rep = new RecordVal(BifType::Record::NFS3::sattr_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattr_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -413,9 +397,9 @@ RecordVal* NFS_Interp::nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_fattr(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_fattr(const u_char*& buf, int& n)
 	{
-	RecordVal* attrs = new RecordVal(BifType::Record::NFS3::fattr_t);
+	auto attrs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::fattr_t);
 
 	attrs->Assign(0, nfs3_ftype(buf, n));	// file type
 	attrs->Assign(1, ExtractUint32(buf, n));	// mode
@@ -435,21 +419,23 @@ RecordVal* NFS_Interp::nfs3_fattr(const u_char*& buf, int& n)
 	return attrs;
 	}
 
-EnumVal* NFS_Interp::nfs3_time_how(const u_char*& buf, int& n)
+IntrusivePtr<EnumVal> NFS_Interp::nfs3_time_how(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::time_how_t t = (BifEnum::NFS3::time_how_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::NFS3::time_how_t->GetVal(t).release();
+	auto rval = zeek::BifType::Enum::NFS3::time_how_t->GetVal(t);
+	return rval;
 	}
 
-EnumVal* NFS_Interp::nfs3_ftype(const u_char*& buf, int& n)
+IntrusivePtr<EnumVal> NFS_Interp::nfs3_ftype(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::file_type_t t = (BifEnum::NFS3::file_type_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::NFS3::file_type_t->GetVal(t).release();
+	auto rval = zeek::BifType::Enum::NFS3::file_type_t->GetVal(t);
+	return rval;
 	}
 
-RecordVal* NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n)
 	{
-	RecordVal* attrs = new RecordVal(BifType::Record::NFS3::wcc_attr_t);
+	auto attrs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::wcc_attr_t);
 
 	attrs->Assign(0, ExtractUint64(buf, n));	// size
 	attrs->Assign(1, ExtractTime(buf, n));	// mtime
@@ -458,7 +444,7 @@ RecordVal* NFS_Interp::nfs3_wcc_attr(const u_char*& buf, int& n)
 	return attrs;
 	}
 
-StringVal *NFS_Interp::nfs3_filename(const u_char*& buf, int& n)
+IntrusivePtr<StringVal> NFS_Interp::nfs3_filename(const u_char*& buf, int& n)
 	{
 	int name_len;
 	const u_char* name = extract_XDR_opaque(buf, n, name_len);
@@ -466,12 +452,12 @@ StringVal *NFS_Interp::nfs3_filename(const u_char*& buf, int& n)
 	if ( ! name )
 		return nullptr;
 
-	return new StringVal(new BroString(name, name_len, false));
+	return make_intrusive<StringVal>(new BroString(name, name_len, false));
 	}
 
-RecordVal *NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n)
 	{
-	RecordVal *diropargs = new RecordVal(BifType::Record::NFS3::diropargs_t);
+	auto diropargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::diropargs_t);
 
 	diropargs->Assign(0, nfs3_fh(buf, n));
 	diropargs->Assign(1, nfs3_filename(buf, n));
@@ -479,9 +465,9 @@ RecordVal *NFS_Interp::nfs3_diropargs(const u_char*& buf, int& n)
 	return diropargs;
 	}
 
-RecordVal* NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n)
 	{
-	RecordVal* symlinkdata = new RecordVal(BifType::Record::NFS3::symlinkdata_t);
+	auto symlinkdata = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::symlinkdata_t);
 
 	symlinkdata->Assign(0, nfs3_sattr(buf, n));
 	symlinkdata->Assign(1, nfs3_nfspath(buf, n));
@@ -489,9 +475,9 @@ RecordVal* NFS_Interp::nfs3_symlinkdata(const u_char*& buf, int& n)
 	return symlinkdata;
 	}
 
-RecordVal *NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n)
 	{
-	RecordVal *renameopargs = new RecordVal(BifType::Record::NFS3::renameopargs_t);
+	auto renameopargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::renameopargs_t);
 
 	renameopargs->Assign(0, nfs3_fh(buf, n));
 	renameopargs->Assign(1, nfs3_filename(buf, n));
@@ -501,7 +487,7 @@ RecordVal *NFS_Interp::nfs3_renameopargs(const u_char*& buf, int& n)
 	return renameopargs;
 	}
 
-RecordVal* NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n)
 	{
 	int have_attrs = extract_XDR_uint32(buf, n);
 
@@ -511,7 +497,7 @@ RecordVal* NFS_Interp::nfs3_post_op_attr(const u_char*& buf, int& n)
 	return nullptr;
 	}
 
-StringVal* NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n)
+IntrusivePtr<StringVal> NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n)
 	{
 	int have_fh = extract_XDR_uint32(buf, n);
 
@@ -521,7 +507,7 @@ StringVal* NFS_Interp::nfs3_post_op_fh(const u_char*& buf, int& n)
 	return nullptr;
 	}
 
-RecordVal* NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n)
 	{
 	int have_attrs = extract_XDR_uint32(buf, n);
 
@@ -530,15 +516,16 @@ RecordVal* NFS_Interp::nfs3_pre_op_attr(const u_char*& buf, int& n)
 	return nullptr;
 	}
 
-EnumVal *NFS_Interp::nfs3_stable_how(const u_char*& buf, int& n)
+IntrusivePtr<EnumVal> NFS_Interp::nfs3_stable_how(const u_char*& buf, int& n)
 	{
 	BifEnum::NFS3::stable_how_t stable = (BifEnum::NFS3::stable_how_t)extract_XDR_uint32(buf, n);
-	return BifType::Enum::NFS3::stable_how_t->GetVal(stable).release();
+	auto rval = zeek::BifType::Enum::NFS3::stable_how_t->GetVal(stable);
+	return rval;
 	}
 
-RecordVal* NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::lookup_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::lookup_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -555,9 +542,9 @@ RecordVal* NFS_Interp::nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NF
 	return rep;
 	}
 
-RecordVal *NFS_Interp::nfs3_readargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_readargs(const u_char*& buf, int& n)
 	{
-	RecordVal *readargs = new RecordVal(BifType::Record::NFS3::readargs_t);
+	auto readargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readargs_t);
 
 	readargs->Assign(0, nfs3_fh(buf, n));
 	readargs->Assign(1, ExtractUint64(buf, n));  // offset
@@ -566,10 +553,10 @@ RecordVal *NFS_Interp::nfs3_readargs(const u_char*& buf, int& n)
 	return readargs;
 	}
 
-RecordVal* NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status,
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status,
 		bro_uint_t offset)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::read_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::read_reply_t);
 
 	if (status == BifEnum::NFS3::NFS3ERR_OK)
 		{
@@ -589,9 +576,9 @@ RecordVal* NFS_Interp::nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::readlink_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readlink_reply_t);
 
 	if (status == BifEnum::NFS3::NFS3ERR_OK)
 		{
@@ -606,9 +593,9 @@ RecordVal* NFS_Interp::nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	RecordVal* rep = new RecordVal(BifType::Record::NFS3::link_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::link_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -622,9 +609,9 @@ RecordVal* NFS_Interp::nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n)
 	{
-	RecordVal* symlinkargs = new RecordVal(BifType::Record::NFS3::symlinkargs_t);
+	auto symlinkargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::symlinkargs_t);
 
 	symlinkargs->Assign(0, nfs3_diropargs(buf, n));
 	symlinkargs->Assign(1, nfs3_symlinkdata(buf, n));
@@ -632,9 +619,9 @@ RecordVal* NFS_Interp::nfs3_symlinkargs(const u_char*& buf, int& n)
 	return symlinkargs;
 	}
 
-RecordVal* NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n)
 	{
-	RecordVal* sattrargs = new RecordVal(BifType::Record::NFS3::sattrargs_t);
+	auto sattrargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::sattrargs_t);
 
 	sattrargs->Assign(0, nfs3_fh(buf, n));
 	sattrargs->Assign(1, nfs3_sattr(buf, n));
@@ -642,9 +629,9 @@ RecordVal* NFS_Interp::nfs3_sattrargs(const u_char*& buf, int& n)
 	return sattrargs;
 	}
 
-RecordVal* NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n)
 	{
-	RecordVal* linkargs = new RecordVal(BifType::Record::NFS3::linkargs_t);
+	auto linkargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::linkargs_t);
 
 	linkargs->Assign(0, nfs3_fh(buf, n));
 	linkargs->Assign(1, nfs3_diropargs(buf, n));
@@ -652,11 +639,11 @@ RecordVal* NFS_Interp::nfs3_linkargs(const u_char*& buf, int& n)
 	return linkargs;
 	}
 
-RecordVal *NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n)
 	{
 	uint32_t bytes;
 	uint64_t offset;
-	RecordVal *writeargs = new RecordVal(BifType::Record::NFS3::writeargs_t);
+	auto writeargs = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::writeargs_t);
 
 	writeargs->Assign(0, nfs3_fh(buf, n));
 	offset = extract_XDR_uint64(buf, n);
@@ -670,9 +657,9 @@ RecordVal *NFS_Interp::nfs3_writeargs(const u_char*& buf, int& n)
 	return writeargs;
 	}
 
-RecordVal *NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::write_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::write_reply_t);
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
@@ -695,9 +682,9 @@ RecordVal *NFS_Interp::nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::newobj_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::newobj_reply_t);
 
 	if (status == BifEnum::NFS3::NFS3ERR_OK)
 		{
@@ -719,9 +706,9 @@ RecordVal* NFS_Interp::nfs3_newobj_reply(const u_char*& buf, int& n, BifEnum::NF
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::delobj_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::delobj_reply_t);
 
 	// wcc_data
 	rep->Assign(0, nfs3_pre_op_attr(buf, n));
@@ -730,9 +717,9 @@ RecordVal* NFS_Interp::nfs3_delobj_reply(const u_char*& buf, int& n)
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::renameobj_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::renameobj_reply_t);
 
 	// wcc_data
 	rep->Assign(0, nfs3_pre_op_attr(buf, n));
@@ -743,9 +730,9 @@ RecordVal* NFS_Interp::nfs3_renameobj_reply(const u_char*& buf, int& n)
 	return rep;
 	}
 
-RecordVal* NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n)
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n)
 	{
-	RecordVal *args = new RecordVal(BifType::Record::NFS3::readdirargs_t);
+	auto args = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readdirargs_t);
 
 	args->Assign(0, val_mgr->Bool(isplus));
 	args->Assign(1, nfs3_fh(buf, n));
@@ -759,17 +746,17 @@ RecordVal* NFS_Interp::nfs3_readdirargs(bool isplus, const u_char*& buf, int&n)
 	return args;
 	}
 
-RecordVal* NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
+IntrusivePtr<RecordVal> NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
 		int&n, BifEnum::NFS3::status_t status)
 	{
-	RecordVal *rep = new RecordVal(BifType::Record::NFS3::readdir_reply_t);
+	auto rep = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::readdir_reply_t);
 
 	rep->Assign(0, val_mgr->Bool(isplus));
 
 	if ( status == BifEnum::NFS3::NFS3ERR_OK )
 		{
 		unsigned pos;
-		VectorVal *entries = new VectorVal(BifType::Vector::NFS3::direntry_vec_t);
+		auto entries = make_intrusive<VectorVal>(zeek::BifType::Vector::NFS3::direntry_vec_t);
 
 		rep->Assign(1, nfs3_post_op_attr(buf,n));   // dir_attr
 		rep->Assign(2, ExtractUint64(buf,n));  // cookieverf
@@ -778,7 +765,7 @@ RecordVal* NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
 
 		while ( extract_XDR_uint32(buf,n) )
 			{
-			RecordVal *entry = new RecordVal(BifType::Record::NFS3::direntry_t);
+			auto entry = make_intrusive<RecordVal>(zeek::BifType::Record::NFS3::direntry_t);
 			entry->Assign(0, ExtractUint64(buf,n)); // fileid
 			entry->Assign(1, nfs3_filename(buf,n)); // fname
 			entry->Assign(2, ExtractUint64(buf,n)); // cookie
@@ -789,7 +776,7 @@ RecordVal* NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
 				entry->Assign(4, nfs3_post_op_fh(buf,n));
 				}
 
-			entries->Assign(pos, entry);
+			entries->Assign(pos, std::move(entry));
 			pos++;
 			}
 
@@ -804,29 +791,29 @@ RecordVal* NFS_Interp::nfs3_readdir_reply(bool isplus, const u_char*& buf,
 	return rep;
 	}
 
-Val* NFS_Interp::ExtractUint32(const u_char*& buf, int& n)
+IntrusivePtr<Val> NFS_Interp::ExtractUint32(const u_char*& buf, int& n)
 	{
-	return val_mgr->Count(extract_XDR_uint32(buf, n)).release();
+	return val_mgr->Count(extract_XDR_uint32(buf, n));
 	}
 
-Val* NFS_Interp::ExtractUint64(const u_char*& buf, int& n)
+IntrusivePtr<Val> NFS_Interp::ExtractUint64(const u_char*& buf, int& n)
 	{
-	return val_mgr->Count(extract_XDR_uint64(buf, n)).release();
+	return val_mgr->Count(extract_XDR_uint64(buf, n));
 	}
 
-Val* NFS_Interp::ExtractTime(const u_char*& buf, int& n)
+IntrusivePtr<Val> NFS_Interp::ExtractTime(const u_char*& buf, int& n)
 	{
-	return new Val(extract_XDR_time(buf, n), TYPE_TIME);
+	return make_intrusive<Val>(extract_XDR_time(buf, n), TYPE_TIME);
 	}
 
-Val* NFS_Interp::ExtractInterval(const u_char*& buf, int& n)
+IntrusivePtr<Val> NFS_Interp::ExtractInterval(const u_char*& buf, int& n)
 	{
-	return new IntervalVal(double(extract_XDR_uint32(buf, n)), 1.0);
+	return make_intrusive<IntervalVal>(double(extract_XDR_uint32(buf, n)), 1.0);
 	}
 
-Val* NFS_Interp::ExtractBool(const u_char*& buf, int& n)
+IntrusivePtr<Val> NFS_Interp::ExtractBool(const u_char*& buf, int& n)
 	{
-	return val_mgr->Bool(extract_XDR_uint32(buf, n))->Ref();
+	return val_mgr->Bool(extract_XDR_uint32(buf, n));
 	}
 
 
diff --git a/src/analyzer/protocol/rpc/NFS.h b/src/analyzer/protocol/rpc/NFS.h
index a215dfc14a..9d5942878e 100644
--- a/src/analyzer/protocol/rpc/NFS.h
+++ b/src/analyzer/protocol/rpc/NFS.h
@@ -30,53 +30,53 @@ protected:
 	// to 0. However, the methods might still return an allocated Val * !
 	// So, you might want to Unref() the Val if buf is 0. Method names
 	// are based on the type names of RFC 1813.
-	StringVal* nfs3_fh(const u_char*& buf, int& n);
-	RecordVal* nfs3_fattr(const u_char*& buf, int& n);
-	RecordVal* nfs3_sattr(const u_char*& buf, int& n);
-	EnumVal* nfs3_ftype(const u_char*& buf, int& n);
-	EnumVal* nfs3_time_how(const u_char*& buf, int& n);
-	RecordVal* nfs3_wcc_attr(const u_char*& buf, int& n);
-	RecordVal* nfs3_diropargs(const u_char*&buf, int &n);
-	RecordVal* nfs3_symlinkdata(const u_char*& buf, int& n);
-	RecordVal* nfs3_renameopargs(const u_char*&buf, int &n);
-	StringVal* nfs3_filename(const u_char*& buf, int& n);
-	RecordVal* nfs3_linkargs(const u_char*& buf, int& n);
-	RecordVal* nfs3_symlinkargs(const u_char*& buf, int& n);
-	RecordVal* nfs3_sattrargs(const u_char*& buf, int& n);
-	StringVal* nfs3_nfspath(const u_char*& buf, int& n)
+	IntrusivePtr<StringVal> nfs3_fh(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_fattr(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_sattr(const u_char*& buf, int& n);
+	IntrusivePtr<EnumVal> nfs3_ftype(const u_char*& buf, int& n);
+	IntrusivePtr<EnumVal> nfs3_time_how(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_wcc_attr(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_diropargs(const u_char*&buf, int &n);
+	IntrusivePtr<RecordVal> nfs3_symlinkdata(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_renameopargs(const u_char*&buf, int &n);
+	IntrusivePtr<StringVal> nfs3_filename(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_linkargs(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_symlinkargs(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_sattrargs(const u_char*& buf, int& n);
+	IntrusivePtr<StringVal> nfs3_nfspath(const u_char*& buf, int& n)
 		{
 		return nfs3_filename(buf,n);
 		}
 
-	RecordVal* nfs3_post_op_attr(const u_char*&buf, int &n);	// Return 0 or an fattr
-	RecordVal* nfs3_pre_op_attr(const u_char*&buf, int &n);	// Return 0 or an wcc_attr
-	RecordVal* nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	RecordVal* nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	RecordVal* nfs3_readargs(const u_char*& buf, int& n);
-	RecordVal* nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, bro_uint_t offset);
-	RecordVal* nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	RecordVal* nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	RecordVal* nfs3_writeargs(const u_char*& buf, int& n);
-	EnumVal* nfs3_stable_how(const u_char*& buf, int& n);
-	RecordVal* nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
-	RecordVal* nfs3_newobj_reply(const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
-	RecordVal* nfs3_delobj_reply(const u_char*& buf, int& n);
-	RecordVal* nfs3_renameobj_reply(const u_char*& buf, int& n);
-	StringVal* nfs3_post_op_fh(const u_char*& buf, int& n);
-	RecordVal* nfs3_readdirargs(bool isplus, const u_char*& buf, int&n);
-	RecordVal* nfs3_readdir_reply(bool isplus, const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
+	IntrusivePtr<RecordVal> nfs3_post_op_attr(const u_char*&buf, int &n);	// Return 0 or an fattr
+	IntrusivePtr<RecordVal> nfs3_pre_op_attr(const u_char*&buf, int &n);	// Return 0 or an wcc_attr
+	IntrusivePtr<RecordVal> nfs3_sattr_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	IntrusivePtr<RecordVal> nfs3_lookup_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	IntrusivePtr<RecordVal> nfs3_readargs(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_read_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status, bro_uint_t offset);
+	IntrusivePtr<RecordVal> nfs3_readlink_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	IntrusivePtr<RecordVal> nfs3_link_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	IntrusivePtr<RecordVal> nfs3_writeargs(const u_char*& buf, int& n);
+	IntrusivePtr<EnumVal> nfs3_stable_how(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_write_reply(const u_char*& buf, int& n, BifEnum::NFS3::status_t status);
+	IntrusivePtr<RecordVal> nfs3_newobj_reply(const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
+	IntrusivePtr<RecordVal> nfs3_delobj_reply(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_renameobj_reply(const u_char*& buf, int& n);
+	IntrusivePtr<StringVal> nfs3_post_op_fh(const u_char*& buf, int& n);
+	IntrusivePtr<RecordVal> nfs3_readdirargs(bool isplus, const u_char*& buf, int&n);
+	IntrusivePtr<RecordVal> nfs3_readdir_reply(bool isplus, const u_char*& buf, int&n, BifEnum::NFS3::status_t status);
 
 	// Consumes the file data in the RPC message. Depending on NFS::return_data* consts
 	// in bro.init returns NULL or the data as string val:
 	//   * offset is the offset of the read/write call
 	//   * size is the amount of bytes read (or requested to be written),
-	StringVal* nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size);
+	IntrusivePtr<StringVal> nfs3_file_data(const u_char*& buf, int& n, uint64_t offset, int size);
 
-	Val* ExtractUint32(const u_char*& buf, int& n);
-	Val* ExtractUint64(const u_char*& buf, int& n);
-	Val* ExtractTime(const u_char*& buf, int& n);
-	Val* ExtractInterval(const u_char*& buf, int& n);
-	Val* ExtractBool(const u_char*& buf, int& n);
+	IntrusivePtr<Val> ExtractUint32(const u_char*& buf, int& n);
+	IntrusivePtr<Val> ExtractUint64(const u_char*& buf, int& n);
+	IntrusivePtr<Val> ExtractTime(const u_char*& buf, int& n);
+	IntrusivePtr<Val> ExtractInterval(const u_char*& buf, int& n);
+	IntrusivePtr<Val> ExtractBool(const u_char*& buf, int& n);
 };
 
 class NFS_Analyzer : public RPC_Analyzer {
diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc
index d3f878f8f0..5fb2fb878e 100644
--- a/src/analyzer/protocol/rpc/Portmap.cc
+++ b/src/analyzer/protocol/rpc/Portmap.cc
@@ -29,28 +29,28 @@ bool PortmapperInterp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n
 
 	case PMAPPROC_SET:
 		{
-		Val* m = ExtractMapping(buf, n);
+		auto m = ExtractMapping(buf, n);
 		if ( ! m )
 			return false;
-		c->AddVal(m);
+		c->AddVal(std::move(m));
 		}
 		break;
 
 	case PMAPPROC_UNSET:
 		{
-		Val* m = ExtractMapping(buf, n);
+		auto m = ExtractMapping(buf, n);
 		if ( ! m )
 			return false;
-		c->AddVal(m);
+		c->AddVal(std::move(m));
 		}
 		break;
 
 	case PMAPPROC_GETPORT:
 		{
-		Val* pr = ExtractPortRequest(buf, n);
+		auto pr = ExtractPortRequest(buf, n);
 		if ( ! pr )
 			return false;
-		c->AddVal(pr);
+		c->AddVal(std::move(pr));
 		}
 		break;
 
@@ -59,10 +59,10 @@ bool PortmapperInterp::RPC_BuildCall(RPC_CallInfo* c, const u_char*& buf, int& n
 
 	case PMAPPROC_CALLIT:
 		{
-		Val* call_it = ExtractCallItRequest(buf, n);
+		auto call_it = ExtractCallItRequest(buf, n);
 		if ( ! call_it )
 			return false;
-		c->AddVal(call_it);
+		c->AddVal(std::move(call_it));
 		}
 		break;
 
@@ -79,7 +79,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 				     int reply_len)
 	{
 	EventHandlerPtr event;
-	Val *reply = nullptr;
+	IntrusivePtr<Val> reply;
 	int success = (status == BifEnum::RPC_SUCCESS);
 
 	switch ( c->Proc() ) {
@@ -94,7 +94,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 			if ( ! buf )
 				return false;
 
-			reply = val_mgr->Bool(status)->Ref();
+			reply = val_mgr->Bool(status);
 			event = pm_request_set;
 			}
 		else
@@ -109,7 +109,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 			if ( ! buf )
 				return false;
 
-			reply = val_mgr->Bool(status)->Ref();
+			reply = val_mgr->Bool(status);
 			event = pm_request_unset;
 			}
 		else
@@ -125,9 +125,9 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 				return false;
 
 			RecordVal* rv = c->RequestVal()->AsRecordVal();
-			Val* is_tcp = rv->Lookup(2);
+			const auto& is_tcp = rv->GetField(2);
 			reply = val_mgr->Port(CheckPort(port), is_tcp->IsOne() ?
-			                      TRANSPORT_TCP : TRANSPORT_UDP)->Ref();
+			                      TRANSPORT_TCP : TRANSPORT_UDP);
 			event = pm_request_getport;
 			}
 		else
@@ -138,28 +138,26 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 		event = success ? pm_request_dump : pm_attempt_dump;
 		if ( success )
 			{
-			TableVal* mappings = new TableVal({NewRef{}, pm_mappings});
+			static auto pm_mappings = zeek::id::find_type<TableType>("pm_mappings");
+			auto mappings = make_intrusive<TableVal>(pm_mappings);
 			uint32_t nmap = 0;
 
 			// Each call in the loop test pulls the next "opted"
 			// element to see if there are more mappings.
 			while ( extract_XDR_uint32(buf, n) && buf )
 				{
-				Val* m = ExtractMapping(buf, n);
+				auto m = ExtractMapping(buf, n);
 				if ( ! m )
 					break;
 
 				auto index = val_mgr->Count(++nmap);
-				mappings->Assign(index.get(), m);
+				mappings->Assign(std::move(index), std::move(m));
 				}
 
 			if ( ! buf )
-				{
-				Unref(mappings);
 				return false;
-				}
 
-			reply = mappings;
+			reply = std::move(mappings);
 			event = pm_request_dump;
 			}
 		else
@@ -176,7 +174,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 			if ( ! opaque_reply )
 				return false;
 
-			reply = val_mgr->Port(CheckPort(port), TRANSPORT_UDP)->Ref();
+			reply = val_mgr->Port(CheckPort(port), TRANSPORT_UDP);
 			event = pm_request_callit;
 			}
 		else
@@ -187,13 +185,14 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
 		return false;
 	}
 
-	Event(event, c->TakeRequestVal(), status, reply);
+	Event(event, c->TakeRequestVal(), status, std::move(reply));
 	return true;
 	}
 
-Val* PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
+IntrusivePtr<Val> PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
 	{
-	RecordVal* mapping = new RecordVal(pm_mapping);
+	static auto pm_mapping = zeek::id::find_type<RecordType>("pm_mapping");
+	auto mapping = make_intrusive<RecordVal>(pm_mapping);
 
 	mapping->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
 	mapping->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
@@ -203,17 +202,15 @@ Val* PortmapperInterp::ExtractMapping(const u_char*& buf, int& len)
 	mapping->Assign(2, val_mgr->Port(CheckPort(port), is_tcp ? TRANSPORT_TCP : TRANSPORT_UDP));
 
 	if ( ! buf )
-		{
-		Unref(mapping);
 		return nullptr;
-		}
 
 	return mapping;
 	}
 
-Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
+IntrusivePtr<Val> PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
 	{
-	RecordVal* pr = new RecordVal(pm_port_request);
+	static auto pm_port_request = zeek::id::find_type<RecordType>("pm_port_request");
+	auto pr = make_intrusive<RecordVal>(pm_port_request);
 
 	pr->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
 	pr->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
@@ -223,17 +220,15 @@ Val* PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len)
 	(void) extract_XDR_uint32(buf, len);	// consume the bogus port
 
 	if ( ! buf )
-		{
-		Unref(pr);
 		return nullptr;
-		}
 
 	return pr;
 	}
 
-Val* PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len)
+IntrusivePtr<Val> PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len)
 	{
-	RecordVal* c = new RecordVal(pm_callit_request);
+	static auto pm_callit_request = zeek::id::find_type<RecordType>("pm_callit_request");
+	auto c = make_intrusive<RecordVal>(pm_callit_request);
 
 	c->Assign(0, val_mgr->Count(extract_XDR_uint32(buf, len)));
 	c->Assign(1, val_mgr->Count(extract_XDR_uint32(buf, len)));
@@ -244,10 +239,7 @@ Val* PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len)
 	c->Assign(3, val_mgr->Count(arg_n));
 
 	if ( ! buf )
-		{
-		Unref(c);
 		return nullptr;
-		}
 
 	return c;
 	}
@@ -270,14 +262,10 @@ uint32_t PortmapperInterp::CheckPort(uint32_t port)
 	return port;
 	}
 
-void PortmapperInterp::Event(EventHandlerPtr f, Val* request, BifEnum::rpc_status status, Val* reply)
+void PortmapperInterp::Event(EventHandlerPtr f, IntrusivePtr<Val> request, BifEnum::rpc_status status, IntrusivePtr<Val> reply)
 	{
 	if ( ! f )
-		{
-		Unref(request);
-		Unref(reply);
 		return;
-		}
 
 	zeek::Args vl;
 
@@ -286,16 +274,16 @@ void PortmapperInterp::Event(EventHandlerPtr f, Val* request, BifEnum::rpc_statu
 	if ( status == BifEnum::RPC_SUCCESS )
 		{
 		if ( request )
-			vl.emplace_back(AdoptRef{}, request);
+			vl.emplace_back(std::move(request));
 		if ( reply )
-			vl.emplace_back(AdoptRef{}, reply);
+			vl.emplace_back(std::move(reply));
 		}
 	else
 		{
-		vl.emplace_back(BifType::Enum::rpc_status->GetVal(status));
+		vl.emplace_back(zeek::BifType::Enum::rpc_status->GetVal(status));
 
 		if ( request )
-			vl.emplace_back(AdoptRef{}, request);
+			vl.emplace_back(std::move(request));
 		}
 
 	analyzer->EnqueueConnEvent(f, std::move(vl));
diff --git a/src/analyzer/protocol/rpc/Portmap.h b/src/analyzer/protocol/rpc/Portmap.h
index cf8f9be7e2..9879976c28 100644
--- a/src/analyzer/protocol/rpc/Portmap.h
+++ b/src/analyzer/protocol/rpc/Portmap.h
@@ -17,11 +17,11 @@ protected:
 			   double last_time, int reply_len) override;
 	uint32_t CheckPort(uint32_t port);
 
-	void Event(EventHandlerPtr f, Val* request, BifEnum::rpc_status status, Val* reply);
+	void Event(EventHandlerPtr f, IntrusivePtr<Val> request, BifEnum::rpc_status status, IntrusivePtr<Val> reply);
 
-	Val* ExtractMapping(const u_char*& buf, int& len);
-	Val* ExtractPortRequest(const u_char*& buf, int& len);
-	Val* ExtractCallItRequest(const u_char*& buf, int& len);
+	IntrusivePtr<Val> ExtractMapping(const u_char*& buf, int& len);
+	IntrusivePtr<Val> ExtractPortRequest(const u_char*& buf, int& len);
+	IntrusivePtr<Val> ExtractCallItRequest(const u_char*& buf, int& len);
 };
 
 class Portmapper_Analyzer : public RPC_Analyzer {
diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc
index 46240f8773..ed3dda86e4 100644
--- a/src/analyzer/protocol/rpc/RPC.cc
+++ b/src/analyzer/protocol/rpc/RPC.cc
@@ -28,7 +28,6 @@ namespace { // local namespace
 
 RPC_CallInfo::RPC_CallInfo(uint32_t arg_xid, const u_char*& buf, int& n, double arg_start_time, double arg_last_time, int arg_rpc_len)
 	{
-	v = nullptr;
 	xid = arg_xid;
 	stamp = 0;
 	uid = 0;
@@ -98,7 +97,6 @@ RPC_CallInfo::RPC_CallInfo(uint32_t arg_xid, const u_char*& buf, int& n, double
 RPC_CallInfo::~RPC_CallInfo()
 	{
 	delete [] call_buf;
-	Unref(v);
 	}
 
 bool RPC_CallInfo::CompareRexmit(const u_char* buf, int n) const
@@ -343,7 +341,7 @@ void RPC_Interpreter::Event_RPC_Dialogue(RPC_CallInfo* c, BifEnum::rpc_status st
 			val_mgr->Count(c->Program()),
 			val_mgr->Count(c->Version()),
 			val_mgr->Count(c->Proc()),
-			BifType::Enum::rpc_status->GetVal(status),
+			zeek::BifType::Enum::rpc_status->GetVal(status),
 			make_intrusive<Val>(c->StartTime(), TYPE_TIME),
 			val_mgr->Count(c->CallLen()),
 			val_mgr->Count(reply_len)
@@ -369,7 +367,7 @@ void RPC_Interpreter::Event_RPC_Reply(uint32_t xid, BifEnum::rpc_status status,
 		analyzer->EnqueueConnEvent(rpc_reply,
 			analyzer->ConnVal(),
 			val_mgr->Count(xid),
-			BifType::Enum::rpc_status->GetVal(status),
+			zeek::BifType::Enum::rpc_status->GetVal(status),
 			val_mgr->Count(reply_len)
 		);
 	}
diff --git a/src/analyzer/protocol/rpc/RPC.h b/src/analyzer/protocol/rpc/RPC.h
index a3615bebc5..7d4a75bd8e 100644
--- a/src/analyzer/protocol/rpc/RPC.h
+++ b/src/analyzer/protocol/rpc/RPC.h
@@ -52,9 +52,9 @@ public:
 		     double last_time, int rpc_len);
 	~RPC_CallInfo();
 
-	void AddVal(Val* arg_v)		{ Unref(v); v = arg_v; }
-	Val* RequestVal() const		{ return v; }
-	Val* TakeRequestVal()		{ Val* rv = v; v = nullptr; return rv; }
+	void AddVal(IntrusivePtr<Val> arg_v)		{ v = std::move(arg_v); }
+	const IntrusivePtr<Val>& RequestVal() const		{ return v; }
+	IntrusivePtr<Val> TakeRequestVal()		{ auto rv = std::move(v); return rv; }
 
 	bool CompareRexmit(const u_char* buf, int n) const;
 
@@ -95,7 +95,7 @@ protected:
 	int header_len;		// size of data before the arguments
 	bool valid_call;	// whether call was well-formed
 
-	Val* v;		// single (perhaps compound) value corresponding to call
+	IntrusivePtr<Val> v;		// single (perhaps compound) value corresponding to call
 };
 
 class RPC_Interpreter {
diff --git a/src/analyzer/protocol/sip/sip-analyzer.pac b/src/analyzer/protocol/sip/sip-analyzer.pac
index 37e036739d..aad9df3a14 100644
--- a/src/analyzer/protocol/sip/sip-analyzer.pac
+++ b/src/analyzer/protocol/sip/sip-analyzer.pac
@@ -3,7 +3,7 @@ refine flow SIP_Flow += {
 	%member{
 		int content_length;
 		bool build_headers;
-		vector<BroVal> headers;
+		std::vector<IntrusivePtr<Val>> headers;
 	%}
 
 	%init{
@@ -20,7 +20,7 @@ refine flow SIP_Flow += {
 		%{
 		if ( sip_request )
 			{
-			BifEvent::enqueue_sip_request(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_sip_request(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
 						       to_stringval(method), to_stringval(uri),
 						       to_stringval(${vers.vers_str}));
 			}
@@ -35,7 +35,7 @@ refine flow SIP_Flow += {
 		connection()->bro_analyzer()->ProtocolConfirmation();
 		if ( sip_reply )
 			{
-			BifEvent::enqueue_sip_reply(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_sip_reply(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
 						     to_stringval(${vers.vers_str}), code, to_stringval(reason));
 			}
 
@@ -53,13 +53,13 @@ refine flow SIP_Flow += {
 			{
 			auto nameval = to_stringval(name);
 			nameval->ToUpper();
-			BifEvent::enqueue_sip_header(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_sip_header(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
 						      is_orig(), std::move(nameval), to_stringval(value));
 			}
 
 		if ( build_headers )
 			{
-			headers.push_back(build_sip_header_val(name, value));
+			headers.push_back({AdoptRef{}, build_sip_header_val(name, value)});
 			}
 
 		return true;
@@ -67,12 +67,13 @@ refine flow SIP_Flow += {
 
 	function build_sip_headers_val(): BroVal
 		%{
-		TableVal* t = new TableVal({NewRef{}, mime_header_list});
+		static auto mime_header_list = zeek::id::find_type<TableType>("mime_header_list");
+		TableVal* t = new TableVal(mime_header_list);
 
 		for ( unsigned int i = 0; i < headers.size(); ++i )
 			{ // index starting from 1
 			auto index = val_mgr->Count(i + 1);
-			t->Assign(index.get(), headers[i]);
+			t->Assign(std::move(index), std::move(headers[i]));
 			}
 
 		return t;
@@ -82,7 +83,7 @@ refine flow SIP_Flow += {
 		%{
 		if ( sip_all_headers )
 			{
-			BifEvent::enqueue_sip_all_headers(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_sip_all_headers(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(),
 							   is_orig(), {AdoptRef{}, build_sip_headers_val()});
 			}
 
@@ -101,6 +102,7 @@ refine flow SIP_Flow += {
 
 	function build_sip_header_val(name: const_bytestring, value: const_bytestring): BroVal
 		%{
+		static auto mime_header_rec = zeek::id::find_type<RecordType>("mime_header_rec");
 		RecordVal* header_record = new RecordVal(mime_header_rec);
 		IntrusivePtr<StringVal> name_val;
 
@@ -125,7 +127,7 @@ refine flow SIP_Flow += {
 		%{
 		if ( sip_begin_entity )
 			{
-			BifEvent::enqueue_sip_begin_entity(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), is_orig());
+			zeek::BifEvent::enqueue_sip_begin_entity(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), is_orig());
 			}
 		%}
 
@@ -133,7 +135,7 @@ refine flow SIP_Flow += {
 		%{
 		if ( sip_end_entity )
 			{
-			BifEvent::enqueue_sip_end_entity(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), is_orig());
+			zeek::BifEvent::enqueue_sip_end_entity(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), is_orig());
 			}
 
 		return true;
diff --git a/src/analyzer/protocol/smb/smb-strings.pac b/src/analyzer/protocol/smb/smb-strings.pac
index 5d025f162a..2c7988b37c 100644
--- a/src/analyzer/protocol/smb/smb-strings.pac
+++ b/src/analyzer/protocol/smb/smb-strings.pac
@@ -1,7 +1,61 @@
+%extern{
+#include "binpac_bro.h"
+%}
+
+%code{
+IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::uint8s_to_stringval(std::vector<uint8_t>* data)
+	{
+	int length = data->size();
+	auto buf = std::make_unique<uint8[]>(length);
+
+	for ( int i = 0; i < length; ++i)
+		buf[i] = (*data)[i];
+
+	const bytestring bs = bytestring(buf.get(), length);
+	return utf16_to_utf8_val(bro_analyzer()->Conn(), bs);
+	}
+
+IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::extract_string(SMB_string* s)
+	{
+	if ( s->unicode() == false )
+		{
+		int length = s->a()->size();
+		auto buf = std::make_unique<char[]>(length);
+
+		for ( int i = 0; i < length; i++)
+			{
+			unsigned char t = (*(s->a()))[i];
+			buf[i] = t;
+			}
+
+		if ( length > 0 && buf[length-1] == 0x00 )
+			length--;
+
+		return make_intrusive<StringVal>(length, buf.get());
+		}
+	else
+		return uint8s_to_stringval(s->u()->s());
+	}
+
+IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::smb_string2stringval(SMB_string* s)
+	{
+	return extract_string(s);
+	}
+
+IntrusivePtr<StringVal> binpac::SMB::SMB_Conn::smb2_string2stringval(SMB2_string* s)
+	{
+	return uint8s_to_stringval(s->s());
+	}
+%}
 
 refine connection SMB_Conn += {
 	%member{
-		SMB_unicode_string *me;
+		IntrusivePtr<StringVal> uint8s_to_stringval(std::vector<uint8_t>* data);
+		IntrusivePtr<StringVal> extract_string(SMB_string* s);
+		IntrusivePtr<StringVal> smb_string2stringval(SMB_string* s);
+		IntrusivePtr<StringVal> smb2_string2stringval(SMB2_string* s);
+
+		SMB_unicode_string* me;
 	%}
 
 	%init{
@@ -23,52 +77,6 @@ refine connection SMB_Conn += {
 		else
 			return 0xFF;
 		%}
-
-	function uint8s_to_stringval(data: uint8[]): StringVal
-		%{
-		int length = data->size();
-		auto buf = std::make_unique<uint8[]>(length);
-
-		for ( int i = 0; i < length; ++i)
-			buf[i] = (*data)[i];
-
-		const bytestring bs = bytestring(buf.get(), length);
-		return utf16_bytestring_to_utf8_val(bro_analyzer()->Conn(), bs);
-		%}
-
-	function extract_string(s: SMB_string) : StringVal
-		%{
-		if ( s->unicode() == false )
-			{
-			int length = s->a()->size();
-			auto buf = std::make_unique<char[]>(length);
-
-			for ( int i = 0; i < length; i++)
-				{
-				unsigned char t = (*(s->a()))[i];
-				buf[i] = t;
-				}
-
-			if ( length > 0 && buf[length-1] == 0x00 )
-				length--;
-
-			return new StringVal(length, buf.get());
-			}
-		else
-			{
-			return uint8s_to_stringval(s->u()->s());
-			}
-		%}
-
-	function smb_string2stringval(s: SMB_string) : StringVal
-		%{
-		return extract_string(s);
-		%}
-
-	function smb2_string2stringval(s: SMB2_string) : StringVal
-		%{
-		return uint8s_to_stringval(s->s());
-		%}
 };
 
 type SMB_ascii_string = uint8[] &until($element == 0x00);
diff --git a/src/analyzer/protocol/smb/smb-time.pac b/src/analyzer/protocol/smb/smb-time.pac
index 52654c7a2b..2fcc58f32e 100644
--- a/src/analyzer/protocol/smb/smb-time.pac
+++ b/src/analyzer/protocol/smb/smb-time.pac
@@ -1,28 +1,22 @@
-function SMB_BuildMACTimes(modify: uint64, access: uint64, create: uint64, change: uint64): BroVal
-	%{
-	RecordVal* r = new RecordVal(BifType::Record::SMB::MACTimes);
+%header{
+IntrusivePtr<Val> filetime2brotime(uint64_t ts);
+IntrusivePtr<Val> time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz);
 
-	r->Assign(0, filetime2brotime(modify));
-	r->Assign(1, filetime2brotime(access));
-	r->Assign(2, filetime2brotime(create));
-	r->Assign(3, filetime2brotime(change));
+IntrusivePtr<RecordVal> SMB_BuildMACTimes(uint64_t modify, uint64_t access,
+                                          uint64_t create, uint64_t change);
+%}
 
-	return r;
-	%}
-
-function filetime2brotime(ts: uint64): Val
-	%{
+%code{
+IntrusivePtr<Val> filetime2brotime(uint64_t ts)
+	{
 	// Bro can't support times back to the 1600's
 	// so we subtract a lot of seconds.
 	double secs = (ts / 10000000.0L) - 11644473600.0L;
+	return make_intrusive<Val>(secs, TYPE_TIME);
+	}
 
-	Val* bro_ts = new Val(secs, TYPE_TIME);
-
-	return bro_ts;
-	%}
-
-function time_from_lanman(t: SMB_time, d: SMB_date, tz: uint16): Val
-	%{
+IntrusivePtr<Val> time_from_lanman(SMB_time* t, SMB_date* d, uint16_t tz)
+	{
 	tm lTime;
 	lTime.tm_sec = ${t.two_seconds} * 2;
 	lTime.tm_min = ${t.minutes};
@@ -30,11 +24,22 @@ function time_from_lanman(t: SMB_time, d: SMB_date, tz: uint16): Val
 	lTime.tm_mday = ${d.day};
 	lTime.tm_mon = ${d.month};
 	lTime.tm_year = 1980 + ${d.year};
-    lTime.tm_isdst = -1;
+	lTime.tm_isdst = -1;
 	double lResult = mktime(&lTime);
-	return new Val(lResult + tz, TYPE_TIME);
-	%}
+	return make_intrusive<Val>(lResult + tz, TYPE_TIME);
+	}
 
+IntrusivePtr<RecordVal> SMB_BuildMACTimes(uint64_t modify, uint64_t access,
+                                          uint64_t create, uint64_t change)
+	{
+	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB::MACTimes);
+	r->Assign(0, filetime2brotime(modify));
+	r->Assign(1, filetime2brotime(access));
+	r->Assign(2, filetime2brotime(create));
+	r->Assign(3, filetime2brotime(change));
+	return r;
+	}
+%}
 
 type SMB_timestamp32 = uint32;
 type SMB_timestamp = uint64;
diff --git a/src/analyzer/protocol/smb/smb1-com-check-directory.pac b/src/analyzer/protocol/smb/smb1-com-check-directory.pac
index 53b5ff9f0d..3c7747fc7b 100644
--- a/src/analyzer/protocol/smb/smb1-com-check-directory.pac
+++ b/src/analyzer/protocol/smb/smb1-com-check-directory.pac
@@ -3,17 +3,17 @@ refine connection SMB_Conn += {
 	function proc_smb1_check_directory_request(header: SMB_Header, val: SMB1_check_directory_request): bool
 		%{
 		if ( smb1_check_directory_request )
-			BifEvent::enqueue_smb1_check_directory_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_check_directory_request(bro_analyzer(),
 			                                               bro_analyzer()->Conn(),
 			                                               SMBHeaderVal(header),
-			                                               {AdoptRef{}, smb_string2stringval(${val.directory_name})});
+			                                               smb_string2stringval(${val.directory_name}));
 		return true;
 		%}
 
 	function proc_smb1_check_directory_response(header: SMB_Header, val: SMB1_check_directory_response): bool
 		%{
 		if ( smb1_check_directory_response )
-			BifEvent::enqueue_smb1_check_directory_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_check_directory_response(bro_analyzer(),
 			                                                bro_analyzer()->Conn(),
 			                                                SMBHeaderVal(header));
 		return true;
diff --git a/src/analyzer/protocol/smb/smb1-com-close.pac b/src/analyzer/protocol/smb/smb1-com-close.pac
index f07fce3820..8e85de4685 100644
--- a/src/analyzer/protocol/smb/smb1-com-close.pac
+++ b/src/analyzer/protocol/smb/smb1-com-close.pac
@@ -3,7 +3,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_close_request(h: SMB_Header, val: SMB1_close_request): bool
 		%{
 		if ( smb1_close_request )
-			BifEvent::enqueue_smb1_close_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_close_request(bro_analyzer(),
 			                                     bro_analyzer()->Conn(),
 			                                     SMBHeaderVal(h),
 			                                     ${val.file_id});
diff --git a/src/analyzer/protocol/smb/smb1-com-create-directory.pac b/src/analyzer/protocol/smb/smb1-com-create-directory.pac
index e1dd85f55a..af9b9f4897 100644
--- a/src/analyzer/protocol/smb/smb1-com-create-directory.pac
+++ b/src/analyzer/protocol/smb/smb1-com-create-directory.pac
@@ -3,15 +3,15 @@ refine connection SMB_Conn += {
 	function proc_smb1_create_directory_request(header: SMB_Header, val: SMB1_create_directory_request): bool
 		%{
 		if ( smb1_create_directory_request )
-			BifEvent::enqueue_smb1_create_directory_request(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_smb1_create_directory_request(bro_analyzer(), bro_analyzer()->Conn(),
 			                                                SMBHeaderVal(header),
-			                                                {AdoptRef{}, smb_string2stringval(${val.directory_name})});
+			                                                smb_string2stringval(${val.directory_name}));
 		return true;
 		%}
 	function proc_smb1_create_directory_response(header: SMB_Header, val: SMB1_create_directory_response): bool
 		%{
 		if ( smb1_create_directory_response )
-			BifEvent::enqueue_smb1_create_directory_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_create_directory_response(bro_analyzer(),
 			                                                 bro_analyzer()->Conn(),
 			                                                 SMBHeaderVal(header));
 		return true;
diff --git a/src/analyzer/protocol/smb/smb1-com-echo.pac b/src/analyzer/protocol/smb/smb1-com-echo.pac
index c8a8f9eb0c..33fb977748 100644
--- a/src/analyzer/protocol/smb/smb1-com-echo.pac
+++ b/src/analyzer/protocol/smb/smb1-com-echo.pac
@@ -3,7 +3,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_echo_request(header: SMB_Header, val: SMB1_echo_request): bool
 		%{
 		if ( smb1_echo_request )
-			BifEvent::enqueue_smb1_echo_request(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_smb1_echo_request(bro_analyzer(), bro_analyzer()->Conn(),
 			                                    ${val.echo_count}, to_stringval(${val.data}));
 		return true;
 		%}
@@ -11,7 +11,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_echo_response(header: SMB_Header, val: SMB1_echo_response): bool
 		%{
 		if ( smb1_echo_response )
-			BifEvent::enqueue_smb1_echo_response(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_smb1_echo_response(bro_analyzer(), bro_analyzer()->Conn(),
 			                                     ${val.seq_num}, to_stringval(${val.data}));
 		return true;
 		%}
diff --git a/src/analyzer/protocol/smb/smb1-com-logoff-andx.pac b/src/analyzer/protocol/smb/smb1-com-logoff-andx.pac
index 878d549022..7efc8993ca 100644
--- a/src/analyzer/protocol/smb/smb1-com-logoff-andx.pac
+++ b/src/analyzer/protocol/smb/smb1-com-logoff-andx.pac
@@ -3,7 +3,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_logoff_andx(header: SMB_Header, val: SMB1_logoff_andx): bool
 		%{
 		if ( smb1_logoff_andx )
-			BifEvent::enqueue_smb1_logoff_andx(bro_analyzer(), bro_analyzer()->Conn(), ${val.is_orig});
+			zeek::BifEvent::enqueue_smb1_logoff_andx(bro_analyzer(), bro_analyzer()->Conn(), ${val.is_orig});
 
 		return true;
 		%}
diff --git a/src/analyzer/protocol/smb/smb1-com-negotiate.pac b/src/analyzer/protocol/smb/smb1-com-negotiate.pac
index 62842b33c3..1a6ef0c3bd 100644
--- a/src/analyzer/protocol/smb/smb1-com-negotiate.pac
+++ b/src/analyzer/protocol/smb/smb1-com-negotiate.pac
@@ -15,15 +15,15 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_negotiate_request )
 			{
-			auto dialects = make_intrusive<VectorVal>(string_vec);
+			auto dialects = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 			for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i )
 				{
-				StringVal* dia = smb_string2stringval((*${val.dialects})[i]->name());
-				dialects->Assign(i, dia);
+				auto dia = smb_string2stringval((*${val.dialects})[i]->name());
+				dialects->Assign(i, std::move(dia));
 				}
 
-			BifEvent::enqueue_smb1_negotiate_request(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_smb1_negotiate_request(bro_analyzer(), bro_analyzer()->Conn(),
 			                                         SMBHeaderVal(header),
 			                                         std::move(dialects));
 			}
@@ -35,59 +35,57 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_negotiate_response )
 			{
-			auto response = make_intrusive<RecordVal>(BifType::Record::SMB1::NegotiateResponse);
+			auto response = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponse);
 
-			RecordVal* core;
-			RecordVal* lanman;
-			RecordVal* ntlm;
-
-			RecordVal* security;
-			RecordVal* raw;
-			RecordVal* capabilities;
 			switch ( ${val.word_count} )
 				{
 				case 0x01:
-					core = new RecordVal(BifType::Record::SMB1::NegotiateResponseCore);
+					{
+					auto core = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseCore);
 					core->Assign(0, val_mgr->Count(${val.dialect_index}));
 
-					response->Assign(0, core);
+					response->Assign(0, std::move(core));
+					}
 					break;
 
 				case 0x0d:
-					security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity);
+					{
+					auto security = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseSecurity);
 					security->Assign(0, val_mgr->Bool(${val.lanman.security_user_level}));
 					security->Assign(1, val_mgr->Bool(${val.lanman.security_challenge_response}));
 
-					raw = new RecordVal(BifType::Record::SMB1::NegotiateRawMode);
+					auto raw = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateRawMode);
 					raw->Assign(0, val_mgr->Bool(${val.lanman.raw_read_supported}));
 					raw->Assign(1, val_mgr->Bool(${val.lanman.raw_write_supported}));
 
-					lanman = new RecordVal(BifType::Record::SMB1::NegotiateResponseLANMAN);
+					auto lanman = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseLANMAN);
 					lanman->Assign(0, val_mgr->Count(${val.word_count}));
 					lanman->Assign(1, val_mgr->Count(${val.dialect_index}));
-					lanman->Assign(2, security);
+					lanman->Assign(2, std::move(security));
 					lanman->Assign(3, val_mgr->Count(${val.lanman.max_buffer_size}));
 					lanman->Assign(4, val_mgr->Count(${val.lanman.max_mpx_count}));
 
 					lanman->Assign(5, val_mgr->Count(${val.lanman.max_number_vcs}));
-					lanman->Assign(6, raw);
+					lanman->Assign(6, std::move(raw));
 					lanman->Assign(7, val_mgr->Count(${val.lanman.session_key}));
 					lanman->Assign(8, time_from_lanman(${val.lanman.server_time}, ${val.lanman.server_date}, ${val.lanman.server_tz}));
 					lanman->Assign(9, to_stringval(${val.lanman.encryption_key}));
 
 					lanman->Assign(10, smb_string2stringval(${val.lanman.primary_domain}));
 
-					response->Assign(1, lanman);
+					response->Assign(1, std::move(lanman));
+					}
 					break;
 
 				case 0x11:
-					security = new RecordVal(BifType::Record::SMB1::NegotiateResponseSecurity);
+					{
+					auto security = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseSecurity);
 					security->Assign(0, val_mgr->Bool(${val.ntlm.security_user_level}));
 					security->Assign(1, val_mgr->Bool(${val.ntlm.security_challenge_response}));
 					security->Assign(2, val_mgr->Bool(${val.ntlm.security_signatures_enabled}));
 					security->Assign(3, val_mgr->Bool(${val.ntlm.security_signatures_required}));
 
-					capabilities = new RecordVal(BifType::Record::SMB1::NegotiateCapabilities);
+					auto capabilities = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateCapabilities);
 					capabilities->Assign(0, val_mgr->Bool(${val.ntlm.capabilities_raw_mode}));
 					capabilities->Assign(1, val_mgr->Bool(${val.ntlm.capabilities_mpx_mode}));
 					capabilities->Assign(2, val_mgr->Bool(${val.ntlm.capabilities_unicode}));
@@ -110,17 +108,17 @@ refine connection SMB_Conn += {
 					capabilities->Assign(16, val_mgr->Bool(${val.ntlm.capabilities_compressed_data}));
 					capabilities->Assign(17, val_mgr->Bool(${val.ntlm.capabilities_extended_security}));
 
-					ntlm = new RecordVal(BifType::Record::SMB1::NegotiateResponseNTLM);
+					auto ntlm = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::NegotiateResponseNTLM);
 					ntlm->Assign(0, val_mgr->Count(${val.word_count}));
 					ntlm->Assign(1, val_mgr->Count(${val.dialect_index}));
-					ntlm->Assign(2, security);
+					ntlm->Assign(2, std::move(security));
 					ntlm->Assign(3, val_mgr->Count(${val.ntlm.max_buffer_size}));
 					ntlm->Assign(4, val_mgr->Count(${val.ntlm.max_mpx_count}));
 
 					ntlm->Assign(5, val_mgr->Count(${val.ntlm.max_number_vcs}));
 					ntlm->Assign(6, val_mgr->Count(${val.ntlm.max_raw_size}));
 					ntlm->Assign(7, val_mgr->Count(${val.ntlm.session_key}));
-					ntlm->Assign(8, capabilities);
+					ntlm->Assign(8, std::move(capabilities));
 					ntlm->Assign(9, filetime2brotime(${val.ntlm.server_time}));
 
 					if ( ${val.ntlm.capabilities_extended_security} == false )
@@ -133,10 +131,11 @@ refine connection SMB_Conn += {
 						ntlm->Assign(12, to_stringval(${val.ntlm.server_guid}));
 						}
 
-					response->Assign(2, ntlm);
+					response->Assign(2, std::move(ntlm));
+					}
 					break;
 				}
-			BifEvent::enqueue_smb1_negotiate_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_negotiate_response(bro_analyzer(),
 			                                          bro_analyzer()->Conn(),
 			                                          SMBHeaderVal(header),
 			                                          std::move(response));
diff --git a/src/analyzer/protocol/smb/smb1-com-nt-cancel.pac b/src/analyzer/protocol/smb/smb1-com-nt-cancel.pac
index 17da194d01..185c49b6b5 100644
--- a/src/analyzer/protocol/smb/smb1-com-nt-cancel.pac
+++ b/src/analyzer/protocol/smb/smb1-com-nt-cancel.pac
@@ -3,7 +3,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_nt_cancel_request(header: SMB_Header, val: SMB1_nt_cancel_request): bool
 		%{
 		if ( smb1_nt_cancel_request )
-			BifEvent::enqueue_smb1_nt_cancel_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_nt_cancel_request(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
 			                                         SMBHeaderVal(header));
 		return true;
diff --git a/src/analyzer/protocol/smb/smb1-com-nt-create-andx.pac b/src/analyzer/protocol/smb/smb1-com-nt-create-andx.pac
index c8022c1bf6..c7c0ba745e 100644
--- a/src/analyzer/protocol/smb/smb1-com-nt-create-andx.pac
+++ b/src/analyzer/protocol/smb/smb1-com-nt-create-andx.pac
@@ -1,21 +1,21 @@
 refine connection SMB_Conn += {
 	function proc_smb1_nt_create_andx_request(header: SMB_Header, val: SMB1_nt_create_andx_request): bool
 		%{
-		auto filename = IntrusivePtr<StringVal>{AdoptRef{}, smb_string2stringval(${val.filename})};
+		auto filename = smb_string2stringval(${val.filename});
 
 		if ( ! ${header.is_pipe} &&
-		     BifConst::SMB::pipe_filenames->AsTable()->Lookup(filename->CheckString()) )
+		     zeek::BifConst::SMB::pipe_filenames->AsTable()->Lookup(filename->CheckString()) )
 			{
 			set_tree_is_pipe(${header.tid});
 
 			if ( smb_pipe_connect_heuristic )
-				BifEvent::enqueue_smb_pipe_connect_heuristic(bro_analyzer(),
+				zeek::BifEvent::enqueue_smb_pipe_connect_heuristic(bro_analyzer(),
 				                                             bro_analyzer()->Conn());
 			}
 
 		if ( smb1_nt_create_andx_request )
 			{
-			BifEvent::enqueue_smb1_nt_create_andx_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_nt_create_andx_request(bro_analyzer(),
 			                                              bro_analyzer()->Conn(),
 			                                              SMBHeaderVal(header),
 			                                              std::move(filename));
@@ -28,15 +28,15 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_nt_create_andx_response )
 			{
-			BifEvent::enqueue_smb1_nt_create_andx_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_nt_create_andx_response(bro_analyzer(),
 			                                               bro_analyzer()->Conn(),
 			                                               SMBHeaderVal(header),
 			                                               ${val.file_id},
 			                                               ${val.end_of_file},
-			                                               {AdoptRef{}, SMB_BuildMACTimes(${val.last_write_time},
+			                                               SMB_BuildMACTimes(${val.last_write_time},
 			                                                                 ${val.last_access_time},
 			                                                                 ${val.create_time},
-			                                                                 ${val.last_change_time})});
+			                                                                 ${val.last_change_time}));
 			}
 
 		return true;
diff --git a/src/analyzer/protocol/smb/smb1-com-query-information.pac b/src/analyzer/protocol/smb/smb1-com-query-information.pac
index 29ffcf089c..a5dc03366b 100644
--- a/src/analyzer/protocol/smb/smb1-com-query-information.pac
+++ b/src/analyzer/protocol/smb/smb1-com-query-information.pac
@@ -3,10 +3,10 @@ refine connection SMB_Conn += {
 	function proc_smb1_query_information_request(header: SMB_Header, val: SMB1_query_information_request): bool
 		%{
 		if ( smb1_query_information_request )
-			BifEvent::enqueue_smb1_query_information_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_query_information_request(bro_analyzer(),
 			                                                 bro_analyzer()->Conn(),
 			                                                 SMBHeaderVal(header),
-			                                                 {AdoptRef{}, smb_string2stringval(${val.filename})});
+			                                                 smb_string2stringval(${val.filename}));
 		return true;
 		%}
 
diff --git a/src/analyzer/protocol/smb/smb1-com-read-andx.pac b/src/analyzer/protocol/smb/smb1-com-read-andx.pac
index a90518b604..79317a3450 100644
--- a/src/analyzer/protocol/smb/smb1-com-read-andx.pac
+++ b/src/analyzer/protocol/smb/smb1-com-read-andx.pac
@@ -9,7 +9,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_read_andx_request(h: SMB_Header, val: SMB1_read_andx_request): bool
 		%{
 		if ( smb1_read_andx_request )
-			BifEvent::enqueue_smb1_read_andx_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_read_andx_request(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
 			                                         SMBHeaderVal(h),
 			                                         ${val.file_id},
@@ -23,7 +23,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_read_andx_response(h: SMB_Header, val: SMB1_read_andx_response): bool
 		%{
 		if ( smb1_read_andx_response )
-			BifEvent::enqueue_smb1_read_andx_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_read_andx_response(bro_analyzer(),
 			                                          bro_analyzer()->Conn(),
 			                                          SMBHeaderVal(h),
 			                                          ${val.data_len});
diff --git a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
index d2eadde58a..ddc2c6ce3e 100644
--- a/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
+++ b/src/analyzer/protocol/smb/smb1-com-session-setup-andx.pac
@@ -12,8 +12,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_session_setup_andx_request )
 			{
-			auto request = make_intrusive<RecordVal>(BifType::Record::SMB1::SessionSetupAndXRequest);
-			RecordVal* capabilities;
+			auto request = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXRequest);
 
 			request->Assign(0, val_mgr->Count(${val.word_count}));
 			switch ( ${val.word_count} ) {
@@ -31,7 +30,8 @@ refine connection SMB_Conn += {
 
 					break;
 				case 12:	// NT LM 0.12 with extended security
-					capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities);
+					{
+					auto capabilities = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities);
 				 	capabilities->Assign(0, val_mgr->Bool(${val.ntlm_extended_security.capabilities.unicode}));
 				 	capabilities->Assign(1, val_mgr->Bool(${val.ntlm_extended_security.capabilities.large_files}));
 				 	capabilities->Assign(2, val_mgr->Bool(${val.ntlm_extended_security.capabilities.nt_smbs}));
@@ -47,11 +47,13 @@ refine connection SMB_Conn += {
 					request->Assign(5, smb_string2stringval(${val.ntlm_extended_security.native_os}));
 					request->Assign(6, smb_string2stringval(${val.ntlm_extended_security.native_lanman}));
 
-					request->Assign(13, capabilities);
+					request->Assign(13, std::move(capabilities));
+					}
 					break;
 
 				case 13: // NT LM 0.12 without extended security
-					capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities);
+					{
+					auto capabilities = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXCapabilities);
 				 	capabilities->Assign(0, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.unicode}));
 				 	capabilities->Assign(1, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.large_files}));
 				 	capabilities->Assign(2, val_mgr->Bool(${val.ntlm_nonextended_security.capabilities.nt_smbs}));
@@ -71,11 +73,12 @@ refine connection SMB_Conn += {
 
 					request->Assign(10, to_stringval(${val.ntlm_nonextended_security.case_insensitive_password}));
 					request->Assign(11, to_stringval(${val.ntlm_nonextended_security.case_sensitive_password}));
-					request->Assign(13, capabilities);
+					request->Assign(13, std::move(capabilities));
+					}
 					break;
 				}
 
-			BifEvent::enqueue_smb1_session_setup_andx_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_session_setup_andx_request(bro_analyzer(),
 			                                                  bro_analyzer()->Conn(),
 			                                                  SMBHeaderVal(header),
 			                                                  std::move(request));
@@ -87,16 +90,16 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_session_setup_andx_response )
 			{
-			auto response = make_intrusive<RecordVal>(BifType::Record::SMB1::SessionSetupAndXResponse);
+			auto response = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::SessionSetupAndXResponse);
 			response->Assign(0, val_mgr->Count(${val.word_count}));
 
 			switch ( ${val.word_count} )
 				{
 				case 3: // pre NT LM 0.12
 					response->Assign(1, val_mgr->Bool(${val.lanman.is_guest}));
-					response->Assign(2, ${val.lanman.byte_count} == 0 ? val_mgr->EmptyString()->Ref()->AsStringVal() : smb_string2stringval(${val.lanman.native_os[0]}));
-					response->Assign(3, ${val.lanman.byte_count} == 0 ? val_mgr->EmptyString()->Ref()->AsStringVal() : smb_string2stringval(${val.lanman.native_lanman[0]}));
-					response->Assign(4, ${val.lanman.byte_count} == 0 ? val_mgr->EmptyString()->Ref()->AsStringVal() : smb_string2stringval(${val.lanman.primary_domain[0]}));
+					response->Assign(2, ${val.lanman.byte_count} == 0 ? val_mgr->EmptyString() : smb_string2stringval(${val.lanman.native_os[0]}));
+					response->Assign(3, ${val.lanman.byte_count} == 0 ? val_mgr->EmptyString() : smb_string2stringval(${val.lanman.native_lanman[0]}));
+					response->Assign(4, ${val.lanman.byte_count} == 0 ? val_mgr->EmptyString() : smb_string2stringval(${val.lanman.primary_domain[0]}));
 					break;
 				case 4: // NT LM 0.12
 					response->Assign(1, val_mgr->Bool(${val.ntlm.is_guest}));
@@ -109,7 +112,7 @@ refine connection SMB_Conn += {
 					break;
 				}
 
-			BifEvent::enqueue_smb1_session_setup_andx_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_session_setup_andx_response(bro_analyzer(),
 			                                                   bro_analyzer()->Conn(),
 			                                                   SMBHeaderVal(header),
 			                                                   std::move(response));
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac
index 80af3dfe6b..321e1f9183 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction-secondary.pac
@@ -5,7 +5,7 @@ refine connection SMB_Conn += {
 	if ( ! smb1_transaction_secondary_request )
 		return false;
 
-	auto args = make_intrusive<RecordVal>(BifType::Record::SMB1::Trans_Sec_Args);
+	auto args = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans_Sec_Args);
 	args->Assign(0, val_mgr->Count(${val.total_param_count}));
 	args->Assign(1, val_mgr->Count(${val.total_data_count}));
 	args->Assign(2, val_mgr->Count(${val.param_count}));
@@ -45,7 +45,7 @@ refine connection SMB_Conn += {
 		payload_str = val_mgr->EmptyString();
 		}
 
-	BifEvent::enqueue_smb1_transaction_secondary_request(bro_analyzer(),
+	zeek::BifEvent::enqueue_smb1_transaction_secondary_request(bro_analyzer(),
 	                                                     bro_analyzer()->Conn(),
 	                                                     SMBHeaderVal(header),
 	                                                     std::move(args),
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction.pac b/src/analyzer/protocol/smb/smb1-com-transaction.pac
index c227203c6a..221f8c5549 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction.pac
@@ -62,10 +62,10 @@ refine connection SMB_Conn += {
 		else
 			payload_str = val_mgr->EmptyString();
 
-		BifEvent::enqueue_smb1_transaction_request(bro_analyzer(),
+		zeek::BifEvent::enqueue_smb1_transaction_request(bro_analyzer(),
 		                                           bro_analyzer()->Conn(),
 		                                           SMBHeaderVal(header),
-		                                           {AdoptRef{}, smb_string2stringval(${val.name})},
+		                                           smb_string2stringval(${val.name}),
 		                                           ${val.sub_cmd},
 		                                           std::move(parameters),
 		                                           std::move(payload_str));
@@ -87,7 +87,7 @@ refine connection SMB_Conn += {
 		else
 			payload_str = val_mgr->EmptyString();
 
-		BifEvent::enqueue_smb1_transaction_response(bro_analyzer(),
+		zeek::BifEvent::enqueue_smb1_transaction_response(bro_analyzer(),
 		                                            bro_analyzer()->Conn(),
 		                                            SMBHeaderVal(header),
 		                                            std::move(parameters),
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac
index 3c41139935..a3a65c8367 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction2-secondary.pac
@@ -5,7 +5,7 @@ refine connection SMB_Conn += {
 	if ( ! smb1_transaction2_secondary_request )
 		return false;
 
-	auto args = make_intrusive<RecordVal>(BifType::Record::SMB1::Trans2_Sec_Args);
+	auto args = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans2_Sec_Args);
 	args->Assign(0, val_mgr->Count(${val.total_param_count}));
 	args->Assign(1, val_mgr->Count(${val.total_data_count}));
 	args->Assign(2, val_mgr->Count(${val.param_count}));
@@ -19,7 +19,7 @@ refine connection SMB_Conn += {
 	auto parameters = make_intrusive<StringVal>(${val.parameters}.length(), (const char*)${val.parameters}.data());
 	auto payload = make_intrusive<StringVal>(${val.data}.length(), (const char*)${val.data}.data());
 
-	BifEvent::enqueue_smb1_transaction2_secondary_request(bro_analyzer(),
+	zeek::BifEvent::enqueue_smb1_transaction2_secondary_request(bro_analyzer(),
 	                                                      bro_analyzer()->Conn(),
 	                                                      SMBHeaderVal(header),
 	                                                      std::move(args),
diff --git a/src/analyzer/protocol/smb/smb1-com-transaction2.pac b/src/analyzer/protocol/smb/smb1-com-transaction2.pac
index 5bec0b667b..b13865d989 100644
--- a/src/analyzer/protocol/smb/smb1-com-transaction2.pac
+++ b/src/analyzer/protocol/smb/smb1-com-transaction2.pac
@@ -24,7 +24,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_transaction2_request )
 			{
-			auto args = make_intrusive<RecordVal>(BifType::Record::SMB1::Trans2_Args);
+			auto args = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Trans2_Args);
 			args->Assign(0, val_mgr->Count(${val.total_param_count}));
 			args->Assign(1, val_mgr->Count(${val.total_data_count}));
 			args->Assign(2, val_mgr->Count(${val.max_param_count}));
@@ -38,7 +38,7 @@ refine connection SMB_Conn += {
 			args->Assign(10, val_mgr->Count(${val.data_offset}));
 			args->Assign(11, val_mgr->Count(${val.setup_count}));
 
-			BifEvent::enqueue_smb1_transaction2_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_transaction2_request(bro_analyzer(),
 			                                            bro_analyzer()->Conn(),
 			                                            SMBHeaderVal(header),
 			                                            std::move(args),
@@ -51,7 +51,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_transaction2_response(header: SMB_Header, val: SMB1_transaction2_response): bool
 		%{
 		//if ( smb1_transaction2_response )
-		//	BifEvent::enqueue_smb1_transaction2_response(bro_analyzer(), bro_analyzer()->Conn(), SMBHeaderVal(header), ${val.sub_cmd});
+		//	zeek::BifEvent::enqueue_smb1_transaction2_response(bro_analyzer(), bro_analyzer()->Conn(), SMBHeaderVal(header), ${val.sub_cmd});
 		return true;
 		%}
 
@@ -131,14 +131,14 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_trans2_find_first2_request )
 			{
-			auto result = make_intrusive<RecordVal>(BifType::Record::SMB1::Find_First2_Request_Args);
+			auto result = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Find_First2_Request_Args);
 			result->Assign(0, val_mgr->Count(${val.search_attrs}));
 			result->Assign(1, val_mgr->Count(${val.search_count}));
 			result->Assign(2, val_mgr->Count(${val.flags}));
 			result->Assign(3, val_mgr->Count(${val.info_level}));
 			result->Assign(4, val_mgr->Count(${val.search_storage_type}));
 			result->Assign(5, smb_string2stringval(${val.file_name}));
-			BifEvent::enqueue_smb1_trans2_find_first2_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_trans2_find_first2_request(bro_analyzer(),
 			                                                  bro_analyzer()->Conn(),
 															  SMBHeaderVal(header),
 															  std::move(result));
@@ -217,10 +217,10 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_trans2_query_path_info_request )
 			{
-			BifEvent::enqueue_smb1_trans2_query_path_info_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_trans2_query_path_info_request(bro_analyzer(),
 			                                                      bro_analyzer()->Conn(),
 																  SMBHeaderVal(header),
-																  {AdoptRef{}, smb_string2stringval(${val.file_name})});
+																  smb_string2stringval(${val.file_name}));
 
 			}
 		return true;
@@ -322,10 +322,10 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_trans2_get_dfs_referral_request )
 			{
-			BifEvent::enqueue_smb1_trans2_get_dfs_referral_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_trans2_get_dfs_referral_request(bro_analyzer(),
 			                                                       bro_analyzer()->Conn(),
 			                                                       SMBHeaderVal(header),
-			                                                       {AdoptRef{}, smb_string2stringval(${val.file_name})});
+			                                                       smb_string2stringval(${val.file_name}));
 			}
 		return true;
 		%}
diff --git a/src/analyzer/protocol/smb/smb1-com-tree-connect-andx.pac b/src/analyzer/protocol/smb/smb1-com-tree-connect-andx.pac
index 69e53afcf7..914aef838b 100644
--- a/src/analyzer/protocol/smb/smb1-com-tree-connect-andx.pac
+++ b/src/analyzer/protocol/smb/smb1-com-tree-connect-andx.pac
@@ -3,29 +3,29 @@ refine connection SMB_Conn += {
 	function proc_smb1_tree_connect_andx_request(header: SMB_Header, val: SMB1_tree_connect_andx_request): bool
 		%{
 		if ( smb1_tree_connect_andx_request )
-			BifEvent::enqueue_smb1_tree_connect_andx_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_tree_connect_andx_request(bro_analyzer(),
 			                                                 bro_analyzer()->Conn(),
 			                                                 SMBHeaderVal(header),
-			                                                 {AdoptRef{}, smb_string2stringval(${val.path})},
-			                                                 {AdoptRef{}, smb_string2stringval(${val.service})});
+			                                                 smb_string2stringval(${val.path}),
+			                                                 smb_string2stringval(${val.service}));
 		return true;
 		%}
 
 	function proc_smb1_tree_connect_andx_response(header: SMB_Header, val: SMB1_tree_connect_andx_response): bool
 		%{
-		auto service_string = IntrusivePtr<StringVal>{AdoptRef{}, smb_string2stringval(${val.service})};
+		auto service_string = smb_string2stringval(${val.service});
 		auto s = reinterpret_cast<const char*>(service_string->Bytes());
 
 		if ( strncmp(s, "IPC", 3) == 0 )
 			set_tree_is_pipe(${header.tid});
 
 		if ( smb1_tree_connect_andx_response )
-			BifEvent::enqueue_smb1_tree_connect_andx_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_tree_connect_andx_response(bro_analyzer(),
 			                                                  bro_analyzer()->Conn(),
 			                                                  SMBHeaderVal(header),
 			                                                  std::move(service_string),
 			                                                  ${val.byte_count} > ${val.service.a}->size() ?
-			                                                     IntrusivePtr<StringVal>{AdoptRef{}, smb_string2stringval(${val.native_file_system[0]})} :
+			                                                     smb_string2stringval(${val.native_file_system[0]}) :
 			                                                     val_mgr->EmptyString());
 
 		return true;
diff --git a/src/analyzer/protocol/smb/smb1-com-tree-disconnect.pac b/src/analyzer/protocol/smb/smb1-com-tree-disconnect.pac
index b0178b65aa..7a23729181 100644
--- a/src/analyzer/protocol/smb/smb1-com-tree-disconnect.pac
+++ b/src/analyzer/protocol/smb/smb1-com-tree-disconnect.pac
@@ -3,7 +3,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_tree_disconnect(header: SMB_Header, val: SMB1_tree_disconnect): bool
 		%{
 		if ( smb1_tree_disconnect )
-			BifEvent::enqueue_smb1_tree_disconnect(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_tree_disconnect(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
 			                                       SMBHeaderVal(header),
 			                                       ${val.is_orig});
diff --git a/src/analyzer/protocol/smb/smb1-com-write-andx.pac b/src/analyzer/protocol/smb/smb1-com-write-andx.pac
index b2fd8d9381..8831d730df 100644
--- a/src/analyzer/protocol/smb/smb1-com-write-andx.pac
+++ b/src/analyzer/protocol/smb/smb1-com-write-andx.pac
@@ -3,7 +3,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_write_andx_request(h: SMB_Header, val: SMB1_write_andx_request): bool
 		%{
 		if ( smb1_write_andx_request )
-			BifEvent::enqueue_smb1_write_andx_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_write_andx_request(bro_analyzer(),
 			                                          bro_analyzer()->Conn(),
 			                                          SMBHeaderVal(h),
 			                                          ${val.file_id},
@@ -24,7 +24,7 @@ refine connection SMB_Conn += {
 	function proc_smb1_write_andx_response(h: SMB_Header, val: SMB1_write_andx_response): bool
 		%{
 		if ( smb1_write_andx_response )
-			BifEvent::enqueue_smb1_write_andx_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_write_andx_response(bro_analyzer(),
 			                                           bro_analyzer()->Conn(),
 			                                           SMBHeaderVal(h),
 			                                           ${val.written_bytes});
diff --git a/src/analyzer/protocol/smb/smb1-protocol.pac b/src/analyzer/protocol/smb/smb1-protocol.pac
index 8e19fcbe57..63e6d87e87 100644
--- a/src/analyzer/protocol/smb/smb1-protocol.pac
+++ b/src/analyzer/protocol/smb/smb1-protocol.pac
@@ -9,7 +9,7 @@
 %code{
 	IntrusivePtr<RecordVal> SMBHeaderVal(SMB_Header* hdr)
 		{
-		auto r = make_intrusive<RecordVal>(BifType::Record::SMB1::Header);
+		auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB1::Header);
 
 		//unsigned int status = 0;
 		//
@@ -43,7 +43,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_message )
 			{
-			BifEvent::enqueue_smb1_message(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_smb1_message(bro_analyzer(), bro_analyzer()->Conn(),
 			                                SMBHeaderVal(h),
 			                                is_orig);
 			}
@@ -54,7 +54,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb1_empty_response )
 			{
-			BifEvent::enqueue_smb1_empty_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb1_empty_response(bro_analyzer(),
 			                                      bro_analyzer()->Conn(),
 			                                      SMBHeaderVal(header));
 			}
@@ -67,7 +67,7 @@ refine connection SMB_Conn += {
 			{
 			if ( smb1_empty_response )
 				{
-				BifEvent::enqueue_smb1_empty_response(bro_analyzer(),
+				zeek::BifEvent::enqueue_smb1_empty_response(bro_analyzer(),
 				                                      bro_analyzer()->Conn(),
 				                                      SMBHeaderVal(h));
 				}
@@ -75,7 +75,7 @@ refine connection SMB_Conn += {
 		else
 			{
 			if ( smb1_error )
-				BifEvent::enqueue_smb1_error(bro_analyzer(),
+				zeek::BifEvent::enqueue_smb1_error(bro_analyzer(),
 				                             bro_analyzer()->Conn(),
 				                             SMBHeaderVal(h), is_orig);
 			}
diff --git a/src/analyzer/protocol/smb/smb2-com-close.pac b/src/analyzer/protocol/smb/smb2-com-close.pac
index 9ad939f60a..db6b24b9b4 100644
--- a/src/analyzer/protocol/smb/smb2-com-close.pac
+++ b/src/analyzer/protocol/smb/smb2-com-close.pac
@@ -4,10 +4,10 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_close_request )
 			{
-			BifEvent::enqueue_smb2_close_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_close_request(bro_analyzer(),
 			                                     bro_analyzer()->Conn(),
-			                                     {AdoptRef{}, BuildSMB2HeaderVal(h)},
-			                                     {AdoptRef{}, BuildSMB2GUID(${val.file_id})});
+			                                     BuildSMB2HeaderVal(h),
+			                                     BuildSMB2GUID(${val.file_id}));
 			}
 
 		file_mgr->EndOfFile(bro_analyzer()->GetAnalyzerTag(),
@@ -20,7 +20,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_close_response )
 			{
-			auto resp = make_intrusive<RecordVal>(BifType::Record::SMB2::CloseResponse);
+			auto resp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CloseResponse);
 
 			resp->Assign(0, val_mgr->Count(${val.alloc_size}));
 			resp->Assign(1, val_mgr->Count(${val.eof}));
@@ -30,9 +30,9 @@ refine connection SMB_Conn += {
 			                                  ${val.change_time}));
 			resp->Assign(3, smb2_file_attrs_to_bro(${val.file_attrs}));
 
-			BifEvent::enqueue_smb2_close_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_close_response(bro_analyzer(),
 			                                      bro_analyzer()->Conn(),
-			                                      {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			                                      BuildSMB2HeaderVal(h),
 			                                      std::move(resp));
 			}
 
diff --git a/src/analyzer/protocol/smb/smb2-com-create.pac b/src/analyzer/protocol/smb/smb2-com-create.pac
index 1b42de1b4a..ac9feb22f0 100644
--- a/src/analyzer/protocol/smb/smb2-com-create.pac
+++ b/src/analyzer/protocol/smb/smb2-com-create.pac
@@ -2,32 +2,29 @@ refine connection SMB_Conn += {
 
 	function proc_smb2_create_request(h: SMB2_Header, val: SMB2_create_request): bool
 		%{
-		StringVal *filename = smb2_string2stringval(${val.filename});
+		auto filename = smb2_string2stringval(${val.filename});
+
 		if ( ! ${h.is_pipe} &&
-		     BifConst::SMB::pipe_filenames->AsTable()->Lookup(filename->CheckString()) )
+		     zeek::BifConst::SMB::pipe_filenames->AsTable()->Lookup(filename->CheckString()) )
 			{
 			set_tree_is_pipe(${h.tree_id});
 
 			if ( smb_pipe_connect_heuristic )
-				BifEvent::enqueue_smb_pipe_connect_heuristic(bro_analyzer(),
+				zeek::BifEvent::enqueue_smb_pipe_connect_heuristic(bro_analyzer(),
 				                                             bro_analyzer()->Conn());
 			}
 
 		if ( smb2_create_request )
 			{
-			auto requestinfo = make_intrusive<RecordVal>(BifType::Record::SMB2::CreateRequest);
-			requestinfo->Assign(0, filename);
+			auto requestinfo = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CreateRequest);
+			requestinfo->Assign(0, std::move(filename));
 			requestinfo->Assign(1, val_mgr->Count(${val.disposition}));
 			requestinfo->Assign(2, val_mgr->Count(${val.create_options}));
-			BifEvent::enqueue_smb2_create_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_create_request(bro_analyzer(),
 			                                      bro_analyzer()->Conn(),
-			                                      {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			                                      BuildSMB2HeaderVal(h),
 			                                      std::move(requestinfo));
 			}
-		else
-			{
-			delete filename;
-			}
 
 		return true;
 		%}
@@ -36,7 +33,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_create_response )
 			{
-			auto responseinfo = make_intrusive<RecordVal>(BifType::Record::SMB2::CreateResponse);
+			auto responseinfo = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CreateResponse);
 			responseinfo->Assign(0, BuildSMB2GUID(${val.file_id}));
 			responseinfo->Assign(1, val_mgr->Count(${val.eof}));
 			responseinfo->Assign(2, SMB_BuildMACTimes(${val.last_write_time},
@@ -45,9 +42,9 @@ refine connection SMB_Conn += {
 			                                          ${val.change_time}));
 			responseinfo->Assign(3, smb2_file_attrs_to_bro(${val.file_attrs}));
 			responseinfo->Assign(4, val_mgr->Count(${val.create_action}));
-			BifEvent::enqueue_smb2_create_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_create_response(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
-			                                       {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			                                       BuildSMB2HeaderVal(h),
 												   std::move(responseinfo));
 			}
 
diff --git a/src/analyzer/protocol/smb/smb2-com-negotiate.pac b/src/analyzer/protocol/smb/smb2-com-negotiate.pac
index 6c3b26e8f5..cc639088f2 100644
--- a/src/analyzer/protocol/smb/smb2-com-negotiate.pac
+++ b/src/analyzer/protocol/smb/smb2-com-negotiate.pac
@@ -22,13 +22,13 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_negotiate_request )
 			{
-			auto dialects = make_intrusive<VectorVal>(index_vec);
+			auto dialects = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			for ( unsigned int i = 0; i < ${val.dialects}->size(); ++i )
 				dialects->Assign(i, val_mgr->Count((*${val.dialects})[i]));
 
-			BifEvent::enqueue_smb2_negotiate_request(bro_analyzer(), bro_analyzer()->Conn(),
-			                                         {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			zeek::BifEvent::enqueue_smb2_negotiate_request(bro_analyzer(), bro_analyzer()->Conn(),
+			                                         BuildSMB2HeaderVal(h),
 			                                         std::move(dialects));
 			}
 
@@ -39,7 +39,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_negotiate_response )
 			{
-			auto nr = make_intrusive<RecordVal>(BifType::Record::SMB2::NegotiateResponse);
+			auto nr = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::NegotiateResponse);
 
 			nr->Assign(0, val_mgr->Count(${val.dialect_revision}));
 			nr->Assign(1, val_mgr->Count(${val.security_mode}));
@@ -48,7 +48,7 @@ refine connection SMB_Conn += {
 			nr->Assign(4, filetime2brotime(${val.server_start_time}));
 			nr->Assign(5, val_mgr->Count(${val.negotiate_context_count}));
 
-			VectorVal* cv = new VectorVal(BifType::Vector::SMB2::NegotiateContextValues);
+			auto cv = make_intrusive<VectorVal>(zeek::BifType::Vector::SMB2::NegotiateContextValues);
 
 			if ( ${val.dialect_revision} == 0x0311 && ${val.negotiate_context_count} > 0 )
 				{
@@ -58,10 +58,10 @@ refine connection SMB_Conn += {
 				cv->Assign(${val.smb3_ncl.list.vals}->size(), BuildSMB2ContextVal(${val.smb3_ncl.list.last_val}));
 				}
 
-			nr->Assign(6, cv);
+			nr->Assign(6, std::move(cv));
 
-			BifEvent::enqueue_smb2_negotiate_response(bro_analyzer(), bro_analyzer()->Conn(),
-			                                          {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			zeek::BifEvent::enqueue_smb2_negotiate_response(bro_analyzer(), bro_analyzer()->Conn(),
+			                                          BuildSMB2HeaderVal(h),
 													  std::move(nr));
 			}
 
diff --git a/src/analyzer/protocol/smb/smb2-com-read.pac b/src/analyzer/protocol/smb/smb2-com-read.pac
index ce78903401..07eafcbabc 100644
--- a/src/analyzer/protocol/smb/smb2-com-read.pac
+++ b/src/analyzer/protocol/smb/smb2-com-read.pac
@@ -26,10 +26,10 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_read_request )
 			{
-			BifEvent::enqueue_smb2_read_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_read_request(bro_analyzer(),
 			                                    bro_analyzer()->Conn(),
-			                                    {AdoptRef{}, BuildSMB2HeaderVal(h)},
-			                                    {AdoptRef{}, BuildSMB2GUID(${val.file_id})},
+			                                    BuildSMB2HeaderVal(h),
+			                                    BuildSMB2GUID(${val.file_id}),
 			                                    ${val.offset},
 			                                    ${val.read_len});
 			}
diff --git a/src/analyzer/protocol/smb/smb2-com-session-setup.pac b/src/analyzer/protocol/smb/smb2-com-session-setup.pac
index 4060b18f99..5b4b5f27e8 100644
--- a/src/analyzer/protocol/smb/smb2-com-session-setup.pac
+++ b/src/analyzer/protocol/smb/smb2-com-session-setup.pac
@@ -4,12 +4,12 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_session_setup_request )
 			{
-			auto req = make_intrusive<RecordVal>(BifType::Record::SMB2::SessionSetupRequest);
+			auto req = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupRequest);
 			req->Assign(0, val_mgr->Count(${val.security_mode}));
 
-			BifEvent::enqueue_smb2_session_setup_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_session_setup_request(bro_analyzer(),
 			                                             bro_analyzer()->Conn(),
-			                                             {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			                                             BuildSMB2HeaderVal(h),
 														 std::move(req));
 			}
 
@@ -20,17 +20,17 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_session_setup_response )
 			{
-			auto flags = make_intrusive<RecordVal>(BifType::Record::SMB2::SessionSetupFlags);
+			auto flags = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupFlags);
 			flags->Assign(0, val_mgr->Bool(${val.flag_guest}));
 			flags->Assign(1, val_mgr->Bool(${val.flag_anonymous}));
 			flags->Assign(2, val_mgr->Bool(${val.flag_encrypt}));
 
-			auto resp = make_intrusive<RecordVal>(BifType::Record::SMB2::SessionSetupResponse);
+			auto resp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::SessionSetupResponse);
 			resp->Assign(0, std::move(flags));
 
-			BifEvent::enqueue_smb2_session_setup_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_session_setup_response(bro_analyzer(),
 			                                              bro_analyzer()->Conn(),
-			                                              {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			                                              BuildSMB2HeaderVal(h),
 			                                              std::move(resp));
 			}
 
diff --git a/src/analyzer/protocol/smb/smb2-com-set-info.pac b/src/analyzer/protocol/smb/smb2-com-set-info.pac
index d390c174db..a1c13e61b6 100644
--- a/src/analyzer/protocol/smb/smb2-com-set-info.pac
+++ b/src/analyzer/protocol/smb/smb2-com-set-info.pac
@@ -28,15 +28,15 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file(val: SMB2_file_basic_info): bool
 		%{
 		if ( smb2_file_sattr )
-			BifEvent::enqueue_smb2_file_sattr(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_sattr(bro_analyzer(),
 			                                  bro_analyzer()->Conn(),
-			                                  {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                  {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
-			                                  {AdoptRef{}, SMB_BuildMACTimes(${val.last_write_time},
-			                                                       ${val.last_access_time},
-			                                                       ${val.creation_time},
-			                                                       ${val.change_time})},
-			                                  {AdoptRef{}, smb2_file_attrs_to_bro(${val.file_attrs})});
+			                                  BuildSMB2HeaderVal(${val.sir.header}),
+			                                  BuildSMB2GUID(${val.sir.file_id}),
+			                                  SMB_BuildMACTimes(${val.last_write_time},
+			                                                    ${val.last_access_time},
+			                                                    ${val.creation_time},
+			                                                    ${val.change_time}),
+			                                  smb2_file_attrs_to_bro(${val.file_attrs}));
 
 		return true;
 		%}
@@ -44,11 +44,11 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_rename(val: SMB2_file_rename_info): bool
 		%{
 		if ( smb2_file_rename )
-			BifEvent::enqueue_smb2_file_rename(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_rename(bro_analyzer(),
 			                                   bro_analyzer()->Conn(),
-			                                   {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                   {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
-			                                   {AdoptRef{}, smb2_string2stringval(${val.filename})});
+			                                   BuildSMB2HeaderVal(${val.sir.header}),
+			                                   BuildSMB2GUID(${val.sir.file_id}),
+			                                   smb2_string2stringval(${val.filename}));
 
 		return true;
 		%}
@@ -56,10 +56,10 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_delete(val: SMB2_file_disposition_info): bool
 		%{
 		if ( smb2_file_delete )
-			BifEvent::enqueue_smb2_file_delete(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_delete(bro_analyzer(),
 			                                   bro_analyzer()->Conn(),
-			                                   {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                   {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                   BuildSMB2HeaderVal(${val.sir.header}),
+			                                   BuildSMB2GUID(${val.sir.file_id}),
 			                                   (${val.delete_pending} > 0));
 
 		return true;
@@ -68,10 +68,10 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_allocation(val: SMB2_file_allocation_info): bool
 		%{
 		if ( smb2_file_allocation )
-			BifEvent::enqueue_smb2_file_allocation(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_allocation(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
-			                                       {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                       {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                       BuildSMB2HeaderVal(${val.sir.header}),
+			                                       BuildSMB2GUID(${val.sir.file_id}),
 			                                       (${val.allocation_size}));
 
 		return true;
@@ -80,10 +80,10 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_endoffile(val: SMB2_file_endoffile_info): bool
 		%{
 		if ( smb2_file_endoffile )
-			BifEvent::enqueue_smb2_file_endoffile(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_endoffile(bro_analyzer(),
 			                                      bro_analyzer()->Conn(),
-			                                      {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                      {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                      BuildSMB2HeaderVal(${val.sir.header}),
+			                                      BuildSMB2GUID(${val.sir.file_id}),
 			                                      ${val.endoffile});
 
 		return true;
@@ -93,22 +93,22 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_file_fullea )
 			{
-			auto eas = make_intrusive<VectorVal>(BifType::Vector::SMB2::FileEAs);
+			auto eas = make_intrusive<VectorVal>(zeek::BifType::Vector::SMB2::FileEAs);
 
 			for ( auto i = 0u; i < ${val.ea_vector}->size(); ++i )
 				{
-				auto r = make_intrusive<RecordVal>(BifType::Record::SMB2::FileEA);
+				auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::FileEA);
 				r->Assign(0, smb2_string2stringval(${val.ea_vector[i].ea_name}));
 				r->Assign(1, smb2_string2stringval(${val.ea_vector[i].ea_value}));
 
 				eas->Assign(i, std::move(r));
 				}
 
-			BifEvent::enqueue_smb2_file_fullea(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_fullea(bro_analyzer(),
 			                                   bro_analyzer()->Conn(),
-			                                   {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                   {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
-											   std::move(eas));
+			                                   BuildSMB2HeaderVal(${val.sir.header}),
+			                                   BuildSMB2GUID(${val.sir.file_id}),
+			                                   std::move(eas));
 			}
 
 		return true;
@@ -117,12 +117,12 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_link(val: SMB2_file_link_info): bool
 		%{
 		if ( smb2_file_link )
-			BifEvent::enqueue_smb2_file_link(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_link(bro_analyzer(),
 			                                 bro_analyzer()->Conn(),
-			                                 {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                 {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                 BuildSMB2HeaderVal(${val.sir.header}),
+			                                 BuildSMB2GUID(${val.sir.file_id}),
 			                                 ${val.root_directory},
-			                                 {AdoptRef{}, smb2_string2stringval(${val.file_name})});
+			                                 smb2_string2stringval(${val.file_name}));
 
 		return true;
 		%}
@@ -130,10 +130,10 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_mode(val: SMB2_file_mode_info): bool
 		%{
 		if ( smb2_file_mode )
-			BifEvent::enqueue_smb2_file_mode(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_mode(bro_analyzer(),
 			                                 bro_analyzer()->Conn(),
-			                                 {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                 {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                 BuildSMB2HeaderVal(${val.sir.header}),
+			                                 BuildSMB2GUID(${val.sir.file_id}),
 			                                 ${val.mode});
 
 		return true;
@@ -142,12 +142,12 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_pipe(val: SMB2_file_pipe_info): bool
 		%{
 		if ( smb2_file_pipe )
-			BifEvent::enqueue_smb2_file_pipe(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_pipe(bro_analyzer(),
 			                                 bro_analyzer()->Conn(),
-			                                 {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                 {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                 BuildSMB2HeaderVal(${val.sir.header}),
+			                                 BuildSMB2GUID(${val.sir.file_id}),
 			                                 ${val.read_mode},
-			                                    ${val.completion_mode});
+			                                 ${val.completion_mode});
 
 		return true;
 		%}
@@ -155,10 +155,10 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_position(val: SMB2_file_position_info): bool
 		%{
 		if ( smb2_file_position )
-			BifEvent::enqueue_smb2_file_position(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_position(bro_analyzer(),
 			                                     bro_analyzer()->Conn(),
-			                                     {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                     {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                     BuildSMB2HeaderVal(${val.sir.header}),
+			                                     BuildSMB2GUID(${val.sir.file_id}),
 			                                     ${val.current_byte_offset});
 
 		return true;
@@ -167,11 +167,11 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_shortname(val: SMB2_file_shortname_info): bool
 		%{
 		if ( smb2_file_shortname )
-			BifEvent::enqueue_smb2_file_shortname(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_shortname(bro_analyzer(),
 			                                      bro_analyzer()->Conn(),
-			                                      {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                      {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
-			                                      {AdoptRef{}, smb2_string2stringval(${val.filename})});
+			                                      BuildSMB2HeaderVal(${val.sir.header}),
+			                                      BuildSMB2GUID(${val.sir.file_id}),
+			                                      smb2_string2stringval(${val.filename}));
 
 		return true;
 		%}
@@ -179,10 +179,10 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_validdatalength(val: SMB2_file_validdatalength_info): bool
 		%{
 		if ( smb2_file_validdatalength )
-			BifEvent::enqueue_smb2_file_validdatalength(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_validdatalength(bro_analyzer(),
 			                                            bro_analyzer()->Conn(),
-			                                            {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                            {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
+			                                            BuildSMB2HeaderVal(${val.sir.header}),
+			                                            BuildSMB2GUID(${val.sir.file_id}),
 			                                            ${val.validdatalength});
 
 		return true;
@@ -192,7 +192,7 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_file_fscontrol )
 			{
-			auto r = make_intrusive<RecordVal>(BifType::Record::SMB2::Fscontrol);
+			auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Fscontrol);
 			r->Assign(0, val_mgr->Int(${val.free_space_start_filtering}));
 			r->Assign(1, val_mgr->Int(${val.free_space_start_threshold}));
 			r->Assign(2, val_mgr->Int(${val.free_space_stop_filtering}));
@@ -200,11 +200,11 @@ refine connection SMB_Conn += {
 			r->Assign(4, val_mgr->Count(${val.default_quota_limit}));
 			r->Assign(5, val_mgr->Count(${val.file_system_control_flags}));
 
-			BifEvent::enqueue_smb2_file_fscontrol(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_fscontrol(bro_analyzer(),
 			                                      bro_analyzer()->Conn(),
-			                                      {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                      {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
-												  std::move(r));
+			                                      BuildSMB2HeaderVal(${val.sir.header}),
+			                                      BuildSMB2GUID(${val.sir.file_id}),
+			                                      std::move(r));
 			}
 
 		return true;
@@ -213,12 +213,12 @@ refine connection SMB_Conn += {
 	function proc_smb2_set_info_request_file_fsobjectid(val: SMB2_file_fsobjectid_info): bool
 		%{
 		if ( smb2_file_fsobjectid )
-			BifEvent::enqueue_smb2_file_fsobjectid(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_file_fsobjectid(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
-			                                       {AdoptRef{}, BuildSMB2HeaderVal(${val.sir.header})},
-			                                       {AdoptRef{}, BuildSMB2GUID(${val.sir.file_id})},
-			                                       {AdoptRef{}, BuildSMB2GUID(${val.object_id})},
-			                                       {AdoptRef{}, smb2_string2stringval(${val.extended_info})});
+			                                       BuildSMB2HeaderVal(${val.sir.header}),
+			                                       BuildSMB2GUID(${val.sir.file_id}),
+			                                       BuildSMB2GUID(${val.object_id}),
+			                                       smb2_string2stringval(${val.extended_info}));
 
 		return true;
 		%}
diff --git a/src/analyzer/protocol/smb/smb2-com-transform-header.pac b/src/analyzer/protocol/smb/smb2-com-transform-header.pac
index 2c2da578e6..a261f58d42 100644
--- a/src/analyzer/protocol/smb/smb2-com-transform-header.pac
+++ b/src/analyzer/protocol/smb/smb2-com-transform-header.pac
@@ -1,24 +1,20 @@
 refine connection SMB_Conn += {
 
-	function BuildSMB2TransformHeaderVal(hdr: SMB2_transform_header): BroVal
-		%{
-		RecordVal* r = new RecordVal(BifType::Record::SMB2::Transform_header);
-
-		r->Assign(0, to_stringval(${hdr.signature}));
-		r->Assign(1, to_stringval(${hdr.nonce}));
-		r->Assign(2, val_mgr->Count(${hdr.orig_msg_size}));
-		r->Assign(3, val_mgr->Count(${hdr.flags}));
-		r->Assign(4, val_mgr->Count(${hdr.session_id}));
-
-		return r;
-		%}
-
 	function proc_smb2_transform_header(hdr: SMB2_transform_header) : bool
 		%{
 		if ( smb2_transform_header )
-			BifEvent::enqueue_smb2_transform_header(bro_analyzer(),
+			{
+			auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Transform_header);
+			r->Assign(0, to_stringval(${hdr.signature}));
+			r->Assign(1, to_stringval(${hdr.nonce}));
+			r->Assign(2, val_mgr->Count(${hdr.orig_msg_size}));
+			r->Assign(3, val_mgr->Count(${hdr.flags}));
+			r->Assign(4, val_mgr->Count(${hdr.session_id}));
+
+			zeek::BifEvent::enqueue_smb2_transform_header(bro_analyzer(),
 			                                        bro_analyzer()->Conn(),
-			                                        {AdoptRef{}, BuildSMB2TransformHeaderVal(hdr)});
+			                                        std::move(r));
+			}
 
 		return true;
 		%}
diff --git a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac
index 262c8ef173..63de3c1ccb 100644
--- a/src/analyzer/protocol/smb/smb2-com-tree-connect.pac
+++ b/src/analyzer/protocol/smb/smb2-com-tree-connect.pac
@@ -3,10 +3,10 @@ refine connection SMB_Conn += {
 	function proc_smb2_tree_connect_request(header: SMB2_Header, val: SMB2_tree_connect_request): bool
 		%{
 		if ( smb2_tree_connect_request )
-			BifEvent::enqueue_smb2_tree_connect_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_tree_connect_request(bro_analyzer(),
 			                                            bro_analyzer()->Conn(),
-			                                            {AdoptRef{}, BuildSMB2HeaderVal(header)},
-			                                            {AdoptRef{}, smb2_string2stringval(${val.path})});
+			                                            BuildSMB2HeaderVal(header),
+			                                            smb2_string2stringval(${val.path}));
 
 		return true;
 		%}
@@ -18,12 +18,12 @@ refine connection SMB_Conn += {
 
 		if ( smb2_tree_connect_response )
 			{
-			auto resp = make_intrusive<RecordVal>(BifType::Record::SMB2::TreeConnectResponse);
+			auto resp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::TreeConnectResponse);
 			resp->Assign(0, val_mgr->Count(${val.share_type}));
 
-			BifEvent::enqueue_smb2_tree_connect_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_tree_connect_response(bro_analyzer(),
 			                                             bro_analyzer()->Conn(),
-			                                             {AdoptRef{}, BuildSMB2HeaderVal(header)},
+			                                             BuildSMB2HeaderVal(header),
 														 std::move(resp));
 			}
 
diff --git a/src/analyzer/protocol/smb/smb2-com-tree-disconnect.pac b/src/analyzer/protocol/smb/smb2-com-tree-disconnect.pac
index a4ce9cf21e..ebfe3cf367 100644
--- a/src/analyzer/protocol/smb/smb2-com-tree-disconnect.pac
+++ b/src/analyzer/protocol/smb/smb2-com-tree-disconnect.pac
@@ -7,9 +7,9 @@ refine connection SMB_Conn += {
 
 		if ( smb2_tree_disconnect_request )
 			{
-			BifEvent::enqueue_smb2_tree_disconnect_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_tree_disconnect_request(bro_analyzer(),
 			                                               bro_analyzer()->Conn(),
-			                                               {AdoptRef{}, BuildSMB2HeaderVal(header)});
+			                                               BuildSMB2HeaderVal(header));
 			}
 
 		return true;
@@ -19,9 +19,9 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_tree_disconnect_response )
 			{
-			BifEvent::enqueue_smb2_tree_disconnect_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_tree_disconnect_response(bro_analyzer(),
 			                                                bro_analyzer()->Conn(),
-			                                                {AdoptRef{}, BuildSMB2HeaderVal(header)});
+			                                                BuildSMB2HeaderVal(header));
 			}
 
 		return true;
diff --git a/src/analyzer/protocol/smb/smb2-com-write.pac b/src/analyzer/protocol/smb/smb2-com-write.pac
index e638f45a55..91cbd1988d 100644
--- a/src/analyzer/protocol/smb/smb2-com-write.pac
+++ b/src/analyzer/protocol/smb/smb2-com-write.pac
@@ -4,10 +4,10 @@ refine connection SMB_Conn += {
 		%{
 		if ( smb2_write_request )
 			{
-			BifEvent::enqueue_smb2_write_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_write_request(bro_analyzer(),
 			                                     bro_analyzer()->Conn(),
-			                                     {AdoptRef{}, BuildSMB2HeaderVal(h)},
-			                                     {AdoptRef{}, BuildSMB2GUID(${val.file_id})},
+			                                     BuildSMB2HeaderVal(h),
+			                                     BuildSMB2GUID(${val.file_id}),
 			                                     ${val.offset},
 			                                     ${val.data_len});
 			}
@@ -27,9 +27,9 @@ refine connection SMB_Conn += {
 
 		if ( smb2_write_response )
 			{
-			BifEvent::enqueue_smb2_write_response(bro_analyzer(),
+			zeek::BifEvent::enqueue_smb2_write_response(bro_analyzer(),
 			                                      bro_analyzer()->Conn(),
-			                                      {AdoptRef{}, BuildSMB2HeaderVal(h)},
+			                                      BuildSMB2HeaderVal(h),
 			                                      ${val.write_count});
 			}
 
diff --git a/src/analyzer/protocol/smb/smb2-protocol.pac b/src/analyzer/protocol/smb/smb2-protocol.pac
index 00e525ff50..3df04b354d 100644
--- a/src/analyzer/protocol/smb/smb2-protocol.pac
+++ b/src/analyzer/protocol/smb/smb2-protocol.pac
@@ -1,6 +1,137 @@
 # Documentation for SMB2 protocol from here:
 #     http://msdn.microsoft.com/en-us/library/cc246497(v=PROT.13).aspx
 
+%header{
+IntrusivePtr<RecordVal> BuildSMB2HeaderVal(SMB2_Header* hdr);
+IntrusivePtr<RecordVal> BuildSMB2GUID(SMB2_guid* file_id);
+IntrusivePtr<RecordVal> smb2_file_attrs_to_bro(SMB2_file_attributes* val);
+IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv);
+%}
+
+%code{
+IntrusivePtr<RecordVal> BuildSMB2HeaderVal(SMB2_Header* hdr)
+	{
+	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::Header);
+	r->Assign(0, val_mgr->Count(${hdr.credit_charge}));
+	r->Assign(1, val_mgr->Count(${hdr.status}));
+	r->Assign(2, val_mgr->Count(${hdr.command}));
+	r->Assign(3, val_mgr->Count(${hdr.credits}));
+	r->Assign(4, val_mgr->Count(${hdr.flags}));
+	r->Assign(5, val_mgr->Count(${hdr.message_id}));
+	r->Assign(6, val_mgr->Count(${hdr.process_id}));
+	r->Assign(7, val_mgr->Count(${hdr.tree_id}));
+	r->Assign(8, val_mgr->Count(${hdr.session_id}));
+	r->Assign(9, to_stringval(${hdr.signature}));
+	return r;
+	}
+
+IntrusivePtr<RecordVal> BuildSMB2GUID(SMB2_guid* file_id)
+	{
+	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::GUID);
+	r->Assign(0, val_mgr->Count(${file_id.persistent}));
+	r->Assign(1, val_mgr->Count(${file_id._volatile}));
+	return r;
+	}
+
+IntrusivePtr<RecordVal> smb2_file_attrs_to_bro(SMB2_file_attributes* val)
+	{
+	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::FileAttrs);
+	r->Assign(0, val_mgr->Bool(${val.read_only}));
+	r->Assign(1, val_mgr->Bool(${val.hidden}));
+	r->Assign(2, val_mgr->Bool(${val.system}));
+	r->Assign(3, val_mgr->Bool(${val.directory}));
+	r->Assign(4, val_mgr->Bool(${val.archive}));
+	r->Assign(5, val_mgr->Bool(${val.normal}));
+	r->Assign(6, val_mgr->Bool(${val.temporary}));
+	r->Assign(7, val_mgr->Bool(${val.sparse_file}));
+	r->Assign(8, val_mgr->Bool(${val.reparse_point}));
+	r->Assign(9, val_mgr->Bool(${val.compressed}));
+	r->Assign(10, val_mgr->Bool(${val.offline}));
+	r->Assign(11, val_mgr->Bool(${val.not_content_indexed}));
+	r->Assign(12, val_mgr->Bool(${val.encrypted}));
+	r->Assign(13, val_mgr->Bool(${val.integrity_stream}));
+	r->Assign(14, val_mgr->Bool(${val.no_scrub_data}));
+	return r;
+	}
+
+IntrusivePtr<RecordVal> BuildSMB2ContextVal(SMB3_negotiate_context_value* ncv)
+	{
+	auto r = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::NegotiateContextValue);
+
+	r->Assign(0, val_mgr->Count(${ncv.context_type}));
+	r->Assign(1, val_mgr->Count(${ncv.data_length}));
+
+	switch ( ${ncv.context_type} ) {
+	case SMB2_PREAUTH_INTEGRITY_CAPABILITIES:
+		{
+		auto rpreauth = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::PreAuthIntegrityCapabilities);
+		rpreauth->Assign(0, val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg_count}));
+		rpreauth->Assign(1, val_mgr->Count(${ncv.preauth_integrity_capabilities.salt_length}));
+
+		auto ha = make_intrusive<VectorVal>(zeek::id::index_vec);
+
+		for ( int i = 0; i < ${ncv.preauth_integrity_capabilities.hash_alg_count}; ++i )
+			{
+			const auto& vec = *${ncv.preauth_integrity_capabilities.hash_alg};
+			ha->Assign(i, val_mgr->Count(vec[i]));
+			}
+
+		rpreauth->Assign(2, std::move(ha));
+		rpreauth->Assign(3, to_stringval(${ncv.preauth_integrity_capabilities.salt}));
+		r->Assign(2, std::move(rpreauth));
+		}
+		break;
+
+	case SMB2_ENCRYPTION_CAPABILITIES:
+		{
+		auto rencr = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::EncryptionCapabilities);
+		rencr->Assign(0, val_mgr->Count(${ncv.encryption_capabilities.cipher_count}));
+
+		auto c = make_intrusive<VectorVal>(zeek::id::index_vec);
+
+		for ( int i = 0; i < ${ncv.encryption_capabilities.cipher_count}; ++i )
+			{
+			const auto& vec = *${ncv.encryption_capabilities.ciphers};
+			c->Assign(i, val_mgr->Count(vec[i]));
+			}
+
+		rencr->Assign(1, std::move(c));
+		r->Assign(3, std::move(rencr));
+		}
+		break;
+
+	case SMB2_COMPRESSION_CAPABILITIES:
+		{
+		auto rcomp = make_intrusive<RecordVal>(zeek::BifType::Record::SMB2::CompressionCapabilities);
+		rcomp->Assign(0, val_mgr->Count(${ncv.compression_capabilities.alg_count}));
+
+		auto c = make_intrusive<VectorVal>(zeek::id::index_vec);
+
+		for ( int i = 0; i < ${ncv.compression_capabilities.alg_count}; ++i )
+			{
+			const auto& vec = *${ncv.compression_capabilities.algs};
+			c->Assign(i, val_mgr->Count(vec[i]));
+			}
+
+		rcomp->Assign(1, std::move(c));
+		r->Assign(4, std::move(rcomp));
+		}
+		break;
+
+	case SMB2_NETNAME_NEGOTIATE_CONTEXT_ID:
+		{
+		r->Assign(5, to_stringval(${ncv.netname_negotiate_context_id.net_name}));
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	return r;
+	}
+%}
+
 enum smb2_commands {
 	SMB2_NEGOTIATE_PROTOCOL = 0,
 	SMB2_SESSION_SETUP      = 1,
@@ -100,102 +231,6 @@ refine connection SMB_Conn += {
 		std::map<uint64,uint64> smb2_request_tree_id;
 	%}
 
-	function BuildSMB2ContextVal(ncv: SMB3_negotiate_context_value): BroVal
-		%{
-		RecordVal* r = new RecordVal(BifType::Record::SMB2::NegotiateContextValue);
-
-		r->Assign(0, val_mgr->Count(${ncv.context_type}));
-		r->Assign(1, val_mgr->Count(${ncv.data_length}));
-
-		switch ( ${ncv.context_type} ) {
-			case SMB2_PREAUTH_INTEGRITY_CAPABILITIES:
-				{
-				RecordVal* rpreauth = new RecordVal(BifType::Record::SMB2::PreAuthIntegrityCapabilities);
-				rpreauth->Assign(0, val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg_count}));
-				rpreauth->Assign(1, val_mgr->Count(${ncv.preauth_integrity_capabilities.salt_length}));
-
-				VectorVal* ha = new VectorVal(internal_type("index_vec")->AsVectorType());
-
-				for ( int i = 0; i < (${ncv.preauth_integrity_capabilities.hash_alg_count}); ++i )
-						ha->Assign(i, val_mgr->Count(${ncv.preauth_integrity_capabilities.hash_alg[i]}));
-
-				rpreauth->Assign(2, ha);
-				rpreauth->Assign(3, to_stringval(${ncv.preauth_integrity_capabilities.salt}));
-				r->Assign(2, rpreauth);
-				}
-				break;
-
-			case SMB2_ENCRYPTION_CAPABILITIES:
-				{
-				RecordVal* rencr = new RecordVal(BifType::Record::SMB2::EncryptionCapabilities);
-				rencr->Assign(0, val_mgr->Count(${ncv.encryption_capabilities.cipher_count}));
-
-				VectorVal* c = new VectorVal(internal_type("index_vec")->AsVectorType());
-
-				for ( int i = 0; i < (${ncv.encryption_capabilities.cipher_count}); ++i )
-						c->Assign(i, val_mgr->Count(${ncv.encryption_capabilities.ciphers[i]}));
-
-				rencr->Assign(1, c);
-				r->Assign(3, rencr);
-				}
-				break;
-
-			case SMB2_COMPRESSION_CAPABILITIES:
-				{
-				RecordVal* rcomp = new RecordVal(BifType::Record::SMB2::CompressionCapabilities);
-				rcomp->Assign(0, val_mgr->Count(${ncv.compression_capabilities.alg_count}));
-
-				VectorVal* c = new VectorVal(internal_type("index_vec")->AsVectorType());
-
-				for ( int i = 0; i < (${ncv.compression_capabilities.alg_count}); ++i )
-						c->Assign(i, val_mgr->Count(${ncv.compression_capabilities.algs[i]}));
-
-				rcomp->Assign(1, c);
-				r->Assign(4, rcomp);
-				}
-				break;
-
-			case SMB2_NETNAME_NEGOTIATE_CONTEXT_ID:
-				{
-				r->Assign(5, to_stringval(${ncv.netname_negotiate_context_id.net_name}));
-				}
-				break;
-
-			default:
-				break;
-		}
-
-		return r;
-		%}
-
-	function BuildSMB2HeaderVal(hdr: SMB2_Header): BroVal
-		%{
-		RecordVal* r = new RecordVal(BifType::Record::SMB2::Header);
-
-		r->Assign(0, val_mgr->Count(${hdr.credit_charge}));
-		r->Assign(1, val_mgr->Count(${hdr.status}));
-		r->Assign(2, val_mgr->Count(${hdr.command}));
-		r->Assign(3, val_mgr->Count(${hdr.credits}));
-		r->Assign(4, val_mgr->Count(${hdr.flags}));
-		r->Assign(5, val_mgr->Count(${hdr.message_id}));
-		r->Assign(6, val_mgr->Count(${hdr.process_id}));
-		r->Assign(7, val_mgr->Count(${hdr.tree_id}));
-		r->Assign(8, val_mgr->Count(${hdr.session_id}));
-		r->Assign(9, to_stringval(${hdr.signature}));
-
-		return r;
-		%}
-
-	function BuildSMB2GUID(file_id: SMB2_guid): BroVal
-		%{
-		RecordVal* r = new RecordVal(BifType::Record::SMB2::GUID);
-
-		r->Assign(0, val_mgr->Count(${file_id.persistent}));
-		r->Assign(1, val_mgr->Count(${file_id._volatile}));
-
-		return r;
-		%}
-
 	function proc_smb2_message(h: SMB2_Header, is_orig: bool): bool
 		%{
 		if ( is_orig )
@@ -215,9 +250,8 @@ refine connection SMB_Conn += {
 
 		if ( smb2_message )
 			{
-			BifEvent::enqueue_smb2_message(bro_analyzer(), bro_analyzer()->Conn(),
-			                               {AdoptRef{}, BuildSMB2HeaderVal(h)},
-			                               is_orig);
+			zeek::BifEvent::enqueue_smb2_message(bro_analyzer(), bro_analyzer()->Conn(),
+			                               BuildSMB2HeaderVal(h), is_orig);
 			}
 		return true;
 		%}
@@ -234,29 +268,6 @@ refine connection SMB_Conn += {
 		%}
 };
 
-function smb2_file_attrs_to_bro(val: SMB2_file_attributes): BroVal
-	%{
-	RecordVal* r = new RecordVal(BifType::Record::SMB2::FileAttrs);
-
-	r->Assign(0, val_mgr->Bool(${val.read_only}));
-	r->Assign(1, val_mgr->Bool(${val.hidden}));
-	r->Assign(2, val_mgr->Bool(${val.system}));
-	r->Assign(3, val_mgr->Bool(${val.directory}));
-	r->Assign(4, val_mgr->Bool(${val.archive}));
-	r->Assign(5, val_mgr->Bool(${val.normal}));
-	r->Assign(6, val_mgr->Bool(${val.temporary}));
-	r->Assign(7, val_mgr->Bool(${val.sparse_file}));
-	r->Assign(8, val_mgr->Bool(${val.reparse_point}));
-	r->Assign(9, val_mgr->Bool(${val.compressed}));
-	r->Assign(10, val_mgr->Bool(${val.offline}));
-	r->Assign(11, val_mgr->Bool(${val.not_content_indexed}));
-	r->Assign(12, val_mgr->Bool(${val.encrypted}));
-	r->Assign(13, val_mgr->Bool(${val.integrity_stream}));
-	r->Assign(14, val_mgr->Bool(${val.no_scrub_data}));
-
-	return r;
-	%}
-
 type SMB2_file_attributes = record {
 	flags : uint32;
 } &let {
diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac
index 17296e11f8..4793405697 100644
--- a/src/analyzer/protocol/snmp/snmp-analyzer.pac
+++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac
@@ -8,13 +8,13 @@
 %}
 
 %header{
-AddrVal* network_address_to_val(const ASN1Encoding* na);
-AddrVal* network_address_to_val(const NetworkAddress* na);
-Val*     asn1_obj_to_val(const ASN1Encoding* obj);
+IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na);
+IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na);
+IntrusivePtr<Val>     asn1_obj_to_val(const ASN1Encoding* obj);
 
 IntrusivePtr<RecordVal> build_hdr(const Header* header);
-RecordVal* build_hdrV3(const Header* header);
-VectorVal* build_bindings(const VarBindList* vbl);
+IntrusivePtr<RecordVal> build_hdrV3(const Header* header);
+IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl);
 IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu);
 IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu);
 IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu);
@@ -22,12 +22,12 @@ IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu);
 
 %code{
 
-AddrVal* network_address_to_val(const NetworkAddress* na)
+IntrusivePtr<AddrVal> network_address_to_val(const NetworkAddress* na)
 	{
 	return network_address_to_val(na->encoding());
 	}
 
-AddrVal* network_address_to_val(const ASN1Encoding* na)
+IntrusivePtr<AddrVal> network_address_to_val(const ASN1Encoding* na)
 	{
 	bytestring const& bs = na->content();
 
@@ -35,16 +35,16 @@ AddrVal* network_address_to_val(const ASN1Encoding* na)
 	// but standards don't seem to currently make any provisions for IPv6,
 	// so ignore anything that can't be IPv4.
 	if ( bs.length() != 4 )
-		return new AddrVal(IPAddr());
+		return make_intrusive<AddrVal>(IPAddr());
 
 	const u_char* data = reinterpret_cast<const u_char*>(bs.data());
 	uint32 network_order = extract_uint32(data);
-	return new AddrVal(ntohl(network_order));
+	return make_intrusive<AddrVal>(ntohl(network_order));
 	}
 
-Val* asn1_obj_to_val(const ASN1Encoding* obj)
+IntrusivePtr<Val> asn1_obj_to_val(const ASN1Encoding* obj)
 	{
-	RecordVal* rval = new RecordVal(BifType::Record::SNMP::ObjectValue);
+	IntrusivePtr<RecordVal> rval = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ObjectValue);
 	uint8 tag = obj->meta()->tag();
 
 	rval->Assign(0, val_mgr->Count(tag));
@@ -85,30 +85,30 @@ Val* asn1_obj_to_val(const ASN1Encoding* obj)
 	return rval;
 	}
 
-Val* time_ticks_to_val(const TimeTicks* tt)
+IntrusivePtr<Val> time_ticks_to_val(const TimeTicks* tt)
 	{
 	return asn1_integer_to_val(tt->asn1_integer(), TYPE_COUNT);
 	}
 
 IntrusivePtr<RecordVal> build_hdr(const Header* header)
 	{
-	auto rv = make_intrusive<RecordVal>(BifType::Record::SNMP::Header);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::Header);
 	rv->Assign(0, val_mgr->Count(header->version()));
 
 	switch ( header->version() ) {
 	case SNMPV1_TAG:
 		{
-		RecordVal* v1 = new RecordVal(BifType::Record::SNMP::HeaderV1);
+		auto v1 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV1);
 		v1->Assign(0, asn1_octet_string_to_val(header->v1()->community()));
-		rv->Assign(1, v1);
+		rv->Assign(1, std::move(v1));
 		}
 		break;
 
 	case SNMPV2_TAG:
 		{
-		RecordVal* v2 = new RecordVal(BifType::Record::SNMP::HeaderV2);
+		auto v2 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV2);
 		v2->Assign(0, asn1_octet_string_to_val(header->v2()->community()));
-		rv->Assign(2, v2);
+		rv->Assign(2, std::move(v2));
 		}
 		break;
 
@@ -122,48 +122,46 @@ IntrusivePtr<RecordVal> build_hdr(const Header* header)
 	return rv;
 	}
 
-RecordVal* build_hdrV3(const Header* header)
+IntrusivePtr<RecordVal> build_hdrV3(const Header* header)
 	{
-	RecordVal* v3 = new RecordVal(BifType::Record::SNMP::HeaderV3);
+	auto v3 = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::HeaderV3);
 	const v3Header* v3hdr = header->v3();
 	const v3HeaderData* global_data = v3hdr->global_data();
 	bytestring const& flags = global_data->flags()->encoding()->content();
 	uint8 flags_byte = flags.length() > 0 ? flags[0] : 0;
 
 	v3->Assign(0, asn1_integer_to_val(global_data->id(), TYPE_COUNT));
-	v3->Assign(1, asn1_integer_to_val(global_data->max_size(),
-	                                        TYPE_COUNT));
+	v3->Assign(1, asn1_integer_to_val(global_data->max_size(), TYPE_COUNT));
 	v3->Assign(2, val_mgr->Count(flags_byte));
 	v3->Assign(3, val_mgr->Bool(flags_byte & 0x01));
 	v3->Assign(4, val_mgr->Bool(flags_byte & 0x02));
 	v3->Assign(5, val_mgr->Bool(flags_byte & 0x04));
-	v3->Assign(6, asn1_integer_to_val(global_data->security_model(),
-	                                        TYPE_COUNT));
+	v3->Assign(6, asn1_integer_to_val(global_data->security_model(), TYPE_COUNT));
 	v3->Assign(7, asn1_octet_string_to_val(v3hdr->security_parameters()));
 
 	if ( v3hdr->next()->tag() == ASN1_SEQUENCE_TAG )
 		{
 		const v3ScopedPDU* spdu = v3hdr->plaintext_pdu();
-		RecordVal* rv = new RecordVal(BifType::Record::SNMP::ScopedPDU_Context);
+		auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::ScopedPDU_Context);
 		rv->Assign(0, asn1_octet_string_to_val(spdu->context_engine_id()));
 		rv->Assign(1, asn1_octet_string_to_val(spdu->context_name()));
-		v3->Assign(8, rv);
+		v3->Assign(8, std::move(rv));
 		}
 
 	return v3;
 	}
 
-VectorVal* build_bindings(const VarBindList* vbl)
+IntrusivePtr<VectorVal> build_bindings(const VarBindList* vbl)
 	{
-	VectorVal* vv = new VectorVal(BifType::Vector::SNMP::Bindings);
+	auto vv = make_intrusive<VectorVal>(zeek::BifType::Vector::SNMP::Bindings);
 
 	for ( size_t i = 0; i < vbl->bindings()->size(); ++i )
 		{
 		VarBind* vb = (*vbl->bindings())[i];
-		RecordVal* binding = new RecordVal(BifType::Record::SNMP::Binding);
+		auto binding = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::Binding);
 		binding->Assign(0, asn1_oid_to_val(vb->name()->oid()));
 		binding->Assign(1, asn1_obj_to_val(vb->value()->encoding()));
-		vv->Assign(i, binding);
+		vv->Assign(i, std::move(binding));
 		}
 
 	return vv;
@@ -171,7 +169,7 @@ VectorVal* build_bindings(const VarBindList* vbl)
 
 IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(BifType::Record::SNMP::PDU);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::PDU);
 	rv->Assign(0, asn1_integer_to_val(pdu->request_id(), TYPE_INT));
 	rv->Assign(1, asn1_integer_to_val(pdu->error_status(), TYPE_INT));
 	rv->Assign(2, asn1_integer_to_val(pdu->error_index(), TYPE_INT));
@@ -181,7 +179,7 @@ IntrusivePtr<RecordVal> build_pdu(const CommonPDU* pdu)
 
 IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(BifType::Record::SNMP::TrapPDU);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::TrapPDU);
 	rv->Assign(0, asn1_oid_to_val(pdu->enterprise()));
 	rv->Assign(1, network_address_to_val(pdu->agent_addr()));
 	rv->Assign(2, asn1_integer_to_val(pdu->generic_trap(), TYPE_INT));
@@ -193,7 +191,7 @@ IntrusivePtr<RecordVal> build_trap_pdu(const TrapPDU* pdu)
 
 IntrusivePtr<RecordVal> build_bulk_pdu(const GetBulkRequestPDU* pdu)
 	{
-	auto rv = make_intrusive<RecordVal>(BifType::Record::SNMP::BulkPDU);
+	auto rv = make_intrusive<RecordVal>(zeek::BifType::Record::SNMP::BulkPDU);
 	rv->Assign(0, asn1_integer_to_val(pdu->request_id(), TYPE_INT));
 	rv->Assign(1, asn1_integer_to_val(pdu->non_repeaters(), TYPE_COUNT));
 	rv->Assign(2, asn1_integer_to_val(pdu->max_repititions(), TYPE_COUNT));
@@ -209,7 +207,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_get_request )
 			return false;
 
-		BifEvent::enqueue_snmp_get_request(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_get_request(bro_analyzer(),
 		                                   bro_analyzer()->Conn(),
 		                                   ${pdu.header.is_orig},
 		                                   build_hdr(${pdu.header}),
@@ -222,7 +220,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_get_next_request )
 			return false;
 
-		BifEvent::enqueue_snmp_get_next_request(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_get_next_request(bro_analyzer(),
 		                                        bro_analyzer()->Conn(),
 		                                        ${pdu.header.is_orig},
 		                                        build_hdr(${pdu.header}),
@@ -235,7 +233,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_response )
 			return false;
 
-		BifEvent::enqueue_snmp_response(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_response(bro_analyzer(),
 		                                bro_analyzer()->Conn(),
 		                                ${pdu.header.is_orig},
 		                                build_hdr(${pdu.header}),
@@ -248,7 +246,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_set_request )
 			return false;
 
-		BifEvent::enqueue_snmp_set_request(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_set_request(bro_analyzer(),
 		                                   bro_analyzer()->Conn(),
 		                                   ${pdu.header.is_orig},
 		                                   build_hdr(${pdu.header}),
@@ -261,7 +259,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_trap )
 			return false;
 
-		BifEvent::enqueue_snmp_trap(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_trap(bro_analyzer(),
 		                            bro_analyzer()->Conn(),
 		                            ${pdu.header.is_orig},
 		                            build_hdr(${pdu.header}),
@@ -274,7 +272,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_get_bulk_request )
 			return false;
 
-		BifEvent::enqueue_snmp_get_bulk_request(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_get_bulk_request(bro_analyzer(),
 		                                        bro_analyzer()->Conn(),
 		                                        ${pdu.header.is_orig},
 		                                        build_hdr(${pdu.header}),
@@ -287,7 +285,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_inform_request )
 			return false;
 
-		BifEvent::enqueue_snmp_inform_request(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_inform_request(bro_analyzer(),
 		                                      bro_analyzer()->Conn(),
 		                                      ${pdu.header.is_orig},
 		                                      build_hdr(${pdu.header}),
@@ -300,7 +298,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_trapV2 )
 			return false;
 
-		BifEvent::enqueue_snmp_trapV2(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_trapV2(bro_analyzer(),
 		                              bro_analyzer()->Conn(),
 		                              ${pdu.header.is_orig},
 		                              build_hdr(${pdu.header}),
@@ -313,7 +311,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_report )
 			return false;
 
-		BifEvent::enqueue_snmp_report(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_report(bro_analyzer(),
 		                              bro_analyzer()->Conn(),
 		                              ${pdu.header.is_orig},
 		                              build_hdr(${pdu.header}),
@@ -326,7 +324,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_unknown_header_version )
 			return false;
 
-		BifEvent::enqueue_snmp_unknown_header_version(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_unknown_header_version(bro_analyzer(),
 		                                              bro_analyzer()->Conn(),
 		                                              ${rec.header.is_orig},
 		                                              ${rec.header.version});
@@ -338,7 +336,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_unknown_pdu )
 			return false;
 
-		BifEvent::enqueue_snmp_unknown_pdu(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_unknown_pdu(bro_analyzer(),
 		                                   bro_analyzer()->Conn(),
 		                                   ${rec.header.is_orig},
 		                                   build_hdr(${rec.header}),
@@ -351,7 +349,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_unknown_scoped_pdu )
 			return false;
 
-		BifEvent::enqueue_snmp_unknown_scoped_pdu(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_unknown_scoped_pdu(bro_analyzer(),
 		                                          bro_analyzer()->Conn(),
 		                                          ${rec.header.is_orig},
 		                                          build_hdr(${rec.header}),
@@ -364,7 +362,7 @@ refine connection SNMP_Conn += {
 		if ( ! snmp_encrypted_pdu )
 			return false;
 
-		BifEvent::enqueue_snmp_encrypted_pdu(bro_analyzer(),
+		zeek::BifEvent::enqueue_snmp_encrypted_pdu(bro_analyzer(),
 		                                     bro_analyzer()->Conn(),
 		                                     ${rec.header.is_orig},
 		                                     build_hdr(${rec.header}));
diff --git a/src/analyzer/protocol/socks/socks-analyzer.pac b/src/analyzer/protocol/socks/socks-analyzer.pac
index 95b1812eb6..fe45150215 100644
--- a/src/analyzer/protocol/socks/socks-analyzer.pac
+++ b/src/analyzer/protocol/socks/socks-analyzer.pac
@@ -24,13 +24,14 @@ refine connection SOCKS_Conn += {
 		%{
 		if ( socks_request )
 			{
+			static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
 			auto sa = make_intrusive<RecordVal>(socks_address);
 			sa->Assign(0, make_intrusive<AddrVal>(htonl(${request.addr})));
 
 			if ( ${request.v4a} )
 				sa->Assign(1, array_to_string(${request.name}));
 
-			BifEvent::enqueue_socks_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_socks_request(bro_analyzer(),
 			                                bro_analyzer()->Conn(),
 			                                4,
 			                                ${request.command},
@@ -48,10 +49,11 @@ refine connection SOCKS_Conn += {
 		%{
 		if ( socks_reply )
 			{
+			static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
 			auto sa = make_intrusive<RecordVal>(socks_address);
 			sa->Assign(0, make_intrusive<AddrVal>(htonl(${reply.addr})));
 
-			BifEvent::enqueue_socks_reply(bro_analyzer(),
+			zeek::BifEvent::enqueue_socks_reply(bro_analyzer(),
 			                              bro_analyzer()->Conn(),
 			                              4,
 			                              ${reply.status},
@@ -80,6 +82,7 @@ refine connection SOCKS_Conn += {
 			return false;
 			}
 
+		static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
 		auto sa = make_intrusive<RecordVal>(socks_address);
 
 		// This is dumb and there must be a better way (checking for presence of a field)...
@@ -104,7 +107,7 @@ refine connection SOCKS_Conn += {
 			}
 
 		if ( socks_request )
-			BifEvent::enqueue_socks_request(bro_analyzer(),
+			zeek::BifEvent::enqueue_socks_request(bro_analyzer(),
 			                                bro_analyzer()->Conn(),
 			                                5,
 			                                ${request.command},
@@ -119,6 +122,7 @@ refine connection SOCKS_Conn += {
 
 	function socks5_reply(reply: SOCKS5_Reply): bool
 		%{
+		static auto socks_address = zeek::id::find_type<RecordType>("SOCKS::Address");
 		auto sa = make_intrusive<RecordVal>(socks_address);
 
 		// This is dumb and there must be a better way (checking for presence of a field)...
@@ -143,7 +147,7 @@ refine connection SOCKS_Conn += {
 			}
 
 		if ( socks_reply )
-			BifEvent::enqueue_socks_reply(bro_analyzer(),
+			zeek::BifEvent::enqueue_socks_reply(bro_analyzer(),
 			                              bro_analyzer()->Conn(),
 			                              5,
 			                              ${reply.reply},
@@ -163,7 +167,7 @@ refine connection SOCKS_Conn += {
 		auto user = make_intrusive<StringVal>(${request.username}.length(), (const char*) ${request.username}.begin());
 		auto pass = make_intrusive<StringVal>(${request.password}.length(), (const char*) ${request.password}.begin());
 
-		BifEvent::enqueue_socks_login_userpass_request(bro_analyzer(),
+		zeek::BifEvent::enqueue_socks_login_userpass_request(bro_analyzer(),
 		                                               bro_analyzer()->Conn(),
 		                                               std::move(user), std::move(pass));
 		return true;
@@ -184,7 +188,7 @@ refine connection SOCKS_Conn += {
 	function socks5_auth_reply_userpass(reply: SOCKS5_Auth_Reply_UserPass_v1): bool
 		%{
 		if ( socks_login_userpass_reply )
-			BifEvent::enqueue_socks_login_userpass_reply(bro_analyzer(),
+			zeek::BifEvent::enqueue_socks_login_userpass_reply(bro_analyzer(),
 			                                             bro_analyzer()->Conn(),
 			                                             ${reply.code});
 		return true;
diff --git a/src/analyzer/protocol/ssh/SSH.cc b/src/analyzer/protocol/ssh/SSH.cc
index f39d125bff..c43a4ce1fc 100644
--- a/src/analyzer/protocol/ssh/SSH.cc
+++ b/src/analyzer/protocol/ssh/SSH.cc
@@ -91,7 +91,7 @@ void SSH_Analyzer::Undelivered(uint64_t seq, int len, bool orig)
 void SSH_Analyzer::ProcessEncryptedSegment(int len, bool orig)
 	{
 	if ( ssh_encrypted_packet )
-		BifEvent::enqueue_ssh_encrypted_packet(interp->bro_analyzer(),
+		zeek::BifEvent::enqueue_ssh_encrypted_packet(interp->bro_analyzer(),
 		                                       interp->bro_analyzer()->Conn(),
 		                                       orig, len);
 
@@ -132,9 +132,9 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
 			{
 			auth_decision_made = true;
 			if ( ssh_auth_attempted )
-				BifEvent::enqueue_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
+				zeek::BifEvent::enqueue_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
 			if ( ssh_auth_successful )
-				BifEvent::enqueue_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
+				zeek::BifEvent::enqueue_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
 			return;
 			}
 
@@ -159,7 +159,7 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
 		if ( len == userauth_failure_size )
 			{
 			if ( ssh_auth_attempted )
-				BifEvent::enqueue_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false);
+				zeek::BifEvent::enqueue_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false);
 			return;
 			}
 
@@ -168,9 +168,9 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
 			{
 			auth_decision_made = true;
 			if ( ssh_auth_attempted )
-				BifEvent::enqueue_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
+				zeek::BifEvent::enqueue_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
 			if ( ssh_auth_successful )
-				BifEvent::enqueue_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false);
+				zeek::BifEvent::enqueue_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false);
 			return;
 			}
 		}
diff --git a/src/analyzer/protocol/ssh/ssh-analyzer.pac b/src/analyzer/protocol/ssh/ssh-analyzer.pac
index 52b731ccaa..e3064e08a0 100644
--- a/src/analyzer/protocol/ssh/ssh-analyzer.pac
+++ b/src/analyzer/protocol/ssh/ssh-analyzer.pac
@@ -5,14 +5,14 @@
 %}
 
 %header{
-VectorVal* name_list_to_vector(const bytestring& nl);
+IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl);
 %}
 
 %code{
 // Copied from IRC_Analyzer::SplitWords
-VectorVal* name_list_to_vector(const bytestring& nl)
+IntrusivePtr<VectorVal> name_list_to_vector(const bytestring& nl)
 	{
-	VectorVal* vv = new VectorVal(internal_type("string_vec")->AsVectorType());
+	auto vv = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	string name_list = std_str(nl);
 	if ( name_list.size() < 1 )
@@ -52,13 +52,13 @@ refine flow SSH_Flow += {
 		%{
 		if ( ssh_client_version && ${msg.is_orig } )
 			{
-			BifEvent::enqueue_ssh_client_version(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_ssh_client_version(connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				to_stringval(${msg.version}));
 			}
 		else if ( ssh_server_version )
 			{
-			BifEvent::enqueue_ssh_server_version(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_ssh_server_version(connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				to_stringval(${msg.version}));
 			}
@@ -70,40 +70,40 @@ refine flow SSH_Flow += {
 		if ( ! ssh_capabilities )
 			return false;
 
-		auto result = make_intrusive<RecordVal>(BifType::Record::SSH::Capabilities);
+		auto result = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Capabilities);
 		result->Assign(0, name_list_to_vector(${msg.kex_algorithms.val}));
 		result->Assign(1, name_list_to_vector(${msg.server_host_key_algorithms.val}));
 
-		RecordVal* encryption_algs = new RecordVal(BifType::Record::SSH::Algorithm_Prefs);
+		auto encryption_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 		encryption_algs->Assign(0, name_list_to_vector(${msg.encryption_algorithms_client_to_server.val}));
 		encryption_algs->Assign(1, name_list_to_vector(${msg.encryption_algorithms_server_to_client.val}));
-		result->Assign(2, encryption_algs);
+		result->Assign(2, std::move(encryption_algs));
 
-		RecordVal* mac_algs = new RecordVal(BifType::Record::SSH::Algorithm_Prefs);
+		auto mac_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 		mac_algs->Assign(0, name_list_to_vector(${msg.mac_algorithms_client_to_server.val}));
 		mac_algs->Assign(1, name_list_to_vector(${msg.mac_algorithms_server_to_client.val}));
-		result->Assign(3, mac_algs);
+		result->Assign(3, std::move(mac_algs));
 
-		RecordVal* compression_algs = new RecordVal(BifType::Record::SSH::Algorithm_Prefs);
+		auto compression_algs = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 		compression_algs->Assign(0, name_list_to_vector(${msg.compression_algorithms_client_to_server.val}));
 		compression_algs->Assign(1, name_list_to_vector(${msg.compression_algorithms_server_to_client.val}));
-		result->Assign(4, compression_algs);
+		result->Assign(4, std::move(compression_algs));
 
 		if ( ${msg.languages_client_to_server.len} || ${msg.languages_server_to_client.len} )
 			{
-			RecordVal* languages = new RecordVal(BifType::Record::SSH::Algorithm_Prefs);
+			auto languages = make_intrusive<RecordVal>(zeek::BifType::Record::SSH::Algorithm_Prefs);
 			if ( ${msg.languages_client_to_server.len} )
 				languages->Assign(0, name_list_to_vector(${msg.languages_client_to_server.val}));
 			if ( ${msg.languages_server_to_client.len} )
 				languages->Assign(1, name_list_to_vector(${msg.languages_server_to_client.val}));
 
-			result->Assign(5, languages);
+			result->Assign(5, std::move(languages));
 			}
 
 
 		result->Assign(6, val_mgr->Bool(!${msg.is_orig}));
 
-		BifEvent::enqueue_ssh_capabilities(connection()->bro_analyzer(),
+		zeek::BifEvent::enqueue_ssh_capabilities(connection()->bro_analyzer(),
 			connection()->bro_analyzer()->Conn(), to_stringval(${msg.cookie}),
 			result);
 
@@ -115,7 +115,7 @@ refine flow SSH_Flow += {
 		%{
 		if ( ssh2_dh_server_params )
 			{
-			BifEvent::enqueue_ssh2_dh_server_params(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_ssh2_dh_server_params(connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				to_stringval(${msg.p.val}), to_stringval(${msg.g.val}));
 			}
@@ -126,7 +126,7 @@ refine flow SSH_Flow += {
 		%{
 		if ( ssh2_ecc_key )
 			{
-			BifEvent::enqueue_ssh2_ecc_key(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_ssh2_ecc_key(connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				is_orig, to_stringval(q));
 			}
@@ -137,7 +137,7 @@ refine flow SSH_Flow += {
 		%{
 		if ( ssh2_gss_error )
 			{
-			BifEvent::enqueue_ssh2_gss_error(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_ssh2_gss_error(connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				${msg.major_status}, ${msg.minor_status},
 				to_stringval(${msg.message.val}));
@@ -149,7 +149,7 @@ refine flow SSH_Flow += {
 		%{
 		if ( ssh2_server_host_key )
 			{
-			BifEvent::enqueue_ssh2_server_host_key(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_ssh2_server_host_key(connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				to_stringval(${key}));
 			}
@@ -160,7 +160,7 @@ refine flow SSH_Flow += {
 		%{
 		if ( ssh1_server_host_key )
 			{
-			BifEvent::enqueue_ssh1_server_host_key(connection()->bro_analyzer(),
+			zeek::BifEvent::enqueue_ssh1_server_host_key(connection()->bro_analyzer(),
 				connection()->bro_analyzer()->Conn(),
 				to_stringval(${p}),
 				to_stringval(${e}));
diff --git a/src/analyzer/protocol/ssh/ssh-protocol.pac b/src/analyzer/protocol/ssh/ssh-protocol.pac
index 1b42a841b7..9b364601b8 100644
--- a/src/analyzer/protocol/ssh/ssh-protocol.pac
+++ b/src/analyzer/protocol/ssh/ssh-protocol.pac
@@ -393,21 +393,18 @@ refine connection SSH_Conn += {
 		else if ( kex_orig_ == orig )
 			return false;
 
-		VectorVal* client_list = name_list_to_vector(orig ? algs             : kex_algs_cache_);
-		VectorVal* server_list = name_list_to_vector(orig ? kex_algs_cache_  : algs);
+		auto client_list = name_list_to_vector(orig ? algs             : kex_algs_cache_);
+		auto server_list = name_list_to_vector(orig ? kex_algs_cache_  : algs);
 
 		for ( unsigned int i = 0; i < client_list->Size(); ++i )
 			{
 			for ( unsigned int j = 0; j < server_list->Size(); ++j )
 				{
-				if ( *(client_list->Lookup(i)->AsStringVal()->AsString()) == *(server_list->Lookup(j)->AsStringVal()->AsString()) )
+				if ( *(client_list->At(i)->AsStringVal()->AsString()) == *(server_list->At(j)->AsStringVal()->AsString()) )
 					{
 					kex_algorithm_.free();
-					kex_algorithm_.init((const uint8 *) client_list->Lookup(i)->AsStringVal()->Bytes(),
-						client_list->Lookup(i)->AsStringVal()->Len());
-
-					Unref(client_list);
-					Unref(server_list);
+					kex_algorithm_.init((const uint8 *) client_list->At(i)->AsStringVal()->Bytes(),
+						client_list->At(i)->AsStringVal()->Len());
 
 					// UNTESTED
 					if ( update_kex_state_if_equal("rsa1024-sha1", KEX_RSA) )
@@ -452,9 +449,6 @@ refine connection SSH_Conn += {
 				}
 			}
 
-		Unref(client_list);
-		Unref(server_list);
-
 		return true;
 		%}
 
diff --git a/src/analyzer/protocol/ssl/dtls-protocol.pac b/src/analyzer/protocol/ssl/dtls-protocol.pac
index 70897a585c..c54a62f251 100644
--- a/src/analyzer/protocol/ssl/dtls-protocol.pac
+++ b/src/analyzer/protocol/ssl/dtls-protocol.pac
@@ -73,11 +73,11 @@ refine connection SSL_Conn += {
 			if ( bro_analyzer()->ProtocolConfirmed() )
 				{
 				reported_errors_++;
-				if ( reported_errors_ <= BifConst::SSL::dtls_max_reported_version_errors )
+				if ( reported_errors_ <= zeek::BifConst::SSL::dtls_max_reported_version_errors )
 					bro_analyzer()->ProtocolViolation(fmt("Invalid version in DTLS connection. Packet reported version: %d", version));
 				}
 
-			if ( invalid_version_count_ > BifConst::SSL::dtls_max_version_errors )
+			if ( invalid_version_count_ > zeek::BifConst::SSL::dtls_max_version_errors )
 				bro_analyzer()->SetSkip(true);
 			return false;
 		}
diff --git a/src/analyzer/protocol/ssl/proc-client-hello.pac b/src/analyzer/protocol/ssl/proc-client-hello.pac
index 1eae147996..c98b0772c6 100644
--- a/src/analyzer/protocol/ssl/proc-client-hello.pac
+++ b/src/analyzer/protocol/ssl/proc-client-hello.pac
@@ -23,7 +23,7 @@
 			else
 				std::transform(cipher_suites24->begin(), cipher_suites24->end(), std::back_inserter(cipher_suites), to_int());
 
-			auto cipher_vec = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+			auto cipher_vec = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			for ( unsigned int i = 0; i < cipher_suites.size(); ++i )
 				{
@@ -31,7 +31,7 @@
 				cipher_vec->Assign(i, ciph);
 				}
 
-			auto comp_vec = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+			auto comp_vec = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 			if ( compression_methods )
 				{
@@ -42,7 +42,7 @@
 					}
 				}
 
-			BifEvent::enqueue_ssl_client_hello(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_ssl_client_hello(bro_analyzer(), bro_analyzer()->Conn(),
 							version, record_version(), ts,
 							make_intrusive<StringVal>(client_random.length(),
 							                          (const char*) client_random.data()),
diff --git a/src/analyzer/protocol/ssl/proc-server-hello.pac b/src/analyzer/protocol/ssl/proc-server-hello.pac
index 843a83e15d..130ff1f9ca 100644
--- a/src/analyzer/protocol/ssl/proc-server-hello.pac
+++ b/src/analyzer/protocol/ssl/proc-server-hello.pac
@@ -25,7 +25,7 @@
 			if ( v2 == 0 && server_random.length() >= 4 )
 				ts = ntohl(*((uint32*)server_random.data()));
 
-			BifEvent::enqueue_ssl_server_hello(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_server_hello(bro_analyzer(),
 							bro_analyzer()->Conn(),
 							version, record_version(), ts,
 							make_intrusive<StringVal>(server_random.length(),
diff --git a/src/analyzer/protocol/ssl/ssl-analyzer.pac b/src/analyzer/protocol/ssl/ssl-analyzer.pac
index 7d7a5a4419..3e2a4a2d6a 100644
--- a/src/analyzer/protocol/ssl/ssl-analyzer.pac
+++ b/src/analyzer/protocol/ssl/ssl-analyzer.pac
@@ -18,7 +18,7 @@ refine connection SSL_Conn += {
 	function proc_v2_client_master_key(rec: SSLRecord, cipher_kind: int) : bool
 		%{
 		if ( ssl_established )
-			BifEvent::enqueue_ssl_established(bro_analyzer(), bro_analyzer()->Conn());
+			zeek::BifEvent::enqueue_ssl_established(bro_analyzer(), bro_analyzer()->Conn());
 
 		return true;
 		%}
diff --git a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
index 256ed2d295..47d664ef99 100644
--- a/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
+++ b/src/analyzer/protocol/ssl/ssl-dtls-analyzer.pac
@@ -32,7 +32,7 @@ refine connection SSL_Conn += {
 	function proc_alert(rec: SSLRecord, level : int, desc : int) : bool
 		%{
 		if ( ssl_alert )
-			BifEvent::enqueue_ssl_alert(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_ssl_alert(bro_analyzer(), bro_analyzer()->Conn(),
 							${rec.is_orig}, level, desc);
 		return true;
 		%}
@@ -52,11 +52,11 @@ refine connection SSL_Conn += {
 			{
 			established_ = true;
 			if ( ssl_established )
-				BifEvent::enqueue_ssl_established(bro_analyzer(), bro_analyzer()->Conn());
+				zeek::BifEvent::enqueue_ssl_established(bro_analyzer(), bro_analyzer()->Conn());
 			}
 
 		if ( ssl_encrypted_data )
-			BifEvent::enqueue_ssl_encrypted_data(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_encrypted_data(bro_analyzer(),
 				bro_analyzer()->Conn(), ${rec.is_orig}, ${rec.raw_tls_version}, ${rec.content_type}, ${rec.length});
 
 		return true;
@@ -65,7 +65,7 @@ refine connection SSL_Conn += {
 	function proc_plaintext_record(rec : SSLRecord) : bool
 		%{
 		if ( ssl_plaintext_data )
-			BifEvent::enqueue_ssl_plaintext_data(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_plaintext_data(bro_analyzer(),
 				bro_analyzer()->Conn(), ${rec.is_orig}, ${rec.raw_tls_version}, ${rec.content_type}, ${rec.length});
 
 		return true;
@@ -74,7 +74,7 @@ refine connection SSL_Conn += {
 	function proc_heartbeat(rec : SSLRecord, type: uint8, payload_length: uint16, data: bytestring) : bool
 		%{
 		if ( ssl_heartbeat )
-			BifEvent::enqueue_ssl_heartbeat(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_heartbeat(bro_analyzer(),
 				bro_analyzer()->Conn(), ${rec.is_orig}, ${rec.length}, type, payload_length,
 				make_intrusive<StringVal>(data.length(), (const char*) data.data()));
 		return true;
@@ -96,7 +96,7 @@ refine connection SSL_Conn += {
 	function proc_ccs(rec: SSLRecord) : bool
 		%{
 		if ( ssl_change_cipher_spec )
-			BifEvent::enqueue_ssl_change_cipher_spec(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_change_cipher_spec(bro_analyzer(),
 				bro_analyzer()->Conn(), ${rec.is_orig});
 
 		return true;
diff --git a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
index 46333fcd13..7db8d7584f 100644
--- a/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
+++ b/src/analyzer/protocol/ssl/tls-handshake-analyzer.pac
@@ -34,7 +34,7 @@ refine connection Handshake_Conn += {
 		%{
 		if ( ssl_session_ticket_handshake )
 			{
-			BifEvent::enqueue_ssl_session_ticket_handshake(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_session_ticket_handshake(bro_analyzer(),
 							bro_analyzer()->Conn(),
 							${rec.ticket_lifetime_hint},
 							make_intrusive<StringVal>(${rec.data}.length(), (const char*) ${rec.data}.data()));
@@ -64,7 +64,7 @@ refine connection Handshake_Conn += {
 		const unsigned char* data = sourcedata.begin() + 4;
 
 		if ( ssl_extension )
-			BifEvent::enqueue_ssl_extension(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_extension(bro_analyzer(),
 						bro_analyzer()->Conn(), ${rec.is_orig}, type,
 						make_intrusive<StringVal>(length, reinterpret_cast<const char*>(data)));
 		return true;
@@ -75,7 +75,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_ec_point_formats )
 			return true;
 
-		auto points = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto points = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( point_format_list )
 			{
@@ -83,7 +83,7 @@ refine connection Handshake_Conn += {
 				points->Assign(i, val_mgr->Count((*point_format_list)[i]));
 			}
 
-		BifEvent::enqueue_ssl_extension_ec_point_formats(bro_analyzer(), bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_ssl_extension_ec_point_formats(bro_analyzer(), bro_analyzer()->Conn(),
 		   ${rec.is_orig}, std::move(points));
 
 		return true;
@@ -94,7 +94,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_elliptic_curves )
 			return true;
 
-		auto curves = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto curves = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( list )
 			{
@@ -102,7 +102,7 @@ refine connection Handshake_Conn += {
 				curves->Assign(i, val_mgr->Count((*list)[i]));
 			}
 
-		BifEvent::enqueue_ssl_extension_elliptic_curves(bro_analyzer(), bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_ssl_extension_elliptic_curves(bro_analyzer(), bro_analyzer()->Conn(),
 		   ${rec.is_orig}, std::move(curves));
 
 		return true;
@@ -113,7 +113,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_key_share )
 			return true;
 
-		auto nglist = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto nglist = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( keyshare )
 			{
@@ -121,7 +121,7 @@ refine connection Handshake_Conn += {
 				nglist->Assign(i, val_mgr->Count((*keyshare)[i]->namedgroup()));
 			}
 
-		BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
+		zeek::BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
 
 		return true;
 		%}
@@ -131,10 +131,10 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_key_share )
 			return true;
 
-		auto nglist = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto nglist = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		nglist->Assign(0u, val_mgr->Count(keyshare->namedgroup()));
-		BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
+		zeek::BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
 		return true;
 		%}
 
@@ -143,10 +143,10 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_key_share )
 			return true;
 
-		auto nglist = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto nglist = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		nglist->Assign(0u, val_mgr->Count(namedgroup));
-		BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
+		zeek::BifEvent::enqueue_ssl_extension_key_share(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(nglist));
 		return true;
 		%}
 
@@ -155,20 +155,20 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_signature_algorithm )
 			return true;
 
-		auto slist = make_intrusive<VectorVal>(internal_type("signature_and_hashalgorithm_vec")->AsVectorType());
+		auto slist = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("signature_and_hashalgorithm_vec"));
 
 		if ( supported_signature_algorithms )
 			{
 			for ( unsigned int i = 0; i < supported_signature_algorithms->size(); ++i )
 				{
-				RecordVal* el = new RecordVal(BifType::Record::SSL::SignatureAndHashAlgorithm);
+				auto el = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 				el->Assign(0, val_mgr->Count((*supported_signature_algorithms)[i]->HashAlgorithm()));
 				el->Assign(1, val_mgr->Count((*supported_signature_algorithms)[i]->SignatureAlgorithm()));
-				slist->Assign(i, el);
+				slist->Assign(i, std::move(el));
 				}
 			}
 
-		BifEvent::enqueue_ssl_extension_signature_algorithm(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(slist));
+		zeek::BifEvent::enqueue_ssl_extension_signature_algorithm(bro_analyzer(), bro_analyzer()->Conn(), ${rec.is_orig}, std::move(slist));
 
 		return true;
 		%}
@@ -178,7 +178,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_application_layer_protocol_negotiation )
 			return true;
 
-		auto plist = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+		auto plist = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		if ( protocols )
 			{
@@ -186,7 +186,7 @@ refine connection Handshake_Conn += {
 				plist->Assign(i, make_intrusive<StringVal>((*protocols)[i]->name().length(), (const char*) (*protocols)[i]->name().data()));
 			}
 
-		BifEvent::enqueue_ssl_extension_application_layer_protocol_negotiation(bro_analyzer(), bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_ssl_extension_application_layer_protocol_negotiation(bro_analyzer(), bro_analyzer()->Conn(),
 											${rec.is_orig}, std::move(plist));
 
 		return true;
@@ -194,7 +194,7 @@ refine connection Handshake_Conn += {
 
 	function proc_server_name(rec: HandshakeRecord, list: ServerName[]) : bool
 		%{
-		auto servers = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+		auto servers = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		if ( list )
 			{
@@ -215,7 +215,7 @@ refine connection Handshake_Conn += {
 			}
 
 		if ( ssl_extension_server_name )
-			BifEvent::enqueue_ssl_extension_server_name(bro_analyzer(), bro_analyzer()->Conn(),
+			zeek::BifEvent::enqueue_ssl_extension_server_name(bro_analyzer(), bro_analyzer()->Conn(),
 		   	   ${rec.is_orig}, std::move(servers));
 
 		return true;
@@ -226,7 +226,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_supported_versions )
 			return true;
 
-		auto versions = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto versions = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( versions_list )
 			{
@@ -234,7 +234,7 @@ refine connection Handshake_Conn += {
 				versions->Assign(i, val_mgr->Count((*versions_list)[i]));
 			}
 
-		BifEvent::enqueue_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(),
 			${rec.is_orig}, std::move(versions));
 
 		return true;
@@ -245,10 +245,10 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_supported_versions )
 			return true;
 
-		auto versions = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto versions = make_intrusive<VectorVal>(zeek::id::index_vec);
 		versions->Assign(0u, val_mgr->Count(version));
 
-		BifEvent::enqueue_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_ssl_extension_supported_versions(bro_analyzer(), bro_analyzer()->Conn(),
 			${rec.is_orig}, std::move(versions));
 
 		return true;
@@ -259,7 +259,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_psk_key_exchange_modes )
 			return true;
 
-		auto modes = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+		auto modes = make_intrusive<VectorVal>(zeek::id::index_vec);
 
 		if ( mode_list )
 			{
@@ -267,7 +267,7 @@ refine connection Handshake_Conn += {
 				modes->Assign(i, val_mgr->Count((*mode_list)[i]));
 			}
 
-		BifEvent::enqueue_ssl_extension_psk_key_exchange_modes(bro_analyzer(), bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_ssl_extension_psk_key_exchange_modes(bro_analyzer(), bro_analyzer()->Conn(),
 			${rec.is_orig}, std::move(modes));
 
 		return true;
@@ -314,7 +314,7 @@ refine connection Handshake_Conn += {
 			                 bro_analyzer()->Conn(), false, file_id, "application/ocsp-response");
 
 			if ( ssl_stapled_ocsp )
-				BifEvent::enqueue_ssl_stapled_ocsp(bro_analyzer(),
+				zeek::BifEvent::enqueue_ssl_stapled_ocsp(bro_analyzer(),
 				        bro_analyzer()->Conn(),
 				        ${rec.is_orig},
 				        make_intrusive<StringVal>(response.length(), (const char*) response.data()));
@@ -335,14 +335,14 @@ refine connection Handshake_Conn += {
 			return true;
 
 		if ( ssl_ecdh_server_params )
-			BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
 			                                         ${kex.params.curve},
 			                                         make_intrusive<StringVal>(${kex.params.point}.length(), (const char*)${kex.params.point}.data()));
 
 		if ( ssl_server_signature )
 			{
-			auto ha = make_intrusive<RecordVal>(BifType::Record::SSL::SignatureAndHashAlgorithm);
+			auto ha = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 
 			if ( ${kex.signed_params.uses_signature_and_hashalgorithm} )
 				{
@@ -356,7 +356,7 @@ refine connection Handshake_Conn += {
 				ha->Assign(1, val_mgr->Count(256));
 				}
 
-			BifEvent::enqueue_ssl_server_signature(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_server_signature(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
 			                                       std::move(ha),
 			                                       make_intrusive<StringVal>(${kex.signed_params.signature}.length(), (const char*)(${kex.signed_params.signature}).data()));
@@ -371,7 +371,7 @@ refine connection Handshake_Conn += {
 			return true;
 
 		if ( ssl_ecdh_server_params )
-			BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_ecdh_server_params(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
 			                                         ${kex.params.curve},
 			                                         make_intrusive<StringVal>(${kex.params.point}.length(), (const char*)${kex.params.point}.data()));
@@ -382,7 +382,7 @@ refine connection Handshake_Conn += {
 	function proc_rsa_client_key_exchange(rec: HandshakeRecord, rsa_pms: bytestring) : bool
 		%{
 		if ( ssl_rsa_client_pms )
-			BifEvent::enqueue_ssl_rsa_client_pms(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_rsa_client_pms(bro_analyzer(),
 			                                     bro_analyzer()->Conn(),
 			                                     make_intrusive<StringVal>(rsa_pms.length(), (const char*)rsa_pms.data()));
 
@@ -392,7 +392,7 @@ refine connection Handshake_Conn += {
 	function proc_dh_client_key_exchange(rec: HandshakeRecord, Yc: bytestring) : bool
 		%{
 		if ( ssl_dh_client_params )
-			BifEvent::enqueue_ssl_dh_client_params(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_dh_client_params(bro_analyzer(),
 			                                       bro_analyzer()->Conn(),
 			                                       make_intrusive<StringVal>(Yc.length(), (const char*)Yc.data()));
 
@@ -402,7 +402,7 @@ refine connection Handshake_Conn += {
 	function proc_ecdh_client_key_exchange(rec: HandshakeRecord, point: bytestring) : bool
 		%{
 		if ( ssl_ecdh_client_params )
-			BifEvent::enqueue_ssl_ecdh_client_params(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_ecdh_client_params(bro_analyzer(),
 			                                         bro_analyzer()->Conn(),
 			                                         make_intrusive<StringVal>(point.length(), (const char*)point.data()));
 
@@ -414,11 +414,11 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_signed_certificate_timestamp )
 			return true;
 
-		auto ha = make_intrusive<RecordVal>(BifType::Record::SSL::SignatureAndHashAlgorithm);
+		auto ha = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 		ha->Assign(0, val_mgr->Count(digitally_signed_algorithms->HashAlgorithm()));
 		ha->Assign(1, val_mgr->Count(digitally_signed_algorithms->SignatureAlgorithm()));
 
-		BifEvent::enqueue_ssl_extension_signed_certificate_timestamp(bro_analyzer(),
+		zeek::BifEvent::enqueue_ssl_extension_signed_certificate_timestamp(bro_analyzer(),
 			bro_analyzer()->Conn(), ${rec.is_orig},
 			version,
 			make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())),
@@ -433,7 +433,7 @@ refine connection Handshake_Conn += {
 	function proc_dhe_server_key_exchange(rec: HandshakeRecord, p: bytestring, g: bytestring, Ys: bytestring, signed_params: ServerKeyExchangeSignature) : bool
 		%{
 		if ( ssl_ecdh_server_params )
-			BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(),
 			  bro_analyzer()->Conn(),
 			  make_intrusive<StringVal>(p.length(), (const char*) p.data()),
 			  make_intrusive<StringVal>(g.length(), (const char*) g.data()),
@@ -442,7 +442,7 @@ refine connection Handshake_Conn += {
 
 		if ( ssl_server_signature )
 			{
-			auto ha = make_intrusive<RecordVal>(BifType::Record::SSL::SignatureAndHashAlgorithm);
+			auto ha = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::SignatureAndHashAlgorithm);
 
 			if ( ${signed_params.uses_signature_and_hashalgorithm} )
 				{
@@ -456,7 +456,7 @@ refine connection Handshake_Conn += {
 				ha->Assign(1, val_mgr->Count(256));
 				}
 
-			BifEvent::enqueue_ssl_server_signature(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_server_signature(bro_analyzer(),
 			  bro_analyzer()->Conn(), std::move(ha),
 			  make_intrusive<StringVal>(${signed_params.signature}.length(), (const char*)(${signed_params.signature}).data())
 			  );
@@ -468,7 +468,7 @@ refine connection Handshake_Conn += {
 	function proc_dh_anon_server_key_exchange(rec: HandshakeRecord, p: bytestring, g: bytestring, Ys: bytestring) : bool
 		%{
 		if ( ssl_dh_server_params )
-			BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_dh_server_params(bro_analyzer(),
 			  bro_analyzer()->Conn(),
 			  make_intrusive<StringVal>(p.length(), (const char*) p.data()),
 			  make_intrusive<StringVal>(g.length(), (const char*) g.data()),
@@ -481,7 +481,7 @@ refine connection Handshake_Conn += {
 	function proc_handshake(is_orig: bool, msg_type: uint8, length: uint24) : bool
 		%{
 		if ( ssl_handshake_message )
-			BifEvent::enqueue_ssl_handshake_message(bro_analyzer(),
+			zeek::BifEvent::enqueue_ssl_handshake_message(bro_analyzer(),
 				bro_analyzer()->Conn(), is_orig, msg_type, to_int()(length));
 
 		return true;
@@ -492,20 +492,20 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_pre_shared_key_server_hello )
 			return true;
 
-		auto slist = make_intrusive<VectorVal>(internal_type("psk_identity_vec")->AsVectorType());
+		auto slist = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("psk_identity_vec"));
 
 		if ( identities && identities->identities() )
 			{
 			for ( auto&& identity : *(identities->identities()) )
 				{
-				RecordVal* el = new RecordVal(BifType::Record::SSL::PSKIdentity);
+				auto el = make_intrusive<RecordVal>(zeek::BifType::Record::SSL::PSKIdentity);
 				el->Assign(0, make_intrusive<StringVal>(identity->identity().length(), (const char*) identity->identity().data()));
 				el->Assign(1, val_mgr->Count(identity->obfuscated_ticket_age()));
-				slist->Assign(slist->Size(), el);
+				slist->Assign(slist->Size(), std::move(el));
 				}
 			}
 
-		auto blist = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+		auto blist = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 		if ( binders && binders->binders() )
 			{
@@ -513,7 +513,7 @@ refine connection Handshake_Conn += {
 				blist->Assign(blist->Size(), make_intrusive<StringVal>(binder->binder().length(), (const char*) binder->binder().data()));
 			}
 
-		BifEvent::enqueue_ssl_extension_pre_shared_key_client_hello(bro_analyzer(), bro_analyzer()->Conn(),
+		zeek::BifEvent::enqueue_ssl_extension_pre_shared_key_client_hello(bro_analyzer(), bro_analyzer()->Conn(),
 			${rec.is_orig}, std::move(slist), std::move(blist));
 
 		return true;
@@ -524,7 +524,7 @@ refine connection Handshake_Conn += {
 		if ( ! ssl_extension_pre_shared_key_client_hello )
 			return true;
 
-		BifEvent::enqueue_ssl_extension_pre_shared_key_server_hello(bro_analyzer(),
+		zeek::BifEvent::enqueue_ssl_extension_pre_shared_key_server_hello(bro_analyzer(),
 			bro_analyzer()->Conn(), ${rec.is_orig}, selected_identity);
 
 		return true;
diff --git a/src/analyzer/protocol/syslog/syslog-analyzer.pac b/src/analyzer/protocol/syslog/syslog-analyzer.pac
index 72acb78653..f464abf3b3 100644
--- a/src/analyzer/protocol/syslog/syslog-analyzer.pac
+++ b/src/analyzer/protocol/syslog/syslog-analyzer.pac
@@ -15,7 +15,7 @@ flow Syslog_Flow
 			return true;
 
 		if ( ${m.has_pri} )
-			BifEvent::enqueue_syslog_message(
+			zeek::BifEvent::enqueue_syslog_message(
 			    connection()->bro_analyzer(),
 			    connection()->bro_analyzer()->Conn(),
 			    ${m.PRI.facility},
@@ -23,7 +23,7 @@ flow Syslog_Flow
 			    make_intrusive<StringVal>(${m.msg}.length(), (const char*)${m.msg}.begin())
 			    );
 		else
-			BifEvent::enqueue_syslog_message(
+			zeek::BifEvent::enqueue_syslog_message(
 			    connection()->bro_analyzer(),
 			    connection()->bro_analyzer()->Conn(),
 			    999,
diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc
index d94f67e995..d61c246c8f 100644
--- a/src/analyzer/protocol/tcp/TCP.cc
+++ b/src/analyzer/protocol/tcp/TCP.cc
@@ -107,6 +107,7 @@ static RecordVal* build_syn_packet_val(bool is_orig, const IP_Hdr* ip,
 		options += opt_len;
 		}
 
+	static auto SYN_packet = zeek::id::find_type<RecordType>("SYN_packet");
 	RecordVal* v = new RecordVal(SYN_packet);
 
 	v->Assign(0, val_mgr->Bool(is_orig));
@@ -1097,7 +1098,7 @@ void TCP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 		{
 		syn_weirds(flags, endpoint, len);
 		RecordVal* SYN_vals = build_syn_packet_val(is_orig, ip, tp);
-		init_window(endpoint, peer, flags, SYN_vals->Lookup(5)->CoerceToInt(),
+		init_window(endpoint, peer, flags, SYN_vals->GetField(5)->CoerceToInt(),
 		            base_seq, ack_seq);
 
 		if ( connection_SYN_packet )
@@ -1286,8 +1287,8 @@ void TCP_Analyzer::FlipRoles()
 
 void TCP_Analyzer::UpdateConnVal(RecordVal *conn_val)
 	{
-	RecordVal *orig_endp_val = conn_val->Lookup("orig")->AsRecordVal();
-	RecordVal *resp_endp_val = conn_val->Lookup("resp")->AsRecordVal();
+	RecordVal* orig_endp_val = conn_val->GetField("orig")->AsRecordVal();
+	RecordVal* resp_endp_val = conn_val->GetField("resp")->AsRecordVal();
 
 	orig_endp_val->Assign(0, val_mgr->Count(orig->Size()));
 	orig_endp_val->Assign(1, val_mgr->Count(int(orig->state)));
@@ -1355,9 +1356,9 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
 
 	if ( tcp_options )
 		{
-		auto option_list = make_intrusive<VectorVal>(BifType::Vector::TCP::OptionList);
+		auto option_list = make_intrusive<VectorVal>(zeek::BifType::Vector::TCP::OptionList);
 
-		auto add_option_data = [](RecordVal* rv, const u_char* odata, int olen)
+		auto add_option_data = [](const IntrusivePtr<RecordVal>& rv, const u_char* odata, int olen)
 			{
 			if ( olen <= 2 )
 				return;
@@ -1371,7 +1372,7 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
 			{
 			auto kind = o[0];
 			auto length = kind < 2 ? 1 : o[1];
-			auto option_record = new RecordVal(BifType::Record::TCP::Option);
+			auto option_record = make_intrusive<RecordVal>(zeek::BifType::Record::TCP::Option);
 			option_list->Assign(option_list->Size(), option_record);
 			option_record->Assign(0, val_mgr->Count(kind));
 			option_record->Assign(1, val_mgr->Count(length));
@@ -1421,8 +1422,8 @@ int TCP_Analyzer::ParseTCPOptions(const struct tcphdr* tcp, bool is_orig)
 					{
 					auto p = reinterpret_cast<const uint32_t*>(o + 2);
 					auto num_pointers = (length - 2) / 4;
-					auto vt = internal_type("index_vec")->AsVectorType();
-					auto sack = new VectorVal(vt);
+					auto vt = zeek::id::index_vec;
+					auto sack = make_intrusive<VectorVal>(std::move(vt));
 
 					for ( auto i = 0; i < num_pointers; ++i )
 						sack->Assign(sack->Size(), val_mgr->Count(ntohl(p[i])));
@@ -1583,7 +1584,7 @@ void TCP_Analyzer::ConnDeleteTimer(double t)
 	Conn()->DeleteTimer(t);
 	}
 
-void TCP_Analyzer::SetContentsFile(unsigned int direction, BroFile* f)
+void TCP_Analyzer::SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f)
 	{
 	if ( direction == CONTENTS_NONE )
 		{
@@ -1600,7 +1601,7 @@ void TCP_Analyzer::SetContentsFile(unsigned int direction, BroFile* f)
 		}
 	}
 
-BroFile* TCP_Analyzer::GetContentsFile(unsigned int direction) const
+IntrusivePtr<BroFile> TCP_Analyzer::GetContentsFile(unsigned int direction) const
 	{
 	switch ( direction ) {
 	case CONTENTS_NONE:
@@ -2050,7 +2051,7 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl
 	int64_t sequence_delta = top_seq - max_top_seq;
 	if ( sequence_delta <= 0 )
 		{
-		if ( ! BifConst::ignore_keep_alive_rexmit || len > 1 || data_in_flight > 0 )
+		if ( ! zeek::BifConst::ignore_keep_alive_rexmit || len > 1 || data_in_flight > 0 )
 			{
 			++num_rxmit;
 			num_rxmit_bytes += len;
@@ -2077,6 +2078,7 @@ bool TCPStats_Endpoint::DataSent(double /* t */, uint64_t seq, int len, int capl
 
 RecordVal* TCPStats_Endpoint::BuildStats()
 	{
+	static auto endpoint_stats = zeek::id::find_type<RecordType>("endpoint_stats");
 	RecordVal* stats = new RecordVal(endpoint_stats);
 
 	stats->Assign(0, val_mgr->Count(num_pkts));
diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h
index f8b668b35a..2100eda181 100644
--- a/src/analyzer/protocol/tcp/TCP.h
+++ b/src/analyzer/protocol/tcp/TCP.h
@@ -60,8 +60,8 @@ public:
 	// the test is whether it has any outstanding, un-acked data.
 	bool DataPending(TCP_Endpoint* closing_endp);
 
-	void SetContentsFile(unsigned int direction, BroFile* f) override;
-	BroFile* GetContentsFile(unsigned int direction) const override;
+	void SetContentsFile(unsigned int direction, IntrusivePtr<BroFile> f) override;
+	IntrusivePtr<BroFile> GetContentsFile(unsigned int direction) const override;
 
 	// From Analyzer.h
 	void UpdateConnVal(RecordVal *conn_val) override;
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
index a798c28fb2..272bc0b563 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
@@ -29,7 +29,6 @@ TCP_Endpoint::TCP_Endpoint(TCP_Analyzer* arg_analyzer, bool arg_is_orig)
 	FIN_seq = 0;
 	SYN_cnt = FIN_cnt = RST_cnt = 0;
 	did_close = false;
-	contents_file = nullptr;
 	tcp_analyzer = arg_analyzer;
 	is_orig = arg_is_orig;
 
@@ -53,7 +52,6 @@ TCP_Endpoint::TCP_Endpoint(TCP_Analyzer* arg_analyzer, bool arg_is_orig)
 TCP_Endpoint::~TCP_Endpoint()
 	{
 	delete contents_processor;
-	Unref(contents_file);
 	}
 
 Connection* TCP_Endpoint::Conn() const
@@ -254,10 +252,9 @@ void TCP_Endpoint::AckReceived(uint64_t seq)
 		contents_processor->AckReceived(seq);
 	}
 
-void TCP_Endpoint::SetContentsFile(BroFile* f)
+void TCP_Endpoint::SetContentsFile(IntrusivePtr<BroFile> f)
 	{
-	Ref(f);
-	contents_file = f;
+	contents_file = std::move(f);
 	contents_start_seq = ToRelativeSeqSpace(last_seq, seq_wraps);
 
 	if ( contents_start_seq == 0 )
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.h b/src/analyzer/protocol/tcp/TCP_Endpoint.h
index e72016e4a2..9e90f0919d 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.h
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.h
@@ -3,8 +3,8 @@
 #pragma once
 
 #include "IPAddr.h"
+#include "File.h"
 
-class BroFile;
 class Connection;
 class IP_Hdr;
 
@@ -187,8 +187,8 @@ public:
 
 	void AckReceived(uint64_t seq);
 
-	void SetContentsFile(BroFile* f);
-	BroFile* GetContentsFile() const	{ return contents_file; }
+	void SetContentsFile(IntrusivePtr<BroFile> f);
+	const IntrusivePtr<BroFile>& GetContentsFile() const	{ return contents_file; }
 
 	// Codes used for tracking history.  For responders, we shift these
 	// over by 16 bits in order to fit both originator and responder
@@ -211,7 +211,7 @@ public:
 	TCP_Endpoint* peer;
 	TCP_Reassembler* contents_processor;
 	TCP_Analyzer* tcp_analyzer;
-	BroFile* contents_file;
+	IntrusivePtr<BroFile> contents_file;
 	uint32_t checksum_base;
 
 	double start_time, last_time;
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
index f93647adb2..2e9ef2c84d 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
@@ -30,7 +30,6 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer,
 	type = arg_type;
 	endp = arg_endp;
 	had_gap = false;
-	record_contents_file = nullptr;
 	deliver_tcp_contents = false;
 	skip_deliveries = false;
 	did_EOF = false;
@@ -42,12 +41,14 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer,
 
 	if ( ::tcp_contents )
 		{
+		static auto tcp_content_delivery_ports_orig = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_orig");
+		static auto tcp_content_delivery_ports_resp = zeek::id::find_val<TableVal>("tcp_content_delivery_ports_resp");
 		const auto& dst_port_val = val_mgr->Port(ntohs(tcp_analyzer->Conn()->RespPort()),
 		                                         TRANSPORT_TCP);
-		TableVal* ports = IsOrig() ?
+		const auto& ports = IsOrig() ?
 			tcp_content_delivery_ports_orig :
 			tcp_content_delivery_ports_resp;
-		auto result = ports->Lookup(dst_port_val.get());
+		auto result = ports->FindOrDefault(dst_port_val);
 
 		if ( (IsOrig() && tcp_content_deliver_all_orig) ||
 		     (! IsOrig() && tcp_content_deliver_all_resp) ||
@@ -56,11 +57,6 @@ TCP_Reassembler::TCP_Reassembler(analyzer::Analyzer* arg_dst_analyzer,
 		}
 	}
 
-TCP_Reassembler::~TCP_Reassembler()
-	{
-	Unref(record_contents_file);
-	}
-
 void TCP_Reassembler::Done()
 	{
 	MatchUndelivered(-1, true);
@@ -96,7 +92,7 @@ uint64_t TCP_Reassembler::NumUndeliveredBytes() const
 	return last_block.upper - last_reassem_seq;
 	}
 
-void TCP_Reassembler::SetContentsFile(BroFile* f)
+void TCP_Reassembler::SetContentsFile(IntrusivePtr<BroFile> f)
 	{
 	if ( ! f->IsOpen() )
 		{
@@ -105,16 +101,17 @@ void TCP_Reassembler::SetContentsFile(BroFile* f)
 		}
 
 	if ( record_contents_file )
+		{
 		// We were already recording, no need to catch up.
-		Unref(record_contents_file);
+		record_contents_file = nullptr;
+		}
 	else
 		{
 		if ( ! block_list.Empty() )
 			RecordToSeq(block_list.Begin()->second.seq, last_reassem_seq, f);
 		}
 
-	Ref(f);
-	record_contents_file = f;
+	record_contents_file = std::move(f);
 	}
 
 static inline bool is_clean(const TCP_Endpoint* a)
@@ -133,7 +130,7 @@ static inline bool established_or_cleanly_closing(const TCP_Endpoint* a,
 static inline bool report_gap(const TCP_Endpoint* a, const TCP_Endpoint* b)
 	{
 	return content_gap &&
-	       ( BifConst::report_gaps_for_partial ||
+	       ( zeek::BifConst::report_gaps_for_partial ||
 	         established_or_cleanly_closing(a, b) );
 	}
 
@@ -208,7 +205,7 @@ void TCP_Reassembler::Undelivered(uint64_t up_to_seq)
 		// to this method and only if this condition is not true).
 		reporter->InternalError("Calling Undelivered for data that has already been delivered (or has already been marked as undelivered");
 
-	if ( BifConst::detect_filtered_trace && last_reassem_seq == 1 &&
+	if ( zeek::BifConst::detect_filtered_trace && last_reassem_seq == 1 &&
 	     (endpoint->FIN_cnt > 0 || endpoint->RST_cnt > 0 ||
 	      peer->FIN_cnt > 0 || peer->RST_cnt > 0) )
 		{
@@ -320,7 +317,7 @@ void TCP_Reassembler::MatchUndelivered(uint64_t up_to_seq, bool use_last_upper)
 		}
 	}
 
-void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, BroFile* f)
+void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const IntrusivePtr<BroFile>& f)
 	{
 	auto it = block_list.Begin();
 
@@ -351,7 +348,7 @@ void TCP_Reassembler::RecordToSeq(uint64_t start_seq, uint64_t stop_seq, BroFile
 			RecordGap(last_seq, stop_seq, f);
 	}
 
-void TCP_Reassembler::RecordBlock(const DataBlock& b, BroFile* f)
+void TCP_Reassembler::RecordBlock(const DataBlock& b, const IntrusivePtr<BroFile>& f)
 	{
 	if ( f->Write((const char*) b.block, b.Size()) )
 		return;
@@ -366,7 +363,7 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, BroFile* f)
 		);
 	}
 
-void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile* f)
+void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, const IntrusivePtr<BroFile>& f)
 	{
 	if ( f->Write(fmt("\n<<gap %" PRIu64">>\n", upper_seq - start_seq)) )
 		return;
@@ -537,7 +534,7 @@ void TCP_Reassembler::AckReceived(uint64_t seq)
 		return;
 
 	bool test_active = ! skip_deliveries && ! tcp_analyzer->Skipping() &&
-		( BifConst::report_gaps_for_partial ||
+		( zeek::BifConst::report_gaps_for_partial ||
 			(endp->state == TCP_ENDPOINT_ESTABLISHED &&
 				endp->peer->state == TCP_ENDPOINT_ESTABLISHED ) );
 
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.h b/src/analyzer/protocol/tcp/TCP_Reassembler.h
index dffa55445a..1ff6b835d1 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.h
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.h
@@ -3,8 +3,8 @@
 #include "Reassem.h"
 #include "TCP_Endpoint.h"
 #include "TCP_Flags.h"
+#include "File.h"
 
-class BroFile;
 class Connection;
 
 namespace analyzer {
@@ -25,8 +25,6 @@ public:
 	TCP_Reassembler(Analyzer* arg_dst_analyzer, TCP_Analyzer* arg_tcp_analyzer,
 	                Type arg_type, TCP_Endpoint* arg_endp);
 
-	~TCP_Reassembler() override;
-
 	void Done();
 
 	void SetDstAnalyzer(Analyzer* analyzer)	{ dst_analyzer = analyzer; }
@@ -51,8 +49,8 @@ public:
 	// from waiting_on_hole above; and is computed in a different fashion).
 	uint64_t NumUndeliveredBytes() const;
 
-	void SetContentsFile(BroFile* f);
-	BroFile* GetContentsFile() const	{ return record_contents_file; }
+	void SetContentsFile(IntrusivePtr<BroFile> f);
+	const IntrusivePtr<BroFile>& GetContentsFile() const	{ return record_contents_file; }
 
 	void MatchUndelivered(uint64_t up_to_seq, bool use_last_upper);
 
@@ -91,9 +89,9 @@ private:
 	void Undelivered(uint64_t up_to_seq) override;
 	void Gap(uint64_t seq, uint64_t len);
 
-	void RecordToSeq(uint64_t start_seq, uint64_t stop_seq, BroFile* f);
-	void RecordBlock(const DataBlock& b, BroFile* f);
-	void RecordGap(uint64_t start_seq, uint64_t upper_seq, BroFile* f);
+	void RecordToSeq(uint64_t start_seq, uint64_t stop_seq, const IntrusivePtr<BroFile>& f);
+	void RecordBlock(const DataBlock& b, const IntrusivePtr<BroFile>& f);
+	void RecordGap(uint64_t start_seq, uint64_t upper_seq, const IntrusivePtr<BroFile>& f);
 
 	void BlockInserted(DataBlockMap::const_iterator it) override;
 	void Overlap(const u_char* b1, const u_char* b2, uint64_t n) override;
@@ -110,7 +108,7 @@ private:
 	bool in_delivery;
 	analyzer::tcp::TCP_Flags flags;
 
-	BroFile* record_contents_file;	// file on which to reassemble contents
+	IntrusivePtr<BroFile> record_contents_file;	// file on which to reassemble contents
 
 	Analyzer* dst_analyzer;
 	TCP_Analyzer* tcp_analyzer;
diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif
index a560301b8a..043dbbdafa 100644
--- a/src/analyzer/protocol/tcp/functions.bif
+++ b/src/analyzer/protocol/tcp/functions.bif
@@ -101,7 +101,7 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
 	if ( ! c )
 		return val_mgr->False();
 
-	c->GetRootAnalyzer()->SetContentsFile(direction, f);
+	c->GetRootAnalyzer()->SetContentsFile(direction, {NewRef{}, f});
 	return val_mgr->True();
 	%}
 
@@ -121,12 +121,13 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
 function get_contents_file%(cid: conn_id, direction: count%): file
 	%{
 	Connection* c = sessions->FindConnection(cid);
-	BroFile* f = c ? c->GetRootAnalyzer()->GetContentsFile(direction) : nullptr;
 
-	if ( f )
+	if ( c )
 		{
-		Ref(f);
-		return make_intrusive<Val>(f);
+		auto cf = c->GetRootAnalyzer()->GetContentsFile(direction);
+
+		if ( cf )
+			return make_intrusive<Val>(std::move(cf));
 		}
 
 	// Return some sort of error value.
@@ -135,5 +136,5 @@ function get_contents_file%(cid: conn_id, direction: count%): file
 	else
 		builtin_error("no contents file for given direction");
 
-	return make_intrusive<Val>(new BroFile(stderr, "-", "w"));
+	return make_intrusive<Val>(make_intrusive<BroFile>(stderr, "-", "w"));
 	%}
diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc
index 8fbb8eb4af..e37ef7d18f 100644
--- a/src/analyzer/protocol/teredo/Teredo.cc
+++ b/src/analyzer/protocol/teredo/Teredo.cc
@@ -98,22 +98,15 @@ bool TeredoEncapsulation::DoParse(const u_char* data, int& len,
 
 IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 	{
-	static RecordType* teredo_hdr_type = nullptr;
-	static RecordType* teredo_auth_type = nullptr;
-	static RecordType* teredo_origin_type = nullptr;
-
-	if ( ! teredo_hdr_type )
-		{
-		teredo_hdr_type = internal_type("teredo_hdr")->AsRecordType();
-		teredo_auth_type = internal_type("teredo_auth")->AsRecordType();
-		teredo_origin_type = internal_type("teredo_origin")->AsRecordType();
-		}
+	static auto teredo_hdr_type = zeek::id::find_type<RecordType>("teredo_hdr");
+	static auto teredo_auth_type = zeek::id::find_type<RecordType>("teredo_auth");
+	static auto teredo_origin_type = zeek::id::find_type<RecordType>("teredo_origin");
 
 	auto teredo_hdr = make_intrusive<RecordVal>(teredo_hdr_type);
 
 	if ( auth )
 		{
-		RecordVal* teredo_auth = new RecordVal(teredo_auth_type);
+		auto teredo_auth = make_intrusive<RecordVal>(teredo_auth_type);
 		uint8_t id_len = *((uint8_t*)(auth + 2));
 		uint8_t au_len = *((uint8_t*)(auth + 3));
 		uint64_t nonce = ntohll(*((uint64_t*)(auth + 4 + id_len + au_len)));
@@ -124,20 +117,20 @@ IntrusivePtr<RecordVal> TeredoEncapsulation::BuildVal(const IP_Hdr* inner) const
 		    new BroString(auth + 4 + id_len, au_len, true)));
 		teredo_auth->Assign(2, val_mgr->Count(nonce));
 		teredo_auth->Assign(3, val_mgr->Count(conf));
-		teredo_hdr->Assign(0, teredo_auth);
+		teredo_hdr->Assign(0, std::move(teredo_auth));
 		}
 
 	if ( origin_indication )
 		{
-		RecordVal* teredo_origin = new RecordVal(teredo_origin_type);
+		auto teredo_origin = make_intrusive<RecordVal>(teredo_origin_type);
 		uint16_t port = ntohs(*((uint16_t*)(origin_indication + 2))) ^ 0xFFFF;
 		uint32_t addr = ntohl(*((uint32_t*)(origin_indication + 4))) ^ 0xFFFFFFFF;
 		teredo_origin->Assign(0, val_mgr->Port(port, TRANSPORT_UDP));
 		teredo_origin->Assign(1, make_intrusive<AddrVal>(htonl(addr)));
-		teredo_hdr->Assign(1, teredo_origin);
+		teredo_hdr->Assign(1, std::move(teredo_origin));
 		}
 
-	teredo_hdr->Assign(2, inner->BuildPktHdrVal());
+	teredo_hdr->Assign(2, inner->ToPktHdrVal());
 	return teredo_hdr;
 	}
 
@@ -161,7 +154,7 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 
 	const EncapsulationStack* e = Conn()->GetEncapsulation();
 
-	if ( e && e->Depth() >= BifConst::Tunnel::max_depth )
+	if ( e && e->Depth() >= zeek::BifConst::Tunnel::max_depth )
 		{
 		Weird("tunnel_depth", true);
 		return;
diff --git a/src/analyzer/protocol/teredo/Teredo.h b/src/analyzer/protocol/teredo/Teredo.h
index 4abd9483e6..6b9975537c 100644
--- a/src/analyzer/protocol/teredo/Teredo.h
+++ b/src/analyzer/protocol/teredo/Teredo.h
@@ -42,7 +42,7 @@ public:
 	 */
 	void Confirm()
 		{
-		if ( ! BifConst::Tunnel::delay_teredo_confirmation ||
+		if ( ! zeek::BifConst::Tunnel::delay_teredo_confirmation ||
 		     ( valid_orig && valid_resp ) )
 			ProtocolConfirmation();
 		}
diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc
index f04f29ddfe..a320b9ee76 100644
--- a/src/analyzer/protocol/udp/UDP.cc
+++ b/src/analyzer/protocol/udp/UDP.cc
@@ -81,7 +81,7 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 			if ( chksum == 0 )
 				validate_checksum = false;
 			else
-				validate_checksum = BifConst::Tunnel::validate_vxlan_checksums;
+				validate_checksum = zeek::BifConst::Tunnel::validate_vxlan_checksums;
 			}
 		}
 
@@ -134,12 +134,15 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 
 	if ( udp_contents )
 		{
+		static auto udp_content_ports = zeek::id::find_val<TableVal>("udp_content_ports");
+		static auto udp_content_delivery_ports_orig = zeek::id::find_val<TableVal>("udp_content_delivery_ports_orig");
+		static auto udp_content_delivery_ports_resp = zeek::id::find_val<TableVal>("udp_content_delivery_ports_resp");
 		bool do_udp_contents = false;
 		const auto& sport_val = val_mgr->Port(ntohs(up->uh_sport), TRANSPORT_UDP);
 		const auto& dport_val = val_mgr->Port(ntohs(up->uh_dport), TRANSPORT_UDP);
 
-		if ( udp_content_ports->Lookup(dport_val.get()) ||
-		     udp_content_ports->Lookup(sport_val.get()) )
+		if ( udp_content_ports->FindOrDefault(dport_val) ||
+		     udp_content_ports->FindOrDefault(sport_val) )
 			do_udp_contents = true;
 		else
 			{
@@ -149,14 +152,14 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 
 			if ( is_orig )
 				{
-				auto result = udp_content_delivery_ports_orig->Lookup(port_val.get());
+				auto result = udp_content_delivery_ports_orig->FindOrDefault(port_val);
 
 				if ( udp_content_deliver_all_orig || (result && result->AsBool()) )
 					do_udp_contents = true;
 				}
 			else
 				{
-				auto result = udp_content_delivery_ports_resp->Lookup(port_val.get());
+				auto result = udp_content_delivery_ports_resp->FindOrDefault(port_val);
 
 				if ( udp_content_deliver_all_resp || (result && result->AsBool()) )
 					do_udp_contents = true;
@@ -213,8 +216,8 @@ void UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig,
 
 void UDP_Analyzer::UpdateConnVal(RecordVal *conn_val)
 	{
-	RecordVal *orig_endp = conn_val->Lookup("orig")->AsRecordVal();
-	RecordVal *resp_endp = conn_val->Lookup("resp")->AsRecordVal();
+	RecordVal* orig_endp = conn_val->GetField("orig")->AsRecordVal();
+	RecordVal* resp_endp = conn_val->GetField("resp")->AsRecordVal();
 
 	UpdateEndpointVal(orig_endp, true);
 	UpdateEndpointVal(resp_endp, false);
diff --git a/src/analyzer/protocol/vxlan/VXLAN.cc b/src/analyzer/protocol/vxlan/VXLAN.cc
index 2af72887f7..d633649ae6 100644
--- a/src/analyzer/protocol/vxlan/VXLAN.cc
+++ b/src/analyzer/protocol/vxlan/VXLAN.cc
@@ -48,7 +48,7 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 
 	const EncapsulationStack* estack = Conn()->GetEncapsulation();
 
-	if ( estack && estack->Depth() >= BifConst::Tunnel::max_depth )
+	if ( estack && estack->Depth() >= zeek::BifConst::Tunnel::max_depth )
 		{
 		reporter->Weird(Conn(), "tunnel_depth");
 		return;
@@ -102,8 +102,7 @@ void VXLAN_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
 
 	if ( vxlan_packet )
 		Conn()->EnqueueEvent(vxlan_packet, nullptr, ConnVal(),
-		                     IntrusivePtr{AdoptRef{}, inner->BuildPktHdrVal()},
-		                     val_mgr->Count(vni));
+		                     inner->ToPktHdrVal(), val_mgr->Count(vni));
 
 	EncapsulatingConn ec(Conn(), BifEnum::Tunnel::VXLAN);
 	sessions->DoNextInnerPacket(network_time, &pkt, inner, estack, ec);
diff --git a/src/analyzer/protocol/xmpp/xmpp-analyzer.pac b/src/analyzer/protocol/xmpp/xmpp-analyzer.pac
index 6c06809098..62bcec8fc5 100644
--- a/src/analyzer/protocol/xmpp/xmpp-analyzer.pac
+++ b/src/analyzer/protocol/xmpp/xmpp-analyzer.pac
@@ -33,7 +33,7 @@ refine connection XMPP_Conn += {
 			{
 			bro_analyzer()->StartTLS();
 			if ( xmpp_starttls )
-				BifEvent::enqueue_xmpp_starttls(bro_analyzer(), bro_analyzer()->Conn());
+				zeek::BifEvent::enqueue_xmpp_starttls(bro_analyzer(), bro_analyzer()->Conn());
 			}
 		else if ( !is_orig && token == "proceed" )
 			reporter->Weird(bro_analyzer()->Conn(), "XMPP: proceed without starttls");
diff --git a/src/binpac_bro-lib.pac b/src/binpac_bro-lib.pac
index ed8efff361..5b5b7594b1 100644
--- a/src/binpac_bro-lib.pac
+++ b/src/binpac_bro-lib.pac
@@ -6,22 +6,18 @@
 #include "ConvertUTF.h"
 %}
 
-function network_time(): double
-	%{
-	return ::network_time;
-	%}
-
-function utf16_bytestring_to_utf8_val(conn: Connection, utf16: bytestring): StringVal
-	%{
+%code{
+IntrusivePtr<StringVal> utf16_to_utf8_val(Connection* conn, const bytestring& utf16)
+	{
 	std::string resultstring;
 
 	size_t utf8size = (3 * utf16.length() + 1);
 
 	if ( utf8size > resultstring.max_size() )
 		{
-		reporter->Info("utf16 too long in utf16_bytestring_to_utf8_val");
+		reporter->Weird(conn, "utf16_conversion_failed", "utf16 too long in utf16_to_utf8_val");
 		// If the conversion didn't go well, return the original data.
-		return to_stringval(utf16).release();
+		return to_stringval(utf16);
 		}
 
 	resultstring.resize(utf8size, '\0');
@@ -47,14 +43,25 @@ function utf16_bytestring_to_utf8_val(conn: Connection, utf16: bytestring): Stri
 	                                          lenientConversion);
 	if ( res != conversionOK )
 		{
-		reporter->Weird(conn, "utf16_conversion_failed", "utf16 conversion failed in utf16_bytestring_to_utf8_val");
+		reporter->Weird(conn, "utf16_conversion_failed", "utf16 conversion failed in utf16_to_utf8_val");
 		// If the conversion didn't go well, return the original data.
-		return to_stringval(utf16).release();
+		return to_stringval(utf16);
 		}
 
 	*targetstart = 0;
 
 	// We're relying on no nulls being in the string.
 	//return new StringVal(resultstring.length(), (const char *) resultstring.data());
-	return new StringVal(resultstring.c_str());
+	return make_intrusive<StringVal>(resultstring.c_str());
+	}
+
+StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16)
+	{
+	return utf16_to_utf8_val(conn, utf16).release();
+	}
+%}
+
+function network_time(): double
+	%{
+	return ::network_time;
 	%}
diff --git a/src/binpac_bro.h b/src/binpac_bro.h
index 743bb7443d..1d84ad0810 100644
--- a/src/binpac_bro.h
+++ b/src/binpac_bro.h
@@ -40,4 +40,9 @@ inline IntrusivePtr<StringVal> to_stringval(const_bytestring const& str)
 	return make_intrusive<StringVal>(str.length(), (const char*) str.begin());
     }
 
+IntrusivePtr<StringVal> utf16_to_utf8_val(Connection* conn, const bytestring& utf16);
+
+[[deprecated("Remove in v4.1.  Use utf16_to_utf8_val() instead.")]]
+StringVal* utf16_bytestring_to_utf8_val(Connection* conn, const bytestring& utf16);
+
 } // namespace binpac
diff --git a/src/bro-bif.h b/src/bro-bif.h
index a20996152b..30a694b7ef 100644
--- a/src/bro-bif.h
+++ b/src/bro-bif.h
@@ -7,4 +7,5 @@
 #include "NetVar.h"
 #include "Event.h"
 #include "Reporter.h"
-#include "Var.h" // for internal_type()
+#include "ID.h"
+#include "EventRegistry.h"
diff --git a/src/bro.pac b/src/bro.pac
index 5f976b448a..b622041c12 100644
--- a/src/bro.pac
+++ b/src/bro.pac
@@ -8,4 +8,3 @@ extern type BroPortVal;
 extern type BroStringVal;
 
 function network_time(): double;
-function utf16_bytestring_to_utf8_val(conn: Connection, utf16: bytestring): StringVal;
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index ecea94861a..0c3a04aee3 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -3,7 +3,7 @@
 #include "Desc.h"
 #include "IntrusivePtr.h"
 #include "RE.h"
-#include "Var.h" // for internal_type()
+#include "ID.h"
 #include "Scope.h"
 #include "module_util.h"
 #include "3rdparty/doctest.h"
@@ -17,13 +17,11 @@
 
 using namespace std;
 
-OpaqueType* bro_broker::opaque_of_data_type;
-OpaqueType* bro_broker::opaque_of_set_iterator;
-OpaqueType* bro_broker::opaque_of_table_iterator;
-OpaqueType* bro_broker::opaque_of_vector_iterator;
-OpaqueType* bro_broker::opaque_of_record_iterator;
-
-BroType* bro_broker::DataVal::script_data_type = nullptr;
+IntrusivePtr<OpaqueType> bro_broker::opaque_of_data_type;
+IntrusivePtr<OpaqueType> bro_broker::opaque_of_set_iterator;
+IntrusivePtr<OpaqueType> bro_broker::opaque_of_table_iterator;
+IntrusivePtr<OpaqueType> bro_broker::opaque_of_vector_iterator;
+IntrusivePtr<OpaqueType> bro_broker::opaque_of_record_iterator;
 
 static bool data_type_check(const broker::data& d, BroType* t);
 
@@ -78,7 +76,7 @@ TEST_CASE("converting Broker to Zeek protocol constants")
 	}
 
 struct val_converter {
-	using result_type = Val*;
+	using result_type = IntrusivePtr<Val>;
 
 	BroType* type;
 
@@ -90,30 +88,30 @@ struct val_converter {
 	result_type operator()(bool a)
 		{
 		if ( type->Tag() == TYPE_BOOL )
-			return val_mgr->Bool(a)->Ref();
+			return val_mgr->Bool(a);
 		return nullptr;
 		}
 
 	result_type operator()(uint64_t a)
 		{
 		if ( type->Tag() == TYPE_COUNT )
-			return val_mgr->Count(a).release();
+			return val_mgr->Count(a);
 		if ( type->Tag() == TYPE_COUNTER )
-			return val_mgr->Count(a).release();
+			return val_mgr->Count(a);
 		return nullptr;
 		}
 
 	result_type operator()(int64_t a)
 		{
 		if ( type->Tag() == TYPE_INT )
-			return val_mgr->Int(a).release();
+			return val_mgr->Int(a);
 		return nullptr;
 		}
 
 	result_type operator()(double a)
 		{
 		if ( type->Tag() == TYPE_DOUBLE )
-			return new Val(a, TYPE_DOUBLE);
+			return make_intrusive<Val>(a, TYPE_DOUBLE);
 		return nullptr;
 		}
 
@@ -121,13 +119,13 @@ struct val_converter {
 		{
 		switch ( type->Tag() ) {
 		case TYPE_STRING:
-			return new StringVal(a.size(), a.data());
+			return make_intrusive<StringVal>(a.size(), a.data());
 		case TYPE_FILE:
 			{
-			auto file = BroFile::GetFile(a.data());
+			auto file = BroFile::Get(a.data());
 
 			if ( file )
-				return new Val(file);
+				return make_intrusive<Val>(std::move(file));
 
 			return nullptr;
 			}
@@ -141,7 +139,7 @@ struct val_converter {
 		if ( type->Tag() == TYPE_ADDR )
 			{
 			auto bits = reinterpret_cast<const in6_addr*>(&a.bytes());
-			return new AddrVal(IPAddr(*bits));
+			return make_intrusive<AddrVal>(IPAddr(*bits));
 			}
 
 		return nullptr;
@@ -152,7 +150,7 @@ struct val_converter {
 		if ( type->Tag() == TYPE_SUBNET )
 			{
 			auto bits = reinterpret_cast<const in6_addr*>(&a.network().bytes());
-			return new SubNetVal(IPPrefix(IPAddr(*bits), a.length()));
+			return make_intrusive<SubNetVal>(IPPrefix(IPAddr(*bits), a.length()));
 			}
 
 		return nullptr;
@@ -161,7 +159,7 @@ struct val_converter {
 	result_type operator()(broker::port& a)
 		{
 		if ( type->Tag() == TYPE_PORT )
-			return val_mgr->Port(a.number(), bro_broker::to_bro_port_proto(a.type()))->Ref();
+			return val_mgr->Port(a.number(), bro_broker::to_bro_port_proto(a.type()));
 
 		return nullptr;
 		}
@@ -173,7 +171,7 @@ struct val_converter {
 
 		using namespace std::chrono;
 		auto s = duration_cast<broker::fractional_seconds>(a.time_since_epoch());
-		return new Val(s.count(), TYPE_TIME);
+		return make_intrusive<Val>(s.count(), TYPE_TIME);
 		}
 
 	result_type operator()(broker::timespan& a)
@@ -183,7 +181,7 @@ struct val_converter {
 
 		using namespace std::chrono;
 		auto s = duration_cast<broker::fractional_seconds>(a);
-		return new Val(s.count(), TYPE_INTERVAL);
+		return make_intrusive<Val>(s.count(), TYPE_INTERVAL);
 		}
 
 	result_type operator()(broker::enum_value& a)
@@ -196,7 +194,8 @@ struct val_converter {
 			if ( i == -1 )
 				return nullptr;
 
-			return etype->GetVal(i).release();
+			auto rval = etype->GetVal(i);
+			return rval;
 			}
 
 		return nullptr;
@@ -212,17 +211,17 @@ struct val_converter {
 
 		for ( auto& item : a )
 			{
-			auto expected_index_types = tt->Indices()->Types();
+			const auto& expected_index_types = tt->GetIndices()->Types();
 			broker::vector composite_key;
 			auto indices = caf::get_if<broker::vector>(&item);
 
 			if ( indices )
 				{
-				if ( expected_index_types->length() == 1 )
+				if ( expected_index_types.size() == 1 )
 					{
 					auto index_is_vector_or_record =
-					     (*expected_index_types)[0]->Tag() == TYPE_RECORD ||
-					     (*expected_index_types)[0]->Tag() == TYPE_VECTOR;
+					     expected_index_types[0]->Tag() == TYPE_RECORD ||
+					     expected_index_types[0]->Tag() == TYPE_VECTOR;
 
 					if ( index_is_vector_or_record )
 						{
@@ -238,8 +237,7 @@ struct val_converter {
 				indices = &composite_key;
 				}
 
-			if ( static_cast<size_t>(expected_index_types->length()) !=
-			     indices->size() )
+			if ( expected_index_types.size() != indices->size() )
 				return nullptr;
 
 			auto list_val = make_intrusive<ListVal>(TYPE_ANY);
@@ -247,19 +245,19 @@ struct val_converter {
 			for ( auto i = 0u; i < indices->size(); ++i )
 				{
 				auto index_val = bro_broker::data_to_val(move((*indices)[i]),
-				                                         (*expected_index_types)[i]);
+				                                         expected_index_types[i].get());
 
 				if ( ! index_val )
 					return nullptr;
 
-				list_val->Append(index_val.release());
+				list_val->Append(std::move(index_val));
 				}
 
 
-			rval->Assign(list_val.get(), nullptr);
+			rval->Assign(std::move(list_val), nullptr);
 			}
 
-		return rval.release();
+		return rval;
 		}
 
 	result_type operator()(broker::table& a)
@@ -272,17 +270,17 @@ struct val_converter {
 
 		for ( auto& item : a )
 			{
-			auto expected_index_types = tt->Indices()->Types();
+			const auto& expected_index_types = tt->GetIndices()->Types();
 			broker::vector composite_key;
 			auto indices = caf::get_if<broker::vector>(&item.first);
 
 			if ( indices )
 				{
-				if ( expected_index_types->length() == 1 )
+				if ( expected_index_types.size() == 1 )
 					{
 					auto index_is_vector_or_record =
-					     (*expected_index_types)[0]->Tag() == TYPE_RECORD ||
-					     (*expected_index_types)[0]->Tag() == TYPE_VECTOR;
+					     expected_index_types[0]->Tag() == TYPE_RECORD ||
+					     expected_index_types[0]->Tag() == TYPE_VECTOR;
 
 					if ( index_is_vector_or_record )
 						{
@@ -298,8 +296,7 @@ struct val_converter {
 				indices = &composite_key;
 				}
 
-			if ( static_cast<size_t>(expected_index_types->length()) !=
-			     indices->size() )
+			if ( expected_index_types.size() != indices->size() )
 				return nullptr;
 
 			auto list_val = make_intrusive<ListVal>(TYPE_ANY);
@@ -307,24 +304,24 @@ struct val_converter {
 			for ( auto i = 0u; i < indices->size(); ++i )
 				{
 				auto index_val = bro_broker::data_to_val(move((*indices)[i]),
-				                                         (*expected_index_types)[i]);
+				                                         expected_index_types[i].get());
 
 				if ( ! index_val )
 					return nullptr;
 
-				list_val->Append(index_val.release());
+				list_val->Append(std::move(index_val));
 				}
 
 			auto value_val = bro_broker::data_to_val(move(item.second),
-			                                         tt->YieldType());
+			                                         tt->Yield().get());
 
 			if ( ! value_val )
 				return nullptr;
 
-			rval->Assign(list_val.get(), std::move(value_val));
+			rval->Assign(std::move(list_val), std::move(value_val));
 			}
 
-		return rval.release();
+		return rval;
 		}
 
 	result_type operator()(broker::vector& a)
@@ -332,11 +329,11 @@ struct val_converter {
 		if ( type->Tag() == TYPE_VECTOR )
 			{
 			auto vt = type->AsVectorType();
-			auto rval = make_intrusive<VectorVal>(vt);
+			auto rval = make_intrusive<VectorVal>(IntrusivePtr{NewRef{}, vt});
 
 			for ( auto& item : a )
 				{
-				auto item_val = bro_broker::data_to_val(move(item), vt->YieldType());
+				auto item_val = bro_broker::data_to_val(move(item), vt->Yield().get());
 
 				if ( ! item_val )
 					return nullptr;
@@ -344,7 +341,7 @@ struct val_converter {
 				rval->Assign(rval->Size(), std::move(item_val));
 				}
 
-			return rval.release();
+			return rval;
 			}
 		else if ( type->Tag() == TYPE_FUNC )
 			{
@@ -355,15 +352,15 @@ struct val_converter {
 			if ( ! name )
 				return nullptr;
 
-			auto id = global_scope()->Lookup(*name);
+			const auto& id = global_scope()->Find(*name);
 			if ( ! id )
 				return nullptr;
 
-			auto rval = id->ID_Val();
+			const auto& rval = id->GetVal();
 			if ( ! rval )
 				return nullptr;
 
-			auto t = rval->Type();
+			const auto& t = rval->GetType();
 			if ( ! t )
 				return nullptr;
 
@@ -384,12 +381,12 @@ struct val_converter {
 					return nullptr;
 				}
 
-			return rval->Ref();
+			return rval;
 			}
 		else if ( type->Tag() == TYPE_RECORD )
 			{
 			auto rt = type->AsRecordType();
-			auto rval = make_intrusive<RecordVal>(rt);
+			auto rval = make_intrusive<RecordVal>(IntrusivePtr{NewRef{}, rt});
 			auto idx = 0u;
 
 			for ( auto i = 0u; i < static_cast<size_t>(rt->NumFields()); ++i )
@@ -405,7 +402,7 @@ struct val_converter {
 					}
 
 				auto item_val = bro_broker::data_to_val(move(a[idx]),
-				                                        rt->FieldType(i));
+				                                        rt->GetFieldType(i).get());
 
 				if ( ! item_val )
 					return nullptr;
@@ -414,7 +411,7 @@ struct val_converter {
 				++idx;
 				}
 
-			return rval.release();
+			return rval;
 			}
 		else if ( type->Tag() == TYPE_PATTERN )
 			{
@@ -438,11 +435,11 @@ struct val_converter {
 				return nullptr;
 				}
 
-			auto rval = new PatternVal(re);
+			auto rval = make_intrusive<PatternVal>(re);
 			return rval;
 			}
 		else if ( type->Tag() == TYPE_OPAQUE )
-			return OpaqueVal::Unserialize(a).release();
+			return OpaqueVal::Unserialize(a);
 
 		return nullptr;
 		}
@@ -561,17 +558,17 @@ struct type_checker {
 
 		for ( const auto& item : a )
 			{
-			auto expected_index_types = tt->Indices()->Types();
+			const auto& expected_index_types = tt->GetIndices()->Types();
 			auto indices = caf::get_if<broker::vector>(&item);
 			vector<const broker::data*> indices_to_check;
 
 			if ( indices )
 				{
-				if ( expected_index_types->length() == 1 )
+				if ( expected_index_types.size() == 1 )
 					{
 					auto index_is_vector_or_record =
-					     (*expected_index_types)[0]->Tag() == TYPE_RECORD ||
-					     (*expected_index_types)[0]->Tag() == TYPE_VECTOR;
+					     expected_index_types[0]->Tag() == TYPE_RECORD ||
+					     expected_index_types[0]->Tag() == TYPE_VECTOR;
 
 					if ( index_is_vector_or_record )
 						// Disambiguate from composite key w/ multiple vals.
@@ -595,13 +592,12 @@ struct type_checker {
 			else
 				indices_to_check.emplace_back(&item);
 
-			if ( static_cast<size_t>(expected_index_types->length()) !=
-			     indices_to_check.size() )
+			if ( expected_index_types.size() != indices_to_check.size() )
 				return false;
 
 			for ( auto i = 0u; i < indices_to_check.size(); ++i )
 				{
-				auto expect = (*expected_index_types)[i];
+				auto expect = expected_index_types[i].get();
 				auto& index_to_check = *(indices_to_check)[i];
 
 				if ( ! data_type_check(index_to_check, expect) )
@@ -621,17 +617,17 @@ struct type_checker {
 
 		for ( auto& item : a )
 			{
-			auto expected_index_types = tt->Indices()->Types();
+			const auto& expected_index_types = tt->GetIndices()->Types();
 			auto indices = caf::get_if<broker::vector>(&item.first);
 			vector<const broker::data*> indices_to_check;
 
 			if ( indices )
 				{
-				if ( expected_index_types->length() == 1 )
+				if ( expected_index_types.size() == 1 )
 					{
 					auto index_is_vector_or_record =
-					     (*expected_index_types)[0]->Tag() == TYPE_RECORD ||
-					     (*expected_index_types)[0]->Tag() == TYPE_VECTOR;
+					     expected_index_types[0]->Tag() == TYPE_RECORD ||
+					     expected_index_types[0]->Tag() == TYPE_VECTOR;
 
 					if ( index_is_vector_or_record )
 						// Disambiguate from composite key w/ multiple vals.
@@ -656,22 +652,21 @@ struct type_checker {
 				indices_to_check.emplace_back(&item.first);
 
 
-			if ( static_cast<size_t>(expected_index_types->length()) !=
-			     indices_to_check.size() )
+			if ( expected_index_types.size() != indices_to_check.size() )
 				{
 				return false;
 				}
 
 			for ( auto i = 0u; i < indices_to_check.size(); ++i )
 				{
-				auto expect = (*expected_index_types)[i];
+				auto expect = expected_index_types[i].get();
 				auto& index_to_check = *(indices_to_check)[i];
 
 				if ( ! data_type_check(index_to_check, expect) )
 					return false;
 				}
 
-			if ( ! data_type_check(item.second, tt->YieldType()) )
+			if ( ! data_type_check(item.second, tt->Yield().get()) )
 				return false;
 			}
 
@@ -686,7 +681,7 @@ struct type_checker {
 
 			for ( auto& item : a )
 				{
-				if ( ! data_type_check(item, vt->YieldType()) )
+				if ( ! data_type_check(item, vt->Yield().get()) )
 					return false;
 				}
 
@@ -701,15 +696,15 @@ struct type_checker {
 			if ( ! name )
 				return false;
 
-			auto id = global_scope()->Lookup(*name);
+			const auto& id = global_scope()->Find(*name);
 			if ( ! id )
 				return false;
 
-			auto rval = id->ID_Val();
+			const auto& rval = id->GetVal();
 			if ( ! rval )
 				return false;
 
-			auto t = rval->Type();
+			const auto& t = rval->GetType();
 			if ( ! t )
 				return false;
 
@@ -734,7 +729,7 @@ struct type_checker {
 					continue;
 					}
 
-				if ( ! data_type_check(a[idx], rt->FieldType(i)) )
+				if ( ! data_type_check(a[idx], rt->GetFieldType(i).get()) )
 					return false;
 
 				++idx;
@@ -792,12 +787,12 @@ IntrusivePtr<Val> bro_broker::data_to_val(broker::data d, BroType* type)
 	if ( type->Tag() == TYPE_ANY )
 		return bro_broker::make_data_val(move(d));
 
-	return {AdoptRef{}, caf::visit(val_converter{type}, std::move(d))};
+	return caf::visit(val_converter{type}, std::move(d));
 	}
 
 broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 	{
-	switch ( v->Type()->Tag() ) {
+	switch ( v->GetType()->Tag() ) {
 	case TYPE_BOOL:
 		return {v->AsBool()};
 	case TYPE_INT:
@@ -847,7 +842,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 		}
 	case TYPE_ENUM:
 		{
-		auto enum_type = v->Type()->AsEnumType();
+		auto enum_type = v->GetType()->AsEnumType();
 		auto enum_name = enum_type->Lookup(v->AsEnum());
 		return {broker::enum_value(enum_name ? enum_name : "<unknown enum>")};
 		}
@@ -888,7 +883,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 		}
 	case TYPE_TABLE:
 		{
-		auto is_set = v->Type()->IsSet();
+		auto is_set = v->GetType()->IsSet();
 		auto table = v->AsTable();
 		auto table_val = v->AsTableVal();
 		broker::data rval;
@@ -904,7 +899,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 
 		while ( (entry = table->NextEntry(hk, c)) )
 			{
-			auto vl = table_val->RecoverIndex(hk);
+			auto vl = table_val->RecreateIndex(*hk);
 			delete hk;
 
 			broker::vector composite_key;
@@ -912,7 +907,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 
 			for ( auto k = 0; k < vl->Length(); ++k )
 				{
-				auto key_part = val_to_data((*vl->Vals())[k]);
+				auto key_part = val_to_data(vl->Idx(k).get());
 
 				if ( ! key_part )
 					return broker::ec::invalid_data;
@@ -931,7 +926,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 				caf::get<broker::set>(rval).emplace(move(key));
 			else
 				{
-				auto val = val_to_data(entry->Value());
+				auto val = val_to_data(entry->GetVal().get());
 
 				if ( ! val )
 					return broker::ec::invalid_data;
@@ -950,12 +945,12 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 
 		for ( auto i = 0u; i < vec->Size(); ++i )
 			{
-			auto item_val = vec->Lookup(i);
+			const auto& item_val = vec->At(i);
 
 			if ( ! item_val )
 				continue;
 
-			auto item = val_to_data(item_val);
+			auto item = val_to_data(item_val.get());
 
 			if ( ! item )
 				return broker::ec::invalid_data;
@@ -969,12 +964,12 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 		{
 		auto rec = v->AsRecordVal();
 		broker::vector rval;
-		size_t num_fields = v->Type()->AsRecordType()->NumFields();
+		size_t num_fields = v->GetType()->AsRecordType()->NumFields();
 		rval.reserve(num_fields);
 
 		for ( auto i = 0u; i < num_fields; ++i )
 			{
-			auto item_val = rec->LookupWithDefault(i);
+			auto item_val = rec->GetFieldOrDefault(i);
 
 			if ( ! item_val )
 				{
@@ -1011,7 +1006,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 		}
 	default:
 		reporter->Error("unsupported Broker::Data type: %s",
-		                type_name(v->Type()->Tag()));
+		                type_name(v->GetType()->Tag()));
 		break;
 	}
 
@@ -1020,7 +1015,7 @@ broker::expected<broker::data> bro_broker::val_to_data(const Val* v)
 
 IntrusivePtr<RecordVal> bro_broker::make_data_val(Val* v)
 	{
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	auto data = val_to_data(v);
 
 	if  ( data )
@@ -1033,7 +1028,7 @@ IntrusivePtr<RecordVal> bro_broker::make_data_val(Val* v)
 
 IntrusivePtr<RecordVal> bro_broker::make_data_val(broker::data d)
 	{
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	rval->Assign(0, make_intrusive<DataVal>(move(d)));
 	return rval;
 	}
@@ -1043,72 +1038,72 @@ struct data_type_getter {
 
 	result_type operator()(broker::none)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::NONE);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::NONE);
 		}
 
 	result_type operator()(bool)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::BOOL);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::BOOL);
 		}
 
 	result_type operator()(uint64_t)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::COUNT);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::COUNT);
 		}
 
 	result_type operator()(int64_t)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INT);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INT);
 		}
 
 	result_type operator()(double)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::DOUBLE);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::DOUBLE);
 		}
 
 	result_type operator()(const std::string&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::STRING);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::STRING);
 		}
 
 	result_type operator()(const broker::address&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ADDR);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ADDR);
 		}
 
 	result_type operator()(const broker::subnet&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SUBNET);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SUBNET);
 		}
 
 	result_type operator()(const broker::port&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::PORT);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::PORT);
 		}
 
 	result_type operator()(const broker::timestamp&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TIME);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TIME);
 		}
 
 	result_type operator()(const broker::timespan&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INTERVAL);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::INTERVAL);
 		}
 
 	result_type operator()(const broker::enum_value&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ENUM);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::ENUM);
 		}
 
 	result_type operator()(const broker::set&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SET);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::SET);
 		}
 
 	result_type operator()(const broker::table&)
 		{
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TABLE);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::TABLE);
 		}
 
 	result_type operator()(const broker::vector&)
@@ -1116,7 +1111,7 @@ struct data_type_getter {
 		// Note that Broker uses vectors to store record data, so there's
 		// no actual way to tell if this data was originally associated
 		// with a Bro record.
-		return BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::VECTOR);
+		return zeek::BifType::Enum::Broker::DataType->GetVal(BifEnum::Broker::VECTOR);
 		}
 };
 
@@ -1127,7 +1122,7 @@ IntrusivePtr<EnumVal> bro_broker::get_data_type(RecordVal* v, Frame* frame)
 
 broker::data& bro_broker::opaque_field_to_data(RecordVal* v, Frame* f)
 	{
-	Val* d = v->Lookup(0);
+	const auto& d = v->GetField(0);
 
 	if ( ! d )
 		reporter->RuntimeError(f->GetCall()->GetLocationInfo(),
@@ -1135,7 +1130,7 @@ broker::data& bro_broker::opaque_field_to_data(RecordVal* v, Frame* f)
 
 	// RuntimeError throws an exception which causes this line to never exceute.
 	// NOLINTNEXTLINE(clang-analyzer-core.uninitialized.UndefReturn)
-	return static_cast<DataVal*>(d)->data;
+	return static_cast<DataVal*>(d.get())->data;
 	}
 
 void bro_broker::DataVal::ValDescribe(ODesc* d) const
@@ -1155,11 +1150,9 @@ IntrusivePtr<Val> bro_broker::DataVal::castTo(BroType* t)
 	return data_to_val(data, t);
 	}
 
-BroType* bro_broker::DataVal::ScriptDataType()
+const IntrusivePtr<BroType>& bro_broker::DataVal::ScriptDataType()
 	{
-	if ( ! script_data_type )
-		script_data_type = internal_type("Broker::Data");
-
+	static auto script_data_type = zeek::id::find_type("Broker::Data");
 	return script_data_type;
 	}
 
diff --git a/src/broker/Data.h b/src/broker/Data.h
index 5979de83ae..d6578ceb99 100644
--- a/src/broker/Data.h
+++ b/src/broker/Data.h
@@ -12,11 +12,11 @@ class ODesc;
 
 namespace bro_broker {
 
-extern OpaqueType* opaque_of_data_type;
-extern OpaqueType* opaque_of_set_iterator;
-extern OpaqueType* opaque_of_table_iterator;
-extern OpaqueType* opaque_of_vector_iterator;
-extern OpaqueType* opaque_of_record_iterator;
+extern IntrusivePtr<OpaqueType> opaque_of_data_type;
+extern IntrusivePtr<OpaqueType> opaque_of_set_iterator;
+extern IntrusivePtr<OpaqueType> opaque_of_table_iterator;
+extern IntrusivePtr<OpaqueType> opaque_of_vector_iterator;
+extern IntrusivePtr<OpaqueType> opaque_of_record_iterator;
 
 /**
  * Convert a broker port protocol to a bro port protocol.
@@ -110,7 +110,7 @@ public:
 	// Returns the Bro type that scripts use to represent a Broker data
 	// instance. This may be wrapping the opaque value inside another
 	// type.
-	static BroType* ScriptDataType();
+	static const IntrusivePtr<BroType>& ScriptDataType();
 
 	broker::data data;
 
@@ -120,8 +120,6 @@ protected:
 		{}
 
 	DECLARE_OPAQUE_VALUE(bro_broker::DataVal)
-
-	static BroType* script_data_type;
 };
 
 /**
diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index d54b061580..469cc997f0 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -29,12 +29,12 @@ namespace bro_broker {
 
 static inline Val* get_option(const char* option)
 	{
-	auto id = global_scope()->Lookup(option);
+	const auto& id = global_scope()->Find(option);
 
-	if ( ! (id && id->ID_Val()) )
+	if ( ! (id && id->GetVal()) )
 		reporter->FatalError("Unknown Broker option %s", option);
 
-	return id->ID_Val();
+	return id->GetVal().get();
 	}
 
 class BrokerConfig : public broker::configuration {
@@ -132,7 +132,6 @@ Manager::Manager(bool arg_use_real_time)
 	peer_count = 0;
 	log_batch_size = 0;
 	log_topic_func = nullptr;
-	vector_of_data_type = nullptr;
 	log_id_type = nullptr;
 	writer_id_type = nullptr;
 	}
@@ -149,16 +148,16 @@ void Manager::InitPostScript()
 	default_log_topic_prefix =
 	    get_option("Broker::default_log_topic_prefix")->AsString()->CheckString();
 	log_topic_func = get_option("Broker::log_topic")->AsFunc();
-	log_id_type = internal_type("Log::ID")->AsEnumType();
-	writer_id_type = internal_type("Log::Writer")->AsEnumType();
+	log_id_type = zeek::id::find_type("Log::ID")->AsEnumType();
+	writer_id_type = zeek::id::find_type("Log::Writer")->AsEnumType();
 
-	opaque_of_data_type = new OpaqueType("Broker::Data");
-	opaque_of_set_iterator = new OpaqueType("Broker::SetIterator");
-	opaque_of_table_iterator = new OpaqueType("Broker::TableIterator");
-	opaque_of_vector_iterator = new OpaqueType("Broker::VectorIterator");
-	opaque_of_record_iterator = new OpaqueType("Broker::RecordIterator");
-	opaque_of_store_handle = new OpaqueType("Broker::Store");
-	vector_of_data_type = new VectorType({NewRef{}, internal_type("Broker::Data")});
+	opaque_of_data_type = make_intrusive<OpaqueType>("Broker::Data");
+	opaque_of_set_iterator = make_intrusive<OpaqueType>("Broker::SetIterator");
+	opaque_of_table_iterator = make_intrusive<OpaqueType>("Broker::TableIterator");
+	opaque_of_vector_iterator = make_intrusive<OpaqueType>("Broker::VectorIterator");
+	opaque_of_record_iterator = make_intrusive<OpaqueType>("Broker::RecordIterator");
+	opaque_of_store_handle = make_intrusive<OpaqueType>("Broker::Store");
+	vector_of_data_type = make_intrusive<VectorType>(zeek::id::find_type("Broker::Data"));
 
 	// Register as a "dont-count" source first, we may change that later.
 	iosource_mgr->Register(this, true);
@@ -387,18 +386,18 @@ bool Manager::PublishEvent(string topic, RecordVal* args)
 	if ( peer_count == 0 )
 		return true;
 
-	if ( ! args->Lookup(0) )
+	if ( ! args->GetField(0) )
 		return false;
 
-	auto event_name = args->Lookup(0)->AsString()->CheckString();
-	auto vv = args->Lookup(1)->AsVectorVal();
+	auto event_name = args->GetField(0)->AsString()->CheckString();
+	auto vv = args->GetField(1)->AsVectorVal();
 	broker::vector xs;
 	xs.reserve(vv->Size());
 
 	for ( auto i = 0u; i < vv->Size(); ++i )
 		{
-		auto val = vv->Lookup(i)->AsRecordVal()->Lookup(0);
-		auto data_val = static_cast<DataVal*>(val);
+		const auto& val = vv->At(i)->AsRecordVal()->GetField(0);
+		auto data_val = static_cast<DataVal*>(val.get());
 		xs.emplace_back(data_val->data);
 		}
 
@@ -413,24 +412,24 @@ bool Manager::PublishIdentifier(std::string topic, std::string id)
 	if ( peer_count == 0 )
 		return true;
 
-	ID* i = global_scope()->Lookup(id);
+	const auto& i = global_scope()->Find(id);
 
 	if ( ! i )
 		return false;
 
-	auto val = i->ID_Val();
+	const auto& val = i->GetVal();
 
 	if ( ! val )
 		// Probably could have a special case to also unset the value on the
 		// receiving side, but not sure what use that would be.
 		return false;
 
-	auto data = val_to_data(val);
+	auto data = val_to_data(val.get());
 
 	if ( ! data )
 		{
 		Error("Failed to publish ID with unsupported type: %s (%s)",
-		      id.c_str(), type_name(val->Type()->Tag()));
+		      id.c_str(), type_name(val->GetType()->Tag()));
 		return false;
 		}
 
@@ -453,7 +452,7 @@ bool Manager::PublishLogCreate(EnumVal* stream, EnumVal* writer,
 	if ( peer_count == 0 )
 		return true;
 
-	auto stream_id = stream->Type()->AsEnumType()->Lookup(stream->AsEnum());
+	auto stream_id = stream->GetType()->AsEnumType()->Lookup(stream->AsEnum());
 
 	if ( ! stream_id )
 		{
@@ -462,7 +461,7 @@ bool Manager::PublishLogCreate(EnumVal* stream, EnumVal* writer,
 		return false;
 		}
 
-	auto writer_id = writer->Type()->AsEnumType()->Lookup(writer->AsEnum());
+	auto writer_id = writer->GetType()->AsEnumType()->Lookup(writer->AsEnum());
 
 	if ( ! writer_id )
 		{
@@ -508,7 +507,7 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 		return true;
 
 	auto stream_id_num = stream->AsEnum();
-	auto stream_id = stream->Type()->AsEnumType()->Lookup(stream_id_num);
+	auto stream_id = stream->GetType()->AsEnumType()->Lookup(stream_id_num);
 
 	if ( ! stream_id )
 		{
@@ -517,7 +516,7 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 		return false;
 		}
 
-	auto writer_id = writer->Type()->AsEnumType()->Lookup(writer->AsEnum());
+	auto writer_id = writer->GetType()->AsEnumType()->Lookup(writer->AsEnum());
 
 	if ( ! writer_id )
 		{
@@ -553,8 +552,8 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 	std::string serial_data(data, len);
 	free(data);
 
-	auto v = log_topic_func->Call(IntrusivePtr{NewRef{}, stream},
-	                              make_intrusive<StringVal>(path));
+	auto v = log_topic_func->Invoke(IntrusivePtr{NewRef{}, stream},
+	                                make_intrusive<StringVal>(path));
 
 	if ( ! v )
 		{
@@ -639,7 +638,7 @@ void Manager::Error(const char* format, ...)
 
 bool Manager::AutoPublishEvent(string topic, Val* event)
 	{
-	if ( event->Type()->Tag() != TYPE_FUNC )
+	if ( event->GetType()->Tag() != TYPE_FUNC )
 		{
 		Error("Broker::auto_publish must operate on an event");
 		return false;
@@ -668,7 +667,7 @@ bool Manager::AutoPublishEvent(string topic, Val* event)
 
 bool Manager::AutoUnpublishEvent(const string& topic, Val* event)
 	{
-	if ( event->Type()->Tag() != TYPE_FUNC )
+	if ( event->GetType()->Tag() != TYPE_FUNC )
 		{
 		Error("Broker::auto_event_stop must operate on an event");
 		return false;
@@ -700,8 +699,8 @@ bool Manager::AutoUnpublishEvent(const string& topic, Val* event)
 
 RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 	{
-	auto rval = new RecordVal(BifType::Record::Broker::Event);
-	auto arg_vec = new VectorVal(vector_of_data_type);
+	auto rval = new RecordVal(zeek::BifType::Record::Broker::Event);
+	auto arg_vec = make_intrusive<VectorVal>(vector_of_data_type);
 	rval->Assign(1, arg_vec);
 	Func* func = nullptr;
 	scoped_reporter_location srl{frame};
@@ -714,7 +713,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 			{
 			// Event val must come first.
 
-			if ( arg_val->Type()->Tag() != TYPE_FUNC )
+			if ( arg_val->GetType()->Tag() != TYPE_FUNC )
 				{
 				Error("attempt to convert non-event into an event type");
 				return rval;
@@ -728,7 +727,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 				return rval;
 				}
 
-			auto num_args = func->FType()->Args()->NumFields();
+			auto num_args = func->GetType()->Params()->NumFields();
 
 			if ( num_args != args->length() - 1 )
 				{
@@ -741,8 +740,8 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 			continue;
 			}
 
-		auto got_type = (*args)[i]->Type();
-		auto expected_type = (*func->FType()->ArgTypes()->Types())[i - 1];
+		const auto& got_type = (*args)[i]->GetType();
+		const auto& expected_type = func->GetType()->ParamList()->Types()[i - 1];
 
 		if ( ! same_type(got_type, expected_type) )
 			{
@@ -760,7 +759,7 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
 		else
 			data_val = make_data_val((*args)[i]);
 
-		if ( ! data_val->Lookup(0) )
+		if ( ! data_val->GetField(0) )
 			{
 			rval->Assign(0, nullptr);
 			Error("failed to convert param #%d of type %s to broker data",
@@ -978,13 +977,13 @@ void Manager::ProcessEvent(const broker::topic& topic, broker::zeek::Event ev)
 		return;
 		}
 
-	auto arg_types = handler->FType(false)->ArgTypes()->Types();
+	const auto& arg_types = handler->GetType(false)->ParamList()->Types();
 
-	if ( static_cast<size_t>(arg_types->length()) != args.size() )
+	if ( arg_types.size() != args.size() )
 		{
 		reporter->Warning("got event message '%s' with invalid # of args,"
-				  " got %zd, expected %d", name.data(), args.size(),
-				  arg_types->length());
+		                  " got %zd, expected %zu", name.data(), args.size(),
+		                  arg_types.size());
 		return;
 		}
 
@@ -994,8 +993,8 @@ void Manager::ProcessEvent(const broker::topic& topic, broker::zeek::Event ev)
 	for ( auto i = 0u; i < args.size(); ++i )
 		{
 		auto got_type = args[i].get_type_name();
-		auto expected_type = (*arg_types)[i];
-		auto val = data_to_val(std::move(args[i]), expected_type);
+		const auto& expected_type = arg_types[i];
+		auto val = data_to_val(std::move(args[i]), expected_type.get());
 
 		if ( val )
 			vl.emplace_back(std::move(val));
@@ -1187,7 +1186,7 @@ bool Manager::ProcessIdentifierUpdate(broker::zeek::IdentifierUpdate iu)
 	++statistics.num_ids_incoming;
 	auto id_name = std::move(iu.id_name());
 	auto id_value = std::move(iu.id_value());
-	auto id = global_scope()->Lookup(id_name);
+	const auto& id = global_scope()->Find(id_name);
 
 	if ( ! id )
 		{
@@ -1196,12 +1195,12 @@ bool Manager::ProcessIdentifierUpdate(broker::zeek::IdentifierUpdate iu)
 		return false;
 		}
 
-	auto val = data_to_val(std::move(id_value), id->Type());
+	auto val = data_to_val(std::move(id_value), id->GetType().get());
 
 	if ( ! val )
 		{
 		reporter->Error("Failed to receive ID with unsupported type: %s (%s)",
-		                id_name.c_str(), type_name(id->Type()->Tag()));
+		                id_name.c_str(), type_name(id->GetType()->Tag()));
 		return false;
 		}
 
@@ -1246,13 +1245,13 @@ void Manager::ProcessStatus(broker::status stat)
 	if ( ! event )
 		return;
 
-	auto ei = internal_type("Broker::EndpointInfo")->AsRecordType();
+	static auto ei = zeek::id::find_type<RecordType>("Broker::EndpointInfo");
 	auto endpoint_info = make_intrusive<RecordVal>(ei);
 
 	if ( ctx )
 		{
 		endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(ctx->node)));
-		auto ni = internal_type("Broker::NetworkInfo")->AsRecordType();
+		static auto ni = zeek::id::find_type<RecordType>("Broker::NetworkInfo");
 		auto network_info = make_intrusive<RecordVal>(ni);
 
 		if ( ctx->network )
@@ -1352,7 +1351,7 @@ void Manager::ProcessError(broker::error err)
 		}
 
 	mgr.Enqueue(Broker::error,
-		BifType::Enum::Broker::ErrorCode->GetVal(ec),
+		zeek::BifType::Enum::Broker::ErrorCode->GetVal(ec),
 		make_intrusive<StringVal>(msg)
 	);
 	}
diff --git a/src/broker/Manager.h b/src/broker/Manager.h
index bbd38f88be..a57b86057c 100644
--- a/src/broker/Manager.h
+++ b/src/broker/Manager.h
@@ -17,6 +17,7 @@
 #include <string>
 #include <unordered_map>
 
+#include "IntrusivePtr.h"
 #include "iosource/IOSource.h"
 #include "logging/WriterBackend.h"
 
@@ -394,7 +395,7 @@ private:
 
 	size_t log_batch_size;
 	Func* log_topic_func;
-	VectorType* vector_of_data_type;
+	IntrusivePtr<VectorType> vector_of_data_type;
 	EnumType* log_id_type;
 	EnumType* writer_id_type;
 
diff --git a/src/broker/Store.cc b/src/broker/Store.cc
index 1d1ff7addb..7eb22c5948 100644
--- a/src/broker/Store.cc
+++ b/src/broker/Store.cc
@@ -1,13 +1,13 @@
 #include "Store.h"
 #include "Desc.h"
-#include "Var.h" // for internal_type()
+#include "ID.h"
 #include "broker/Manager.h"
 
 namespace bro_broker {
 
-OpaqueType* opaque_of_store_handle;
+IntrusivePtr<OpaqueType> opaque_of_store_handle;
 
-EnumVal* query_status(bool success)
+IntrusivePtr<EnumVal> query_status(bool success)
 	{
 	static EnumType* store_query_status = nullptr;
 	static int success_val;
@@ -15,12 +15,13 @@ EnumVal* query_status(bool success)
 
 	if ( ! store_query_status )
 		{
-		store_query_status = internal_type("Broker::QueryStatus")->AsEnumType();
+		store_query_status = zeek::id::find_type("Broker::QueryStatus")->AsEnumType();
 		success_val = store_query_status->Lookup("Broker", "SUCCESS");
 		failure_val = store_query_status->Lookup("Broker", "FAILURE");
 		}
 
-	return store_query_status->GetVal(success ? success_val : failure_val).release();
+	auto rval = store_query_status->GetVal(success ? success_val : failure_val);
+	return rval;
 	}
 
 void StoreHandleVal::ValDescribe(ODesc* d) const
@@ -103,15 +104,15 @@ broker::backend_options to_backend_options(broker::backend backend,
 	switch ( backend ) {
 	case broker::backend::sqlite:
 		{
-		auto path = options->Lookup(0)->AsRecordVal()
-			->Lookup(0)->AsStringVal()->CheckString();
+		auto path = options->GetField(0)->AsRecordVal()
+			->GetField(0)->AsStringVal()->CheckString();
 		return {{"path", path}};
 		}
 
 	case broker::backend::rocksdb:
 		{
-		auto path = options->Lookup(1)->AsRecordVal()
-			->Lookup(0)->AsStringVal()->CheckString();
+		auto path = options->GetField(1)->AsRecordVal()
+			->GetField(0)->AsStringVal()->CheckString();
 		return {{"path", path}};
 		}
 
diff --git a/src/broker/Store.h b/src/broker/Store.h
index e8e4fec03d..186bb519ba 100644
--- a/src/broker/Store.h
+++ b/src/broker/Store.h
@@ -11,14 +11,14 @@
 
 namespace bro_broker {
 
-extern OpaqueType* opaque_of_store_handle;
+extern IntrusivePtr<OpaqueType> opaque_of_store_handle;
 
 /**
  * Create a Broker::QueryStatus value.
  * @param success whether the query status should be set to success or failure.
  * @return a Broker::QueryStatus value.
  */
-EnumVal* query_status(bool success);
+IntrusivePtr<EnumVal> query_status(bool success);
 
 /**
  * @return a Broker::QueryResult value that has a Broker::QueryStatus indicating
@@ -26,9 +26,9 @@ EnumVal* query_status(bool success);
  */
 inline IntrusivePtr<RecordVal> query_result()
 	{
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::QueryResult);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::QueryResult);
 	rval->Assign(0, query_status(false));
-	rval->Assign(1, make_intrusive<RecordVal>(BifType::Record::Broker::Data));
+	rval->Assign(1, make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data));
 	return rval;
 	}
 
@@ -39,7 +39,7 @@ inline IntrusivePtr<RecordVal> query_result()
  */
 inline IntrusivePtr<RecordVal> query_result(IntrusivePtr<RecordVal> data)
 	{
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::QueryResult);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::QueryResult);
 	rval->Assign(0, query_status(true));
 	rval->Assign(1, std::move(data));
 	return rval;
diff --git a/src/broker/comm.bif b/src/broker/comm.bif
index 4d8ee6c096..6b63029f17 100644
--- a/src/broker/comm.bif
+++ b/src/broker/comm.bif
@@ -94,17 +94,17 @@ function Broker::__unpeer%(a: string, p: port%): bool
 function Broker::__peers%(%): PeerInfos
 	%{
 	bro_broker::Manager::ScriptScopeGuard ssg;
-	auto rval = make_intrusive<VectorVal>(internal_type("Broker::PeerInfos")->AsVectorType());
+	auto rval = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("Broker::PeerInfos"));
 	auto i = 0;
 
 	for ( auto& p : broker_mgr->Peers() )
 		{
-		auto pi = internal_type("Broker::PeerInfo")->AsRecordType();
-		auto ei = internal_type("Broker::EndpointInfo")->AsRecordType();
-		auto ni = internal_type("Broker::NetworkInfo")->AsRecordType();
-		auto peer_info = new RecordVal(pi);
-		auto endpoint_info = new RecordVal(ei);
-		auto network_info = new RecordVal(ni);
+		const auto& pi = zeek::id::find_type<RecordType>("Broker::PeerInfo");
+		const auto& ei = zeek::id::find_type<RecordType>("Broker::EndpointInfo");
+		const auto& ni = zeek::id::find_type<RecordType>("Broker::NetworkInfo");
+		auto peer_info = make_intrusive<RecordVal>(pi);
+		auto endpoint_info = make_intrusive<RecordVal>(ei);
+		auto network_info = make_intrusive<RecordVal>(ni);
 		auto n = p.peer.network;
 
 		if ( n )
@@ -119,13 +119,13 @@ function Broker::__peers%(%): PeerInfos
 			}
 
 		endpoint_info->Assign(0, make_intrusive<StringVal>(to_string(p.peer.node)));
-		endpoint_info->Assign(1, network_info);
+		endpoint_info->Assign(1, std::move(network_info));
 
 		auto ps = (BifEnum::Broker::PeerStatus)p.status;
-		peer_info->Assign(0, endpoint_info);
-		peer_info->Assign(1, BifType::Enum::Broker::PeerStatus->GetVal(ps));
+		peer_info->Assign(0, std::move(endpoint_info));
+		peer_info->Assign(1, zeek::BifType::Enum::Broker::PeerStatus->GetVal(ps));
 
-		rval->Assign(i, peer_info);
+		rval->Assign(i, std::move(peer_info));
 		++i;
 		}
 
diff --git a/src/broker/data.bif b/src/broker/data.bif
index c7a7840d30..0cdceff2e9 100644
--- a/src/broker/data.bif
+++ b/src/broker/data.bif
@@ -146,7 +146,7 @@ function Broker::__set_iterator_next%(it: opaque of Broker::SetIterator%): bool
 function Broker::__set_iterator_value%(it: opaque of Broker::SetIterator%): Broker::Data
 	%{
 	auto set_it = static_cast<bro_broker::SetIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	if ( set_it->it == set_it->dat.end() )
 		{
@@ -204,7 +204,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	auto v = bro_broker::val_to_data(val);
@@ -212,7 +212,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	if ( ! v )
 		{
 		builtin_error("invalid Broker data conversion for value argument");
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	try
@@ -225,7 +225,7 @@ function Broker::__table_insert%(t: Broker::Data, key: any, val: any%): Broker::
 	catch (const std::out_of_range&)
 		{
 		table[std::move(*k)] = std::move(*v);
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 	%}
 
@@ -239,13 +239,13 @@ function Broker::__table_remove%(t: Broker::Data, key: any%): Broker::Data
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	auto it = table.find(*k);
 
 	if ( it == table.end() )
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	else
 		{
 		auto rval = bro_broker::make_data_val(move(it->second));
@@ -264,13 +264,13 @@ function Broker::__table_lookup%(t: Broker::Data, key: any%): Broker::Data
 	if ( ! k )
 		{
 		builtin_error("invalid Broker data conversion for key argument");
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 		}
 
 	auto it = table.find(*k);
 
 	if ( it == table.end() )
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	else
 		return bro_broker::make_data_val(it->second);
 	%}
@@ -300,9 +300,9 @@ function Broker::__table_iterator_next%(it: opaque of Broker::TableIterator%): b
 function Broker::__table_iterator_value%(it: opaque of Broker::TableIterator%): Broker::TableItem
 	%{
 	auto ti = static_cast<bro_broker::TableIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::TableItem);
-	auto key_val = new RecordVal(BifType::Record::Broker::Data);
-	auto val_val = new RecordVal(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::TableItem);
+	auto key_val = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
+	auto val_val = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 	rval->Assign(0, key_val);
 	rval->Assign(1, val_val);
 
@@ -367,7 +367,7 @@ function Broker::__vector_replace%(v: Broker::Data, idx: count, d: any%): Broker
 		}
 
 	if ( idx >= vec.size() )
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	auto rval = bro_broker::make_data_val(move(vec[idx]));
 	vec[idx] = std::move(*item);
@@ -380,7 +380,7 @@ function Broker::__vector_remove%(v: Broker::Data, idx: count%): Broker::Data
 	                                                          TYPE_VECTOR, frame);
 
 	if ( idx >= vec.size() )
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	auto rval = bro_broker::make_data_val(move(vec[idx]));
 	vec.erase(vec.begin() + idx);
@@ -393,7 +393,7 @@ function Broker::__vector_lookup%(v: Broker::Data, idx: count%): Broker::Data
 	                                                          TYPE_VECTOR, frame);
 
 	if ( idx >= vec.size() )
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	return bro_broker::make_data_val(vec[idx]);
 	%}
@@ -423,7 +423,7 @@ function Broker::__vector_iterator_next%(it: opaque of Broker::VectorIterator%):
 function Broker::__vector_iterator_value%(it: opaque of Broker::VectorIterator%): Broker::Data
 	%{
 	auto vi = static_cast<bro_broker::VectorIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	if ( vi->it == vi->dat.end() )
 		{
@@ -472,7 +472,7 @@ function Broker::__record_lookup%(r: Broker::Data, idx: count%): Broker::Data
 	                                                        TYPE_RECORD, frame);
 
 	if ( idx >= v.size() || caf::get_if<broker::none>(&v[idx]) )
-		return make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	return bro_broker::make_data_val(v[idx]);
 	%}
@@ -502,7 +502,7 @@ function Broker::__record_iterator_next%(it: opaque of Broker::RecordIterator%):
 function Broker::__record_iterator_value%(it: opaque of Broker::RecordIterator%): Broker::Data
 	%{
 	auto ri = static_cast<bro_broker::RecordIterator*>(it);
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Broker::Data);
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Broker::Data);
 
 	if ( ri->it == ri->dat.end() )
 		{
diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif
index caa373cb68..b88320bcd2 100644
--- a/src/broker/messaging.bif
+++ b/src/broker/messaging.bif
@@ -12,19 +12,19 @@ static bool is_string_set(const BroType* type)
 	if ( ! type->IsSet() )
 		return false;
 
-	auto index_types = type->AsSetType()->IndexTypes();
+	const auto& index_types = type->AsSetType()->IndexTypes();
 
-	if ( index_types->length() != 1 )
+	if ( index_types.size() != 1 )
 		return false;
 
-	return (*index_types)[0]->Tag() == TYPE_STRING;
+	return index_types[0]->Tag() == TYPE_STRING;
 	}
 
 std::set<std::string> val_to_topic_set(Val* val)
 	{
 	std::set<std::string> rval;
 
-	if ( val->Type()->Tag() == TYPE_STRING )
+	if ( val->GetType()->Tag() == TYPE_STRING )
 		rval.emplace(val->AsString()->CheckString());
 	else
 		{
@@ -38,8 +38,8 @@ std::set<std::string> val_to_topic_set(Val* val)
 
 		while ( tbl->NextEntry(k, c) )
 			{
-			auto index = val->AsTableVal()->RecoverIndex(k);
-			rval.emplace(index->Index(0)->AsString()->CheckString());
+			auto index = val->AsTableVal()->RecreateIndex(*k);
+			rval.emplace(index->Idx(0)->AsString()->CheckString());
 			delete k;
 			}
 		}
@@ -53,7 +53,7 @@ static bool publish_event_args(val_list& args, const BroString* topic,
 	bro_broker::Manager::ScriptScopeGuard ssg;
 	auto rval = false;
 
-	if ( args[0]->Type()->Tag() == TYPE_RECORD )
+	if ( args[0]->GetType()->Tag() == TYPE_RECORD )
 		rval = broker_mgr->PublishEvent(topic->CheckString(),
 		                                args[0]->AsRecordVal());
 	else
@@ -185,10 +185,10 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool
 	static Func* topic_func = 0;
 
 	if ( ! topic_func )
-		topic_func = global_scope()->Lookup("Cluster::rr_topic")->ID_Val()->AsFunc();
+		topic_func = global_scope()->Find("Cluster::rr_topic")->GetVal()->AsFunc();
 
 	zeek::Args vl{{NewRef{}, pool}, {NewRef{}, key}};
-	auto topic = topic_func->Call(vl);
+	auto topic = topic_func->Invoke(&vl);
 
 	if ( ! topic->AsString()->Len() )
 		return val_mgr->False();
@@ -222,10 +222,10 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool
 	static Func* topic_func = 0;
 
 	if ( ! topic_func )
-		topic_func = global_scope()->Lookup("Cluster::hrw_topic")->ID_Val()->AsFunc();
+		topic_func = global_scope()->Find("Cluster::hrw_topic")->GetVal()->AsFunc();
 
 	zeek::Args vl{{NewRef{}, pool}, {NewRef{}, key}};
-	auto topic = topic_func->Call(vl);
+	auto topic = topic_func->Invoke(&vl);
 
 	if ( ! topic->AsString()->Len() )
 		return val_mgr->False();
diff --git a/src/event.bif b/src/event.bif
index e894d2f5e3..78bdefc0f9 100644
--- a/src/event.bif
+++ b/src/event.bif
@@ -61,6 +61,24 @@ event zeek_init%(%);
 ##    is not generated.
 event zeek_done%(%);
 
+## Generated as one of the first steps of Zeek's main-loop termination, just
+## before it starts to flush any remaining events/timers/state. The event
+## engine generates this event when Zeek is about to terminate, either due to
+## having exhausted reading its input trace file(s), receiving a termination
+## signal, or because Zeek was run without a network input source and has
+## finished executing any global statements.  This event comes before
+## :zeek:see:`zeek_init`.
+##
+## t: The time at with the Zeek-termination process started.
+##
+## .. zeek:see:: zeek_init zeek_done
+##
+## .. note::
+##
+##    If Zeek terminates due to an invocation of :zeek:id:`exit`, then this event
+##    is not generated.
+event net_done%(t: time%);
+
 ## Generated when network time is initialized. The event engine generates this
 ## event after the network time has been determined but before processing of
 ## packets is started.
@@ -820,6 +838,20 @@ event dns_mapping_new_name%(dm: dns_mapping%);
 ##    dns_mapping_valid
 event dns_mapping_lost_name%(dm: dns_mapping%);
 
+## Generated when an internal DNS lookup returns a different host name than
+## in the past.  Zeek keeps an internal DNS cache for host names
+## and IP addresses it has already resolved. This event is generated when
+## on a subsequent lookup we receive an answer that has a different host
+## string than we already have in the cache.
+##
+## prev: A record describing the old resolver result.
+#
+## latest: A record describing the new resolver result.
+##
+## .. zeek:see:: dns_mapping_altered dns_mapping_new_name dns_mapping_unverified
+##    dns_mapping_valid
+event dns_mapping_name_changed%(prev: dns_mapping, latest: dns_mapping%);
+
 ## Generated when an internal DNS lookup produced a different result than in
 ## the past.  Zeek keeps an internal DNS cache for host names and IP addresses
 ## it has already resolved. This event is generated when a subsequent lookup
diff --git a/src/file_analysis/Analyzer.cc b/src/file_analysis/Analyzer.cc
index 963c4a693d..27066ba826 100644
--- a/src/file_analysis/Analyzer.cc
+++ b/src/file_analysis/Analyzer.cc
@@ -10,7 +10,6 @@ file_analysis::Analyzer::~Analyzer()
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "Destroy file analyzer %s",
 	        file_mgr->GetComponentName(tag).c_str());
-	Unref(args);
 	}
 
 void file_analysis::Analyzer::SetAnalyzerTag(const file_analysis::Tag& arg_tag)
@@ -19,12 +18,28 @@ void file_analysis::Analyzer::SetAnalyzerTag(const file_analysis::Tag& arg_tag)
 	tag = arg_tag;
 	}
 
-file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag, RecordVal* arg_args, File* arg_file)
+file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag,
+                                  IntrusivePtr<RecordVal> arg_args,
+                                  File* arg_file)
 	: tag(arg_tag),
-	  args(arg_args->Ref()->AsRecordVal()),
+	  args(std::move(arg_args)),
 	  file(arg_file),
 	  got_stream_delivery(false),
 	  skip(false)
 	{
 	id = ++id_counter;
 	}
+
+file_analysis::Analyzer::Analyzer(IntrusivePtr<RecordVal> arg_args, File* arg_file)
+	: Analyzer({}, std::move(arg_args), arg_file)
+	{}
+
+file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag,
+                                  RecordVal* arg_args,
+                                  File* arg_file)
+	: Analyzer(arg_tag, {NewRef{}, arg_args}, arg_file)
+	{}
+
+file_analysis::Analyzer::Analyzer(RecordVal* arg_args, File* arg_file)
+	: Analyzer({}, {NewRef{}, arg_args}, arg_file)
+	{}
diff --git a/src/file_analysis/Analyzer.h b/src/file_analysis/Analyzer.h
index 029a4df082..fe0b2bf521 100644
--- a/src/file_analysis/Analyzer.h
+++ b/src/file_analysis/Analyzer.h
@@ -95,7 +95,12 @@ public:
 	/**
 	 * @return the AnalyzerArgs associated with the analyzer.
 	 */
-	RecordVal* Args() const { return args; }
+	const IntrusivePtr<RecordVal>& GetArgs() const
+		{ return args; }
+
+	[[deprecated("Remove in v4.1.  Use GetArgs().")]]
+	RecordVal* Args() const
+		{ return args.get(); }
 
 	/**
 	 * @return the file_analysis::File object to which the analyzer is attached.
@@ -146,6 +151,10 @@ protected:
 	 *        tunable options, if any, related to a particular analyzer type.
 	 * @param arg_file the file to which the the analyzer is being attached.
 	 */
+	Analyzer(file_analysis::Tag arg_tag, IntrusivePtr<RecordVal> arg_args,
+	         File* arg_file);
+
+	[[deprecated("Remove in v4.1..  Construct using IntrusivePtr instead.")]]
 	Analyzer(file_analysis::Tag arg_tag, RecordVal* arg_args, File* arg_file);
 
 	/**
@@ -157,16 +166,16 @@ protected:
 	 *        tunable options, if any, related to a particular analyzer type.
 	 * @param arg_file the file to which the the analyzer is being attached.
 	 */
-	Analyzer(RecordVal* arg_args, File* arg_file)
-	    : Analyzer({}, arg_args, arg_file)
-		{
-		}
+	Analyzer(IntrusivePtr<RecordVal> arg_args, File* arg_file);
+
+	[[deprecated("Remove in v4.1..  Construct using IntrusivePtr instead.")]]
+	Analyzer(RecordVal* arg_args, File* arg_file);
 
 private:
 
 	ID id;	/**< Unique instance ID. */
 	file_analysis::Tag tag;	/**< The particular type of the analyzer instance. */
-	RecordVal* args;	/**< \c AnalyzerArgs val gives tunable analyzer params. */
+	IntrusivePtr<RecordVal> args;	/**< \c AnalyzerArgs val gives tunable analyzer params. */
 	File* file;	/**< The file to which the analyzer is attached. */
 	bool got_stream_delivery;
 	bool skip;
diff --git a/src/file_analysis/AnalyzerSet.cc b/src/file_analysis/AnalyzerSet.cc
index 3ea6f5f925..8d1397e6d6 100644
--- a/src/file_analysis/AnalyzerSet.cc
+++ b/src/file_analysis/AnalyzerSet.cc
@@ -21,8 +21,8 @@ static void analyzer_del_func(void* v)
 AnalyzerSet::AnalyzerSet(File* arg_file) : file(arg_file)
 	{
 	auto t = make_intrusive<TypeList>();
-	t->Append({NewRef{}, file_mgr->GetTagEnumType()});
-	t->Append({NewRef{}, BifType::Record::Files::AnalyzerArgs});
+	t->Append(file_mgr->GetTagType());
+	t->Append(zeek::BifType::Record::Files::AnalyzerArgs);
 	analyzer_hash = new CompositeHash(std::move(t));
 	analyzer_map.SetDeleteFunc(analyzer_del_func);
 	}
@@ -40,60 +40,54 @@ AnalyzerSet::~AnalyzerSet()
 	delete analyzer_hash;
 	}
 
-Analyzer* AnalyzerSet::Find(const file_analysis::Tag& tag, RecordVal* args)
+Analyzer* AnalyzerSet::Find(const file_analysis::Tag& tag,
+                            IntrusivePtr<RecordVal> args)
 	{
-	HashKey* key = GetKey(tag, args);
-	Analyzer* rval = analyzer_map.Lookup(key);
-	delete key;
+	auto key = GetKey(tag, std::move(args));
+	Analyzer* rval = analyzer_map.Lookup(key.get());
 	return rval;
 	}
 
-bool AnalyzerSet::Add(const file_analysis::Tag& tag, RecordVal* args)
+bool AnalyzerSet::Add(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args)
 	{
-	HashKey* key = GetKey(tag, args);
+	auto key = GetKey(tag, args);
 
-	if ( analyzer_map.Lookup(key) )
+	if ( analyzer_map.Lookup(key.get()) )
 		{
 		DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Instantiate analyzer %s skipped: already exists",
 		        file->GetID().c_str(),
 		        file_mgr->GetComponentName(tag).c_str());
 
-		delete key;
 		return true;
 		}
 
-	file_analysis::Analyzer* a = InstantiateAnalyzer(tag, args);
+	file_analysis::Analyzer* a = InstantiateAnalyzer(tag, std::move(args));
 
 	if ( ! a )
-		{
-		delete key;
 		return false;
-		}
 
-	Insert(a, key);
+	Insert(a, std::move(key));
 
 	return true;
 	}
 
-Analyzer* AnalyzerSet::QueueAdd(const file_analysis::Tag& tag, RecordVal* args)
+Analyzer* AnalyzerSet::QueueAdd(const file_analysis::Tag& tag,
+                                IntrusivePtr<RecordVal> args)
 	{
-	HashKey* key = GetKey(tag, args);
-	file_analysis::Analyzer* a = InstantiateAnalyzer(tag, args);
+	auto key = GetKey(tag, args);
+	file_analysis::Analyzer* a = InstantiateAnalyzer(tag, std::move(args));
 
 	if ( ! a )
-		{
-		delete key;
 		return nullptr;
-		}
 
-	mod_queue.push(new AddMod(a, key));
+	mod_queue.push(new AddMod(a, std::move(key)));
 
 	return a;
 	}
 
 bool AnalyzerSet::AddMod::Perform(AnalyzerSet* set)
 	{
-	if ( set->analyzer_map.Lookup(key) )
+	if ( set->analyzer_map.Lookup(key.get()) )
 		{
 		DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Add analyzer %s skipped: already exists",
 		        a->GetFile()->GetID().c_str(),
@@ -103,7 +97,7 @@ bool AnalyzerSet::AddMod::Perform(AnalyzerSet* set)
 		return true;
 		}
 
-	set->Insert(a, key);
+	set->Insert(a, std::move(key));
 
 	return true;
 	}
@@ -111,20 +105,18 @@ bool AnalyzerSet::AddMod::Perform(AnalyzerSet* set)
 void AnalyzerSet::AddMod::Abort()
 	{
 	delete a;
-	delete key;
 	}
 
-bool AnalyzerSet::Remove(const file_analysis::Tag& tag, RecordVal* args)
+bool AnalyzerSet::Remove(const file_analysis::Tag& tag,
+                         IntrusivePtr<RecordVal> args)
 	{
-	return Remove(tag, GetKey(tag, args));
+	return Remove(tag, GetKey(tag, std::move(args)));
 	}
 
-bool AnalyzerSet::Remove(const file_analysis::Tag& tag, HashKey* key)
+bool AnalyzerSet::Remove(const file_analysis::Tag& tag,
+                         std::unique_ptr<HashKey> key)
 	{
-	file_analysis::Analyzer* a =
-	    (file_analysis::Analyzer*) analyzer_map.Remove(key);
-
-	delete key;
+	auto a = (file_analysis::Analyzer*) analyzer_map.Remove(key.get());
 
 	if ( ! a )
 		{
@@ -147,27 +139,28 @@ bool AnalyzerSet::Remove(const file_analysis::Tag& tag, HashKey* key)
 	return true;
 	}
 
-bool AnalyzerSet::QueueRemove(const file_analysis::Tag& tag, RecordVal* args)
+bool AnalyzerSet::QueueRemove(const file_analysis::Tag& tag,
+                              IntrusivePtr<RecordVal> args)
 	{
-	HashKey* key = GetKey(tag, args);
-
-	mod_queue.push(new RemoveMod(tag, key));
-
-	return analyzer_map.Lookup(key);
+	auto key = GetKey(tag, std::move(args));
+	auto rval = analyzer_map.Lookup(key.get());
+	mod_queue.push(new RemoveMod(tag, std::move(key)));
+	return rval;
 	}
 
 bool AnalyzerSet::RemoveMod::Perform(AnalyzerSet* set)
 	{
-	return set->Remove(tag, key);
+	return set->Remove(tag, std::move(key));
 	}
 
-HashKey* AnalyzerSet::GetKey(const file_analysis::Tag& t, RecordVal* args) const
+std::unique_ptr<HashKey> AnalyzerSet::GetKey(const file_analysis::Tag& t,
+                                             IntrusivePtr<RecordVal> args) const
 	{
-	ListVal* lv = new ListVal(TYPE_ANY);
-	lv->Append(t.AsEnumVal()->Ref());
-	lv->Append(args->Ref());
-	HashKey* key = analyzer_hash->ComputeHash(lv, true);
-	Unref(lv);
+	auto lv = make_intrusive<ListVal>(TYPE_ANY);
+	lv->Append(t.AsVal());
+	lv->Append(std::move(args));
+	auto key = analyzer_hash->MakeHashKey(*lv, true);
+
 	if ( ! key )
 		reporter->InternalError("AnalyzerArgs type mismatch");
 
@@ -175,9 +168,9 @@ HashKey* AnalyzerSet::GetKey(const file_analysis::Tag& t, RecordVal* args) const
 	}
 
 file_analysis::Analyzer* AnalyzerSet::InstantiateAnalyzer(const Tag& tag,
-                                                          RecordVal* args) const
+                                                          IntrusivePtr<RecordVal> args) const
 	{
-	file_analysis::Analyzer* a = file_mgr->InstantiateAnalyzer(tag, args, file);
+	auto  a = file_mgr->InstantiateAnalyzer(tag, std::move(args), file);
 
 	if ( ! a )
 		{
@@ -190,12 +183,12 @@ file_analysis::Analyzer* AnalyzerSet::InstantiateAnalyzer(const Tag& tag,
 	return a;
 	}
 
-void AnalyzerSet::Insert(file_analysis::Analyzer* a, HashKey* key)
+void AnalyzerSet::Insert(file_analysis::Analyzer* a,
+                         std::unique_ptr<HashKey> key)
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Add analyzer %s",
 	        file->GetID().c_str(), file_mgr->GetComponentName(a->Tag()).c_str());
-	analyzer_map.Insert(key, a);
-	delete key;
+	analyzer_map.Insert(key.get(), a);
 
 	a->Init();
 	}
diff --git a/src/file_analysis/AnalyzerSet.h b/src/file_analysis/AnalyzerSet.h
index 4605371eef..c0ef1d6fc0 100644
--- a/src/file_analysis/AnalyzerSet.h
+++ b/src/file_analysis/AnalyzerSet.h
@@ -3,6 +3,7 @@
 #pragma once
 
 #include <queue>
+#include <memory>
 
 #include "Dict.h"
 #include "Tag.h"
@@ -42,7 +43,7 @@ public:
 	 * @param args an \c AnalyzerArgs record.
 	 * @return pointer to an analyzer instance, or a null pointer if not found.
 	 */
-	Analyzer* Find(const file_analysis::Tag& tag, RecordVal* args);
+	Analyzer* Find(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Attach an analyzer to #file immediately.
@@ -50,7 +51,7 @@ public:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return true if analyzer was instantiated/attached, else false.
 	 */
-	bool Add(const file_analysis::Tag& tag, RecordVal* args);
+	bool Add(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Queue the attachment of an analyzer to #file.
@@ -59,7 +60,8 @@ public:
 	 * @return if successful, a pointer to a newly instantiated analyzer else
 	 * a null pointer.  The caller does *not* take ownership of the memory.
 	 */
-	file_analysis::Analyzer* QueueAdd(const file_analysis::Tag& tag, RecordVal* args);
+	file_analysis::Analyzer* QueueAdd(const file_analysis::Tag& tag,
+	                                  IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Remove an analyzer from #file immediately.
@@ -67,7 +69,7 @@ public:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return false if analyzer didn't exist and so wasn't removed, else true.
 	 */
-	bool Remove(const file_analysis::Tag& tag, RecordVal* args);
+	bool Remove(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Queue the removal of an analyzer from #file.
@@ -75,7 +77,7 @@ public:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return true if analyzer exists at time of call, else false;
 	 */
-	bool QueueRemove(const file_analysis::Tag& tag, RecordVal* args);
+	bool QueueRemove(const file_analysis::Tag& tag, IntrusivePtr<RecordVal> args);
 
 	/**
 	 * Perform all queued modifications to the current analyzer set.
@@ -108,7 +110,8 @@ protected:
 	 * @param args an \c AnalyzerArgs value which specifies an analyzer.
 	 * @return the hash key calculated from \a args
 	 */
-	HashKey* GetKey(const file_analysis::Tag& tag, RecordVal* args) const;
+	std::unique_ptr<HashKey> GetKey(const file_analysis::Tag& tag,
+	                                IntrusivePtr<RecordVal> args) const;
 
 	/**
 	 * Create an instance of a file analyzer.
@@ -117,14 +120,14 @@ protected:
 	 * @return a new file analyzer instance.
 	 */
 	file_analysis::Analyzer* InstantiateAnalyzer(const file_analysis::Tag& tag,
-	                                             RecordVal* args) const;
+	                                             IntrusivePtr<RecordVal> args) const;
 
 	/**
 	 * Insert an analyzer instance in to the set.
 	 * @param a an analyzer instance.
 	 * @param key the hash key which represents the analyzer's \c AnalyzerArgs.
 	 */
-	void Insert(file_analysis::Analyzer* a, HashKey* key);
+	void Insert(file_analysis::Analyzer* a, std::unique_ptr<HashKey> key);
 
 	/**
 	 * Remove an analyzer instance from the set.
@@ -132,7 +135,7 @@ protected:
 	 *        just used for debugging messages.
 	 * @param key the hash key which represents the analyzer's \c AnalyzerArgs.
 	 */
-	bool Remove(const file_analysis::Tag& tag, HashKey* key);
+	bool Remove(const file_analysis::Tag& tag, std::unique_ptr<HashKey> key);
 
 private:
 
@@ -170,15 +173,15 @@ private:
 		 * @param arg_a an analyzer instance to add to an analyzer set.
 		 * @param arg_key hash key representing the analyzer's \c AnalyzerArgs.
 		 */
-		AddMod(file_analysis::Analyzer* arg_a, HashKey* arg_key)
-			: Modification(), a(arg_a), key(arg_key) {}
+		AddMod(file_analysis::Analyzer* arg_a, std::unique_ptr<HashKey> arg_key)
+			: Modification(), a(arg_a), key(std::move(arg_key)) {}
 		~AddMod() override {}
 		bool Perform(AnalyzerSet* set) override;
 		void Abort() override;
 
 	protected:
 		file_analysis::Analyzer* a;
-		HashKey* key;
+		std::unique_ptr<HashKey> key;
 	};
 
 	/**
@@ -191,15 +194,15 @@ private:
 		 * @param arg_a an analyzer instance to add to an analyzer set.
 		 * @param arg_key hash key representing the analyzer's \c AnalyzerArgs.
 		 */
-		RemoveMod(const file_analysis::Tag& arg_tag, HashKey* arg_key)
-			: Modification(), tag(arg_tag), key(arg_key) {}
+		RemoveMod(const file_analysis::Tag& arg_tag, std::unique_ptr<HashKey> arg_key)
+			: Modification(), tag(arg_tag), key(std::move(arg_key)) {}
 		~RemoveMod() override {}
 		bool Perform(AnalyzerSet* set) override;
-		void Abort() override { delete key; }
+		void Abort() override {}
 
 	protected:
 		file_analysis::Tag tag;
-		HashKey* key;
+		std::unique_ptr<HashKey> key;
 	};
 
 	using ModQueue = std::queue<Modification*>;
diff --git a/src/file_analysis/Component.cc b/src/file_analysis/Component.cc
index 3ed707313e..b2a55ce53d 100644
--- a/src/file_analysis/Component.cc
+++ b/src/file_analysis/Component.cc
@@ -13,6 +13,15 @@ Component::Component(const std::string& name, factory_callback arg_factory, Tag:
 	  plugin::TaggedComponent<file_analysis::Tag>(subtype)
 	{
 	factory = arg_factory;
+	factory_func = nullptr;
+	}
+
+Component::Component(const std::string& name, factory_function arg_factory, Tag::subtype_t subtype)
+	: plugin::Component(plugin::component::FILE_ANALYZER, name),
+	  plugin::TaggedComponent<file_analysis::Tag>(subtype)
+	{
+	factory = nullptr;
+	factory_func = arg_factory;
 	}
 
 void Component::Initialize()
diff --git a/src/file_analysis/Component.h b/src/file_analysis/Component.h
index e63a4db248..1bf5efe7ff 100644
--- a/src/file_analysis/Component.h
+++ b/src/file_analysis/Component.h
@@ -14,6 +14,7 @@ namespace file_analysis {
 
 class File;
 class Analyzer;
+class Manager;
 
 /**
  * Component description for plugins providing file analyzers.
@@ -25,6 +26,7 @@ class Component : public plugin::Component,
                   public plugin::TaggedComponent<file_analysis::Tag> {
 public:
 	typedef Analyzer* (*factory_callback)(RecordVal* args, File* file);
+	using factory_function = Analyzer* (*)(IntrusivePtr<RecordVal> args, File* file);
 
 	/**
 	 * Constructor.
@@ -45,6 +47,9 @@ public:
 	 * analyzer instances can accordingly access it via analyzer::Tag().
 	 * If not used, leave at zero.
 	 */
+	Component(const std::string& name, factory_function factory, Tag::subtype_t subtype = 0);
+
+	[[deprecated("Remove in v4.1.  Use factory_function w/ IntrusivePtr args")]]
 	Component(const std::string& name, factory_callback factory, Tag::subtype_t subtype = 0);
 
 	/**
@@ -62,6 +67,10 @@ public:
 	/**
 	 * Returns the analyzer's factory function.
 	 */
+	factory_function FactoryFunction() const
+		{ return factory_func; }
+
+	[[deprecated("Remove in v4.1.  Use FactoryFunction().")]]
 	factory_callback Factory() const	{ return factory; }
 
 protected:
@@ -71,7 +80,10 @@ protected:
 	void DoDescribe(ODesc* d) const override;
 
 private:
-	factory_callback factory;	// The analyzer's factory callback.
+	friend class file_analysis::Manager;
+
+	factory_callback factory;	// The analyzer's factory callback (deprecated).
+	factory_function factory_func;	// The analyzer's factory callback.
 };
 
 }
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index 064d4bbe9b..4146bf9dd3 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -21,18 +21,18 @@
 
 using namespace file_analysis;
 
-static Val* empty_connection_table()
+static IntrusivePtr<TableVal> empty_connection_table()
 	{
-	auto tbl_index = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, conn_id});
-	tbl_index->Append({NewRef{}, conn_id});
+	auto tbl_index = make_intrusive<TypeList>(zeek::id::conn_id);
+	tbl_index->Append(zeek::id::conn_id);
 	auto tbl_type = make_intrusive<TableType>(std::move(tbl_index),
-	                                          IntrusivePtr{NewRef{}, connection_type});
-	return new TableVal(std::move(tbl_type));
+	                                          zeek::id::connection);
+	return make_intrusive<TableVal>(std::move(tbl_type));
 	}
 
-static RecordVal* get_conn_id_val(const Connection* conn)
+static IntrusivePtr<RecordVal> get_conn_id_val(const Connection* conn)
 	{
-	RecordVal* v = new RecordVal(conn_id);
+	auto v = make_intrusive<RecordVal>(zeek::id::conn_id);
 	v->Assign(0, make_intrusive<AddrVal>(conn->OrigAddr()));
 	v->Assign(1, val_mgr->Port(ntohs(conn->OrigPort()), conn->ConnTransport()));
 	v->Assign(2, make_intrusive<AddrVal>(conn->RespAddr()));
@@ -62,22 +62,22 @@ void File::StaticInit()
 	if ( id_idx != -1 )
 		return;
 
-	id_idx = Idx("id", fa_file_type);
-	parent_id_idx = Idx("parent_id", fa_file_type);
-	source_idx = Idx("source", fa_file_type);
-	is_orig_idx = Idx("is_orig", fa_file_type);
-	conns_idx = Idx("conns", fa_file_type);
-	last_active_idx = Idx("last_active", fa_file_type);
-	seen_bytes_idx = Idx("seen_bytes", fa_file_type);
-	total_bytes_idx = Idx("total_bytes", fa_file_type);
-	missing_bytes_idx = Idx("missing_bytes", fa_file_type);
-	overflow_bytes_idx = Idx("overflow_bytes", fa_file_type);
-	timeout_interval_idx = Idx("timeout_interval", fa_file_type);
-	bof_buffer_size_idx = Idx("bof_buffer_size", fa_file_type);
-	bof_buffer_idx = Idx("bof_buffer", fa_file_type);
-	meta_mime_type_idx = Idx("mime_type", fa_metadata_type);
-	meta_mime_types_idx = Idx("mime_types", fa_metadata_type);
-	meta_inferred_idx = Idx("inferred", fa_metadata_type);
+	id_idx = Idx("id", zeek::id::fa_file);
+	parent_id_idx = Idx("parent_id", zeek::id::fa_file);
+	source_idx = Idx("source", zeek::id::fa_file);
+	is_orig_idx = Idx("is_orig", zeek::id::fa_file);
+	conns_idx = Idx("conns", zeek::id::fa_file);
+	last_active_idx = Idx("last_active", zeek::id::fa_file);
+	seen_bytes_idx = Idx("seen_bytes", zeek::id::fa_file);
+	total_bytes_idx = Idx("total_bytes", zeek::id::fa_file);
+	missing_bytes_idx = Idx("missing_bytes", zeek::id::fa_file);
+	overflow_bytes_idx = Idx("overflow_bytes", zeek::id::fa_file);
+	timeout_interval_idx = Idx("timeout_interval", zeek::id::fa_file);
+	bof_buffer_size_idx = Idx("bof_buffer_size", zeek::id::fa_file);
+	bof_buffer_idx = Idx("bof_buffer", zeek::id::fa_file);
+	meta_mime_type_idx = Idx("mime_type", zeek::id::fa_metadata);
+	meta_mime_types_idx = Idx("mime_types", zeek::id::fa_metadata);
+	meta_inferred_idx = Idx("inferred", zeek::id::fa_metadata);
 	}
 
 File::File(const std::string& file_id, const std::string& source_name, Connection* conn,
@@ -91,7 +91,7 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio
 
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Creating new File object", file_id.c_str());
 
-	val = new RecordVal(fa_file_type);
+	val = make_intrusive<RecordVal>(zeek::id::fa_file);
 	val->Assign(id_idx, make_intrusive<StringVal>(file_id.c_str()));
 	SetSource(source_name);
 
@@ -107,7 +107,6 @@ File::File(const std::string& file_id, const std::string& source_name, Connectio
 File::~File()
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Destroying File object", id.c_str());
-	Unref(val);
 	delete file_reassembler;
 
 	for ( auto a : done_analyzers )
@@ -121,7 +120,7 @@ void File::UpdateLastActivityTime()
 
 double File::GetLastActivityTime() const
 	{
-	return val->Lookup(last_active_idx)->AsTime();
+	return val->GetField(last_active_idx)->AsTime();
 	}
 
 bool File::UpdateConnectionFields(Connection* conn, bool is_orig)
@@ -129,24 +128,21 @@ bool File::UpdateConnectionFields(Connection* conn, bool is_orig)
 	if ( ! conn )
 		return false;
 
-	Val* conns = val->Lookup(conns_idx);
+	Val* conns = val->GetField(conns_idx).get();
 
 	if ( ! conns )
 		{
-		conns = empty_connection_table();
-		val->Assign(conns_idx, conns);
+		auto ect = empty_connection_table();
+		conns = ect.get();
+		val->Assign(conns_idx, std::move(ect));
 		}
 
-	Val* idx = get_conn_id_val(conn);
+	auto idx = get_conn_id_val(conn);
 
-	if ( conns->AsTableVal()->Lookup(idx) )
-		{
-		Unref(idx);
+	if ( conns->AsTableVal()->FindOrDefault(idx) )
 		return false;
-		}
 
-	conns->AsTableVal()->Assign(idx, conn->ConnVal());
-	Unref(idx);
+	conns->AsTableVal()->Assign(std::move(idx), conn->ConnVal());
 	return true;
 	}
 
@@ -155,7 +151,7 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig)
 	if ( conn && FileEventAvailable(file_over_new_connection) )
 		{
 		FileEvent(file_over_new_connection, {
-			IntrusivePtr{NewRef{}, val},
+			val,
 			conn->ConnVal(),
 			val_mgr->Bool(is_orig),
 		});
@@ -164,13 +160,13 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig)
 
 uint64_t File::LookupFieldDefaultCount(int idx) const
 	{
-	auto v = val->LookupWithDefault(idx);
+	auto v = val->GetFieldOrDefault(idx);
 	return v->AsCount();
 	}
 
 double File::LookupFieldDefaultInterval(int idx) const
 	{
-	auto v = val->LookupWithDefault(idx);
+	auto v = val->GetFieldOrDefault(idx);
 	return v->AsInterval();
 	}
 
@@ -187,7 +183,7 @@ int File::Idx(const std::string& field, const RecordType* type)
 
 std::string File::GetSource() const
 	{
-	Val* v = val->Lookup(source_idx);
+	const auto& v = val->GetField(source_idx);
 
 	return v ? v->AsString()->CheckString() : std::string();
 	}
@@ -208,8 +204,12 @@ void File::SetTimeoutInterval(double interval)
 	}
 
 bool File::SetExtractionLimit(RecordVal* args, uint64_t bytes)
+	{ return SetExtractionLimit({NewRef{}, args}, bytes); }
+
+bool File::SetExtractionLimit(IntrusivePtr<RecordVal> args, uint64_t bytes)
 	{
-	Analyzer* a = analyzers.Find(file_mgr->GetComponentTag("EXTRACT"), args);
+	Analyzer* a = analyzers.Find(file_mgr->GetComponentTag("EXTRACT"),
+	                             std::move(args));
 
 	if ( ! a )
 		return false;
@@ -237,7 +237,8 @@ void File::SetTotalBytes(uint64_t size)
 
 bool File::IsComplete() const
 	{
-	Val* total = val->Lookup(total_bytes_idx);
+	const auto& total = val->GetField(total_bytes_idx);
+
 	if ( ! total )
 		return false;
 
@@ -253,6 +254,9 @@ void File::ScheduleInactivityTimer() const
 	}
 
 bool File::AddAnalyzer(file_analysis::Tag tag, RecordVal* args)
+	{ return AddAnalyzer(tag, {NewRef{}, args}); }
+
+bool File::AddAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args)
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Queuing addition of %s analyzer",
 		id.c_str(), file_mgr->GetComponentName(tag).c_str());
@@ -260,15 +264,18 @@ bool File::AddAnalyzer(file_analysis::Tag tag, RecordVal* args)
 	if ( done )
 		return false;
 
-	return analyzers.QueueAdd(tag, args) != nullptr;
+	return analyzers.QueueAdd(tag, std::move(args)) != nullptr;
 	}
 
 bool File::RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args)
+	{ return RemoveAnalyzer(tag, {NewRef{}, args}); }
+
+bool File::RemoveAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args)
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Queuing remove of %s analyzer",
 		id.c_str(), file_mgr->GetComponentName(tag).c_str());
 
-	return done ? false : analyzers.QueueRemove(tag, args);
+	return done ? false : analyzers.QueueRemove(tag, std::move(args));
 	}
 
 void File::EnableReassembly()
@@ -299,11 +306,11 @@ bool File::SetMime(const std::string& mime_type)
 	if ( ! FileEventAvailable(file_sniff) )
 		return false;
 
-	auto meta = make_intrusive<RecordVal>(fa_metadata_type);
+	auto meta = make_intrusive<RecordVal>(zeek::id::fa_metadata);
 	meta->Assign(meta_mime_type_idx, make_intrusive<StringVal>(mime_type));
 	meta->Assign(meta_inferred_idx, val_mgr->False());
 
-	FileEvent(file_sniff, {IntrusivePtr{NewRef{}, val}, std::move(meta)});
+	FileEvent(file_sniff, {val, std::move(meta)});
 	return true;
 	}
 
@@ -311,7 +318,7 @@ void File::InferMetadata()
 	{
 	did_metadata_inference = true;
 
-	Val* bof_buffer_val = val->Lookup(bof_buffer_idx);
+	Val* bof_buffer_val = val->GetField(bof_buffer_idx).get();
 
 	if ( ! bof_buffer_val )
 		{
@@ -319,8 +326,8 @@ void File::InferMetadata()
 			return;
 
 		BroString* bs = concatenate(bof_buffer.chunks);
-		bof_buffer_val = new StringVal(bs);
-		val->Assign(bof_buffer_idx, bof_buffer_val);
+		val->Assign<StringVal>(bof_buffer_idx, bs);
+		bof_buffer_val = val->GetField(bof_buffer_idx).get();
 		}
 
 	if ( ! FileEventAvailable(file_sniff) )
@@ -332,17 +339,17 @@ void File::InferMetadata()
 	len = std::min(len, LookupFieldDefaultCount(bof_buffer_size_idx));
 	file_mgr->DetectMIME(data, len, &matches);
 
-	auto meta = make_intrusive<RecordVal>(fa_metadata_type);
+	auto meta = make_intrusive<RecordVal>(zeek::id::fa_metadata);
 
 	if ( ! matches.empty() )
 		{
-		meta->Assign(meta_mime_type_idx,
-		             new StringVal(*(matches.begin()->second.begin())));
+		meta->Assign<StringVal>(meta_mime_type_idx,
+		                        *(matches.begin()->second.begin()));
 		meta->Assign(meta_mime_types_idx,
 		             file_analysis::GenMIMEMatchesVal(matches));
 		}
 
-	FileEvent(file_sniff, {IntrusivePtr{NewRef{}, val}, std::move(meta)});
+	FileEvent(file_sniff, {val, std::move(meta)});
 	}
 
 bool File::BufferBOF(const u_char* data, uint64_t len)
@@ -413,7 +420,7 @@ void File::DeliverStream(const u_char* data, uint64_t len)
 								bof_buffer.chunks[i]->Len()) )
 						{
 						a->SetSkip(true);
-						analyzers.QueueRemove(a->Tag(), a->Args());
+						analyzers.QueueRemove(a->Tag(), a->GetArgs());
 						}
 					}
 
@@ -430,7 +437,7 @@ void File::DeliverStream(const u_char* data, uint64_t len)
 			if ( ! a->DeliverStream(data, len) )
 				{
 				a->SetSkip(true);
-				analyzers.QueueRemove(a->Tag(), a->Args());
+				analyzers.QueueRemove(a->Tag(), a->GetArgs());
 				}
 			}
 		}
@@ -454,7 +461,7 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
 			if ( FileEventAvailable(file_reassembly_overflow) )
 				{
 				FileEvent(file_reassembly_overflow, {
-					IntrusivePtr{NewRef{}, val},
+					val,
 					val_mgr->Count(current_offset),
 					val_mgr->Count(gap_bytes)
 				});
@@ -501,7 +508,7 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
 			if ( ! a->DeliverChunk(data, len, offset) )
 				{
 				a->SetSkip(true);
-				analyzers.QueueRemove(a->Tag(), a->Args());
+				analyzers.QueueRemove(a->Tag(), a->GetArgs());
 				}
 			}
 		}
@@ -560,7 +567,7 @@ void File::EndOfFile()
 	while ( (a = analyzers.NextEntry(c)) )
 		{
 		if ( ! a->EndOfFile() )
-			analyzers.QueueRemove(a->Tag(), a->Args());
+			analyzers.QueueRemove(a->Tag(), a->GetArgs());
 		}
 
 	FileEvent(file_state_remove);
@@ -593,17 +600,11 @@ void File::Gap(uint64_t offset, uint64_t len)
 	while ( (a = analyzers.NextEntry(c)) )
 		{
 		if ( ! a->Undelivered(offset, len) )
-			analyzers.QueueRemove(a->Tag(), a->Args());
+			analyzers.QueueRemove(a->Tag(), a->GetArgs());
 		}
 
 	if ( FileEventAvailable(file_gap) )
-		{
-		FileEvent(file_gap, {
-			IntrusivePtr{NewRef{}, val},
-			val_mgr->Count(offset),
-			val_mgr->Count(len)
-		});
-		}
+		FileEvent(file_gap, {val, val_mgr->Count(offset), val_mgr->Count(len)});
 
 	analyzers.DrainModifications();
 
@@ -621,7 +622,7 @@ void File::FileEvent(EventHandlerPtr h)
 	if ( ! FileEventAvailable(h) )
 		return;
 
-	FileEvent(h, zeek::Args{{NewRef{}, val}});
+	FileEvent(h, zeek::Args{val});
 	}
 
 void File::FileEvent(EventHandlerPtr h, val_list* vl)
diff --git a/src/file_analysis/File.h b/src/file_analysis/File.h
index 97e6e0817a..f7afe45b77 100644
--- a/src/file_analysis/File.h
+++ b/src/file_analysis/File.h
@@ -38,7 +38,12 @@ public:
 	/**
 	 * @return the wrapped \c fa_file record value, #val.
 	 */
-	RecordVal* GetVal() const { return val; }
+	const IntrusivePtr<RecordVal>& ToVal() const
+		{ return val; }
+
+	[[deprecated("Remove in v4.1.  Use ToVal().")]]
+	RecordVal* GetVal() const
+		{ return val.get(); }
 
 	/**
 	 * @return the value of the "source" field from #val record or an empty
@@ -69,12 +74,15 @@ public:
 	 * @param bytes new limit.
 	 * @return false if no extraction analyzer is active, else true.
 	 */
+	bool SetExtractionLimit(IntrusivePtr<RecordVal> args, uint64_t bytes);
+
+	[[deprecated("Remove in v4.1.  Pass an IntrusivePtr instead.")]]
 	bool SetExtractionLimit(RecordVal* args, uint64_t bytes);
 
 	/**
 	 * @return value of the "id" field from #val record.
 	 */
-	std::string GetID() const { return id; }
+	const std::string& GetID() const { return id; }
 
 	/**
 	 * @return value of "last_active" field in #val record;
@@ -114,6 +122,9 @@ public:
 	 * @param args an \c AnalyzerArgs value representing a file analyzer.
 	 * @return false if analyzer can't be instantiated, else true.
 	 */
+	bool AddAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args);
+
+	[[deprecated("Remove in v4.1.  Pass an IntrusivePtr instead.")]]
 	bool AddAnalyzer(file_analysis::Tag tag, RecordVal* args);
 
 	/**
@@ -122,6 +133,9 @@ public:
 	 * @param args an \c AnalyzerArgs value representing a file analyzer.
 	 * @return true if analyzer was active at time of call, else false.
 	 */
+	bool RemoveAnalyzer(file_analysis::Tag tag, IntrusivePtr<RecordVal> args);
+
+	[[deprecated("Remove in v4.1.  Pass an IntrusivePtr instead.")]]
 	bool RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args);
 
 	/**
@@ -259,7 +273,7 @@ protected:
 	void IncrementByteCount(uint64_t size, int field_idx);
 
 	/**
-	 * Wrapper to RecordVal::LookupWithDefault for the field in #val at index
+	 * Wrapper to RecordVal::GetFieldOrDefault for the field in #val at index
 	 * \a idx which automatically unrefs the Val and returns a converted value.
 	 * @param idx the index of a field of type "count" in \c fa_file.
 	 * @return the value of the field, which may be it &default.
@@ -267,7 +281,7 @@ protected:
 	uint64_t LookupFieldDefaultCount(int idx) const;
 
 	/**
-	 * Wrapper to RecordVal::LookupWithDefault for the field in #val at index
+	 * Wrapper to RecordVal::GetFieldOrDefault for the field in #val at index
 	 * \a idx which automatically unrefs the Val and returns a converted value.
 	 * @param idx the index of a field of type "interval" in \c fa_file.
 	 * @return the value of the field, which may be it &default.
@@ -323,6 +337,8 @@ protected:
 	 * @return the field offset in #val record corresponding to \a field_name.
 	 */
 	static int Idx(const std::string& field_name, const RecordType* type);
+	static int Idx(const std::string& field_name, const IntrusivePtr<RecordType>& type)
+		{ return Idx(field_name, type.get()); }
 
 	/**
 	 * Initializes static member.
@@ -331,7 +347,7 @@ protected:
 
 protected:
 	std::string id;                 /**< A pretty hash that likely identifies file */
-	RecordVal* val;            /**< \c fa_file from script layer. */
+	IntrusivePtr<RecordVal> val;            /**< \c fa_file from script layer. */
 	FileReassembler* file_reassembler; /**< A reassembler for the file if it's needed. */
 	uint64_t stream_offset;      /**< The offset of the file which has been forwarded. */
 	uint64_t reassembly_max_buffer;      /**< Maximum allowed buffer for reassembly. */
diff --git a/src/file_analysis/Manager.cc b/src/file_analysis/Manager.cc
index f3face2d79..1c2465c415 100644
--- a/src/file_analysis/Manager.cc
+++ b/src/file_analysis/Manager.cc
@@ -3,7 +3,6 @@
 #include "Manager.h"
 #include "File.h"
 #include "Analyzer.h"
-#include "Var.h"
 #include "Event.h"
 #include "UID.h"
 #include "digest.h"
@@ -261,35 +260,47 @@ bool Manager::SetReassemblyBuffer(const string& file_id, uint64_t max)
 
 bool Manager::SetExtractionLimit(const string& file_id, RecordVal* args,
                                  uint64_t n) const
+	{ return SetExtractionLimit(file_id, {NewRef{}, args}, n); }
+
+bool Manager::SetExtractionLimit(const string& file_id,
+                                 IntrusivePtr<RecordVal> args, uint64_t n) const
 	{
 	File* file = LookupFile(file_id);
 
 	if ( ! file )
 		return false;
 
-	return file->SetExtractionLimit(args, n);
+	return file->SetExtractionLimit(std::move(args), n);
 	}
 
 bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag,
                           RecordVal* args) const
+	{ return AddAnalyzer(file_id, tag, {NewRef{}, args}); }
+
+bool Manager::AddAnalyzer(const string& file_id, const file_analysis::Tag& tag,
+                          IntrusivePtr<RecordVal> args) const
 	{
 	File* file = LookupFile(file_id);
 
 	if ( ! file )
 		return false;
 
-	return file->AddAnalyzer(tag, args);
+	return file->AddAnalyzer(tag, std::move(args));
 	}
 
 bool Manager::RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag,
                              RecordVal* args) const
+	{ return RemoveAnalyzer(file_id, tag, {NewRef{}, args}); }
+
+bool Manager::RemoveAnalyzer(const string& file_id, const file_analysis::Tag& tag,
+                             IntrusivePtr<RecordVal> args) const
 	{
 	File* file = LookupFile(file_id);
 
 	if ( ! file )
 		return false;
 
-	return file->RemoveAnalyzer(tag, args);
+	return file->RemoveAnalyzer(tag, std::move(args));
 	}
 
 File* Manager::GetFile(const string& file_id, Connection* conn,
@@ -397,10 +408,10 @@ bool Manager::RemoveFile(const string& file_id)
 	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Remove file", file_id.c_str());
 
 	f->EndOfFile();
-	delete f;
 
 	id_map.erase(file_id);
 	ignored.erase(file_id);
+	delete f;
 	return true;
 	}
 
@@ -422,13 +433,9 @@ string Manager::GetFileID(const analyzer::Tag& tag, Connection* c, bool is_orig)
 	DBG_LOG(DBG_FILE_ANALYSIS, "Raise get_file_handle() for protocol analyzer %s",
 		analyzer_mgr->GetComponentName(tag).c_str());
 
-	EnumVal* tagval = tag.AsEnumVal();
+	const auto& tagval = tag.AsVal();
 
-	mgr.Enqueue(get_file_handle,
-		IntrusivePtr{NewRef{}, tagval},
-		c->ConnVal(),
-		val_mgr->Bool(is_orig)
-	);
+	mgr.Enqueue(get_file_handle, tagval, c->ConnVal(), val_mgr->Bool(is_orig));
 	mgr.Drain(); // need file handle immediately so we don't have to buffer data
 	return current_file_id;
 	}
@@ -436,10 +443,10 @@ string Manager::GetFileID(const analyzer::Tag& tag, Connection* c, bool is_orig)
 bool Manager::IsDisabled(const analyzer::Tag& tag)
 	{
 	if ( ! disabled )
-		disabled = internal_const_val("Files::disable")->AsTableVal();
+		disabled = zeek::id::find_const("Files::disable")->AsTableVal();
 
 	auto index = val_mgr->Count(bool(tag));
-	auto yield = disabled->Lookup(index.get());
+	auto yield = disabled->FindOrDefault(index);
 
 	if ( ! yield )
 		return false;
@@ -448,6 +455,11 @@ bool Manager::IsDisabled(const analyzer::Tag& tag)
 	}
 
 Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f) const
+	{ return InstantiateAnalyzer(tag, {NewRef{}, args}, f); }
+
+Analyzer* Manager::InstantiateAnalyzer(const Tag& tag,
+                                       IntrusivePtr<RecordVal> args,
+                                       File* f) const
 	{
 	Component* c = Lookup(tag);
 
@@ -459,18 +471,22 @@ Analyzer* Manager::InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f)
 		return nullptr;
 		}
 
-	if ( ! c->Factory() )
+	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Instantiate analyzer %s",
+	        f->id.c_str(), GetComponentName(tag).c_str());
+
+	Analyzer* a;
+
+	if ( c->factory_func )
+		a = c->factory_func(std::move(args), f);
+	else if ( c->factory )
+		a = c->factory(args.get(), f);
+	else
 		{
 		reporter->InternalWarning("file analyzer %s cannot be instantiated "
-					  "dynamically", c->CanonicalName().c_str());
+		                          "dynamically", c->CanonicalName().c_str());
 		return nullptr;
 		}
 
-	DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Instantiate analyzer %s",
-		f->id.c_str(), GetComponentName(tag).c_str());
-
-	Analyzer* a = c->Factory()(args, f);
-
 	if ( ! a )
 		reporter->InternalError("file analyzer instantiation failed");
 
@@ -503,6 +519,8 @@ string Manager::DetectMIME(const u_char* data, uint64_t len) const
 
 IntrusivePtr<VectorVal> file_analysis::GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m)
 	{
+	static auto mime_matches = zeek::id::find_type<VectorType>("mime_matches");
+	static auto mime_match = zeek::id::find_type<RecordType>("mime_match");
 	auto rval = make_intrusive<VectorVal>(mime_matches);
 
 	for ( RuleMatcher::MIME_Matches::const_iterator it = m.begin();
diff --git a/src/file_analysis/Manager.h b/src/file_analysis/Manager.h
index 8d619d04bd..4f8874a0a1 100644
--- a/src/file_analysis/Manager.h
+++ b/src/file_analysis/Manager.h
@@ -253,6 +253,10 @@ public:
 	 * @return false if file identifier and analyzer did not map to anything,
 	 *         else true.
 	 */
+	bool SetExtractionLimit(const std::string& file_id,
+	                        IntrusivePtr<RecordVal> args, uint64_t n) const;
+
+	[[deprecated("Remove in v4.1.  Pass IntrusivePtr args param instead.")]]
 	bool SetExtractionLimit(const std::string& file_id, RecordVal* args,
 	                        uint64_t n) const;
 
@@ -273,6 +277,10 @@ public:
 	 * @param args a \c AnalyzerArgs value which describes a file analyzer.
 	 * @return false if the analyzer failed to be instantiated, else true.
 	 */
+	bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
+	                 IntrusivePtr<RecordVal> args) const;
+
+	[[deprecated("Remove in v4.1.  Pass IntrusivePtr args param instead.")]]
 	bool AddAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
 	                 RecordVal* args) const;
 
@@ -283,6 +291,10 @@ public:
 	 * @param args a \c AnalyzerArgs value which describes a file analyzer.
 	 * @return true if the analyzer is active at the time of call, else false.
 	 */
+	bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
+	                    IntrusivePtr<RecordVal> args) const;
+
+	[[deprecated("Remove in v4.1.  Pass IntrusivePtr args param instead.")]]
 	bool RemoveAnalyzer(const std::string& file_id, const file_analysis::Tag& tag,
 	                    RecordVal* args) const;
 
@@ -300,6 +312,10 @@ public:
 	 * @param f The file analzer is to be associated with.
 	 * @return The new analyzer instance or null if tag is invalid.
 	 */
+	Analyzer* InstantiateAnalyzer(const Tag& tag, IntrusivePtr<RecordVal> args,
+	                              File* f) const;
+
+	[[deprecated("Remove in v4.1.  Pass in IntrusivePtr args instead.")]]
 	Analyzer* InstantiateAnalyzer(const Tag& tag, RecordVal* args, File* f) const;
 
 	/**
diff --git a/src/file_analysis/Tag.cc b/src/file_analysis/Tag.cc
index 30958ed605..1789600f26 100644
--- a/src/file_analysis/Tag.cc
+++ b/src/file_analysis/Tag.cc
@@ -8,7 +8,7 @@ using namespace file_analysis;
 const file_analysis::Tag file_analysis::Tag::Error;
 
 file_analysis::Tag::Tag(type_t type, subtype_t subtype)
-	: ::Tag(file_mgr->GetTagEnumType(), type, subtype)
+	: ::Tag(file_mgr->GetTagType(), type, subtype)
 	{
 	}
 
@@ -18,7 +18,20 @@ file_analysis::Tag& file_analysis::Tag::operator=(const file_analysis::Tag& othe
 	return *this;
 	}
 
+const IntrusivePtr<EnumVal>& file_analysis::Tag::AsVal() const
+	{
+	return ::Tag::AsVal(file_mgr->GetTagType());
+	}
+
 EnumVal* file_analysis::Tag::AsEnumVal() const
 	{
-	return ::Tag::AsEnumVal(file_mgr->GetTagEnumType());
+	return AsVal().get();
 	}
+
+file_analysis::Tag::Tag(IntrusivePtr<EnumVal> val)
+	: ::Tag(std::move(val))
+	{ }
+
+file_analysis::Tag::Tag(EnumVal* val)
+	: ::Tag({NewRef{}, val})
+	{ }
diff --git a/src/file_analysis/Tag.h b/src/file_analysis/Tag.h
index 6f5dae6b03..8c434e20e6 100644
--- a/src/file_analysis/Tag.h
+++ b/src/file_analysis/Tag.h
@@ -82,6 +82,9 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
+	const IntrusivePtr<EnumVal>& AsVal() const;
+
+	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
 
 	static const Tag Error;
@@ -107,7 +110,10 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Files::Tag.
 	 */
-	explicit Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(IntrusivePtr<EnumVal> val);
+
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
+	explicit Tag(EnumVal* val);
 };
 
 }
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.cc b/src/file_analysis/analyzer/data_event/DataEvent.cc
index df3f31348b..04175723af 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.cc
+++ b/src/file_analysis/analyzer/data_event/DataEvent.cc
@@ -11,18 +11,19 @@
 
 using namespace file_analysis;
 
-DataEvent::DataEvent(RecordVal* args, File* file,
+DataEvent::DataEvent(IntrusivePtr<RecordVal> args, File* file,
                      EventHandlerPtr ce, EventHandlerPtr se)
     : file_analysis::Analyzer(file_mgr->GetComponentTag("DATA_EVENT"),
-	                          args, file),
+	                          std::move(args), file),
 	chunk_event(ce), stream_event(se)
 	{
 	}
 
-file_analysis::Analyzer* DataEvent::Instantiate(RecordVal* args, File* file)
+file_analysis::Analyzer* DataEvent::Instantiate(IntrusivePtr<RecordVal> args,
+                                                File* file)
 	{
-	auto chunk_val = args->Lookup("chunk_event");
-	auto stream_val = args->Lookup("stream_event");
+	const auto& chunk_val = args->GetField("chunk_event");
+	const auto& stream_val = args->GetField("stream_event");
 
 	if ( ! chunk_val && ! stream_val ) return nullptr;
 
@@ -35,7 +36,7 @@ file_analysis::Analyzer* DataEvent::Instantiate(RecordVal* args, File* file)
 	if ( stream_val )
 		stream = event_registry->Lookup(stream_val->AsFunc()->Name());
 
-	return new DataEvent(args, file, chunk, stream);
+	return new DataEvent(std::move(args), file, chunk, stream);
 	}
 
 bool DataEvent::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
@@ -43,7 +44,7 @@ bool DataEvent::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
 	if ( ! chunk_event ) return true;
 
 	mgr.Enqueue(chunk_event,
-		IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+		GetFile()->ToVal(),
 		make_intrusive<StringVal>(new BroString(data, len, false)),
 		val_mgr->Count(offset)
 	);
@@ -56,7 +57,7 @@ bool DataEvent::DeliverStream(const u_char* data, uint64_t len)
 	if ( ! stream_event ) return true;
 
 	mgr.Enqueue(stream_event,
-		IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+		GetFile()->ToVal(),
 		make_intrusive<StringVal>(new BroString(data, len, false))
 	);
 
diff --git a/src/file_analysis/analyzer/data_event/DataEvent.h b/src/file_analysis/analyzer/data_event/DataEvent.h
index 5027fd78ed..c1dd1ab64b 100644
--- a/src/file_analysis/analyzer/data_event/DataEvent.h
+++ b/src/file_analysis/analyzer/data_event/DataEvent.h
@@ -43,7 +43,8 @@ public:
 	 * @return the new DataEvent analyzer instance or a null pointer if
 	 *         no "chunk_event" or "stream_event" field was specfied in \a args.
 	 */
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file);
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file);
 
 protected:
 
@@ -56,7 +57,7 @@ protected:
 	 * @param se pointer to event handler which will be called to receive
 	 *        sequential file data.
 	 */
-	DataEvent(RecordVal* args, File* file,
+	DataEvent(IntrusivePtr<RecordVal> args, File* file,
 	          EventHandlerPtr ce, EventHandlerPtr se);
 
 private:
diff --git a/src/file_analysis/analyzer/entropy/Entropy.cc b/src/file_analysis/analyzer/entropy/Entropy.cc
index ab96947d30..443a97b729 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.cc
+++ b/src/file_analysis/analyzer/entropy/Entropy.cc
@@ -9,8 +9,9 @@
 
 using namespace file_analysis;
 
-Entropy::Entropy(RecordVal* args, File* file)
-    : file_analysis::Analyzer(file_mgr->GetComponentTag("ENTROPY"), args, file)
+Entropy::Entropy(IntrusivePtr<RecordVal> args, File* file)
+    : file_analysis::Analyzer(file_mgr->GetComponentTag("ENTROPY"),
+                              std::move(args), file)
 	{
 	//entropy->Init();
 	entropy = new EntropyVal;
@@ -22,9 +23,10 @@ Entropy::~Entropy()
 	Unref(entropy);
 	}
 
-file_analysis::Analyzer* Entropy::Instantiate(RecordVal* args, File* file)
+file_analysis::Analyzer* Entropy::Instantiate(IntrusivePtr<RecordVal> args,
+                                              File* file)
 	{
-	return new Entropy(args, file);
+	return new Entropy(std::move(args), file);
 	}
 
 bool Entropy::DeliverStream(const u_char* data, uint64_t len)
@@ -60,6 +62,7 @@ void Entropy::Finalize()
 	montepi = scc = ent = mean = chisq = 0.0;
 	entropy->Get(&ent, &chisq, &mean, &montepi, &scc);
 
+	static auto entropy_test_result = zeek::id::find_type<RecordType>("entropy_test_result");
 	auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
 	ent_result->Assign(0, make_intrusive<Val>(ent,     TYPE_DOUBLE));
 	ent_result->Assign(1, make_intrusive<Val>(chisq,   TYPE_DOUBLE));
@@ -68,7 +71,7 @@ void Entropy::Finalize()
 	ent_result->Assign(4, make_intrusive<Val>(scc,     TYPE_DOUBLE));
 
 	mgr.Enqueue(file_entropy,
-		IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+		GetFile()->ToVal(),
 		std::move(ent_result)
 	);
 	}
diff --git a/src/file_analysis/analyzer/entropy/Entropy.h b/src/file_analysis/analyzer/entropy/Entropy.h
index d316291a5f..2f65f1aa56 100644
--- a/src/file_analysis/analyzer/entropy/Entropy.h
+++ b/src/file_analysis/analyzer/entropy/Entropy.h
@@ -31,7 +31,8 @@ public:
 	 * @return the new Entropy analyzer instance or a null pointer if the
 	 *         the "extraction_file" field of \a args wasn't set.
 	 */
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file);
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file);
 
 	/**
 	 * Calculate entropy of next chunk of file contents.
@@ -65,7 +66,7 @@ protected:
 	 * @param hv specific hash calculator object.
 	 * @param kind human readable name of the hash algorithm to use.
 	 */
-	Entropy(RecordVal* args, File* file);
+	Entropy(IntrusivePtr<RecordVal> args, File* file);
 
 	/**
 	 * If some file contents have been seen, finalizes the entropy of them and
diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc
index aa0ba1cbca..869c8e8724 100644
--- a/src/file_analysis/analyzer/extract/Extract.cc
+++ b/src/file_analysis/analyzer/extract/Extract.cc
@@ -10,9 +10,10 @@
 
 using namespace file_analysis;
 
-Extract::Extract(RecordVal* args, File* file, const std::string& arg_filename,
-                 uint64_t arg_limit)
-    : file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"), args, file),
+Extract::Extract(IntrusivePtr<RecordVal> args, File* file,
+                 const std::string& arg_filename, uint64_t arg_limit)
+    : file_analysis::Analyzer(file_mgr->GetComponentTag("EXTRACT"),
+                              std::move(args), file),
       filename(arg_filename), limit(arg_limit), depth(0)
 	{
 	fd = open(filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC | O_APPEND, 0666);
@@ -32,9 +33,10 @@ Extract::~Extract()
 		safe_close(fd);
 	}
 
-static IntrusivePtr<Val> get_extract_field_val(RecordVal* args, const char* name)
+static const IntrusivePtr<Val>& get_extract_field_val(const IntrusivePtr<RecordVal>& args,
+                                                      const char* name)
 	{
-	auto rval = args->Lookup(name);
+	const auto& rval = args->GetField(name);
 
 	if ( ! rval )
 		reporter->Error("File extraction analyzer missing arg field: %s", name);
@@ -42,15 +44,15 @@ static IntrusivePtr<Val> get_extract_field_val(RecordVal* args, const char* name
 	return rval;
 	}
 
-file_analysis::Analyzer* Extract::Instantiate(RecordVal* args, File* file)
+file_analysis::Analyzer* Extract::Instantiate(IntrusivePtr<RecordVal> args, File* file)
 	{
-	auto fname = get_extract_field_val(args, "extract_filename");
-	auto limit = get_extract_field_val(args, "extract_limit");
+	const auto& fname = get_extract_field_val(args, "extract_filename");
+	const auto& limit = get_extract_field_val(args, "extract_limit");
 
 	if ( ! fname || ! limit )
 		return nullptr;
 
-	return new Extract(args, file, fname->AsString()->CheckString(),
+	return new Extract(std::move(args), file, fname->AsString()->CheckString(),
 	                   limit->AsCount());
 	}
 
@@ -92,8 +94,8 @@ bool Extract::DeliverStream(const u_char* data, uint64_t len)
 		{
 		File* f = GetFile();
 		f->FileEvent(file_extraction_limit, {
-			IntrusivePtr{NewRef{}, f->GetVal()},
-			IntrusivePtr{NewRef{}, Args()},
+			f->ToVal(),
+			GetArgs(),
 			val_mgr->Count(limit),
 			val_mgr->Count(len)
 		});
diff --git a/src/file_analysis/analyzer/extract/Extract.h b/src/file_analysis/analyzer/extract/Extract.h
index 5d2cd5b10b..c51e2e1a80 100644
--- a/src/file_analysis/analyzer/extract/Extract.h
+++ b/src/file_analysis/analyzer/extract/Extract.h
@@ -47,7 +47,8 @@ public:
 	 * @return the new Extract analyzer instance or a null pointer if the
 	 *         the "extraction_file" field of \a args wasn't set.
 	 */
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file);
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file);
 
 	/**
 	 * Sets the maximum allowed extracted file size.  A value of zero means
@@ -66,8 +67,8 @@ protected:
 	 *        to which the contents of the file will be extracted/written.
 	 * @param arg_limit the maximum allowed file size.
 	 */
-	Extract(RecordVal* args, File* file, const std::string& arg_filename,
-	        uint64_t arg_limit);
+	Extract(IntrusivePtr<RecordVal> args, File* file,
+	        const std::string& arg_filename, uint64_t arg_limit);
 
 private:
 	std::string filename;
diff --git a/src/file_analysis/analyzer/extract/functions.bif b/src/file_analysis/analyzer/extract/functions.bif
index 9b80700755..9d76849f23 100644
--- a/src/file_analysis/analyzer/extract/functions.bif
+++ b/src/file_analysis/analyzer/extract/functions.bif
@@ -10,9 +10,10 @@ module FileExtract;
 ## :zeek:see:`FileExtract::set_limit`.
 function FileExtract::__set_limit%(file_id: string, args: any, n: count%): bool
 	%{
-	using BifType::Record::Files::AnalyzerArgs;
+	using zeek::BifType::Record::Files::AnalyzerArgs;
 	auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
-	bool result = file_mgr->SetExtractionLimit(file_id->CheckString(), rv.get(), n);
+	bool result = file_mgr->SetExtractionLimit(file_id->CheckString(),
+	                                           std::move(rv), n);
 	return val_mgr->Bool(result);
 	%}
 
diff --git a/src/file_analysis/analyzer/hash/Hash.cc b/src/file_analysis/analyzer/hash/Hash.cc
index a4b0a8930d..011b6ef443 100644
--- a/src/file_analysis/analyzer/hash/Hash.cc
+++ b/src/file_analysis/analyzer/hash/Hash.cc
@@ -9,8 +9,10 @@
 
 using namespace file_analysis;
 
-Hash::Hash(RecordVal* args, File* file, HashVal* hv, const char* arg_kind)
-	: file_analysis::Analyzer(file_mgr->GetComponentTag(to_upper(arg_kind).c_str()), args, file), hash(hv), fed(false), kind(arg_kind)
+Hash::Hash(IntrusivePtr<RecordVal> args, File* file, HashVal* hv, const char* arg_kind)
+	: file_analysis::Analyzer(file_mgr->GetComponentTag(to_upper(arg_kind).c_str()),
+	                          std::move(args), file),
+	  hash(hv), fed(false), kind(arg_kind)
 	{
 	hash->Init();
 	}
@@ -52,7 +54,7 @@ void Hash::Finalize()
 		return;
 
 	mgr.Enqueue(file_hash,
-		IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+		GetFile()->ToVal(),
 		make_intrusive<StringVal>(kind),
 		hash->Get()
 	);
diff --git a/src/file_analysis/analyzer/hash/Hash.h b/src/file_analysis/analyzer/hash/Hash.h
index 903fc7d6f7..190152d1c3 100644
--- a/src/file_analysis/analyzer/hash/Hash.h
+++ b/src/file_analysis/analyzer/hash/Hash.h
@@ -56,7 +56,7 @@ protected:
 	 * @param hv specific hash calculator object.
 	 * @param kind human readable name of the hash algorithm to use.
 	 */
-	Hash(RecordVal* args, File* file, HashVal* hv, const char* kind);
+	Hash(IntrusivePtr<RecordVal> args, File* file, HashVal* hv, const char* kind);
 
 	/**
 	 * If some file contents have been seen, finalizes the hash of them and
@@ -83,8 +83,9 @@ public:
 	 * @return the new MD5 analyzer instance or a null pointer if there's no
 	 *         handler for the "file_hash" event.
 	 */
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return file_hash ? new MD5(args, file) : nullptr; }
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file)
+		{ return file_hash ? new MD5(std::move(args), file) : nullptr; }
 
 protected:
 
@@ -93,8 +94,8 @@ protected:
 	 * @param args the \c AnalyzerArgs value which represents the analyzer.
 	 * @param file the file to which the analyzer will be attached.
 	 */
-	MD5(RecordVal* args, File* file)
-		: Hash(args, file, new MD5Val(), "md5")
+	MD5(IntrusivePtr<RecordVal> args, File* file)
+		: Hash(std::move(args), file, new MD5Val(), "md5")
 		{}
 };
 
@@ -111,8 +112,9 @@ public:
 	 * @return the new MD5 analyzer instance or a null pointer if there's no
 	 *         handler for the "file_hash" event.
 	 */
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return file_hash ? new SHA1(args, file) : nullptr; }
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file)
+		{ return file_hash ? new SHA1(std::move(args), file) : nullptr; }
 
 protected:
 
@@ -121,8 +123,8 @@ protected:
 	 * @param args the \c AnalyzerArgs value which represents the analyzer.
 	 * @param file the file to which the analyzer will be attached.
 	 */
-	SHA1(RecordVal* args, File* file)
-		: Hash(args, file, new SHA1Val(), "sha1")
+	SHA1(IntrusivePtr<RecordVal> args, File* file)
+		: Hash(std::move(args), file, new SHA1Val(), "sha1")
 		{}
 };
 
@@ -139,8 +141,9 @@ public:
 	 * @return the new MD5 analyzer instance or a null pointer if there's no
 	 *         handler for the "file_hash" event.
 	 */
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return file_hash ? new SHA256(args, file) : nullptr; }
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file)
+		{ return file_hash ? new SHA256(std::move(args), file) : nullptr; }
 
 protected:
 
@@ -149,8 +152,8 @@ protected:
 	 * @param args the \c AnalyzerArgs value which represents the analyzer.
 	 * @param file the file to which the analyzer will be attached.
 	 */
-	SHA256(RecordVal* args, File* file)
-		: Hash(args, file, new SHA256Val(), "sha256")
+	SHA256(IntrusivePtr<RecordVal> args, File* file)
+		: Hash(std::move(args), file, new SHA256Val(), "sha256")
 		{}
 };
 
diff --git a/src/file_analysis/analyzer/pe/PE.cc b/src/file_analysis/analyzer/pe/PE.cc
index 20ecadc3bf..0962f51dfa 100644
--- a/src/file_analysis/analyzer/pe/PE.cc
+++ b/src/file_analysis/analyzer/pe/PE.cc
@@ -3,8 +3,9 @@
 
 using namespace file_analysis;
 
-PE::PE(RecordVal* args, File* file)
-    : file_analysis::Analyzer(file_mgr->GetComponentTag("PE"), args, file)
+PE::PE(IntrusivePtr<RecordVal> args, File* file)
+    : file_analysis::Analyzer(file_mgr->GetComponentTag("PE"), std::move(args),
+                              file)
 	{
 	conn = new binpac::PE::MockConnection(this);
 	interp = new binpac::PE::File(conn);
diff --git a/src/file_analysis/analyzer/pe/PE.h b/src/file_analysis/analyzer/pe/PE.h
index 3a1c9befc0..87a82825f4 100644
--- a/src/file_analysis/analyzer/pe/PE.h
+++ b/src/file_analysis/analyzer/pe/PE.h
@@ -15,15 +15,16 @@ class PE : public file_analysis::Analyzer {
 public:
 	~PE();
 
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return new PE(args, file); }
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file)
+		{ return new PE(std::move(args), file); }
 
 	virtual bool DeliverStream(const u_char* data, uint64_t len);
 
 	virtual bool EndOfFile();
 
 protected:
-	PE(RecordVal* args, File* file);
+	PE(IntrusivePtr<RecordVal> args, File* file);
 	binpac::PE::File* interp;
 	binpac::PE::MockConnection* conn;
 	bool done;
diff --git a/src/file_analysis/analyzer/pe/pe-analyzer.pac b/src/file_analysis/analyzer/pe/pe-analyzer.pac
index 56f110563a..e9da2468d3 100644
--- a/src/file_analysis/analyzer/pe/pe-analyzer.pac
+++ b/src/file_analysis/analyzer/pe/pe-analyzer.pac
@@ -5,43 +5,48 @@
 %}
 
 %header{
-VectorVal* process_rvas(const RVAS* rvas);
+IntrusivePtr<VectorVal> process_rvas(const RVAS* rvas);
+IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len);
 %}
 
 %code{
-VectorVal* process_rvas(const RVAS* rva_table)
+IntrusivePtr<VectorVal> process_rvas(const RVAS* rva_table)
 	{
-	VectorVal* rvas = new VectorVal(internal_type("index_vec")->AsVectorType());
+	auto rvas = make_intrusive<VectorVal>(zeek::id::index_vec);
+
 	for ( uint16 i=0; i < rva_table->rvas()->size(); ++i )
 		rvas->Assign(i, val_mgr->Count((*rva_table->rvas())[i]->size()));
 
 	return rvas;
 	}
+
+IntrusivePtr<TableVal> characteristics_to_bro(uint32_t c, uint8_t len)
+	{
+	uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF;
+	auto char_set = make_intrusive<TableVal>(zeek::id::count_set);
+
+	for ( uint16 i=0; i < len; ++i )
+		{
+		if ( ((c >> i) & 0x1) == 1 )
+			{
+			auto ch = val_mgr->Count((1<<i)&mask);
+			char_set->Assign(std::move(ch), 0);
+			}
+		}
+
+	return char_set;
+	}
 %}
 
 
 refine flow File += {
 
-	function characteristics_to_bro(c: uint32, len: uint8): TableVal
-		%{
-		uint64 mask = (len==16) ? 0xFFFF : 0xFFFFFFFF;
-		TableVal* char_set = new TableVal({NewRef{}, internal_type("count_set")->AsTableType()});
-		for ( uint16 i=0; i < len; ++i )
-			{
-			if ( ((c >> i) & 0x1) == 1 )
-				{
-				auto ch = val_mgr->Count((1<<i)&mask);
-				char_set->Assign(ch.get(), 0);
-				}
-			}
-		return char_set;
-		%}
 
 	function proc_dos_header(h: DOS_Header): bool
 		%{
 		if ( pe_dos_header )
 			{
-			auto dh = make_intrusive<RecordVal>(BifType::Record::PE::DOSHeader);
+			auto dh = make_intrusive<RecordVal>(zeek::BifType::Record::PE::DOSHeader);
 			dh->Assign(0, make_intrusive<StringVal>(${h.signature}.length(), (const char*) ${h.signature}.data()));
 			dh->Assign(1, val_mgr->Count(${h.UsedBytesInTheLastPage}));
 			dh->Assign(2, val_mgr->Count(${h.FileSizeInPages}));
@@ -61,7 +66,7 @@ refine flow File += {
 			dh->Assign(16, val_mgr->Count(${h.AddressOfNewExeHeader}));
 
 			mgr.Enqueue(pe_dos_header,
-			    IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+			    connection()->bro_analyzer()->GetFile()->ToVal(),
 			    std::move(dh));
 			}
 		return true;
@@ -71,7 +76,7 @@ refine flow File += {
 		%{
 		if ( pe_dos_code )
 			mgr.Enqueue(pe_dos_code,
-			    IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+			    connection()->bro_analyzer()->GetFile()->ToVal(),
 			    make_intrusive<StringVal>(code.length(), (const char*) code.data())
 			    );
 		return true;
@@ -91,7 +96,7 @@ refine flow File += {
 		%{
 		if ( pe_file_header )
 			{
-			auto fh = make_intrusive<RecordVal>(BifType::Record::PE::FileHeader);
+			auto fh = make_intrusive<RecordVal>(zeek::BifType::Record::PE::FileHeader);
 			fh->Assign(0, val_mgr->Count(${h.Machine}));
 			fh->Assign(1, make_intrusive<Val>(static_cast<double>(${h.TimeDateStamp}), TYPE_TIME));
 			fh->Assign(2, val_mgr->Count(${h.PointerToSymbolTable}));
@@ -100,7 +105,7 @@ refine flow File += {
 			fh->Assign(5, characteristics_to_bro(${h.Characteristics}, 16));
 
 			mgr.Enqueue(pe_file_header,
-			    IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+			    connection()->bro_analyzer()->GetFile()->ToVal(),
 			    std::move(fh));
 			}
 
@@ -119,7 +124,7 @@ refine flow File += {
 
 		if ( pe_optional_header )
 			{
-			auto oh = make_intrusive<RecordVal>(BifType::Record::PE::OptionalHeader);
+			auto oh = make_intrusive<RecordVal>(zeek::BifType::Record::PE::OptionalHeader);
 
 			oh->Assign(0, val_mgr->Count(${h.magic}));
 			oh->Assign(1, val_mgr->Count(${h.major_linker_version}));
@@ -151,7 +156,7 @@ refine flow File += {
 			oh->Assign(23, process_rvas(${h.rvas}));
 
 			mgr.Enqueue(pe_optional_header,
-			    IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+			    connection()->bro_analyzer()->GetFile()->ToVal(),
 			    std::move(oh));
 			}
 		return true;
@@ -161,7 +166,7 @@ refine flow File += {
 		%{
 		if ( pe_section_header )
 			{
-			auto section_header = make_intrusive<RecordVal>(BifType::Record::PE::SectionHeader);
+			auto section_header = make_intrusive<RecordVal>(zeek::BifType::Record::PE::SectionHeader);
 
 			// Strip null characters from the end of the section name.
 			u_char* first_null = (u_char*) memchr(${h.name}.data(), 0, ${h.name}.length());
@@ -183,7 +188,7 @@ refine flow File += {
 			section_header->Assign(9, characteristics_to_bro(${h.characteristics}, 32));
 
 			mgr.Enqueue(pe_section_header,
-			    IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+			    connection()->bro_analyzer()->GetFile()->ToVal(),
 			    std::move(section_header)
 			    );
 			}
diff --git a/src/file_analysis/analyzer/unified2/Unified2.cc b/src/file_analysis/analyzer/unified2/Unified2.cc
index d14ee340e9..e9b14373c6 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.cc
+++ b/src/file_analysis/analyzer/unified2/Unified2.cc
@@ -5,8 +5,8 @@
 
 using namespace file_analysis;
 
-Unified2::Unified2(RecordVal* args, File* file)
-    : file_analysis::Analyzer(file_mgr->GetComponentTag("UNIFIED2"), args, file)
+Unified2::Unified2(IntrusivePtr<RecordVal> args, File* file)
+    : file_analysis::Analyzer(file_mgr->GetComponentTag("UNIFIED2"), std::move(args), file)
 	{
 	interp = new binpac::Unified2::Unified2_Analyzer(this);
 	}
@@ -16,9 +16,9 @@ Unified2::~Unified2()
 	delete interp;
 	}
 
-file_analysis::Analyzer* Unified2::Instantiate(RecordVal* args, File* file)
+file_analysis::Analyzer* Unified2::Instantiate(IntrusivePtr<RecordVal> args, File* file)
 	{
-	return new Unified2(args, file);
+	return new Unified2(std::move(args), file);
 	}
 
 bool Unified2::DeliverStream(const u_char* data, uint64_t len)
diff --git a/src/file_analysis/analyzer/unified2/Unified2.h b/src/file_analysis/analyzer/unified2/Unified2.h
index 8184861b22..b65c25e0a1 100644
--- a/src/file_analysis/analyzer/unified2/Unified2.h
+++ b/src/file_analysis/analyzer/unified2/Unified2.h
@@ -20,10 +20,11 @@ public:
 
 	bool DeliverStream(const u_char* data, uint64_t len) override;
 
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file);
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file);
 
 protected:
-	Unified2(RecordVal* args, File* file);
+	Unified2(IntrusivePtr<RecordVal> args, File* file);
 
 private:
 	binpac::Unified2::Unified2_Analyzer* interp;
diff --git a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
index b2d46c89ed..78d32bbac2 100644
--- a/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
+++ b/src/file_analysis/analyzer/unified2/unified2-analyzer.pac
@@ -7,9 +7,43 @@
 #include "IPAddr.h"
 %}
 
+%code{
+IntrusivePtr<AddrVal> binpac::Unified2::Flow::unified2_addr_to_bro_addr(std::vector<uint32_t>* a)
+	{
+	if ( a->size() == 1 )
+		{
+		return make_intrusive<AddrVal>(IPAddr(IPv4, &(a->at(0)), IPAddr::Host));
+		}
+	else if ( a->size() == 4 )
+		{
+		uint32 tmp[4] = { a->at(0), a->at(1), a->at(2), a->at(3) };
+		return make_intrusive<AddrVal>(IPAddr(IPv6, tmp, IPAddr::Host));
+		}
+	else
+		{
+		// Should never reach here.
+		return make_intrusive<AddrVal>(1);
+		}
+	}
+
+IntrusivePtr<Val> binpac::Unified2::Flow::to_port(uint16_t n, uint8_t p)
+	{
+	TransportProto proto = TRANSPORT_UNKNOWN;
+	switch ( p ) {
+	case 1: proto = TRANSPORT_ICMP; break;
+	case 6: proto = TRANSPORT_TCP; break;
+	case 17: proto = TRANSPORT_UDP; break;
+	}
+
+	return val_mgr->Port(n, proto);
+	}
+%}
+
 refine flow Flow += {
 
 	%member{
+		IntrusivePtr<AddrVal> unified2_addr_to_bro_addr(std::vector<uint32_t>* a);
+		IntrusivePtr<Val> to_port(uint16_t n, uint8_t p);
 	%}
 
 	%init{
@@ -27,35 +61,6 @@ refine flow Flow += {
 		return t;
 		%}
 
-	function unified2_addr_to_bro_addr(a: uint32[]): AddrVal
-		%{
-		if ( a->size() == 1 )
-			{
-			return new AddrVal(IPAddr(IPv4, &(a->at(0)), IPAddr::Host));
-			}
-		else if ( a->size() == 4 )
-			{
-			uint32 tmp[4] = { a->at(0), a->at(1), a->at(2), a->at(3) };
-			return new AddrVal(IPAddr(IPv6, tmp, IPAddr::Host));
-			}
-		else
-			{
-			// Should never reach here.
-			return new AddrVal(1);
-			}
-		%}
-
-	function to_port(n: uint16, p: uint8): Val
-		%{
-		TransportProto proto = TRANSPORT_UNKNOWN;
-		switch ( p ) {
-		case 1: proto = TRANSPORT_ICMP; break;
-		case 6: proto = TRANSPORT_TCP; break;
-		case 17: proto = TRANSPORT_UDP; break;
-		}
-
-		return val_mgr->Port(n, proto)->Ref();
-		%}
 
 	#function proc_record(rec: Record) : bool
 	#	%{
@@ -66,7 +71,7 @@ refine flow Flow += {
 		%{
 		if ( ::unified2_event )
 			{
-			auto ids_event = make_intrusive<RecordVal>(BifType::Record::Unified2::IDSEvent);
+			auto ids_event = make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::IDSEvent);
 			ids_event->Assign(0, val_mgr->Count(${ev.sensor_id}));
 			ids_event->Assign(1, val_mgr->Count(${ev.event_id}));
 			ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME));
@@ -82,7 +87,7 @@ refine flow Flow += {
 			ids_event->Assign(17, val_mgr->Count(${ev.packet_action}));
 
 			mgr.Enqueue(::unified2_event,
-					IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+					connection()->bro_analyzer()->GetFile()->ToVal(),
 					std::move(ids_event));
 			}
 		return true;
@@ -92,7 +97,7 @@ refine flow Flow += {
 		%{
 		if ( ::unified2_event )
 			{
-			auto ids_event = make_intrusive<RecordVal>(BifType::Record::Unified2::IDSEvent);
+			auto ids_event = make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::IDSEvent);
 			ids_event->Assign(0, val_mgr->Count(${ev.sensor_id}));
 			ids_event->Assign(1, val_mgr->Count(${ev.event_id}));
 			ids_event->Assign(2, make_intrusive<Val>(ts_to_double(${ev.ts}), TYPE_TIME));
@@ -112,7 +117,7 @@ refine flow Flow += {
 			ids_event->Assign(16, val_mgr->Count(${ev.vlan_id}));
 
 			mgr.Enqueue(::unified2_event,
-					IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+					connection()->bro_analyzer()->GetFile()->ToVal(),
 					std::move(ids_event));
 			}
 
@@ -123,7 +128,7 @@ refine flow Flow += {
 		%{
 		if ( ::unified2_packet )
 			{
-			auto packet = make_intrusive<RecordVal>(BifType::Record::Unified2::Packet);
+			auto packet = make_intrusive<RecordVal>(zeek::BifType::Record::Unified2::Packet);
 			packet->Assign(0, val_mgr->Count(${pkt.sensor_id}));
 			packet->Assign(1, val_mgr->Count(${pkt.event_id}));
 			packet->Assign(2, val_mgr->Count(${pkt.event_second}));
@@ -132,7 +137,7 @@ refine flow Flow += {
 			packet->Assign(5, to_stringval(${pkt.packet_data}));
 
 			mgr.Enqueue(::unified2_packet,
-					IntrusivePtr{NewRef{}, connection()->bro_analyzer()->GetFile()->GetVal()},
+					connection()->bro_analyzer()->GetFile()->ToVal(),
 					std::move(packet));
 			}
 
diff --git a/src/file_analysis/analyzer/x509/OCSP.cc b/src/file_analysis/analyzer/x509/OCSP.cc
index 3eb9b423c9..b11d7c6970 100644
--- a/src/file_analysis/analyzer/x509/OCSP.cc
+++ b/src/file_analysis/analyzer/x509/OCSP.cc
@@ -32,16 +32,6 @@ using namespace file_analysis;
 
 #define OCSP_STRING_BUF_SIZE 2048
 
-static IntrusivePtr<Val> get_ocsp_type(RecordVal* args, const char* name)
-	{
-	auto rval = args->Lookup(name);
-
-	if ( ! rval )
-		reporter->Error("File extraction analyzer missing arg field: %s", name);
-
-	return rval;
-	}
-
 static bool OCSP_RESPID_bio(OCSP_BASICRESP* basic_resp, BIO* bio)
 	{
 #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
@@ -122,18 +112,23 @@ static bool ocsp_add_cert_id(const OCSP_CERTID* cert_id, zeek::Args* vl, BIO* bi
 	return true;
 	}
 
-file_analysis::Analyzer* OCSP::InstantiateRequest(RecordVal* args, File* file)
+file_analysis::Analyzer* OCSP::InstantiateRequest(IntrusivePtr<RecordVal> args,
+                                                  File* file)
 	{
-	return new OCSP(args, file, true);
+	return new OCSP(std::move(args), file, true);
 	}
 
-file_analysis::Analyzer* OCSP::InstantiateReply(RecordVal* args, File* file)
+file_analysis::Analyzer* OCSP::InstantiateReply(IntrusivePtr<RecordVal> args,
+                                                File* file)
 	{
-	return new OCSP(args, file, false);
+	return new OCSP(std::move(args), file, false);
 	}
 
-file_analysis::OCSP::OCSP(RecordVal* args, file_analysis::File* file, bool arg_request)
-	: file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("OCSP"), args, file), request(arg_request)
+file_analysis::OCSP::OCSP(IntrusivePtr<RecordVal> args, file_analysis::File* file,
+                          bool arg_request)
+	: file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("OCSP"),
+	                                        std::move(args), file),
+	  request(arg_request)
 	{
 	}
 
@@ -422,7 +417,7 @@ void file_analysis::OCSP::ParseRequest(OCSP_REQUEST* req)
 
 	if ( ocsp_request )
 		mgr.Enqueue(ocsp_request,
-			IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+			GetFile()->ToVal(),
 			val_mgr->Count(version)
 		);
 
@@ -433,7 +428,7 @@ void file_analysis::OCSP::ParseRequest(OCSP_REQUEST* req)
 		{
 		zeek::Args rvl;
 		rvl.reserve(5);
-		rvl.emplace_back(NewRef{}, GetFile()->GetVal());
+		rvl.emplace_back(GetFile()->ToVal());
 
 		OCSP_ONEREQ *one_req = OCSP_request_onereq_get0(req, i);
 		OCSP_CERTID *cert_id = OCSP_onereq_get0_id(one_req);
@@ -464,13 +459,10 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 	memset(buf, 0, sizeof(buf));
 
 	const char *status_str = OCSP_response_status_str(OCSP_response_status(resp));
-	StringVal* status_val = new StringVal(strlen(status_str), status_str);
+	auto status_val = make_intrusive<StringVal>(strlen(status_str), status_str);
 
 	if ( ocsp_response_status )
-		mgr.Enqueue(ocsp_response_status,
-			IntrusivePtr{NewRef{}, GetFile()->GetVal()},
-			IntrusivePtr{NewRef{}, status_val}
-		);
+		mgr.Enqueue(ocsp_response_status, GetFile()->ToVal(), status_val);
 
 	//if (!resp_bytes)
 	//	{
@@ -489,22 +481,16 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 	// get the basic response
 	basic_resp = OCSP_response_get1_basic(resp);
 	if ( !basic_resp )
-		{
-		Unref(status_val);
 		goto clean_up;
-		}
 
 #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
 	resp_data = basic_resp->tbsResponseData;
 	if ( !resp_data )
-		{
-		Unref(status_val);
 		goto clean_up;
-		}
 #endif
 
-	vl.emplace_back(NewRef{}, GetFile()->GetVal());
-	vl.emplace_back(AdoptRef{}, status_val);
+	vl.emplace_back(GetFile()->ToVal());
+	vl.emplace_back(std::move(status_val));
 
 #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
 	vl.emplace_back(val_mgr->Count((uint64_t)ASN1_INTEGER_get(resp_data->version)));
@@ -547,7 +533,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 
 		zeek::Args rvl;
 		rvl.reserve(10);
-		rvl.emplace_back(NewRef{}, GetFile()->GetVal());
+		rvl.emplace_back(GetFile()->ToVal());
 
 		// cert id
 		const OCSP_CERTID* cert_id = nullptr;
@@ -634,7 +620,7 @@ void file_analysis::OCSP::ParseResponse(OCSP_RESPONSE *resp)
 	//ocsp_resp_record->Assign(7, make_intrusive<StringVal>(len, buf));
 	//BIO_reset(bio);
 
-	certs_vector = new VectorVal(internal_type("x509_opaque_vector")->AsVectorType());
+	certs_vector = new VectorVal(zeek::id::find_type<VectorType>("x509_opaque_vector"));
 	vl.emplace_back(AdoptRef{}, certs_vector);
 
 #if ( OPENSSL_VERSION_NUMBER < 0x10100000L ) || defined(LIBRESSL_VERSION_NUMBER)
diff --git a/src/file_analysis/analyzer/x509/OCSP.h b/src/file_analysis/analyzer/x509/OCSP.h
index 06ea1dd25a..c3cec77cec 100644
--- a/src/file_analysis/analyzer/x509/OCSP.h
+++ b/src/file_analysis/analyzer/x509/OCSP.h
@@ -18,11 +18,13 @@ public:
 	bool Undelivered(uint64_t offset, uint64_t len) override;
 	bool EndOfFile() override;
 
-	static file_analysis::Analyzer* InstantiateRequest(RecordVal* args, File* file);
-	static file_analysis::Analyzer* InstantiateReply(RecordVal* args, File* file);
+	static file_analysis::Analyzer* InstantiateRequest(IntrusivePtr<RecordVal> args,
+	                                                   File* file);
+	static file_analysis::Analyzer* InstantiateReply(IntrusivePtr<RecordVal> args,
+	                                                 File* file);
 
 protected:
-	OCSP(RecordVal* args, File* file, bool request);
+	OCSP(IntrusivePtr<RecordVal> args, File* file, bool request);
 
 private:
 	void ParseResponse(OCSP_RESPONSE*);
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index 535dbc27d1..016a265d8f 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -21,8 +21,9 @@
 
 using namespace file_analysis;
 
-file_analysis::X509::X509(RecordVal* args, file_analysis::File* file)
-	: file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("X509"), args, file)
+file_analysis::X509::X509(IntrusivePtr<RecordVal> args, file_analysis::File* file)
+	: file_analysis::X509Common::X509Common(file_mgr->GetComponentTag("X509"),
+	                                        std::move(args), file)
 	{
 	cert_data.clear();
 	}
@@ -51,7 +52,8 @@ bool file_analysis::X509::EndOfFile()
 		hash_final(ctx, buf);
 		std::string cert_sha256 = sha256_digest_print(buf);
 		auto index = make_intrusive<StringVal>(cert_sha256);
-		auto entry = certificate_cache->Lookup(index.get(), false);
+		const auto& entry = certificate_cache->Find(index);
+
 		if ( entry )
 			// in this case, the certificate is in the cache and we do not
 			// do any further processing here. However, if there is a callback, we execute it.
@@ -60,9 +62,8 @@ bool file_analysis::X509::EndOfFile()
 				return false;
 			// yup, let's call the callback.
 
-			cache_hit_callback->Call(IntrusivePtr{NewRef{}, GetFile()->GetVal()},
-			                         std::move(entry),
-			                         make_intrusive<StringVal>(cert_sha256));
+			cache_hit_callback->Invoke(GetFile()->ToVal(), entry,
+			                           make_intrusive<StringVal>(cert_sha256));
 			return false;
 			}
 		}
@@ -84,7 +85,7 @@ bool file_analysis::X509::EndOfFile()
 	// and send the record on to scriptland
 	if ( x509_certificate )
 		mgr.Enqueue(x509_certificate,
-		            IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+		            GetFile()->ToVal(),
 		            IntrusivePtr{NewRef{}, cert_val},
 		            cert_record);
 
@@ -117,7 +118,7 @@ IntrusivePtr<RecordVal> file_analysis::X509::ParseCertificate(X509Val* cert_val,
 	char buf[2048]; // we need a buffer for some of the openssl functions
 	memset(buf, 0, sizeof(buf));
 
-	auto pX509Cert = make_intrusive<RecordVal>(BifType::Record::X509::Certificate);
+	auto pX509Cert = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Certificate);
 	BIO *bio = BIO_new(BIO_s_mem());
 
 	pX509Cert->Assign(0, val_mgr->Count((uint64_t) X509_get_version(ssl_cert) + 1));
@@ -244,13 +245,14 @@ X509_STORE* file_analysis::X509::GetRootStore(TableVal* root_certs)
 		return x509_stores[root_certs];
 
 	X509_STORE* ctx = X509_STORE_new();
-	ListVal* idxs = root_certs->ConvertToPureList();
+	auto idxs = root_certs->ToPureListVal();
 
 	// Build the validation store
 	for ( int i = 0; i < idxs->Length(); ++i )
 		{
-		Val* key = idxs->Index(i);
-		StringVal *sv = root_certs->Lookup(key)->AsStringVal();
+		const auto& key = idxs->Idx(i);
+		auto val = root_certs->FindOrDefault(key);
+		StringVal* sv = val->AsStringVal();
 		assert(sv);
 		const uint8_t* data = sv->Bytes();
 		::X509* x = d2i_X509(NULL, &data, sv->Len());
@@ -264,8 +266,6 @@ X509_STORE* file_analysis::X509::GetRootStore(TableVal* root_certs)
 		X509_free(x);
 		}
 
-	delete idxs;
-
 	// Save the newly constructed certificate store into the cacheing map.
 	x509_stores[root_certs] = ctx;
 
@@ -288,14 +288,14 @@ void file_analysis::X509::ParseBasicConstraints(X509_EXTENSION* ex)
 		{
 		if ( x509_ext_basic_constraints )
 			{
-			auto pBasicConstraint = make_intrusive<RecordVal>(BifType::Record::X509::BasicConstraints);
+			auto pBasicConstraint = make_intrusive<RecordVal>(zeek::BifType::Record::X509::BasicConstraints);
 			pBasicConstraint->Assign(0, val_mgr->Bool(constr->ca));
 
 			if ( constr->pathlen )
 				pBasicConstraint->Assign(1, val_mgr->Count((int32_t) ASN1_INTEGER_get(constr->pathlen)));
 
 			mgr.Enqueue(x509_ext_basic_constraints,
-				IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+				GetFile()->ToVal(),
 				std::move(pBasicConstraint)
 			);
 			}
@@ -338,10 +338,10 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 		return;
 		}
 
-	VectorVal* names = nullptr;
-	VectorVal* emails = nullptr;
-	VectorVal* uris = nullptr;
-	VectorVal* ips = nullptr;
+	IntrusivePtr<VectorVal> names;
+	IntrusivePtr<VectorVal> emails;
+	IntrusivePtr<VectorVal> uris;
+	IntrusivePtr<VectorVal> ips;
 
 	bool otherfields = false;
 
@@ -363,29 +363,29 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 #else
 			const char* name = (const char*) ASN1_STRING_get0_data(gen->d.ia5);
 #endif
-			StringVal* bs = new StringVal(name);
+			auto bs = make_intrusive<StringVal>(name);
 
 			switch ( gen->type )
 				{
 				case GEN_DNS:
 					if ( names == nullptr )
-						names = new VectorVal(internal_type("string_vec")->AsVectorType());
+						names = make_intrusive<VectorVal>(zeek::id::string_vec);
 
-					names->Assign(names->Size(), bs);
+					names->Assign(names->Size(), std::move(bs));
 					break;
 
 				case GEN_URI:
 					if ( uris == nullptr )
-						uris = new VectorVal(internal_type("string_vec")->AsVectorType());
+						uris = make_intrusive<VectorVal>(zeek::id::string_vec);
 
-					uris->Assign(uris->Size(), bs);
+					uris->Assign(uris->Size(), std::move(bs));
 					break;
 
 				case GEN_EMAIL:
 					if ( emails == nullptr )
-						emails = new VectorVal(internal_type("string_vec")->AsVectorType());
+						emails = make_intrusive<VectorVal>(zeek::id::string_vec);
 
-					emails->Assign(emails->Size(), bs);
+					emails->Assign(emails->Size(), std::move(bs));
 					break;
 				}
 			}
@@ -393,7 +393,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 		else if ( gen->type == GEN_IPADD )
 			{
 				if ( ips == nullptr )
-					ips = new VectorVal(internal_type("addr_vec")->AsVectorType());
+					ips = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("addr_vec"));
 
 				uint32_t* addr = (uint32_t*) gen->d.ip->data;
 
@@ -419,7 +419,7 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 			}
 		}
 
-		auto sanExt = make_intrusive<RecordVal>(BifType::Record::X509::SubjectAlternativeName);
+		auto sanExt = make_intrusive<RecordVal>(zeek::BifType::Record::X509::SubjectAlternativeName);
 
 		if ( names != nullptr )
 			sanExt->Assign(0, names);
@@ -436,18 +436,18 @@ void file_analysis::X509::ParseSAN(X509_EXTENSION* ext)
 		sanExt->Assign(4, val_mgr->Bool(otherfields));
 
 		mgr.Enqueue(x509_ext_subject_alternative_name,
-		            IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+		            GetFile()->ToVal(),
 		            std::move(sanExt));
 	GENERAL_NAMES_free(altname);
 	}
 
-StringVal* file_analysis::X509::KeyCurve(EVP_PKEY *key)
+IntrusivePtr<StringVal> file_analysis::X509::KeyCurve(EVP_PKEY* key)
 	{
-	assert(key != NULL);
+	assert(key != nullptr);
 
 #ifdef OPENSSL_NO_EC
 	// well, we do not have EC-Support...
-	return NULL;
+	return nullptr;
 #else
 	if ( EVP_PKEY_base_id(key) != EVP_PKEY_EC )
 		{
@@ -470,7 +470,7 @@ StringVal* file_analysis::X509::KeyCurve(EVP_PKEY *key)
 	if ( curve_name == nullptr )
 		return nullptr;
 
-	return new StringVal(curve_name);
+	return make_intrusive<StringVal>(curve_name);
 #endif
 	}
 
diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h
index c299d55270..092ac9aa94 100644
--- a/src/file_analysis/analyzer/x509/X509.h
+++ b/src/file_analysis/analyzer/x509/X509.h
@@ -88,8 +88,9 @@ public:
 	 */
 	static IntrusivePtr<RecordVal> ParseCertificate(X509Val* cert_val, File* file = nullptr);
 
-	static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
-		{ return new X509(args, file); }
+	static file_analysis::Analyzer* Instantiate(IntrusivePtr<RecordVal> args,
+	                                            File* file)
+		{ return new X509(std::move(args), file); }
 
 	/**
 	 * Retrieves OpenSSL's representation of an X509 certificate store
@@ -126,7 +127,7 @@ public:
 		{ cache_hit_callback = std::move(func); }
 
 protected:
-	X509(RecordVal* args, File* file);
+	X509(IntrusivePtr<RecordVal> args, File* file);
 
 private:
 	void ParseBasicConstraints(X509_EXTENSION* ex);
@@ -136,7 +137,7 @@ private:
 	std::string cert_data;
 
 	// Helpers for ParseCertificate.
-	static StringVal* KeyCurve(EVP_PKEY *key);
+	static IntrusivePtr<StringVal> KeyCurve(EVP_PKEY* key);
 	static unsigned int KeyLength(EVP_PKEY *key);
 	/** X509 stores associated with global script-layer values */
 	inline static std::map<Val*, X509_STORE*> x509_stores = std::map<Val*, X509_STORE*>();
diff --git a/src/file_analysis/analyzer/x509/X509Common.cc b/src/file_analysis/analyzer/x509/X509Common.cc
index 12abb5ecb0..e30ac06f7c 100644
--- a/src/file_analysis/analyzer/x509/X509Common.cc
+++ b/src/file_analysis/analyzer/x509/X509Common.cc
@@ -16,8 +16,9 @@
 
 using namespace file_analysis;
 
-X509Common::X509Common(const file_analysis::Tag& arg_tag, RecordVal* arg_args, File* arg_file)
-	: file_analysis::Analyzer(arg_tag, arg_args, arg_file)
+X509Common::X509Common(const file_analysis::Tag& arg_tag,
+                       IntrusivePtr<RecordVal> arg_args, File* arg_file)
+	: file_analysis::Analyzer(arg_tag, std::move(arg_args), arg_file)
 	{
 	}
 
@@ -269,7 +270,7 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa
 	if ( ! ext_val )
 		ext_val = make_intrusive<StringVal>(0, "");
 
-	auto pX509Ext = make_intrusive<RecordVal>(BifType::Record::X509::Extension);
+	auto pX509Ext = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Extension);
 	pX509Ext->Assign(0, make_intrusive<StringVal>(name));
 
 	if ( short_name and strlen(short_name) > 0 )
@@ -287,12 +288,11 @@ void file_analysis::X509Common::ParseExtension(X509_EXTENSION* ex, const EventHa
 	// but I am not sure if there is a better way to do it...
 
 	if ( h == ocsp_extension )
-		mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
+		mgr.Enqueue(h, GetFile()->ToVal(),
 					std::move(pX509Ext),
 					val_mgr->Bool(global));
 	else
-		mgr.Enqueue(h, IntrusivePtr{NewRef{}, GetFile()->GetVal()},
-		            std::move(pX509Ext));
+		mgr.Enqueue(h, GetFile()->ToVal(), std::move(pX509Ext));
 
 	// let individual analyzers parse more.
 	ParseExtensionsSpecific(ex, global, ext_asn, oid);
diff --git a/src/file_analysis/analyzer/x509/X509Common.h b/src/file_analysis/analyzer/x509/X509Common.h
index 5276329e55..a7c9254d0b 100644
--- a/src/file_analysis/analyzer/x509/X509Common.h
+++ b/src/file_analysis/analyzer/x509/X509Common.h
@@ -40,7 +40,8 @@ public:
 	static double GetTimeFromAsn1(const ASN1_TIME* atime, File* f, Reporter* reporter);
 
 protected:
-	X509Common(const file_analysis::Tag& arg_tag, RecordVal* arg_args, File* arg_file);
+	X509Common(const file_analysis::Tag& arg_tag,
+	           IntrusivePtr<RecordVal> arg_args, File* arg_file);
 
 	void ParseExtension(X509_EXTENSION* ex, const EventHandlerPtr& h, bool global);
 	void ParseSignedCertificateTimestamps(X509_EXTENSION* ext);
diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif
index f45bd422ea..214c10f24a 100644
--- a/src/file_analysis/analyzer/x509/functions.bif
+++ b/src/file_analysis/analyzer/x509/functions.bif
@@ -11,14 +11,14 @@
 #include <openssl/err.h>
 
 // construct an error record
-IntrusivePtr<RecordVal> x509_result_record(uint64_t num, const char* reason, Val* chainVector = nullptr)
+static IntrusivePtr<RecordVal> x509_result_record(uint64_t num, const char* reason, IntrusivePtr<Val> chainVector = nullptr)
 	{
-	auto rrecord = make_intrusive<RecordVal>(BifType::Record::X509::Result);
+	auto rrecord = make_intrusive<RecordVal>(zeek::BifType::Record::X509::Result);
 
 	rrecord->Assign(0, val_mgr->Int(num));
 	rrecord->Assign(1, make_intrusive<StringVal>(reason));
 	if ( chainVector )
-		rrecord->Assign(2, chainVector);
+		rrecord->Assign(2, std::move(chainVector));
 
 	return rrecord;
 	}
@@ -35,13 +35,13 @@ STACK_OF(X509)* x509_get_untrusted_stack(VectorVal* certs_vec)
 
 	for ( int i = 1; i < (int) certs_vec->Size(); ++i ) // start at 1 - 0 is host cert
 		{
-		Val *sv = certs_vec->Lookup(i);
+		const auto& sv = certs_vec->At(i);
 
 		if ( ! sv )
 			continue;
 
 		// Fixme: check type
-		X509* x = ((file_analysis::X509Val*) sv)->GetCertificate();
+		X509* x = ((file_analysis::X509Val*) sv.get())->GetCertificate();
 		if ( ! x )
 			{
 			sk_X509_free(untrusted_certs);
@@ -230,14 +230,14 @@ function x509_ocsp_verify%(certs: x509_opaque_vector, ocsp_reply: string, root_c
 
 	// host certificate
 	unsigned int index = 0; // to prevent overloading to 0pointer
-	Val *sv = certs_vec->Lookup(index);
+	const auto& sv = certs_vec->At(index);
 	if ( ! sv )
 		{
 		builtin_error("undefined value in certificate vector");
 		return x509_result_record(-1, "undefined value in certificate vector");
 		}
 
-	file_analysis::X509Val* cert_handle = (file_analysis::X509Val*) sv;
+	file_analysis::X509Val* cert_handle = (file_analysis::X509Val*) sv.get();
 
 	X509* cert = cert_handle->GetCertificate();
 	if ( ! cert )
@@ -516,13 +516,13 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 	// host certificate
 	unsigned int index = 0; // to prevent overloading to 0pointer
-	Val *sv = certs_vec->Lookup(index);
+	const auto& sv = certs_vec->At(index);
 	if ( !sv )
 		{
 		builtin_error("undefined value in certificate vector");
 		return x509_result_record(-1, "undefined value in certificate vector");
 		}
-	file_analysis::X509Val* cert_handle = (file_analysis::X509Val*) sv;
+	file_analysis::X509Val* cert_handle = (file_analysis::X509Val*) sv.get();
 
 	X509* cert = cert_handle->GetCertificate();
 	if ( ! cert )
@@ -542,7 +542,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 	int result = X509_verify_cert(csc);
 
-	VectorVal* chainVector = nullptr;
+	IntrusivePtr<VectorVal> chainVector;
 
 	if ( result == 1 ) // we have a valid chain. try to get it...
 		{
@@ -556,7 +556,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 			}
 
 		int num_certs = sk_X509_num(chain);
-		chainVector = new VectorVal(internal_type("x509_opaque_vector")->AsVectorType());
+		chainVector = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("x509_opaque_vector"));
 
 		for ( int i = 0; i < num_certs; i++ )
 			{
@@ -578,7 +578,7 @@ function x509_verify%(certs: x509_opaque_vector, root_certs: table_string_of_str
 
 x509_verify_chainerror:
 
-	auto rrecord = x509_result_record(X509_STORE_CTX_get_error(csc), X509_verify_cert_error_string(X509_STORE_CTX_get_error(csc)), chainVector);
+	auto rrecord = x509_result_record(X509_STORE_CTX_get_error(csc), X509_verify_cert_error_string(X509_STORE_CTX_get_error(csc)), std::move(chainVector));
 
 	X509_STORE_CTX_cleanup(csc);
 	X509_STORE_CTX_free(csc);
diff --git a/src/file_analysis/analyzer/x509/x509-extension.pac b/src/file_analysis/analyzer/x509/x509-extension.pac
index ad922a5862..9aaf095b71 100644
--- a/src/file_analysis/analyzer/x509/x509-extension.pac
+++ b/src/file_analysis/analyzer/x509/x509-extension.pac
@@ -39,7 +39,7 @@ refine connection MockConnection += {
 			return true;
 
 		mgr.Enqueue(x509_ocsp_ext_signed_certificate_timestamp,
-			IntrusivePtr{NewRef{}, bro_analyzer()->GetFile()->GetVal()},
+			bro_analyzer()->GetFile()->ToVal(),
 			val_mgr->Count(version),
 			make_intrusive<StringVal>(logid.length(), reinterpret_cast<const char*>(logid.begin())),
 			val_mgr->Count(timestamp),
diff --git a/src/file_analysis/file_analysis.bif b/src/file_analysis/file_analysis.bif
index 24222a7a45..7f60bc2845 100644
--- a/src/file_analysis/file_analysis.bif
+++ b/src/file_analysis/file_analysis.bif
@@ -41,20 +41,22 @@ function Files::__set_reassembly_buffer%(file_id: string, max: count%): bool
 ## :zeek:see:`Files::add_analyzer`.
 function Files::__add_analyzer%(file_id: string, tag: Files::Tag, args: any%): bool
 	%{
-	using BifType::Record::Files::AnalyzerArgs;
+	using zeek::BifType::Record::Files::AnalyzerArgs;
 	auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
 	bool result = file_mgr->AddAnalyzer(file_id->CheckString(),
-	                                    file_mgr->GetComponentTag(tag), rv.get());
+	                                    file_mgr->GetComponentTag(tag),
+	                                    std::move(rv));
 	return val_mgr->Bool(result);
 	%}
 
 ## :zeek:see:`Files::remove_analyzer`.
 function Files::__remove_analyzer%(file_id: string, tag: Files::Tag, args: any%): bool
 	%{
-	using BifType::Record::Files::AnalyzerArgs;
+	using zeek::BifType::Record::Files::AnalyzerArgs;
 	auto rv = args->AsRecordVal()->CoerceTo(AnalyzerArgs);
 	bool result = file_mgr->RemoveAnalyzer(file_id->CheckString(),
-	                                       file_mgr->GetComponentTag(tag) , rv.get());
+	                                       file_mgr->GetComponentTag(tag),
+	                                       std::move(rv));
 	return val_mgr->Bool(result);
 	%}
 
@@ -68,7 +70,8 @@ function Files::__stop%(file_id: string%): bool
 ## :zeek:see:`Files::analyzer_name`.
 function Files::__analyzer_name%(tag: Files::Tag%) : string
 	%{
-	return make_intrusive<StringVal>(file_mgr->GetComponentName(tag));
+	const auto& n = file_mgr->GetComponentName(IntrusivePtr{NewRef{}, tag->AsEnumVal()});
+	return make_intrusive<StringVal>(n);
 	%}
 
 ## :zeek:see:`Files::file_exists`.
@@ -85,10 +88,8 @@ function Files::__lookup_file%(fuid: string%): fa_file
 	%{
 	auto f = file_mgr->LookupFile(fuid->CheckString());
 	if ( f != nullptr )
-		{
-		return IntrusivePtr{NewRef{}, f->GetVal()};
-		}
-	
+		return f->ToVal();
+
 	reporter->Error("file ID %s not a known file", fuid->CheckString());
 	return nullptr;
 	%}
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index 5a1edb3200..4914fc6fe4 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -184,7 +184,7 @@ Manager::AnalysisStream::~AnalysisStream()
 Manager::Manager()
 	: plugin::ComponentManager<input::Tag, input::Component>("Input", "Reader")
 	{
-	end_of_data = internal_handler("Input::end_of_data");
+	end_of_data = event_registry->Register("Input::end_of_data");
 	}
 
 Manager::~Manager()
@@ -216,16 +216,16 @@ ReaderBackend* Manager::CreateBackend(ReaderFrontend* frontend, EnumVal* tag)
 // Create a new input reader object to be used at whomevers leisure later on.
 bool Manager::CreateStream(Stream* info, RecordVal* description)
 	{
-	RecordType* rtype = description->Type()->AsRecordType();
-	if ( ! ( same_type(rtype, BifType::Record::Input::TableDescription, false)
-		|| same_type(rtype, BifType::Record::Input::EventDescription, false)
-		|| same_type(rtype, BifType::Record::Input::AnalysisDescription, false) ) )
+	RecordType* rtype = description->GetType()->AsRecordType();
+	if ( ! ( same_type(rtype, zeek::BifType::Record::Input::TableDescription, false)
+		|| same_type(rtype, zeek::BifType::Record::Input::EventDescription, false)
+		|| same_type(rtype, zeek::BifType::Record::Input::AnalysisDescription, false) ) )
 		{
 		reporter->Error("Stream description argument not of right type for new input stream");
 		return false;
 		}
 
-	string name = description->Lookup("name", true)->AsString()->CheckString();
+	string name = description->GetFieldOrDefault("name")->AsString()->CheckString();
 
 	if ( Stream *i = FindStream(name) )
 		{
@@ -234,17 +234,19 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 		return false;
 		}
 
-	auto reader = description->Lookup("reader", true);
+	auto reader = description->GetFieldOrDefault("reader");
 
 	// get the source ...
-	const BroString* bsource = description->Lookup("source", true)->AsString();
+	auto source_val = description->GetFieldOrDefault("source");
+	const BroString* bsource = source_val->AsString();
 	string source((const char*) bsource->Bytes(), bsource->Len());
 
 	ReaderBackend::ReaderInfo rinfo;
 	rinfo.source = copy_string(source.c_str());
 	rinfo.name = copy_string(name.c_str());
 
-	auto mode = description->Lookup("mode", true)->AsEnumVal();
+	auto mode_val = description->GetFieldOrDefault("mode");
+	auto mode = mode_val->AsEnumVal();
 	switch ( mode->InternalInt() )
 		{
 		case 0:
@@ -264,7 +266,7 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 			return false;
 		}
 
-	auto config = description->Lookup("config", true);
+	auto config = description->GetFieldOrDefault("config");
 	info->config = config.release()->AsTableVal();
 
 		{
@@ -275,9 +277,9 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 		TableEntryVal* v;
 		while ( (v = info->config->AsTable()->NextEntry(k, c)) )
 			{
-			auto index = info->config->RecoverIndex(k);
-			string key = index->Index(0)->AsString()->CheckString();
-			string value = v->Value()->AsString()->CheckString();
+			auto index = info->config->RecreateIndex(*k);
+			string key = index->Idx(0)->AsString()->CheckString();
+			string value = v->GetVal()->AsString()->CheckString();
 			rinfo.config.insert(std::make_pair(copy_string(key.c_str()), copy_string(value.c_str())));
 			delete k;
 			}
@@ -302,23 +304,24 @@ bool Manager::CreateStream(Stream* info, RecordVal* description)
 
 bool Manager::CreateEventStream(RecordVal* fval)
 	{
-	RecordType* rtype = fval->Type()->AsRecordType();
-	if ( ! same_type(rtype, BifType::Record::Input::EventDescription, false) )
+	RecordType* rtype = fval->GetType()->AsRecordType();
+	if ( ! same_type(rtype, zeek::BifType::Record::Input::EventDescription, false) )
 		{
 		reporter->Error("EventDescription argument not of right type");
 		return false;
 		}
 
-	string stream_name = fval->Lookup("name", true)->AsString()->CheckString();
+	string stream_name = fval->GetFieldOrDefault("name")->AsString()->CheckString();
 
-	auto fields_val = fval->Lookup("fields", true);
-	RecordType* fields = fields_val->AsType()->AsTypeType()->Type()->AsRecordType();
+	auto fields_val = fval->GetFieldOrDefault("fields");
+	RecordType* fields = fields_val->AsType()->AsTypeType()->GetType()->AsRecordType();
 
-	auto want_record = fval->Lookup("want_record", true);
+	auto want_record = fval->GetFieldOrDefault("want_record");
 
-	Func* event = fval->Lookup("ev", true)->AsFunc();
+	auto ev_val = fval->GetFieldOrDefault("ev");
+	Func* event = ev_val->AsFunc();
 
-	FuncType* etype = event->FType()->AsFuncType();
+	const auto& etype = event->GetType();
 
 	bool allow_file_func = false;
 
@@ -328,21 +331,21 @@ bool Manager::CreateEventStream(RecordVal* fval)
 		return false;
 		}
 
-	const type_list* args = etype->ArgTypes()->Types();
+	const auto& args = etype->ParamList()->Types();
 
-	if ( args->length() < 2 )
+	if ( args.size() < 2 )
 		{
 		reporter->Error("Input stream %s: Event does not take enough arguments", stream_name.c_str());
 		return false;
 		}
 
-	if ( ! same_type((*args)[1], BifType::Enum::Input::Event, false) )
+	if ( ! same_type(args[1], zeek::BifType::Enum::Input::Event, false) )
 		{
 		reporter->Error("Input stream %s: Event's second attribute must be of type Input::Event", stream_name.c_str());
 		return false;
 		}
 
-	if ( ! same_type((*args)[0], BifType::Record::Input::EventDescription, false) )
+	if ( ! same_type(args[0], zeek::BifType::Record::Input::EventDescription, false) )
 		{
 		reporter->Error("Input stream %s: Event's first attribute must be of type Input::EventDescription", stream_name.c_str());
 		return false;
@@ -350,7 +353,7 @@ bool Manager::CreateEventStream(RecordVal* fval)
 
 	if ( want_record->InternalInt() == 0 )
 		{
-		if ( args->length() != fields->NumFields() + 2 )
+		if ( static_cast<int>(args.size()) != fields->NumFields() + 2 )
 			{
 			reporter->Error("Input stream %s: Event has wrong number of arguments", stream_name.c_str());
 			return false;
@@ -358,17 +361,17 @@ bool Manager::CreateEventStream(RecordVal* fval)
 
 		for ( int i = 0; i < fields->NumFields(); i++ )
 			{
-			if ( ! same_type((*args)[i + 2], fields->FieldType(i) ) )
+			if ( ! same_type(args[i + 2], fields->GetFieldType(i) ) )
 				{
 				ODesc desc1;
 				ODesc desc2;
-				(*args)[i + 2]->Describe(&desc1);
-				fields->FieldType(i)->Describe(&desc2);
+				args[i + 2]->Describe(&desc1);
+				fields->GetFieldType(i)->Describe(&desc2);
 
 				reporter->Error("Input stream %s: Incompatible type for event in field %d. Need type '%s':%s, got '%s':%s",
 						stream_name.c_str(), i + 3,
-						type_name(fields->FieldType(i)->Tag()), desc2.Description(),
-						type_name((*args)[i + 2]->Tag()), desc1.Description());
+						type_name(fields->GetFieldType(i)->Tag()), desc2.Description(),
+						type_name(args[i + 2]->Tag()), desc1.Description());
 
 				return false;
 				}
@@ -378,33 +381,33 @@ bool Manager::CreateEventStream(RecordVal* fval)
 
 	else if ( want_record->InternalInt() == 1 )
 		{
-		if ( args->length() != 3 )
+		if ( args.size() != 3 )
 			{
 			reporter->Error("Input stream %s: Event has wrong number of arguments", stream_name.c_str());
 			return false;
 			}
 
-		if ( ! same_type((*args)[2], fields ) )
+		if ( ! same_type(args[2], fields ) )
 			{
 			ODesc desc1;
 			ODesc desc2;
-			(*args)[2]->Describe(&desc1);
+			args[2]->Describe(&desc1);
 			fields->Describe(&desc2);
 			reporter->Error("Input stream %s: Incompatible type '%s':%s for event, which needs type '%s':%s\n",
 					stream_name.c_str(),
-					type_name((*args)[2]->Tag()), desc1.Description(),
+					type_name(args[2]->Tag()), desc1.Description(),
 					type_name(fields->Tag()), desc2.Description());
 			return false;
 			}
 
-		allow_file_func = BifConst::Input::accept_unsupported_types;
+		allow_file_func = zeek::BifConst::Input::accept_unsupported_types;
 
 		}
 
 	else
 		assert(false);
 
-	auto error_event_val = fval->Lookup("error_ev", true);
+	auto error_event_val = fval->GetFieldOrDefault("error_ev");
 	Func* error_event = error_event_val ? error_event_val->AsFunc() : nullptr;
 
 	if ( ! CheckErrorEventTypes(stream_name, error_event, false) )
@@ -455,32 +458,33 @@ bool Manager::CreateEventStream(RecordVal* fval)
 
 bool Manager::CreateTableStream(RecordVal* fval)
 	{
-	RecordType* rtype = fval->Type()->AsRecordType();
-	if ( ! same_type(rtype, BifType::Record::Input::TableDescription, false) )
+	RecordType* rtype = fval->GetType()->AsRecordType();
+	if ( ! same_type(rtype, zeek::BifType::Record::Input::TableDescription, false) )
 		{
 		reporter->Error("TableDescription argument not of right type");
 		return false;
 		}
 
-	string stream_name = fval->Lookup("name", true)->AsString()->CheckString();
+	string stream_name = fval->GetFieldOrDefault("name")->AsString()->CheckString();
 
-	auto pred = fval->Lookup("pred", true);
-	auto idx_val = fval->Lookup("idx", true);
-	RecordType* idx = idx_val->AsType()->AsTypeType()->Type()->AsRecordType();
+	auto pred = fval->GetFieldOrDefault("pred");
+	auto idx_val = fval->GetFieldOrDefault("idx");
+	RecordType* idx = idx_val->AsType()->AsTypeType()->GetType()->AsRecordType();
 
 	IntrusivePtr<RecordType> val;
-	auto val_val = fval->Lookup("val", true);
+	auto val_val = fval->GetFieldOrDefault("val");
 
 	if ( val_val )
-		val = {NewRef{}, val_val->AsType()->AsTypeType()->Type()->AsRecordType()};
+		val = val_val->AsType()->AsTypeType()->GetType<RecordType>();
 
-	auto dst = fval->Lookup("destination", true);
+	auto dst = fval->GetFieldOrDefault("destination");
 
 	// check if index fields match table description
-	int num = idx->NumFields();
-	const type_list* tl = dst->Type()->AsTableType()->IndexTypes();
+	size_t num = idx->NumFields();
+	const auto& tl = dst->GetType()->AsTableType()->IndexTypes();
+	size_t j;
 
-	loop_over_list(*tl, j)
+	for ( j = 0; j < tl.size(); ++j )
 		{
 		if ( j >= num )
 			{
@@ -488,16 +492,16 @@ bool Manager::CreateTableStream(RecordVal* fval)
 			return false;
 			}
 
-		if ( ! same_type(idx->FieldType(j), (*tl)[j]) )
+		if ( ! same_type(idx->GetFieldType(j), tl[j]) )
 			{
 			ODesc desc1;
 			ODesc desc2;
-			idx->FieldType(j)->Describe(&desc1);
-			(*tl)[j]->Describe(&desc2);
+			idx->GetFieldType(j)->Describe(&desc1);
+			tl[j]->Describe(&desc2);
 
 			reporter->Error("Input stream %s: Table type does not match index type. Need type '%s':%s, got '%s':%s", stream_name.c_str(),
-					type_name(idx->FieldType(j)->Tag()), desc1.Description(),
-					type_name((*tl)[j]->Tag()), desc2.Description());
+					type_name(idx->GetFieldType(j)->Tag()), desc1.Description(),
+					type_name(tl[j]->Tag()), desc2.Description());
 
 			return false;
 			}
@@ -509,15 +513,12 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		return false;
 		}
 
-	auto want_record = fval->Lookup("want_record", true);
+	auto want_record = fval->GetFieldOrDefault("want_record");
 
 	if ( val )
 		{
-		const BroType* table_yield = dst->Type()->AsTableType()->YieldType();
-		const BroType* compare_type = val.get();
-
-		if ( want_record->InternalInt() == 0 )
-			compare_type = val->FieldType(0);
+		const auto& table_yield = dst->GetType()->AsTableType()->Yield();
+		const auto& compare_type = want_record->InternalInt() == 0 ? val->GetFieldType(0) : val;
 
 		if ( ! same_type(table_yield, compare_type) )
 			{
@@ -532,7 +533,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		}
 	else
 		{
-		if ( ! dst->Type()->IsSet() )
+		if ( ! dst->GetType()->IsSet() )
 			{
 			reporter->Error("Input stream %s: 'destination' field is a table,"
 			                " but 'val' field is not provided"
@@ -542,12 +543,12 @@ bool Manager::CreateTableStream(RecordVal* fval)
 			}
 		}
 
-	auto event_val = fval->Lookup("ev", true);
+	auto event_val = fval->GetFieldOrDefault("ev");
 	Func* event = event_val ? event_val->AsFunc() : nullptr;
 
 	if ( event )
 		{
-		FuncType* etype = event->FType()->AsFuncType();
+		const auto& etype = event->GetType();
 
 		if ( etype->Flavor() != FUNC_FLAVOR_EVENT )
 			{
@@ -555,54 +556,54 @@ bool Manager::CreateTableStream(RecordVal* fval)
 			return false;
 			}
 
-		const type_list* args = etype->ArgTypes()->Types();
+		const auto& args = etype->ParamList()->Types();
 
-		if ( args->length() != 4 )
+		if ( args.size() != 4 )
 			{
 			reporter->Error("Input stream %s: Table event must take 4 arguments", stream_name.c_str());
 			return false;
 			}
 
-		if ( ! same_type((*args)[0], BifType::Record::Input::TableDescription, false) )
+		if ( ! same_type(args[0], zeek::BifType::Record::Input::TableDescription, false) )
 			{
 			reporter->Error("Input stream %s: Table event's first attribute must be of type Input::TableDescription", stream_name.c_str());
 			return false;
 			}
 
-		if ( ! same_type((*args)[1], BifType::Enum::Input::Event, false) )
+		if ( ! same_type(args[1], zeek::BifType::Enum::Input::Event, false) )
 			{
 			reporter->Error("Input stream %s: Table event's second attribute must be of type Input::Event", stream_name.c_str());
 			return false;
 			}
 
-		if ( ! same_type((*args)[2], idx) )
+		if ( ! same_type(args[2], idx) )
 			{
 			ODesc desc1;
 			ODesc desc2;
 			idx->Describe(&desc1);
-			(*args)[2]->Describe(&desc2);
+			args[2]->Describe(&desc2);
 			reporter->Error("Input stream %s: Table event's index attributes do not match. Need '%s', got '%s'", stream_name.c_str(),
 					desc1.Description(), desc2.Description());
 			return false;
 			}
 
-		if ( want_record->InternalInt() == 1 && val && ! same_type((*args)[3], val.get()) )
+		if ( want_record->InternalInt() == 1 && val && ! same_type(args[3], val) )
 			{
 			ODesc desc1;
 			ODesc desc2;
 			val->Describe(&desc1);
-			(*args)[3]->Describe(&desc2);
+			args[3]->Describe(&desc2);
 			reporter->Error("Input stream %s: Table event's value attributes do not match. Need '%s', got '%s'", stream_name.c_str(),
 					desc1.Description(), desc2.Description());
 			return false;
 			}
 		else if (  want_record->InternalInt() == 0
-		           && val && !same_type((*args)[3], val->FieldType(0) ) )
+		           && val && !same_type(args[3], val->GetFieldType(0) ) )
 			{
 			ODesc desc1;
 			ODesc desc2;
-			val->FieldType(0)->Describe(&desc1);
-			(*args)[3]->Describe(&desc2);
+			val->GetFieldType(0)->Describe(&desc1);
+			args[3]->Describe(&desc2);
 			reporter->Error("Input stream %s: Table event's value attribute does not match. Need '%s', got '%s'", stream_name.c_str(),
 					desc1.Description(), desc2.Description());
 			return false;
@@ -615,7 +616,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 		assert(want_record->InternalInt() == 1 || want_record->InternalInt() == 0);
 		}
 
-	auto error_event_val = fval->Lookup("error_ev", true);
+	auto error_event_val = fval->GetFieldOrDefault("error_ev");
 	Func* error_event = error_event_val ? error_event_val->AsFunc() : nullptr;
 
 	if ( ! CheckErrorEventTypes(stream_name, error_event, true) )
@@ -628,7 +629,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
 	int idxfields = fieldsV.size();
 
 	if ( val ) // if we are not a set
-		status = status || ! UnrollRecordType(&fieldsV, val.get(), "", BifConst::Input::accept_unsupported_types);
+		status = status || ! UnrollRecordType(&fieldsV, val.get(), "", zeek::BifConst::Input::accept_unsupported_types);
 
 	int valfields = fieldsV.size() - idxfields;
 
@@ -694,7 +695,7 @@ bool Manager::CheckErrorEventTypes(const std::string& stream_name, const Func* e
 	if ( ev == nullptr )
 		return true;
 
-	FuncType* etype = ev->FType()->AsFuncType();
+	const auto& etype = ev->GetType();
 
 	if ( etype->Flavor() != FUNC_FLAVOR_EVENT )
 		{
@@ -702,33 +703,33 @@ bool Manager::CheckErrorEventTypes(const std::string& stream_name, const Func* e
 		return false;
 		}
 
-	const type_list* args = etype->ArgTypes()->Types();
+	const auto& args = etype->ParamList()->Types();
 
-	if ( args->length() != 3 )
+	if ( args.size() != 3 )
 		{
 		reporter->Error("Input stream %s: Error event must take 3 arguments", stream_name.c_str());
 		return false;
 		}
 
-	if ( table && ! same_type((*args)[0], BifType::Record::Input::TableDescription, false) )
+	if ( table && ! same_type(args[0], zeek::BifType::Record::Input::TableDescription, false) )
 		{
 		reporter->Error("Input stream %s: Error event's first attribute must be of type Input::TableDescription", stream_name.c_str());
 		return false;
 		}
 
-	if ( ! table && ! same_type((*args)[0], BifType::Record::Input::EventDescription, false) )
+	if ( ! table && ! same_type(args[0], zeek::BifType::Record::Input::EventDescription, false) )
 		{
 		reporter->Error("Input stream %s: Error event's first attribute must be of type Input::EventDescription", stream_name.c_str());
 		return false;
 		}
 
-	if ( (*args)[1]->Tag() != TYPE_STRING )
+	if ( args[1]->Tag() != TYPE_STRING )
 		{
 		reporter->Error("Input stream %s: Error event's second attribute must be of type string", stream_name.c_str());
 		return false;
 		}
 
-	if ( ! same_type((*args)[2], BifType::Enum::Reporter::Level, false) )
+	if ( ! same_type(args[2], zeek::BifType::Enum::Reporter::Level, false) )
 		{
 		reporter->Error("Input stream %s: Error event's third attribute must be of type Reporter::Level", stream_name.c_str());
 		return false;
@@ -739,9 +740,9 @@ bool Manager::CheckErrorEventTypes(const std::string& stream_name, const Func* e
 
 bool Manager::CreateAnalysisStream(RecordVal* fval)
 	{
-	RecordType* rtype = fval->Type()->AsRecordType();
+	RecordType* rtype = fval->GetType()->AsRecordType();
 
-	if ( ! same_type(rtype, BifType::Record::Input::AnalysisDescription, false) )
+	if ( ! same_type(rtype, zeek::BifType::Record::Input::AnalysisDescription, false) )
 		{
 		reporter->Error("AnalysisDescription argument not of right type");
 		return false;
@@ -804,7 +805,7 @@ bool Manager::IsCompatibleType(BroType* t, bool atomic_only)
 		if ( ! t->IsSet() )
 			return false;
 
-		return IsCompatibleType(t->AsSetType()->Indices()->PureType(), true);
+		return IsCompatibleType(t->AsSetType()->GetIndices()->GetPureType().get(), true);
 		}
 
 	case TYPE_VECTOR:
@@ -812,7 +813,7 @@ bool Manager::IsCompatibleType(BroType* t, bool atomic_only)
 		if ( atomic_only )
 			return false;
 
-		return IsCompatibleType(t->AsVectorType()->YieldType(), true);
+		return IsCompatibleType(t->AsVectorType()->Yield().get(), true);
 		}
 
 	default:
@@ -883,7 +884,7 @@ bool Manager::UnrollRecordType(vector<Field*> *fields, const RecordType *rec,
 	for ( int i = 0; i < rec->NumFields(); i++ )
 		{
 
-		if ( ! IsCompatibleType(rec->FieldType(i)) )
+		if ( ! IsCompatibleType(rec->GetFieldType(i).get()) )
 			{
 			string name = nameprepend + rec->FieldName(i);
 			// If the field is a file, function, or opaque
@@ -892,31 +893,31 @@ bool Manager::UnrollRecordType(vector<Field*> *fields, const RecordType *rec,
 			// stuff that we actually cannot read :)
 			if ( allow_file_func )
 				{
-				if ( ( rec->FieldType(i)->Tag() == TYPE_FILE ||
-				       rec->FieldType(i)->Tag() == TYPE_FUNC ||
-				       rec->FieldType(i)->Tag() == TYPE_OPAQUE ) &&
-				       rec->FieldDecl(i)->FindAttr(ATTR_OPTIONAL) )
+				if ( ( rec->GetFieldType(i)->Tag() == TYPE_FILE ||
+				       rec->GetFieldType(i)->Tag() == TYPE_FUNC ||
+				       rec->GetFieldType(i)->Tag() == TYPE_OPAQUE ) &&
+				       rec->FieldDecl(i)->GetAttr(ATTR_OPTIONAL) )
 					{
-					reporter->Info("Encountered incompatible type \"%s\" in type definition for field \"%s\" in ReaderFrontend. Ignoring optional field.", type_name(rec->FieldType(i)->Tag()), name.c_str());
+					reporter->Info("Encountered incompatible type \"%s\" in type definition for field \"%s\" in ReaderFrontend. Ignoring optional field.", type_name(rec->GetFieldType(i)->Tag()), name.c_str());
 					continue;
 					}
 				}
 
-			reporter->Error("Incompatible type \"%s\" in type definition for for field \"%s\" in ReaderFrontend", type_name(rec->FieldType(i)->Tag()), name.c_str());
+			reporter->Error("Incompatible type \"%s\" in type definition for for field \"%s\" in ReaderFrontend", type_name(rec->GetFieldType(i)->Tag()), name.c_str());
 			return false;
 			}
 
-		if ( rec->FieldType(i)->Tag() == TYPE_RECORD )
+		if ( rec->GetFieldType(i)->Tag() == TYPE_RECORD )
 			{
 			string prep = nameprepend + rec->FieldName(i) + ".";
 
-			if ( rec->FieldDecl(i)->FindAttr(ATTR_OPTIONAL) )
+			if ( rec->FieldDecl(i)->GetAttr(ATTR_OPTIONAL) )
 				{
 				reporter->Info("The input framework does not support optional record fields: \"%s\"", rec->FieldName(i));
 				return false;
 				}
 
-			if ( !UnrollRecordType(fields, rec->FieldType(i)->AsRecordType(), prep, allow_file_func) )
+			if ( !UnrollRecordType(fields, rec->GetFieldType(i)->AsRecordType(), prep, allow_file_func) )
 				{
 				return false;
 				}
@@ -928,30 +929,30 @@ bool Manager::UnrollRecordType(vector<Field*> *fields, const RecordType *rec,
 			string name = nameprepend + rec->FieldName(i);
 			const char* secondary = nullptr;
 			IntrusivePtr<Val> c;
-			TypeTag ty = rec->FieldType(i)->Tag();
+			TypeTag ty = rec->GetFieldType(i)->Tag();
 			TypeTag st = TYPE_VOID;
 			bool optional = false;
 
 			if ( ty == TYPE_TABLE )
-				st = rec->FieldType(i)->AsSetType()->Indices()->PureType()->Tag();
+				st = rec->GetFieldType(i)->AsSetType()->GetIndices()->GetPureType()->Tag();
 
 			else if ( ty == TYPE_VECTOR )
-				st = rec->FieldType(i)->AsVectorType()->YieldType()->Tag();
+				st = rec->GetFieldType(i)->AsVectorType()->Yield()->Tag();
 
 			else if ( ty == TYPE_PORT &&
-				  rec->FieldDecl(i)->FindAttr(ATTR_TYPE_COLUMN) )
+				  rec->FieldDecl(i)->GetAttr(ATTR_TYPE_COLUMN) )
 				{
 				// we have an annotation for the second column
 
-				c = rec->FieldDecl(i)->FindAttr(ATTR_TYPE_COLUMN)->AttrExpr()->Eval(nullptr);
+				c = rec->FieldDecl(i)->GetAttr(ATTR_TYPE_COLUMN)->GetExpr()->Eval(nullptr);
 
 				assert(c);
-				assert(c->Type()->Tag() == TYPE_STRING);
+				assert(c->GetType()->Tag() == TYPE_STRING);
 
 				secondary = c->AsStringVal()->AsString()->CheckString();
 				}
 
-			if ( rec->FieldDecl(i)->FindAttr(ATTR_OPTIONAL ) )
+			if ( rec->FieldDecl(i)->GetAttr(ATTR_OPTIONAL ) )
 				optional = true;
 
 			Field* field = new Field(name.c_str(), secondary, ty, st, optional);
@@ -991,18 +992,18 @@ Val* Manager::RecordValToIndexVal(RecordVal *r) const
 	{
 	IntrusivePtr<Val> idxval;
 
-	RecordType *type = r->Type()->AsRecordType();
+	RecordType *type = r->GetType()->AsRecordType();
 
 	int num_fields = type->NumFields();
 
 	if ( num_fields == 1 && type->FieldDecl(0)->type->Tag() != TYPE_RECORD  )
-		idxval = r->LookupWithDefault(0);
+		idxval = r->GetFieldOrDefault(0);
 
 	else
 		{
 		auto l = make_intrusive<ListVal>(TYPE_ANY);
 		for ( int j = 0 ; j < num_fields; j++ )
-			l->Append(r->LookupWithDefault(j).release());
+			l->Append(r->GetFieldOrDefault(j));
 
 		idxval = std::move(l);
 		}
@@ -1018,9 +1019,9 @@ Val* Manager::ValueToIndexVal(const Stream* i, int num_fields, const RecordType
 	int position = 0;
 
 
-	if ( num_fields == 1 && type->FieldType(0)->Tag() != TYPE_RECORD  )
+	if ( num_fields == 1 && type->GetFieldType(0)->Tag() != TYPE_RECORD  )
 		{
-		idxval = ValueToVal(i, vals[0], type->FieldType(0), have_error);
+		idxval = ValueToVal(i, vals[0], type->GetFieldType(0).get(), have_error);
 		position = 1;
 		}
 	else
@@ -1028,12 +1029,12 @@ Val* Manager::ValueToIndexVal(const Stream* i, int num_fields, const RecordType
 		ListVal *l = new ListVal(TYPE_ANY);
 		for ( int j = 0 ; j < type->NumFields(); j++ )
 			{
-			if ( type->FieldType(j)->Tag() == TYPE_RECORD )
-				l->Append(ValueToRecordVal(i, vals,
-				          type->FieldType(j)->AsRecordType(), &position, have_error));
+			if ( type->GetFieldType(j)->Tag() == TYPE_RECORD )
+				l->Append({AdoptRef{}, ValueToRecordVal(i, vals,
+				          type->GetFieldType(j)->AsRecordType(), &position, have_error)});
 			else
 				{
-				l->Append(ValueToVal(i, vals[position], type->FieldType(j), have_error));
+				l->Append({AdoptRef{}, ValueToVal(i, vals[position], type->GetFieldType(j).get(), have_error)});
 				position++;
 				}
 			}
@@ -1063,8 +1064,8 @@ void Manager::SendEntry(ReaderFrontend* reader, Value* *vals)
 
 	else if ( i->stream_type == EVENT_STREAM )
 		{
-		EnumVal* type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
-		readFields = SendEventStreamEvent(i, type, vals);
+		auto type = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+		readFields = SendEventStreamEvent(i, type.release(), vals);
 		}
 
 	else if ( i->stream_type == ANALYSIS_STREAM )
@@ -1149,7 +1150,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		valval = nullptr;
 
 	else if ( stream->num_val_fields == 1 && !stream->want_record )
-		valval = ValueToVal(i, vals[position], stream->rtype->FieldType(0), convert_error);
+		valval = ValueToVal(i, vals[position], stream->rtype->GetFieldType(0).get(), convert_error);
 
 	else
 		valval = ValueToRecordVal(i, vals, stream->rtype, &position, convert_error);
@@ -1157,7 +1158,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 	// call stream first to determine if we really add / change the entry
 	if ( stream->pred && ! convert_error )
 		{
-		EnumVal* ev;
+		IntrusivePtr<EnumVal> ev;
 		int startpos = 0;
 		bool pred_convert_error = false;
 		predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, pred_convert_error);
@@ -1168,15 +1169,15 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		if ( ! pred_convert_error )
 			{
 			if ( updated )
-				ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
+				ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
 			else
-				ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
+				ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
 
 			bool result;
 			if ( stream->num_val_fields > 0 ) // we have values
-				result = CallPred(stream->pred, 3, ev, predidx->Ref(), valval->Ref());
+				result = CallPred(stream->pred, 3, ev.release(), predidx->Ref(), valval->Ref());
 			else // no values
-				result = CallPred(stream->pred, 2, ev, predidx->Ref());
+				result = CallPred(stream->pred, 2, ev.release(), predidx->Ref());
 
 			if ( result == false )
 				{
@@ -1233,10 +1234,11 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		{
 		assert(stream->num_val_fields > 0);
 		// in that case, we need the old value to send the event (if we send an event).
-		oldval = stream->tab->Lookup(idxval, false);
+		oldval = stream->tab->Find({NewRef{}, idxval});
 		}
 
-	HashKey* k = stream->tab->ComputeHash(idxval);
+	auto k = stream->tab->MakeHashKey(*idxval);
+
 	if ( ! k )
 		reporter->InternalError("could not hash");
 
@@ -1244,8 +1246,7 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 	ih->idxkey = new HashKey(k->Key(), k->Size(), k->Hash());
 	ih->valhash = valhash;
 
-	stream->tab->Assign(idxval, k, valval);
-	Unref(idxval); // asssign does not consume idxval.
+	stream->tab->Assign({AdoptRef{}, idxval}, std::move(k), {AdoptRef{}, valval});
 
 	if ( predidx != nullptr )
 		Unref(predidx);
@@ -1256,7 +1257,6 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 
 	if ( stream->event )
 		{
-		EnumVal* ev;
 		int startpos = 0;
 		Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, convert_error);
 
@@ -1269,20 +1269,20 @@ int Manager::SendEntryTable(Stream* i, const Value* const *vals)
 		else if ( updated )
 			{ // in case of update send back the old value.
 			assert ( stream->num_val_fields > 0 );
-			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
+			auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
 			assert ( oldval != nullptr );
-			SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, oldval.release());
+			SendEvent(stream->event, 4, stream->description->Ref(), ev.release(), predidx, oldval.release());
 			}
 		else
 			{
-			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
+			auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
 			if ( stream->num_val_fields == 0 )
 				{
 				Ref(stream->description);
-				SendEvent(stream->event, 3, stream->description->Ref(), ev, predidx);
+				SendEvent(stream->event, 3, stream->description->Ref(), ev.release(), predidx);
 				}
 			else
-				SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, valval->Ref());
+				SendEvent(stream->event, 4, stream->description->Ref(), ev.release(), predidx, valval->Ref());
 			}
 		}
 
@@ -1326,36 +1326,31 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 	while ( ( ih = stream->lastDict->NextEntry(lastDictIdxKey, c) ) )
 		{
 		IntrusivePtr<Val> val;
-
-		Val* predidx = nullptr;
-		EnumVal* ev = nullptr;
+		IntrusivePtr<Val> predidx;
+		IntrusivePtr<EnumVal> ev;
 		int startpos = 0;
 
 		if ( stream->pred || stream->event )
 			{
-			auto idx = stream->tab->RecoverIndex(ih->idxkey);
+			auto idx = stream->tab->RecreateIndex(*ih->idxkey);
 			assert(idx != nullptr);
-			val = stream->tab->Lookup(idx.get());
+			val = stream->tab->FindOrDefault(idx);
 			assert(val != nullptr);
-			predidx = ListValToRecordVal(idx.get(), stream->itype, &startpos);
-			ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
+			predidx = {AdoptRef{}, ListValToRecordVal(idx.get(), stream->itype, &startpos)};
+			ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
 			}
 
 		if ( stream->pred )
 			{
 			// ask predicate, if we want to expire this element...
 
-			Ref(ev);
-			Ref(predidx);
-
-			bool result = CallPred(stream->pred, 3, ev, predidx, IntrusivePtr{val}.release());
+			bool result = CallPred(stream->pred, 3, ev->Ref(), predidx->Ref(),
+			                       val->Ref());
 
 			if ( result == false )
 				{
 				// Keep it. Hence - we quit and simply go to the next entry of lastDict
 				// ah well - and we have to add the entry to currDict...
-				Unref(predidx);
-				Unref(ev);
 				stream->currDict->Insert(lastDictIdxKey, stream->lastDict->RemoveEntry(lastDictIdxKey));
 				delete lastDictIdxKey;
 				continue;
@@ -1363,19 +1358,10 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
 			}
 
 		if ( stream->event )
-			{
-			Ref(predidx);
-			Ref(ev);
-			SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, IntrusivePtr{val}.release());
-			}
+			SendEvent(stream->event, 4, stream->description->Ref(), ev->Ref(),
+			          predidx->Ref(), val->Ref());
 
-		if ( predidx )  // if we have a stream or an event...
-			Unref(predidx);
-
-		if ( ev )
-			Unref(ev);
-
-		stream->tab->Delete(ih->idxkey);
+		stream->tab->Remove(*ih->idxkey);
 		stream->lastDict->Remove(lastDictIdxKey); // delete in next line
 		delete lastDictIdxKey;
 		delete(ih);
@@ -1445,8 +1431,8 @@ void Manager::Put(ReaderFrontend* reader, Value* *vals)
 
 	else if ( i->stream_type == EVENT_STREAM )
 		{
-		EnumVal* type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
-		readFields = SendEventStreamEvent(i, type, vals);
+		auto type = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
+		readFields = SendEventStreamEvent(i, type.release(), vals);
 		}
 
 	else if ( i->stream_type == ANALYSIS_STREAM )
@@ -1493,14 +1479,14 @@ int Manager::SendEventStreamEvent(Stream* i, EnumVal* type, const Value* const *
 			{
 			Val* val = nullptr;
 
-			if ( stream->fields->FieldType(j)->Tag() == TYPE_RECORD )
+			if ( stream->fields->GetFieldType(j)->Tag() == TYPE_RECORD )
 				val = ValueToRecordVal(i, vals,
-						stream->fields->FieldType(j)->AsRecordType(),
+						stream->fields->GetFieldType(j)->AsRecordType(),
 						&position, convert_error);
 
 			else
 				{
-				val = ValueToVal(i, vals[position], stream->fields->FieldType(j), convert_error);
+				val = ValueToVal(i, vals[position], stream->fields->GetFieldType(j).get(), convert_error);
 				position++;
 				}
 
@@ -1538,7 +1524,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 		valval = nullptr;
 
 	else if ( stream->num_val_fields == 1 && stream->want_record == 0 )
-		valval = ValueToVal(i, vals[position], stream->rtype->FieldType(0), convert_error);
+		valval = ValueToVal(i, vals[position], stream->rtype->GetFieldType(0).get(), convert_error);
 	else
 		valval = ValueToRecordVal(i, vals, stream->rtype, &position, convert_error);
 
@@ -1559,7 +1545,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 		if ( stream->num_val_fields > 0 )
 			{
 			// in that case, we need the old value to send the event (if we send an event).
-			oldval = stream->tab->Lookup(idxval, false);
+			oldval = stream->tab->Find({NewRef{}, idxval});
 			}
 
 		if ( oldval != nullptr )
@@ -1572,7 +1558,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 		// predicate if we want the update or not
 		if ( stream->pred )
 			{
-			EnumVal* ev;
+			IntrusivePtr<EnumVal> ev;
 			int startpos = 0;
 			bool pred_convert_error = false;
 			Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, pred_convert_error);
@@ -1582,18 +1568,18 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 			else
 				{
 				if ( updated )
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
+					ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
 				else
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
+					ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
 
 				bool result;
 				if ( stream->num_val_fields > 0 ) // we have values
 					{
 					Ref(valval);
-					result = CallPred(stream->pred, 3, ev, predidx, valval);
+					result = CallPred(stream->pred, 3, ev.release(), predidx, valval);
 					}
 				else // no values
-					result = CallPred(stream->pred, 2, ev, predidx);
+					result = CallPred(stream->pred, 2, ev.release(), predidx);
 
 				if ( result == false )
 					{
@@ -1606,11 +1592,10 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 
 			}
 
-		stream->tab->Assign(idxval, valval);
+		stream->tab->Assign({NewRef{}, idxval}, {AdoptRef{}, valval});
 
 		if ( stream->event )
 			{
-			EnumVal* ev;
 			int startpos = 0;
 			bool event_convert_error = false;
 			Val* predidx = ValueToRecordVal(i, vals, stream->itype, &startpos, event_convert_error);
@@ -1623,20 +1608,20 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 					{
 					// in case of update send back the old value.
 					assert ( stream->num_val_fields > 0 );
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED).release();
+					auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_CHANGED);
 					assert ( oldval != nullptr );
 					SendEvent(stream->event, 4, stream->description->Ref(),
-					          ev, predidx, oldval.release());
+					          ev.release(), predidx, oldval.release());
 					}
 				else
 					{
-					ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW).release();
+					auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_NEW);
 					if ( stream->num_val_fields == 0 )
 						SendEvent(stream->event, 4, stream->description->Ref(),
-								ev, predidx);
+								ev.release(), predidx);
 					else
 						SendEvent(stream->event, 4, stream->description->Ref(),
-								ev, predidx, valval->Ref());
+								ev.release(), predidx, valval->Ref());
 					}
 				}
 
@@ -1645,7 +1630,7 @@ int Manager::PutTable(Stream* i, const Value* const *vals)
 		}
 
 	else // no predicates or other stuff
-		stream->tab->Assign(idxval, valval);
+		stream->tab->Assign({NewRef{}, idxval}, {AdoptRef{}, valval});
 
 	Unref(idxval); // not consumed by assign
 
@@ -1704,7 +1689,7 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 
 		if ( stream->pred || stream->event )
 			{
-			auto val = stream->tab->Lookup(idxval);
+			auto val = stream->tab->FindOrDefault({NewRef{}, idxval});
 
 			if ( stream->pred )
 				{
@@ -1715,9 +1700,9 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 					Unref(predidx);
 				else
 					{
-					EnumVal* ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
+					auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
 
-					streamresult = CallPred(stream->pred, 3, ev, predidx, IntrusivePtr{val}.release());
+					streamresult = CallPred(stream->pred, 3, ev.release(), predidx, IntrusivePtr{val}.release());
 
 					if ( streamresult == false )
 						{
@@ -1734,23 +1719,23 @@ bool Manager::Delete(ReaderFrontend* reader, Value* *vals)
 				{
 				Ref(idxval);
 				assert(val != nullptr);
-				EnumVal* ev = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
-				SendEvent(stream->event, 4, stream->description->Ref(), ev, idxval, IntrusivePtr{val}.release());
+				auto ev = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
+				SendEvent(stream->event, 4, stream->description->Ref(), ev.release(), idxval, IntrusivePtr{val}.release());
 				}
 			}
 
 		// only if stream = true -> no streaming
 		if ( streamresult )
 			{
-			if ( ! stream->tab->Delete(idxval) )
+			if ( ! stream->tab->Remove(*idxval) )
 				Warning(i, "Internal error while deleting values from input table");
 			}
 		}
 
 	else if ( i->stream_type == EVENT_STREAM  )
 		{
-		EnumVal* type = BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED).release();
-		readVals = SendEventStreamEvent(i, type, vals);
+		auto type = zeek::BifType::Enum::Input::Event->GetVal(BifEnum::Input::EVENT_REMOVED);
+		readVals = SendEventStreamEvent(i, type.release(), vals);
 		success = true;
 		}
 
@@ -1783,7 +1768,7 @@ bool Manager::CallPred(Func* pred_func, const int numvals, ...) const
 
 	va_end(lP);
 
-	auto v = pred_func->Call(vl);
+	auto v = pred_func->Invoke(&vl);
 
 	if ( v )
 		result = v->AsBool();
@@ -1835,7 +1820,7 @@ RecordVal* Manager::ListValToRecordVal(ListVal* list, RecordType *request_type,
 	{
 	assert(position != nullptr); // we need the pointer to point to data;
 
-	RecordVal* rec = new RecordVal(request_type->AsRecordType());
+	RecordVal* rec = new RecordVal({NewRef{}, request_type});
 
 	assert(list != nullptr);
 	int maxpos = list->Length();
@@ -1845,15 +1830,15 @@ RecordVal* Manager::ListValToRecordVal(ListVal* list, RecordType *request_type,
 		assert ( (*position) <= maxpos );
 
 		Val* fieldVal = nullptr;
-		if ( request_type->FieldType(i)->Tag() == TYPE_RECORD )
-			fieldVal = ListValToRecordVal(list, request_type->FieldType(i)->AsRecordType(), position);
+		if ( request_type->GetFieldType(i)->Tag() == TYPE_RECORD )
+			fieldVal = ListValToRecordVal(list, request_type->GetFieldType(i)->AsRecordType(), position);
 		else
 			{
-			fieldVal = list->Index(*position);
+			fieldVal = list->Idx(*position).get();
 			(*position)++;
 			}
 
-		rec->Assign(i, fieldVal->Ref());
+		rec->Assign(i, {NewRef{}, fieldVal});
 		}
 
 	return rec;
@@ -1865,14 +1850,14 @@ RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const *v
 	{
 	assert(position != nullptr); // we need the pointer to point to data.
 
-	RecordVal* rec = new RecordVal(request_type->AsRecordType());
+	RecordVal* rec = new RecordVal({NewRef{}, request_type});
 	for ( int i = 0; i < request_type->NumFields(); i++ )
 		{
 		Val* fieldVal = nullptr;
-		if ( request_type->FieldType(i)->Tag() == TYPE_RECORD )
-			fieldVal = ValueToRecordVal(stream, vals, request_type->FieldType(i)->AsRecordType(), position, have_error);
-		else if ( request_type->FieldType(i)->Tag() == TYPE_FILE ||
-			  request_type->FieldType(i)->Tag() == TYPE_FUNC )
+		if ( request_type->GetFieldType(i)->Tag() == TYPE_RECORD )
+			fieldVal = ValueToRecordVal(stream, vals, request_type->GetFieldType(i)->AsRecordType(), position, have_error);
+		else if ( request_type->GetFieldType(i)->Tag() == TYPE_FILE ||
+			  request_type->GetFieldType(i)->Tag() == TYPE_FUNC )
 			{
 			// If those two unsupported types are encountered here, they have
 			// been let through by the type checking.
@@ -1881,16 +1866,16 @@ RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const *v
 			// Hence -> assign null to the field, done.
 
 			// Better check that it really is optional. Uou never know.
-			assert(request_type->FieldDecl(i)->FindAttr(ATTR_OPTIONAL));
+			assert(request_type->FieldDecl(i)->GetAttr(ATTR_OPTIONAL));
 			}
 		else
 			{
-			fieldVal = ValueToVal(stream, vals[*position], request_type->FieldType(i), have_error);
+			fieldVal = ValueToVal(stream, vals[*position], request_type->GetFieldType(i).get(), have_error);
 			(*position)++;
 			}
 
 		if ( fieldVal )
-			rec->Assign(i, fieldVal);
+			rec->Assign(i, {AdoptRef{}, fieldVal});
 		}
 
 	return rec;
@@ -2264,17 +2249,16 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
 	case TYPE_TABLE:
 		{
 		// all entries have to have the same type...
-		BroType* type = request_type->AsTableType()->Indices()->PureType();
-		auto set_index = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-		set_index->Append({NewRef{}, type});
+		const auto& type = request_type->AsTableType()->GetIndices()->GetPureType();
+		auto set_index = make_intrusive<TypeList>(type);
+		set_index->Append(type);
 		auto s = make_intrusive<SetType>(std::move(set_index), nullptr);
 		TableVal* t = new TableVal(std::move(s));
 		for ( int j = 0; j < val->val.set_val.size; j++ )
 			{
-			Val* assignval = ValueToVal(i, val->val.set_val.vals[j], type, have_error);
+			Val* assignval = ValueToVal(i, val->val.set_val.vals[j], type.get(), have_error);
 
-			t->Assign(assignval, nullptr);
-			Unref(assignval); // index is not consumed by assign.
+			t->Assign({AdoptRef{}, assignval}, nullptr);
 			}
 
 		return t;
@@ -2283,16 +2267,17 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
 	case TYPE_VECTOR:
 		{
 		// all entries have to have the same type...
-		BroType* type = request_type->AsVectorType()->YieldType();
-		VectorType* vt = new VectorType({NewRef{}, type});
-		VectorVal* v = new VectorVal(vt);
+		const auto& type = request_type->AsVectorType()->Yield();
+		auto vt = make_intrusive<VectorType>(type);
+		auto v = make_intrusive<VectorVal>(std::move(vt));
+
 		for ( int j = 0; j < val->val.vector_val.size; j++ )
 			{
-			v->Assign(j, ValueToVal(i, val->val.vector_val.vals[j], type, have_error));
+			auto el = ValueToVal(i, val->val.vector_val.vals[j], type.get(), have_error);
+			v->Assign(j, {AdoptRef{}, el});
 			}
 
-		Unref(vt);
-		return v;
+		return v.release();
 		}
 
 	case TYPE_ENUM: {
@@ -2316,7 +2301,8 @@ Val* Manager::ValueToVal(const Stream* i, const Value* val, BroType* request_typ
 			return nullptr;
 			}
 
-		return request_type->AsEnumType()->GetVal(index).release();
+		auto rval = request_type->AsEnumType()->GetVal(index);
+		return rval.release();
 		}
 
 	default:
@@ -2444,19 +2430,19 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co
 	// send our script level error event
 	if ( i->error_event )
 		{
-		EnumVal* ev;
+		IntrusivePtr<EnumVal> ev;
 		switch (et)
 			{
 			case ErrorType::INFO:
-				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::INFO).release();
+				ev = zeek::BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::INFO);
 				break;
 
 			case ErrorType::WARNING:
-				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::WARNING).release();
+				ev = zeek::BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::WARNING);
 				break;
 
 			case ErrorType::ERROR:
-				ev = BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::ERROR).release();
+				ev = zeek::BifType::Enum::Reporter::Level->GetVal(BifEnum::Reporter::ERROR);
 				break;
 
 			default:
@@ -2465,7 +2451,7 @@ void Manager::ErrorHandler(const Stream* i, ErrorType et, bool reporter_send, co
 			}
 
 		StringVal* message = new StringVal(buf);
-		SendEvent(i->error_event, 3, i->description->Ref(), message, ev);
+		SendEvent(i->error_event, 3, i->description->Ref(), message, ev.release());
 		}
 
 	if ( reporter_send )
diff --git a/src/input/ReaderFrontend.cc b/src/input/ReaderFrontend.cc
index 7fce36ee71..e634570d85 100644
--- a/src/input/ReaderFrontend.cc
+++ b/src/input/ReaderFrontend.cc
@@ -39,7 +39,7 @@ ReaderFrontend::ReaderFrontend(const ReaderBackend::ReaderInfo& arg_info, EnumVa
 	disabled = initialized = false;
 	info = new ReaderBackend::ReaderInfo(arg_info);
 
-	const char* t = type->Type()->AsEnumType()->Lookup(type->InternalInt());
+	const char* t = type->GetType()->AsEnumType()->Lookup(type->InternalInt());
 	name = copy_string(fmt("%s/%s", arg_info.source, t));
 
 	backend = input_mgr->CreateBackend(this, type);
diff --git a/src/input/Tag.cc b/src/input/Tag.cc
index a2c0708583..cbdcd59aae 100644
--- a/src/input/Tag.cc
+++ b/src/input/Tag.cc
@@ -6,7 +6,7 @@
 const input::Tag input::Tag::Error;
 
 input::Tag::Tag(type_t type, subtype_t subtype)
-	: ::Tag(input_mgr->GetTagEnumType(), type, subtype)
+	: ::Tag(input_mgr->GetTagType(), type, subtype)
 	{
 	}
 
@@ -16,7 +16,20 @@ input::Tag& input::Tag::operator=(const input::Tag& other)
 	return *this;
 	}
 
+const IntrusivePtr<EnumVal>& input::Tag::AsVal() const
+	{
+	return ::Tag::AsVal(input_mgr->GetTagType());
+	}
+
 EnumVal* input::Tag::AsEnumVal() const
 	{
-	return ::Tag::AsEnumVal(input_mgr->GetTagEnumType());
+	return AsVal().get();
 	}
+
+input::Tag::Tag(IntrusivePtr<EnumVal> val)
+	: ::Tag(std::move(val))
+	{ }
+
+input::Tag::Tag(EnumVal* val)
+	: ::Tag({NewRef{}, val})
+	{ }
diff --git a/src/input/Tag.h b/src/input/Tag.h
index 86f85ac36b..20a163da23 100644
--- a/src/input/Tag.h
+++ b/src/input/Tag.h
@@ -83,6 +83,9 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
+	const IntrusivePtr<EnumVal>& AsVal() const;
+
+	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
 
 	static const Tag Error;
@@ -108,7 +111,10 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Input::Reader.
 	 */
-	explicit Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(IntrusivePtr<EnumVal> val);
+
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr isntead.")]]
+	explicit Tag(EnumVal* val);
 };
 
 }
diff --git a/src/input/readers/ascii/Ascii.cc b/src/input/readers/ascii/Ascii.cc
index 3b108e365c..c3950cdc59 100644
--- a/src/input/readers/ascii/Ascii.cc
+++ b/src/input/readers/ascii/Ascii.cc
@@ -67,23 +67,23 @@ bool Ascii::DoInit(const ReaderInfo& info, int num_fields, const Field* const* f
 	{
 	StopWarningSuppression();
 
-	separator.assign( (const char*) BifConst::InputAscii::separator->Bytes(),
-	                 BifConst::InputAscii::separator->Len());
+	separator.assign( (const char*) zeek::BifConst::InputAscii::separator->Bytes(),
+	                 zeek::BifConst::InputAscii::separator->Len());
 
-	set_separator.assign( (const char*) BifConst::InputAscii::set_separator->Bytes(),
-	                     BifConst::InputAscii::set_separator->Len());
+	set_separator.assign( (const char*) zeek::BifConst::InputAscii::set_separator->Bytes(),
+	                     zeek::BifConst::InputAscii::set_separator->Len());
 
-	empty_field.assign( (const char*) BifConst::InputAscii::empty_field->Bytes(),
-	                   BifConst::InputAscii::empty_field->Len());
+	empty_field.assign( (const char*) zeek::BifConst::InputAscii::empty_field->Bytes(),
+	                   zeek::BifConst::InputAscii::empty_field->Len());
 
-	unset_field.assign( (const char*) BifConst::InputAscii::unset_field->Bytes(),
-	                   BifConst::InputAscii::unset_field->Len());
+	unset_field.assign( (const char*) zeek::BifConst::InputAscii::unset_field->Bytes(),
+	                   zeek::BifConst::InputAscii::unset_field->Len());
 
-	fail_on_invalid_lines = BifConst::InputAscii::fail_on_invalid_lines;
-	fail_on_file_problem = BifConst::InputAscii::fail_on_file_problem;
+	fail_on_invalid_lines = zeek::BifConst::InputAscii::fail_on_invalid_lines;
+	fail_on_file_problem = zeek::BifConst::InputAscii::fail_on_file_problem;
 
-	path_prefix.assign((const char*) BifConst::InputAscii::path_prefix->Bytes(),
-	                   BifConst::InputAscii::path_prefix->Len());
+	path_prefix.assign((const char*) zeek::BifConst::InputAscii::path_prefix->Bytes(),
+	                   zeek::BifConst::InputAscii::path_prefix->Len());
 
 	// Set per-filter configuration options.
 	for ( ReaderInfo::config_map::const_iterator i = info.config.begin(); i != info.config.end(); i++ )
diff --git a/src/input/readers/benchmark/Benchmark.cc b/src/input/readers/benchmark/Benchmark.cc
index a7b0cc7c44..26975ad411 100644
--- a/src/input/readers/benchmark/Benchmark.cc
+++ b/src/input/readers/benchmark/Benchmark.cc
@@ -18,15 +18,15 @@ using threading::Field;
 Benchmark::Benchmark(ReaderFrontend *frontend) : ReaderBackend(frontend)
 	{
 	num_lines = 0;
-	multiplication_factor = double(BifConst::InputBenchmark::factor);
-	autospread = double(BifConst::InputBenchmark::autospread);
-	spread = int(BifConst::InputBenchmark::spread);
-	add = int(BifConst::InputBenchmark::addfactor);
+	multiplication_factor = double(zeek::BifConst::InputBenchmark::factor);
+	autospread = double(zeek::BifConst::InputBenchmark::autospread);
+	spread = int(zeek::BifConst::InputBenchmark::spread);
+	add = int(zeek::BifConst::InputBenchmark::addfactor);
 	autospread_time = 0;
-	stopspreadat = int(BifConst::InputBenchmark::stopspreadat);
-	timedspread = double(BifConst::InputBenchmark::timedspread);
+	stopspreadat = int(zeek::BifConst::InputBenchmark::stopspreadat);
+	timedspread = double(zeek::BifConst::InputBenchmark::timedspread);
 	heartbeatstarttime = 0;
-	heartbeat_interval = double(BifConst::Threading::heartbeat_interval);
+	heartbeat_interval = double(zeek::BifConst::Threading::heartbeat_interval);
 
 	ascii = new threading::formatter::Ascii(this, threading::formatter::Ascii::SeparatorInfo());
 	}
diff --git a/src/input/readers/binary/Binary.cc b/src/input/readers/binary/Binary.cc
index 9aa815cb47..77db68a80e 100644
--- a/src/input/readers/binary/Binary.cc
+++ b/src/input/readers/binary/Binary.cc
@@ -19,7 +19,7 @@ Binary::Binary(ReaderFrontend *frontend)
 	{
 	if ( ! chunk_size )
 		{
-		chunk_size = BifConst::InputBinary::chunk_size;
+		chunk_size = zeek::BifConst::InputBinary::chunk_size;
 
 		if ( ! chunk_size )
 			chunk_size = 1024;
@@ -82,8 +82,8 @@ bool Binary::DoInit(const ReaderInfo& info, int num_fields,
 	ino = 0;
 	firstrun = true;
 
-	path_prefix.assign((const char*) BifConst::InputBinary::path_prefix->Bytes(),
-	                   BifConst::InputBinary::path_prefix->Len());
+	path_prefix.assign((const char*) zeek::BifConst::InputBinary::path_prefix->Bytes(),
+	                   zeek::BifConst::InputBinary::path_prefix->Len());
 
 	if ( ! info.source || strlen(info.source) == 0 )
 		{
diff --git a/src/input/readers/config/Config.cc b/src/input/readers/config/Config.cc
index f31226a69b..2416ff7af0 100644
--- a/src/input/readers/config/Config.cc
+++ b/src/input/readers/config/Config.cc
@@ -35,19 +35,19 @@ Config::Config(ReaderFrontend *frontend) : ReaderBackend(frontend)
 		if ( ! id->IsOption() )
 			continue;
 
-		if ( id->Type()->Tag() == TYPE_RECORD ||
-			 ! input::Manager::IsCompatibleType(id->Type()) )
+		if ( id->GetType()->Tag() == TYPE_RECORD ||
+			 ! input::Manager::IsCompatibleType(id->GetType().get()) )
 			{
-			option_types[id->Name()] = std::make_tuple(TYPE_ERROR, id->Type()->Tag());
+			option_types[id->Name()] = std::make_tuple(TYPE_ERROR, id->GetType()->Tag());
 			continue;
 			}
 
-		TypeTag primary = id->Type()->Tag();
+		TypeTag primary = id->GetType()->Tag();
 		TypeTag secondary = TYPE_VOID;
 		if ( primary == TYPE_TABLE )
-			secondary = id->Type()->AsSetType()->Indices()->PureType()->Tag();
+			secondary = id->GetType()->AsSetType()->GetIndices()->GetPureType()->Tag();
 		else if ( primary == TYPE_VECTOR )
-			secondary = id->Type()->AsVectorType()->YieldType()->Tag();
+			secondary = id->GetType()->AsVectorType()->Yield()->Tag();
 
 		option_types[id->Name()] = std::make_tuple(primary, secondary);
 		}
@@ -63,13 +63,13 @@ void Config::DoClose()
 
 bool Config::DoInit(const ReaderInfo& info, int num_fields, const Field* const* fields)
 	{
-	fail_on_file_problem = BifConst::InputConfig::fail_on_file_problem;
+	fail_on_file_problem = zeek::BifConst::InputConfig::fail_on_file_problem;
 
-	set_separator.assign( (const char*) BifConst::InputConfig::set_separator->Bytes(),
-	                     BifConst::InputConfig::set_separator->Len());
+	set_separator.assign( (const char*) zeek::BifConst::InputConfig::set_separator->Bytes(),
+	                     zeek::BifConst::InputConfig::set_separator->Len());
 
-	empty_field.assign( (const char*) BifConst::InputConfig::empty_field->Bytes(),
-	                   BifConst::InputConfig::empty_field->Len());
+	empty_field.assign( (const char*) zeek::BifConst::InputConfig::empty_field->Bytes(),
+	                   zeek::BifConst::InputConfig::empty_field->Len());
 
 	formatter::Ascii::SeparatorInfo sep_info("\t", set_separator, "", empty_field);
 	formatter = std::unique_ptr<threading::formatter::Formatter>(new formatter::Ascii(this, sep_info));
diff --git a/src/input/readers/raw/Raw.cc b/src/input/readers/raw/Raw.cc
index b8bfbdb1da..d1dd8c9aac 100644
--- a/src/input/readers/raw/Raw.cc
+++ b/src/input/readers/raw/Raw.cc
@@ -34,10 +34,10 @@ Raw::Raw(ReaderFrontend *frontend) : ReaderBackend(frontend), file(nullptr, fclo
 	ino = 0;
 	forcekill = false;
 	offset = 0;
-	separator.assign( (const char*) BifConst::InputRaw::record_separator->Bytes(),
-			  BifConst::InputRaw::record_separator->Len());
+	separator.assign( (const char*) zeek::BifConst::InputRaw::record_separator->Bytes(),
+			  zeek::BifConst::InputRaw::record_separator->Len());
 
-	sep_length = BifConst::InputRaw::record_separator->Len();
+	sep_length = zeek::BifConst::InputRaw::record_separator->Len();
 
 	bufpos = 0;
 
diff --git a/src/input/readers/sqlite/SQLite.cc b/src/input/readers/sqlite/SQLite.cc
index e5e3a133e4..fccb9a5b0b 100644
--- a/src/input/readers/sqlite/SQLite.cc
+++ b/src/input/readers/sqlite/SQLite.cc
@@ -24,18 +24,18 @@ SQLite::SQLite(ReaderFrontend *frontend)
 	  fields(), num_fields(), mode(), started(), query(), db(), st()
 	{
 	set_separator.assign(
-			(const char*) BifConst::LogSQLite::set_separator->Bytes(),
-			BifConst::InputSQLite::set_separator->Len()
+			(const char*) zeek::BifConst::LogSQLite::set_separator->Bytes(),
+			zeek::BifConst::InputSQLite::set_separator->Len()
 			);
 
 	unset_field.assign(
-			(const char*) BifConst::LogSQLite::unset_field->Bytes(),
-			BifConst::InputSQLite::unset_field->Len()
+			(const char*) zeek::BifConst::LogSQLite::unset_field->Bytes(),
+			zeek::BifConst::InputSQLite::unset_field->Len()
 			);
 
 	empty_field.assign(
-			(const char*) BifConst::LogAscii::empty_field->Bytes(),
-			BifConst::InputSQLite::empty_field->Len()
+			(const char*) zeek::BifConst::LogAscii::empty_field->Bytes(),
+			zeek::BifConst::InputSQLite::empty_field->Len()
 			);
 
 	io = new threading::formatter::Ascii(this, threading::formatter::Ascii::SeparatorInfo(std::string(), set_separator, unset_field, empty_field));
diff --git a/src/iosource/Manager.cc b/src/iosource/Manager.cc
index 6ffc924ab8..d97b585894 100644
--- a/src/iosource/Manager.cc
+++ b/src/iosource/Manager.cc
@@ -115,7 +115,7 @@ void Manager::FindReadySources(std::vector<IOSource*>* ready)
 
 	// If there aren't any sources and exit_only_after_terminate is false, just
 	// return an empty set of sources. We want the main loop to end.
-	if ( Size() == 0 && ( ! BifConst::exit_only_after_terminate || terminating ) )
+	if ( Size() == 0 && ( ! zeek::BifConst::exit_only_after_terminate || terminating ) )
 		return;
 
 	double timeout = -1;
diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc
index 09cc2f1fa6..75554662cf 100644
--- a/src/iosource/Packet.cc
+++ b/src/iosource/Packet.cc
@@ -2,7 +2,9 @@
 #include "Sessions.h"
 #include "Desc.h"
 #include "IP.h"
+#include "IntrusivePtr.h"
 #include "iosource/Manager.h"
+#include "Var.h"
 
 extern "C" {
 #include <pcap.h>
@@ -590,10 +592,12 @@ void Packet::ProcessLayer2()
 	hdr_size = (pdata - data);
 }
 
-RecordVal* Packet::BuildPktHdrVal() const
+IntrusivePtr<RecordVal> Packet::ToRawPktHdrVal() const
 	{
-	RecordVal* pkt_hdr = new RecordVal(raw_pkt_hdr_type);
-	RecordVal* l2_hdr = new RecordVal(l2_hdr_type);
+	static auto raw_pkt_hdr_type = zeek::id::find_type<RecordType>("raw_pkt_hdr");
+	static auto l2_hdr_type = zeek::id::find_type<RecordType>("l2_hdr");
+	auto pkt_hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
+	auto l2_hdr = make_intrusive<RecordVal>(l2_hdr_type);
 
 	bool is_ethernet = link_type == DLT_EN10MB;
 
@@ -623,7 +627,7 @@ RecordVal* Packet::BuildPktHdrVal() const
 		{
 		// Ethernet header layout is:
 		//    dst[6bytes] src[6bytes] ethertype[2bytes]...
-		l2_hdr->Assign(0, BifType::Enum::link_encap->GetVal(BifEnum::LINK_ETHERNET));
+		l2_hdr->Assign(0, zeek::BifType::Enum::link_encap->GetVal(BifEnum::LINK_ETHERNET));
 		l2_hdr->Assign(3, FmtEUI48(data + 6));	// src
 		l2_hdr->Assign(4, FmtEUI48(data));  	// dst
 
@@ -640,37 +644,42 @@ RecordVal* Packet::BuildPktHdrVal() const
 			l3 = BifEnum::L3_ARP;
 		}
 	else
-		l2_hdr->Assign(0, BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN));
+		l2_hdr->Assign(0, zeek::BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN));
 
 	l2_hdr->Assign(1, val_mgr->Count(len));
 	l2_hdr->Assign(2, val_mgr->Count(cap_len));
 
-	l2_hdr->Assign(8, BifType::Enum::layer3_proto->GetVal(l3));
+	l2_hdr->Assign(8, zeek::BifType::Enum::layer3_proto->GetVal(l3));
 
-	pkt_hdr->Assign(0, l2_hdr);
+	pkt_hdr->Assign(0, std::move(l2_hdr));
 
 	if ( l3_proto == L3_IPV4 )
 		{
 		IP_Hdr ip_hdr((const struct ip*)(data + hdr_size), false);
-		return ip_hdr.BuildPktHdrVal(pkt_hdr, 1);
+		return ip_hdr.ToPktHdrVal(std::move(pkt_hdr), 1);
 		}
 
 	else if ( l3_proto == L3_IPV6 )
 		{
 		IP_Hdr ip6_hdr((const struct ip6_hdr*)(data + hdr_size), false, cap_len);
-		return ip6_hdr.BuildPktHdrVal(pkt_hdr, 1);
+		return ip6_hdr.ToPktHdrVal(std::move(pkt_hdr), 1);
 		}
 
 	else
 		return pkt_hdr;
 	}
 
-Val *Packet::FmtEUI48(const u_char *mac) const
+RecordVal* Packet::BuildPktHdrVal() const
+	{
+	return ToRawPktHdrVal().release();
+	}
+
+IntrusivePtr<Val> Packet::FmtEUI48(const u_char* mac) const
 	{
 	char buf[20];
 	snprintf(buf, sizeof buf, "%02x:%02x:%02x:%02x:%02x:%02x",
 		 mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
-	return new StringVal(buf);
+	return make_intrusive<StringVal>(buf);
 	}
 
 void Packet::Describe(ODesc* d) const
diff --git a/src/iosource/Packet.h b/src/iosource/Packet.h
index 2da4836b7b..83b0fddb59 100644
--- a/src/iosource/Packet.h
+++ b/src/iosource/Packet.h
@@ -16,6 +16,7 @@ class Val;
 class ODesc;
 class IP_Hdr;
 class RecordVal;
+template <class T> class IntrusivePtr;
 
 /**
  * The Layer 3 type of a packet, as determined by the parsing code in Packet.
@@ -127,6 +128,9 @@ public:
 	 * Returns a \c raw_pkt_hdr RecordVal, which includes layer 2 and
 	 * also everything in IP_Hdr (i.e., IP4/6 + TCP/UDP/ICMP).
 	 */
+	IntrusivePtr<RecordVal> ToRawPktHdrVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToRawPktHdrval() instead.")]]
 	RecordVal* BuildPktHdrVal() const;
 
 	/**
@@ -221,7 +225,7 @@ private:
 	void Weird(const char* name);
 
 	// Renders an MAC address into its ASCII representation.
-	Val* FmtEUI48(const u_char *mac) const;
+	IntrusivePtr<Val> FmtEUI48(const u_char* mac) const;
 
 	// True if we need to delete associated packet memory upon
 	// destruction.
diff --git a/src/iosource/PktSrc.cc b/src/iosource/PktSrc.cc
index 0aa1a2568e..8c0432425b 100644
--- a/src/iosource/PktSrc.cc
+++ b/src/iosource/PktSrc.cc
@@ -271,7 +271,7 @@ bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
 	// Compile filter.
 	BPF_Program* code = new BPF_Program();
 
-	if ( ! code->Compile(BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf, sizeof(errbuf)) )
+	if ( ! code->Compile(zeek::BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf, sizeof(errbuf)) )
 		{
 		std::string msg = fmt("cannot compile BPF filter \"%s\"", filter.c_str());
 
diff --git a/src/iosource/pcap/Dumper.cc b/src/iosource/pcap/Dumper.cc
index 5bbf12dfa6..d161adda88 100644
--- a/src/iosource/pcap/Dumper.cc
+++ b/src/iosource/pcap/Dumper.cc
@@ -27,7 +27,7 @@ void PcapDumper::Open()
 	{
 	int linktype = -1;
 
-	pd = pcap_open_dead(DLT_EN10MB, BifConst::Pcap::snaplen);
+	pd = pcap_open_dead(DLT_EN10MB, zeek::BifConst::Pcap::snaplen);
 
 	if ( ! pd )
 		{
diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc
index 31599139ac..8df5111da0 100644
--- a/src/iosource/pcap/Source.cc
+++ b/src/iosource/pcap/Source.cc
@@ -111,7 +111,7 @@ void PcapSource::OpenLive()
 		return;
 		}
 
-	if ( pcap_set_snaplen(pd, BifConst::Pcap::snaplen) )
+	if ( pcap_set_snaplen(pd, zeek::BifConst::Pcap::snaplen) )
 		{
 		PcapError("pcap_set_snaplen");
 		return;
@@ -137,7 +137,7 @@ void PcapSource::OpenLive()
 		return;
 		}
 
-	if ( pcap_set_buffer_size(pd, BifConst::Pcap::bufsize * 1024 * 1024) )
+	if ( pcap_set_buffer_size(pd, zeek::BifConst::Pcap::bufsize * 1024 * 1024) )
 		{
 		PcapError("pcap_set_buffer_size");
 		return;
diff --git a/src/legacy-netvar-init.cc b/src/legacy-netvar-init.cc
new file mode 100644
index 0000000000..f5f7ee52f0
--- /dev/null
+++ b/src/legacy-netvar-init.cc
@@ -0,0 +1,93 @@
+
+#include "NetVar.h"
+#include "Var.h"
+#include "ID.h"
+#include "Scope.h"
+
+// Compiled separately to avoid deprecation warnings at the assignment sites.
+void zeek_legacy_netvar_init()
+	{
+	::conn_id = zeek::id::conn_id.get();
+	::endpoint = zeek::id::endpoint.get();
+	::connection_type = zeek::id::connection.get();
+	::fa_file_type = zeek::id::fa_file.get();
+	::fa_metadata_type = zeek::id::fa_metadata.get();
+	::icmp_conn = zeek::id::find_type("icmp_conn")->AsRecordType();
+	::icmp_context = zeek::id::find_type("icmp_context")->AsRecordType();
+	::signature_state = zeek::id::find_type("signature_state")->AsRecordType();
+	::SYN_packet = zeek::id::find_type("SYN_packet")->AsRecordType();
+	::pcap_packet = zeek::id::find_type("pcap_packet")->AsRecordType();
+	::raw_pkt_hdr_type = zeek::id::find_type("raw_pkt_hdr")->AsRecordType();
+	::l2_hdr_type = zeek::id::find_type("l2_hdr")->AsRecordType();
+	::transport_proto = zeek::id::transport_proto.get();
+	::string_set = zeek::id::string_set.get();
+	::string_array = zeek::id::string_array.get();
+	::count_set = zeek::id::count_set.get();
+	::string_vec = zeek::id::string_vec.get();
+	::index_vec = zeek::id::index_vec.get();
+	::mime_matches = zeek::id::find_type("mime_matches")->AsVectorType();
+	::mime_match = zeek::id::find_type("mime_match")->AsRecordType();
+	::socks_address = zeek::id::find_type("SOCKS::Address")->AsRecordType();
+	::mime_header_rec = zeek::id::find_type("mime_header_rec")->AsRecordType();
+	::mime_header_list = zeek::id::find_type("mime_header_list")->AsTableType();
+	::http_stats_rec = zeek::id::find_type("http_stats_rec")->AsRecordType();
+	::http_message_stat = zeek::id::find_type("http_message_stat")->AsRecordType();
+	::pm_mapping = zeek::id::find_type("pm_mapping")->AsRecordType();
+	::pm_mappings = zeek::id::find_type("pm_mappings")->AsTableType();
+	::pm_port_request = zeek::id::find_type("pm_port_request")->AsRecordType();
+	::pm_callit_request = zeek::id::find_type("pm_callit_request")->AsRecordType();
+	::geo_location = zeek::id::find_type("geo_location")->AsRecordType();
+	::entropy_test_result = zeek::id::find_type("entropy_test_result")->AsRecordType();
+	::dns_msg = zeek::id::find_type("dns_msg")->AsRecordType();
+	::dns_answer = zeek::id::find_type("dns_answer")->AsRecordType();
+	::dns_soa = zeek::id::find_type("dns_soa")->AsRecordType();
+	::dns_edns_additional = zeek::id::find_type("dns_edns_additional")->AsRecordType();
+	::dns_tsig_additional = zeek::id::find_type("dns_tsig_additional")->AsRecordType();
+	::dns_rrsig_rr = zeek::id::find_type("dns_rrsig_rr")->AsRecordType();
+	::dns_dnskey_rr = zeek::id::find_type("dns_dnskey_rr")->AsRecordType();
+	::dns_nsec3_rr = zeek::id::find_type("dns_nsec3_rr")->AsRecordType();
+	::dns_ds_rr = zeek::id::find_type("dns_ds_rr")->AsRecordType();
+	::rotate_info = zeek::id::find_type("rotate_info")->AsRecordType();
+	::irc_join_list = zeek::id::find_type("irc_join_list")->AsTableType();
+	::irc_join_info = zeek::id::find_type("irc_join_info")->AsRecordType();
+	::script_id = zeek::id::find_type("script_id")->AsRecordType();
+	::id_table = zeek::id::find_type("id_table")->AsTableType();
+	::record_field = zeek::id::find_type("record_field")->AsRecordType();
+	::record_field_table = zeek::id::find_type("record_field_table")->AsTableType();
+	::call_argument = zeek::id::find_type("call_argument")->AsRecordType();
+	::call_argument_vector = zeek::id::find_type("call_argument_vector")->AsVectorType();
+
+	::log_rotate_base_time = zeek::id::find_val("log_rotate_base_time")->AsStringVal();
+	::pkt_profile_file = zeek::id::find_val("pkt_profile_file").get();
+	::likely_server_ports = zeek::id::find_val("likely_server_ports")->AsTableVal();
+	::tcp_content_delivery_ports_orig = zeek::id::find_val("tcp_content_delivery_ports_orig")->AsTableVal();
+	::tcp_content_delivery_ports_resp = zeek::id::find_val("tcp_content_delivery_ports_resp")->AsTableVal();
+	::stp_skip_src = zeek::id::find_val("stp_skip_src")->AsTableVal();
+	::dns_skip_auth = zeek::id::find_val("dns_skip_auth")->AsTableVal();
+	::dns_skip_addl = zeek::id::find_val("dns_skip_addl")->AsTableVal();
+	::udp_content_ports = zeek::id::find_val("udp_content_ports")->AsTableVal();
+	::udp_content_delivery_ports_orig = zeek::id::find_val("udp_content_delivery_ports_orig")->AsTableVal();
+	::udp_content_delivery_ports_resp = zeek::id::find_val("udp_content_delivery_ports_resp")->AsTableVal();
+	::profiling_file = zeek::id::find_val("profiling_file").get();
+	::global_hash_seed = zeek::id::find_val("global_hash_seed")->AsStringVal();
+	::tcp_reassembler_ports_orig = zeek::id::find_val("tcp_reassembler_ports_orig")->AsTableVal();
+	::tcp_reassembler_ports_resp = zeek::id::find_val("tcp_reassembler_ports_resp")->AsTableVal();
+	::peer_description = zeek::id::find_val("peer_description")->AsStringVal();
+	::trace_output_file = zeek::id::find_val("trace_output_file")->AsStringVal();
+	::cmd_line_bpf_filter = zeek::id::find_val("cmd_line_bpf_filter")->AsStringVal();
+
+	auto anon_id = global_scope()->Lookup("preserve_orig_addr");
+
+	if ( anon_id )
+		preserve_orig_addr = anon_id->GetVal()->AsTableVal();
+
+	anon_id = global_scope()->Lookup("preserve_resp_addr");
+
+	if ( anon_id )
+		preserve_resp_addr = anon_id->GetVal()->AsTableVal();
+
+	anon_id = global_scope()->Lookup("preserve_other_addr");
+
+	if ( anon_id )
+		preserve_other_addr = anon_id->GetVal()->AsTableVal();
+	}
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index a41b204369..8ab3ba9f51 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -229,25 +229,23 @@ void Manager::RemoveDisabledWriters(Stream* stream)
 
 bool Manager::CreateStream(EnumVal* id, RecordVal* sval)
 	{
-	RecordType* rtype = sval->Type()->AsRecordType();
-
-	if ( ! same_type(rtype, BifType::Record::Log::Stream, false) )
+	if ( ! same_type(sval->GetType(), zeek::BifType::Record::Log::Stream, false) )
 		{
 		reporter->Error("sval argument not of right type");
 		return false;
 		}
 
-	RecordType* columns = sval->Lookup("columns")
-		->AsType()->AsTypeType()->Type()->AsRecordType();
+	RecordType* columns = sval->GetField("columns")
+		->AsType()->AsTypeType()->GetType()->AsRecordType();
 
 	bool log_attr_present = false;
 
 	for ( int i = 0; i < columns->NumFields(); i++ )
 		{
-		if ( ! (columns->FieldDecl(i)->FindAttr(ATTR_LOG)) )
+		if ( ! (columns->FieldDecl(i)->GetAttr(ATTR_LOG)) )
 		    continue;
 
-		if ( ! threading::Value::IsCompatibleType(columns->FieldType(i)) )
+		if ( ! threading::Value::IsCompatibleType(columns->GetFieldType(i).get()) )
 			{
 			reporter->Error("type of field '%s' is not support for logging output",
 				 columns->FieldName(i));
@@ -264,13 +262,13 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval)
 		return false;
 		}
 
-	auto event_val = sval->Lookup("ev");
+	const auto& event_val = sval->GetField("ev");
 	Func* event = event_val ? event_val->AsFunc() : nullptr;
 
 	if ( event )
 		{
 		// Make sure the event is prototyped as expected.
-		FuncType* etype = event->FType()->AsFuncType();
+		const auto& etype = event->GetType();
 
 		if ( etype->Flavor() != FUNC_FLAVOR_EVENT )
 			{
@@ -278,15 +276,15 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval)
 			return false;
 			}
 
-		const type_list* args = etype->ArgTypes()->Types();
+		const auto& args = etype->ParamList()->Types();
 
-		if ( args->length() != 1 )
+		if ( args.size() != 1 )
 			{
 			reporter->Error("stream event must take a single argument");
 			return false;
 			}
 
-		if ( ! same_type((*args)[0], columns) )
+		if ( ! same_type(args[0], columns) )
 			{
 			reporter->Error("stream event's argument type does not match column record type");
 			return false;
@@ -309,11 +307,11 @@ bool Manager::CreateStream(EnumVal* id, RecordVal* sval)
 	streams[idx] = new Stream;
 	streams[idx]->id = id->Ref()->AsEnumVal();
 	streams[idx]->enabled = true;
-	streams[idx]->name = id->Type()->AsEnumType()->Lookup(idx);
+	streams[idx]->name = id->GetType()->AsEnumType()->Lookup(idx);
 	streams[idx]->event = event ? event_registry->Lookup(event->Name()) : nullptr;
 	streams[idx]->columns = columns->Ref()->AsRecordType();
 
-	streams[idx]->enable_remote = internal_val("Log::enable_remote_logging")->AsBool();
+	streams[idx]->enable_remote = zeek::id::find_val("Log::enable_remote_logging")->AsBool();
 
 	DBG_LOG(DBG_LOGGING, "Created new logging stream '%s', raising event %s",
 		streams[idx]->name.c_str(), event ? streams[idx]->event->Name() : "<none>");
@@ -401,7 +399,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 		if ( j < num_ext_fields )
 			{
 			i = j;
-			rtype = filter->ext_func->FType()->YieldType()->AsRecordType();
+			rtype = filter->ext_func->GetType()->Yield()->AsRecordType();
 			}
 		else
 			{
@@ -409,10 +407,10 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 			rtype = rt;
 			}
 
-		BroType* t = rtype->FieldType(i);
+		const auto& t = rtype->GetFieldType(i);
 
 		// Ignore if &log not specified.
-		if ( ! rtype->FieldDecl(i)->FindAttr(ATTR_LOG) )
+		if ( ! rtype->FieldDecl(i)->GetAttr(ATTR_LOG) )
 			continue;
 
 		list<int> new_indices = indices;
@@ -477,10 +475,8 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 		// If include fields are specified, only include if explicitly listed.
 		if ( include )
 			{
-			StringVal* new_path_val = new StringVal(new_path.c_str());
-			bool result = (bool)include->Lookup(new_path_val);
-
-			Unref(new_path_val);
+			auto new_path_val = make_intrusive<StringVal>(new_path.c_str());
+			bool result = (bool)include->FindOrDefault(new_path_val);
 
 			if ( ! result )
 				continue;
@@ -489,10 +485,8 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 		// If exclude fields are specified, do not only include if listed.
 		if ( exclude )
 			{
-			StringVal* new_path_val = new StringVal(new_path.c_str());
-			bool result = (bool)exclude->Lookup(new_path_val);
-
-			Unref(new_path_val);
+			auto new_path_val = make_intrusive<StringVal>(new_path.c_str());
+			bool result = (bool)exclude->FindOrDefault(new_path_val);
 
 			if ( result )
 				continue;
@@ -517,12 +511,12 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 		TypeTag st = TYPE_VOID;
 
 		if ( t->Tag() == TYPE_TABLE )
-			st = t->AsSetType()->Indices()->PureType()->Tag();
+			st = t->AsSetType()->GetIndices()->GetPureType()->Tag();
 
 		else if ( t->Tag() == TYPE_VECTOR )
-			st = t->AsVectorType()->YieldType()->Tag();
+			st = t->AsVectorType()->Yield()->Tag();
 
-		bool optional = rtype->FieldDecl(i)->FindAttr(ATTR_OPTIONAL);
+		bool optional = (bool)rtype->FieldDecl(i)->GetAttr(ATTR_OPTIONAL);
 
 		filter->fields[filter->num_fields - 1] = new threading::Field(new_path.c_str(), nullptr, t->Tag(), st, optional);
 		}
@@ -532,9 +526,7 @@ bool Manager::TraverseRecord(Stream* stream, Filter* filter, RecordType* rt,
 
 bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 	{
-	RecordType* rtype = fval->Type()->AsRecordType();
-
-	if ( ! same_type(rtype, BifType::Record::Log::Filter, false) )
+	if ( ! same_type(fval->GetType(), zeek::BifType::Record::Log::Filter, false) )
 		{
 		reporter->Error("filter argument not of right type");
 		return false;
@@ -545,22 +537,22 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 		return false;
 
 	// Find the right writer type.
-	EnumVal* writer = fval->Lookup("writer", true)->AsEnumVal();
+	auto writer = fval->GetFieldOrDefault<EnumVal>("writer");
 
 	// Create a new Filter instance.
 
-	auto name = fval->Lookup("name", true);
-	auto pred = fval->Lookup("pred", true);
-	auto path_func = fval->Lookup("path_func", true);
-	auto log_local = fval->Lookup("log_local", true);
-	auto log_remote = fval->Lookup("log_remote", true);
-	auto interv = fval->Lookup("interv", true);
-	auto postprocessor = fval->Lookup("postprocessor", true);
-	auto config = fval->Lookup("config", true);
-	auto field_name_map = fval->Lookup("field_name_map", true);
-	auto scope_sep = fval->Lookup("scope_sep", true);
-	auto ext_prefix = fval->Lookup("ext_prefix", true);
-	auto ext_func = fval->Lookup("ext_func", true);
+	auto name = fval->GetFieldOrDefault("name");
+	auto pred = fval->GetFieldOrDefault("pred");
+	auto path_func = fval->GetFieldOrDefault("path_func");
+	auto log_local = fval->GetFieldOrDefault("log_local");
+	auto log_remote = fval->GetFieldOrDefault("log_remote");
+	auto interv = fval->GetFieldOrDefault("interv");
+	auto postprocessor = fval->GetFieldOrDefault("postprocessor");
+	auto config = fval->GetFieldOrDefault("config");
+	auto field_name_map = fval->GetFieldOrDefault("field_name_map");
+	auto scope_sep = fval->GetFieldOrDefault("scope_sep");
+	auto ext_prefix = fval->GetFieldOrDefault("ext_prefix");
+	auto ext_func = fval->GetFieldOrDefault("ext_func");
 
 	Filter* filter = new Filter;
 	filter->fval = fval->Ref();
@@ -581,24 +573,24 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 
 	// Build the list of fields that the filter wants included, including
 	// potentially rolling out fields.
-	auto include = fval->Lookup("include");
-	auto exclude = fval->Lookup("exclude");
+	const auto& include = fval->GetField("include");
+	const auto& exclude = fval->GetField("exclude");
 
 	filter->num_ext_fields = 0;
 	if ( filter->ext_func )
 		{
-		if ( filter->ext_func->FType()->YieldType()->Tag() == TYPE_RECORD )
+		if ( filter->ext_func->GetType()->Yield()->Tag() == TYPE_RECORD )
 			{
-			filter->num_ext_fields = filter->ext_func->FType()->YieldType()->AsRecordType()->NumFields();
+			filter->num_ext_fields = filter->ext_func->GetType()->Yield()->AsRecordType()->NumFields();
 			}
-		else if ( filter->ext_func->FType()->YieldType()->Tag() == TYPE_VOID )
+		else if ( filter->ext_func->GetType()->Yield()->Tag() == TYPE_VOID )
 			{
 			// This is a special marker for the default no-implementation
 			// of the ext_func and we'll allow it to slide.
 			}
 		else
 			{
-			reporter->Error("Return value of log_ext is not a record (got %s)", type_name(filter->ext_func->FType()->YieldType()->Tag()));
+			reporter->Error("Return value of log_ext is not a record (got %s)", type_name(filter->ext_func->GetType()->Yield()->Tag()));
 			delete filter;
 			return false;
 			}
@@ -616,7 +608,7 @@ bool Manager::AddFilter(EnumVal* id, RecordVal* fval)
 		}
 
 	// Get the path for the filter.
-	auto path_val = fval->Lookup("path");
+	auto path_val = fval->GetField("path");
 
 	if ( path_val )
 		{
@@ -701,7 +693,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 	if ( ! stream->enabled )
 		return true;
 
-	auto columns = columns_arg->CoerceTo(stream->columns);
+	auto columns = columns_arg->CoerceTo({NewRef{}, stream->columns});
 
 	if ( ! columns )
 		{
@@ -725,7 +717,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 			// See whether the predicates indicates that we want
 			// to log this record.
 			int result = 1;
-			auto v = filter->pred->Call(columns);
+			auto v = filter->pred->Invoke(columns);
 
 			if ( v )
 				result = v->AsBool();
@@ -744,22 +736,22 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 				path_arg = val_mgr->EmptyString();
 
 			IntrusivePtr<Val> rec_arg;
-			BroType* rt = filter->path_func->FType()->Args()->FieldType("rec");
+			const auto& rt = filter->path_func->GetType()->Params()->GetFieldType("rec");
 
 			if ( rt->Tag() == TYPE_RECORD )
-				rec_arg = columns->CoerceTo(rt->AsRecordType(), true);
+				rec_arg = columns->CoerceTo(cast_intrusive<RecordType>(rt), true);
 			else
 				// Can be TYPE_ANY here.
 				rec_arg = columns;
 
-			auto v = filter->path_func->Call(IntrusivePtr{NewRef{}, id},
-			                                 std::move(path_arg),
-			                                 std::move(rec_arg));
+			auto v = filter->path_func->Invoke(IntrusivePtr{NewRef{}, id},
+			                                   std::move(path_arg),
+			                                   std::move(rec_arg));
 
 			if ( ! v )
 				return false;
 
-			if ( v->Type()->Tag() != TYPE_STRING )
+			if ( v->GetType()->Tag() != TYPE_STRING )
 				{
 				reporter->Error("path_func did not return string");
 				return false;
@@ -826,7 +818,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 				auto wi = w->second;
 				wi->hook_initialized = true;
 				PLUGIN_HOOK_VOID(HOOK_LOG_INIT,
-				                 HookLogInit(filter->writer->Type()->AsEnumType()->Lookup(filter->writer->InternalInt()),
+				                 HookLogInit(filter->writer->GetType()->AsEnumType()->Lookup(filter->writer->InternalInt()),
 				                             wi->instantiating_filter, filter->local,
 				                             filter->remote, *wi->info,
 				                             filter->num_fields,
@@ -848,13 +840,13 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 				if ( filter->field_name_map )
 					{
 					const char* name = filter->fields[j]->name;
-					StringVal *fn = new StringVal(name);
-					if ( auto val = filter->field_name_map->Lookup(fn, false) )
+					auto fn = make_intrusive<StringVal>(name);
+
+					if ( const auto& val = filter->field_name_map->Find(fn) )
 						{
 						delete [] filter->fields[j]->name;
 						filter->fields[j]->name = copy_string(val->AsStringVal()->CheckString());
 						}
-					delete fn;
 					}
 				arg_fields[j] = new threading::Field(*filter->fields[j]);
 				}
@@ -869,9 +861,9 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 			TableEntryVal* v;
 			while ( (v = filter->config->AsTable()->NextEntry(k, c)) )
 				{
-				auto index = filter->config->RecoverIndex(k);
-				string key = index->Index(0)->AsString()->CheckString();
-				string value = v->Value()->AsString()->CheckString();
+				auto index = filter->config->RecreateIndex(*k);
+				string key = index->Idx(0)->AsString()->CheckString();
+				string value = v->GetVal()->AsString()->CheckString();
 				info->config.insert(std::make_pair(copy_string(key.c_str()), copy_string(value.c_str())));
 				delete k;
 				}
@@ -891,7 +883,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 		threading::Value** vals = RecordToFilterVals(stream, filter, columns.get());
 
 		if ( ! PLUGIN_HOOK_WITH_RESULT(HOOK_LOG_WRITE,
-		                               HookLogWrite(filter->writer->Type()->AsEnumType()->Lookup(filter->writer->InternalInt()),
+		                               HookLogWrite(filter->writer->GetType()->AsEnumType()->Lookup(filter->writer->InternalInt()),
 		                                            filter->name, *info,
 		                                            filter->num_fields,
 		                                            filter->fields, vals),
@@ -922,7 +914,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns_arg)
 threading::Value* Manager::ValToLogVal(Val* val, BroType* ty)
 	{
 	if ( ! ty )
-		ty = val->Type();
+		ty = val->GetType().get();
 
 	if ( ! val )
 		return new threading::Value(ty->Tag(), false);
@@ -938,7 +930,7 @@ threading::Value* Manager::ValToLogVal(Val* val, BroType* ty)
 	case TYPE_ENUM:
 		{
 		const char* s =
-			val->Type()->AsEnumType()->Lookup(val->InternalInt());
+			val->GetType()->AsEnumType()->Lookup(val->InternalInt());
 
 		if ( s )
 			{
@@ -948,7 +940,7 @@ threading::Value* Manager::ValToLogVal(Val* val, BroType* ty)
 
 		else
 			{
-			val->Type()->Error("enum type does not contain value", val);
+			val->GetType()->Error("enum type does not contain value", val);
 			lval->val.string_val.data = copy_string("");
 			lval->val.string_val.length = 0;
 			}
@@ -1012,19 +1004,18 @@ threading::Value* Manager::ValToLogVal(Val* val, BroType* ty)
 
 	case TYPE_TABLE:
 		{
-		ListVal* set = val->AsTableVal()->ConvertToPureList();
+		auto set = val->AsTableVal()->ToPureListVal();
 		if ( ! set )
-			// ConvertToPureList has reported an internal warning
+			// ToPureListVal has reported an internal warning
 			// already. Just keep going by making something up.
-			set = new ListVal(TYPE_INT);
+			set = make_intrusive<ListVal>(TYPE_INT);
 
 		lval->val.set_val.size = set->Length();
 		lval->val.set_val.vals = new threading::Value* [lval->val.set_val.size];
 
 		for ( int i = 0; i < lval->val.set_val.size; i++ )
-			lval->val.set_val.vals[i] = ValToLogVal(set->Index(i));
+			lval->val.set_val.vals[i] = ValToLogVal(set->Idx(i).get());
 
-		Unref(set);
 		break;
 		}
 
@@ -1038,8 +1029,8 @@ threading::Value* Manager::ValToLogVal(Val* val, BroType* ty)
 		for ( int i = 0; i < lval->val.vector_val.size; i++ )
 			{
 			lval->val.vector_val.vals[i] =
-				ValToLogVal(vec->Lookup(i),
-					    vec->Type()->YieldType());
+				ValToLogVal(vec->At(i).get(),
+					    vec->GetType()->Yield().get());
 			}
 
 		break;
@@ -1059,7 +1050,7 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter,
 
 	if ( filter->num_ext_fields > 0 )
 		{
-		auto res = filter->ext_func->Call(IntrusivePtr{NewRef{}, filter->path_val});
+		auto res = filter->ext_func->Invoke(IntrusivePtr{NewRef{}, filter->path_val});
 
 		if ( res )
 			ext_rec = {AdoptRef{}, res.release()->AsRecordVal()};
@@ -1090,7 +1081,7 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter,
 
 		for ( list<int>::iterator j = indices.begin(); j != indices.end(); ++j )
 			{
-			val = val->AsRecordVal()->Lookup(*j);
+			val = val->AsRecordVal()->GetField(*j).get();
 
 			if ( ! val )
 				{
@@ -1183,9 +1174,9 @@ WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBacken
 
 	if ( ! found_filter_match )
 		{
-		ID* id = global_scope()->Lookup("Log::default_rotation_interval");
+		const auto& id = global_scope()->Find("Log::default_rotation_interval");
 		assert(id);
-		winfo->interval = id->ID_Val()->AsInterval();
+		winfo->interval = id->GetVal()->AsInterval();
 		}
 
 	stream->writers.insert(
@@ -1194,8 +1185,8 @@ WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBacken
 
 	// Still need to set the WriterInfo's rotation parameters, which we
 	// computed above.
-	const char* base_time = log_rotate_base_time ?
-		log_rotate_base_time->AsString()->CheckString() : nullptr;
+	static auto log_rotate_base_time = zeek::id::find_val<StringVal>("log_rotate_base_time");
+	static auto base_time = log_rotate_base_time->AsString()->CheckString();
 
 	winfo->info->rotation_interval = winfo->interval;
 	winfo->info->rotation_base = parse_rotate_base_time(base_time);
@@ -1207,7 +1198,7 @@ WriterFrontend* Manager::CreateWriter(EnumVal* id, EnumVal* writer, WriterBacken
 		{
 		winfo->hook_initialized = true;
 		PLUGIN_HOOK_VOID(HOOK_LOG_INIT,
-		                 HookLogInit(writer->Type()->AsEnumType()->Lookup(writer->InternalInt()),
+		                 HookLogInit(writer->GetType()->AsEnumType()->Lookup(writer->InternalInt()),
 		                             instantiating_filter, local, remote,
 		                             *winfo->info, num_fields, fields));
 		}
@@ -1277,7 +1268,7 @@ bool Manager::WriteFromRemote(EnumVal* id, EnumVal* writer, const string& path,
 
 void Manager::SendAllWritersTo(const broker::endpoint_info& ei)
 	{
-	auto et = internal_type("Log::Writer")->AsEnumType();
+	auto et = zeek::id::find_type("Log::Writer")->AsEnumType();
 
 	for ( vector<Stream *>::iterator s = streams.begin(); s != streams.end(); ++s )
 		{
@@ -1291,7 +1282,7 @@ void Manager::SendAllWritersTo(const broker::endpoint_info& ei)
 		      i != stream->writers.end(); i++ )
 			{
 			WriterFrontend* writer = i->second->writer;
-			auto writer_val = et->GetVal(i->first.first);
+			const auto& writer_val = et->GetVal(i->first.first);
 			broker_mgr->PublishLogCreate((*s)->id,
 						     writer_val.get(),
 						     *i->second->info,
@@ -1454,8 +1445,8 @@ void Manager::InstallRotationTimer(WriterInfo* winfo)
 			if ( ! winfo->open_time )
 				winfo->open_time = network_time;
 
-			const char* base_time = log_rotate_base_time ?
-				log_rotate_base_time->AsString()->CheckString() : nullptr;
+			static auto log_rotate_base_time = zeek::id::find_val<StringVal>("log_rotate_base_time");
+			static auto base_time = log_rotate_base_time->AsString()->CheckString();
 
 			double base = parse_rotate_base_time(base_time);
 			double delta_t =
@@ -1515,8 +1506,8 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
 		return true;
 
 	// Create the RotationInfo record.
-	auto info = make_intrusive<RecordVal>(BifType::Record::Log::RotationInfo);
-	info->Assign(0, winfo->type->Ref());
+	auto info = make_intrusive<RecordVal>(zeek::BifType::Record::Log::RotationInfo);
+	info->Assign(0, {NewRef{}, winfo->type});
 	info->Assign(1, make_intrusive<StringVal>(new_name));
 	info->Assign(2, make_intrusive<StringVal>(winfo->writer->Info().path));
 	info->Assign(3, make_intrusive<Val>(open, TYPE_TIME));
@@ -1526,9 +1517,9 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
 	Func* func = winfo->postprocessor;
 	if ( ! func )
 		{
-		ID* id = global_scope()->Lookup("Log::__default_rotation_postprocessor");
+		const auto& id = global_scope()->Find("Log::__default_rotation_postprocessor");
 		assert(id);
-		func = id->ID_Val()->AsFunc();
+		func = id->GetVal()->AsFunc();
 		}
 
 	assert(func);
@@ -1536,7 +1527,7 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
 	// Call the postprocessor function.
 	int result = 0;
 
-	auto v = func->Call(std::move(info));
+	auto v = func->Invoke(std::move(info));
 	if ( v )
 		result = v->AsBool();
 
diff --git a/src/logging/Tag.cc b/src/logging/Tag.cc
index 2ab2844e25..69d9e0ad67 100644
--- a/src/logging/Tag.cc
+++ b/src/logging/Tag.cc
@@ -6,7 +6,7 @@
 const logging::Tag logging::Tag::Error;
 
 logging::Tag::Tag(type_t type, subtype_t subtype)
-	: ::Tag(log_mgr->GetTagEnumType(), type, subtype)
+	: ::Tag(log_mgr->GetTagType(), type, subtype)
 	{
 	}
 
@@ -22,7 +22,20 @@ logging::Tag& logging::Tag::operator=(const logging::Tag&& other) noexcept
 	return *this;
 	}
 
+const IntrusivePtr<EnumVal>& logging::Tag::AsVal() const
+	{
+	return ::Tag::AsVal(log_mgr->GetTagType());
+	}
+
 EnumVal* logging::Tag::AsEnumVal() const
 	{
-	return ::Tag::AsEnumVal(log_mgr->GetTagEnumType());
+	return AsVal().get();
 	}
+
+logging::Tag::Tag(IntrusivePtr<EnumVal> val)
+	: ::Tag(std::move(val))
+	{ }
+
+logging::Tag::Tag(EnumVal* val)
+	: ::Tag({NewRef{}, val})
+	{ }
diff --git a/src/logging/Tag.h b/src/logging/Tag.h
index 29c7fd6cd4..78aee1a3d0 100644
--- a/src/logging/Tag.h
+++ b/src/logging/Tag.h
@@ -88,6 +88,9 @@ public:
 	 *
 	 * @param etype the script-layer enum type associated with the tag.
 	 */
+	const IntrusivePtr<EnumVal>& AsVal() const;
+
+	[[deprecated("Remove in v4.1.  Use AsVal() instead.")]]
 	EnumVal* AsEnumVal() const;
 
 	static const Tag Error;
@@ -113,7 +116,10 @@ protected:
 	 *
 	 * @param val An enum value of script type \c Log::Writer.
 	 */
-	explicit Tag(EnumVal* val) : ::Tag(val) {}
+	explicit Tag(IntrusivePtr<EnumVal> val);
+
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
+	explicit Tag(EnumVal* val);
 };
 
 }
diff --git a/src/logging/WriterFrontend.cc b/src/logging/WriterFrontend.cc
index c8953b817e..307b121e17 100644
--- a/src/logging/WriterFrontend.cc
+++ b/src/logging/WriterFrontend.cc
@@ -116,7 +116,7 @@ WriterFrontend::WriterFrontend(const WriterBackend::WriterInfo& arg_info, EnumVa
 	num_fields = 0;
 	fields = nullptr;
 
-	const char* w = arg_writer->Type()->AsEnumType()->Lookup(arg_writer->InternalInt());
+	const char* w = arg_writer->GetType()->AsEnumType()->Lookup(arg_writer->InternalInt());
 	name = copy_string(fmt("%s/%s", arg_info.path, w));
 
 	if ( local )
diff --git a/src/logging/writers/ascii/Ascii.cc b/src/logging/writers/ascii/Ascii.cc
index 8c502b498b..47cceeb738 100644
--- a/src/logging/writers/ascii/Ascii.cc
+++ b/src/logging/writers/ascii/Ascii.cc
@@ -35,47 +35,47 @@ Ascii::Ascii(WriterFrontend* frontend) : WriterBackend(frontend)
 
 void Ascii::InitConfigOptions()
 	{
-	output_to_stdout = BifConst::LogAscii::output_to_stdout;
-	include_meta = BifConst::LogAscii::include_meta;
-	use_json = BifConst::LogAscii::use_json;
-	enable_utf_8 = BifConst::LogAscii::enable_utf_8;
-	gzip_level = BifConst::LogAscii::gzip_level;
+	output_to_stdout = zeek::BifConst::LogAscii::output_to_stdout;
+	include_meta = zeek::BifConst::LogAscii::include_meta;
+	use_json = zeek::BifConst::LogAscii::use_json;
+	enable_utf_8 = zeek::BifConst::LogAscii::enable_utf_8;
+	gzip_level = zeek::BifConst::LogAscii::gzip_level;
 
 	separator.assign(
-			(const char*) BifConst::LogAscii::separator->Bytes(),
-			BifConst::LogAscii::separator->Len()
+			(const char*) zeek::BifConst::LogAscii::separator->Bytes(),
+			zeek::BifConst::LogAscii::separator->Len()
 			);
 
 	set_separator.assign(
-			(const char*) BifConst::LogAscii::set_separator->Bytes(),
-			BifConst::LogAscii::set_separator->Len()
+			(const char*) zeek::BifConst::LogAscii::set_separator->Bytes(),
+			zeek::BifConst::LogAscii::set_separator->Len()
 			);
 
 	empty_field.assign(
-			(const char*) BifConst::LogAscii::empty_field->Bytes(),
-			BifConst::LogAscii::empty_field->Len()
+			(const char*) zeek::BifConst::LogAscii::empty_field->Bytes(),
+			zeek::BifConst::LogAscii::empty_field->Len()
 			);
 
 	unset_field.assign(
-			(const char*) BifConst::LogAscii::unset_field->Bytes(),
-			BifConst::LogAscii::unset_field->Len()
+			(const char*) zeek::BifConst::LogAscii::unset_field->Bytes(),
+			zeek::BifConst::LogAscii::unset_field->Len()
 			);
 
 	meta_prefix.assign(
-			(const char*) BifConst::LogAscii::meta_prefix->Bytes(),
-			BifConst::LogAscii::meta_prefix->Len()
+			(const char*) zeek::BifConst::LogAscii::meta_prefix->Bytes(),
+			zeek::BifConst::LogAscii::meta_prefix->Len()
 			);
 
 	ODesc tsfmt;
-	BifConst::LogAscii::json_timestamps->Describe(&tsfmt);
+	zeek::BifConst::LogAscii::json_timestamps->Describe(&tsfmt);
 	json_timestamps.assign(
 			(const char*) tsfmt.Bytes(),
 			tsfmt.Len()
 			);
 
 	gzip_file_extension.assign(
-		(const char*) BifConst::LogAscii::gzip_file_extension->Bytes(),
-		BifConst::LogAscii::gzip_file_extension->Len()
+		(const char*) zeek::BifConst::LogAscii::gzip_file_extension->Bytes(),
+		zeek::BifConst::LogAscii::gzip_file_extension->Len()
 		);
 	}
 
diff --git a/src/logging/writers/none/None.cc b/src/logging/writers/none/None.cc
index a668dde3cc..3ab4f049aa 100644
--- a/src/logging/writers/none/None.cc
+++ b/src/logging/writers/none/None.cc
@@ -12,7 +12,7 @@ using namespace writer;
 bool None::DoInit(const WriterInfo& info, int num_fields,
 	    const threading::Field* const * fields)
 	{
-	if ( BifConst::LogNone::debug )
+	if ( zeek::BifConst::LogNone::debug )
 		{
 		std::cout << "[logging::writer::None]" << std::endl;
 		std::cout << "  path=" << info.path << std::endl;
diff --git a/src/logging/writers/sqlite/SQLite.cc b/src/logging/writers/sqlite/SQLite.cc
index 5043ad75c6..b0ac37afa3 100644
--- a/src/logging/writers/sqlite/SQLite.cc
+++ b/src/logging/writers/sqlite/SQLite.cc
@@ -22,18 +22,18 @@ SQLite::SQLite(WriterFrontend* frontend)
 	  fields(), num_fields(), db(), st()
 	{
 	set_separator.assign(
-			(const char*) BifConst::LogSQLite::set_separator->Bytes(),
-			BifConst::LogSQLite::set_separator->Len()
+			(const char*) zeek::BifConst::LogSQLite::set_separator->Bytes(),
+			zeek::BifConst::LogSQLite::set_separator->Len()
 			);
 
 	unset_field.assign(
-			(const char*) BifConst::LogSQLite::unset_field->Bytes(),
-			BifConst::LogSQLite::unset_field->Len()
+			(const char*) zeek::BifConst::LogSQLite::unset_field->Bytes(),
+			zeek::BifConst::LogSQLite::unset_field->Len()
 			);
 
 	empty_field.assign(
-			(const char*) BifConst::LogSQLite::empty_field->Bytes(),
-			BifConst::LogSQLite::empty_field->Len()
+			(const char*) zeek::BifConst::LogSQLite::empty_field->Bytes(),
+			zeek::BifConst::LogSQLite::empty_field->Len()
 			);
 
 	threading::formatter::Ascii::SeparatorInfo sep_info(string(), set_separator, unset_field, empty_field);
diff --git a/src/main.cc b/src/main.cc
index b107dd213c..3cd648a0aa 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -18,7 +18,7 @@ int main(int argc, char** argv)
 	auto& options = setup_result.options;
 	auto do_net_run = iosource_mgr->Size() > 0 ||
 	                  have_pending_timers ||
-	                  BifConst::exit_only_after_terminate;
+	                  zeek::BifConst::exit_only_after_terminate;
 
 	if ( do_net_run )
 		{
diff --git a/src/option.bif b/src/option.bif
index 49d63bdca7..f2024062c4 100644
--- a/src/option.bif
+++ b/src/option.bif
@@ -7,7 +7,7 @@ module Option;
 #include "NetVar.h"
 #include "broker/Data.h"
 
-static bool call_option_handlers_and_set_value(StringVal* name, ID* i,
+static bool call_option_handlers_and_set_value(StringVal* name, const IntrusivePtr<ID>& i,
                                                IntrusivePtr<Val> val,
                                                StringVal* location)
 	{
@@ -15,7 +15,7 @@ static bool call_option_handlers_and_set_value(StringVal* name, ID* i,
 		{
 		for ( auto handler_function : i->GetOptionHandlers() )
 			{
-			bool add_loc = handler_function->FType()->AsFuncType()->ArgTypes()->Types()->length() == 3;
+			bool add_loc = handler_function->GetType()->ParamList()->Types().size() == 3;
 			zeek::Args vl;
 			vl.reserve(2 + add_loc);
 			vl.emplace_back(NewRef{}, name);
@@ -24,7 +24,7 @@ static bool call_option_handlers_and_set_value(StringVal* name, ID* i,
 			if ( add_loc )
 				vl.emplace_back(NewRef{}, location);
 
-			val = handler_function->Call(vl); // consumed by next call.
+			val = handler_function->Invoke(&vl); // consumed by next call.
 
 			if ( ! val )
 				{
@@ -59,7 +59,7 @@ static bool call_option_handlers_and_set_value(StringVal* name, ID* i,
 ##           lower-level function.
 function Option::set%(ID: string, val: any, location: string &default=""%): bool
 	%{
-	auto i = global_scope()->Lookup(ID->CheckString());
+	const auto& i = global_scope()->Find(ID->CheckString());
 	if ( ! i )
 		{
 		builtin_error(fmt("Could not find ID named '%s'", ID->CheckString()));
@@ -79,15 +79,15 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 		return val_mgr->False();
 		}
 
-	if ( same_type(val->Type(), bro_broker::DataVal::ScriptDataType()) )
+	if ( same_type(val->GetType(), bro_broker::DataVal::ScriptDataType()) )
 		{
-		auto dv = static_cast<bro_broker::DataVal*>(val->AsRecordVal()->Lookup(0));
-		auto val_from_data = dv->castTo(i->Type());
+		auto dv = static_cast<bro_broker::DataVal*>(val->AsRecordVal()->GetField(0).get());
+		auto val_from_data = dv->castTo(i->GetType().get());
 
 		if ( ! val_from_data )
 			{
 			builtin_error(fmt("Incompatible type for set of ID '%s': got broker data '%s', need '%s'",
-				ID->CheckString(), dv->data.get_type_name(), type_name(i->Type()->Tag())));
+				ID->CheckString(), dv->data.get_type_name(), type_name(i->GetType()->Tag())));
 			return val_mgr->False();
 			}
 
@@ -95,22 +95,22 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 		return val_mgr->Bool(rval);
 		}
 
-	if ( ! same_type(i->Type(), val->Type()) )
+	if ( ! same_type(i->GetType(), val->GetType()) )
 		{
-		if ( i->Type()->Tag() == TYPE_TABLE &&
-		     val->Type()->Tag() == TYPE_TABLE &&
-		     val->Type()->AsTableType()->IsUnspecifiedTable() )
+		if ( i->GetType()->Tag() == TYPE_TABLE &&
+		     val->GetType()->Tag() == TYPE_TABLE &&
+		     val->GetType()->AsTableType()->IsUnspecifiedTable() )
 			{
 			// Just coerce an empty/unspecified table to the right type.
 			auto tv = make_intrusive<TableVal>(
-			        IntrusivePtr{NewRef{}, i->Type()->AsTableType()},
-			        IntrusivePtr{NewRef{}, i->ID_Val()->AsTableVal()->Attrs()});
+			        cast_intrusive<TableType>(i->GetType()),
+			        i->GetVal()->AsTableVal()->GetAttrs());
 			auto rval = call_option_handlers_and_set_value(ID, i, std::move(tv), location);
 			return val_mgr->Bool(rval);
 			}
 
 		builtin_error(fmt("Incompatible type for set of ID '%s': got '%s', need '%s'",
-			ID->CheckString(), type_name(val->Type()->Tag()), type_name(i->Type()->Tag())));
+			ID->CheckString(), type_name(val->GetType()->Tag()), type_name(i->GetType()->Tag())));
 		return val_mgr->False();
 		}
 
@@ -144,7 +144,7 @@ function Option::set%(ID: string, val: any, location: string &default=""%): bool
 ## .. zeek:see:: Option::set
 function Option::set_change_handler%(ID: string, on_change: any, priority: int &default=0%): bool
 	%{
-	auto i = global_scope()->Lookup(ID->CheckString());
+	const auto& i = global_scope()->Find(ID->CheckString());
 	if ( ! i )
 		{
 		builtin_error(fmt("Could not find ID named '%s'", ID->CheckString()));
@@ -157,56 +157,55 @@ function Option::set_change_handler%(ID: string, on_change: any, priority: int &
 		return val_mgr->False();
 		}
 
-	if ( on_change->Type()->Tag() != TYPE_FUNC )
+	if ( on_change->GetType()->Tag() != TYPE_FUNC )
 		{
 		builtin_error(fmt("Option::on_change needs function argument; got '%s' for ID '%s'",
-			type_name(on_change->Type()->Tag()), ID->CheckString()));
+			type_name(on_change->GetType()->Tag()), ID->CheckString()));
 		return val_mgr->False();
 		}
 
-	if ( on_change->Type()->AsFuncType()->Flavor() != FUNC_FLAVOR_FUNCTION )
+	if ( on_change->GetType()->AsFuncType()->Flavor() != FUNC_FLAVOR_FUNCTION )
 		{
 		builtin_error("Option::on_change needs function argument; not hook or event");
 		return val_mgr->False();
 		}
 
-	const type_list* args = on_change->Type()->AsFuncType()->ArgTypes()->Types();
-	if ( args->length() < 2 || args->length() > 3 )
+	const auto& args = on_change->GetType()->AsFuncType()->ParamList()->Types();
+	if ( args.size() < 2 || args.size() > 3 )
 		{
-		builtin_error(fmt("Wrong number of arguments for passed function in Option::on_change for ID '%s'; expected 2 or 3, got %d",
-			ID->CheckString(), args->length()));
+		builtin_error(fmt("Wrong number of arguments for passed function in Option::on_change for ID '%s'; expected 2 or 3, got %zu",
+		                  ID->CheckString(), args.size()));
 		return val_mgr->False();
 		}
 
-	if ( (*args)[0]->Tag() != TYPE_STRING )
+	if ( args[0]->Tag() != TYPE_STRING )
 		{
 		builtin_error(fmt("First argument of passed function has to be string in Option::on_change for ID '%s'; got '%s'",
-			ID->CheckString(), type_name((*args)[0]->Tag())));
+			ID->CheckString(), type_name(args[0]->Tag())));
 		return val_mgr->False();
 		}
 
-	if ( ! same_type((*args)[1], i->Type()) )
+	if ( ! same_type(args[1], i->GetType()) )
 		{
 		builtin_error(fmt("Second argument of passed function has to be %s in Option::on_change for ID '%s'; got '%s'",
-			type_name(i->Type()->Tag()), ID->CheckString(), type_name((*args)[1]->Tag())));
+			type_name(i->GetType()->Tag()), ID->CheckString(), type_name(args[1]->Tag())));
 		return val_mgr->False();
 		}
 
-	if ( args->length() == 3 && (*args)[2]->Tag() != TYPE_STRING )
+	if ( args.size() == 3 && args[2]->Tag() != TYPE_STRING )
 		{
 		builtin_error(fmt("Third argument of passed function has to be string in Option::on_change for ID '%s'; got '%s'",
-			ID->CheckString(), type_name((*args)[2]->Tag())));
+			ID->CheckString(), type_name(args[2]->Tag())));
 		return val_mgr->False();
 		}
 
-	if ( ! same_type(on_change->Type()->AsFuncType()->YieldType(), i->Type()) )
+	if ( ! same_type(on_change->GetType()->AsFuncType()->Yield(), i->GetType()) )
 		{
 		builtin_error(fmt("Passed function needs to return type '%s' for ID '%s'; got '%s'",
-			type_name(i->Type()->Tag()), ID->CheckString(), type_name(on_change->Type()->AsFuncType()->YieldType()->Tag())));
+			type_name(i->GetType()->Tag()), ID->CheckString(), type_name(on_change->GetType()->AsFuncType()->Yield()->Tag())));
 		return val_mgr->False();
 		}
 
-	auto* func = on_change->AsFunc();
-	i->AddOptionHandler({NewRef{}, func}, -priority);
+	i->AddOptionHandler(on_change->AsFuncPtr(), -priority);
 	return val_mgr->True();
 	%}
diff --git a/src/parse.y b/src/parse.y
index 928340f20b..59b229bdca 100644
--- a/src/parse.y
+++ b/src/parse.y
@@ -134,7 +134,6 @@ bool resolving_global_ID = false;
 bool defining_global_ID = false;
 std::vector<int> saved_in_init;
 
-ID* func_id = 0;
 static Location func_hdr_location;
 EnumType *cur_enum_type = 0;
 static ID* cur_decl_type_id = 0;
@@ -155,47 +154,20 @@ static void parser_redef_enum (ID *id)
 	/* Redef an enum. id points to the enum to be redefined.
 	   Let cur_enum_type point to it. */
 	assert(cur_enum_type == NULL);
+
 	// abort on errors; enums need to be accessible to continue parsing
-	if ( ! id->Type() )
+	if ( ! id->GetType() )
 		reporter->FatalError("unknown enum identifier \"%s\"", id->Name());
 	else
 		{
-		if ( ! id->Type() || id->Type()->Tag() != TYPE_ENUM )
+		if ( ! id->GetType() || id->GetType()->Tag() != TYPE_ENUM )
 			reporter->FatalError("identifier \"%s\" is not an enum", id->Name());
-		cur_enum_type = id->Type()->AsEnumType();
+		cur_enum_type = id->GetType()->AsEnumType();
 		}
 	}
 
-static type_decl_list* copy_type_decl_list(type_decl_list* tdl)
-	{
-	if ( ! tdl )
-		return 0;
-
-	type_decl_list* rval = new type_decl_list();
-
-	for ( const auto& td : *tdl )
-		rval->push_back(new TypeDecl(*td));
-
-	return rval;
-	}
-
-static attr_list* copy_attr_list(attr_list* al)
-	{
-	if ( ! al )
-		return 0;
-
-	attr_list* rval = new attr_list();
-
-	for ( const auto& a : *al )
-		{
-		::Ref(a);
-		rval->push_back(a);
-		}
-
-	return rval;
-	}
-
-static void extend_record(ID* id, type_decl_list* fields, attr_list* attrs)
+static void extend_record(ID* id, std::unique_ptr<type_decl_list> fields,
+                          std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs)
 	{
 	std::set<BroType*> types = BroType::GetAliases(id->Name());
 
@@ -205,17 +177,19 @@ static void extend_record(ID* id, type_decl_list* fields, attr_list* attrs)
 		return;
 		}
 
-	for ( std::set<BroType*>::const_iterator it = types.begin(); it != types.end(); )
-		{
-		RecordType* add_to = (*it)->AsRecordType();
-		const char* error = 0;
-		++it;
+	bool add_log_attr = false;
 
-		if ( it == types.end() )
-			error = add_to->AddFields(fields, attrs);
-		else
-			error = add_to->AddFields(copy_type_decl_list(fields),
-			                          copy_attr_list(attrs));
+	if ( attrs )
+		for ( const auto& at : *attrs )
+			if ( at->Tag() == ATTR_LOG )
+				{
+				add_log_attr = true;
+				break;
+				}
+
+	for ( auto t : types )
+		{
+		auto error = t->AsRecordType()->AddFields(*fields, add_log_attr);
 
 		if ( error )
 			{
@@ -225,18 +199,31 @@ static void extend_record(ID* id, type_decl_list* fields, attr_list* attrs)
 		}
 	}
 
+static IntrusivePtr<Attributes>
+make_attributes(std::vector<IntrusivePtr<Attr>>* attrs,
+                IntrusivePtr<BroType> t, bool in_record, bool is_global)
+	{
+	if ( ! attrs )
+		return nullptr;
+
+	auto rval = make_intrusive<Attributes>(std::move(*attrs), std::move(t),
+	                                       in_record, is_global);
+	delete attrs;
+	return rval;
+	}
+
 static bool expr_is_table_type_name(const Expr* expr)
 	{
 	if ( expr->Tag() != EXPR_NAME )
 		return false;
 
-	BroType* type = expr->Type();
+	const auto& type = expr->GetType();
 
 	if ( type->IsTable() )
 		return true;
 
 	if ( type->Tag() == TYPE_TYPE )
-		return type->AsTypeType()->Type()->IsTable();
+		return type->AsTypeType()->GetType()->IsTable();
 
 	return false;
 	}
@@ -263,7 +250,7 @@ static bool expr_is_table_type_name(const Expr* expr)
 	Case* c_case;
 	case_list* case_l;
 	Attr* attr;
-	attr_list* attr_l;
+	std::vector<IntrusivePtr<Attr>>* attr_l;
 	attr_tag attrtag;
 }
 
@@ -508,15 +495,15 @@ expr:
 	|	'$' TOK_ID func_params '='
 			{
 			func_hdr_location = @1;
-			func_id = current_scope()->GenerateTemporary("anonymous-function");
+			auto func_id = current_scope()->GenerateTemporary("anonymous-function");
 			func_id->SetInferReturnType(true);
-			begin_func(func_id, current_module.c_str(), FUNC_FLAVOR_FUNCTION,
-			           0, {AdoptRef{}, $3});
+			begin_func(std::move(func_id), current_module.c_str(),
+			           FUNC_FLAVOR_FUNCTION, false,
+			           {AdoptRef{}, $3});
 			}
 		 lambda_body
 			{
 			$$ = new FieldAssignExpr($2, IntrusivePtr{AdoptRef{}, $6});
-			Unref(func_id);
 			}
 
 	|	expr TOK_IN expr
@@ -575,13 +562,15 @@ expr:
 		opt_attr
 			{ // the ++in_init fixes up the parsing of "[x] = y"
 			set_location(@1, @5);
-			$$ = new TableConstructorExpr({AdoptRef{}, $4}, $7);
+			std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs{$7};
+			$$ = new TableConstructorExpr({AdoptRef{}, $4}, std::move(attrs));
 			}
 
 	|	TOK_SET '(' opt_expr_list ')' opt_attr
 			{
 			set_location(@1, @4);
-			$$ = new SetConstructorExpr({AdoptRef{}, $3}, $5);
+			std::unique_ptr<std::vector<IntrusivePtr<Attr>>> attrs{$5};
+			$$ = new SetConstructorExpr({AdoptRef{}, $3}, std::move(attrs));
 			}
 
 	|	TOK_VECTOR '(' opt_expr_list ')'
@@ -606,34 +595,30 @@ expr:
 			{
 			set_location(@1, @6);
 
-			BroType* ctor_type = 0;
-
-			if ( $1->Tag() == EXPR_NAME &&
-			     (ctor_type = $1->AsNameExpr()->Id()->AsType()) )
+			if ( $1->Tag() == EXPR_NAME && $1->AsNameExpr()->Id()->IsType() )
 				{
+				const auto& ctor_type = $1->AsNameExpr()->Id()->GetType();
+
 				switch ( ctor_type->Tag() ) {
 				case TYPE_RECORD:
 					{
 					auto rce = make_intrusive<RecordConstructorExpr>(
 					            IntrusivePtr<ListExpr>{AdoptRef{}, $4});
-					IntrusivePtr<RecordType> rt{NewRef{}, ctor_type->AsRecordType()};
+					auto rt = cast_intrusive<RecordType>(ctor_type);
 					$$ = new RecordCoerceExpr(std::move(rce), std::move(rt));
 					}
 					break;
 
 				case TYPE_TABLE:
 					if ( ctor_type->IsTable() )
-						$$ = new TableConstructorExpr({AdoptRef{}, $4}, 0,
-						                              {NewRef{}, ctor_type});
+						$$ = new TableConstructorExpr({AdoptRef{}, $4}, 0, ctor_type);
 					else
-						$$ = new SetConstructorExpr({AdoptRef{}, $4}, 0,
-						                            {NewRef{}, ctor_type});
+						$$ = new SetConstructorExpr({AdoptRef{}, $4}, 0, ctor_type);
 
 					break;
 
 				case TYPE_VECTOR:
-					$$ = new VectorConstructorExpr({AdoptRef{}, $4},
-					                               {NewRef{}, ctor_type});
+					$$ = new VectorConstructorExpr({AdoptRef{}, $4}, ctor_type);
 					break;
 
 				default:
@@ -698,7 +683,7 @@ expr:
 				if ( id->IsDeprecated() )
 					reporter->Warning("%s", id->GetDeprecationWarning().c_str());
 
-				if ( ! id->Type() )
+				if ( ! id->GetType() )
 					{
 					id->Error("undeclared variable");
 					id->SetType(error_type());
@@ -707,7 +692,7 @@ expr:
 
 				else if ( id->IsEnumConst() )
 					{
-					EnumType* t = id->Type()->AsEnumType();
+					EnumType* t = id->GetType()->AsEnumType();
 					int intval = t->Lookup(id->ModuleName(),
 							       id->Name());
 					if ( intval < 0 )
@@ -746,7 +731,7 @@ expr:
 			set_location(@1, @3);
 			IntrusivePtr<Expr> e{AdoptRef{}, $2};
 
-			if ( IsIntegral(e->Type()->Tag()) )
+			if ( IsIntegral(e->GetType()->Tag()) )
 				e = make_intrusive<ArithCoerceExpr>(std::move(e), TYPE_INT);
 
 			$$ = new SizeExpr(std::move(e));
@@ -816,7 +801,7 @@ enum_body_elem:
 			set_location(@1, @3);
 			assert(cur_enum_type);
 
-			if ( $3->Type()->Tag() != TYPE_COUNT )
+			if ( $3->GetType()->Tag() != TYPE_COUNT )
 				reporter->Error("enumerator is not a count constant");
 			else
 				cur_enum_type->AddName(current_module, $1,
@@ -843,72 +828,72 @@ enum_body_elem:
 type:
 		TOK_BOOL	{
 				set_location(@1);
-				$$ = base_type(TYPE_BOOL).release();
+				$$ = base_type(TYPE_BOOL)->Ref();
 				}
 
 	|	TOK_INT		{
 				set_location(@1);
-				$$ = base_type(TYPE_INT).release();
+				$$ = base_type(TYPE_INT)->Ref();
 				}
 
 	|	TOK_COUNT	{
 				set_location(@1);
-				$$ = base_type(TYPE_COUNT).release();
+				$$ = base_type(TYPE_COUNT)->Ref();
 				}
 
 	|	TOK_COUNTER	{
 				set_location(@1);
-				$$ = base_type(TYPE_COUNTER).release();
+				$$ = base_type(TYPE_COUNTER)->Ref();
 				}
 
 	|	TOK_DOUBLE	{
 				set_location(@1);
-				$$ = base_type(TYPE_DOUBLE).release();
+				$$ = base_type(TYPE_DOUBLE)->Ref();
 				}
 
 	|	TOK_TIME	{
 				set_location(@1);
-				$$ = base_type(TYPE_TIME).release();
+				$$ = base_type(TYPE_TIME)->Ref();
 				}
 
 	|	TOK_INTERVAL	{
 				set_location(@1);
-				$$ = base_type(TYPE_INTERVAL).release();
+				$$ = base_type(TYPE_INTERVAL)->Ref();
 				}
 
 	|	TOK_STRING	{
 				set_location(@1);
-				$$ = base_type(TYPE_STRING).release();
+				$$ = base_type(TYPE_STRING)->Ref();
 				}
 
 	|	TOK_PATTERN	{
 				set_location(@1);
-				$$ = base_type(TYPE_PATTERN).release();
+				$$ = base_type(TYPE_PATTERN)->Ref();
 				}
 
 	|	TOK_TIMER	{
 				set_location(@1);
-				$$ = base_type(TYPE_TIMER).release();
+				$$ = base_type(TYPE_TIMER)->Ref();
 				}
 
 	|	TOK_PORT	{
 				set_location(@1);
-				$$ = base_type(TYPE_PORT).release();
+				$$ = base_type(TYPE_PORT)->Ref();
 				}
 
 	|	TOK_ADDR	{
 				set_location(@1);
-				$$ = base_type(TYPE_ADDR).release();
+				$$ = base_type(TYPE_ADDR)->Ref();
 				}
 
 	|	TOK_SUBNET	{
 				set_location(@1);
-				$$ = base_type(TYPE_SUBNET).release();
+				$$ = base_type(TYPE_SUBNET)->Ref();
 				}
 
 	|	TOK_ANY		{
 				set_location(@1);
-				$$ = base_type(TYPE_ANY).release();
+				$$ = base_type(TYPE_ANY)->Ref();
 				}
 
 	|	TOK_TABLE '[' type_list ']' TOK_OF type
@@ -1007,12 +992,12 @@ type:
 
 	|	resolve_id
 			{
-			if ( ! $1 || ! ($$ = $1->AsType()) )
+			if ( ! $1 || ! ($$ = $1->IsType() ? $1->GetType().get() : nullptr) )
 				{
 				NullStmt here;
 				if ( $1 )
 					$1->Error("not a Zeek type", &here);
-				$$ = error_type().release();
+				$$ = error_type()->Ref();
 				}
 			else
 				{
@@ -1049,7 +1034,8 @@ type_decl:
 		TOK_ID ':' type opt_attr ';'
 			{
 			set_location(@1, @4);
-			$$ = new TypeDecl({AdoptRef{}, $3}, $1, $4, (in_record > 0));
+			auto attrs = make_attributes($4, {NewRef{}, $3}, in_record > 0, false);
+			$$ = new TypeDecl($1, {AdoptRef{}, $3}, std::move(attrs));
 
 			if ( in_record > 0 && cur_decl_type_id )
 				zeekygen_mgr->RecordField(cur_decl_type_id, $$, ::filename);
@@ -1078,7 +1064,8 @@ formal_args_decl:
 		TOK_ID ':' type opt_attr
 			{
 			set_location(@1, @4);
-			$$ = new TypeDecl({AdoptRef{}, $3}, $1, $4, true);
+			auto attrs = make_attributes($4, {NewRef{}, $3}, true, false);
+			$$ = new TypeDecl($1, {AdoptRef{}, $3}, std::move(attrs));
 			}
 	;
 
@@ -1095,21 +1082,27 @@ decl:
 	|	TOK_GLOBAL def_global_id opt_type init_class opt_init opt_attr ';'
 			{
 			IntrusivePtr id{AdoptRef{}, $2};
-			add_global(id.get(), {AdoptRef{}, $3}, $4, {AdoptRef{}, $5}, $6, VAR_REGULAR);
+			add_global(id, {AdoptRef{}, $3}, $4, {AdoptRef{}, $5},
+			           std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$6},
+			           VAR_REGULAR);
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
 	|	TOK_OPTION def_global_id opt_type init_class opt_init opt_attr ';'
 			{
 			IntrusivePtr id{AdoptRef{}, $2};
-			add_global(id.get(), {AdoptRef{}, $3}, $4, {AdoptRef{}, $5}, $6, VAR_OPTION);
+			add_global(id, {AdoptRef{}, $3}, $4, {AdoptRef{}, $5},
+			           std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$6},
+			           VAR_OPTION);
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
 	|	TOK_CONST def_global_id opt_type init_class opt_init opt_attr ';'
 			{
 			IntrusivePtr id{AdoptRef{}, $2};
-			add_global(id.get(), {AdoptRef{}, $3}, $4, {AdoptRef{}, $5}, $6, VAR_CONST);
+			add_global(id, {AdoptRef{}, $3}, $4, {AdoptRef{}, $5},
+			           std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$6},
+			           VAR_CONST);
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
@@ -1117,7 +1110,9 @@ decl:
 			{
 			IntrusivePtr id{AdoptRef{}, $2};
 			IntrusivePtr<Expr> init{AdoptRef{}, $5};
-			add_global(id.get(), {AdoptRef{}, $3}, $4, init, $6, VAR_REDEF);
+			add_global(id, {AdoptRef{}, $3}, $4, init,
+			           std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$6},
+			           VAR_REDEF);
 			zeekygen_mgr->Redef(id.get(), ::filename, $4, std::move(init));
 			}
 
@@ -1138,10 +1133,11 @@ decl:
 			{
 			cur_decl_type_id = 0;
 
-			if ( ! $3->Type() )
+			if ( ! $3->GetType() )
 				$3->Error("unknown identifier");
 			else
-				extend_record($3, $8, $11);
+				extend_record($3, std::unique_ptr<type_decl_list>($8),
+				              std::unique_ptr<std::vector<IntrusivePtr<Attr>>>($11));
 			}
 
 	|	TOK_TYPE global_id ':'
@@ -1150,7 +1146,8 @@ decl:
 			{
 			cur_decl_type_id = 0;
 			IntrusivePtr id{AdoptRef{}, $2};
-			add_type(id.get(), {AdoptRef{}, $5}, $6);
+			add_type(id.get(), {AdoptRef{}, $5},
+			         std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$6});
 			zeekygen_mgr->Identifier(std::move(id));
 			}
 
@@ -1182,8 +1179,9 @@ func_hdr:
 		TOK_FUNCTION def_global_id func_params opt_attr
 			{
 			IntrusivePtr id{AdoptRef{}, $2};
-			begin_func(id.get(), current_module.c_str(),
-				FUNC_FLAVOR_FUNCTION, 0, {NewRef{}, $3}, $4);
+			begin_func(id, current_module.c_str(),
+				FUNC_FLAVOR_FUNCTION, 0, {NewRef{}, $3},
+				std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$4});
 			$$ = $3;
 			zeekygen_mgr->Identifier(std::move(id));
 			}
@@ -1196,22 +1194,25 @@ func_hdr:
 				reporter->Error("event %s() is no longer available, use zeek_%s() instead", name, base.c_str());
 				}
 
-			begin_func($2, current_module.c_str(),
-				   FUNC_FLAVOR_EVENT, 0, {NewRef{}, $3}, $4);
+			begin_func({NewRef{}, $2}, current_module.c_str(),
+				   FUNC_FLAVOR_EVENT, 0, {NewRef{}, $3},
+				   std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$4});
 			$$ = $3;
 			}
 	|	TOK_HOOK def_global_id func_params opt_attr
 			{
 			$3->ClearYieldType(FUNC_FLAVOR_HOOK);
 			$3->SetYieldType(base_type(TYPE_BOOL));
-			begin_func($2, current_module.c_str(),
-				   FUNC_FLAVOR_HOOK, 0, {NewRef{}, $3}, $4);
+			begin_func({NewRef{}, $2}, current_module.c_str(),
+				   FUNC_FLAVOR_HOOK, 0, {NewRef{}, $3},
+				   std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$4});
 			$$ = $3;
 			}
 	|	TOK_REDEF TOK_EVENT event_id func_params opt_attr
 			{
-			begin_func($3, current_module.c_str(),
-				   FUNC_FLAVOR_EVENT, 1, {NewRef{}, $4}, $5);
+			begin_func({NewRef{}, $3}, current_module.c_str(),
+				   FUNC_FLAVOR_EVENT, 1, {NewRef{}, $4},
+				   std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$5});
 			$$ = $4;
 			}
 	;
@@ -1273,8 +1274,9 @@ anonymous_function:
 begin_func:
 		func_params
 			{
-			$$ = current_scope()->GenerateTemporary("anonymous-function");
-			begin_func($$, current_module.c_str(), FUNC_FLAVOR_FUNCTION, 0, {AdoptRef{}, $1});
+			auto id = current_scope()->GenerateTemporary("anonymous-function");
+			begin_func(id, current_module.c_str(), FUNC_FLAVOR_FUNCTION, 0, {AdoptRef{}, $1});
+			$$ = id.release();
 			}
 	;
 
@@ -1326,7 +1328,7 @@ index_slice:
 			                 make_intrusive<SizeExpr>(
 			                     IntrusivePtr<Expr>{NewRef{}, $1});
 
-			if ( ! IsIntegral(low->Type()->Tag()) || ! IsIntegral(high->Type()->Tag()) )
+			if ( ! IsIntegral(low->GetType()->Tag()) || ! IsIntegral(high->GetType()->Tag()) )
 				reporter->Error("slice notation must have integral values as indexes");
 
 			auto le = make_intrusive<ListExpr>(std::move(low));
@@ -1337,16 +1339,16 @@ index_slice:
 opt_attr:
 		attr_list
 	|
-			{ $$ = 0; }
+			{ $$ = nullptr; }
 	;
 
 attr_list:
 		attr_list attr
-			{ $1->push_back($2); }
+			{ $1->emplace_back(AdoptRef{}, $2); }
 	|	attr
 			{
-			$$ = new attr_list;
-			$$->push_back($1);
+			$$ = new std::vector<IntrusivePtr<Attr>>;
+			$$->emplace_back(AdoptRef{}, $1);
 			}
 	;
 
@@ -1385,7 +1387,7 @@ attr:
 			{ $$ = new Attr(ATTR_DEPRECATED); }
 	|	TOK_ATTR_DEPRECATED '=' TOK_CONSTANT
 			{
-			if ( IsString($3->Type()->Tag()) )
+			if ( IsString($3->GetType()->Tag()) )
 				$$ = new Attr(ATTR_DEPRECATED, make_intrusive<ConstExpr>(IntrusivePtr{AdoptRef{}, $3}));
 			else
 				{
@@ -1512,7 +1514,9 @@ stmt:
 			{
 			set_location(@1, @7);
 			$$ = add_local({AdoptRef{}, $2}, {AdoptRef{}, $3}, $4,
-			               {AdoptRef{}, $5}, $6, VAR_REGULAR).release();
+			               {AdoptRef{}, $5},
+			               std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$6},
+			               VAR_REGULAR).release();
 			if ( ! $8 )
 			    brofiler.AddStmt($$);
 			}
@@ -1521,7 +1525,9 @@ stmt:
 			{
 			set_location(@1, @6);
 			$$ = add_local({AdoptRef{}, $2}, {AdoptRef{}, $3}, $4,
-			               {AdoptRef{}, $5}, $6, VAR_CONST).release();
+			               {AdoptRef{}, $5},
+			               std::unique_ptr<std::vector<IntrusivePtr<Attr>>>{$6},
+			               VAR_CONST).release();
 			if ( ! $8 )
 			    brofiler.AddStmt($$);
 			}
@@ -1602,7 +1608,7 @@ event:
 		TOK_ID '(' opt_expr_list ')'
 			{
 			set_location(@1, @4);
-			auto id = lookup_ID($1, current_module.c_str());
+			const auto& id = lookup_ID($1, current_module.c_str());
 
 			if ( id )
 				{
@@ -1667,7 +1673,8 @@ case_type:
 			else
 				case_var = install_ID(name, current_module.c_str(), false, false);
 
-			add_local(case_var, std::move(type), INIT_NONE, 0, 0, VAR_REGULAR);
+			add_local(case_var, std::move(type), INIT_NONE, nullptr, nullptr,
+			          VAR_REGULAR);
 			$$ = case_var.release();
 			}
 
@@ -1772,7 +1779,8 @@ local_id:
 		TOK_ID
 			{
 			set_location(@1);
-			$$ = lookup_ID($1, current_module.c_str()).release();
+			auto id = lookup_ID($1, current_module.c_str());
+			$$ = id.release();
 
 			if ( $$ )
 				{
@@ -1808,8 +1816,9 @@ global_or_event_id:
 		TOK_ID
 			{
 			set_location(@1);
-			$$ = lookup_ID($1, current_module.c_str(), false,
-			               defining_global_ID).release();
+			auto id = lookup_ID($1, current_module.c_str(), false,
+			                    defining_global_ID);
+			$$ = id.release();
 
 			if ( $$ )
 				{
@@ -1818,7 +1827,7 @@ global_or_event_id:
 
 				if ( $$->IsDeprecated() )
 					{
-					BroType* t = $$->Type();
+					const auto& t = $$->GetType();
 
 					if ( t->Tag() != TYPE_FUNC ||
 					     t->AsFuncType()->Flavor() != FUNC_FLAVOR_FUNCTION )
@@ -1845,7 +1854,8 @@ resolve_id:
 		TOK_ID
 			{
 			set_location(@1);
-			$$ = lookup_ID($1, current_module.c_str()).release();
+			auto id = lookup_ID($1, current_module.c_str());
+			$$ = id.release();
 
 			if ( ! $$ )
 				reporter->Error("identifier not defined: %s", $1);
@@ -1872,7 +1882,7 @@ opt_deprecated:
 	|
 		TOK_ATTR_DEPRECATED '=' TOK_CONSTANT
 			{
-			if ( IsString($3->Type()->Tag()) )
+			if ( IsString($3->GetType()->Tag()) )
 				$$ = new ConstExpr({AdoptRef{}, $3});
 			else
 				{
diff --git a/src/plugin/ComponentManager.h b/src/plugin/ComponentManager.h
index 2448597004..3c66fe9dd7 100644
--- a/src/plugin/ComponentManager.h
+++ b/src/plugin/ComponentManager.h
@@ -52,6 +52,9 @@ public:
 	/**
 	 * @return The enum type associated with the script-layer "Tag".
 	 */
+	const IntrusivePtr<EnumType>& GetTagType() const;
+
+	[[deprecated("Remove in v4.1.  Use GetTagType() instead.")]]
 	EnumType* GetTagEnumType() const;
 
 	/**
@@ -68,6 +71,9 @@ public:
 	 * @param val A component's enum value.
 	 * @return The canonical component name.
 	 */
+	const std::string& GetComponentName(IntrusivePtr<EnumVal> val) const;
+
+	[[deprecated("Remove in v4.1.  Use IntrusivePtr argument instead.")]]
 	const std::string& GetComponentName(Val* val) const;
 
 	/**
@@ -156,6 +162,12 @@ std::list<C*> ComponentManager<T, C>::GetComponents() const
 	return rval;
 	}
 
+template <class T, class C>
+const IntrusivePtr<EnumType>& ComponentManager<T, C>::GetTagType() const
+	{
+	return tag_enum_type;
+	}
+
 template <class T, class C>
 EnumType* ComponentManager<T, C>::GetTagEnumType() const
 	{
@@ -180,10 +192,16 @@ const std::string& ComponentManager<T, C>::GetComponentName(T tag) const
 	return error;
 	}
 
+template <class T, class C>
+const std::string& ComponentManager<T, C>::GetComponentName(IntrusivePtr<EnumVal> val) const
+	{
+	return GetComponentName(T(std::move(val)));
+	}
+
 template <class T, class C>
 const std::string& ComponentManager<T, C>::GetComponentName(Val* val) const
 	{
-	return GetComponentName(T(val->AsEnumVal()));
+	return GetComponentName(T({NewRef{}, val->AsEnumVal()}));
 	}
 
 template <class T, class C>
@@ -239,12 +257,12 @@ void ComponentManager<T, C>::RegisterComponent(C* component,
 	components_by_name.insert(std::make_pair(cname, component));
 	components_by_tag.insert(std::make_pair(component->Tag(), component));
 	components_by_val.insert(std::make_pair(
-	        component->Tag().AsEnumVal()->InternalInt(), component));
+	        component->Tag().AsVal()->InternalInt(), component));
 
 	// Install an identfier for enum value
 	std::string id = fmt("%s%s", prefix.c_str(), cname.c_str());
 	tag_enum_type->AddName(module, id.c_str(),
-	                       component->Tag().AsEnumVal()->InternalInt(), true,
+	                       component->Tag().AsVal()->InternalInt(), true,
 	                       nullptr);
 	}
 
diff --git a/src/plugin/Manager.cc b/src/plugin/Manager.cc
index 084e421945..09a3bb5d9f 100644
--- a/src/plugin/Manager.cc
+++ b/src/plugin/Manager.cc
@@ -14,6 +14,7 @@
 #include "../Reporter.h"
 #include "../Func.h"
 #include "../Event.h"
+#include "../Val.h"
 #include "../util.h"
 #include "../input.h"
 
@@ -621,53 +622,48 @@ int Manager::HookLoadFile(const Plugin::LoadType type, const string& file, const
 	return rc;
 	}
 
-std::pair<bool, Val*> Manager::HookCallFunction(const Func* func, Frame* parent, const zeek::Args& vecargs) const
+std::pair<bool, IntrusivePtr<Val>>
+Manager::HookCallFunction(const Func* func, Frame* parent,
+                          zeek::Args* vecargs) const
 	{
 	HookArgumentList args;
-	std::optional<val_list> vargs;
+	val_list vargs;
 
 	if ( HavePluginForHook(META_HOOK_PRE) )
 		{
-		vargs = val_list(vecargs.size());
+		vargs.resize(vecargs->size());
 
-		for ( const auto& v : vecargs )
-			vargs->push_back(v.get());
+		for ( const auto& v : *vecargs )
+			vargs.push_back(v.get());
 
 		args.push_back(HookArgument(func));
 		args.push_back(HookArgument(parent));
-		args.push_back(HookArgument(&vargs.value()));
+		args.push_back(HookArgument(&vargs));
 		MetaHookPre(HOOK_CALL_FUNCTION, args);
 		}
 
 	hook_list* l = hooks[HOOK_CALL_FUNCTION];
 
-	std::pair<bool, Val*> v = std::pair<bool, Val*>(false, NULL);
+	std::pair<bool, IntrusivePtr<Val>> rval{false, nullptr};
 
 	if ( l )
 		{
-		if ( ! vargs )
-			{
-			vargs = val_list(vecargs.size());
-
-			for ( const auto& v : vecargs )
-				vargs->push_back(v.get());
-			}
-
 		for ( hook_list::iterator i = l->begin(); i != l->end(); ++i )
 			{
 			Plugin* p = (*i).second;
 
-			v = p->HookCallFunction(func, parent, &vargs.value());
+			rval = p->HookFunctionCall(func, parent, vecargs);
 
-			if ( v.first )
+			if ( rval.first )
 				break;
 			}
 		}
 
 	if ( HavePluginForHook(META_HOOK_POST) )
-		MetaHookPost(HOOK_CALL_FUNCTION, args, HookArgument(v));
+		MetaHookPost(HOOK_CALL_FUNCTION, args,
+		             HookArgument(std::make_pair(rval.first, rval.second.get())));
 
-	return v;
+	return rval;
 	}
 
 bool Manager::HookQueueEvent(Event* event) const
diff --git a/src/plugin/Manager.h b/src/plugin/Manager.h
index f2e46ca68e..b3080cf733 100644
--- a/src/plugin/Manager.h
+++ b/src/plugin/Manager.h
@@ -245,15 +245,18 @@ public:
 	 *
 	 * @param func The function to be called.
 	 *
+	 * @param parent The frame in which the function is being called.
+	 *
 	 * @param args The function call's arguments; they may be modified by the
 	 * method.
 	 *
-	 * @return If a plugin handled the call, a Val with a +1 reference count
-	 * containing the result value to pass back to the interpreter (for void
-	 * functions and events, it may be any Val and must be ignored). If no
-	 * plugin handled the call, the method returns null.
+	 * @return If a plugin handled the call, a Val representing the result
+	 * to pass back to the interpreter (for void functions and events,
+	 * it may be any Val and must be ignored). If no plugin handled the call,
+	 * the method returns null.
 	 */
-	std::pair<bool, Val*> HookCallFunction(const Func* func, Frame* parent, const zeek::Args& args) const;
+	std::pair<bool, IntrusivePtr<Val>>
+	HookCallFunction(const Func* func, Frame* parent, zeek::Args* args) const;
 
 	/**
 	 * Hook that filters the queuing of an event.
diff --git a/src/plugin/Plugin.cc b/src/plugin/Plugin.cc
index 5538b87b28..262ee2cc64 100644
--- a/src/plugin/Plugin.cc
+++ b/src/plugin/Plugin.cc
@@ -151,6 +151,17 @@ void HookArgument::Describe(ODesc* d) const
 			d->Add("<null>");
 		break;
 
+	case ARG_LIST:
+		if ( arg.args)
+			{
+			d->Add("(");
+			describe_vals(*arg.args, d);
+			d->Add(")");
+			}
+		else
+			d->Add("<null>");
+		break;
+
 	case VOID:
 		d->Add("<void>");
 		break;
@@ -364,6 +375,26 @@ int Plugin::HookLoadFile(const LoadType type, const std::string& file, const std
 	return -1;
 	}
 
+std::pair<bool, IntrusivePtr<Val>>
+Plugin::HookFunctionCall(const Func* func, Frame* parent,
+                         zeek::Args* args)
+	{
+	val_list vlargs(args->size());
+
+	for ( auto& v : *args )
+		vlargs.push_back(v.release());
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+	auto [handled, result] = HookCallFunction(func, parent, &vlargs);
+#pragma GCC diagnostic pop
+
+	for ( auto i = 0u; i < args->size(); ++i )
+		(*args)[i] = {AdoptRef{}, vlargs[i]};
+
+	return {handled, {AdoptRef{}, result}};
+	}
+
 std::pair<bool, Val*> Plugin::HookCallFunction(const Func* func, Frame *parent, val_list* args)
 	{
 	std::pair<bool, Val*> result(false, NULL);
diff --git a/src/plugin/Plugin.h b/src/plugin/Plugin.h
index b218c693d7..096b796429 100644
--- a/src/plugin/Plugin.h
+++ b/src/plugin/Plugin.h
@@ -8,6 +8,7 @@
 
 #include "zeek-config.h"
 #include "logging/WriterBackend.h"
+#include "ZeekArgs.h"
 
 // Increase this when making incompatible changes to the plugin API. Note
 // that the constant is never used in C code. It's picked up on by CMake.
@@ -177,7 +178,8 @@ public:
 	 */
 	enum Type {
 		BOOL, DOUBLE, EVENT, FRAME, FUNC, FUNC_RESULT, INT, STRING, VAL,
-		VAL_LIST, VOID, VOIDP, WRITER_INFO, CONN, THREAD_FIELDS, LOCATION
+		VAL_LIST, VOID, VOIDP, WRITER_INFO, CONN, THREAD_FIELDS, LOCATION,
+		ARG_LIST
 	};
 
 	/**
@@ -260,6 +262,11 @@ public:
 	 */
 	explicit HookArgument(const Location* location)	{ type = LOCATION; arg.loc = location; }
 
+	/**
+	 * Constructor with a zeek::Args argument.
+	 */
+	explicit HookArgument(const zeek::Args* args)	{ type = ARG_LIST; arg.args = args; }
+
 	/**
 	 * Returns the value for a boolen argument. The argument's type must
 	 * match accordingly.
@@ -338,6 +345,11 @@ public:
 	 */
 	const val_list* AsValList() const	{ assert(type == VAL_LIST); return arg.vals; }
 
+	/**
+	 * Returns the value as a zeek::Args.
+	 */
+	const zeek::Args* AsArgList() const	{ assert(type == ARG_LIST); return arg.args; }
+
 	/**
 	 * Returns the value for a vod pointer argument. The argument's type
 	 * must match accordingly.
@@ -368,6 +380,7 @@ private:
 		int int_;
 		const Val* val;
 		const val_list* vals;
+		const zeek::Args* args;
 		const void* voidp;
 		const logging::WriterBackend::WriterInfo* winfo;
 		const Location* loc;
@@ -664,12 +677,15 @@ protected:
 	 * in place as long as it ensures matching types and correct reference
 	 * counting.
 	 *
-	 * @return If the plugin handled the call, a std::pair<bool, Val*> with the
-	 * processed flag set to true, and a value set on the object with
-	 * a+1 reference count containing the result value to pass back to the
-	 * interpreter.  If the plugin did not handle the call, it must
-	 * return a pair with the processed flag set to 'false'.
+	 * @return If the plugin handled the call, a pair with the first member
+	 * set to true, and a Val representing the result value to pass back to the
+	 * interpreter. If the plugin did not handle the call, it must return a
+	 * pair with the first member set to 'false' and null result value.
 	 */
+	virtual std::pair<bool, IntrusivePtr<Val>>
+	HookFunctionCall(const Func* func, Frame* parent, zeek::Args* args);
+
+	[[deprecated("Remove in v4.1.  Use HookFunctionCall()")]]
 	virtual std::pair<bool, Val*> HookCallFunction(const Func* func, Frame *parent, val_list* args);
 
 	/**
diff --git a/src/probabilistic/Hasher.cc b/src/probabilistic/Hasher.cc
index 78f7bb3c72..d1765c4fdf 100644
--- a/src/probabilistic/Hasher.cc
+++ b/src/probabilistic/Hasher.cc
@@ -7,6 +7,7 @@
 #include <openssl/evp.h>
 
 #include "NetVar.h"
+#include "Var.h"
 #include "digest.h"
 #include "highwayhash/sip_hash.h"
 
@@ -22,10 +23,12 @@ Hasher::seed_t Hasher::MakeSeed(const void* data, size_t size)
 
 	assert(sizeof(tmpseed) == 16);
 
+	static auto global_hash_seed = zeek::id::find_val<StringVal>("global_hash_seed");
+
 	if ( data )
 		hash_update(ctx, data, size);
 
-	else if ( global_hash_seed && global_hash_seed->Len() > 0 )
+	else if ( global_hash_seed->Len() > 0 )
 		hash_update(ctx, global_hash_seed->Bytes(), global_hash_seed->Len());
 
 	else
diff --git a/src/probabilistic/Topk.cc b/src/probabilistic/Topk.cc
index fff53cbc1b..f870619e87 100644
--- a/src/probabilistic/Topk.cc
+++ b/src/probabilistic/Topk.cc
@@ -18,25 +18,20 @@ static void topk_element_hash_delete_func(void* val)
 	delete e;
 	}
 
-Element::~Element()
-	{
-	Unref(value);
-	}
-
-void TopkVal::Typify(BroType* t)
+void TopkVal::Typify(IntrusivePtr<BroType> t)
 	{
 	assert(!hash && !type);
-	type = t->Ref();
-	auto tl = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, t});
-	tl->Append({NewRef{}, t});
+	type = std::move(t);
+	auto tl = make_intrusive<TypeList>(type);
+	tl->Append(type);
 	hash = new CompositeHash(std::move(tl));
 	}
 
 HashKey* TopkVal::GetHash(Val* v) const
 	{
-	HashKey* key = hash->ComputeHash(v, true);
+	auto key = hash->MakeHashKey(*v, true);
 	assert(key);
-	return key;
+	return key.release();
 	}
 
 TopkVal::TopkVal(uint64_t arg_size) : OpaqueVal(topk_type)
@@ -44,7 +39,6 @@ TopkVal::TopkVal(uint64_t arg_size) : OpaqueVal(topk_type)
 	elementDict = new PDict<Element>;
 	elementDict->SetDeleteFunc(topk_element_hash_delete_func);
 	size = arg_size;
-	type = nullptr;
 	numElements = 0;
 	pruned = false;
 	hash = nullptr;
@@ -55,7 +49,6 @@ TopkVal::TopkVal() : OpaqueVal(topk_type)
 	elementDict = new PDict<Element>;
 	elementDict->SetDeleteFunc(topk_element_hash_delete_func);
 	size = 0;
-	type = nullptr;
 	numElements = 0;
 	hash = nullptr;
 	}
@@ -73,7 +66,6 @@ TopkVal::~TopkVal()
 		bi++;
 		}
 
-	Unref(type);
 	delete hash;
 	}
 
@@ -119,7 +111,7 @@ void TopkVal::Merge(const TopkVal* value, bool doPrune)
 				{
 				olde = new Element();
 				olde->epsilon = 0;
-				olde->value = e->value->Ref();
+				olde->value = e->value;
 				// insert at bucket position 0
 				if ( buckets.size() > 0 )
 					{
@@ -191,7 +183,7 @@ IntrusivePtr<Val> TopkVal::DoClone(CloneState* state)
 	return state->NewClone(this, std::move(clone));
 	}
 
-VectorVal* TopkVal::GetTopK(int k) const // returns vector
+IntrusivePtr<VectorVal> TopkVal::GetTopK(int k) const // returns vector
 	{
 	if ( numElements == 0 )
 		{
@@ -199,10 +191,10 @@ VectorVal* TopkVal::GetTopK(int k) const // returns vector
 		return nullptr;
 		}
 
-	auto vector_index = make_intrusive<TypeList>(IntrusivePtr{NewRef{}, type});
-	vector_index->Append({NewRef{}, type});
-	VectorType* v = new VectorType(std::move(vector_index));
-	VectorVal* t = new VectorVal(v);
+	auto vector_index = make_intrusive<TypeList>(type);
+	vector_index->Append(type);
+	auto v = make_intrusive<VectorType>(std::move(vector_index));
+	auto t = make_intrusive<VectorVal>(std::move(v));
 
 	// this does no estimation if the results is correct!
 	// in any case - just to make this future-proof (and I am lazy) - this can return more than k.
@@ -217,7 +209,7 @@ VectorVal* TopkVal::GetTopK(int k) const // returns vector
 		while ( eit != (*it)->elements.end() )
 			{
 			//printf("Size: %ld\n", (*it)->elements.size());
-			t->Assign(read, (*eit)->value->Ref());
+			t->Assign(read, (*eit)->value);
 			read++;
 			eit++;
 			}
@@ -228,7 +220,6 @@ VectorVal* TopkVal::GetTopK(int k) const // returns vector
 		it--;
 		}
 
-	Unref(v);
 	return t;
 	}
 
@@ -280,14 +271,14 @@ uint64_t TopkVal::GetSum() const
 	return sum;
 	}
 
-void TopkVal::Encountered(Val* encountered)
+void TopkVal::Encountered(IntrusivePtr<Val> encountered)
 	{
 	// ok, let's see if we already know this one.
 
 	if ( numElements == 0 )
-		Typify(encountered->Type());
+		Typify(encountered->GetType());
 	else
-		if ( ! same_type(type, encountered->Type()) )
+		if ( ! same_type(type, encountered->GetType()) )
 			{
 			reporter->Error("Trying to add element to topk with differing type from other elements");
 			return;
@@ -301,7 +292,7 @@ void TopkVal::Encountered(Val* encountered)
 		{
 		e = new Element();
 		e->epsilon = 0;
-		e->value = encountered->Ref(); // or no ref?
+		e->value = std::move(encountered);
 
 		// well, we do not know this one yet...
 		if ( numElements < size )
@@ -441,7 +432,7 @@ broker::expected<broker::data> TopkVal::DoSerialize() const
 			{
 			Element* element = *eit;
 			d.emplace_back(element->epsilon);
-			auto v = bro_broker::val_to_data(element->value);
+			auto v = bro_broker::val_to_data(element->value.get());
 			if ( ! v )
 				return broker::ec::invalid_data;
 
@@ -480,12 +471,12 @@ bool TopkVal::DoUnserialize(const broker::data& data)
 	auto no_type = caf::get_if<broker::none>(&(*v)[3]);
 	if ( ! no_type )
 		{
-		BroType* t = UnserializeType((*v)[3]);
+		auto t = UnserializeType((*v)[3]);
+
 		if ( ! t )
 			return false;
 
 		Typify(t);
-		Unref(t);
 		}
 
 	uint64_t i = 0;
@@ -506,14 +497,14 @@ bool TopkVal::DoUnserialize(const broker::data& data)
 		for ( uint64_t j = 0; j < *elements_count; j++ )
 			{
 			auto epsilon = caf::get_if<uint64_t>(&(*v)[idx++]);
-			auto val = bro_broker::data_to_val((*v)[idx++], type);
+			auto val = bro_broker::data_to_val((*v)[idx++], type.get());
 
 			if ( ! (epsilon && val) )
 				return false;
 
 			Element* e = new Element();
 			e->epsilon = *epsilon;
-			e->value = val.release();
+			e->value = std::move(val);
 			e->parent = b;
 
 			b->elements.insert(b->elements.end(), e);
diff --git a/src/probabilistic/Topk.h b/src/probabilistic/Topk.h
index 4a2c60e8b7..c71dbfe769 100644
--- a/src/probabilistic/Topk.h
+++ b/src/probabilistic/Topk.h
@@ -27,10 +27,8 @@ struct Bucket {
 
 struct Element {
 	uint64_t epsilon;
-	Val* value;
+	IntrusivePtr<Val> value;
 	Bucket* parent;
-
-	~Element();
 };
 
 class TopkVal : public OpaqueVal {
@@ -57,7 +55,7 @@ public:
 	 *
 	 * @param value The encountered element
 	 */
-	void Encountered(Val* value);
+	void Encountered(IntrusivePtr<Val> value);
 
 	/**
 	 * Get the first *k* elements of the result vector. At the moment,
@@ -68,7 +66,7 @@ public:
 	 *
 	 * @returns The top-k encountered elements
 	 */
-	VectorVal* GetTopK(int k) const;
+	IntrusivePtr<VectorVal> GetTopK(int k) const;
 
 	/**
 	 * Get the current count tracked in the top-k data structure for a
@@ -155,15 +153,17 @@ private:
 	 * @returns HashKey for value
 	 */
 	HashKey* GetHash(Val* v) const; // this probably should go somewhere else.
+	HashKey* GetHash(const IntrusivePtr<Val>& v) const
+		{ return GetHash(v.get()); }
 
 	/**
 	 * Set the type that this TopK instance tracks
 	 *
 	 * @param t type that is tracked
 	 */
-	void Typify(BroType* t);
+	void Typify(IntrusivePtr<BroType> t);
 
-	BroType* type;
+	IntrusivePtr<BroType> type;
 	CompositeHash* hash;
 	std::list<Bucket*> buckets;
 	PDict<Element>* elementDict;
diff --git a/src/probabilistic/bloom-filter.bif b/src/probabilistic/bloom-filter.bif
index fb9784658e..b8c4592c8d 100644
--- a/src/probabilistic/bloom-filter.bif
+++ b/src/probabilistic/bloom-filter.bif
@@ -146,10 +146,10 @@ function bloomfilter_add%(bf: opaque of bloomfilter, x: any%): any
 	%{
 	BloomFilterVal* bfv = static_cast<BloomFilterVal*>(bf);
 
-	if ( ! bfv->Type() && ! bfv->Typify(x->Type()) )
+	if ( ! bfv->Type() && ! bfv->Typify(x->GetType()) )
 		reporter->Error("failed to set Bloom filter type");
 
-	else if ( ! same_type(bfv->Type(), x->Type()) )
+	else if ( ! same_type(bfv->Type(), x->GetType()) )
 		reporter->Error("incompatible Bloom filter types");
 
 	else
@@ -176,7 +176,7 @@ function bloomfilter_lookup%(bf: opaque of bloomfilter, x: any%): count
 	if ( ! bfv->Type() )
 		return val_mgr->Count(0);
 
-	else if ( ! same_type(bfv->Type(), x->Type()) )
+	else if ( ! same_type(bfv->Type(), x->GetType()) )
 		reporter->Error("incompatible Bloom filter types");
 
 	else
diff --git a/src/probabilistic/cardinality-counter.bif b/src/probabilistic/cardinality-counter.bif
index 5b92754267..370f842a38 100644
--- a/src/probabilistic/cardinality-counter.bif
+++ b/src/probabilistic/cardinality-counter.bif
@@ -42,13 +42,13 @@ function hll_cardinality_add%(handle: opaque of cardinality, elem: any%): bool
 	%{
 	CardinalityVal* cv = static_cast<CardinalityVal*>(handle);
 
-	if ( ! cv->Type() && ! cv->Typify(elem->Type()) )
+	if ( ! cv->Type() && ! cv->Typify(elem->GetType()) )
 		{
 		reporter->Error("failed to set HLL type");
 		return val_mgr->False();
 		}
 
-	else if ( ! same_type(cv->Type(), elem->Type()) )
+	else if ( ! same_type(cv->Type(), elem->GetType()) )
 		{
 		reporter->Error("incompatible HLL data type");
 		return val_mgr->False();
@@ -77,8 +77,8 @@ function hll_cardinality_merge_into%(handle1: opaque of cardinality, handle2: op
 	CardinalityVal* v2 = static_cast<CardinalityVal*>(handle2);
 
 	if ( (v1->Type() != v2->Type()) && // both 0 is ok
-	     (v1->Type() != 0) && // any one 0 also is ok
-	     (v2->Type() != 0) &&
+	     (v1->Type() != nullptr) && // any one 0 also is ok
+	     (v2->Type() != nullptr) &&
 	     ! same_type(v1->Type(), v2->Type()) )
 		{
 		reporter->Error("incompatible HLL types");
diff --git a/src/probabilistic/top-k.bif b/src/probabilistic/top-k.bif
index d771df332f..947b514c08 100644
--- a/src/probabilistic/top-k.bif
+++ b/src/probabilistic/top-k.bif
@@ -34,7 +34,7 @@ function topk_add%(handle: opaque of topk, value: any%): any
 	%{
 	assert(handle);
 	probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
-	h->Encountered(value);
+	h->Encountered({NewRef{}, value});
 
 	return nullptr;
 	%}
@@ -53,7 +53,7 @@ function topk_get_top%(handle: opaque of topk, k: count%): any_vec
 	%{
 	assert(handle);
 	probabilistic::TopkVal* h = (probabilistic::TopkVal*) handle;
-	return IntrusivePtr{AdoptRef{}, h->GetTopK(k)};
+	return h->GetTopK(k);
 	%}
 
 ## Get an overestimated count of how often a value has been encountered.
diff --git a/src/reporter.bif b/src/reporter.bif
index 87ac5f9338..8425798ddb 100644
--- a/src/reporter.bif
+++ b/src/reporter.bif
@@ -138,7 +138,7 @@ function Reporter::conn_weird%(name: string, c: connection, addl: string &defaul
 ## Returns: true if the file was still valid, else false.
 function Reporter::file_weird%(name: string, f: fa_file, addl: string &default=""%): bool
 	%{
-	auto fuid = f->AsRecordVal()->Lookup(0)->AsStringVal();
+	auto fuid = f->AsRecordVal()->GetField(0)->AsStringVal();
 	auto file = file_mgr->LookupFile(fuid->CheckString());
 
 	if ( ! file )
@@ -153,11 +153,11 @@ function Reporter::file_weird%(name: string, f: fa_file, addl: string &default="
 ## Returns: Current weird sampling whitelist
 function Reporter::get_weird_sampling_whitelist%(%): string_set
 	%{
-	auto set = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
+	auto set = make_intrusive<TableVal>(zeek::id::string_set);
 	for ( auto el : reporter->GetWeirdSamplingWhitelist() )
 		{
 		auto idx = make_intrusive<StringVal>(el);
-		set->Assign(idx.get(), nullptr);
+		set->Assign(std::move(idx), nullptr);
 		}
 	return set;
 	%}
@@ -179,8 +179,8 @@ function Reporter::set_weird_sampling_whitelist%(weird_sampling_whitelist: strin
 
 	while ( (v = wl_table->NextEntry(k, c)) )
 		{
-		auto index = wl_val->RecoverIndex(k);
-		string key = index->Index(0)->AsString()->CheckString();
+		auto index = wl_val->RecreateIndex(*k);
+		string key = index->Idx(0)->AsString()->CheckString();
 		whitelist_set.emplace(move(key));
 		delete k;
 		}
diff --git a/src/scan.l b/src/scan.l
index 0fd1a65085..54cacdb52c 100644
--- a/src/scan.l
+++ b/src/scan.l
@@ -774,7 +774,7 @@ void do_atifdef(const char* id)
 	{
 	++current_depth;
 
-	auto i = lookup_ID(id, current_module.c_str());
+	const auto& i = lookup_ID(id, current_module.c_str());
 
 	if ( ! i )
 		{
@@ -787,7 +787,7 @@ void do_atifndef(const char *id)
 	{
 	++current_depth;
 
-	auto i = lookup_ID(id, current_module.c_str());
+	const auto& i = lookup_ID(id, current_module.c_str());
 
 	if ( i )
 		{
@@ -1000,9 +1000,10 @@ int yywrap()
 			// string type.)  If no type is found, the value
 			// is left unchanged.
 			std::string opt_quote;	// no optional quote by default
-			Val* v = opt_internal_val(param);
+			const auto& param_id = lookup_ID(param, GLOBAL_MODULE_NAME);
+			Val* v = param_id ? param_id->GetVal().get() : nullptr;
 
-			if ( v && v->Type() && v->Type()->Tag() == TYPE_STRING )
+			if ( v && v->GetType() && v->GetType()->Tag() == TYPE_STRING )
 				opt_quote = "\"";	// use quotes
 
 			policy += std::string("redef ") + param + "="
diff --git a/src/stats.bif b/src/stats.bif
index 94baccc78a..f97e00213a 100644
--- a/src/stats.bif
+++ b/src/stats.bif
@@ -4,19 +4,19 @@
 #include "threading/Manager.h"
 #include "broker/Manager.h"
 
-RecordType* ProcStats;
-RecordType* NetStats;
-RecordType* MatcherStats;
-RecordType* ReassemblerStats;
-RecordType* DNSStats;
-RecordType* ConnStats;
-RecordType* GapStats;
-RecordType* EventStats;
-RecordType* ThreadStats;
-RecordType* TimerStats;
-RecordType* FileAnalysisStats;
-RecordType* BrokerStats;
-RecordType* ReporterStats;
+IntrusivePtr<RecordType> ProcStats;
+IntrusivePtr<RecordType> NetStats;
+IntrusivePtr<RecordType> MatcherStats;
+IntrusivePtr<RecordType> ReassemblerStats;
+IntrusivePtr<RecordType> DNSStats;
+IntrusivePtr<RecordType> ConnStats;
+IntrusivePtr<RecordType> GapStats;
+IntrusivePtr<RecordType> EventStats;
+IntrusivePtr<RecordType> ThreadStats;
+IntrusivePtr<RecordType> TimerStats;
+IntrusivePtr<RecordType> FileAnalysisStats;
+IntrusivePtr<RecordType> BrokerStats;
+IntrusivePtr<RecordType> ReporterStats;
 %%}
 
 ## Returns packet capture statistics. Statistics include the number of
@@ -470,16 +470,16 @@ function get_reporter_stats%(%): ReporterStats
 	auto r = make_intrusive<RecordVal>(ReporterStats);
 	int n = 0;
 
-	TableVal* weirds_by_type = new TableVal({NewRef{}, internal_type("table_string_of_count")->AsTableType()});
+	auto weirds_by_type = make_intrusive<TableVal>(zeek::id::find_type<TableType>("table_string_of_count"));
 
 	for ( auto& kv : reporter->GetWeirdsByType() )
 		{
 		auto weird = make_intrusive<StringVal>(kv.first);
-		weirds_by_type->Assign(weird.get(), val_mgr->Count(kv.second));
+		weirds_by_type->Assign(std::move(weird), val_mgr->Count(kv.second));
 		}
 
 	r->Assign(n++, val_mgr->Count(reporter->GetWeirdCount()));
-	r->Assign(n++, weirds_by_type);
+	r->Assign(n++, std::move(weirds_by_type));
 
 	return r;
 	%}
diff --git a/src/strings.bif b/src/strings.bif
index 06ce9939c3..00160454d1 100644
--- a/src/strings.bif
+++ b/src/strings.bif
@@ -102,7 +102,7 @@ function join_string_vec%(vec: string_vec, sep: string%): string
 		if ( i > 0 )
 			d.Add(sep->CheckString(), 0);
 
-		Val* e = v->Lookup(i);
+		const auto& e = v->At(i);
 
 		// If the element is empty, skip it.
 		if ( ! e )
@@ -204,7 +204,7 @@ static IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
                                                int max_num_sep)
 	{
 	// string_vec is used early in the version script - do not use the NetVar.
-	auto rval = make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+	auto rval = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("string_vec"));
 	const u_char* s = str_val->Bytes();
 	int n = str_val->Len();
 	const u_char* end_of_s = s + n;
@@ -259,7 +259,7 @@ static IntrusivePtr<VectorVal> do_split_string(StringVal* str_val,
 
 Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep)
 	{
-	TableVal* a = new TableVal({NewRef{}, string_array});
+	TableVal* a = new TableVal(zeek::id::string_array);
 	const u_char* s = str_val->Bytes();
 	int n = str_val->Len();
 	const u_char* end_of_s = s + n;
@@ -287,7 +287,7 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep)
 			}
 
 		auto ind = val_mgr->Count(++num);
-		a->Assign(ind.get(), make_intrusive<StringVal>(offset, (const char*) s));
+		a->Assign(std::move(ind), make_intrusive<StringVal>(offset, (const char*) s));
 
 		// No more separators will be needed if this is the end of string.
 		if ( n <= 0 )
@@ -296,7 +296,7 @@ Val* do_split(StringVal* str_val, RE_Matcher* re, int incl_sep, int max_num_sep)
 		if ( incl_sep )
 			{ // including the part that matches the pattern
 			ind = val_mgr->Count(++num);
-			a->Assign(ind.get(), make_intrusive<StringVal>(end_of_match, (const char*) s+offset));
+			a->Assign(std::move(ind), make_intrusive<StringVal>(end_of_match, (const char*) s+offset));
 			}
 
 		if ( max_num_sep && num_sep >= max_num_sep )
@@ -412,7 +412,7 @@ function split_string_n%(str: string, re: pattern,
 ## .. zeek:see:: gsub subst_string
 function sub%(str: string, re: pattern, repl: string%): string
 	%{
-	return str->Substitute(re, repl, false);
+	return str->Replace(re, *repl->AsString(), false);
 	%}
 
 ## Substitutes a given replacement string for all occurrences of a pattern
@@ -429,7 +429,7 @@ function sub%(str: string, re: pattern, repl: string%): string
 ## .. zeek:see:: sub subst_string
 function gsub%(str: string, re: pattern, repl: string%): string
 	%{
-	return str->Substitute(re, repl, true);
+	return str->Replace(re, *repl->AsString(), true);
 	%}
 
 
@@ -681,8 +681,8 @@ function string_to_ascii_hex%(s: string%): string
 ## Returns: The result of the Smith-Waterman algorithm calculation.
 function str_smith_waterman%(s1: string, s2: string, params: sw_params%) : sw_substring_vec
 	%{
-	SWParams sw_params(params->AsRecordVal()->Lookup(0)->AsCount(),
-			   SWVariant(params->AsRecordVal()->Lookup(1)->AsCount()));
+	SWParams sw_params(params->AsRecordVal()->GetField(0)->AsCount(),
+			   SWVariant(params->AsRecordVal()->GetField(1)->AsCount()));
 
 	BroSubstring::Vec* subseq =
 		smith_waterman(s1->AsString(), s2->AsString(), sw_params);
@@ -705,7 +705,7 @@ function str_smith_waterman%(s1: string, s2: string, params: sw_params%) : sw_su
 ## .. zeek:see:: split_string split_string1 split_string_all split_string_n
 function str_split%(s: string, idx: index_vec%): string_vec
 	%{
-	vector<Val*>* idx_v = idx->AsVector();
+	auto idx_v = idx->AsVector();
 	BroString::IdxVec indices(idx_v->size());
 	unsigned int i;
 
@@ -713,8 +713,7 @@ function str_split%(s: string, idx: index_vec%): string_vec
 		indices[i] = (*idx_v)[i]->AsCount();
 
 	BroString::Vec* result = s->AsString()->Split(indices);
-	auto result_v = make_intrusive<VectorVal>(
-	    internal_type("string_vec")->AsVectorType());
+	auto result_v = make_intrusive<VectorVal>(zeek::id::string_vec);
 
 	if ( result )
 		{
@@ -909,7 +908,7 @@ function safe_shell_quote%(source: string%): string
 ## .. zeek:see: find_last strstr
 function find_all%(str: string, re: pattern%) : string_set
 	%{
-	auto a = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set});
+	auto a = make_intrusive<TableVal>(zeek::id::string_set);
 
 	const u_char* s = str->Bytes();
 	const u_char* e = s + str->Len();
@@ -920,7 +919,7 @@ function find_all%(str: string, re: pattern%) : string_set
 		if ( n >= 0 )
 			{
 			auto idx = make_intrusive<StringVal>(n, (const char*) t);
-			a->Assign(idx.get(), 0);
+			a->Assign(std::move(idx), 0);
 			t += n - 1;
 			}
 		}
diff --git a/src/supervisor/Supervisor.cc b/src/supervisor/Supervisor.cc
index 28b03434c5..df8aa63026 100644
--- a/src/supervisor/Supervisor.cc
+++ b/src/supervisor/Supervisor.cc
@@ -982,41 +982,41 @@ static BifEnum::Supervisor::ClusterRole role_str_to_enum(std::string_view r)
 Supervisor::NodeConfig Supervisor::NodeConfig::FromRecord(const RecordVal* node)
 	{
 	Supervisor::NodeConfig rval;
-	rval.name = node->Lookup("name")->AsString()->CheckString();
-	auto iface_val = node->Lookup("interface");
+	rval.name = node->GetField("name")->AsString()->CheckString();
+	const auto& iface_val = node->GetField("interface");
 
 	if ( iface_val )
 		rval.interface = iface_val->AsString()->CheckString();
 
-	auto directory_val = node->Lookup("directory");
+	const auto& directory_val = node->GetField("directory");
 
 	if ( directory_val )
 		rval.directory = directory_val->AsString()->CheckString();
 
-	auto stdout_val = node->Lookup("stdout_file");
+	const auto& stdout_val = node->GetField("stdout_file");
 
 	if ( stdout_val )
 		rval.stdout_file = stdout_val->AsString()->CheckString();
 
-	auto stderr_val = node->Lookup("stderr_file");
+	const auto& stderr_val = node->GetField("stderr_file");
 
 	if ( stderr_val )
 		rval.stderr_file = stderr_val->AsString()->CheckString();
 
-	auto affinity_val = node->Lookup("cpu_affinity");
+	const auto& affinity_val = node->GetField("cpu_affinity");
 
 	if ( affinity_val )
 		rval.cpu_affinity = affinity_val->AsInt();
 
-	auto scripts_val = node->Lookup("scripts")->AsVectorVal();
+	auto scripts_val = node->GetField("scripts")->AsVectorVal();
 
 	for ( auto i = 0u; i < scripts_val->Size(); ++i )
 		{
-		auto script = scripts_val->Lookup(i)->AsStringVal()->ToStdString();
+		auto script = scripts_val->At(i)->AsStringVal()->ToStdString();
 		rval.scripts.emplace_back(std::move(script));
 		}
 
-	auto cluster_table_val = node->Lookup("cluster")->AsTableVal();
+	auto cluster_table_val = node->GetField("cluster")->AsTableVal();
 	auto cluster_table = cluster_table_val->AsTable();
 	auto c = cluster_table->InitForIteration();
 	HashKey* k;
@@ -1024,17 +1024,17 @@ Supervisor::NodeConfig Supervisor::NodeConfig::FromRecord(const RecordVal* node)
 
 	while ( (v = cluster_table->NextEntry(k, c)) )
 		{
-		auto key = cluster_table_val->RecoverIndex(k);
+		auto key = cluster_table_val->RecreateIndex(*k);
 		delete k;
-		auto name = key->Index(0)->AsStringVal()->ToStdString();
-		auto rv = v->Value()->AsRecordVal();
+		auto name = key->Idx(0)->AsStringVal()->ToStdString();
+		auto rv = v->GetVal()->AsRecordVal();
 
 		Supervisor::ClusterEndpoint ep;
-		ep.role = static_cast<BifEnum::Supervisor::ClusterRole>(rv->Lookup("role")->AsEnum());
-		ep.host = rv->Lookup("host")->AsAddr().AsString();
-		ep.port = rv->Lookup("p")->AsPortVal()->Port();
+		ep.role = static_cast<BifEnum::Supervisor::ClusterRole>(rv->GetField("role")->AsEnum());
+		ep.host = rv->GetField("host")->AsAddr().AsString();
+		ep.port = rv->GetField("p")->AsPortVal()->Port();
 
-		auto iface = rv->Lookup("interface");
+		const auto& iface = rv->GetField("interface");
 
 		if ( iface )
 			ep.interface = iface->AsStringVal()->ToStdString();
@@ -1104,7 +1104,7 @@ std::string Supervisor::NodeConfig::ToJSON() const
 
 IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
 	{
-	auto rt = BifType::Record::Supervisor::NodeConfig;
+	const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig;
 	auto rval = make_intrusive<RecordVal>(rt);
 	rval->Assign(rt->FieldOffset("name"), make_intrusive<StringVal>(name));
 
@@ -1123,15 +1123,16 @@ IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
 	if ( cpu_affinity )
 		rval->Assign(rt->FieldOffset("cpu_affinity"), val_mgr->Int(*cpu_affinity));
 
-	auto st = BifType::Record::Supervisor::NodeConfig->FieldType("scripts");
-	auto scripts_val = new VectorVal(st->AsVectorType());
-	rval->Assign(rt->FieldOffset("scripts"), scripts_val);
+	auto st = rt->GetFieldType<VectorType>("scripts");
+	auto scripts_val = make_intrusive<VectorVal>(std::move(st));
 
 	for ( const auto& s : scripts )
 		scripts_val->Assign(scripts_val->Size(), make_intrusive<StringVal>(s));
 
-	auto tt = BifType::Record::Supervisor::NodeConfig->FieldType("cluster");
-	auto cluster_val = new TableVal({NewRef{}, tt->AsTableType()});
+	rval->Assign(rt->FieldOffset("scripts"), std::move(scripts_val));
+
+	auto tt = rt->GetFieldType<TableType>("cluster");
+	auto cluster_val = make_intrusive<TableVal>(std::move(tt));
 	rval->Assign(rt->FieldOffset("cluster"), cluster_val);
 
 	for ( const auto& e : cluster )
@@ -1139,17 +1140,17 @@ IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
 		auto& name = e.first;
 		auto& ep = e.second;
 		auto key = make_intrusive<StringVal>(name);
-		auto ept = BifType::Record::Supervisor::ClusterEndpoint;
+		const auto& ept = zeek::BifType::Record::Supervisor::ClusterEndpoint;
 		auto val = make_intrusive<RecordVal>(ept);
 
-		val->Assign(ept->FieldOffset("role"), BifType::Enum::Supervisor::ClusterRole->GetVal(ep.role));
+		val->Assign(ept->FieldOffset("role"), zeek::BifType::Enum::Supervisor::ClusterRole->GetVal(ep.role));
 		val->Assign(ept->FieldOffset("host"), make_intrusive<AddrVal>(ep.host));
 		val->Assign(ept->FieldOffset("p"), val_mgr->Port(ep.port, TRANSPORT_TCP));
 
 		if ( ep.interface )
 			val->Assign(ept->FieldOffset("interface"), make_intrusive<StringVal>(*ep.interface));
 
-		cluster_val->Assign(key.get(), std::move(val));
+		cluster_val->Assign(std::move(key), std::move(val));
 		}
 
 	return rval;
@@ -1157,7 +1158,7 @@ IntrusivePtr<RecordVal> Supervisor::NodeConfig::ToRecord() const
 
 IntrusivePtr<RecordVal> Supervisor::Node::ToRecord() const
 	{
-	auto rt = BifType::Record::Supervisor::NodeStatus;
+	const auto& rt = zeek::BifType::Record::Supervisor::NodeStatus;
 	auto rval = make_intrusive<RecordVal>(rt);
 
 	rval->Assign(rt->FieldOffset("node"), config.ToRecord());
@@ -1171,7 +1172,7 @@ IntrusivePtr<RecordVal> Supervisor::Node::ToRecord() const
 
 static IntrusivePtr<Val> supervisor_role_to_cluster_node_type(BifEnum::Supervisor::ClusterRole role)
 	{
-	static auto node_type = global_scope()->Lookup("Cluster::NodeType")->AsType()->AsEnumType();
+	static auto node_type = zeek::id::find_type<EnumType>("Cluster::NodeType");
 
 	switch ( role ) {
 	case BifEnum::Supervisor::LOGGER:
@@ -1192,10 +1193,10 @@ bool Supervisor::SupervisedNode::InitCluster() const
 	if ( config.cluster.empty() )
 		return false;
 
-	auto cluster_node_type = global_scope()->Lookup("Cluster::Node")->AsType()->AsRecordType();
-	auto cluster_nodes_id = global_scope()->Lookup("Cluster::nodes");
-	auto cluster_manager_is_logger_id = global_scope()->Lookup("Cluster::manager_is_logger");
-	auto cluster_nodes = cluster_nodes_id->ID_Val()->AsTableVal();
+	const auto& cluster_node_type = zeek::id::find_type<RecordType>("Cluster::Node");
+	const auto& cluster_nodes_id = zeek::id::find("Cluster::nodes");
+	const auto& cluster_manager_is_logger_id = zeek::id::find("Cluster::manager_is_logger");
+	auto cluster_nodes = cluster_nodes_id->GetVal()->AsTableVal();
 	auto has_logger = false;
 	std::optional<std::string> manager_name;
 
@@ -1227,7 +1228,7 @@ bool Supervisor::SupervisedNode::InitCluster() const
 			val->Assign(cluster_node_type->FieldOffset("manager"),
 			            make_intrusive<StringVal>(*manager_name));
 
-		cluster_nodes->Assign(key.get(), std::move(val));
+		cluster_nodes->Assign(std::move(key), std::move(val));
 		}
 
 	cluster_manager_is_logger_id->SetVal(val_mgr->Bool(! has_logger));
@@ -1313,9 +1314,9 @@ void Supervisor::SupervisedNode::Init(zeek::Options* options) const
 
 IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
 	{
-	auto rval = make_intrusive<RecordVal>(BifType::Record::Supervisor::Status);
-	auto tt = BifType::Record::Supervisor::Status->FieldType("nodes");
-	auto node_table_val = new TableVal({NewRef{}, tt->AsTableType()});
+	auto rval = make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status);
+	const auto& tt = zeek::BifType::Record::Supervisor::Status->GetFieldType("nodes");
+	auto node_table_val = make_intrusive<TableVal>(cast_intrusive<TableType>(tt));
 	rval->Assign(0, node_table_val);
 
 	if ( node_name.empty() )
@@ -1326,7 +1327,7 @@ IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
 			const auto& node = n.second;
 			auto key = make_intrusive<StringVal>(name);
 			auto val = node.ToRecord();
-			node_table_val->Assign(key.get(), std::move(val));
+			node_table_val->Assign(std::move(key), std::move(val));
 			}
 		}
 	else
@@ -1340,7 +1341,7 @@ IntrusivePtr<RecordVal> Supervisor::Status(std::string_view node_name)
 		const auto& node = it->second;
 		auto key = make_intrusive<StringVal>(name);
 		auto val = node.ToRecord();
-		node_table_val->Assign(key.get(), std::move(val));
+		node_table_val->Assign(std::move(key), std::move(val));
 		}
 
 	return rval;
diff --git a/src/supervisor/supervisor.bif b/src/supervisor/supervisor.bif
index 096fa8d957..e0dd3dce3b 100644
--- a/src/supervisor/supervisor.bif
+++ b/src/supervisor/supervisor.bif
@@ -24,7 +24,7 @@ function Supervisor::__status%(node: string%): Supervisor::Status
 	if ( ! zeek::supervisor_mgr )
 		{
 		builtin_error("supervisor mode not enabled");
-		return make_intrusive<RecordVal>(BifType::Record::Supervisor::Status);
+		return make_intrusive<RecordVal>(zeek::BifType::Record::Supervisor::Status);
 		}
 
 	return zeek::supervisor_mgr->Status(node->CheckString());
@@ -84,9 +84,9 @@ function Supervisor::__node%(%): Supervisor::NodeConfig
 	if ( ! zeek::Supervisor::ThisNode() )
 		{
 		builtin_error("not a supervised process");
-		auto rt = BifType::Record::Supervisor::NodeConfig;
+		const auto& rt = zeek::BifType::Record::Supervisor::NodeConfig;
 		auto rval = make_intrusive<RecordVal>(rt);
-		rval->Assign(rt->FieldOffset("name"), new StringVal("<invalid>"));
+		rval->Assign<StringVal>(rt->FieldOffset("name"), "<invalid>");
 		return rval;
 		}
 
diff --git a/src/threading/Manager.cc b/src/threading/Manager.cc
index 666edff142..b4025bc68d 100644
--- a/src/threading/Manager.cc
+++ b/src/threading/Manager.cc
@@ -126,7 +126,7 @@ void Manager::SendHeartbeats()
 void Manager::StartHeartbeatTimer()
 	{
 	heartbeat_timer_running = true;
-	timer_mgr->Add(new HeartbeatTimer(network_time + BifConst::Threading::heartbeat_interval));
+	timer_mgr->Add(new HeartbeatTimer(network_time + zeek::BifConst::Threading::heartbeat_interval));
 	}
 
 // Raise everything in here as warnings so it is passed to scriptland without
@@ -147,7 +147,7 @@ bool Manager::SendEvent(MsgThread* thread, const std::string& name, const int nu
 	        thread->Name(), name.c_str(), num_vals);
 #endif
 
-	RecordType *type = handler->FType()->Args();
+	const auto& type = handler->GetType()->Params();
 	int num_event_vals = type->NumFields();
 	if ( num_vals != num_event_vals )
 		{
@@ -166,10 +166,10 @@ bool Manager::SendEvent(MsgThread* thread, const std::string& name, const int nu
 		Val* v = Value::ValueToVal(std::string("thread ") + thread->Name(), vals[j], convert_error);
 		vl.emplace_back(AdoptRef{}, v);
 
-		if ( v && ! convert_error && ! same_type(type->FieldType(j), v->Type()) )
+		if ( v && ! convert_error && ! same_type(type->GetFieldType(j), v->GetType()) )
 			{
 			convert_error = true;
-			type->FieldType(j)->Error("SendEvent types do not match", v->Type());
+			type->GetFieldType(j)->Error("SendEvent types do not match", v->GetType().get());
 			}
 		}
 
@@ -190,7 +190,7 @@ void Manager::Flush()
 	if ( network_time && (network_time > next_beat || ! next_beat) )
 		{
 		do_beat = true;
-		next_beat = ::network_time + BifConst::Threading::heartbeat_interval;
+		next_beat = ::network_time + zeek::BifConst::Threading::heartbeat_interval;
 		}
 
 	did_process = false;
diff --git a/src/threading/SerialTypes.cc b/src/threading/SerialTypes.cc
index 7b686fc30d..dbea04ef3a 100644
--- a/src/threading/SerialTypes.cc
+++ b/src/threading/SerialTypes.cc
@@ -154,7 +154,7 @@ bool Value::IsCompatibleType(BroType* t, bool atomic_only)
 		if ( ! t->IsSet() )
 			return false;
 
-		return IsCompatibleType(t->AsSetType()->Indices()->PureType(), true);
+		return IsCompatibleType(t->AsSetType()->GetIndices()->GetPureType().get(), true);
 		}
 
 	case TYPE_VECTOR:
@@ -162,7 +162,7 @@ bool Value::IsCompatibleType(BroType* t, bool atomic_only)
 		if ( atomic_only )
 			return false;
 
-		return IsCompatibleType(t->AsVectorType()->YieldType(), true);
+		return IsCompatibleType(t->AsVectorType()->Yield().get(), true);
 		}
 
 	default:
@@ -537,7 +537,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 					// Enums are not a base-type, so need to look it up.
 					const auto& sv = val->val.set_val.vals[0]->val.string_val;
 					std::string enum_name(sv.data, sv.length);
-					auto enum_id = global_scope()->Lookup(enum_name);
+					const auto& enum_id = global_scope()->Find(enum_name);
 
 					if ( ! enum_id )
 						{
@@ -548,7 +548,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 						return nullptr;
 						}
 
-					index_type = {NewRef{}, enum_id->Type()->AsEnumType()};
+					index_type = enum_id->GetType();
 					}
 				else
 					index_type = base_type(stag);
@@ -562,9 +562,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 			for ( int j = 0; j < val->val.set_val.size; j++ )
 				{
 				Val* assignval = ValueToVal(source, val->val.set_val.vals[j], have_error);
-
-				t->Assign(assignval, nullptr);
-				Unref(assignval); // index is not consumed by assign.
+				t->Assign({AdoptRef{}, assignval}, nullptr);
 				}
 
 			return t;
@@ -587,12 +585,15 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 				}
 
 			auto vt = make_intrusive<VectorType>(std::move(type));
-			VectorVal* v = new VectorVal(vt.get());
+			auto v = make_intrusive<VectorVal>(std::move(vt));
 
 			for ( int j = 0; j < val->val.vector_val.size; j++ )
-				v->Assign(j, ValueToVal(source, val->val.vector_val.vals[j], have_error));
+				{
+				auto el = ValueToVal(source, val->val.vector_val.vals[j], have_error);
+				v->Assign(j, {AdoptRef{}, el});
+				}
 
-			return v;
+			return v.release();
 			}
 
 		case TYPE_ENUM: {
@@ -601,7 +602,8 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 			std::string enum_string(val->val.string_val.data, val->val.string_val.length);
 
 			// let's try looking it up by global ID.
-			auto id = lookup_ID(enum_string.c_str(), GLOBAL_MODULE_NAME);
+			const auto& id = lookup_ID(enum_string.c_str(), GLOBAL_MODULE_NAME);
+
 			if ( ! id || ! id->IsEnumConst() )
 				{
 				reporter->Warning("Value '%s' for source '%s' is not a valid enum.",
@@ -611,7 +613,7 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 				return nullptr;
 				}
 
-			EnumType* t = id->Type()->AsEnumType();
+			EnumType* t = id->GetType()->AsEnumType();
 			int intval = t->Lookup(id->ModuleName(), id->Name());
 			if ( intval < 0 )
 				{
@@ -622,7 +624,8 @@ Val* Value::ValueToVal(const std::string& source, const Value* val, bool& have_e
 				return nullptr;
 				}
 
-			return t->GetVal(intval).release();
+			auto rval = t->GetVal(intval);
+			return rval.release();
 			}
 
 		default:
diff --git a/src/util.cc b/src/util.cc
index 8b8daf4ec0..ce86990645 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -1857,10 +1857,10 @@ FILE* rotate_file(const char* name, RecordVal* rotate_info)
 	// Init rotate_info.
 	if ( rotate_info )
 		{
-		rotate_info->Assign(0, new StringVal(name));
-		rotate_info->Assign(1, new StringVal(newname));
-		rotate_info->Assign(2, new Val(network_time, TYPE_TIME));
-		rotate_info->Assign(3, new Val(network_time, TYPE_TIME));
+		rotate_info->Assign<StringVal>(0, name);
+		rotate_info->Assign<StringVal>(1, newname);
+		rotate_info->Assign<Val>(2, network_time, TYPE_TIME);
+		rotate_info->Assign<Val>(3, network_time, TYPE_TIME);
 		}
 
 	return newf;
diff --git a/src/zeek-setup.cc b/src/zeek-setup.cc
index b8d65a01b4..fdbfbe7ec7 100644
--- a/src/zeek-setup.cc
+++ b/src/zeek-setup.cc
@@ -101,7 +101,6 @@ trigger::Manager* trigger_mgr = nullptr;
 
 std::vector<std::string> zeek_script_prefixes;
 Stmt* stmts;
-EventHandlerPtr net_done = nullptr;
 RuleMatcher* rule_matcher = nullptr;
 EventRegistry* event_registry = nullptr;
 ProfileLogger* profiling_logger = nullptr;
@@ -114,16 +113,16 @@ vector<string> params;
 set<string> requested_plugins;
 const char* proc_status_file = nullptr;
 
-OpaqueType* md5_type = nullptr;
-OpaqueType* sha1_type = nullptr;
-OpaqueType* sha256_type = nullptr;
-OpaqueType* entropy_type = nullptr;
-OpaqueType* cardinality_type = nullptr;
-OpaqueType* topk_type = nullptr;
-OpaqueType* bloomfilter_type = nullptr;
-OpaqueType* x509_opaque_type = nullptr;
-OpaqueType* ocsp_resp_opaque_type = nullptr;
-OpaqueType* paraglob_type = nullptr;
+IntrusivePtr<OpaqueType> md5_type;
+IntrusivePtr<OpaqueType> sha1_type;
+IntrusivePtr<OpaqueType> sha256_type;
+IntrusivePtr<OpaqueType> entropy_type;
+IntrusivePtr<OpaqueType> cardinality_type;
+IntrusivePtr<OpaqueType> topk_type;
+IntrusivePtr<OpaqueType> bloomfilter_type;
+IntrusivePtr<OpaqueType> x509_opaque_type;
+IntrusivePtr<OpaqueType> ocsp_resp_opaque_type;
+IntrusivePtr<OpaqueType> paraglob_type;
 
 // Keep copy of command line
 int bro_argc;
@@ -269,7 +268,6 @@ void terminate_bro()
 
 	brofiler.WriteStats();
 
-	EventHandlerPtr zeek_done = internal_handler("zeek_done");
 	if ( zeek_done )
 		mgr.Enqueue(zeek_done, zeek::Args{});
 
@@ -363,7 +361,7 @@ static std::vector<std::string> get_script_signature_files()
 
 	// Parse rule files defined on the script level.
 	char* script_signature_files =
-		copy_string(internal_val("signature_files")->AsString()->CheckString());
+		copy_string(zeek::id::find_val("signature_files")->AsString()->CheckString());
 
 	char* tmp = script_signature_files;
 	char* s;
@@ -594,16 +592,16 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	init_event_handlers();
 
-	md5_type = new OpaqueType("md5");
-	sha1_type = new OpaqueType("sha1");
-	sha256_type = new OpaqueType("sha256");
-	entropy_type = new OpaqueType("entropy");
-	cardinality_type = new OpaqueType("cardinality");
-	topk_type = new OpaqueType("topk");
-	bloomfilter_type = new OpaqueType("bloomfilter");
-	x509_opaque_type = new OpaqueType("x509");
-	ocsp_resp_opaque_type = new OpaqueType("ocsp_resp");
-	paraglob_type = new OpaqueType("paraglob");
+	md5_type = make_intrusive<OpaqueType>("md5");
+	sha1_type = make_intrusive<OpaqueType>("sha1");
+	sha256_type = make_intrusive<OpaqueType>("sha256");
+	entropy_type = make_intrusive<OpaqueType>("entropy");
+	cardinality_type = make_intrusive<OpaqueType>("cardinality");
+	topk_type = make_intrusive<OpaqueType>("topk");
+	bloomfilter_type = make_intrusive<OpaqueType>("bloomfilter");
+	x509_opaque_type = make_intrusive<OpaqueType>("x509");
+	ocsp_resp_opaque_type = make_intrusive<OpaqueType>("ocsp_resp");
+	paraglob_type = make_intrusive<OpaqueType>("paraglob");
 
 	// The leak-checker tends to produce some false
 	// positives (memory which had already been
@@ -630,12 +628,12 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 	// Must come after plugin activation (and also after hash
 	// initialization).
 	binpac::FlowBuffer::Policy flowbuffer_policy;
-	flowbuffer_policy.max_capacity = global_scope()->Lookup(
-		"BinPAC::flowbuffer_capacity_max")->ID_Val()->AsCount();
-	flowbuffer_policy.min_capacity = global_scope()->Lookup(
-		"BinPAC::flowbuffer_capacity_min")->ID_Val()->AsCount();
-	flowbuffer_policy.contract_threshold = global_scope()->Lookup(
-		"BinPAC::flowbuffer_contract_threshold")->ID_Val()->AsCount();
+	flowbuffer_policy.max_capacity = global_scope()->Find(
+		"BinPAC::flowbuffer_capacity_max")->GetVal()->AsCount();
+	flowbuffer_policy.min_capacity = global_scope()->Find(
+		"BinPAC::flowbuffer_capacity_min")->GetVal()->AsCount();
+	flowbuffer_policy.contract_threshold = global_scope()->Find(
+		"BinPAC::flowbuffer_contract_threshold")->GetVal()->AsCount();
 	binpac::init(&flowbuffer_policy);
 
 	plugin_mgr->InitBifs();
@@ -685,7 +683,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	if ( options.pcap_filter )
 		{
-		ID* id = global_scope()->Lookup("cmd_line_bpf_filter");
+		const auto& id = global_scope()->Find("cmd_line_bpf_filter");
 
 		if ( ! id )
 			reporter->InternalError("global cmd_line_bpf_filter not defined");
@@ -724,7 +722,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	if ( ! options.pcap_file && ! options.interface )
 		{
-		Val* interfaces_val = internal_val("interfaces");
+		const auto& interfaces_val = zeek::id::find_val("interfaces");
 		if ( interfaces_val )
 			{
 			char* interfaces_str =
@@ -740,8 +738,6 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 	if ( dns_type != DNS_PRIME )
 		net_init(options.interface, options.pcap_file, options.pcap_output_file, options.use_watchdog);
 
-	net_done = internal_handler("net_done");
-
 	if ( ! g_policy_debug )
 		{
 		(void) setsignal(SIGTERM, sig_handler);
@@ -769,7 +765,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 	// Print the ID.
 	if ( options.identifier_to_print )
 		{
-		ID* id = global_scope()->Lookup(*options.identifier_to_print);
+		const auto& id = global_scope()->Find(*options.identifier_to_print);
 		if ( ! id )
 			reporter->FatalError("No such ID: %s\n", options.identifier_to_print->data());
 
@@ -784,6 +780,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 
 	if ( profiling_interval > 0 )
 		{
+		const auto& profiling_file = zeek::id::find_val("profiling_file");
 		profiling_logger = new ProfileLogger(profiling_file->AsFile(),
 			profiling_interval);
 
@@ -796,8 +793,7 @@ zeek::detail::SetupResult zeek::detail::setup(int argc, char** argv,
 		// we don't have any other source for it.
 		net_update_time(current_time());
 
-	EventHandlerPtr zeek_init = internal_handler("zeek_init");
-	if ( zeek_init )	//### this should be a function
+	if ( zeek_init )
 		mgr.Enqueue(zeek_init, zeek::Args{});
 
 	EventRegistry::string_list dead_handlers =
diff --git a/src/zeek.bif b/src/zeek.bif
index 77d3a11838..fceaa3ac5f 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -68,8 +68,8 @@ static int check_fmt_type(TypeTag t, TypeTag ok[])
 
 static void do_fmt(const char*& fmt, Val* v, ODesc* d)
 	{
-	TypeTag t = v->Type()->Tag();
-	InternalTypeTag it = v->Type()->InternalType();
+	TypeTag t = v->GetType()->Tag();
+	InternalTypeTag it = v->GetType()->InternalType();
 
 	bool zero_pad = false;
 	bool left_just = false;
@@ -198,9 +198,9 @@ static void do_fmt(const char*& fmt, Val* v, ODesc* d)
 			{
 			bro_uint_t u = v->CoerceToUnsigned();
 
-			if ( v->Type()->IsNetworkOrder() )
+			if ( v->GetType()->IsNetworkOrder() )
 				{
-				if ( v->Type()->Tag() == TYPE_PORT )
+				if ( v->GetType()->Tag() == TYPE_PORT )
 					u = v->AsPortVal()->Port();
 				else
 					u = ntohl(uint32_t(u));
@@ -401,15 +401,15 @@ function terminate%(%): bool
 // is false).
 static bool prepare_environment(TableVal* tbl, bool set)
 	{
-	IntrusivePtr<ListVal> idxs{AdoptRef{}, tbl->ConvertToPureList()};
+	auto idxs = tbl->ToPureListVal();
 
 	for ( int i = 0; i < idxs->Length(); ++i )
 		{
-		Val* key = idxs->Index(i);
-		auto val = tbl->Lookup(key, false);
+		const auto& key = idxs->Idx(i);
+		const auto& val = tbl->Find(key);
 
-		if ( key->Type()->Tag() != TYPE_STRING ||
-		     val->Type()->Tag() != TYPE_STRING )
+		if ( key->GetType()->Tag() != TYPE_STRING ||
+		     val->GetType()->Tag() != TYPE_STRING )
 			{
 			builtin_error("system_env() needs a table[string] of string");
 			return false;
@@ -487,7 +487,7 @@ function system%(str: string%): int
 ## .. zeek:see:: system safe_shell_quote piped_exec
 function system_env%(str: string, env: table_string_of_string%): int
 	%{
-	if ( env->Type()->Tag() != TYPE_TABLE )
+	if ( env->GetType()->Tag() != TYPE_TABLE )
 		{
 		builtin_error("system_env() requires a table argument");
 		return val_mgr->Int(-1);
@@ -803,8 +803,8 @@ function sha256_hash_finish%(handle: opaque of sha256%): string
 ## .. zeek:see::paraglob_match paraglob_equals paraglob_add
 function paraglob_init%(v: any%) : opaque of paraglob
 	%{
-	if ( v->Type()->Tag() != TYPE_VECTOR ||
-	     v->Type()->YieldType()->Tag() != TYPE_STRING )
+	if ( v->GetType()->Tag() != TYPE_VECTOR ||
+	     v->GetType()->Yield()->Tag() != TYPE_STRING )
 		{
 		// reporter->Error will throw an exception.
 		reporter->Error("paraglob requires a vector of strings for initialization.");
@@ -815,7 +815,7 @@ function paraglob_init%(v: any%) : opaque of paraglob
 	VectorVal* vv = v->AsVectorVal();
 	for ( unsigned int i = 0; i < vv->Size(); ++i )
 		{
-		const BroString* s = vv->Lookup(i)->AsString();
+		const BroString* s = vv->At(i)->AsString();
 		patterns.push_back(std::string(reinterpret_cast<const char*>(s->Bytes()), s->Len()));
 		}
 
@@ -1051,6 +1051,7 @@ function find_entropy%(data: string%): entropy_test_result
 	e.Feed(data->Bytes(), data->Len());
 	e.Get(&ent, &chisq, &mean, &montepi, &scc);
 
+	static auto entropy_test_result = zeek::id::find_type<RecordType>("entropy_test_result");
 	auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
 	ent_result->Assign(0, make_intrusive<Val>(ent,     TYPE_DOUBLE));
 	ent_result->Assign(1, make_intrusive<Val>(chisq,   TYPE_DOUBLE));
@@ -1102,6 +1103,7 @@ function entropy_test_finish%(handle: opaque of entropy%): entropy_test_result
 	montepi = scc = ent = mean = chisq = 0.0;
 	static_cast<EntropyVal*>(handle)->Get(&ent, &chisq, &mean, &montepi, &scc);
 
+	static auto entropy_test_result = zeek::id::find_type<RecordType>("entropy_test_result");
 	auto ent_result = make_intrusive<RecordVal>(entropy_test_result);
 	ent_result->Assign(0, make_intrusive<Val>(ent,     TYPE_DOUBLE));
 	ent_result->Assign(1, make_intrusive<Val>(chisq,   TYPE_DOUBLE));
@@ -1154,7 +1156,7 @@ function unique_id_from%(pool: int, prefix: string%) : string
 ## v: The set or table
 function clear_table%(v: any%): any
 	%{
-	if ( v->Type()->Tag() == TYPE_TABLE )
+	if ( v->GetType()->Tag() == TYPE_TABLE )
 		v->AsTableVal()->RemoveAll();
 	else
 		builtin_error("clear_table() requires a table/set argument");
@@ -1171,7 +1173,7 @@ function clear_table%(v: any%): any
 ## Returns: All the keys of the set or table that cover the subnet searched for.
 function matching_subnets%(search: subnet, t: any%): subnet_vec
 	%{
-	if ( t->Type()->Tag() != TYPE_TABLE || ! t->Type()->AsTableType()->IsSubNetIndex() )
+	if ( t->GetType()->Tag() != TYPE_TABLE || ! t->GetType()->AsTableType()->IsSubNetIndex() )
 		{
 		reporter->Error("matching_subnets needs to be called on a set[subnet]/table[subnet].");
 		return nullptr;
@@ -1190,7 +1192,7 @@ function matching_subnets%(search: subnet, t: any%): subnet_vec
 ## Returns: A new table that contains all the entries that cover the subnet searched for.
 function filter_subnet_table%(search: subnet, t: any%): any
 	%{
-	if ( t->Type()->Tag() != TYPE_TABLE || ! t->Type()->AsTableType()->IsSubNetIndex() )
+	if ( t->GetType()->Tag() != TYPE_TABLE || ! t->GetType()->AsTableType()->IsSubNetIndex() )
 		{
 		reporter->Error("filter_subnet_table needs to be called on a set[subnet]/table[subnet].");
 		return nullptr;
@@ -1210,7 +1212,7 @@ function filter_subnet_table%(search: subnet, t: any%): any
 ## Returns: True if the exact subnet is a member, false otherwise.
 function check_subnet%(search: subnet, t: any%): bool
 	%{
-	if ( t->Type()->Tag() != TYPE_TABLE || ! t->Type()->AsTableType()->IsSubNetIndex() )
+	if ( t->GetType()->Tag() != TYPE_TABLE || ! t->GetType()->AsTableType()->IsSubNetIndex() )
 		{
 		reporter->Error("check_subnet needs to be called on a set[subnet]/table[subnet].");
 		return nullptr;
@@ -1261,7 +1263,7 @@ function val_size%(v: any%): count
 ## Returns: The old size of *aggr*, or 0 if *aggr* is not a :zeek:type:`vector`.
 function resize%(aggr: any, newsize: count%) : count
 	%{
-	if ( aggr->Type()->Tag() != TYPE_VECTOR )
+	if ( aggr->GetType()->Tag() != TYPE_VECTOR )
 		{
 		builtin_error("resize() operates on vectors");
 		return nullptr;
@@ -1280,8 +1282,8 @@ function resize%(aggr: any, newsize: count%) : count
 ## .. zeek:see:: all_set
 function any_set%(v: any%) : bool
 	%{
-	if ( v->Type()->Tag() != TYPE_VECTOR ||
-	     v->Type()->YieldType()->Tag() != TYPE_BOOL )
+	if ( v->GetType()->Tag() != TYPE_VECTOR ||
+	     v->GetType()->Yield()->Tag() != TYPE_BOOL )
 		{
 		builtin_error("any_set() requires vector of bool");
 		return val_mgr->False();
@@ -1289,7 +1291,7 @@ function any_set%(v: any%) : bool
 
 	VectorVal* vv = v->AsVectorVal();
 	for ( unsigned int i = 0; i < vv->Size(); ++i )
-		if ( vv->Lookup(i) && vv->Lookup(i)->AsBool() )
+		if ( vv->At(i) && vv->At(i)->AsBool() )
 			return val_mgr->True();
 
 	return val_mgr->False();
@@ -1309,8 +1311,8 @@ function any_set%(v: any%) : bool
 ##      Missing elements count as false.
 function all_set%(v: any%) : bool
 	%{
-	if ( v->Type()->Tag() != TYPE_VECTOR ||
-	     v->Type()->YieldType()->Tag() != TYPE_BOOL )
+	if ( v->GetType()->Tag() != TYPE_VECTOR ||
+	     v->GetType()->Yield()->Tag() != TYPE_BOOL )
 		{
 		builtin_error("all_set() requires vector of bool");
 		return val_mgr->False();
@@ -1318,17 +1320,17 @@ function all_set%(v: any%) : bool
 
 	VectorVal* vv = v->AsVectorVal();
 	for ( unsigned int i = 0; i < vv->Size(); ++i )
-		if ( ! vv->Lookup(i) || ! vv->Lookup(i)->AsBool() )
+		if ( ! vv->At(i) || ! vv->At(i)->AsBool() )
 			return val_mgr->False();
 
 	return val_mgr->True();
 	%}
 
 %%{
-static Func* sort_function_comp = 0;
-static Val** index_map = 0;	// used for indirect sorting to support order()
+static Func* sort_function_comp = nullptr;
+static std::vector<const IntrusivePtr<Val>*> index_map;	// used for indirect sorting to support order()
 
-bool sort_function(Val* a, Val* b)
+bool sort_function(const IntrusivePtr<Val>& a, const IntrusivePtr<Val>& b)
 	{
 	// Sort missing values as "high".
 	if ( ! a )
@@ -1336,8 +1338,7 @@ bool sort_function(Val* a, Val* b)
 	if ( ! b )
 		return 1;
 
-	auto result = sort_function_comp->Call(IntrusivePtr{NewRef{}, a},
-	                                       IntrusivePtr{NewRef{}, b});
+	auto result = sort_function_comp->Invoke(a, b);
 	int int_result = result->CoerceToInt();
 
 	return int_result < 0;
@@ -1345,10 +1346,10 @@ bool sort_function(Val* a, Val* b)
 
 bool indirect_sort_function(size_t a, size_t b)
 	{
-	return sort_function(index_map[a], index_map[b]);
+	return sort_function(*index_map[a], *index_map[b]);
 	}
 
-bool signed_sort_function (Val* a, Val* b)
+bool signed_sort_function (const IntrusivePtr<Val>& a, const IntrusivePtr<Val>& b)
 	{
 	if ( ! a )
 		return 0;
@@ -1361,7 +1362,7 @@ bool signed_sort_function (Val* a, Val* b)
 	return ia < ib;
 	}
 
-bool unsigned_sort_function (Val* a, Val* b)
+bool unsigned_sort_function (const IntrusivePtr<Val>& a, const IntrusivePtr<Val>& b)
 	{
 	if ( ! a )
 		return 0;
@@ -1376,12 +1377,12 @@ bool unsigned_sort_function (Val* a, Val* b)
 
 bool indirect_signed_sort_function(size_t a, size_t b)
 	{
-	return signed_sort_function(index_map[a], index_map[b]);
+	return signed_sort_function(*index_map[a], *index_map[b]);
 	}
 
 bool indirect_unsigned_sort_function(size_t a, size_t b)
 	{
-	return unsigned_sort_function(index_map[a], index_map[b]);
+	return unsigned_sort_function(*index_map[a], *index_map[b]);
 	}
 %%}
 
@@ -1402,13 +1403,13 @@ function sort%(v: any, ...%) : any
 	%{
 	IntrusivePtr<Val> rval{NewRef{}, v};
 
-	if ( v->Type()->Tag() != TYPE_VECTOR )
+	if ( v->GetType()->Tag() != TYPE_VECTOR )
 		{
 		builtin_error("sort() requires vector");
 		return rval;
 		}
 
-	BroType* elt_type = v->Type()->YieldType();
+	const auto& elt_type = v->GetType()->Yield();
 	Func* comp = 0;
 
 	if ( @ARG@.size() > 2 )
@@ -1417,7 +1418,7 @@ function sort%(v: any, ...%) : any
 	if ( @ARG@.size() == 2 )
 		{
 		Val* comp_val = @ARG@[1].get();
-		if ( ! IsFunc(comp_val->Type()->Tag()) )
+		if ( ! IsFunc(comp_val->GetType()->Tag()) )
 			{
 			builtin_error("second argument to sort() needs to be comparison function");
 			return rval;
@@ -1429,13 +1430,14 @@ function sort%(v: any, ...%) : any
 	if ( ! comp && ! IsIntegral(elt_type->Tag()) )
 		builtin_error("comparison function required for sort() with non-integral types");
 
-	vector<Val*>& vv = *v->AsVector();
+	auto& vv = *v->AsVector();
 
 	if ( comp )
 		{
-		FuncType* comp_type = comp->FType()->AsFuncType();
-		if ( comp_type->YieldType()->Tag() != TYPE_INT ||
-		     ! comp_type->ArgTypes()->AllMatch(elt_type, 0) )
+		const auto& comp_type = comp->GetType();
+
+		if ( comp_type->Yield()->Tag() != TYPE_INT ||
+		     ! comp_type->ParamList()->AllMatch(elt_type, 0) )
 			{
 			builtin_error("invalid comparison function in call to sort()");
 			return rval;
@@ -1469,16 +1471,15 @@ function sort%(v: any, ...%) : any
 ## .. zeek:see:: sort
 function order%(v: any, ...%) : index_vec
 	%{
-	auto result_v = make_intrusive<VectorVal>(
-	    internal_type("index_vec")->AsVectorType());
+	auto result_v = make_intrusive<VectorVal>(zeek::id::index_vec);
 
-	if ( v->Type()->Tag() != TYPE_VECTOR )
+	if ( v->GetType()->Tag() != TYPE_VECTOR )
 		{
 		builtin_error("order() requires vector");
 		return result_v;
 		}
 
-	BroType* elt_type = v->Type()->YieldType();
+	const auto& elt_type = v->GetType()->Yield();
 	Func* comp = 0;
 
 	if ( @ARG@.size() > 2 )
@@ -1487,7 +1488,7 @@ function order%(v: any, ...%) : index_vec
 	if ( @ARG@.size() == 2 )
 		{
 		Val* comp_val = @ARG@[1].get();
-		if ( ! IsFunc(comp_val->Type()->Tag()) )
+		if ( ! IsFunc(comp_val->GetType()->Tag()) )
 			{
 			builtin_error("second argument to order() needs to be comparison function");
 			return IntrusivePtr<Val>{NewRef{}, v};
@@ -1499,25 +1500,25 @@ function order%(v: any, ...%) : index_vec
 	if ( ! comp && ! IsIntegral(elt_type->Tag()) )
 		builtin_error("comparison function required for order() with non-integral types");
 
-	vector<Val*>& vv = *v->AsVector();
+	auto& vv = *v->AsVector();
 	auto n = vv.size();
 
 	// Set up initial mapping of indices directly to corresponding
 	// elements.
 	vector<size_t> ind_vv(n);
-	index_map = new Val*[n];
+	index_map.reserve(n);
 	size_t i;
 	for ( i = 0; i < n; ++i )
 		{
 		ind_vv[i] = i;
-		index_map[i] = vv[i];
+		index_map.emplace_back(&vv[i]);
 		}
 
 	if ( comp )
 		{
-		FuncType* comp_type = comp->FType()->AsFuncType();
-		if ( comp_type->YieldType()->Tag() != TYPE_INT ||
-		     ! comp_type->ArgTypes()->AllMatch(elt_type, 0) )
+		const auto& comp_type = comp->GetType();
+		if ( comp_type->Yield()->Tag() != TYPE_INT ||
+		     ! comp_type->ParamList()->AllMatch(elt_type, 0) )
 			{
 			builtin_error("invalid comparison function in call to order()");
 			return IntrusivePtr<Val>{NewRef{}, v};
@@ -1535,8 +1536,7 @@ function order%(v: any, ...%) : index_vec
 			sort(ind_vv.begin(), ind_vv.end(), indirect_signed_sort_function);
 		}
 
-	delete [] index_map;
-	index_map = 0;
+	index_map = {};
 
 	// Now spin through ind_vv to read out the rearrangement.
 	for ( i = 0; i < n; ++i )
@@ -1603,7 +1603,7 @@ function cat_sep%(sep: string, def: string, ...%): string
 			d.Add(sep->CheckString(), 0);
 
 		Val* v = @ARG@[i].get();
-		if ( v->Type()->Tag() == TYPE_STRING && ! v->AsString()->Len() )
+		if ( v->GetType()->Tag() == TYPE_STRING && ! v->AsString()->Len() )
 			v = def;
 
 		v->Describe(&d);
@@ -1823,16 +1823,12 @@ function zeek_version%(%): string
 ## Returns: A string vector with the field names of *rt*.
 function record_type_to_vector%(rt: string%): string_vec
 	%{
-	auto result =
-		make_intrusive<VectorVal>(internal_type("string_vec")->AsVectorType());
+	auto result = make_intrusive<VectorVal>(zeek::id::string_vec);
 
-	RecordType *type = internal_type(rt->CheckString())->AsRecordType();
+	RecordType* type = zeek::id::find_type(rt->CheckString())->AsRecordType();
 
-	if ( type )
-		{
-		for ( int i = 0; i < type->NumFields(); ++i )
-			result->Assign(i+1, make_intrusive<StringVal>(type->FieldName(i)));
-		}
+	for ( int i = 0; i < type->NumFields(); ++i )
+		result->Assign(i+1, make_intrusive<StringVal>(type->FieldName(i)));
 
 	return result;
 	%}
@@ -1845,7 +1841,7 @@ function record_type_to_vector%(rt: string%): string_vec
 function type_name%(t: any%): string
 	%{
 	ODesc d;
-	t->Type()->Describe(&d);
+	t->GetType()->Describe(&d);
 
 	BroString* s = new BroString(1, d.TakeBytes(), d.Len());
 	s->SetUseFreeToDelete(true);
@@ -1856,8 +1852,8 @@ function type_name%(t: any%): string
 ## Returns: list of command-line arguments (``argv``) used to run Zeek.
 function zeek_args%(%): string_vec
 	%{
-	auto sv = internal_type("string_vec")->AsVectorType();
-	auto rval = make_intrusive<VectorVal>(sv);
+	auto sv = zeek::id::string_vec;
+	auto rval = make_intrusive<VectorVal>(std::move(sv));
 
 	for ( auto i = 0; i < bro_argc; ++i )
 		rval->Assign(rval->Size(), make_intrusive<StringVal>(bro_argv[i]));
@@ -1894,7 +1890,7 @@ function reading_traces%(%): bool
 ## .. zeek:see:: reading_live_traffic reading_traces
 function packet_source%(%): PacketSource
 	%{
-	auto ps_type = internal_type("PacketSource")->AsRecordType();
+	static auto ps_type = zeek::id::find_type<RecordType>("PacketSource");
 	auto ps = iosource_mgr->GetPktSrc();
 	auto r = make_intrusive<RecordVal>(ps_type);
 
@@ -1926,8 +1922,8 @@ function global_sizes%(%): var_sizes
 		if ( id->HasVal() )
 			{
 			auto id_name = make_intrusive<StringVal>(id->Name());
-			auto id_size = val_mgr->Count(id->ID_Val()->MemoryAllocation());
-			sizes->Assign(id_name.get(), std::move(id_size));
+			auto id_size = val_mgr->Count(id->GetVal()->MemoryAllocation());
+			sizes->Assign(std::move(id_name), std::move(id_size));
 			}
 		}
 
@@ -1944,14 +1940,16 @@ function global_sizes%(%): var_sizes
 ## .. zeek:see:: global_sizes
 function global_ids%(%): id_table
 	%{
-	auto ids = make_intrusive<TableVal>(IntrusivePtr{NewRef{}, id_table});
+	static auto id_table = zeek::id::find_type<TableType>("id_table");
+	auto ids = make_intrusive<TableVal>(id_table);
 	const auto& globals = global_scope()->Vars();
 
 	for ( const auto& global : globals )
 		{
 		ID* id = global.second.get();
+		static auto script_id = zeek::id::find_type<RecordType>("script_id");
 		auto rec = make_intrusive<RecordVal>(script_id);
-		rec->Assign(0, make_intrusive<StringVal>(type_name(id->Type()->Tag())));
+		rec->Assign(0, make_intrusive<StringVal>(type_name(id->GetType()->Tag())));
 		rec->Assign(1, val_mgr->Bool(id->IsExport()));
 		rec->Assign(2, val_mgr->Bool(id->IsConst()));
 		rec->Assign(3, val_mgr->Bool(id->IsEnumConst()));
@@ -1959,14 +1957,10 @@ function global_ids%(%): id_table
 		rec->Assign(5, val_mgr->Bool(id->IsRedefinable()));
 
 		if ( id->HasVal() )
-			{
-			Val* val = id->ID_Val();
-			Ref(val);
-			rec->Assign(6, val);
-			}
+			rec->Assign(6, id->GetVal());
 
 		auto id_name = make_intrusive<StringVal>(id->Name());
-		ids->Assign(id_name.get(), std::move(rec));
+		ids->Assign(std::move(id_name), std::move(rec));
 		}
 
 	return ids;
@@ -1980,14 +1974,14 @@ function global_ids%(%): id_table
 ##          the string ``"<unknown id>"`` or ``"<no ID value>"`` is returned.
 function lookup_ID%(id: string%) : any
 	%{
-	ID* i = global_scope()->Lookup(id->CheckString());
+	const auto& i = global_scope()->Find(id->CheckString());
 	if ( ! i )
 		return make_intrusive<StringVal>("<unknown id>");
 
-	if ( ! i->ID_Val() )
+	if ( ! i->GetVal() )
 		return make_intrusive<StringVal>("<no ID value>");
 
-	return IntrusivePtr{NewRef{}, i->ID_Val()};
+	return i->GetVal();
 	%}
 
 ## Generates metadata about a record's fields. The returned information
@@ -1999,18 +1993,19 @@ function lookup_ID%(id: string%) : any
 ## Returns: A table that describes the fields of a record.
 function record_fields%(rec: any%): record_field_table
 	%{
-	if ( rec->Type()->Tag() == TYPE_STRING )
-		{
-		auto id = global_scope()->Lookup(rec->AsStringVal()->ToStdString());
+	static auto record_field_table = zeek::id::find_type<TableType>("record_field_table");
 
-		if ( ! id || ! id->AsType() || id->AsType()->Tag() != TYPE_RECORD )
+	if ( rec->GetType()->Tag() == TYPE_STRING )
+		{
+		const auto& id = global_scope()->Find(rec->AsStringVal()->ToStdString());
+
+		if ( ! id || ! id->IsType() || id->GetType()->Tag() != TYPE_RECORD )
 			{
 			reporter->Error("record_fields string argument does not name a record type");
-			IntrusivePtr<TableType> tt{NewRef{}, internal_type("record_field_table")->AsTableType()};
-			return make_intrusive<TableVal>(std::move(tt));
+			return make_intrusive<TableVal>(record_field_table);
 			}
 
-		return id->AsType()->AsRecordType()->GetRecordFieldsVal();
+		return id->GetType()->AsRecordType()->GetRecordFieldsVal();
 		}
 
 	return rec->GetRecordFields();
@@ -2193,7 +2188,7 @@ function is_v6_subnet%(s: subnet%): bool
 ## Returns: The vector of addresses contained in the routing header data.
 function routing0_data_to_addrs%(s: string%): addr_vec
 	%{
-	auto rval = make_intrusive<VectorVal>(internal_type("addr_vec")->AsVectorType());
+	auto rval = make_intrusive<VectorVal>(zeek::id::find_type<VectorType>("addr_vec"));
 
 	int len = s->Len();
 	const u_char* bytes = s->Bytes();
@@ -2224,7 +2219,7 @@ function routing0_data_to_addrs%(s: string%): addr_vec
 ## .. zeek:see:: counts_to_addr
 function addr_to_counts%(a: addr%): index_vec
 	%{
-	auto rval = make_intrusive<VectorVal>(internal_type("index_vec")->AsVectorType());
+	auto rval = make_intrusive<VectorVal>(zeek::id::index_vec);
 	const uint32_t* bytes;
 	int len = a->AsAddr().GetBytes(&bytes);
 
@@ -2271,7 +2266,7 @@ function counts_to_addr%(v: index_vec%): addr
 ## Returns: The :zeek:type:`int` value that corresponds to the :zeek:type:`enum`.
 function enum_to_int%(e: any%): int
 	%{
-	if ( e->Type()->Tag() != TYPE_ENUM )
+	if ( e->GetType()->Tag() != TYPE_ENUM )
 		{
 		builtin_error("enum_to_int() requires enum value");
 		return val_mgr->Int(-1);
@@ -3218,16 +3213,16 @@ static IntrusivePtr<EnumVal> map_conn_type(TransportProto tp)
 	{
 	switch ( tp ) {
 	case TRANSPORT_UNKNOWN:
-		return transport_proto->GetVal(0);
+		return zeek::id::transport_proto->GetVal(0);
 
 	case TRANSPORT_TCP:
-		return transport_proto->GetVal(1);
+		return zeek::id::transport_proto->GetVal(1);
 
 	case TRANSPORT_UDP:
-		return transport_proto->GetVal(2);
+		return zeek::id::transport_proto->GetVal(2);
 
 	case TRANSPORT_ICMP:
-		return transport_proto->GetVal(3);
+		return zeek::id::transport_proto->GetVal(3);
 
 	default:
 		reporter->InternalError("bad connection type in map_conn_type()");
@@ -3253,7 +3248,7 @@ function get_conn_transport_proto%(cid: conn_id%): transport_proto
 	if ( ! c )
 		{
 		builtin_error("unknown connection id in get_conn_transport_proto()", cid);
-		return transport_proto->GetVal(0);
+		return zeek::id::transport_proto->GetVal(0);
 		}
 
 	return map_conn_type(c->ConnTransport());
@@ -3305,20 +3300,20 @@ function lookup_connection%(cid: conn_id%): connection
 	builtin_error("connection ID not a known connection", cid);
 
 	// Return a dummy connection record.
-	auto c = make_intrusive<RecordVal>(connection_type);
+	auto c = make_intrusive<RecordVal>(zeek::id::connection);
 
-	auto id_val = make_intrusive<RecordVal>(conn_id);
+	auto id_val = make_intrusive<RecordVal>(zeek::id::conn_id);
 	id_val->Assign(0, make_intrusive<AddrVal>((unsigned int) 0));
 	id_val->Assign(1, val_mgr->Port(ntohs(0), TRANSPORT_UDP));
 	id_val->Assign(2, make_intrusive<AddrVal>((unsigned int) 0));
 	id_val->Assign(3, val_mgr->Port(ntohs(0), TRANSPORT_UDP));
 	c->Assign(0, std::move(id_val));
 
-	auto orig_endp = make_intrusive<RecordVal>(endpoint);
+	auto orig_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
 	orig_endp->Assign(0, val_mgr->Count(0));
 	orig_endp->Assign(1, val_mgr->Count(int(0)));
 
-	auto resp_endp = make_intrusive<RecordVal>(endpoint);
+	auto resp_endp = make_intrusive<RecordVal>(zeek::id::endpoint);
 	resp_endp->Assign(0, val_mgr->Count(0));
 	resp_endp->Assign(1, val_mgr->Count(int(0)));
 
@@ -3327,7 +3322,7 @@ function lookup_connection%(cid: conn_id%): connection
 
 	c->Assign(3, make_intrusive<Val>(network_time, TYPE_TIME));
 	c->Assign(4, make_intrusive<Val>(0.0, TYPE_INTERVAL));
-	c->Assign(5, make_intrusive<TableVal>(IntrusivePtr{NewRef{}, string_set}));	// service
+	c->Assign(5, make_intrusive<TableVal>(zeek::id::string_set));	// service
 	c->Assign(6, val_mgr->EmptyString());	// history
 
 	return c;
@@ -3336,8 +3331,8 @@ function lookup_connection%(cid: conn_id%): connection
 %%{
 const char* conn_id_string(Val* c)
 	{
-	Val* id = (*(c->AsRecord()))[0];
-	const val_list* vl = id->AsRecord();
+	const auto& id = (*(c->AsRecord()))[0];
+	auto vl = id->AsRecord();
 
 	const IPAddr& orig_h = (*vl)[0]->AsAddr();
 	uint32_t orig_p = (*vl)[1]->AsPortVal()->Port();
@@ -3389,6 +3384,7 @@ function dump_current_packet%(file_name: string%) : bool
 ## .. zeek:see:: dump_current_packet dump_packet
 function get_current_packet%(%) : pcap_packet
 	%{
+	static auto pcap_packet = zeek::id::find_type<RecordType>("pcap_packet");
 	const Packet* p;
 	auto pkt = make_intrusive<RecordVal>(pcap_packet);
 
@@ -3400,7 +3396,7 @@ function get_current_packet%(%) : pcap_packet
 		pkt->Assign(2, val_mgr->Count(0));
 		pkt->Assign(3, val_mgr->Count(0));
 		pkt->Assign(4, val_mgr->EmptyString());
-		pkt->Assign(5, BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN));
+		pkt->Assign(5, zeek::BifType::Enum::link_encap->GetVal(BifEnum::LINK_UNKNOWN));
 		return pkt;
 		}
 
@@ -3409,7 +3405,7 @@ function get_current_packet%(%) : pcap_packet
 	pkt->Assign(2, val_mgr->Count(p->cap_len));
 	pkt->Assign(3, val_mgr->Count(p->len));
 	pkt->Assign(4, make_intrusive<StringVal>(p->cap_len, (const char*)p->data));
-	pkt->Assign(5, BifType::Enum::link_encap->GetVal(p->link_type));
+	pkt->Assign(5, zeek::BifType::Enum::link_encap->GetVal(p->link_type));
 
 	return pkt;
 	%}
@@ -3427,9 +3423,10 @@ function get_current_packet_header%(%) : raw_pkt_hdr
 	if ( current_pktsrc &&
 	     current_pktsrc->GetCurrentPacket(&p) )
 		{
-		return IntrusivePtr{AdoptRef{}, p->BuildPktHdrVal()};
+		return p->ToRawPktHdrVal();
 		}
 
+	static auto raw_pkt_hdr_type = zeek::id::find_type<RecordType>("raw_pkt_hdr");
 	auto hdr = make_intrusive<RecordVal>(raw_pkt_hdr_type);
 	return hdr;
 	%}
@@ -3460,7 +3457,7 @@ function dump_packet%(pkt: pcap_packet, file_name: string%) : bool
 		uint32_t caplen, len, link_type;
 		u_char *data;
 
-		const val_list* pkt_vl = pkt->AsRecord();
+		auto pkt_vl = pkt->AsRecord();
 
 		ts.tv_sec = (*pkt_vl)[0]->AsCount();
 		ts.tv_usec = (*pkt_vl)[1]->AsCount();
@@ -3524,10 +3521,9 @@ public:
 		else
 			{
 			ListVal* lv = new ListVal(TYPE_ADDR);
-			lv->Append(new AddrVal("0.0.0.0"));
-			Val* result = lv->ConvertToSet();
-			trigger->Cache(call, result);
-			Unref(result);
+			lv->Append(make_intrusive<AddrVal>("0.0.0.0"));
+			auto result = lv->ToSetVal();
+			trigger->Cache(call, result.get());
 			Unref(lv);
 			}
 
@@ -3866,7 +3862,7 @@ static bool mmdb_lookup_asn(const IPAddr& addr, MMDB_lookup_result_s& result)
 	return mmdb_lookup(addr, result, true);
 	}
 
-static Val* mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
+static IntrusivePtr<Val> mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
                           int data_type )
 	{
 	switch (status)
@@ -3877,16 +3873,16 @@ static Val* mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
 				switch (data_type)
 					{
 					case MMDB_DATA_TYPE_UTF8_STRING:
-						return new StringVal(entry_data->data_size,
-						                     entry_data->utf8_string);
+						return make_intrusive<StringVal>(entry_data->data_size,
+						                                 entry_data->utf8_string);
 						break;
 
 					case MMDB_DATA_TYPE_DOUBLE:
-						return new Val(entry_data->double_value, TYPE_DOUBLE);
+						return make_intrusive<Val>(entry_data->double_value, TYPE_DOUBLE);
 						break;
 
 					case MMDB_DATA_TYPE_UINT32:
-						return val_mgr->Count(entry_data->uint32).release();
+						return val_mgr->Count(entry_data->uint32);
 
 					default:
 						break;
@@ -3909,7 +3905,7 @@ static Val* mmdb_getvalue(MMDB_entry_data_s* entry_data, int status,
 static bool mmdb_try_open_loc ()
 	{
 	// City database is always preferred over Country database.
-	auto mmdb_dir_val = global_scope()->Lookup("mmdb_dir")->ID_Val();
+	const auto& mmdb_dir_val = global_scope()->Find("mmdb_dir")->GetVal();
 	std::string mmdb_dir = mmdb_dir_val->AsString()->CheckString();
 
 	if ( ! mmdb_dir.empty() )
@@ -3937,7 +3933,7 @@ static bool mmdb_try_open_loc ()
 
 static bool mmdb_try_open_asn ()
 	{
-	auto mmdb_dir_val = global_scope()->Lookup("mmdb_dir")->ID_Val();
+	const auto& mmdb_dir_val = global_scope()->Find("mmdb_dir")->GetVal();
 	std::string mmdb_dir = mmdb_dir_val->AsString()->CheckString();
 
 	if ( ! mmdb_dir.empty() )
@@ -4001,6 +3997,7 @@ function mmdb_open_asn_db%(f: string%) : bool
 ## .. zeek:see:: lookup_asn
 function lookup_location%(a: addr%) : geo_location
 	%{
+	static auto geo_location = zeek::id::find_type<RecordType>("geo_location");
 	auto location = make_intrusive<RecordVal>(geo_location);
 
 #ifdef USE_GEOIP
@@ -4112,8 +4109,8 @@ function lookup_asn%(a: addr%) : count
 		// Get Autonomous System Number
 		status = MMDB_get_value(&result.entry, &entry_data,
 		                        "autonomous_system_number", nullptr);
-		Val* asn = mmdb_getvalue(&entry_data, status, MMDB_DATA_TYPE_UINT32);
-		return asn == nullptr ? val_mgr->Count(0) : IntrusivePtr<Val>{AdoptRef{}, asn};
+		auto asn = mmdb_getvalue(&entry_data, status, MMDB_DATA_TYPE_UINT32);
+		return asn == nullptr ? val_mgr->Count(0) : asn;
 		}
 
 #else // not USE_GEOIP
@@ -4400,9 +4397,9 @@ function open%(f: string%): file
 	const char* file = f->CheckString();
 
 	if ( streq(file, "-") )
-		return make_intrusive<Val>(new BroFile(stdout, "-", "w"));
+		return make_intrusive<Val>(make_intrusive<BroFile>(stdout, "-", "w"));
 	else
-		return make_intrusive<Val>(new BroFile(file, "w"));
+		return make_intrusive<Val>(make_intrusive<BroFile>(file, "w"));
 	%}
 
 ## Opens a file for writing or appending. If a file with the same name already
@@ -4417,7 +4414,7 @@ function open%(f: string%): file
 ##              rmdir unlink rename
 function open_for_append%(f: string%): file
 	%{
-	return make_intrusive<Val>(new BroFile(f->CheckString(), "a"));
+	return make_intrusive<Val>(make_intrusive<BroFile>(f->CheckString(), "a"));
 	%}
 
 ## Closes an open file and flushes any buffered content.
@@ -4632,6 +4629,7 @@ function rotate_file%(f: file%): rotate_info
 		return info;
 
 	// Record indicating error.
+	static auto rotate_info = zeek::id::find_type<RecordType>("rotate_info");
 	info = make_intrusive<RecordVal>(rotate_info);
 	info->Assign(0, val_mgr->EmptyString());
 	info->Assign(1, val_mgr->EmptyString());
@@ -4651,6 +4649,7 @@ function rotate_file%(f: file%): rotate_info
 ## .. zeek:see:: rotate_file calc_next_rotate
 function rotate_file_by_name%(f: string%): rotate_info
 	%{
+	static auto rotate_info = zeek::id::find_type<RecordType>("rotate_info");
 	auto info = make_intrusive<RecordVal>(rotate_info);
 
 	bool is_pkt_dumper = false;
@@ -4705,8 +4704,8 @@ function rotate_file_by_name%(f: string%): rotate_info
 ## .. zeek:see:: rotate_file rotate_file_by_name
 function calc_next_rotate%(i: interval%) : interval
 	%{
-	const char* base_time = log_rotate_base_time ?
-		log_rotate_base_time->AsString()->CheckString() : 0;
+	static auto log_rotate_base_time = zeek::id::find_val<StringVal>("log_rotate_base_time");
+	static auto base_time = log_rotate_base_time->AsString()->CheckString();
 
 	double base = parse_rotate_base_time(base_time);
 	return make_intrusive<Val>(calc_next_rotate(network_time, i, base), TYPE_INTERVAL);
diff --git a/src/zeekygen/IdentifierInfo.cc b/src/zeekygen/IdentifierInfo.cc
index e95de1ea9e..744aab928b 100644
--- a/src/zeekygen/IdentifierInfo.cc
+++ b/src/zeekygen/IdentifierInfo.cc
@@ -16,8 +16,8 @@ IdentifierInfo::IdentifierInfo(IntrusivePtr<ID> arg_id, ScriptInfo* script)
 	  comments(), id(std::move(arg_id)), initial_val(), redefs(), fields(),
 	  last_field_seen(), declaring_script(script)
 	{
-	if ( id->ID_Val() && (id->IsOption() || id->IsRedefinable()) )
-		initial_val = id->ID_Val()->Clone();
+	if ( id->GetVal() && (id->IsOption() || id->IsRedefinable()) )
+		initial_val = id->GetVal()->Clone();
 	}
 
 IdentifierInfo::~IdentifierInfo()
@@ -116,7 +116,7 @@ string IdentifierInfo::DoReStructuredText(bool roles_only) const
 		if ( i > 0 )
 			d.NL();
 
-		if ( IsFunc(id->Type()->Tag()) )
+		if ( IsFunc(id->GetType()->Tag()) )
 			{
 			string s = comments[i];
 
diff --git a/src/zeekygen/IdentifierInfo.h b/src/zeekygen/IdentifierInfo.h
index e21912d8fb..a2292844d1 100644
--- a/src/zeekygen/IdentifierInfo.h
+++ b/src/zeekygen/IdentifierInfo.h
@@ -42,8 +42,8 @@ public:
 	/**
 	 * Returns the initial value of the identifier.
 	 */
-	Val* InitialVal() const
-		{ return initial_val.get(); }
+	const IntrusivePtr<Val>& InitialVal() const
+		{ return initial_val; }
 
 	/**
 	 * Add a comment associated with the identifier.  If the identifier is a
diff --git a/src/zeekygen/Manager.cc b/src/zeekygen/Manager.cc
index 6636447516..868b27e39b 100644
--- a/src/zeekygen/Manager.cc
+++ b/src/zeekygen/Manager.cc
@@ -218,13 +218,14 @@ void Manager::ModuleUsage(const string& path, const string& module)
 
 IdentifierInfo* Manager::CreateIdentifierInfo(IntrusivePtr<ID> id, ScriptInfo* script)
 	{
-	auto prev = identifiers.GetInfo(id->Name());
-	IdentifierInfo* rval = prev ? prev : new IdentifierInfo(id, script);
+	const auto& id_name = id->Name();
+	auto prev = identifiers.GetInfo(id_name);
+	IdentifierInfo* rval = prev ? prev : new IdentifierInfo(std::move(id), script);
 
 	rval->AddComments(comment_buffer);
 	comment_buffer.clear();
 
-	comment_buffer_map_t::iterator it = comment_buffer_map.find(id->Name());
+	comment_buffer_map_t::iterator it = comment_buffer_map.find(id_name);
 
 	if ( it != comment_buffer_map.end() )
 		{
@@ -235,7 +236,7 @@ IdentifierInfo* Manager::CreateIdentifierInfo(IntrusivePtr<ID> id, ScriptInfo* s
 	if ( ! prev )
 		{
 		all_info.push_back(rval);
-		identifiers.map[id->Name()] = rval;
+		identifiers.map[id_name] = rval;
 		}
 
 	last_identifier_seen = rval;
@@ -267,14 +268,14 @@ void Manager::StartType(IntrusivePtr<ID> id)
 		return;
 		}
 
-	incomplete_type = CreateIdentifierInfo(id, script_info);
-	DBG_LOG(DBG_ZEEKYGEN, "Made IdentifierInfo (incomplete) %s, in %s",
+	DBG_LOG(DBG_ZEEKYGEN, "Making IdentifierInfo (incomplete) %s, in %s",
 	        id->Name(), script.c_str());
+	incomplete_type = CreateIdentifierInfo(std::move(id), script_info);
 	}
 
 static bool IsEnumType(ID* id)
 	{
-	return id->AsType() ? id->AsType()->Tag() == TYPE_ENUM : false;
+	return id->IsType() ? id->GetType()->Tag() == TYPE_ENUM : false;
 	}
 
 void Manager::Identifier(IntrusivePtr<ID> id)
@@ -300,7 +301,7 @@ void Manager::Identifier(IntrusivePtr<ID> id)
 
 	if ( id_info )
 		{
-		if ( IsFunc(id_info->GetID()->Type()->Tag()) )
+		if ( IsFunc(id_info->GetID()->GetType()->Tag()) )
 			{
 			// Function may already been seen (declaration versus body).
 			id_info->AddComments(comment_buffer);
@@ -331,9 +332,9 @@ void Manager::Identifier(IntrusivePtr<ID> id)
 		return;
 		}
 
-	CreateIdentifierInfo(id, script_info);
-	DBG_LOG(DBG_ZEEKYGEN, "Made IdentifierInfo %s, in script %s",
+	DBG_LOG(DBG_ZEEKYGEN, "Making IdentifierInfo %s, in script %s",
 	        id->Name(), script.c_str());
+	CreateIdentifierInfo(std::move(id), script_info);
 	}
 
 void Manager::RecordField(const ID* id, const TypeDecl* field,
diff --git a/src/zeekygen/ScriptInfo.cc b/src/zeekygen/ScriptInfo.cc
index 532a6667ff..827bac5979 100644
--- a/src/zeekygen/ScriptInfo.cc
+++ b/src/zeekygen/ScriptInfo.cc
@@ -183,7 +183,7 @@ void ScriptInfo::DoInitPostScript()
 		if ( ! zeekygen::is_public_api(id) )
 			continue;
 
-		if ( id->AsType() )
+		if ( id->IsType() )
 			{
 			types.push_back(info);
 			DBG_LOG(DBG_ZEEKYGEN, "Filter id '%s' in '%s' as a type",
@@ -191,9 +191,9 @@ void ScriptInfo::DoInitPostScript()
 			continue;
 			}
 
-		if ( IsFunc(id->Type()->Tag()) )
+		if ( IsFunc(id->GetType()->Tag()) )
 			{
-			switch ( id->Type()->AsFuncType()->Flavor() ) {
+			switch ( id->GetType()->AsFuncType()->Flavor() ) {
 			case FUNC_FLAVOR_HOOK:
 				DBG_LOG(DBG_ZEEKYGEN, "Filter id '%s' in '%s' as a hook",
 				        id->Name(), name.c_str());
@@ -219,7 +219,7 @@ void ScriptInfo::DoInitPostScript()
 
 		if ( id->IsConst() )
 			{
-			if ( id->FindAttr(ATTR_REDEF) )
+			if ( id->GetAttr(ATTR_REDEF) )
 				{
 				DBG_LOG(DBG_ZEEKYGEN, "Filter id '%s' in '%s' as a redef_option",
 				        id->Name(), name.c_str());
@@ -243,7 +243,7 @@ void ScriptInfo::DoInitPostScript()
 			continue;
 			}
 
-		if ( id->Type()->Tag() == TYPE_ENUM )
+		if ( id->GetType()->Tag() == TYPE_ENUM )
 			// Enums are always referenced/documented from the type's
 			// documentation.
 			continue;
@@ -257,13 +257,13 @@ void ScriptInfo::DoInitPostScript()
 	// so just manually associating them with scripts for now.
 	if ( name == "base/frameworks/input/main.zeek" )
 		{
-		auto id = global_scope()->Lookup("Input::Reader");
-		types.push_back(new IdentifierInfo({NewRef{}, id}, this));
+		const auto& id = global_scope()->Find("Input::Reader");
+		types.push_back(new IdentifierInfo(id, this));
 		}
 	else if ( name == "base/frameworks/logging/main.zeek" )
 		{
-		auto id = global_scope()->Lookup("Log::Writer");
-		types.push_back(new IdentifierInfo({NewRef{}, id}, this));
+		const auto& id = global_scope()->Find("Log::Writer");
+		types.push_back(new IdentifierInfo(id, this));
 		}
 	}
 
diff --git a/src/zeekygen/Target.cc b/src/zeekygen/Target.cc
index 9aae9b82fe..34e6f3519a 100644
--- a/src/zeekygen/Target.cc
+++ b/src/zeekygen/Target.cc
@@ -35,7 +35,7 @@ static void write_plugin_section_heading(FILE* f, const plugin::Plugin* p)
 
 static void write_analyzer_component(FILE* f, const analyzer::Component* c)
 	{
-	EnumType* atag = analyzer_mgr->GetTagEnumType();
+	const auto& atag = analyzer_mgr->GetTagType();
 	string tag = fmt("ANALYZER_%s", c->CanonicalName().c_str());
 
 	if ( atag->Lookup("Analyzer", tag.c_str()) < 0 )
@@ -46,7 +46,7 @@ static void write_analyzer_component(FILE* f, const analyzer::Component* c)
 
 static void write_analyzer_component(FILE* f, const file_analysis::Component* c)
 	{
-	EnumType* atag = file_mgr->GetTagEnumType();
+	const auto& atag = file_mgr->GetTagType();
 	string tag = fmt("ANALYZER_%s", c->CanonicalName().c_str());
 
 	if ( atag->Lookup("Files", tag.c_str()) < 0 )
diff --git a/testing/btest/Baseline/plugins.func-hook/output b/testing/btest/Baseline/plugins.func-hook/output
new file mode 100644
index 0000000000..21e27b43c0
--- /dev/null
+++ b/testing/btest/Baseline/plugins.func-hook/output
@@ -0,0 +1,4 @@
+1590206064.237264   MetaHookPre   CallFunction(foo, <frame>, (1, 2, 3, yo))
+1590206064.237264 | HookFunctionCall foo(1, 2, 3, yo)
+1590206064.237264   MetaHookPost  CallFunction(foo, <frame>, (1, 2, 3, yo)) -> <no result>
+foo, 42, 2, 3, yo
diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output
index 514820557f..620be2be0d 100644
--- a/testing/btest/Baseline/plugins.hooks/output
+++ b/testing/btest/Baseline/plugins.hooks/output
@@ -565,7 +565,7 @@
 0.000000   MetaHookPost  CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::STD_DEV, lambda_<5704045257244168718>{ SumStats::calc_std_dev(SumStats::rv)})) -> <no result>
 0.000000   MetaHookPost  CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::SUM, lambda_<6958532551242393774>{ SumStats::rv$sum += SumStats::val})) -> <no result>
 0.000000   MetaHookPost  CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::TOPK, lambda_<2861372781530360365>{ topk_add(SumStats::rv$topk, SumStats::obs)})) -> <no result>
-0.000000   MetaHookPost  CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::UNIQUE, lambda_<535013331230430358>{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || flattenSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = flattenSumStats::rv$unique_vals})) -> <no result>
+0.000000   MetaHookPost  CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::UNIQUE, lambda_<10387912117292132662>{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || sizeofSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = sizeofSumStats::rv$unique_vals})) -> <no result>
 0.000000   MetaHookPost  CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::VARIANCE, lambda_<6557258612059469785>{ if (1 < SumStats::rv$num) SumStats::rv$var_s += ((SumStats::val - SumStats::rv$prev_avg) * (SumStats::val - SumStats::rv$average))SumStats::calc_variance(SumStats::rv)SumStats::rv$prev_avg = SumStats::rv$average})) -> <no result>
 0.000000   MetaHookPost  CallFunction(SumStats::register_observe_plugins, <frame>, ()) -> <no result>
 0.000000   MetaHookPost  CallFunction(current_time, <frame>, ()) -> <no result>
@@ -1486,7 +1486,7 @@
 0.000000   MetaHookPre   CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::STD_DEV, lambda_<5704045257244168718>{ SumStats::calc_std_dev(SumStats::rv)}))
 0.000000   MetaHookPre   CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::SUM, lambda_<6958532551242393774>{ SumStats::rv$sum += SumStats::val}))
 0.000000   MetaHookPre   CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::TOPK, lambda_<2861372781530360365>{ topk_add(SumStats::rv$topk, SumStats::obs)}))
-0.000000   MetaHookPre   CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::UNIQUE, lambda_<535013331230430358>{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || flattenSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = flattenSumStats::rv$unique_vals}))
+0.000000   MetaHookPre   CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::UNIQUE, lambda_<10387912117292132662>{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || sizeofSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = sizeofSumStats::rv$unique_vals}))
 0.000000   MetaHookPre   CallFunction(SumStats::register_observe_plugin, <frame>, (SumStats::VARIANCE, lambda_<6557258612059469785>{ if (1 < SumStats::rv$num) SumStats::rv$var_s += ((SumStats::val - SumStats::rv$prev_avg) * (SumStats::val - SumStats::rv$average))SumStats::calc_variance(SumStats::rv)SumStats::rv$prev_avg = SumStats::rv$average}))
 0.000000   MetaHookPre   CallFunction(SumStats::register_observe_plugins, <frame>, ())
 0.000000   MetaHookPre   CallFunction(current_time, <frame>, ())
@@ -2406,7 +2406,7 @@
 0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::STD_DEV, lambda_<5704045257244168718>{ SumStats::calc_std_dev(SumStats::rv)})
 0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::SUM, lambda_<6958532551242393774>{ SumStats::rv$sum += SumStats::val})
 0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::TOPK, lambda_<2861372781530360365>{ topk_add(SumStats::rv$topk, SumStats::obs)})
-0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::UNIQUE, lambda_<535013331230430358>{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || flattenSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = flattenSumStats::rv$unique_vals})
+0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::UNIQUE, lambda_<10387912117292132662>{ if (!SumStats::rv?$unique_vals) SumStats::rv$unique_vals = (coerce set() to set[SumStats::Observation])if (SumStats::r?$unique_max) SumStats::rv$unique_max = SumStats::r$unique_maxif (!SumStats::r?$unique_max || sizeofSumStats::rv$unique_vals <= SumStats::r$unique_max) add SumStats::rv$unique_vals[SumStats::obs]SumStats::rv$unique = sizeofSumStats::rv$unique_vals})
 0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::VARIANCE, lambda_<6557258612059469785>{ if (1 < SumStats::rv$num) SumStats::rv$var_s += ((SumStats::val - SumStats::rv$prev_avg) * (SumStats::val - SumStats::rv$average))SumStats::calc_variance(SumStats::rv)SumStats::rv$prev_avg = SumStats::rv$average})
 0.000000 | HookCallFunction SumStats::register_observe_plugins()
 0.000000 | HookCallFunction current_time()
diff --git a/testing/btest/Baseline/plugins.legacy-func-hook/output b/testing/btest/Baseline/plugins.legacy-func-hook/output
new file mode 100644
index 0000000000..1d00ed4d5d
--- /dev/null
+++ b/testing/btest/Baseline/plugins.legacy-func-hook/output
@@ -0,0 +1,4 @@
+1590205948.002795   MetaHookPre   CallFunction(foo, <frame>, (1, 2, 3, yo))
+1590205948.002795 | HookCallFunction foo(1, 2, 3, yo)
+1590205948.002795   MetaHookPost  CallFunction(foo, <frame>, (1, 2, 3, yo)) -> <no result>
+foo, 13, 2, 3, yo
diff --git a/testing/btest/plugins/func-hook-plugin/.btest-ignore b/testing/btest/plugins/func-hook-plugin/.btest-ignore
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/testing/btest/plugins/func-hook-plugin/src/Plugin.cc b/testing/btest/plugins/func-hook-plugin/src/Plugin.cc
new file mode 100644
index 0000000000..f1b089e65e
--- /dev/null
+++ b/testing/btest/plugins/func-hook-plugin/src/Plugin.cc
@@ -0,0 +1,86 @@
+
+#include "Plugin.h"
+
+#include <Val.h>
+#include <Func.h>
+#include <Event.h>
+#include <Conn.h>
+#include <Desc.h>
+#include <threading/Formatter.h>
+
+namespace plugin { namespace Demo_Hooks { Plugin plugin; } }
+
+using namespace plugin::Demo_Hooks;
+
+plugin::Configuration Plugin::Configure()
+	{
+	EnableHook(HOOK_CALL_FUNCTION);
+	EnableHook(META_HOOK_PRE);
+	EnableHook(META_HOOK_POST);
+
+	plugin::Configuration config;
+	config.name = "Demo::Hooks";
+	config.description = "Exercises all plugin hooks";
+	config.version.major = 1;
+	config.version.minor = 0;
+	config.version.patch = 0;
+	return config;
+	}
+
+static void describe_hook_args(const plugin::HookArgumentList& args, ODesc* d)
+	{
+	bool first = true;
+
+	for ( plugin::HookArgumentList::const_iterator i = args.begin(); i != args.end(); i++ )
+		{
+		if ( ! first )
+			d->Add(", ");
+
+		i->Describe(d);
+		first = false;
+		}
+	}
+
+std::pair<bool, IntrusivePtr<Val>> Plugin::HookFunctionCall(const Func* func,
+                                                            Frame* frame,
+                                                            zeek::Args* args)
+	{
+	ODesc d;
+	d.SetShort();
+	HookArgument(func).Describe(&d);
+	HookArgument(args).Describe(&d);
+	fprintf(stderr, "%.6f %-15s %s\n", network_time, "| HookFunctionCall",
+		d.Description());
+
+	if ( streq(func->Name(), "foo") )
+		{
+		auto& vl = *args;
+		vl[0] = val_mgr->Count(42);
+		}
+
+	return {};
+	}
+
+void Plugin::MetaHookPre(HookType hook, const HookArgumentList& args)
+	{
+	ODesc d;
+	d.SetShort();
+	describe_hook_args(args, &d);
+	fprintf(stderr, "%.6f %-15s %s(%s)\n", network_time, "  MetaHookPre",
+		hook_name(hook), d.Description());
+	}
+
+void Plugin::MetaHookPost(HookType hook, const HookArgumentList& args, HookArgument result)
+	{
+	ODesc d1;
+	d1.SetShort();
+	describe_hook_args(args, &d1);
+
+	ODesc d2;
+	d2.SetShort();
+	result.Describe(&d2);
+
+	fprintf(stderr, "%.6f %-15s %s(%s) -> %s\n", network_time, "  MetaHookPost",
+		hook_name(hook), d1.Description(),
+		d2.Description());
+	}
diff --git a/testing/btest/plugins/func-hook-plugin/src/Plugin.h b/testing/btest/plugins/func-hook-plugin/src/Plugin.h
new file mode 100644
index 0000000000..c480466e9e
--- /dev/null
+++ b/testing/btest/plugins/func-hook-plugin/src/Plugin.h
@@ -0,0 +1,27 @@
+
+#pragma once
+
+#include <plugin/Plugin.h>
+
+namespace plugin {
+namespace Demo_Hooks {
+
+class Plugin : public ::plugin::Plugin
+{
+protected:
+
+	std::pair<bool, IntrusivePtr<Val>> HookFunctionCall(const Func* func,
+	                                                    Frame* frame,
+	                                                    zeek::Args* args) override;
+
+	void MetaHookPre(HookType hook, const HookArgumentList& args) override;
+	void MetaHookPost(HookType hook, const HookArgumentList& args, HookArgument result) override;
+
+	// Overridden from plugin::Plugin.
+	plugin::Configuration Configure() override;
+};
+
+extern Plugin plugin;
+
+}
+}
diff --git a/testing/btest/plugins/func-hook.zeek b/testing/btest/plugins/func-hook.zeek
new file mode 100644
index 0000000000..5a9d2c6e48
--- /dev/null
+++ b/testing/btest/plugins/func-hook.zeek
@@ -0,0 +1,17 @@
+# @TEST-EXEC: ${DIST}/aux/zeek-aux/plugin-support/init-plugin -u . Demo Hooks
+# @TEST-EXEC: cp -r %DIR/func-hook-plugin/* .
+# @TEST-EXEC: ./configure --zeek-dist=${DIST} && make
+# @TEST-EXEC: ZEEK_PLUGIN_ACTIVATE="Demo::Hooks" ZEEK_PLUGIN_PATH=`pwd` zeek -b %INPUT 2>&1 | grep foo >output
+# @TEST-EXEC: btest-diff output
+
+@unload base/misc/version
+
+function foo(a: count, b: count, c: count, s: string)
+	{
+	print "foo", a, b, c, s;
+	}
+
+event zeek_init()
+	{
+	foo(1, 2, 3, "yo");
+	}
diff --git a/testing/btest/plugins/legacy-func-hook-plugin/.btest-ignore b/testing/btest/plugins/legacy-func-hook-plugin/.btest-ignore
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/testing/btest/plugins/legacy-func-hook-plugin/src/Plugin.cc b/testing/btest/plugins/legacy-func-hook-plugin/src/Plugin.cc
new file mode 100644
index 0000000000..c4f06fc651
--- /dev/null
+++ b/testing/btest/plugins/legacy-func-hook-plugin/src/Plugin.cc
@@ -0,0 +1,105 @@
+
+#include "Plugin.h"
+
+#include <Val.h>
+#include <Func.h>
+#include <Event.h>
+#include <Conn.h>
+#include <Desc.h>
+#include <threading/Formatter.h>
+
+namespace plugin { namespace Demo_Hooks { Plugin plugin; } }
+
+using namespace plugin::Demo_Hooks;
+
+plugin::Configuration Plugin::Configure()
+	{
+	EnableHook(HOOK_CALL_FUNCTION);
+	EnableHook(META_HOOK_PRE);
+	EnableHook(META_HOOK_POST);
+
+	plugin::Configuration config;
+	config.name = "Demo::Hooks";
+	config.description = "Exercises all plugin hooks";
+	config.version.major = 1;
+	config.version.minor = 0;
+	config.version.patch = 0;
+	return config;
+	}
+
+static void describe_hook_args(const plugin::HookArgumentList& args, ODesc* d)
+	{
+	bool first = true;
+
+	for ( plugin::HookArgumentList::const_iterator i = args.begin(); i != args.end(); i++ )
+		{
+		if ( ! first )
+			d->Add(", ");
+
+		i->Describe(d);
+		first = false;
+		}
+	}
+
+std::pair<bool, Val*> Plugin::HookCallFunction(const Func* func, Frame* frame, val_list* args)
+	{
+	ODesc d;
+	d.SetShort();
+	HookArgument(func).Describe(&d);
+	HookArgument(args).Describe(&d);
+	fprintf(stderr, "%.6f %-15s %s\n", network_time, "| HookCallFunction",
+		d.Description());
+
+	if ( streq(func->Name(), "foo") )
+		{
+		auto& vl = *args;
+		Unref(vl[0]);
+		vl[0] = val_mgr->Count(13).release();
+		}
+
+	return {};
+	}
+
+/* std::pair<bool, IntrusivePtr<Val>> Plugin::HookFunctionCall(const Func* func, */
+/*                                                             Frame* frame, */
+/*                                                             zeek::Args* args) */
+/* 	{ */
+/* 	ODesc d; */
+/* 	d.SetShort(); */
+/* 	HookArgument(func).Describe(&d); */
+/* 	HookArgument(args).Describe(&d); */
+/* 	fprintf(stderr, "%.6f %-15s %s\n", network_time, "| HookFunctionCall", */
+/* 		d.Description()); */
+
+/* 	if ( streq(func->Name(), "foo") ) */
+/* 		{ */
+/* 		auto& vl = *args; */
+/* 		vl[0] = val_mgr->Count(42); */
+/* 		} */
+
+/* 	return {}; */
+/* 	} */
+
+void Plugin::MetaHookPre(HookType hook, const HookArgumentList& args)
+	{
+	ODesc d;
+	d.SetShort();
+	describe_hook_args(args, &d);
+	fprintf(stderr, "%.6f %-15s %s(%s)\n", network_time, "  MetaHookPre",
+		hook_name(hook), d.Description());
+	}
+
+void Plugin::MetaHookPost(HookType hook, const HookArgumentList& args, HookArgument result)
+	{
+	ODesc d1;
+	d1.SetShort();
+	describe_hook_args(args, &d1);
+
+	ODesc d2;
+	d2.SetShort();
+	result.Describe(&d2);
+
+	fprintf(stderr, "%.6f %-15s %s(%s) -> %s\n", network_time, "  MetaHookPost",
+		hook_name(hook), d1.Description(),
+		d2.Description());
+	}
diff --git a/testing/btest/plugins/legacy-func-hook-plugin/src/Plugin.h b/testing/btest/plugins/legacy-func-hook-plugin/src/Plugin.h
new file mode 100644
index 0000000000..305192b31e
--- /dev/null
+++ b/testing/btest/plugins/legacy-func-hook-plugin/src/Plugin.h
@@ -0,0 +1,28 @@
+
+#pragma once
+
+#include <plugin/Plugin.h>
+
+namespace plugin {
+namespace Demo_Hooks {
+
+class Plugin : public ::plugin::Plugin
+{
+protected:
+	std::pair<bool, Val*> HookCallFunction(const Func* func, Frame* frame, val_list* args) override;
+
+	/* std::pair<bool, IntrusivePtr<Val>> HookFunctionCall(const Func* func, */
+	/*                                                     Frame* frame, */
+	/*                                                     zeek::Args* args) override; */
+
+	void MetaHookPre(HookType hook, const HookArgumentList& args) override;
+	void MetaHookPost(HookType hook, const HookArgumentList& args, HookArgument result) override;
+
+	// Overridden from plugin::Plugin.
+	plugin::Configuration Configure() override;
+};
+
+extern Plugin plugin;
+
+}
+}
diff --git a/testing/btest/plugins/legacy-func-hook.zeek b/testing/btest/plugins/legacy-func-hook.zeek
new file mode 100644
index 0000000000..75e6301d6f
--- /dev/null
+++ b/testing/btest/plugins/legacy-func-hook.zeek
@@ -0,0 +1,17 @@
+# @TEST-EXEC: ${DIST}/aux/zeek-aux/plugin-support/init-plugin -u . Demo Hooks
+# @TEST-EXEC: cp -r %DIR/legacy-func-hook-plugin/* .
+# @TEST-EXEC: ./configure --zeek-dist=${DIST} && make
+# @TEST-EXEC: ZEEK_PLUGIN_ACTIVATE="Demo::Hooks" ZEEK_PLUGIN_PATH=`pwd` zeek -b %INPUT 2>&1 | grep foo >output
+# @TEST-EXEC: btest-diff output
+
+@unload base/misc/version
+
+function foo(a: count, b: count, c: count, s: string)
+	{
+	print "foo", a, b, c, s;
+	}
+
+event zeek_init()
+	{
+	foo(1, 2, 3, "yo");
+	}
diff --git a/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac b/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac
index 1ef3650e84..0c1fdbfa1a 100644
--- a/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac
+++ b/testing/btest/plugins/protocol-plugin/src/foo-analyzer.pac
@@ -4,7 +4,7 @@ refine connection Foo_Conn += {
 	function Foo_data(msg: Foo_Message): bool
 		%{
 		auto data = make_intrusive<StringVal>(${msg.data}.length(), (const char*) ${msg.data}.data());
-		BifEvent::enqueue_foo_message(bro_analyzer(), bro_analyzer()->Conn(), std::move(data));
+		zeek::BifEvent::enqueue_foo_message(bro_analyzer(), bro_analyzer()->Conn(), std::move(data));
 		return true;
 		%}